<?php
/* wppa-input.php
* Package: wp-photo-album-plus
*
* Contains functions for sanitizing and formatting user input
* Version 8.0.08.007
*
*/

/* CHECK REDIRECTION */
add_action( 'plugins_loaded', 'wppa_redirect', '1' );

function wppa_redirect() {

	if ( ! isset( $_SERVER["REQUEST_URI"] ) ) return;

	$uri = $_SERVER["REQUEST_URI"];
	$wppapos = stripos( $uri, '/wppaspec/' );
	if ( $wppapos === false ) {

		$wppapos = strpos( $uri, '/-/' );
		if ( wppa_get_option( 'wppa_use_pretty_links' ) != 'compressed' ) {
			$wppapos = false;
		}
	}

	if ( $wppapos !== false && wppa_get_option( 'permalink_structure' ) ) {

		// old style solution, still required when qTranslate is active
		$plugins = implode( ',', wppa_get_option( 'active_plugins' ) );
		if ( stripos( $plugins, 'qtranslate' ) !== false ) {

			$newuri = wppa_convert_from_pretty( $uri );
			if ( $newuri == $uri ) return;

			// Although the url is urlencoded it is damaged by wp_redirect when it contains chars like ë, so we do a header() call
			header( 'Location: '.$newuri, true, 302 );
			exit;
		}

		// New style solution
		$newuri = wppa_convert_from_pretty( $uri );
		if ( $newuri == $uri ) return;
		$_SERVER["REQUEST_URI"] = $newuri;
		wppa_convert_uri_to_get( $newuri );
	}
}

// Gert the filter slug to use for the querystring var
function wppa_get_get_filter( $name ) {

	switch ( $name ) {

		// Integer
		case 'occur':
		case 'topten':
		case 'lasten':
		case 'comten':
		case 'featen':
		case 'relcount':
		case 'page':
		case 'page_id':
		case 'caldate':
		case 'size':
		case 'fromp':
		case 'forceroot':
		case 'comment-id':
		case 'upload-album':
		case 'user':
		case 'rating':
		case 'index':
		case 'next-after':
		case 'commentid':
		case 'bulk-album':
		case 'set-album':
		case 'photo-album':
		case 'video-album':
		case 'audio-album':
		case 'document-album':
		case 'del-id':
		case 'move-album':
		case 'parent-id':
		case 'is-sibling-of':
		case 'sub':
		case 'subtab':
		case 'pano-val':
		case 'album-page-no':
			$result = 'int';
			break;

		// Array of integers
		case 'commentids':
			$result = 'intarr';
			break;

		// Boolean
		case 'cover':
		case 'slide':
		case 'slideonly':
		case 'filmonly':
		case 'single':
		case 'photos-only':
		case 'albums-only':
		case 'medals-only':
		case 'rel':
		case 'rootsearch':
		case 'potdhis':
		case 'debug':
		case 'inv':
		case 'vt':
		case 'catbox':
		case 'resp':
		case 'quick':
		case 'continue':
		case 'del-after-p':
		case 'del-after-f':
		case 'del-after-a':
		case 'del-after-z':
		case 'del-after-v':
		case 'del-after-u':
		case 'del-after-c':
		case 'del-after-d':
		case 'del-dir':
		case 'use-backup':
		case 'update':
		case 'superview':
		case 'nodups':
		case 'raw':
		case 'bulk':
		case 'applynewdesc':
		case 'remakealbum':
			$result = 'bool';
			break;

		// Searchstring
		case 'searchstring':
			$result = 'src';
			break;

		// Html
		case 'comment':
		case 'commenttext':
		case 'upn-description':
			$result = 'html';
			break;

		// Tags / Cats
		case 'tag':
		case 'upn-tags':
		case 'new-tags':
			$result = 'tags';
			break;

		// Custom data
		case 'custom_0':
		case 'custom_1':
		case 'custom_2':
		case 'custom_3':
		case 'custom_4':
		case 'custom_5':
		case 'custom_6':
		case 'custom_7':
		case 'custom_8':
		case 'custom_9':
			$result = 'custom';
			break;

		// Text
		case 'supersearch':
		case 'lang':
		case 'wppalocale':
		case 'calendar':
		case 'upldr':
		case 'owner':
		case 'nonce':
		case 'user-name': 	// Photo/video name supplied by user
		case 'user-desc': 	// Desc by user
		case 'ntfy-nonce':
		case 'qr-nonce':
		case 'crypt':
		case 'slug':
		case 'just-edit':
		case 'filter':
		case 'orderby':
		case 'order':
		case 'bulk-status':
		case 'bulk-owner':
		case 'watermark-file':
		case 'watermark-pos':
		case 'cre-album':
		case 'bulk-action':
		case 'action':
		case 'option':
		case 'local-remote':
		case 'upn-name':
		case 'del-confirm':
		case 'del-photos':
		case 'tab':
		case 'edit-id':
		case 'settings-submit':
		case 'key':
		case 'subtab':
		case 'switchto':
		case 'order_by':
		case 'comname':
		case 'value':
		case 'post-title':
		case 'blogit-pretext':
		case 'blogit-posttext':
		case 'update-check':
		case 'import-ajax-file':
		case 'import-submit':
		case 'delete':
		case 'cache':
			$result = 'text';
			break;

		// Possibly encrypted or nemed photo(s)
		case 'photo':
		case 'photos':
		case 'hilite':
		case 'photo-id':
		case 'rating-id':
			$result = 'pcrypt';
			break;

		// Possibly encrypted or nemed album
		case 'album':
			$result = 'acrypt';
			break;

		// Email
		case 'comemail':
			$result = 'email';
			break;

		// Url
		case 'url':
		case 'returnurl':
			$result = 'url';
			break;

		default:
			$result = 'raw';
			break;
	}

	return $result;
}

// Retrieve a get- or post- variable, sanitized and post-processed
function wppa_get( $xname, $default = false, $filter = false ) {
global $wpdb;

	// Save orig xname for debug
	$oxname = $xname;

	// Ajax call?
	if ( $xname == 'action' ) {
		if ( isset( $_REQUEST['wppa-action'] ) ) {
			return sanitize_text_field( $_REQUEST['wppa-action'] );
		}
	}

	// Normalize $name and $xname
	if ( substr( $xname, 0, 5 ) == 'wppa-' ) {
		$name = substr( $xname, 5 );
	}
	else {
		$name = $xname;
		$xname = 'wppa-' . $name;
	}

	// Get the value
	if ( $name == 'page' ) { 		// Admin page is not the wppa pageno
		if ( isset( $_REQUEST[$xname] ) ) {
			$value = $_REQUEST[$xname];
		}
	}
	else {
		$value = isset( $_REQUEST[$name] ) ? $_REQUEST[$name] : null;
	}
	if ( ! isset( $value ) ) $value = isset( $_REQUEST[$xname] ) ? $_REQUEST[$xname] : null;
	if ( ! isset( $value ) ) return $default;

	// Get the right filter
	if ( ! $filter ) {
		$filter = wppa_get_get_filter( $name );
	}

	// Do the filtering
	switch ( $filter ) {

		case 'int':
			$result = strval( intval ( $value ) );
			break;

		case 'posint':
			$result = max( '1', strval( intval ( $value ) ) );
			break;

		case 'intarr':
			if ( is_array( $value ) ) {
				foreach( array_keys( $value ) as $i ) {
					$value[$i] = strval( intval( $value[$i] ) );
				}
			}
			else {
				$value = strval( intval( $value ) );
			}
			$result = $value;
			break;

		case 'bool':
			if ( $value !== '0' && $value != 'nil' && $value != 'no' ) {
				$result = '1';
			}
			else {
				$result = '0';
			}
			break;

		case 'src':
			$result = wppa_sanitize_searchstring( $value );
			break;

		case 'html':
			$result = force_balance_tags( $value );
			break;

		case 'tag':
		case 'tags':
		case 'cat':
			$result = trim( wppa_sanitize_tags( $value ), ',' );
			break;

		case 'custom':
			$result = wppa_sanitize_custom_field( $value );
			break;

		case 'text':
			$result = $value;
			break;

		case 'pcrypt':
			$result = wppa_decode_photo( trim( $value, '/' ) );
			break;

		case 'acrypt':
			$result = wppa_decode_album( trim( $value, '/' ) );
			break;

		case 'email':
			$result = sanitize_email( $value );
			break;

		case 'url':
			$result = esc_url_raw( $value );
			break;

		case 'raw':
			$result = $value;
			wppa_log( 'obs', 'Unfiltered (raw) querystring arg= ' . $name . ', value=  ' . var_export( $value, true ) );
			break;

		default:
			$result = $value;
			wppa_log( 'obs', 'Unknown filter for querystring arg= ' . $name . ', value=  ' . var_export( $value, true ) );
			break;
	}

	return $result;
}

// Sanitize a searchstring
function wppa_sanitize_searchstring( $str ) {

	$result = $str;
	$result = strip_tags( $result );
	$result = stripslashes( $result );
	$result = str_replace( array( "'", '"', ':', ), '', $result );
	$temp 	= explode( ',', $result );
	foreach ( array_keys( $temp ) as $key ) {
		$temp[$key] = trim( $temp[$key] );
	}
	$result = implode( ',', $temp );

	return $result;
}