<?php
/**
 * VMPFence Malicious File Viewer
 *
 * @package VMPFence
 * @since 1.0.0
 * @since 2.0.0 Updated to reflect VMP WordPress Security branding.
 * @since 2.2.2 Updated to reflect VMP Security branding.
 */

// Prevent direct access
if (!defined('ABSPATH')) {
    exit;
}

// Variables should be available from the calling function
$file_content = file_get_contents($full_file_path);
$safe_content = htmlspecialchars($file_content);
$filename = basename($full_file_path);
$file_size = filesize($full_file_path);
$lines = explode("\n", $file_content);
$line_count = count($lines);

// Parse line number from issue description
$highlighted_line = 0;
$malware_pattern = '';
if (isset($issue['description'])) {
    // Look for "at line X" pattern in description
    if (preg_match('/at line (\d+)/i', $issue['description'], $matches)) {
        $highlighted_line = intval($matches[1]);
    }
    // Also try "Line X" pattern
    if (!$highlighted_line && preg_match('/Line (\d+)/i', $issue['description'], $matches)) {
        $highlighted_line = intval($matches[1]);
    }
    // Extract the malware pattern if available
    if (preg_match('/"([^"]+)".*detected/i', $issue['description'], $matches)) {
        $malware_pattern = $matches[1];
    }
}
?>
<!DOCTYPE html>
<html <?php language_attributes(); ?>>
<head>
    <meta charset="<?php bloginfo('charset'); ?>">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <title>VMP Security - View Malicious File: <?php echo esc_html($filename); ?></title>
    <?php
    // Load CSS from external file for standalone page
    $css_file = plugin_dir_path(dirname(__FILE__)) . 'assets/css/view-malicious-file.css';
    $css_content = file_exists($css_file) ? file_get_contents($css_file) : '';
    ?>
    <style><?php echo $css_content; /* phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CSS from plugin file */ ?></style>
    <?php
    // Enqueue JavaScript file
    wp_enqueue_script(
        'vmpfence-view-malicious-file',
        plugin_dir_url(dirname(__FILE__)) . 'assets/js/view-malicious-file.js',
        array(),
        VMPFENCE_VERSION,
        true
    );
    wp_print_scripts('vmpfence-view-malicious-file');
    ?>
</head>
<body data-is-php="<?php echo esc_attr( pathinfo($filename, PATHINFO_EXTENSION) === 'php' ? 'true' : 'false' ); ?>" data-highlighted-line="<?php echo esc_attr( $highlighted_line ); ?>">
    <div class="header">
        <h1>🦠 VMP Security Malicious File Viewer</h1>
        <div class="file-info">
            <div class="info-item">
                <div class="info-label">File Path</div>
                <div class="info-value"><?php echo esc_html($full_file_path); ?></div>
            </div>
            <div class="info-item">
                <div class="info-label">File Name</div>
                <div class="info-value"><?php echo esc_html($filename); ?></div>
            </div>
            <div class="info-item">
                <div class="info-label">File Size</div>
                <div class="info-value"><?php echo number_format($file_size); ?> bytes</div>
            </div>
            <div class="info-item">
                <div class="info-label">Lines</div>
                <div class="info-value"><?php echo number_format($line_count); ?></div>
            </div>
            <?php if ($highlighted_line > 0): ?>
            <div class="info-item">
                <div class="info-label">Malware Line</div>
                <div class="info-value" style="color: #ff6b6b; font-weight: bold;">Line <?php echo esc_html( $highlighted_line ); ?></div>
            </div>
            <?php endif; ?>
            <?php if (!empty($malware_pattern)): ?>
            <div class="info-item">
                <div class="info-label">Pattern Detected</div>
                <div class="info-value" style="color: #ff6b6b; font-weight: bold;"><?php echo esc_html($malware_pattern); ?></div>
            </div>
            <?php endif; ?>
            <div class="info-item">
                <div class="info-label">Issue Type</div>
                <div class="info-value"><?php echo esc_html($issue['issue_type']); ?> - <?php echo esc_html($issue['type']); ?></div>
            </div>
            <div class="info-item">
                <div class="info-label">Detected</div>
                <div class="info-value"><?php echo esc_html($issue['detected_time']); ?></div>
            </div>
        </div>
    </div>

    <div class="warning-banner">
        <strong>⚠️ Security Warning:</strong> This file has been flagged as potentially malicious by VMP Security. 
        Exercise extreme caution when reviewing this content. Do not execute or modify this file unless you are 
        certain about its safety and purpose.
    </div>

    <div class="content">
        <div class="code-header">
            File Content Preview
        </div>
        <div class="code-container">
            <div class="line-numbers">
                <?php for ($i = 1; $i <= $line_count; $i++): ?>
                    <span class="line-number<?php echo esc_attr( ($i == $highlighted_line) ? ' highlighted' : '' ); ?>" id="line-<?php echo esc_attr( $i ); ?>"><?php echo esc_html( $i ); ?></span>
                <?php endfor; ?>
            </div>
            <div class="code-content">
                <?php 
                foreach ($lines as $line_num => $line) {
                    $line_number = $line_num + 1;
                    $safe_line = htmlspecialchars($line);
                    
                    // Highlight malware pattern in the line if we know what it is
                    if ($line_number == $highlighted_line && !empty($malware_pattern)) {
                        $safe_line = str_replace(
                            htmlspecialchars($malware_pattern), 
                            '<span class="malware-highlight">' . htmlspecialchars($malware_pattern) . '</span>', 
                            $safe_line
                        );
                    }
                    
                    $line_class = ($line_number == $highlighted_line) ? 'code-line highlighted' : 'code-line';
                    
                    // Allow only span tags with class attribute for malware highlighting
                    $allowed_html = array(
                        'span' => array(
                            'class' => array()
                        )
                    );
                    
                    echo '<span class="' . esc_attr( $line_class ) . '" id="code-line-' . esc_attr( $line_number ) . '">' . wp_kses( $safe_line, $allowed_html ) . '</span>' . "\n";
                }
                ?>
            </div>
        </div>
    </div>

    <a href="javascript:history.back()" class="back-link">← Back to Scan Results</a>

</body>
</html>