<?php
/**
 * Sanitize
 *
 * @package Sanitize
 */

defined( 'ABSPATH' ) || exit( 'Please don&rsquo;t call the plugin directly. Thanks :)' );

/**
 * Sanitize options fields
 *
 * @param array $input Input.
 *
 * @return array Sanitized input.
 */
function seopress_sanitize_options_fields( $input ) {
	$seopress_sanitize_fields = array(
		'seopress_social_facebook_img_attachment_id',
		'seopress_social_facebook_img_attachment_width',
		'seopress_social_facebook_img_attachment_height',
		'seopress_titles_sep',
		'seopress_titles_home_site_title',
		'seopress_titles_home_site_title_alt',
		'seopress_titles_home_site_desc',
		'seopress_titles_archives_author_title',
		'seopress_titles_archives_author_desc',
		'seopress_titles_archives_date_title',
		'seopress_titles_archives_date_desc',
		'seopress_titles_archives_search_title',
		'seopress_titles_archives_search_desc',
		'seopress_titles_archives_404_title',
		'seopress_titles_archives_404_desc',
		'seopress_xml_sitemap_html_exclude',
		'seopress_xml_sitemap_html_mapping',
		'seopress_social_knowledge_name',
		'seopress_social_knowledge_img',
		'seopress_social_knowledge_desc',
		'seopress_social_knowledge_email',
		'seopress_social_knowledge_phone',
		'seopress_social_knowledge_tax_id',
		'seopress_social_knowledge_legal_name',
		'seopress_social_knowledge_founding_date',
		'seopress_social_knowledge_employees',
		'seopress_social_knowledge_street',
		'seopress_social_knowledge_locality',
		'seopress_social_knowledge_region',
		'seopress_social_knowledge_postal_code',
		'seopress_social_knowledge_country',
		'seopress_social_knowledge_user_id',
		'seopress_social_accounts_facebook',
		'seopress_social_accounts_twitter',
		'seopress_social_accounts_pinterest',
		'seopress_social_accounts_instagram',
		'seopress_social_accounts_youtube',
		'seopress_social_accounts_linkedin',
		'seopress_social_accounts_extra',
		'seopress_social_facebook_link_ownership_id',
		'seopress_social_facebook_app_id',
		'seopress_google_analytics_ga4',
		'seopress_google_analytics_download_tracking',
		'seopress_google_analytics_opt_out_msg',
		'seopress_google_analytics_opt_out_msg_ok',
		'seopress_google_analytics_opt_out_msg_close',
		'seopress_google_analytics_opt_out_msg_edit',
		'seopress_google_analytics_other_tracking',
		'seopress_google_analytics_other_tracking_body',
		'seopress_google_analytics_other_tracking_footer',
		'seopress_google_analytics_ads',
		'seopress_google_analytics_matomo_id',
		'seopress_google_analytics_matomo_site_id',
		'seopress_google_analytics_matomo_cross_domain_sites',
		'seopress_google_analytics_cb_backdrop_bg',
		'seopress_google_analytics_cb_exp_date',
		'seopress_google_analytics_cb_bg',
		'seopress_google_analytics_cb_txt_col',
		'seopress_google_analytics_cb_lk_col',
		'seopress_google_analytics_cb_btn_bg',
		'seopress_google_analytics_cb_btn_col',
		'seopress_google_analytics_cb_btn_bg_hov',
		'seopress_google_analytics_cb_btn_col_hov',
		'seopress_google_analytics_cb_btn_sec_bg',
		'seopress_google_analytics_cb_btn_sec_col',
		'seopress_google_analytics_cb_btn_sec_bg_hov',
		'seopress_google_analytics_cb_btn_sec_col_hov',
		'seopress_google_analytics_cb_width',
		'seopress_instant_indexing_bing_api_key',
		'seopress_instant_indexing_manual_batch',
		'seopress_google_analytics_clarity_project_id',
		'seopress_google_analytics_matomo_widget_auth_token',
		// 'seopress_instant_indexing_google_api_key',
	);

	$seopress_sanitize_site_verification = array(
		'seopress_advanced_advanced_google',
		'seopress_advanced_advanced_bing',
		'seopress_advanced_advanced_pinterest',
		'seopress_advanced_advanced_yandex',
		'seopress_advanced_advanced_baidu',
		'seopress_advanced_advanced_facebook',
		'seopress_advanced_advanced_seznam',
	);

	$new_options = array( 'seopress_social_facebook_img_attachment_id', 'seopress_social_facebook_img_height', 'seopress_social_facebook_img_width' );

	foreach ( $new_options as $key => $value ) {
		if ( ! isset( $input[ $value ] ) && isset( $_POST[ $value ] ) ) {
			$input[ $value ] = $_POST[ $value ];
		}
	}

	foreach ( $seopress_sanitize_fields as $value ) {
		if ( ! empty( $input['seopress_google_analytics_matomo_widget_auth_token'] ) && 'seopress_google_analytics_matomo_widget_auth_token' === $value ) {
			$options = get_option( 'seopress_google_analytics_option_name' );

			$token = isset( $options['seopress_google_analytics_matomo_widget_auth_token'] ) ? $options['seopress_google_analytics_matomo_widget_auth_token'] : null;

			$input[ $value ] = $input[ $value ] === 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx' ? $token : sanitize_text_field( $input[ $value ] );
		} elseif ( ! empty( $input['seopress_google_analytics_opt_out_msg'] ) && 'seopress_google_analytics_opt_out_msg' === $value ) {
			$args            = array(
				'strong' => array(),
				'em'     => array(),
				'br'     => array(),
				'a'      => array(
					'href'   => array(),
					'target' => array(),
				),
			);
			$input[ $value ] = wp_kses( $input[ $value ], $args );
		} elseif ( ( ! empty( $input['seopress_google_analytics_other_tracking'] ) && 'seopress_google_analytics_other_tracking' === $value ) || ( ! empty( $input['seopress_google_analytics_other_tracking_body'] ) && 'seopress_google_analytics_other_tracking_body' === $value ) || ( ! empty( $input['seopress_google_analytics_other_tracking_footer'] ) && 'seopress_google_analytics_other_tracking_footer' === $value ) ) {
			if ( current_user_can( 'unfiltered_html' ) ) {
				$input[ $value ] = $input[ $value ]; // No sanitization for this field.
			} else {
				$options         = get_option( 'seopress_google_analytics_option_name' );
				$input[ $value ] = isset( $options[ $value ] ) ? $options[ $value ] : '';
			}
		} elseif ( ( ! empty( $input['seopress_instant_indexing_manual_batch'] ) && 'seopress_instant_indexing_manual_batch' === $value ) || ( ! empty( $input['seopress_social_accounts_extra'] ) && 'seopress_social_accounts_extra' === $value ) ) {
			$input[ $value ] = sanitize_textarea_field( $input[ $value ] );
		} elseif ( ( ! empty( $input['seopress_social_accounts_facebook'] ) && 'seopress_social_accounts_facebook' === $value ) || ( ! empty( $input['seopress_social_accounts_pinterest'] ) && 'seopress_social_accounts_pinterest' === $value ) || ( ! empty( $input['seopress_social_accounts_instagram'] ) && 'seopress_social_accounts_instagram' === $value ) || ( ! empty( $input['seopress_social_accounts_youtube'] ) && 'seopress_social_accounts_youtube' === $value ) || ( ! empty( $input['seopress_social_accounts_linkedin'] ) && 'seopress_social_accounts_linkedin' === $value ) ) {
			$input[ $value ] = sanitize_url( $input[ $value ] );
		} elseif ( ( ! empty( $input['seopress_social_knowledge_email'] ) && 'seopress_social_knowledge_email' === $value ) ) {
			$input[ $value ] = sanitize_email( $input[ $value ] );
		} elseif ( isset( $input['seopress_social_knowledge_user_id'] ) && 'seopress_social_knowledge_user_id' === $value ) {
			$input[ $value ] = absint( $input[ $value ] );
		} elseif ( isset( $input['seopress_social_knowledge_employees'] ) && 'seopress_social_knowledge_employees' === $value ) {
			$input[ $value ] = '' !== $input[ $value ] ? absint( $input[ $value ] ) : '';
		} elseif ( ( ! empty( $input['seopress_social_accounts_twitter'] ) && 'seopress_social_accounts_twitter' === $value ) ) {
			$input[ $value ] = sanitize_text_field( $input[ $value ] );
			// Ensure Twitter handle starts with @.
			if ( strpos( $input[ $value ], '@' ) !== 0 ) {
				$input[ $value ] = '@' . ltrim( $input[ $value ], '@' );
			}
		} elseif ( ! empty( $input[ $value ] ) ) {
			// Title/description templates and the separator carry user-meaningful
			// whitespace (e.g. " - " around %%sep%%, leading/trailing spaces around
			// tokens). sanitize_text_field() trims and collapses spaces, so it
			// would silently rewrite the saved template. Strip tags + line breaks
			// and keep the rest verbatim.
			$preserve_whitespace_fields = array(
				'seopress_titles_sep',
				'seopress_titles_home_site_title',
				'seopress_titles_home_site_title_alt',
				'seopress_titles_home_site_desc',
				'seopress_titles_archives_author_title',
				'seopress_titles_archives_author_desc',
				'seopress_titles_archives_date_title',
				'seopress_titles_archives_date_desc',
				'seopress_titles_archives_search_title',
				'seopress_titles_archives_search_desc',
				'seopress_titles_archives_404_title',
				'seopress_titles_archives_404_desc',
			);
			if ( in_array( $value, $preserve_whitespace_fields, true ) ) {
				// Mirror wp_strip_all_tags() (script/style block removal +
				// strip_tags) without its trailing trim(), so user spaces
				// around the separator and around tokens survive. Line breaks
				// and control characters are dropped.
				$stripped        = preg_replace( '@<(script|style)[^>]*?>.*?</\1>@si', '', (string) $input[ $value ] );
				$stripped        = strip_tags( $stripped );
				$stripped        = preg_replace( '/[\r\n\t]+/', '', $stripped );
				$input[ $value ] = preg_replace( '/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/', '', $stripped );
			} else {
				$input[ $value ] = sanitize_text_field( $input[ $value ] );
			}
		}
	}

	foreach ( $seopress_sanitize_site_verification as $value ) {
		if ( ! empty( $input[ $value ] ) ) {
			if ( preg_match( '#content=\'([^"]+)\'#', $input[ $value ], $m ) ) {
				$input[ $value ] = esc_attr( $m[1] );
			} elseif ( preg_match( '#content="([^"]+)"#', $input[ $value ], $m ) ) {
				$input[ $value ] = esc_attr( $m[1] );
			} else {
				$input[ $value ] = esc_attr( $input[ $value ] );
			}
		}
	}

	return $input;
}
