<?php
/**
 * WP Multi – Modul: Kommentarfilter (Telefon/E-Mail/URL/IP/Schimpfwörter)
 *
 * Automatisch aus wp-multi.php ausgelagert. Wird über den Loader in
 * wp-multi.php eingebunden (nur wenn das WP Multi Toolkit aktiv ist).
 */

if (!defined('ABSPATH')) { exit; }

/*
* Kommentarfilter: Telefonnummern, E-Mails, URLs, IPs und Schimpfwörter
*/

// Einstellungen für den Kommentarfilter registrieren (auf der bestehenden "Sicherheit"-Seite)
function wp_multi_comment_filter_register_settings() {
    register_setting('wp_multi_security_settings', 'wp_multi_filter_phone', ['sanitize_callback' => 'absint', 'default' => 0]);
    register_setting('wp_multi_security_settings', 'wp_multi_filter_email', ['sanitize_callback' => 'absint', 'default' => 0]);
    register_setting('wp_multi_security_settings', 'wp_multi_filter_url', ['sanitize_callback' => 'absint', 'default' => 0]);
    register_setting('wp_multi_security_settings', 'wp_multi_filter_ip', ['sanitize_callback' => 'absint', 'default' => 0]);
    register_setting('wp_multi_security_settings', 'wp_multi_filter_swearwords', ['sanitize_callback' => 'absint', 'default' => 0]);

    add_settings_section(
        'wp_multi_comment_filter_section',
        __('Kommentarfilter', 'wp-multi'),
        'wp_multi_comment_filter_section_callback',
        'wp-multi-security'
    );

    add_settings_field('wp_multi_filter_phone', __('Telefonnummern filtern', 'wp-multi'), 'wp_multi_filter_phone_callback', 'wp-multi-security', 'wp_multi_comment_filter_section');
    add_settings_field('wp_multi_filter_email', __('E-Mail-Adressen filtern', 'wp-multi'), 'wp_multi_filter_email_callback', 'wp-multi-security', 'wp_multi_comment_filter_section');
    add_settings_field('wp_multi_filter_url', __('URLs filtern', 'wp-multi'), 'wp_multi_filter_url_callback', 'wp-multi-security', 'wp_multi_comment_filter_section');
    add_settings_field('wp_multi_filter_ip', __('IP-Adressen filtern', 'wp-multi'), 'wp_multi_filter_ip_callback', 'wp-multi-security', 'wp_multi_comment_filter_section');
    add_settings_field('wp_multi_filter_swearwords', __('Schimpfwörter filtern', 'wp-multi'), 'wp_multi_filter_swearwords_callback', 'wp-multi-security', 'wp_multi_comment_filter_section');
}
add_action('admin_init', 'wp_multi_comment_filter_register_settings');

function wp_multi_comment_filter_section_callback() {
    echo '<p>' . esc_html__('Lege fest, welche Inhalte in Kommentaren automatisch durch * ersetzt werden, statt den ganzen Kommentar zu blockieren.', 'wp-multi') . '</p>';
}

function wp_multi_filter_phone_callback() {
    ?>
    <input type="checkbox" name="wp_multi_filter_phone" value="1" <?php checked(1, get_option('wp_multi_filter_phone', 0)); ?>>
    <?php
}

function wp_multi_filter_email_callback() {
    ?>
    <input type="checkbox" name="wp_multi_filter_email" value="1" <?php checked(1, get_option('wp_multi_filter_email', 0)); ?>>
    <?php
}

function wp_multi_filter_url_callback() {
    ?>
    <input type="checkbox" name="wp_multi_filter_url" value="1" <?php checked(1, get_option('wp_multi_filter_url', 0)); ?>>
    <?php
}

function wp_multi_filter_ip_callback() {
    ?>
    <input type="checkbox" name="wp_multi_filter_ip" value="1" <?php checked(1, get_option('wp_multi_filter_ip', 0)); ?>>
    <?php
}

function wp_multi_filter_swearwords_callback() {
    ?>
    <input type="checkbox" name="wp_multi_filter_swearwords" value="1" <?php checked(1, get_option('wp_multi_filter_swearwords', 0)); ?>>
    <small><?php esc_html_e('Nutzt die Wortliste aus includes/bad-words.json.', 'wp-multi'); ?></small>
    <?php
}

// Lädt die Schimpfwortliste aus includes/bad-words.json (gecached via Transient)
function wp_multi_get_bad_words() {
    $cache_key = 'wp_multi_bad_words';
    $words = get_transient($cache_key);
    if ($words !== false) {
        return $words;
    }

    $words = [];
    $file_path = plugin_dir_path(WP_MULTI_FILE) . 'includes/bad-words.json';
    if (file_exists($file_path)) {
        $data = json_decode(file_get_contents($file_path), true);
        if (is_array($data) && !empty($data['words']) && is_array($data['words'])) {
            $words = $data['words'];
        }
    }

    set_transient($cache_key, $words, DAY_IN_SECONDS);
    return $words;
}

// Baut die (teuren) Regex-Patterns aus der Schimpfwortliste und cached sie.
// Die Wortliste hat mehrere tausend Einträge - in ein einziges Regex gepackt
// überschreitet das die PCRE-Größenlimits, daher wird in Blöcken gearbeitet.
function wp_multi_get_bad_words_patterns() {
    $cache_key = 'wp_multi_bad_words_patterns';
    $patterns = get_transient($cache_key);
    if ($patterns !== false) {
        return $patterns;
    }

    $words = wp_multi_get_bad_words();
    $patterns = [];
    foreach (array_chunk($words, 500) as $chunk) {
        $patterns[] = '/\b(' . implode('|', array_map('preg_quote', $chunk)) . ')\b/iu';
    }

    set_transient($cache_key, $patterns, DAY_IN_SECONDS);
    return $patterns;
}

// Ersetzt einen Regex-Treffer durch eine gleich lange Folge von *
function wp_multi_mask_match($matches) {
    $match = $matches[0];
    return str_repeat('*', function_exists('mb_strlen') ? mb_strlen($match) : strlen($match));
}

// Wendet den Kommentarfilter (Telefon, E-Mail, URL, IP, Schimpfwörter) auf einen Text an
function wp_multi_apply_comment_content_filter($content) {
    if (get_option('wp_multi_filter_phone', 0)) {
        $content = preg_replace_callback('/(?:\+?\d[\d\s\-\/\(\)]{6,}\d)/', 'wp_multi_mask_match', $content);
    }

    if (get_option('wp_multi_filter_email', 0)) {
        $content = preg_replace_callback('/[a-zA-Z0-9._%+\-]+@[a-zA-Z0-9.\-]+\.[a-zA-Z]{2,}/', 'wp_multi_mask_match', $content);
    }

    if (get_option('wp_multi_filter_url', 0)) {
        $content = preg_replace_callback('#\b(?:https?://|www\.)[^\s<>"]+#i', 'wp_multi_mask_match', $content);
    }

    if (get_option('wp_multi_filter_ip', 0)) {
        $content = preg_replace_callback('/\b(?:\d{1,3}\.){3}\d{1,3}\b/', 'wp_multi_mask_match', $content);
    }

    if (get_option('wp_multi_filter_swearwords', 0)) {
        foreach (wp_multi_get_bad_words_patterns() as $pattern) {
            $content = preg_replace_callback($pattern, 'wp_multi_mask_match', $content);
        }
    }

    return $content;
}








