<?php
/**
 * XSPEED_DROPIN
 * Drop-in cache loader. Serves cached HTML before WordPress fully boots.
 *
 * IMPORTANT: This file is included by wp-settings.php BEFORE
 * wp-includes/formatting.php and wp-includes/load.php are loaded, so NO
 * WordPress functions (sanitize_text_field, wp_unslash, is_admin,
 * HOUR_IN_SECONDS, etc.) are available here. Use raw PHP only.
 *
 * @package XSpeed
 */

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

// Only handle plain GET requests.
// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Drop-in runs before wp-includes/formatting.php loads, so wp_unslash() and sanitize_text_field() are unavailable. Value is upper-cased and matched against the literal string 'GET'; never echoed, never executed.
$xspeed_method = isset( $_SERVER['REQUEST_METHOD'] ) ? strtoupper( (string) $_SERVER['REQUEST_METHOD'] ) : '';
if ( 'GET' !== $xspeed_method ) {
	return;
}

// Skip cached query-string requests (search, pagination via ?, etc.).
if ( ! empty( $_SERVER['QUERY_STRING'] ) ) {
	return;
}

// Honor explicit bypass header. xSpeed's own benchmark REST endpoint
// sends `X-XSpeed-Bypass: 1` so we can measure uncached TTFB for the
// before/after comparison on the dashboard. Harmless if a third party
// sends it — they just get an uncached response.
// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Drop-in runs before WP loads. Value is only used as an isset() check + literal string comparison, never echoed.
if ( ! empty( $_SERVER['HTTP_X_XSPEED_BYPASS'] ) ) {
	return;
}

if ( ! isset( $_SERVER['REQUEST_URI'] ) ) {
	return;
}

// Raw-PHP sanitization: strip null bytes only. This value is used for
// substring comparisons and as input to md5() — never echoed, never
// executed, never written to disk as data. Magic quotes was removed in
// PHP 5.4 and the plugin requires PHP 7.4+, so no unslashing is needed.
// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Drop-in runs before wp_unslash()/sanitize_text_field() are loaded; null-byte strip is the strongest sanitizer available pre-WP-bootstrap. Value is only used for substring comparison and as md5() input.
$xspeed_request_uri = str_replace( "\0", '', (string) $_SERVER['REQUEST_URI'] );

// Skip admin / login requests.
if ( false !== strpos( $xspeed_request_uri, '/wp-admin' ) || false !== strpos( $xspeed_request_uri, '/wp-login' ) ) {
	return;
}

// Skip logged-in users and comment authors — never serve a cached page to
// someone who has a session cookie. Reading raw cookies; we only inspect
// names, not values.
if ( ! empty( $_COOKIE ) ) {
	foreach ( $_COOKIE as $xspeed_cookie_name => $xspeed_cookie_value ) {
		unset( $xspeed_cookie_value );
		$xspeed_cookie_name = (string) $xspeed_cookie_name;
		if ( 0 === strpos( $xspeed_cookie_name, 'wordpress_logged_in' )
			|| 0 === strpos( $xspeed_cookie_name, 'comment_author_' )
			|| 0 === strpos( $xspeed_cookie_name, 'wp-postpass_' ) ) {
			return;
		}
	}
}

// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Drop-in runs before wp_unslash()/sanitize_text_field() are loaded. Value is filtered through a strict allowlist regex below (letters, digits, dot, hyphen, colon) and only used as md5() input for the cache key.
$xspeed_host = isset( $_SERVER['HTTP_HOST'] ) ? (string) $_SERVER['HTTP_HOST'] : 'default';
$xspeed_host = str_replace( "\0", '', $xspeed_host );
// Restrict host to a safe charset (letters, digits, dot, hyphen, colon for port).
$xspeed_host = preg_replace( '/[^a-zA-Z0-9.\-:]/', '', $xspeed_host );

$xspeed_path_only  = strtok( $xspeed_request_uri, '?' );

// Device bucket — MUST mirror XSpeed\Cache::cache_key() exactly, or the key
// the drop-in computes won't match the file Cache::store() wrote, the HIT
// branch below never fires, and every request falls through to a full
// WordPress boot (defeating the whole point of the pre-WP drop-in).
//
// Cache::cache_key() appends '|m' / '|d' when the cache module's
// `mobile_separate` setting is on. The drop-in can't read WP options
// (it runs before WordPress loads), so Cache writes a zero-byte sidecar
// flag — `.mobile-separate` next to the cache files — whenever that setting
// is on, and removes it when off (see Cache::sync_mobile_flag()). We mirror
// the same UA token list wp_is_mobile() uses, the same one Cache's inline
// fallback detector uses.
$xspeed_device = '';
if ( file_exists( WP_CONTENT_DIR . '/cache/xspeed/.mobile-separate' ) ) {
	// Mirror core's wp_is_mobile() EXACTLY (which Cache::is_mobile_request()
	// defers to): check the Sec-CH-UA-Mobile client hint first, then fall
	// back to the same UA token list. Any divergence from the engine's
	// detection re-introduces the key mismatch this whole flag exists to
	// prevent.
	$xspeed_is_mobile = false;
	if ( isset( $_SERVER['HTTP_SEC_CH_UA_MOBILE'] ) ) {
		// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Drop-in runs pre-WP. Value is compared against the literal '?1', never echoed or executed.
		$xspeed_is_mobile = ( '?1' === $_SERVER['HTTP_SEC_CH_UA_MOBILE'] );
	} else {
		// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Drop-in runs before wp_unslash()/sanitize_text_field() load. Value is only matched against a literal token regex, never echoed or executed.
		$xspeed_ua        = isset( $_SERVER['HTTP_USER_AGENT'] ) ? (string) $_SERVER['HTTP_USER_AGENT'] : '';
		$xspeed_is_mobile = (bool) preg_match( '/(Mobile|Android|Silk\/|Kindle|BlackBerry|Opera Mini|Opera Mobi)/i', $xspeed_ua );
	}
	$xspeed_device = $xspeed_is_mobile ? '|m' : '|d';
}

$xspeed_cache_key  = md5( $xspeed_host . $xspeed_path_only . $xspeed_device );
$xspeed_cache_file = WP_CONTENT_DIR . '/cache/xspeed/' . $xspeed_cache_key . '.html';

if ( file_exists( $xspeed_cache_file ) ) {
	// 24h TTL in seconds. HOUR_IN_SECONDS is a WordPress constant defined
	// after this drop-in loads, so use a literal here.
	$xspeed_age = time() - filemtime( $xspeed_cache_file );
	if ( $xspeed_age < 86400 ) {
		// PHP-served cache hit (the ~85ms fallback path). The nginx static
		// rewrite sends "HIT (nginx)" for the fast 5-15ms path; same header,
		// distinct value so you can tell which layer served the page.
		header( 'X-XSpeed-Cache: HIT (php)' );

		// Record the HIT for the dashboard hit-ratio. The drop-in runs
		// BEFORE WordPress loads, so it can't call Hit_Counter — instead
		// it appends one line to the same hits.log the nginx static path
		// uses, and Hit_Counter::collect_nginx_log_hits() drains + counts
		// both on the next dashboard load. Without this, every drop-in HIT
		// was served but never counted, so the hit ratio sat at 0.
		// Best-effort: a failed append must never break serving the page.
		//
		// Path is baked in at install time by Cache::install_dropin(), which
		// replaces the @@XSPEED_HITS_LOG@@ token on the next line with the
		// resolved absolute path (uploads/xspeed/hits.log — NOT the cache dir,
		// which gets deleted on purge/uninstall and would take nginx down,
		// FBS-82478). The default below is the fallback for an un-substituted
		// drop-in (e.g. run straight from a dev source checkout); the installed
		// copy always carries the absolute uploads path.
		$xspeed_hits_log = '@@XSPEED_HITS_LOG@@'; // replaced at install
		if ( '@@' === substr( $xspeed_hits_log, 0, 2 ) ) {
			$xspeed_hits_log = WP_CONTENT_DIR . '/uploads/xspeed/hits.log';
		}
		// phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged, WordPress.WP.AlternativeFunctions.file_system_operations_file_put_contents -- pre-WP drop-in; WP_Filesystem isn't loaded. One short line, append + lock; failures are non-fatal (the ratio just under-counts).
		@file_put_contents( $xspeed_hits_log, "hit\n", FILE_APPEND | LOCK_EX );

		// phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_readfile -- Drop-in runs before WP_Filesystem is available; readfile is optimal for streaming a static cache file to the visitor.
		readfile( $xspeed_cache_file );
		exit;
	}
}