<?php
/**
 * WebEngine CMS / Nexora Plugin Manager hardening
 * POST + CSRF compatible actions.
 */
?>
<h1 class="page-header">Plugin Manager</h1>
<?php
if(!config('plugins_system_enable',true)) {
    message('warning', '<strong>WARNING</strong><br />The plugin system is not currently enabled. To enable it please change your <a href="'.admincp_base('website_settings').'">website settings</a>.');
}

define('PLUGIN_ALLOW_UNINSTALL',true);
$Plugins = new Plugins();

// State changes are intentionally POST-only. NexoraSecurity validates the CSRF
// token globally before this module is executed.
if(($_SERVER['REQUEST_METHOD'] ?? 'GET') === 'POST') {
    $pluginId = isset($_POST['plugin_id']) ? (int)$_POST['plugin_id'] : 0;
    $pluginAction = isset($_POST['plugin_action']) ? strtolower(trim((string)$_POST['plugin_action'])) : '';

    if($pluginId > 0 && in_array($pluginAction, array('enable','disable','uninstall'), true)) {
        if($pluginAction === 'enable') {
            $Plugins->updatePluginStatus($pluginId, 1);
            message('success','Plugin successfully enabled.');
        } elseif($pluginAction === 'disable') {
            $Plugins->updatePluginStatus($pluginId, 0);
            message('success','Plugin successfully disabled.');
        } elseif($pluginAction === 'uninstall' && PLUGIN_ALLOW_UNINSTALL) {
            // WebEngine uninstallPlugin() removes only the plugin registry row;
            // it does not delete the plugin files from disk.
            $uninstallPlugin = $Plugins->uninstallPlugin($pluginId);
            if($uninstallPlugin) {
                message('success','Plugin registry entry successfully uninstalled.');
            } else {
                message('error','Could not uninstall plugin.');
            }
            $updateCache = $Plugins->rebuildPluginsCache();
            if(!$updateCache) {
                message('error','Could not update plugins cache data, make sure the file exists and it\'s writable!');
            }
        }
    }
}

$plugins = $Plugins->retrieveInstalledPlugins();
if(is_array($plugins)) {
    echo '<table class="table">';
        echo '<thead>';
            echo '<tr>';
            echo '<th>Name</th>';
            echo '<th>Author</th>';
            echo '<th>Version</th>';
            echo '<th>Compatibility</th>';
            echo '<th>Install Date</th>';
            echo '<th>Status</th>';
            echo '<th>Actions</th>';
            echo '</tr>';
        echo '</thead>';
        echo '<tbody>';
        foreach($plugins as $thisPlugin) {
            $pluginId = (int)$thisPlugin['id'];
            if($thisPlugin['status'] == 1) {
                $status = '<span class="label label-success">enabled</span>';
                $statusAction = 'disable';
                $statusClass = 'btn-default';
            } else {
                $status = '<span class="label label-default">disabled</span>';
                $statusAction = 'enable';
                $statusClass = 'btn-success';
            }

            echo '<tr>';
            echo '<td>'.htmlspecialchars((string)$thisPlugin['name'], ENT_QUOTES, 'UTF-8').'</td>';
            echo '<td>'.htmlspecialchars((string)$thisPlugin['author'], ENT_QUOTES, 'UTF-8').'</td>';
            echo '<td>'.htmlspecialchars((string)$thisPlugin['version'], ENT_QUOTES, 'UTF-8').'</td>';
            echo '<td>'.htmlspecialchars(implode(", ",explode("|",$thisPlugin['compatibility'])), ENT_QUOTES, 'UTF-8').'</td>';
            echo '<td>'.date("m/d/Y",$thisPlugin['install_date']).'</td>';
            echo '<td>'.$status.'</td>';
            echo '<td>';

            echo '<form method="post" action="index.php?module=plugins" style="display:inline-block;margin-right:4px">';
            echo '<input type="hidden" name="plugin_id" value="'.$pluginId.'">';
            echo '<input type="hidden" name="plugin_action" value="'.$statusAction.'">';
            echo '<button type="submit" class="btn '.$statusClass.' btn-xs">'.$statusAction.'</button>';
            echo '</form>';

            if(PLUGIN_ALLOW_UNINSTALL) {
                echo '<form method="post" action="index.php?module=plugins" style="display:inline-block" onsubmit="return confirm(&quot;Remove this plugin registry entry? Plugin files will remain on disk.&quot;);">';
                echo '<input type="hidden" name="plugin_id" value="'.$pluginId.'">';
                echo '<input type="hidden" name="plugin_action" value="uninstall">';
                echo '<button type="submit" class="btn btn-danger btn-xs">uninstall</button>';
                echo '</form>';
            }

            echo '</td>';
            echo '</tr>';
        }
        echo '</tbody>';
    echo '</table>';
} else {
    message('warning','You have not installed any plugin yet.');
}
?>
