<?php
/* ======================================================
   🔥 Spider eCommerce Universal Updater v3
   PHP 7.2 – 8.3 Compatible
====================================================== */

/* ===============================
   DEBUG MODE (true / false)
================================ */
$DEBUG_MODE = true;

if ($DEBUG_MODE) {
    ini_set('display_errors', 1);
    ini_set('display_startup_errors', 1);
    error_reporting(E_ALL);
}

/* ===============================
   GLOBAL ERROR HANDLER
================================ */
set_error_handler(function ($severity, $message, $file, $line) {
    throw new ErrorException($message, 0, $severity, $file, $line);
});

/* ===============================
   BASIC ENVIRONMENT INFO
================================ */
function debugInfo()
{
    global $DEBUG_MODE;
    if (!$DEBUG_MODE) return;

    echo "<pre>";
    echo "PHP VERSION: " . PHP_VERSION . "\n";
    echo "UPLOAD MAX FILESIZE: " . ini_get('upload_max_filesize') . "\n";
    echo "POST MAX SIZE: " . ini_get('post_max_size') . "\n";
    echo "FILE_UPLOADS: " . ini_get('file_uploads') . "\n";
    echo "</pre>";
}

debugInfo();

/* ===============================
   LOAD CORE FILES
================================ */
$Callingg_2 = "SoftwareUpdate";
require_once 'frd1_whoami.php';

$FR_ptitle = "Software Update";
$p = "SoftwareUpdate";
$inn = "";

require_once 'frd-this-header.php';
require_once 'frd1_header.php';

/* ===============================
   RESPONSE FUNCTIONS
================================ */
function updateFail($msg, $extra = [])
{
    echo "<pre>";
    print_r(array_merge([
        "status"  => 0,
        "success" => false,
        "error"   => $msg
    ], $extra));
    echo "</pre>";
    exit;
}

function updateSuccess($data)
{
    echo "<pre>";
    print_r([
        "status"  => 1,
        "success" => true,
        "data"    => $data
    ]);
    echo "</pre>";
}

/* ===============================
   PRE-CHECKS
================================ */
if (!class_exists('ZipArchive')) {
    updateFail("ZipArchive extension not enabled.");
}

if (!is_writable($FR_PATH_HD)) {
    updateFail("Root path not writable.", [
        "path" => $FR_PATH_HD
    ]);
}

$NEXT_VERSION = $FR_SOFT_VERSION + 1;

echo "<h2 class='PT'>Software Update</h2>";

/* ===============================
   UPDATE PROCESS
================================ */
if ($_SERVER['REQUEST_METHOD'] === 'POST') {

    if (empty($_FILES)) {
        updateFail("Upload failed. Possible upload limit exceeded.", [
            "upload_max_filesize" => ini_get('upload_max_filesize'),
            "post_max_size"       => ini_get('post_max_size')
        ]);
    }

    if (empty($_FILES['f_software_file']['name'])) {
        updateFail("No file uploaded.");
    }

    $log = [];

    try {

        $file = $_FILES['f_software_file'];

        if ($file['error'] !== UPLOAD_ERR_OK) {
            updateFail("File upload error.", [
                "php_error_code" => $file['error']
            ]);
        }

        $original = $file['name'];
        $tmp      = $file['tmp_name'];

        /* ========= FILENAME VALIDATION ========= */
        if (!preg_match('/\-([0-9]+)\-SPIDER_ECOMMERCE\.zip$/i', $original, $m)) {
            updateFail("Invalid file name format.", [
                "filename" => $original
            ]);
        }

        $fileVersion = (int)$m[1];

        if ($fileVersion !== $NEXT_VERSION) {
            updateFail("Invalid update version.", [
                "expected" => $NEXT_VERSION,
                "given"    => $fileVersion
            ]);
        }

        $log[] = "Version validated.";

        /* ========= MOVE FILE ========= */
        $zipPath = rtrim($FR_PATH_HD, '/\\') . "/update-$fileVersion.zip";

        if (!move_uploaded_file($tmp, $zipPath)) {
            updateFail("Failed to move uploaded file.", [
                "destination" => $zipPath
            ]);
        }

        $log[] = "ZIP stored.";

        /* ========= OPEN ZIP ========= */
        $zip = new ZipArchive();

        if ($zip->open($zipPath) !== true) {
            updateFail("Unable to open ZIP.");
        }

        $root = realpath($FR_PATH_HD);

        for ($i = 0; $i < $zip->numFiles; $i++) {

            $entry = $zip->getNameIndex($i);

            // Path traversal protection (PHP 7 compatible)
            if (strpos($entry, '../') !== false || substr($entry, 0, 1) === '/') {
                $zip->close();
                updateFail("ZIP path traversal detected.");
            }

            $fullPath = realpath(dirname($FR_PATH_HD . $entry));

            if ($fullPath !== false && strpos($fullPath, $root) !== 0) {
                $zip->close();
                updateFail("ZIP extraction outside root.");
            }
        }

        if (!$zip->extractTo($FR_PATH_HD)) {
            $zip->close();
            updateFail("ZIP extraction failed.");
        }

        $zip->close();

        $log[] = "ZIP extracted.";

        /* ========= DB ALTER ========= */
        $alterFile = rtrim($FR_PATH_HD, '/\\') . "/frd-src/frd-alter-table.php";

        if (file_exists($alterFile)) {
            require $alterFile;
            unlink($alterFile);
            $log[] = "Database updated.";
        } else {
            $log[] = "No DB alter file found (skipped).";
        }

        /* ========= CLEAN ========= */
        if (file_exists($zipPath)) {
            unlink($zipPath);
        }

        $log[] = "Cleanup completed.";

        updateSuccess([
            "message" => "Software updated successfully.",
            "version" => $fileVersion,
            "steps"   => $log
        ]);

    } catch (Throwable $e) {

        updateFail("Update failed.", [
            "exception" => $e->getMessage(),
            "file"      => $e->getFile(),
            "line"      => $e->getLine()
        ]);
    }
}
?>

<!-- ===============================
     UPLOAD FORM
================================ -->
<h6 class="text-center">
    Current Version: <?= htmlspecialchars((string)$FR_SOFT_VERSION) ?>
</h6>
<hr>

<div class="container">
    <div class="row justify-content-center">
        <div class="col-md-4 jumbotron">
            <form method="post" enctype="multipart/form-data">
                <input type="file" name="f_software_file" class="form-control" required>
                <br>
                <button type="submit" class="btn btn-success btn-block">
                    Confirm & Update
                </button>
            </form>
        </div>
    </div>
</div>

<?php require_once 'frd1_footer.php'; ?>