<?php

namespace Imagely\NGG\DynamicStylesheets;

use Imagely\NGG\Display\View;
use Imagely\NGG\Util\Sanitization;

/**
 * Controller for dynamic stylesheets.
 */
class Controller {

	/**
	 * Handle dynamic stylesheet generation.
	 *
	 * @param bool $return_output Whether to return the output or print it.
	 * @return string|void The generated CSS if $return_output is true.
	 */
	public function index_action( $return_output = false ) {
		header( 'Content-Type: text/css; charset=' . get_option( 'blog_charset' ), true );

		if ( \C_NextGEN_Bootstrap::get_pro_api_version() < 4.0 ) {
			$manager = Manager::get_instance( 'all' );
			$manager->register( 'nextgen_pro_film', 'photocrati-nextgen_pro_film#nextgen_pro_film_dyncss' );
			$manager->register( 'nextgen_pro_grid_album', 'photocrati-nextgen_pro_albums#nextgen_pro_grid_album_dyncss' );
			$manager->register( 'nextgen_pro_list_album', 'photocrati-nextgen_pro_albums#nextgen_pro_list_album_dyncss' );
			$manager->register( 'nextgen_pro_blog', 'photocrati-nextgen_pro_blog_gallery#nextgen_pro_blog_dyncss' );
			$manager->register( 'nextgen_pro_thumbnail_grid', 'photocrati-nextgen_pro_thumbnail_grid#nextgen_pro_thumbnail_grid_dyncss' );
		}

		// Nonce verification is not necessary: this is not form data, but generated by NextGEN as part of its displayed
		// gallery customization for style.
		//
        // phpcs:disable WordPress.Security.NonceVerification.Recommended, WordPress.Security.ValidatedSanitizedInput.InputNotValidated, WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
		// Force scalar + unslash + strip; reject arrays/objects to prevent type-juggling into template lookup/decode.
		$raw_data = isset( $_REQUEST['data'] ) && is_scalar( $_REQUEST['data'] ) ? (string) wp_unslash( $_REQUEST['data'] ) : null;
		$raw_name = isset( $_REQUEST['name'] ) && is_scalar( $_REQUEST['name'] ) ? (string) wp_unslash( $_REQUEST['name'] ) : null;
		$data     = null !== $raw_data ? Sanitization::recursive_stripslashes( $raw_data ) : null;
		// sanitize_key restricts template name to [a-z0-9_-], blocks path traversal / unexpected chars in array key lookup.
		$name = null !== $raw_name ? sanitize_key( Sanitization::recursive_stripslashes( $raw_name ) ) : null;
		// phpcs:enable WordPress.Security.NonceVerification.Recommended, WordPress.Security.ValidatedSanitizedInput.InputNotValidated, WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized

		if ( isset( $data ) && isset( $name ) && '' !== $name ) {
			$manager = Manager::get_instance( 'all' );

			// Whitelist: only render if name maps to a registered template; prevents undefined-offset + arbitrary template key lookup.
			$template = $manager->get_css_template( $name );
			if ( false === $template || null === $template ) {
				return;
			}

			if ( \C_NextGEN_Bootstrap::get_pro_api_version() < 4.0 ) {
				$view = new \C_MVC_View( $template, $manager->decode( $data ) );
			} else {
				$view = new View( $template, $manager->decode( $data ) );
			}

			return $view->render( $return_output );
		}
	}
}