<?php
/**
 * Pi-Star configuration writer — safe replacement for the long-standing
 * `sudo sed -i "/key=/c\\key=$value"` pattern that's repeated ~150 times
 * across admin/configure.php.
 *
 * The previous approach concatenated `escapeshellcmd($_POST['field'])`
 * into a double-quoted shell command and a sed `c\` replacement.
 * `escapeshellcmd()` does not protect double-quoted shell contexts, so
 * each call site was an independent command-injection sink. This helper
 * replaces the family of sites with a single staged-write API: edits
 * accumulate in memory, commit() writes them all at once via PHP-side
 * file editing plus an atomic `sudo install`, and no shell ever sees
 * an attacker-controlled byte.
 *
 * Usage from a POST handler:
 *
 *     require_once $_SERVER['DOCUMENT_ROOT'] . '/config/config_writer.php';
 *
 *     // Stage individual edits — accumulate in memory, no I/O yet.
 *     config_writer_stage_flat('/etc/ircddbgateway', 'aprsHostname',  $aprsHost);
 *     config_writer_stage_flat('/etc/ircddbgateway', 'remotePassword', $confPass);
 *     config_writer_stage_flat('/etc/timeserver',    'callsign',       $newCall);
 *     // ... many more ...
 *
 *     // Commit all staged edits — one remount-rw / batched-install / remount-ro cycle.
 *     $errors = config_writer_commit();
 *     if (!empty($errors)) {
 *         // Each entry is a human-readable diagnostic; surface or log as you prefer.
 *     }
 *
 * Design choices:
 *
 *   - **Allowlist of writable paths.** Any caller asking to write outside
 *     the allowlist gets `false` back from `config_writer_stage_flat()`
 *     (and an `error_log()` entry). The list is the set of flat
 *     key=value files the dashboard's editor surfaces actually edit.
 *
 *   - **Stage-then-commit, single mount cycle.** The dashboard runs on
 *     a read-only rootfs by default. A naive per-edit `remount,rw` /
 *     write / `remount,ro` cycle would race when many edits land in one
 *     POST (and configure.php has 150+ such edits per save). Staging
 *     all edits in `$GLOBALS['__config_writer_stage']` and flushing in a
 *     single `commit()` call collapses that to one mount cycle per POST.
 *
 *   - **Match sed's `c\` semantics.** Replace the FIRST line whose head
 *     is `<key>=` (column 0 — stricter than sed's "anywhere on line"
 *     pattern, which is actually the correct intent and avoids the
 *     classic substring-collision class of bug). If the key is absent,
 *     do nothing — same as sed. Append-if-missing would be a behaviour
 *     change for daemons with strict parsers and isn't safe without a
 *     per-file audit; defer to a later opt-in flag if needed.
 *
 *   - **Atomic file replacement via `sudo install -m 644 -o root -g root`.**
 *     `cp` is not atomic — open + write + close on the destination
 *     leaves a window where the file is partially written. `install`
 *     uses rename(2) when src and dst share a filesystem; falls back to
 *     copy+chmod+chown when they don't (which is our case here — `/tmp`
 *     is tmpfs, the destination is on the SD card). The fallback is no
 *     less atomic than the existing `cp` pattern used elsewhere in this
 *     dashboard, and it sets mode/owner in one go. A future hardening
 *     pass could co-locate the staging file with the destination for
 *     true rename(2) atomicity.
 *
 *   - **Hardcoded shell command literals.** `system()` is called with a
 *     fixed-shape command string; only fixed paths and `escapeshellarg()`-
 *     wrapped arguments are interpolated. PHP's `proc_open()` array form
 *     is PHP 7.4+ and this codebase targets PHP 7.0+, so we stay with
 *     `system()` plus `escapeshellarg()` instead.
 *
 *   - **Whitespace preservation.** Existing files use `key=value` with
 *     no spaces around `=`. The helper preserves that exactly — it does
 *     NOT normalise existing files' formatting. Daemons in this stack
 *     parse their own configs with byte-precise matching; introducing
 *     spurious whitespace changes would risk breakage out of scope for
 *     this fix.
 *
 *   - **Concurrent-edits.** Pi-Star is a single-operator embedded device
 *     in practice. The read-mutate-write window in commit() is wider
 *     than sed's, but two simultaneous configure.php POSTs are vanishingly
 *     rare on the target hardware. TODO: add file locking via flock()
 *     if this assumption ever stops holding.
 */

/**
 * Allow-list of paths the helper is permitted to write via the
 * flat key=value editor. Any other path passed to
 * `config_writer_stage_flat()` is rejected with an error_log()
 * entry and a `false` return.
 *
 * Defined as a function (not a constant) so the file is safe to
 * `require_once` multiple times under PHP 7.0 — array constants from
 * `define()` work in 7.0 but `const` arrays at the file scope are
 * 5.6+ and uniform-array-syntax limits make redefinition awkward.
 *
 * @return array<int,string>
 */
function config_writer_allowed_paths()
{
    return array(
        '/etc/ircddbgateway',
        '/etc/dstarrepeater',
        '/etc/timeserver',
        '/etc/aprsgateway',
        '/etc/mobilegps',
        '/etc/starnetserver',
    );
}

/**
 * Allow-list of paths the helper is permitted to write via the
 * privileged-flat editor (`config_writer_stage_privileged_flat()`).
 *
 * Same column-0 `key=value` semantics as the unprivileged flat
 * editor, but the read step uses `sudo cat` so the helper can
 * service files that are mode-600 root:root and therefore not
 * readable by www-data. The destination is restored at mode 600
 * root:root via `sudo install`. Kept separate from the flat
 * allowlist because the read path and the install mode differ.
 *
 * @return array<int,string>
 */
function config_writer_allowed_paths_privileged_flat()
{
    return array(
        '/root/.Remote Control',                            // note: literal space in filename
        '/etc/hostapd/hostapd.conf',                        // contains wpa_passphrase=… ; mode 600 root:root
    );
}

/**
 * Allow-list of paths the helper is permitted to write via the
 * PHP-statement editor (`config_writer_stage_php_string()`).
 *
 * These files are PHP source files included by the dashboard at
 * runtime. Each contains one or more lines of the form
 * `$varName='value';` at column 0. The PHP-statement editor
 * rewrites the value with proper PHP-string escaping so the
 * attacker-controlled bytes can never escape the single-quoted
 * string literal — preventing PHP RCE via these files.
 *
 * Kept separate from the flat allow-list because the file shape
 * and the editing semantics are different. A path that's writable
 * under one editor is NOT automatically writable under the other.
 *
 * @return array<int,string>
 */
function config_writer_allowed_paths_php_string()
{
    return array(
        '/var/www/dashboard/config/language.php',
        '/var/www/dashboard/config/ircddblocal.php',
    );
}

/**
 * Stage a single `key=value` edit against a flat config file.
 *
 * The edit is queued in process-local memory. Nothing touches disk
 * until {@see config_writer_commit()} runs. Multiple stages against the
 * same file accumulate; multiple stages of the same key in the same
 * file overwrite each other (last write wins) and only the last is
 * applied at commit time.
 *
 * @param string $path  Absolute path. Must appear in
 *                      {@see config_writer_allowed_paths()}.
 * @param string $key   The key name, e.g. `aprsHostname`. Must match
 *                      `[A-Za-z_][A-Za-z0-9_]*` — defence in depth so
 *                      a programming-error caller can't inject a
 *                      regex/sed metachar via the key.
 * @param string $value The new value. Must not contain NUL / CR / LF
 *                      (those would break the line-oriented file
 *                      format). All other bytes — including shell
 *                      metachars like `"` `'` `;` `&` `$` — are stored
 *                      verbatim, which is correct: the value is data,
 *                      not a shell argument.
 *
 * @return bool True if staged. False if rejected (path not allow-
 *              listed, key malformed, or value contains NUL/CR/LF).
 *              On false, an error_log() entry is emitted.
 */
function config_writer_stage_flat($path, $key, $value)
{
    if (!in_array($path, config_writer_allowed_paths(), true)) {
        error_log("config_writer: refusing to stage edit against non-allowlisted path '$path'");
        return false;
    }
    if (!preg_match('/\A[A-Za-z_][A-Za-z0-9_]*\z/', $key)) {
        error_log("config_writer: refusing to stage malformed key '$key' for $path");
        return false;
    }
    if (preg_match('/[\x00\r\n]/', $value)) {
        error_log("config_writer: refusing to stage value with NUL/CR/LF for $path:$key");
        return false;
    }

    if (!isset($GLOBALS['__config_writer_stage'])) {
        $GLOBALS['__config_writer_stage'] = array();
    }
    if (!isset($GLOBALS['__config_writer_stage'][$path])) {
        $GLOBALS['__config_writer_stage'][$path] = array();
    }
    // Last write wins for repeated stages of the same key.
    $GLOBALS['__config_writer_stage'][$path][$key] = $value;
    return true;
}

/**
 * Stage a single PHP single-quoted string assignment edit.
 *
 * Targets PHP source files in
 * {@see config_writer_allowed_paths_php_string()} that contain a
 * line of the form `$varName='value';` at column 0. The first
 * matching line is rewritten with the new value, properly escaped
 * for a PHP single-quoted string literal — `\\` and `'` inside
 * the value are escaped to `\\\\` and `\\'` respectively. All
 * other bytes (including shell metachars `"` `;` `&` `$`) are
 * stored verbatim — they are data inside a string literal, not
 * code. This closes the PHP RCE class introduced by the previous
 * `sudo sed -i` pattern, where attacker bytes could close the
 * sed-emitted single-quote and inject arbitrary PHP statements.
 *
 * Like {@see config_writer_stage_flat()}, the edit is queued in
 * memory until {@see config_writer_commit()} runs.
 *
 * @param string $path     Absolute path. Must appear in
 *                         {@see config_writer_allowed_paths_php_string()}.
 * @param string $varName  PHP variable name (no leading `$`).
 *                         Must match `[A-Za-z_][A-Za-z0-9_]*`.
 * @param string $value    The new value to assign. Must not contain
 *                         NUL/CR/LF (those would either break PHP
 *                         parsing or break the line-oriented edit).
 *
 * @return bool True if staged. False if rejected.
 */
function config_writer_stage_php_string($path, $varName, $value)
{
    if (!in_array($path, config_writer_allowed_paths_php_string(), true)) {
        error_log("config_writer: refusing PHP-string stage for non-allowlisted path '$path'");
        return false;
    }
    if (!preg_match('/\A[A-Za-z_][A-Za-z0-9_]*\z/', $varName)) {
        error_log("config_writer: refusing malformed PHP var name '$varName' for $path");
        return false;
    }
    if (preg_match('/[\x00\r\n]/', $value)) {
        error_log("config_writer: refusing PHP-string value with NUL/CR/LF for $path:\$$varName");
        return false;
    }

    if (!isset($GLOBALS['__config_writer_stage_phpstr'])) {
        $GLOBALS['__config_writer_stage_phpstr'] = array();
    }
    if (!isset($GLOBALS['__config_writer_stage_phpstr'][$path])) {
        $GLOBALS['__config_writer_stage_phpstr'][$path] = array();
    }
    $GLOBALS['__config_writer_stage_phpstr'][$path][$varName] = $value;
    return true;
}

/**
 * Stage a single `key=value` edit against a flat config file that
 * lives under root-only permissions.
 *
 * Identical contract to {@see config_writer_stage_flat()} except the
 * file is read via `sudo cat` instead of the PHP-side `file()` —
 * because mode-600 root:root paths are not readable by www-data —
 * and the destination is reinstalled at mode 600 root:root rather
 * than 644.
 *
 * The only currently-allowlisted path is `/root/.Remote Control`,
 * which holds the ircDDBGateway remote-control password and port.
 *
 * @param string $path  Absolute path. Must appear in
 *                      {@see config_writer_allowed_paths_privileged_flat()}.
 * @param string $key   Same key contract as the unprivileged flat
 *                      editor.
 * @param string $value Same value contract.
 *
 * @return bool True if staged. False if rejected.
 */
function config_writer_stage_privileged_flat($path, $key, $value)
{
    if (!in_array($path, config_writer_allowed_paths_privileged_flat(), true)) {
        error_log("config_writer: refusing privileged-flat stage for non-allowlisted path '$path'");
        return false;
    }
    if (!preg_match('/\A[A-Za-z_][A-Za-z0-9_]*\z/', $key)) {
        error_log("config_writer: refusing malformed privileged-flat key '$key' for $path");
        return false;
    }
    if (preg_match('/[\x00\r\n]/', $value)) {
        error_log("config_writer: refusing privileged-flat value with NUL/CR/LF for $path:$key");
        return false;
    }

    if (!isset($GLOBALS['__config_writer_stage_priv'])) {
        $GLOBALS['__config_writer_stage_priv'] = array();
    }
    if (!isset($GLOBALS['__config_writer_stage_priv'][$path])) {
        $GLOBALS['__config_writer_stage_priv'][$path] = array();
    }
    $GLOBALS['__config_writer_stage_priv'][$path][$key] = $value;
    return true;
}

/**
 * Atomically install $newContent at $path with the given mode root:root.
 *
 * Internal helper shared by the flat and php-string commit paths.
 * Returns null on success or a single-line diagnostic on failure.
 * On failure the destination is left untouched and the temp file
 * is unlinked.
 *
 * @param string $path        Absolute destination path.
 * @param string $newContent  Full file content to install.
 *
 * @return string|null Error string, or null on success.
 */
function _config_writer_install_atomic($path, $newContent, $mode = '644')
{
    // Defence in depth — $mode is never attacker-controlled (the
    // helper's commit() picks one of two hardcoded values), but we
    // refuse anything outside the small expected set so a future
    // typo can't inadvertently widen file permissions.
    if ($mode !== '644' && $mode !== '600') {
        return "config_writer: refusing invalid mode '$mode' for $path";
    }
    $tmp = tempnam('/tmp', 'pistar_cw_');
    if ($tmp === false) {
        return "config_writer: tempnam() failed for $path";
    }
    // tempnam() creates the file mode 0600 on POSIX, but a non-default
    // umask could in theory widen it. Force-narrow before writing —
    // the temp content may be a freshly-set password.
    @chmod($tmp, 0600);
    if (file_put_contents($tmp, $newContent) === false) {
        @unlink($tmp);
        return "config_writer: file_put_contents() failed for $tmp; $path edits skipped";
    }
    $cmd = 'sudo install -m ' . $mode . ' -o root -g root '
         . escapeshellarg($tmp) . ' '
         . escapeshellarg($path);
    $rc = 0;
    $out = array();
    exec($cmd . ' 2>&1', $out, $rc);
    @unlink($tmp);
    if ($rc !== 0) {
        return "config_writer: install exit=$rc for $path: " . implode(' / ', $out);
    }
    return null;
}

/**
 * Apply every staged edit and clear the staging buffer.
 *
 * For each affected file:
 *   1. Read the file into a line array.
 *   2. For each staged `key => value`, find the FIRST line whose head
 *      is `key=` (column 0) and replace it with `key=value`. If the
 *      key is absent, the edit is silently skipped (matches sed's
 *      `c\` semantics).
 *   3. Write the rebuilt content to a tempnam() in /tmp.
 *   4. Atomically copy back via `sudo install -m 644 -o root -g root`.
 *
 * Wraps the per-file install calls in a single mount-rw / mount-ro
 * pair so concurrent POSTs can't race on remount toggles. Callers
 * that already manage their own mount cycle (e.g. configure.php's
 * top-level POST handler, which keeps `/` rw across many edits)
 * should pass `$manageMount = false` to skip the helper's own
 * mount-rw/ro — otherwise the helper's mount-ro will prematurely
 * close the caller's write window.
 *
 * @param bool $manageMount Whether commit() should issue its own
 *                          `sudo mount -o remount,rw /` and
 *                          `... remount,ro /` around the batch.
 *                          Default true — safe for one-off callers.
 *                          Pass false from inside an already-managed
 *                          mount window.
 *
 * @return array<int,string> Diagnostic strings — empty on full success.
 *                           Non-empty entries describe per-file failures
 *                           (read failure, file_put_contents failure,
 *                           install non-zero exit). The caller decides
 *                           whether to surface to the UI or just log.
 */
function config_writer_commit($manageMount = true)
{
    $errors = array();
    $flatStage = isset($GLOBALS['__config_writer_stage'])
        ? $GLOBALS['__config_writer_stage']
        : array();
    $phpStrStage = isset($GLOBALS['__config_writer_stage_phpstr'])
        ? $GLOBALS['__config_writer_stage_phpstr']
        : array();
    $privStage = isset($GLOBALS['__config_writer_stage_priv'])
        ? $GLOBALS['__config_writer_stage_priv']
        : array();

    if (empty($flatStage) && empty($phpStrStage) && empty($privStage)) {
        return $errors;
    }

    // Optional single mount-rw / batched-install / mount-ro envelope.
    // When the caller already has `/` open rw (configure.php's POST
    // handler does this for the duration of a save), we MUST NOT do
    // our own mount-ro at the end — that would prematurely close the
    // caller's window and break later writes (e.g. the timezone
    // handler that runs after this commit).
    if ($manageMount) {
        system('sudo mount -o remount,rw /');
    }

    // Pass 1 — flat key=value edits.
    foreach ($flatStage as $path => $kvPairs) {
        if (!is_readable($path)) {
            $errors[] = "config_writer: cannot read $path; edits skipped";
            error_log("config_writer: cannot read $path; " . count($kvPairs) . " edits skipped");
            continue;
        }
        $lines = file($path, FILE_IGNORE_NEW_LINES);
        if ($lines === false) {
            $errors[] = "config_writer: file() failed for $path; edits skipped";
            error_log("config_writer: file() failed for $path; " . count($kvPairs) . " edits skipped");
            continue;
        }

        foreach ($kvPairs as $key => $value) {
            $prefix = $key . '=';
            $applied = false;
            foreach ($lines as $i => $line) {
                if (strpos($line, $prefix) === 0) {
                    $lines[$i] = $prefix . $value;
                    $applied = true;
                    break;
                }
            }
            // Silent no-op when the key isn't present — matches the
            // previous sed `c\` semantics. If the caller cares, log
            // here. (Quiet by default to avoid filling the log on
            // version-skew between the dashboard and the gateway
            // configs.)
            if (!$applied) {
                error_log("config_writer: $path has no '$key=' line; edit skipped");
            }
        }

        $err = _config_writer_install_atomic(
            $path,
            implode("\n", $lines) . "\n"
        );
        if ($err !== null) {
            $errors[] = $err;
            error_log($err);
        }
    }

    // Pass 2 — PHP single-quoted string assignment edits.
    foreach ($phpStrStage as $path => $varValuePairs) {
        if (!is_readable($path)) {
            $errors[] = "config_writer: cannot read $path; PHP-string edits skipped";
            error_log("config_writer: cannot read $path; "
                . count($varValuePairs) . " PHP-string edits skipped");
            continue;
        }
        $lines = file($path, FILE_IGNORE_NEW_LINES);
        if ($lines === false) {
            $errors[] = "config_writer: file() failed for $path; PHP-string edits skipped";
            error_log("config_writer: file() failed for $path; "
                . count($varValuePairs) . " PHP-string edits skipped");
            continue;
        }

        foreach ($varValuePairs as $varName => $value) {
            // Match column-0 `$varName` followed by optional whitespace
            // then `=`. preg_quote is belt-and-braces — the var name is
            // already validated to /^[A-Za-z_][A-Za-z0-9_]*$/ by
            // config_writer_stage_php_string().
            $pattern = '/^\$' . preg_quote($varName, '/') . '\s*=/';
            $applied = false;
            foreach ($lines as $i => $line) {
                if (preg_match($pattern, $line)) {
                    // Escape value for a PHP single-quoted string
                    // literal: only `\` and `'` are special inside
                    // `'...'`. The two-char mask "\\'" tells
                    // addcslashes() to backslash-escape both:
                    //   `\` → `\\`  (first char of the mask)
                    //   `'` → `\'`  (second char of the mask)
                    // The result is parseable PHP that decodes back
                    // to the original $value bytes — so attacker
                    // bytes are stored as data, never executed.
                    $escaped = addcslashes($value, "\\'");
                    $lines[$i] = '$' . $varName . "='" . $escaped . "';";
                    $applied = true;
                    break;
                }
            }
            if (!$applied) {
                error_log("config_writer: $path has no \$$varName= line; PHP-string edit skipped");
            }
        }

        $err = _config_writer_install_atomic(
            $path,
            implode("\n", $lines) . "\n"
        );
        if ($err !== null) {
            $errors[] = $err;
            error_log($err);
        }
    }

    // Pass 3 — privileged flat key=value edits (root-only files).
    // Same column-0 `key=` semantics as pass 1, but the read step
    // uses `sudo cat` so we can service mode-600 root:root paths,
    // and the install mode is 600 not 644.
    foreach ($privStage as $path => $kvPairs) {
        $rc = 0;
        $out = array();
        // sudo -n: never prompt — fail loudly if sudoers ever changes.
        // Output is the file content; stderr captured separately so a
        // sudo / cat failure doesn't poison the parsed lines.
        exec('sudo -n cat ' . escapeshellarg($path) . ' 2>/dev/null',
             $out, $rc);
        if ($rc !== 0) {
            $errors[] = "config_writer: sudo cat exit=$rc for $path; privileged edits skipped";
            error_log("config_writer: sudo cat exit=$rc for $path; "
                . count($kvPairs) . " privileged edits skipped");
            continue;
        }
        $lines = $out;

        foreach ($kvPairs as $key => $value) {
            $prefix = $key . '=';
            $applied = false;
            foreach ($lines as $i => $line) {
                if (strpos($line, $prefix) === 0) {
                    $lines[$i] = $prefix . $value;
                    $applied = true;
                    break;
                }
            }
            if (!$applied) {
                error_log("config_writer: $path has no '$key=' line; privileged edit skipped");
            }
        }

        $err = _config_writer_install_atomic(
            $path,
            implode("\n", $lines) . "\n",
            '600'
        );
        if ($err !== null) {
            $errors[] = $err;
            error_log($err);
        }
    }

    if ($manageMount) {
        system('sudo mount -o remount,ro /');
    }

    // Clear all stages so a subsequent commit() call doesn't
    // re-apply already-applied edits.
    $GLOBALS['__config_writer_stage'] = array();
    $GLOBALS['__config_writer_stage_phpstr'] = array();
    $GLOBALS['__config_writer_stage_priv'] = array();

    return $errors;
}