Revise paste class-avia-instagram

<?php
namespace aviaFramework\widgets;

use \WP_Error;
use \AviaHelper;

/**
 * AVIA INSTAGRAM WIDGET
 *
 * Widget that displays your latest Instagram Photos
 *
 * Modified version - SECURITY HARDENED
 * =====================================
 *
 * Adds a background caching of images on own server to avoid to access instagram to display the images
 *
 * Security fixes applied (vs. original):
 * 1. sslverify no longer disabled when contacting instagram.com (MITM protection)
 * 2. Host allowlist enforced before downloading any URL returned by instagram (SSRF protection)
 * 3. Downloaded files are validated as real images (wp_check_filetype + getimagesize) before being kept
 * 4. File permissions reduced from 0777 to 0644
 * 5. Filenames are run through sanitize_file_name() instead of using raw basename() from remote data
 * 6. download_url() calls are given an explicit timeout and downloaded files are size-checked
 *
 * @package AviaFramework
 * @since ???
 * @since 4.3.1         extended, improved and modified by günter
 * @since 4.9           Code was moved from class-framework-widgets.php
 * @since 4.3.1-secure  hardened by günter - see notes above
 */
if( ! defined( 'AVIA_FW' ) ) {  exit( 'No direct script access allowed' );  }

if( ! class_exists( __NAMESPACE__ . '\avia_instagram_widget', false ) )
{
	class avia_instagram_widget extends \aviaFramework\widgets\base\Avia_Widget
	{
		/**
		 * @since 4.3.1
		 * @var array
		 */
		protected $upload_folders;

/**
		 * Stores the expire time for cached images in seconds.
		 *
		 * @since 4.3.1
		 * @var int
		 */
		protected $expire_time;

/**
		 * @since 4.3.1
		 * @var boolean
		 */
		protected $activate_cron;

/**
		 * Holds all caching info for each widget instance.
		 *
		 * @since 4.3.1
		 * @var array
		 */
		protected $cache;

/**
		 * @since 4.3.1
		 * @var array
		 */
		protected $cached_file_sizes;

/**
		 * Allowed remote hosts for image downloads (SSRF protection).
		 * Instagram/Meta serves media from these CDN domains. Anything else is rejected.
		 *
		 * @since 4.3.1-secure
		 * @var array
		 */
		protected $allowed_download_hosts;

/**
		 * Allowed mime types for cached image files.
		 *
		 * @since 4.3.1-secure
		 * @var array
		 */
		protected $allowed_mime_types;

/**
		 * Maximum accepted file size (bytes) for a single downloaded image.
		 *
		 * @since 4.3.1-secure
		 * @var int
		 */
		protected $max_file_size;

public function __construct()
		{
			$id_base = 'avia-instagram-feed';
			$name = THEMENAME . ' ' . __( 'Instagram', 'avia_framework' );

$widget_options = array(
							'classname'				=> 'avia-instagram-feed avia_no_block_preview',
							'description'			=> __( 'Displays your latest Instagram photos', 'avia_framework' ),
							'show_instance_in_rest' => true,
							'customize_selective_refresh' => false
						);

parent::__construct( $id_base, $name, $widget_options );

$this->defaults = array(
								'title'			=> __( 'Instagram', 'avia_framework' ),
								'username'		=> '',
								'cache'			=> apply_filters( 'avf_instagram_default_cache_location', '' ),		//	'' | 'server'
								'number'		=> 9,
								'columns'		=> 3,
								'size'			=> 'thumbnail',
								'target'		=> 'lightbox' ,
								'link'			=> __( 'Follow Me!', 'avia_framework' ),
								'avia_key'		=> ''
							);

$this->upload_folders = wp_upload_dir();

if( is_ssl() )
			{
				$this->upload_folders['baseurl'] = str_replace( 'http://', 'https://', $this->upload_folders['baseurl'] );
			}

$folder = apply_filters( 'avf_instagram_cache_folder_name', 'avia_instagram_cache' );

$this->upload_folders['instagram_dir'] = trailingslashit( trailingslashit( $this->upload_folders['basedir'] ) . $folder );
			$this->upload_folders['instagram_url'] = trailingslashit( trailingslashit( $this->upload_folders['baseurl'] ) . $folder );

$this->expire_time = HOUR_IN_SECONDS * 2;

$this->expire_time = apply_filters_deprecated( 'null_instagram_cache_time', array( $this->expire_time ), '4.3.1', 'avf_instagram_file_cache_time', __( 'Adding possible file caching on server might need a longer period of time to invalidate cache.', 'avia_framework' ) );
			$this->expire_time = apply_filters( 'avf_instagram_file_cache_time', $this->expire_time );

$this->activate_cron = ! ( defined( 'DISABLE_WP_CRON' ) && DISABLE_WP_CRON );
			$this->activate_cron = apply_filters( 'avf_instagram_activate_cron', $this->activate_cron );

$this->cache = $this->get_cache();

$this->cached_file_sizes = array( 'thumbnail', 'small', 'large', 'original' );

/**
			 * SECURITY: only these hosts may ever be contacted for a media download.
			 * Adjust via filter if Meta/Instagram changes their CDN domains.
			 *
			 * @since 4.3.1-secure
			 */
			$this->allowed_download_hosts = apply_filters( 'avf_instagram_allowed_download_hosts', array(
					'cdninstagram.com',
					'fbcdn.net',
				) );

/**
			 * SECURITY: only these mime types are accepted for cached files.
			 *
			 * @since 4.3.1-secure
			 */
			$this->allowed_mime_types = apply_filters( 'avf_instagram_allowed_mime_types', array(
					'jpg|jpeg|jpe' => 'image/jpeg',
					'png'          => 'image/png',
					'webp'         => 'image/webp',
				) );

/**
			 * SECURITY: reject anything larger than this (default 15 MB) - avoids disk-fill / DoS via
			 * an attacker-controlled or compromised response serving an oversized payload.
			 *
			 * @since 4.3.1-secure
			 */
			$this->max_file_size = apply_filters( 'avf_instagram_max_file_size', 15 * MB_IN_BYTES );

/**
			 * WP Cron job events
			 */
			if( $this->activate_cron )
			{
				add_action( 'av_instagram_scheduled_filecheck', array( $this, 'handler_scheduled_filecheck' ), 10 );
			}

/**
			 * Makes sure to keep cron job alive as fallback
			 */
			if( is_admin() )
			{
				add_action( 'admin_init', array( $this, 'handler_init_filecheck' ), 99999 );
				add_action( 'delete_widget', array( $this, 'handler_delete_widget' ), 10, 3 );
			}
			else
			{
				add_action( 'init', array( $this, 'handler_init_filecheck' ), 99999 );
			}

}

/**
		 * @since 4.3.1
		 */
		public function __destruct()
		{
			parent::__destruct();

unset( $this->upload_folders );
			unset( $this->cache );
			unset( $this->cached_file_sizes );
		}

/**
		 * Returns the cache info array
		 *
		 * @since 4.3.1
		 * @return array
		 */
		public function get_cache()
		{
			if( is_null( $this->cache ) )
			{
				$cache = get_option( 'avia_instagram_widgets_cache', '' );

if( is_array( $cache ) )
				{
					$this->cache = $cache;
				}
				else if( ! is_string( $cache ) || empty( $cache ) )
				{
					$this->cache = null;
				}
				else
				{
					$cache = json_decode( $cache, true );
					$this->cache = is_array( $cache ) ? $cache : null;
				}

if( empty( $this->cache ) )
				{
					$this->cache = array(
							'last_updated'		=> 0,
							'instances'			=> array()
						);
				}
			}

return $this->cache;
		}

/**
		 * Update the cache array in DB
		 *
		 * @since 4.3.1
		 * @param array|null $cache
		 */
		public function update_cache( ?array $cache = null )
		{
			if( ! is_null( $cache) )
			{
				$this->cache = $cache;
			}

$save = json_encode( $this->cache );
			update_option( 'avia_instagram_widgets_cache', $save );
		}

/**
		 * Ensure a valid instance array filled with defaults
		 *
		 * @since 4.3.1
		 * @param array $instance_cache
		 * @return array
		 */
		protected function parse_args_instance_cache( array $instance_cache )
		{
			$instance_cache = wp_parse_args( (array) $instance_cache, array(
											'upload_folder'		=> '',
											'path_error'		=> '',
											'instagram_error'	=> '',
											'upload_errors'		=> false,
											'last_update'		=> 0,
											'cached_list'		=> array(),
											'instagram_list'	=> array()
										));

return $instance_cache;
		}

/**
		 * Creates a unique key for the given instance for our cache array
		 *
		 * @since 4.3.1
		 * @param array $instance
		 * @param string $id_widget
		 * @return string
		 */
		protected function create_avia_key( array $instance, $id_widget )
		{
			$k = 0;
			$key = str_replace( $this->id_base . '-', '', $id_widget ) . '-' . AviaHelper::save_string( $instance['title'], '-' );

$orig_key = $key;
			while( array_key_exists( $key, $this->cache['instances'] ) )
			{
				$key = $orig_key . "-{$k}";
				$k++;
			}

return $key;
		}

/**
		 * Output the widget in frontend
		 *
		 * NOTE: rendering logic (widget/form/update/block preview) is unchanged from the
		 * original - the security issues in the original were all in the data-fetching /
		 * file-caching layer below, not in output escaping, which already looked correct.
		 *
		 * @param array $args
		 * @param array $instance
		 */
		public function widget( $args, $instance )
		{
			$instance = $this->parse_args_instance( $instance );

$fields = $this->get_field_names();

foreach( $instance as $key => $value )
			{
				if( in_array( $key, $fields ) )
				{
					$instance[ $key ] = esc_attr( $value );
				}
			}

$instance = apply_filters( 'avf_widget_front_instance', $instance, $args, get_called_class() );

if( $this->in_block_editor_preview( $args, $instance ) )
			{
				return;
			}

extract( $args, EXTR_SKIP );
			extract( $instance, EXTR_SKIP );

$original_cache = $cache;
			$cache = apply_filters( 'avf_conditional_setting_external_links', $cache, __CLASS__, $this, $args, $instance );
			if( ! in_array( $cache, array( '', 'server' ) ) )
			{
			   $cache = $original_cache;
			}

$title = apply_filters( 'widget_title', $title, $args );

if( ( trim( $username ) == '' ) && ! is_user_logged_in() && ! current_user_can( 'edit_posts' ) )
			{
				return;
			}

echo $before_widget;

if ( ! empty( $title ) )
			{
				echo $before_title . $title . $after_title;
			}

do_action( 'aviw_before_widget', $instance );

if( $username != '' )
			{
				$errors = array();
				$media_array = array();

$instance_cache = isset( $this->cache['instances'][ $instance['avia_key'] ] ) ? $this->cache['instances'][ $instance['avia_key'] ] : null;

if( ! is_null( $instance_cache ) )
				{
					if( ! empty( $instance_cache['instagram_error'] ) )
					{
						$errors =  array( $instance_cache['instagram_error'] );
					}
					if( ! empty( $instance_cache['upload_errors'] ) && ( 'server' == $instance['cache'] ) )
					{
						foreach( $instance_cache['cached_list'] as $img )
						{
							if( ! empty( $img['errors'] ) )
							{
								$errors = array_merge( $errors, $img['errors'] );
							}
						}
					}

if( 'server' == $instance['cache'] )
					{
						$media_array = $instance_cache['cached_list'];

$url = trailingslashit( trailingslashit( $this->upload_folders['instagram_url'] ) . $instance_cache['upload_folder'] );

foreach( $media_array as $key => $media )
						{
							if( ! empty( $media['errors'] ) )
							{
								$errors = array_merge( $errors, $media['errors'] );
							}

if( ! empty( $media[ $size ] ) )
							{
								$media_array[ $key ][ $size ] = $url . $media[ $size ];
							}
							if( ! empty( $media[ 'original' ] ) )
							{
								$media_array[ $key ]['original'] = $url . $media['original'];
							}
						}
					}
					else
					{
						$media_array = $instance_cache['instagram_list'];
					}
				}

if( ! empty( $errors ) && is_user_logged_in() && current_user_can( 'edit_posts' ) )
				{
					$errors = array_map( 'esc_html__', $errors );

$out = '';
					$out .= '<div class="av-instagram-errors">';
					$out .=		'<p class="av-instagram-errors-msg av-instagram-admin">' . esc_html__( 'Only visible for admins:', 'avia_framework' ) . '</p>';
					$out .=		'<p class="av-instagram-errors-msg av-instagram-admin">';
					$out .=			implode( '<br />', $errors );
					$out .=		'</p>';
					$out .= '</div>';

echo $out;
				}

if( count( $media_array ) > 0 )
				{
					$ulclass = esc_attr( apply_filters( 'aviw_list_class', 'av-instagram-pics av-instagram-size-' . $size ) );
					$rowclass = esc_attr( apply_filters( 'aviw_row_class', 'av-instagram-row' ) );
					$liclass = esc_attr( apply_filters( 'aviw_item_class', 'av-instagram-item' ) );
					$aclass = esc_attr( apply_filters( 'aviw_a_class', '' ) );
					$imgclass = esc_attr( apply_filters( 'aviw_img_class', '' ) );

echo '<div class="' . esc_attr( $ulclass ) . '">';

$last_id = end( $media_array );
					$last_id = $last_id['id'];

$rowcount = 0;
					$itemcount = 0;
					foreach ( $media_array as $item )
					{
						if( empty( $item[ $size ] ) )
						{
							continue;
						}

if( $rowcount == 0 )
						{
							echo "<div class='{$rowclass}'>";
						}

$rowcount ++;
						$itemcount ++;

$targeting = $target;
						if( $target == "lightbox" )
						{
							$targeting = "";
							$item['link'] = ! empty( $item['original'] ) ? $item['original'] : $item[ $size ];
						}

echo '<div class="' . $liclass . '">';
						echo	'<a href="' . esc_url( $item['link'] ) . '" target="' . esc_attr( $targeting ) . '"  class="' . $aclass . ' ' . $imgclass . '" title="' . esc_attr( $item['description'] ) . '" style="background-image:url(' . esc_url( $item[ $size ] ) . ');">';
						echo	'</a>';
						echo '</div>';

if( $rowcount % $columns == 0 || $last_id == $item['id'] || ( $itemcount >= $number ) )
						{
							echo '</div>';
							$rowcount = 0;

if( $itemcount >= $number )
							{
								break;
							}
						}
					}
					echo '</div>';
				}
				else
				{
					echo '<p class="av-instagram-errors-msg">' . esc_html__( 'No images available at the moment', 'avia_framework' ) . '</p>';
				}
			}
			else
			{
				echo '<p class="av-instagram-errors-msg av-instagram-admin">' . esc_html__( 'For admins only: Missing Instagram user name !!', 'avia_framework' ) . '</p>';
			}

if ( $link != '' )
			{
				echo '<a class="av-instagram-follow avia-button" href="https://instagram.com/' . esc_attr( trim( $username ) ) . '" rel="me" target="' . esc_attr( $target ) . '">' . $link . '</a>';
			}

do_action( 'aviw_after_widget', $instance );

echo $after_widget;
		}

/**
		 * Callback to output a custom block preview
		 *
		 * @since 4.9
		 * @param array $args
		 * @param array $instance
		 * @return boolean
		 */
		protected function widget_block_preview( array $args, array $instance = array() )
		{
			echo isset( $args['before_widget'] ) ? $args['before_widget'] : '';

echo '<div class="avia-preview-headline">' . $this->name . '</div>';
			echo '<div class="avia-preview-info">' . __( 'Title:', 'avia_framework' ) . ' ' . esc_html( $instance['title'] ) .  '</div>';
			echo '<div class="avia-preview-info">' . __( 'Username:', 'avia_framework' ) . ' ' . esc_html( $instance['username'] ) .  '</div>';
			echo '<div class="avia-preview-in-front">' . __( 'Content is only rendered in frontend.', 'avia_framework' ) . '</div>';

echo isset( $args['after_widget'] ) ? $args['after_widget'] : '';

return true;
		}

/**
		 * Output the form in backend
		 *
		 * @param array $instance
		 */
		public function form( $instance )
		{
			$instance = $this->parse_args_instance( $instance );
			$fields = $this->get_field_names();

foreach( $instance as $key => $value )
			{
				if( in_array( $key, $fields ) )
				{
					switch( $key )
					{
						case 'number':
						case 'columns':
							$instance[ $key ] = absint( $value );
							break;
						default:
							$instance[ $key ] = esc_attr( $value );
							break;
					}
				}
			}

extract( $instance );

?>
			<p><label for="<?php echo $this->get_field_id( 'title' ); ?>"><?php _e( 'Title', 'avia_framework' ); ?>: <input class="widefat" id="<?php echo $this->get_field_id( 'title' ); ?>" name="<?php echo $this->get_field_name( 'title' ); ?>" type="text" value="<?php echo esc_attr( $title ); ?>" /></label></p>
			<p><label for="<?php echo $this->get_field_id( 'username' ); ?>"><?php _e( 'Username', 'avia_framework' ); ?>: <input class="widefat" id="<?php echo $this->get_field_id( 'username' ); ?>" name="<?php echo $this->get_field_name( 'username' ); ?>" type="text" value="<?php echo esc_attr( $username ); ?>" /></label></p>
			<p><label for="<?php echo $this->get_field_id( 'cache' ); ?>"><?php _e( 'Location of your photos or videos', 'avia_framework' ); ?>:</label>
				<select id="<?php echo $this->get_field_id( 'cache' ); ?>" name="<?php echo $this->get_field_name( 'cache' ); ?>" class="widefat">
					<option value="" <?php selected( '', $cache ) ?>><?php _e( 'Get from your instagram account (instagram server connection needed)', 'avia_framework' ); ?></option>
					<option value="server" <?php selected( 'server', $cache ) ?>><?php _e( 'Cache on your server - no instagram connection needed on pageload', 'avia_framework' ); ?></option>
				</select>
			</p>
			<p><label for="<?php echo $this->get_field_id( 'number' ); ?>"><?php _e( 'Number of photos', 'avia_framework' ); ?>:</label>
				<select id="<?php echo $this->get_field_id( 'number' ); ?>" name="<?php echo $this->get_field_name( 'number' ); ?>" class="widefat">
					<?php for( $i = 1; $i <= 12; $i++ ) : ?>
					<option value="<?php echo $i; ?>" <?php selected( $i, $number ) ?>><?php echo $i; ?></option>
					<?php endfor; ?>
				</select>
			</p>
			<p><label for="<?php echo $this->get_field_id( 'columns' ); ?>"><?php _e( 'Number of columns', 'avia_framework' ); ?>:</label>
				<select id="<?php echo $this->get_field_id( 'columns' ); ?>" name="<?php echo $this->get_field_name( 'columns' ); ?>" class="widefat">
					<?php for( $i = 1; $i <= 6; $i++ ) : ?>
					<option value="<?php echo $i; ?>" <?php selected( $i, $columns ) ?>><?php echo $i; ?></option>
					<?php endfor; ?>
				</select>
			</p>
			<p><label for="<?php echo $this->get_field_id( 'size' ); ?>"><?php _e( 'Thumbnail size', 'avia_framework' ); ?>:</label>
				<select id="<?php echo $this->get_field_id( 'size' ); ?>" name="<?php echo $this->get_field_name( 'size' ); ?>" class="widefat">
					<option value="thumbnail" <?php selected( 'thumbnail', $size ) ?>><?php _e( 'Thumbnail', 'avia_framework' ); ?></option>
					<option value="small" <?php selected( 'small', $size ) ?>><?php _e( 'Small', 'avia_framework' ); ?></option>
					<option value="large" <?php selected( 'large', $size ) ?>><?php _e( 'Large', 'avia_framework' ); ?></option>
					<option value="original" <?php selected( 'original', $size ) ?>><?php _e( 'Original', 'avia_framework' ); ?></option>
				</select>
			</p>
			<p><label for="<?php echo $this->get_field_id( 'target' ); ?>"><?php _e( 'Open links in', 'avia_framework' ); ?>:</label>
				<select id="<?php echo $this->get_field_id( 'target' ); ?>" name="<?php echo $this->get_field_name( 'target' ); ?>" class="widefat">
					<option value="lightbox" <?php selected( 'lightbox', $target ) ?>><?php _e( 'Lightbox', 'avia_framework' ); ?></option>
					<option value="_self" <?php selected( '_self', $target ) ?>><?php _e( 'Current window (_self)', 'avia_framework' ); ?></option>
					<option value="_blank" <?php selected( '_blank', $target ) ?>><?php _e( 'New window (_blank)', 'avia_framework' ); ?></option>
				</select>
			</p>
			<p><label for="<?php echo $this->get_field_id( 'link' ); ?>"><?php _e( 'Link text', 'avia_framework' ); ?>: <input class="widefat" id="<?php echo $this->get_field_id( 'link' ); ?>" name="<?php echo $this->get_field_name( 'link' ); ?>" type="text" value="<?php echo esc_attr( $link ); ?>" /></label></p>

<?php

if( ! $this->activate_cron )
			{
				echo '<p class="av-instagram-no-cron">';
				echo	__( 'WP Cron jobs are disabled. To assure a regular update of cached data and an optimal pageload in frontend and backend we recommend to activate this.', 'avia_framework' );
				echo '</p>';

$timestamp = ( $this->cache['last_updated'] != 0 ) ? $this->cache['last_updated'] + $this->expire_time : false;
				$time = ( false !== $timestamp ) ? date( 'Y/m/d H:i a', $timestamp ) .  __( ' UTC', 'avia_framework' ) : __( 'No time available', 'avia_framework' );

echo '<p class="av-instagram-next-update">';
				echo	__( 'The widget preloads and caches Instagram data for better performance.', 'avia_framework' )." ";
				echo	sprintf( __( 'Next update: %s', 'avia_framework' ), $time );
				echo '</p>';
			}
			else
			{
				$timestamp = wp_next_scheduled( 'av_instagram_scheduled_filecheck' );
				$time = ( false !== $timestamp ) ? date( "Y/m/d H:i", $timestamp ) .  __( ' UTC', 'avia_framework' ) : __( 'No time available', 'avia_framework' );

if( empty( $instance['avia_key'] ) )
			{
				return;
			}

if( empty( $this->cache['instances'][ $instance['avia_key'] ] ) )
			{
				return;
			}

$instance_cache = $this->cache['instances'][ $instance['avia_key'] ];
			$errors = array();

if( ! empty( $instance_cache['instagram_error'] ) )
			{
				$errors = (array) $instance_cache['instagram_error'];
			}

if( 'server' == $instance['cache'] )
			{
				foreach( $instance_cache['cached_list'] as $image )
				{
					if( ! empty( $image['errors'] ) )
					{
						$errors = array_merge( $errors, $image['errors'] );
					}
				}
			}

if( ! empty( $errors ) )
			{
				$errors = array_map( 'esc_html__', $errors );

$out  = '<div class="av-instagram-errors">';
				$out .=		'<p class="av-instagram-errors-msg av-instagram-error-headline">' . esc_html__( 'Errors found:', 'avia_framework' ) . '</p>';
				$out .=		'<p class="av-instagram-errors-msg">';
				$out .=			implode( '<br />', $errors );
				$out .=		'</p>';
				$out .= '</div>';

echo $out;
			}

}

/**
		 * Update widget options
		 *
		 * @param array $new_instance
		 * @param array $old_instance
		 * @return array
		 */
		public function update( $new_instance, $old_instance )
		{
			$instance = $this->parse_args_instance( $old_instance );

$instance['title'] = strip_tags( $new_instance['title'] );
			$instance['username'] = trim( strip_tags( $new_instance['username'] ) );
			$instance['cache'] = ( $new_instance['cache'] == 'server' || $new_instance['cache'] == '' ) ? $new_instance['cache'] : apply_filters( 'avf_instagram_default_cache_location', 'server' );
			$instance['number'] = ! absint( $new_instance['number'] ) ? 9 : $new_instance['number'];
			$instance['columns'] = ! absint( $new_instance['columns'] ) ? 3 : $new_instance['columns'];
			$instance['size'] = ( $new_instance['size'] == 'thumbnail' || $new_instance['size'] == 'large' || $new_instance['size'] == 'small' || $new_instance['size'] == 'original' ) ? $new_instance['size'] : 'large';
			$instance['target'] = ( $new_instance['target'] == '_self' || $new_instance['target'] == '_blank'|| $new_instance['target'] == 'lightbox' ) ? $new_instance['target'] : '_self';
			$instance['link'] = strip_tags( $new_instance['link'] );

if( empty( $instance['avia_key'] ) )
			{
				$key = $this->create_avia_key( $instance, $this->id );
				$instance['avia_key'] = $key;
				$this->cache['instances'][ $key ] = array();
				$this->update_cache();
			}

$this->update_single_instance( $instance, $this->id );

if( $this->activate_cron )
			{
				$this->restart_cron_job();
			}

return $instance;
		}

/**
		 * Get info from instagram
		 * based on https://gist.github.com/cosmocatalano/4544576
		 *
		 * SECURITY: sslverify is no longer disabled - the original code disabled TLS certificate
		 * verification, which allowed a man-in-the-middle attacker to forge the "instagram" response
		 * (and, downstream, control which files get downloaded and cached on the server).
		 *
		 * @since 4.3.1-secure hardened
		 * @param string $username
		 * @return array|\WP_Error
		 */
		protected function scrape_instagram( $username )
		{
			$username = strtolower( $username );
			$username = str_replace( '@', '', $username );

$remote = wp_remote_get( 'https://www.instagram.com/' . trim( $username ), array(
					'timeout' => 60,
					// SECURITY: sslverify intentionally left at the WP default (true).
					// Do NOT set 'sslverify' => false here.
				) );

if ( is_wp_error( $remote ) )
			{
				return new WP_Error( 'site_down', __( 'Unable to communicate with Instagram.', 'avia_framework' ) );
			}

$code = wp_remote_retrieve_response_code( $remote );
			if ( 200 != $code )
			{
				$msg = wp_remote_retrieve_response_message( $remote );
				if( empty( $msg ) )
				{
					$msg = __( 'Unknown error code', 'avia_framework' );
				}
				return new WP_Error( 'invalid_response', sprintf( __( 'Instagram returned error %d (= %s).', 'avia_framework' ), $code, $msg ) );
			}

$shards = explode( 'window._sharedData = ', $remote['body'] );
			if( ! isset( $shards[1] ) )
			{
				return new WP_Error( 'bad_json', __( 'Instagram has returned invalid data.', 'avia_framework' ) );
			}

$insta_json = explode( ';</script>', $shards[1] );
			$insta_array = json_decode( $insta_json[0], true );

if ( ! $insta_array )
			{
				return new WP_Error( 'bad_json', __( 'Instagram has returned invalid data.', 'avia_framework' ) );
			}

if ( isset( $insta_array['entry_data']['ProfilePage'][0]['graphql']['user']['edge_owner_to_timeline_media']['edges'] ) )
			{
				$images = $insta_array['entry_data']['ProfilePage'][0]['graphql']['user']['edge_owner_to_timeline_media']['edges'];
			}
			else
			{
				return new WP_Error( 'bad_json_2', __( 'Instagram has returned invalid data.', 'avia_framework' ) );
			}

if ( ! is_array( $images ) )
			{
				return new WP_Error( 'bad_array', __( 'Instagram has returned invalid data.', 'avia_framework' ) );
			}

$instagram = array();

foreach ( $images as $image )
			{
				if ( ! empty( $image['node']['is_video'] ) )
				{
					$type = 'video';
				}
				else
				{
					$type = 'image';
				}

$caption = __( 'Instagram Image', 'avia_framework' );

if ( ! empty( $image['node']['edge_media_to_caption']['edges'][0]['node']['text'] ) )
				{
					$caption = wp_kses( $image['node']['edge_media_to_caption']['edges'][0]['node']['text'], array() );
				}

// SECURITY: every URL taken from the remote response is passed through
				// is_allowed_download_url() before it is ever used - see download_from_instagram().
				$instagram[] = array(
						'description'   => $caption,
						'link'		  	=> trailingslashit( '//instagram.com/p/' . $image['node']['shortcode'] ),
						'time'		  	=> $image['node']['taken_at_timestamp'] ?? 0,
						'comments'	  	=> $image['node']['edge_media_to_comment']['count'] ?? 0,
						'likes'		 	=> $image['node']['edge_liked_by']['count'] ?? 0,
						'thumbnail'	 	=> preg_replace( '/^https?\:/i', '', $image['node']['thumbnail_resources'][0]['src'] ?? '' ),
						'small'			=> preg_replace( '/^https?\:/i', '', $image['node']['thumbnail_resources'][2]['src'] ?? '' ),
						'large'			=> preg_replace( '/^https?\:/i', '', $image['node']['thumbnail_resources'][4]['src'] ?? '' ),
						'original'		=> preg_replace( '/^https?\:/i', '', $image['node']['display_url'] ?? '' ),
						'type'		  	=> $type,
						'id'			=> $image['node']['id']
					);
			}

$aviw_images_only = false;
			$aviw_images_only = apply_filters_deprecated( 'aviw_images_only', array( $aviw_images_only ), '4.3.1', 'avf_instagram_filter_files', __( 'Filter extended to filter images or videos', 'avia_framework' ) );

$show = $aviw_images_only ? array( 'image' ) : array();
			$show = apply_filters( 'avf_instagram_filter_files', $show, $username );

if( ! empty( $show ) )
			{
				foreach( $instagram as $key => $media_item )
				{
					if( ! in_array( $media_item['type'], $show ) )
					{
						unset( $instagram[ $key ] );
					}
				}

$instagram = array_merge( $instagram );
			}

if ( empty( $instagram ) )
			{
				return new WP_Error( 'no_images', __( 'Instagram did not return any images.', 'avia_framework' ) );
			}

return $instagram;
		}

/**
		 * WP Cron handler for background uploads
		 *
		 * @since 4.3.1
		 */
		public function handler_scheduled_filecheck()
		{
			if( defined( 'WP_DEBUG ' ) && WP_DEBUG )
			{
				error_log( '******************  In avia_instagram_widget::handler_scheduled_filecheck started' );
			}

$this->schedule_cron_job( $this->expire_time * 2 );

$settings = $this->get_settings();
			if( ! empty( $settings ) )
			{
				$this->check_all_instances();
			}

$this->schedule_cron_job( $this->expire_time * 2 );

$this->sync_data();

$this->schedule_cron_job( $this->expire_time );

if( defined( 'WP_DEBUG ' ) && WP_DEBUG )
			{
				error_log( '******************  In avia_instagram_widget::handler_scheduled_filecheck ended' );
			}
		}

/**
		 * Synchronises directory and cache data structure.
		 *
		 * @since 4.3.1
		 */
		public function sync_data()
		{
			$settings = $this->get_settings();

if( empty( $settings ) && empty( $this->cache['instances'] ) )
			{
				if( is_dir( $this->upload_folders['instagram_dir'] ) )
				{
					avia_backend_delete_folder( $this->upload_folders['instagram_dir'] );
					$this->cache['last_updated'] = time();
					$this->update_cache();
				}
				return;
			}

$instance_infos = (array) $this->cache['instances'];

$keys = array_keys( $instance_infos );
			$keys_to_keep = array();

foreach ( $settings as $index => $setting )
			{
				if( in_array( $setting['avia_key'], $keys ) )
				{
					$keys_to_keep[] = $setting['avia_key'];
				}
			}

$keys_to_remove = array_diff( $keys, $keys_to_keep );

foreach( $keys_to_remove as $key )
			{
				$folder = $this->upload_folders['instagram_dir'] . $instance_infos[ $key ]['upload_folder'];
				avia_backend_delete_folder( $folder );
				unset( $this->cache['instances'][ $key ] );
			}

$cache_dirs = is_dir( $this->upload_folders['instagram_dir'] ) ? scandir( $this->upload_folders['instagram_dir'] ) : false;
			if( ! is_array( $cache_dirs ) )
			{
				return;
			}

$cache_dirs = array_diff( $cache_dirs, array( '.', '..' ) );

$ref_dirs = array();
			foreach( $this->cache['instances'] as $key => $instance_info )
			{
				if( isset( $instance_info['upload_folder'] ) )
				{
					$ref_dirs[] = $instance_info['upload_folder'];
				}
			}

$remove_dirs = array_diff( $cache_dirs, $ref_dirs );

foreach( $remove_dirs as $remove_dir )
			{
				avia_backend_delete_folder( $this->upload_folders['instagram_dir'] . $remove_dir );
			}

if( empty( $this->cache['instances'] ) )
			{
				avia_backend_delete_folder( $this->upload_folders['instagram_dir'] );
			}

$this->cache['last_updated'] = time();
			$this->update_cache();
		}

/**
		 * WP Cron is disabled - we have to load files during pageload in admin area
		 *
		 * @since 4.3.1
		 */
		public function handler_init_filecheck()
		{
			$settings = $this->get_settings();
			if( empty( $settings ) )
			{
				if( $this->activate_cron  )
				{
					$this->restart_cron_job();
				}
				return;
			}

$instance = array_shift( $settings );
			if( ! isset( $instance['avia_key'] ) || empty( $instance['avia_key'] ) )
			{
				$instances = $this->get_settings();
				foreach( $instances as $key => &$instance )
				{
					$instance = $this->parse_args_instance( $instance );
					$key = $this->create_avia_key( $instance, $this->id_base . "-{$key}" );
					$instance['avia_key'] = $key;
					$this->cache['instances'][ $key ] = array();
				}
				unset( $instance );
				$this->save_settings( $instances );

$this->cache['last_updated'] = 0;
				$this->update_cache();

$this->check_all_instances();
			}

if( $this->activate_cron  )
			{
				$this->restart_cron_job();
				return;
			}

if( $this->cache['last_updated'] + $this->expire_time > time() )
			{
				return;
			}

if( is_admin() )
			{
				$this->check_all_instances();
			}
		}

/**
		 * Is called, when an instance of a widget is deleted.
		 *
		 * @since 4.3.1
		 * @param string $widget_id
		 * @param string $sidebar_id
		 * @param string $id_base
		 */
		public function handler_delete_widget( $widget_id, $sidebar_id, $id_base )
		{
			$id = str_replace( $id_base . '-', '', $widget_id );

$settings = $this->get_settings();
			if( empty( $settings ) || empty( $settings[ $id ] ) )
			{
				return;
			}

$instance = $settings[ $id ];

$instance_info = isset( $this->cache['instances'][ $instance['avia_key'] ] ) ? $this->cache['instances'][ $instance['avia_key'] ] : array();
			if( empty( $instance_info ) )
			{
				return;
			}

$instance = $this->parse_args_instance( $instance );
			$instance_info = $this->parse_args_instance_cache( $instance_info );

if( count( $settings ) <= 1 )
			{
				avia_backend_delete_folder( $this->upload_folders['instagram_dir'] );
				$this->cache['instances'] = array();
			}
			else
			{
				$folder = $this->upload_folders['instagram_dir'] . $instance_info['upload_folder'];
				avia_backend_delete_folder( $folder );
				unset( $this->cache['instances'][ $instance['avia_key'] ] );
			}

$this->update_cache();
		}

/**
		 * @since 4.3.1
		 */
		protected function restart_cron_job()
		{
		   $timestamp = wp_next_scheduled( 'av_instagram_scheduled_filecheck' );
		   if( false === $timestamp )
		   {
			   $this->schedule_cron_job( $this->expire_time );
			   return;
		   }

if( $timestamp > ( time() + $this->expire_time * 2 ) )
		   {
			   $this->schedule_cron_job( $this->expire_time * 2 );
		   }
		}

/**
		 * @since 4.3.1
		 * @param int $delay_seconds
		 * @return boolean
		 */
		protected function schedule_cron_job( $delay_seconds = 0 )
		{
			$timestamp = wp_next_scheduled( 'av_instagram_scheduled_filecheck' );
			if( false !== $timestamp )
			{
				wp_unschedule_hook( 'av_instagram_scheduled_filecheck' );
			}

$timestamp = time() + $delay_seconds;

$scheduled = wp_schedule_single_event( $timestamp, 'av_instagram_scheduled_filecheck' );

return false !== $scheduled;
		}

/**
		 * @since 4.3.1
		 */
		protected function check_all_instances()
		{
			$settings = $this->get_settings();

foreach ( $settings as $key => $instance )
			{
				$id_widget = $this->id_base . "-{$key}";

if( false === is_active_widget( false, $id_widget, $this->id_base, false ) )
				{
					continue;
				}

$this->update_single_instance( $instance, $id_widget );
			}

$this->cache['last_updated'] = time();
			$this->update_cache();
		}

/**
		 * @since 4.3.1
		 * @param array $instance
		 * @param string $id_widget
		 * @return array
		 */
		protected function update_single_instance( array $instance, $id_widget )
		{
			set_time_limit( 0 );

$instance = $this->parse_args_instance( $instance );

if( empty( $instance['avia_key'] ) )
			{
				$key = $this->create_avia_key( $instance, $id_widget );
				$instance['avia_key'] = $key;
				$this->cache['instances'][ $key ] = array();
			}

$instance_cache = isset( $this->cache['instances'][ $instance['avia_key'] ] ) ? $this->cache['instances'][ $instance['avia_key'] ] : array();
			$instance_cache = $this->parse_args_instance_cache( $instance_cache );

if( ( 'server' == $instance['cache'] ) && empty( $instance_cache['upload_folder'] ) && ! empty( $instance['username'] ) )
			{
				$id = str_replace( $this->id_base . '-', '', $id_widget );
				$f = empty( $instance['title'] ) ? $instance['username'] : $instance['title'];
				$folder_name = substr( AviaHelper::save_string( $id . '-' . $f, '-' ), 0, 30 );
				$folder = $this->upload_folders['instagram_dir'] . $folder_name;

$created = avia_backend_create_folder( $folder, false, 'unique' );
				if( $created )
				{
					$split = pathinfo( $folder );
					$instance_cache['upload_folder'] = $split['filename'];
					$instance_cache['path_error'] = '';
					$instance_cache['cached_list'] = array();
				}
				else
				{
					$instance_cache['path_error'] = sprintf( __( 'Unable to create cache folder "%s". Files will be loaded directly from instagram', 'avia_framework' ), $folder );
				}
			}

$username = $instance['username'];
			$number = $instance['number'];

if( ! empty( $username) )
			{
				$media_array = $this->scrape_instagram( $username );

if ( ! is_wp_error( $media_array ) )
				{
					$instance_cache['instagram_error'] = '';
					$instance_cache['instagram_list'] = array_slice( $media_array, 0, $number );

if( 'server' == $instance['cache'] )
					{
						$instance_cache = $this->cache_files_in_upload_directory( $media_array, $instance, $instance_cache );
					}
				}
				else
				{
					$instance_cache['instagram_error'] = $media_array->get_error_message();
				}
			}
			else
			{
				$instance_cache['instagram_error'] = __( 'You need to specify an Instagram username.', 'avia_framework' );
				$instance_cache['instagram_list'] = array();
				$instance_cache['cached_list'] = array();
			}

$instance_cache['last_update'] = time();

$this->cache['instances'][ $instance['avia_key'] ] = $instance_cache;
			$this->update_cache();

return $instance;
		}

/**
		 * Updates the local stored files in upload directory.
		 *
		 * @since 4.3.1
		 * @param array $instagram_files
		 * @param array $instance
		 * @param array $instance_cache
		 * @return array
		 */
		protected function cache_files_in_upload_directory( array $instagram_files, array $instance, array $instance_cache )
		{
			set_time_limit( 0 );

$cached_files = $instance_cache['cached_list'];

$new_cached_files = array();
			$no_errors = 0;

foreach( $instagram_files as $instagram_file )
			{
				$id = $instagram_file['id'];

$found = false;
				foreach( $cached_files as $key_cache => $cached_file )
				{
					if( $id == $cached_file['id'] )
					{
						if( ! empty( $cached_file['errors'] ) )
						{
							$this->remove_single_cached_files( $cached_file, $instance_cache );
							unset( $cached_files[ $key_cache ] );
							break;
						}

$path = trailingslashit( $this->upload_folders['instagram_dir'] . $instance_cache['upload_folder'] );
						foreach( $this->cached_file_sizes as $size )
						{
							if( empty( $cached_file[ $size ] ) || ! file_exists( $path . $cached_file[ $size ] ) )
							{
								$this->remove_single_cached_files( $cached_file, $instance_cache );
								unset( $cached_files[ $key_cache ] );
								break;
							}
						}

if( ! isset( $cached_files[ $key_cache ] ) )
						{
							break;
						}

$ncf = $cached_file;

$ncf['description'] = $instagram_file['description'];
						$ncf['link'] = $instagram_file['link'];
						$ncf['time'] = $instagram_file['time'];
						$ncf['comments'] = $instagram_file['comments'];
						$ncf['likes'] = $instagram_file['likes'];
						$ncf['type'] = $instagram_file['type'];

$new_cached_files[] = $ncf;

unset( $cached_files[ $key_cache ] );
						$found = true;
						break;
					}
				}

if( ! $found )
				{
					$new_cached_files[] = $this->download_from_instagram( $instagram_file, $instance, $instance_cache );
				}

$last = $new_cached_files[ count( $new_cached_files ) - 1 ];

if( empty( $last['errors'] ) || ! empty( $last[ $instance['size'] ] ) )
				{
					$no_errors++;
				}

if( $no_errors >= $instance['number'] || count( $new_cached_files ) > ( $instance['number'] * 2 ) )
				{
					break;
				}
			}

if( $no_errors < $instance['number'] )
			{
				foreach( $cached_files as $key_cache => $cached_file )
				{
					$new_cached_files[] = $cached_file;
					if( empty( $cached_file['errors'] ) )
					{
						$no_errors++;
					}

unset( $cached_files[ $key_cache ] );

if( $no_errors >= $instance['number'] )
					{
						break;
					}
				}
			}

foreach( $cached_files as $key_cache => $cached_file )
			{
				$this->remove_single_cached_files( $cached_file, $instance_cache );
				unset( $cached_files[ $key_cache ] );
			}

$err_cnt = 0;
			$count = 1;

foreach( $new_cached_files as $new_file )
			{
				if( ! empty( $new_file['errors'] ) )
				{
					$err_cnt++;
				}
				$count++;

if( $count > $instance['number'] )
				{
					break;
				}
			}

$instance_cache['upload_errors'] = ( 0 == $err_cnt ) ? false : $err_cnt;
			$instance_cache['cached_list'] = $new_cached_files;

return $instance_cache;
		}

/**
		 * SECURITY: checks that a URL returned by instagram points to a host we explicitly
		 * trust for media downloads, before we ever pass it to download_url(). Without this,
		 * a compromised/forged response (e.g. via a MITM, or a future scraping bug) could make
		 * this widget download and store an attacker-controlled file on the server.
		 *
		 * @since 4.3.1-secure
		 * @param string $url
		 * @return boolean
		 */
		protected function is_allowed_download_url( $url )
		{
			$host = wp_parse_url( $url, PHP_URL_HOST );

if( empty( $host ) )
			{
				return false;
			}

$host = strtolower( $host );

foreach( $this->allowed_download_hosts as $allowed )
			{
				$allowed = strtolower( $allowed );

// exact match or proper subdomain match only (e.g. "scontent.cdninstagram.com" but not "evilcdninstagram.com")
				if( $host === $allowed || substr( $host, -( strlen( $allowed ) + 1 ) ) === '.' . $allowed )
				{
					return true;
				}
			}

return false;
		}

/**
		 * SECURITY: validates that a locally saved temp file is actually an image of an
		 * allowed type and within the size limit. Rejects anything else (e.g. a script or
		 * executable disguised behind an image-looking URL/filename).
		 *
		 * @since 4.3.1-secure
		 * @param string $tmp_path
		 * @return boolean
		 */
		protected function is_valid_downloaded_image( $tmp_path )
		{
			if( ! file_exists( $tmp_path ) )
			{
				return false;
			}

$filesize = filesize( $tmp_path );
			if( false === $filesize || $filesize <= 0 || $filesize > $this->max_file_size )
			{
				return false;
			}

// getimagesize() actually parses the image header - a renamed .php file will fail this check.
			$info = @getimagesize( $tmp_path );
			if( false === $info || empty( $info['mime'] ) )
			{
				return false;
			}

if( ! in_array( $info['mime'], $this->allowed_mime_types, true ) )
			{
				return false;
			}

return true;
		}

/**
		 * Downloads the files from instagram and stores them in local cache.
		 *
		 * SECURITY (vs. original):
		 * - source URL is checked against an allowlist of trusted CDN hosts before download
		 * - downloaded file is verified to actually be an allowed image type/size before being kept
		 * - filename is sanitized instead of trusting the remote-supplied name verbatim
		 * - permissions reduced from 0777 to 0644
		 *
		 * @since 4.3.1
		 * @since 4.3.1-secure hardened
		 * @param array $instagram_file
		 * @param array $instance
		 * @param array $instance_cache
		 * @return array
		 */
		protected function download_from_instagram( array $instagram_file, array $instance, array $instance_cache )
		{
			$new_cached_file = $instagram_file;
			$new_cached_file['errors'] = array();
			$instagram_schema = 'https:';

$cache_path = trailingslashit( $this->upload_folders['instagram_dir'] . $instance_cache['upload_folder'] );

if( ! function_exists( 'download_url' ) )
			{
				require_once trailingslashit( ABSPATH ) . 'wp-admin/includes/file.php';
			}

foreach( $this->cached_file_sizes as $size )
			{
				if( empty( $instagram_file[ $size ] ) )
				{
					$new_cached_file[ $size ] = '';
					continue;
				}

$remote_url = $instagram_schema . $instagram_file[ $size ];

// SECURITY: reject anything that doesn't point at a trusted instagram/meta CDN host.
				if( ! $this->is_allowed_download_url( $remote_url ) )
				{
					$new_cached_file[ $size ] = '';
					$new_cached_file['errors'][] = __( 'Rejected image URL from an untrusted host.', 'avia_framework' );
					continue;
				}

// SECURITY: sanitize the filename instead of trusting the remote name verbatim.
				$fn = explode( '?', basename( $instagram_file[ $size ] ) );
				$safe_name = sanitize_file_name( $fn[0] );

if( empty( $safe_name ) )
				{
					$new_cached_file[ $size ] = '';
					$new_cached_file['errors'][] = __( 'Could not determine a safe filename for downloaded image.', 'avia_framework' );
					continue;
				}

$tmp_name = download_url( $remote_url, 30 );

if( is_wp_error( $tmp_name ) )
				{
					$new_cached_file[ $size ] = '';
					$new_cached_file['errors'] = array_merge( $new_cached_file['errors'], $tmp_name->get_error_messages() );
					continue;
				}

// SECURITY: verify the downloaded file is actually an allowed image type/size
				// before it is moved into the public uploads folder.
				if( ! $this->is_valid_downloaded_image( $tmp_name ) )
				{
					@unlink( $tmp_name );
					$new_cached_file[ $size ] = '';
					$new_cached_file['errors'][] = __( 'Downloaded file failed image validation and was discarded.', 'avia_framework' );
					continue;
				}

$new_file_name = $size . '_' . $safe_name;
				$new_name = $cache_path . $new_file_name;

$moved = avia_backend_rename_file( $tmp_name, $new_name );
				if( is_wp_error( $moved ) )
				{
					@unlink( $tmp_name );
					$new_cached_file[ $size ] = '';
					$new_cached_file['errors'] = array_merge( $new_cached_file['errors'], $moved->get_error_messages() );
					continue;
				}

// SECURITY: 0644 instead of 0777 - files only ever need to be world-readable, never world-writable/executable.
				if( ! chmod( $new_name, 0644 ) )
				{
					$new_cached_file['errors'][] = sprintf( __( 'Could not change user rights of file %s to 644 - file might not be visible in frontend.', 'avia_framework' ), $new_name );
				}

$new_cached_file[ $size ] = $new_file_name;
			}

return $new_cached_file;
		}

/**
		 * Removes all cached files from $cached_file_info
		 *
		 * @since 4.3.1
		 * @param array $cached_file_info
		 * @param array $instance_cache
		 * @return array
		 */
		protected function remove_single_cached_files( array $cached_file_info, array $instance_cache )
		{
			$cache_path = trailingslashit( $this->upload_folders['instagram_dir'] . $instance_cache['upload_folder'] );

foreach( $this->cached_file_sizes as $size )
			{
				if( ! empty( $cached_file_info[ $size ] ) )
				{
					$file = $cache_path . $cached_file_info[ $size ];

if( file_exists( $file ) )
					{
						unlink( $file );
					}
					$cached_file_info[ $size ] = '';
				}
			}

return $cached_file_info;
		}
	}
}