<?php
/**
 * mdzip.php - Zip a selected folder and stream it to the browser.
 * SECURITY: Protect with token + optional IP allowlist. Delete after use!
 */

declare(strict_types=1);

// ====== CONFIG ======
$TOKEN = 'mantuPolikjn56111222!!';   // <-- ändern!
$ALLOW_IPS = []; // z.B. ['1.2.3.4'] oder leer lassen für "kein IP-Limit"
$BASE_DIR = realpath(__DIR__); // Webroot
$ALLOWED_DIRS = ['miet-wc', 'wp-admin', 'wp-content', 'wp-includes']; // nur diese
$EXCLUDE = [
  '/.git/', '/.svn/', '/cache/', '/tmp/', '/logs/',
  '/wp-content/cache/', '/wp-content/uploads/cache/'
];
// ====================

function deny(string $msg, int $code = 403): void {
  http_response_code($code);
  header('Content-Type: text/plain; charset=utf-8');
  echo $msg;
  exit;
}

if (!isset($_GET['token']) || !hash_equals($TOKEN, (string)$_GET['token'])) {
  deny("Forbidden: invalid token");
}

if (!empty($ALLOW_IPS)) {
  $ip = $_SERVER['REMOTE_ADDR'] ?? '';
  if (!in_array($ip, $ALLOW_IPS, true)) {
    deny("Forbidden: IP not allowed");
  }
}

$dir = isset($_GET['dir']) ? (string)$_GET['dir'] : '';
if ($dir === '' || !in_array($dir, $ALLOWED_DIRS, true)) {
  deny("Bad request: invalid dir. Allowed: " . implode(', ', $ALLOWED_DIRS), 400);
}

$target = realpath($BASE_DIR . DIRECTORY_SEPARATOR . $dir);
if ($target === false || strpos($target, $BASE_DIR) !== 0 || !is_dir($target)) {
  deny("Bad request: directory not found or outside base", 400);
}

if (!class_exists('ZipArchive')) {
  deny("Server error: ZipArchive extension not available", 500);
}

// Time/memory tuning (best effort)
@set_time_limit(0);
@ini_set('memory_limit', '512M');

// Create temp zip in system temp
$tmpZip = tempnam(sys_get_temp_dir(), 'zip_');
if ($tmpZip === false) deny("Server error: cannot create temp file", 500);
$zipPath = $tmpZip . '.zip';
@unlink($tmpZip);

$zip = new ZipArchive();
if ($zip->open($zipPath, ZipArchive::CREATE | ZipArchive::OVERWRITE) !== true) {
  deny("Server error: cannot open zip", 500);
}

$baseLen = strlen($target) + 1;
$it = new RecursiveIteratorIterator(
  new RecursiveDirectoryIterator($target, FilesystemIterator::SKIP_DOTS),
  RecursiveIteratorIterator::SELF_FIRST
);

foreach ($it as $file) {
  $fullPath = $file->getPathname();

  // Excludes
  $rel = substr($fullPath, $baseLen);
  $relNorm = '/' . str_replace(DIRECTORY_SEPARATOR, '/', $rel) . '/';
  foreach ($EXCLUDE as $ex) {
    if (strpos($relNorm, $ex) !== false) {
      continue 2;
    }
  }

  // Avoid zipping the zipper itself if inside target
  if (basename($fullPath) === 'mdzip.php') continue;

  $localName = $dir . '/' . str_replace(DIRECTORY_SEPARATOR, '/', $rel);

  if ($file->isDir()) {
    $zip->addEmptyDir($localName);
  } elseif ($file->isFile()) {
    // Add file
    $zip->addFile($fullPath, $localName);
  }
}

$zip->close();

// Stream zip to client
$downloadName = $dir . '-' . date('Ymd-His') . '.zip';
header('Content-Type: application/zip');
header('Content-Disposition: attachment; filename="' . $downloadName . '"');
header('Content-Length: ' . filesize($zipPath));
header('Cache-Control: no-store');

readfile($zipPath);
@unlink($zipPath);
exit;