<?php
/**
 * @package   admintoolswp
 * @copyright Copyright (c)2017-2026 Nicholas K. Dionysopoulos / Akeeba Ltd
 * @license   GNU GPL version 3 or later
 */

defined('ADMINTOOLSINC') or die;

class AtsystemFeatureBrowserconsolewarning extends AtsystemFeatureAbstract
{
	protected $loadOrder = 710;

	/**
	 * Is this feature enabled?
	 *
	 * @return bool
	 */
	public function isEnabled()
	{
		return ($this->cparams->getValue('consolewarn', 1) == 1);
	}

	public function onCustomHooks()
	{
		add_action('wp_footer', [$this, 'injectConsoleWarning'], 9999);
		add_action('admin_footer', [$this, 'injectConsoleWarning'], 9999);
	}

	/**
	 * Inject JavaScript to display a self-XSS warning in the browser console.
	 *
	 * This warns logged-in users not to paste arbitrary JavaScript into the
	 * browser console, which is the attack vector for Self-XSS attacks.
	 *
	 * @return  void
	 */
	public function injectConsoleWarning()
	{
		// Nothing to steal if the user is not logged in
		if (!is_user_logged_in())
		{
			return;
		}

		// Do not inject in AJAX, REST API, or cron contexts
		if (wp_doing_ajax() || wp_doing_cron() || (defined('REST_REQUEST') && REST_REQUEST))
		{
			return;
		}

		echo <<<'JS'
<script>
(function(){
	try {
		console.log('%c Warning! ', 'font-size: 36px; color: red; font-weight: bold;');
		console.log('%c This browser feature is aimed at developers only. If you were instructed to copy something here to enable some kind of "hidden feature", in reality it\'s an attempt to compromise your account. ', 'font-size: 14px;');
		console.log('%c For further info see https://en.wikipedia.org/wiki/Self-XSS ', 'font-size: 14px;');
	} catch(e) {}
})();
</script>
JS;
	}
}
