<?php
/**
 * Metadata stripping for uploaded images — the per-gallery "strip EXIF" option.
 *
 * Why the server and not the browser
 * ----------------------------------
 * Thumbnails and the resolution cap are browser work, because both need the
 * decoded pixels anyway. Stripping needs none: it is a container rewrite, the
 * uploaded file already sits in a temp file on the webhost, and doing it here
 * means the promise "this gallery carries no EXIF" holds for every upload —
 * including one from a stale cached admin.js or a hand-crafted POST. A gallery
 * with a resolution cap gets stripping for free from the browser's re-encode;
 * this is what makes it available to galleries that keep their originals.
 *
 * What is removed
 * ---------------
 * Everything a camera, phone or editor writes about the photo — EXIF (camera,
 * lens, exposure, timestamps, GPS), XMP, IPTC/Photoshop blocks, comments — but
 * nothing the picture needs to render:
 *
 *   - the pixels are never touched: no decode, no re-encode, no quality loss
 *   - the ICC colour profile stays, or colours would shift
 *   - the JFIF (density) and Adobe (colour transform) blocks stay
 *   - the orientation flag is re-written on its own, so a photo shot in
 *     portrait still shows upright. It says which way up, not who or where.
 *
 * JPEG, PNG and WebP are understood. Anything else (RAW, AVIF, video, a file
 * the parser does not recognise) is left alone and uploaded as it arrived —
 * best-effort by nature, exactly like the resolution cap. Every entry point
 * verifies the result with getimagesize() before it is used, so a parse that
 * goes wrong costs the strip, never the photo.
 */

declare(strict_types=1);

/** Metadata segments/chunks bigger than this are skipped rather than examined. */
const EXIF_MAX_PARSE_BYTES = 1024 * 1024;

/**
 * Write a metadata-free copy of $src to a temp file and return its path — the
 * caller owns that file and must unlink it. Returns null when the format is not
 * understood, when there was nothing to strip, or when the rewrite produced
 * anything other than the same image at the same size; in every one of those
 * cases the caller should simply use the original.
 */
function exif_strip_copy(string $src): ?string
{
    $in = @fopen($src, 'rb');
    if ($in === false) {
        return null;
    }
    $format = exif_detect_format((string)fread($in, 12));
    if ($format === null) {
        fclose($in);
        return null;
    }
    rewind($in);

    $dest = @tempnam(sys_get_temp_dir(), 'fpexif');
    $out  = $dest !== false ? @fopen($dest, 'wb') : false;
    if ($dest === false || $out === false) {
        fclose($in);
        if ($dest !== false) {
            @unlink($dest);
        }
        return null;
    }

    try {
        $removed = match ($format) {
            'jpeg' => exif_strip_jpeg($in, $out),
            'png'  => exif_strip_png($in, $out),
            'webp' => exif_strip_webp($in, $out),
        };
    } catch (Throwable $e) {
        $removed = false;
    }
    fclose($in);
    fclose($out);

    // A rewrite that removed nothing is a byte-for-byte copy: drop it and let
    // the original go up, saving a second read of the whole file.
    if (!$removed || !exif_same_image($src, $dest)) {
        @unlink($dest);
        return null;
    }
    return $dest;
}

/** 'jpeg' | 'png' | 'webp' from the first bytes of a file, or null. */
function exif_detect_format(string $head): ?string
{
    if (str_starts_with($head, "\xFF\xD8\xFF")) {
        return 'jpeg';
    }
    if (str_starts_with($head, "\x89PNG\r\n\x1A\n")) {
        return 'png';
    }
    if (str_starts_with($head, 'RIFF') && substr($head, 8, 4) === 'WEBP') {
        return 'webp';
    }
    return null;
}

/**
 * The safety net: the stripped file must still be the same image. Anything the
 * parser got wrong — a truncated copy, a segment length misread, a container we
 * only thought we understood — shows up here as a failed or differing
 * getimagesize(), and the stripped copy is thrown away.
 */
function exif_same_image(string $src, string $dest): bool
{
    $a = @getimagesize($src);
    $b = @getimagesize($dest);
    return is_array($a) && is_array($b)
        && $a[0] === $b[0] && $a[1] === $b[1] && $a[2] === $b[2];
}

// ---------------------------------------------------------------------------
// TIFF (the block inside an EXIF segment)
// ---------------------------------------------------------------------------

/**
 * The Orientation tag (0x0112) of a TIFF/EXIF block, or 1 ("upright") when it
 * is absent or unreadable. Only IFD0 is walked: orientation lives there, and a
 * block this code cannot follow simply reads as upright — the same thing a
 * viewer does with a missing tag.
 */
function exif_tiff_orientation(string $tiff): int
{
    if (strlen($tiff) < 8) {
        return 1;
    }
    // Byte order is declared by the block itself: 'II' little-endian, 'MM' big.
    $order = substr($tiff, 0, 2);
    if ($order === 'II') {
        [$short, $long] = ['v', 'V'];
    } elseif ($order === 'MM') {
        [$short, $long] = ['n', 'N'];
    } else {
        return 1;
    }
    if (unpack($short, substr($tiff, 2, 2))[1] !== 42) {
        return 1;
    }
    $ifd = unpack($long, substr($tiff, 4, 4))[1];
    if ($ifd < 8 || $ifd + 2 > strlen($tiff)) {
        return 1;
    }
    $count = unpack($short, substr($tiff, $ifd, 2))[1];
    for ($i = 0; $i < $count; $i++) {
        $entry = $ifd + 2 + $i * 12;
        if ($entry + 12 > strlen($tiff)) {
            break;
        }
        if (unpack($short, substr($tiff, $entry, 2))[1] !== 0x0112) {
            continue;
        }
        // Type 3 = SHORT, and a single one fits in the entry's value field.
        if (unpack($short, substr($tiff, $entry + 2, 2))[1] !== 3) {
            break;
        }
        $value = unpack($short, substr($tiff, $entry + 8, 2))[1];
        return $value >= 1 && $value <= 8 ? $value : 1;
    }
    return 1;
}

/**
 * A complete TIFF block holding one tag: Orientation. 26 bytes, big-endian,
 * one IFD, no thumbnail, no maker note — the whole point being that this is
 * everything we are willing to keep.
 */
function exif_minimal_tiff(int $orientation): string
{
    return "MM\x00\x2A" . pack('N', 8)          // header, IFD0 starts at byte 8
        . pack('n', 1)                          // one entry
        . pack('n', 0x0112) . pack('n', 3) . pack('N', 1)
        . pack('n', $orientation) . "\x00\x00"  // SHORT, left-aligned in 4 bytes
        . pack('N', 0);                         // no IFD1
}

// ---------------------------------------------------------------------------
// Stream helpers
// ---------------------------------------------------------------------------

/** Exactly $len bytes, or null if the stream ended early. */
function exif_read_exact($fh, int $len): ?string
{
    $buf = '';
    while (strlen($buf) < $len) {
        $chunk = fread($fh, $len - strlen($buf));
        if ($chunk === false || $chunk === '') {
            return null;
        }
        $buf .= $chunk;
    }
    return $buf;
}

/** Copy $len bytes across without holding them in memory. */
function exif_copy_bytes($in, $out, int $len): bool
{
    return $len === 0 || stream_copy_to_stream($in, $out, $len) === $len;
}

// ---------------------------------------------------------------------------
// JPEG
// ---------------------------------------------------------------------------

/**
 * JPEG is a chain of marker segments (0xFF, marker, 2-byte length, payload)
 * ending at the start-of-scan, after which the entropy-coded image data runs to
 * the end of the file. Metadata lives entirely in the segments, so stripping is
 * a copy that skips some of them and never looks at the scan.
 */
function exif_strip_jpeg($in, $out): bool
{
    if (fread($in, 2) !== "\xFF\xD8") {
        return false;
    }
    fwrite($out, "\xFF\xD8");
    $removed = false;

    while (true) {
        $head = exif_read_exact($in, 2);
        if ($head === null || $head[0] !== "\xFF") {
            return false;
        }
        $marker = ord($head[1]);

        // Start of scan: the rest of the file is image data, copied verbatim.
        if ($marker === 0xDA) {
            fwrite($out, $head);
            return stream_copy_to_stream($in, $out) !== false && $removed;
        }
        // Markers that carry no payload (only 0x01 and the restart markers can
        // legally appear out here, but passing any of them through keeps a file
        // with padding between segments intact).
        if ($marker === 0x01 || ($marker >= 0xD0 && $marker <= 0xD9)) {
            fwrite($out, $head);
            continue;
        }

        $lenBytes = exif_read_exact($in, 2);
        if ($lenBytes === null) {
            return false;
        }
        $len = unpack('n', $lenBytes)[1];
        if ($len < 2) {
            return false;
        }
        $payloadLen = $len - 2;

        // Only APPn and COM can hold metadata; everything else (quantisation
        // tables, Huffman tables, frame headers) is structure and streams past.
        $isApp = $marker >= 0xE0 && $marker <= 0xEF;
        if (!$isApp && $marker !== 0xFE) {
            fwrite($out, $head . $lenBytes);
            if (!exif_copy_bytes($in, $out, $payloadLen)) {
                return false;
            }
            continue;
        }

        // An APP segment is at most 64 KB, so reading it whole is cheap — and
        // the decision needs its first bytes anyway.
        $payload = exif_read_exact($in, $payloadLen);
        if ($payload === null) {
            return false;
        }
        if (exif_jpeg_segment_is_structural($marker, $payload)) {
            fwrite($out, $head . $lenBytes . $payload);
            continue;
        }

        $removed = true;
        // The one thing worth rescuing: how the camera was held. Re-emitted as
        // a segment holding that tag and nothing else, in place of the original.
        if ($marker === 0xE1 && str_starts_with($payload, "Exif\x00\x00")) {
            $orientation = exif_tiff_orientation(substr($payload, 6));
            if ($orientation > 1) {
                $slim = "Exif\x00\x00" . exif_minimal_tiff($orientation);
                fwrite($out, "\xFF\xE1" . pack('n', strlen($slim) + 2) . $slim);
            }
        }
    }
}

/**
 * True for the few APP segments that describe how to render the image rather
 * than where it came from. Everything else — EXIF and XMP (APP1), IPTC and the
 * Photoshop resource block (APP13), FlashPix, vendor blocks, comments — goes.
 */
function exif_jpeg_segment_is_structural(int $marker, string $payload): bool
{
    return match ($marker) {
        0xE0 => true,                                           // JFIF: pixel density
        0xE2 => str_starts_with($payload, "ICC_PROFILE\x00"),    // colour profile
        0xEE => str_starts_with($payload, 'Adobe'),              // colour transform
        default => false,
    };
}

// ---------------------------------------------------------------------------
// PNG
// ---------------------------------------------------------------------------

/** Chunks that hold metadata rather than image data. */
const EXIF_PNG_DROP_CHUNKS = ['eXIf', 'tEXt', 'iTXt', 'zTXt', 'tIME'];

/**
 * PNG is a signature followed by length/type/data/CRC chunks. Dropping one is
 * simply not copying it; because every chunk carries its own CRC, nothing has
 * to be recomputed for the chunks that stay.
 */
function exif_strip_png($in, $out): bool
{
    $sig = exif_read_exact($in, 8);
    if ($sig === null) {
        return false;
    }
    fwrite($out, $sig);
    $removed = false;

    while (true) {
        $head = exif_read_exact($in, 8);
        if ($head === null) {
            return false;   // ran out before IEND
        }
        $len  = unpack('N', substr($head, 0, 4))[1];
        $type = substr($head, 4, 4);

        if (in_array($type, EXIF_PNG_DROP_CHUNKS, true)) {
            // Only eXIf is worth reading (for the orientation); the rest is
            // skipped without ever being held in memory.
            $data = null;
            if ($type === 'eXIf' && $len <= EXIF_MAX_PARSE_BYTES) {
                $data = exif_read_exact($in, $len);
                if ($data === null) {
                    return false;
                }
            } elseif (fseek($in, $len, SEEK_CUR) !== 0) {
                return false;
            }
            fseek($in, 4, SEEK_CUR);   // the chunk's CRC
            $removed = true;

            if ($data !== null && ($orientation = exif_tiff_orientation($data)) > 1) {
                fwrite($out, exif_png_chunk('eXIf', exif_minimal_tiff($orientation)));
            }
            continue;
        }

        fwrite($out, $head);
        if (!exif_copy_bytes($in, $out, $len)) {
            return false;
        }
        $crc = exif_read_exact($in, 4);
        if ($crc === null) {
            return false;
        }
        fwrite($out, $crc);

        // IEND closes the image; anything appended after it is not part of the
        // PNG and is deliberately not carried over.
        if ($type === 'IEND') {
            return $removed;
        }
    }
}

/** One PNG chunk, CRC included (PHP's crc32 is the one PNG specifies). */
function exif_png_chunk(string $type, string $data): string
{
    return pack('N', strlen($data)) . $type . $data . pack('N', crc32($type . $data));
}

// ---------------------------------------------------------------------------
// WebP
// ---------------------------------------------------------------------------

/**
 * WebP is RIFF: a 12-byte header whose size field covers everything after it,
 * then FourCC/size/payload chunks padded to an even length. Metadata sits in
 * the 'EXIF' and 'XMP ' chunks, and an extended file announces their presence
 * in the VP8X flag byte — so dropping them means clearing those bits too, or
 * decoders go looking for chunks that are no longer there.
 *
 * The orientation is read in a first pass, because VP8X (start of file) has to
 * be written before the EXIF chunk (end of file) is reached.
 */
function exif_strip_webp($in, $out): bool
{
    $header = exif_read_exact($in, 12);
    if ($header === null) {
        return false;
    }
    $orientation = exif_webp_orientation($in);
    fwrite($out, $header);        // RIFF size is patched in at the end
    $payloadBytes = 4;            // the 'WEBP' FourCC already written
    $removed = false;

    while (!feof($in)) {
        $head = exif_read_exact($in, 8);
        if ($head === null) {
            break;                // clean end of file
        }
        $type   = substr($head, 0, 4);
        $len    = unpack('V', substr($head, 4, 4))[1];
        $padded = $len + ($len % 2);

        if ($type === 'EXIF' || $type === 'XMP ') {
            if (fseek($in, $padded, SEEK_CUR) !== 0) {
                return false;
            }
            $removed = true;
            if ($type === 'EXIF' && $orientation > 1) {
                $slim = exif_minimal_tiff($orientation);
                fwrite($out, 'EXIF' . pack('V', strlen($slim)) . $slim);
                $payloadBytes += 8 + strlen($slim);
            }
            continue;
        }

        if ($type === 'VP8X' && $len >= 10) {
            $data = exif_read_exact($in, $padded);
            if ($data === null) {
                return false;
            }
            // Bit 3 = EXIF present, bit 2 = XMP present. The EXIF bit survives
            // only when an orientation-only chunk is being written back.
            $flags = ord($data[0]) & ~0x0C;
            if ($orientation > 1) {
                $flags |= 0x08;
            }
            $data[0] = chr($flags);
            fwrite($out, $head . $data);
            $payloadBytes += 8 + $padded;
            continue;
        }

        fwrite($out, $head);
        if (!exif_copy_bytes($in, $out, $padded)) {
            return false;
        }
        $payloadBytes += 8 + $padded;
    }

    // RIFF states its own length, which just changed.
    if (fseek($out, 4) !== 0) {
        return false;
    }
    fwrite($out, pack('V', $payloadBytes));
    return $removed;
}

/** Orientation from a WebP's EXIF chunk, leaving $in rewound for the real pass. */
function exif_webp_orientation($in): int
{
    $start = ftell($in);
    $orientation = 1;
    while (true) {
        $head = exif_read_exact($in, 8);
        if ($head === null) {
            break;
        }
        $len    = unpack('V', substr($head, 4, 4))[1];
        $padded = $len + ($len % 2);
        if (substr($head, 0, 4) === 'EXIF' && $len <= EXIF_MAX_PARSE_BYTES) {
            $data = exif_read_exact($in, $len);
            $orientation = $data === null ? 1 : exif_tiff_orientation($data);
            break;
        }
        if (fseek($in, $padded, SEEK_CUR) !== 0) {
            break;
        }
    }
    fseek($in, $start);
    return $orientation;
}