<?php
// dashdesign; PHP Check — Beta. Read-only, no network requests, no upload.
// Source: https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
// Rules reviewed: 2026-10-21. Run with the PHP binary you want to inspect.
if (PHP_SAPI !== 'cli' && PHP_SAPI !== 'phpdbg') {
    http_response_code(403);
    exit('CLI only. Do not publish this file in a web directory.');
}
$fixes = array(
    '8.2' => 35,
    '8.3' => 36,
    '8.4' => 27,
    '8.5' => 12
);
$status = 'unknown';
$required = null;
if (preg_match('/^(\d+)\.(\d+)\.(\d+)$/D', PHP_VERSION, $parts)) {
    $branch = $parts[1] . '.' . $parts[2];
    if (isset($fixes[$branch])) {
        $required = $branch . '.' . $fixes[$branch];
        $status = ((int) $parts[3] >= $fixes[$branch]) ? 'patched' : 'affected';
    } elseif ((int) $parts[1] >= 5 && ((int) $parts[1] < 8 || ((int) $parts[1] === 8 && (int) $parts[2] < 2))) {
        $status = 'affected';
    }
}
$labels = array('affected' => 'Wahrscheinlich betroffen', 'patched' => 'Wahrscheinlich behoben', 'unknown' => 'Nicht feststellbar');
$report = array(
    'tool' => 'dashdesign; PHP Check Beta',
    'advisory' => 'https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w',
    'rules_reviewed' => '2026-10-21',
    'checked_at' => gmdate('c'),
    'verdict' => $status,
    'result' => $labels[$status],
    'php_version' => PHP_VERSION,
    'minimum_fixed_release_for_branch' => $required,
    'sapi' => PHP_SAPI,
    'web_runtime_verified' => false,
    'vendor_backport_verified' => false,
    'memory_limit' => ini_get('memory_limit'),
    'post_max_size' => ini_get('post_max_size'),
    'file_uploads' => (bool) ini_get('file_uploads'),
    'note' => 'Nur die lokale CLI-PHP-Laufzeit wurde geprüft. Web-PHP und andere Pools können abweichen. Anbieter-Backports sind nicht erkennbar. Kein Ausnutzbarkeitstest.'
);
echo json_encode($report, JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES) . PHP_EOL;