<?php
include 'auth.php';
bg_require_admin();
require_once __DIR__ . '/includes/config_manager.php';
$page_title = bg_t('settings') . ' - BastionGuard WebUI';
$active_page = 'settings.php';

function sx($en, $it) { return bg_language() === 'en' ? $en : $it; }
function checked($v) { return $v ? 'checked' : ''; }
function selected($a, $b) { return (string)$a === (string)$b ? 'selected' : ''; }
function sx_lines($value, array $default = []) {
    $value = trim((string)$value);
    if ($value === '') return $default;
    $parts = preg_split('/[;\r\n]+/', $value);
    $out = [];
    foreach ($parts as $p) { $p = trim($p); if ($p !== '') $out[] = $p; }
    return $out ?: $default;
}
function sx_join_semicolon($text) { return implode(';', bg_normalize_lines((string)$text)); }
function sx_bool($arr, $key, $default=false) {
    if (!is_array($arr) || !array_key_exists($key, $arr)) return $default;
    $v = $arr[$key];
    if (is_bool($v)) return $v;
    $v = strtolower(trim((string)$v));
    return in_array($v, ['1','true','yes','on','enabled'], true);
}
function sx_int($arr, $key, $default=0) {
    return (is_array($arr) && isset($arr[$key]) && is_numeric($arr[$key])) ? (int)$arr[$key] : $default;
}
function sx_config_read_key($key, $defaultRaw = '') {
    $catalog = bg_config_catalog();
    if (!isset($catalog[$key])) return ['raw'=>$defaultRaw, 'parsed'=>[], 'exists'=>false, 'via'=>'none'];
    $r = bg_config_read($catalog[$key]);
    if (trim((string)($r['raw'] ?? '')) === '' && $defaultRaw !== '') {
        $r['raw'] = $defaultRaw;
        $r['parsed'] = @parse_ini_string($defaultRaw, false, INI_SCANNER_RAW) ?: [];
    }
    return $r;
}
function sx_config_parsed($key, $fallback = []) {
    $r = sx_config_read_key($key);
    return is_array($r['parsed'] ?? null) ? $r['parsed'] : $fallback;
}
function sx_save_config_key($key, $content, $user = null) {
    return bg_config_save_key($key, (string)$content);
}
function sx_json_config($key, $fallback = []) {
    $r = sx_config_read_key($key);
    if (is_array($r['parsed'] ?? null)) return $r['parsed'];
    return $fallback;
}
function sx_scanner_raw_from_values(array $old, array $updates) {
    $merged = array_merge($old, $updates);
    $out  = "# --- BastionGuard Anti-Ransomware Config ---\n";
    $out .= 'suspicious_only=' . (!empty($merged['suspicious_only']) ? '1' : '0') . "\n";
    $out .= 'ignore_paths=' . ($merged['ignore_paths'] ?? '/proc;/sys;/dev;/run;/tmp') . "\n";
    $out .= 'ignore_ext=' . ($merged['ignore_ext'] ?? '.tmp;.log;.cache') . "\n";
    $out .= 'suspicious_ext=' . ($merged['suspicious_ext'] ?? '.locked;.encrypted;.crypt;.enc') . "\n\n";
    $out .= "# --- Ransomware Scanner ---\n";
    $out .= 'enable_yara=' . (!empty($merged['enable_yara']) ? '1' : '0') . "\n";
    $out .= 'enable_sanesecurity=' . (!empty($merged['enable_sanesecurity']) ? '1' : '0') . "\n";
    $out .= 'scan_interval=' . max(1, (int)($merged['scan_interval'] ?? 60)) . "\n";
    $out .= 'scan_path=' . ($merged['scan_path'] ?? '/home') . "\n";
    return $out;
}
function sx_clamd_read() {
    $res = bg_admin_helper(['read-clamd-b64'], 60);
    if ((int)($res['code'] ?? 1) === 0) {
        $raw = base64_decode(trim((string)$res['output']), true);
        if ($raw !== false) return ['raw'=>$raw, 'path'=>'auto', 'via'=>'helper', 'error'=>''];
    }
    foreach (['/etc/clamd/clamd.conf','/etc/clamav/clamd.conf','/etc/clamd.d/clamd.conf','/etc/clamd.conf'] as $p) {
        if (is_file($p) && is_readable($p)) return ['raw'=>(string)file_get_contents($p), 'path'=>$p, 'via'=>'direct', 'error'=>''];
    }
    return ['raw'=>"OnAccessIncludePath /home\nScanPE yes\nScanELF yes\nScanOLE2 yes\nScanPDF yes\nScanSWF yes\nScanXMLDOCS yes\nScanHWP3 yes\nScanArchive yes\n", 'path'=>'not found', 'via'=>'default', 'error'=>(string)($res['output'] ?? '')];
}
function sx_parse_clamd($raw) {
    $paths = [];
    $opts = [];
    foreach (preg_split('/\R/', (string)$raw) as $line) {
        $t = trim($line);
        if ($t === '') continue;
        $commented = str_starts_with($t, '#');
        if ($commented) $t = trim(substr($t, 1));
        if (!preg_match('/^([A-Za-z0-9_]+)\s+(.+)$/', $t, $m)) continue;
        $key = $m[1]; $value = trim($m[2]);
        if (!$commented && $key === 'OnAccessIncludePath') $paths[] = $value;
        if (in_array(strtolower($value), ['yes','no'], true)) $opts[$key] = (!$commented && strtolower($value) === 'yes');
    }
    return ['paths'=>array_values(array_unique($paths)), 'options'=>$opts];
}
function sx_build_clamd($raw, array $paths = null, array $options = null) {
    $lines = preg_split('/\R/', (string)$raw);
    $out = [];
    $seenOpt = [];
    foreach ($lines as $line) {
        $t = trim($line);
        $commented = str_starts_with($t, '#');
        $probe = $commented ? trim(substr($t,1)) : $t;
        if (preg_match('/^OnAccessIncludePath\s+/', $probe) && $paths !== null) continue;
        if ($options !== null && preg_match('/^([A-Za-z0-9_]+)\s+(yes|no)\s*$/i', $probe, $m)) {
            $key = $m[1];
            if (array_key_exists($key, $options)) {
                $out[] = $key . ' ' . (!empty($options[$key]) ? 'yes' : 'no');
                $seenOpt[$key] = true;
                continue;
            }
        }
        $out[] = $line;
    }
    if ($paths !== null) {
        $out[] = '';
        $out[] = '# BastionGuard WebPanel On-Access paths';
        foreach (array_values(array_unique(array_filter(array_map('trim',$paths)))) as $p) $out[] = 'OnAccessIncludePath ' . $p;
    }
    if ($options !== null) {
        foreach ($options as $k=>$v) if (!isset($seenOpt[$k])) $out[] = $k . ' ' . ($v ? 'yes' : 'no');
    }
    return rtrim(implode("\n", $out)) . "\n";
}
function sx_write_clamd($raw) {
    return bg_admin_helper(['write-clamd-b64', base64_encode((string)$raw)], 120);
}
function sx_list_yara_rules() {
    $rules = [];
    foreach (['/usr/share/BastionGuard/data/yara', bg_bastionguard_data_dir() . '/data/yara'] as $dir) {
        if (!is_dir($dir) || !is_readable($dir)) continue;
        foreach (glob($dir.'/*.{yar,yara}', GLOB_BRACE) ?: [] as $file) {
            $raw = @file_get_contents($file);
            if ($raw && preg_match_all('/^\s*rule\s+([A-Za-z0-9_]+)/m', $raw, $m)) foreach($m[1] as $r) $rules[]=$r;
        }
    }
    return array_values(array_unique($rules));
}
function sx_list_blacklists() {
    $files = ['/usr/share/BastionGuard/data/phishing/blacklist.txt','/usr/share/BastionGuard/data/phishing/blacklist-reduce.txt','/usr/share/BastionGuard/data/phishing/blacklist_custom.txt', bg_bastionguard_data_dir().'/data/phishing/blacklist.txt', bg_bastionguard_data_dir().'/data/phishing/blacklist-reduce.txt'];
    $out=[];
    foreach($files as $file){ if(!is_file($file)) continue; $lines=0; if(is_readable($file) && ($fh=@fopen($file,'r'))){ while(!feof($fh)){ fgets($fh); $lines++; } fclose($fh); } $out[]=['file'=>$file,'size'=>@filesize($file)?:0,'mtime'=>@filemtime($file)?:0,'lines'=>$lines]; }
    return $out;
}
function sx_google_safe_test($key) {
    $key = trim((string)$key);
    if ($key === '') return ['code'=>1,'output'=>sx('No API key configured.','Nessuna API key configurata.')];
    $res = bg_http_get('https://safebrowsing.googleapis.com/v4/threatLists?key=' . rawurlencode($key), [], 15);
    $ok = (($res['code'] ?? 0) >= 200 && ($res['code'] ?? 0) < 300 && str_contains((string)($res['body'] ?? ''), 'threatType'));
    return ['code'=>$ok?0:1, 'output'=>$ok ? sx('Google Safe Browsing key is valid.','Chiave Google Safe Browsing valida.') : ('HTTP '.($res['code'] ?? 0)."\n".(($res['error'] ?? '') ?: substr((string)($res['body'] ?? ''),0,500)))];
}

function sx_shell_first_line($cmd) {
    $out = trim((string)bg_shell_exec($cmd));
    $lines = preg_split('/\R+/', $out);
    return trim((string)($lines[0] ?? ''));
}
function sx_cmd_exists($cmd) {
    return bg_cmd_exists($cmd);
}
function sx_service_active($service) {
    $service = preg_replace('/[^A-Za-z0-9_.@:-]/', '', (string)$service);
    if ($service === '') return false;
    $res = bg_run_argv(['systemctl','is-active','--quiet',$service], 10);
    return (int)($res['code'] ?? 1) === 0;
}
function sx_detect_distro() {
    $id = '';
    if (sx_cmd_exists('lsb_release')) {
        $lsb = sx_shell_first_line('lsb_release -si 2>/dev/null');
        if ($lsb !== '' && stripos($lsb, 'n/a') === false) $id = $lsb;
    }
    if ($id === '' && is_readable('/etc/os-release')) {
        foreach (file('/etc/os-release', FILE_IGNORE_NEW_LINES) ?: [] as $line) {
            if (strpos($line, 'ID=') === 0) {
                $id = trim(substr($line, 3), " \t\n\r\0\x0B\"");
                break;
            }
        }
    }
    if ($id === '') {
        if (file_exists('/etc/arch-release')) $id = 'arch';
        elseif (file_exists('/etc/debian_version')) $id = 'debian';
        elseif (file_exists('/etc/redhat-release')) $id = 'fedora';
        elseif (file_exists('/etc/gentoo-release')) $id = 'gentoo';
        elseif (file_exists('/etc/slackware-version')) $id = 'slackware';
        elseif (file_exists('/usr/local/etc/rc.conf')) $id = 'bsd';
    }
    $id = strtolower($id);
    if (str_contains($id, 'debian') || str_contains($id, 'ubuntu') || str_contains($id, 'mint')) return 'debian';
    if (str_contains($id, 'fedora') || str_contains($id, 'rhel') || str_contains($id, 'centos') || str_contains($id, 'alma') || str_contains($id, 'rocky')) return 'fedora';
    if (str_contains($id, 'arch') || str_contains($id, 'manjaro') || str_contains($id, 'endeavour')) return 'arch';
    if (str_contains($id, 'suse')) return 'opensuse';
    if (str_contains($id, 'gentoo')) return 'gentoo';
    if (str_contains($id, 'slackware')) return 'slackware';
    if (str_contains($id, 'bsd')) return 'bsd';
    return 'auto';
}
function sx_detect_webserver() {
    if (sx_service_active('apache2') || sx_service_active('httpd') || sx_cmd_exists('apache2') || sx_cmd_exists('httpd')) return 'apache';
    if (sx_service_active('nginx') || sx_cmd_exists('nginx')) return 'nginx';
    if (sx_service_active('lshttpd') || sx_service_active('lsws') || sx_cmd_exists('lsws') || sx_cmd_exists('lshttpd')) return 'litespeed';
    $out = (string)bg_shell_exec("ps -eo comm 2>/dev/null | grep -E 'apache2|httpd|nginx|lshttpd|lsws' | grep -v grep 2>/dev/null");
    if (str_contains($out, 'apache2') || str_contains($out, 'httpd')) return 'apache';
    if (str_contains($out, 'nginx')) return 'nginx';
    if (str_contains($out, 'lshttpd') || str_contains($out, 'lsws')) return 'litespeed';
    return 'unknown';
}
function sx_read_webports_conf() {
    $http = 81;
    $https = 444;
    foreach (['/etc/BastionGuard/webports.conf','/tmp/BastionGuard_webports.conf'] as $p) {
        if (!is_readable($p)) continue;
        $raw = trim((string)@file_get_contents($p));
        if ($raw === '') continue;
        $parts = preg_split('/\s+/', $raw);
        $p1 = isset($parts[0]) && is_numeric($parts[0]) ? (int)$parts[0] : 0;
        $p2 = isset($parts[1]) && is_numeric($parts[1]) ? (int)$parts[1] : 0;
        if ($p1 > 0 && $p1 < 65536) $http = $p1;
        if ($p2 > 0 && $p2 < 65536) $https = $p2;
        break;
    }
    return [$http, $https];
}
function sx_distro_label($id) {
    $labels = ['auto'=>'auto','debian'=>'Debian / Ubuntu / Mint','fedora'=>'Fedora / RHEL / CentOS / Alma / Rocky','arch'=>'Arch / Manjaro / Endeavour','opensuse'=>'openSUSE / SLE','gentoo'=>'Gentoo','slackware'=>'Slackware','bsd'=>'BSD'];
    return $labels[$id] ?? $id;
}
function sx_webserver_label($id) {
    $labels = ['apache'=>'Apache / httpd','nginx'=>'NGINX','litespeed'=>'LiteSpeed','unknown'=>sx('not detected','non rilevato')];
    return $labels[$id] ?? $id;
}

$detectedDistro = sx_detect_distro();
$detectedWebserver = sx_detect_webserver();
[$detectedHttp, $detectedHttps] = sx_read_webports_conf();
$detectedUser = bg_detect_desktop_user();
$web = bg_read_json('web_options.json', ['http_port'=>$detectedHttp,'https_port'=>$detectedHttps,'desktop_user'=>$detectedUser]);
unset($web['language'], $web['theme']);
$web['language'] = bg_language();
$web['theme'] = bg_theme();
if (empty($web['desktop_user']) && $detectedUser !== '') $web['desktop_user'] = $detectedUser;
$web['http_port'] = $detectedHttp;
$web['https_port'] = $detectedHttps;
$web['webpanel_name'] = bg_sanitize_webpanel_name($web['webpanel_name'] ?? 'WebPanel');
$web['dashboard_widgets'] = array_merge(bg_dashboard_widget_defaults(), is_array($web['dashboard_widgets'] ?? null) ? $web['dashboard_widgets'] : []);
$desktopUser = $web['desktop_user'] ?: $detectedUser;
$desktopMode = bg_desktop_mode_summary($desktopUser);
$desktopGuiActive = !empty($desktopMode['gui']);
$desktopModeSummary = (string)($desktopMode['summary'] ?? 'headless');
$catalog = bg_services_catalog();
$cfgCatalog = bg_config_catalog();

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    csrf_validate();
    $a = $_POST['action'] ?? '';
    $targetUser = preg_replace('/[^a-zA-Z0-9_-]/', '', (string)($_POST['desktop_user'] ?? $desktopUser));
    if ($a === 'save-web') {
        $web = bg_read_json('web_options.json', []);
        if (!is_array($web)) $web = [];
        unset($web['language'], $web['theme']);
        $web['http_port'] = max(1,min(65535,(int)($_POST['http_port'] ?? 81)));
        $web['https_port'] = max(1,min(65535,(int)($_POST['https_port'] ?? 444)));
        $web['desktop_user'] = $targetUser;
        $web['webpanel_name'] = bg_sanitize_webpanel_name($_POST['webpanel_name'] ?? 'WebPanel');
        $selectedWidgets = $_POST['dashboard_widgets'] ?? [];
        $dashboardWidgets = [];
        foreach (bg_dashboard_widget_defaults() as $widgetKey => $_defaultEnabled) {
            $dashboardWidgets[$widgetKey] = isset($selectedWidgets[$widgetKey]);
        }
        $web['dashboard_widgets'] = $dashboardWidgets;
        bg_write_json('web_options.json', $web);
        bg_flash('success', bg_t('web_options_saved'));
        bg_redirect('settings.php#options');
    } elseif ($a === 'apply-web-config') {
        $chosenOs = $_POST['os'] ?? $detectedDistro;
        if ($chosenOs === '' || $chosenOs === 'auto') $chosenOs = $detectedDistro;
        $httpPort = max(1,min(65535,(int)($_POST['http_port'] ?? $detectedHttp)));
        $httpsPort = max(1,min(65535,(int)($_POST['https_port'] ?? $detectedHttps)));
        $res = bg_admin_helper(['apply-web-config', $httpPort, $httpsPort, $chosenOs], 120);
        if ((int)($res['code'] ?? 1) === 0) {
            $web['http_port'] = $httpPort;
            $web['https_port'] = $httpsPort;
            $web['detected_distro'] = $chosenOs;
            $web['detected_webserver'] = $detectedWebserver;
            unset($web['language'], $web['theme']);
            bg_write_json('web_options.json', $web);
        }
        bg_flash(((int)($res['code'] ?? 1)===0)?'success':'warning', $res['output'] ?: sx('Web configuration applied.','Configurazione web applicata.'));
        bg_redirect('settings.php#options');
    } elseif ($a === 'save-clamav-base') {
        $clamd = sx_clamd_read(); $parsed = sx_parse_clamd($clamd['raw']);
        $paths = bg_normalize_lines($_POST['onaccess_paths'] ?? '');
        $raw = sx_build_clamd($clamd['raw'], $paths, null);
        $res = sx_write_clamd($raw);
        $q = trim((string)($_POST['quarantine_path'] ?? ''));
        if ($q !== '') sx_save_config_key('config_ini', 'quarantinePath=' . $q . "\n", $targetUser);
        bg_flash(((int)($res['code'] ?? 1)===0)?'success':'warning', $res['output'] ?: sx('ClamAV realtime settings saved.','Impostazioni realtime ClamAV salvate.'));
        bg_redirect('settings.php#base');
    } elseif ($a === 'save-clamav-advanced') {
        $clamd = sx_clamd_read(); $parsed = sx_parse_clamd($clamd['raw']);
        $new = [];
        foreach (array_keys($parsed['options']) as $opt) $new[$opt] = !empty($_POST['scan_option'][$opt]);
        $raw = sx_build_clamd($clamd['raw'], null, $new);
        $res = sx_write_clamd($raw);
        bg_flash(((int)($res['code'] ?? 1)===0)?'success':'warning', $res['output'] ?: sx('ClamAV scan options saved.','Opzioni scansione ClamAV salvate.'));
        bg_redirect('settings.php#advanced');
    } elseif ($a === 'realtime-start' || $a === 'realtime-stop' || $a === 'realtime-restart') {
        $op = str_replace('realtime-', '', $a);
        $res = bg_service_action(['clamav-clamonacc.service','clamonacc.service'], $op, false);
        bg_flash(((int)($res['code'] ?? 1)===0)?'success':'warning', $res['output'] ?: 'systemctl '.$op);
        bg_redirect('settings.php#base');
    } elseif ($a === 'save-ransom-scanner') {
        $scanner = sx_config_parsed('scanner', []);
        $updates = [
            'enable_yara'=>!empty($_POST['enable_yara']),
            'enable_sanesecurity'=>!empty($_POST['enable_sanesecurity']),
            'scan_interval'=>max(1,(int)($_POST['scan_interval'] ?? 60)),
            'scan_path'=>sx_join_semicolon($_POST['scan_path'] ?? ''),
            'suspicious_only'=>sx_bool($scanner,'suspicious_only',false),
            'ignore_paths'=>$scanner['ignore_paths'] ?? '/proc;/sys;/dev;/run;/tmp',
            'ignore_ext'=>$scanner['ignore_ext'] ?? '.tmp;.log;.cache',
            'suspicious_ext'=>$scanner['suspicious_ext'] ?? '.locked;.encrypted;.crypt;.enc',
        ];
        $res = sx_save_config_key('scanner', sx_scanner_raw_from_values($scanner, $updates), $targetUser);
        bg_flash(((int)($res['code'] ?? 1)===0)?'success':'warning', $res['output'] ?: sx('Scanner configuration saved.','Configurazione scanner salvata.'));
        bg_redirect('settings.php#antiransomware');
    } elseif ($a === 'save-ransom-advanced') {
        $scanner = sx_config_parsed('scanner', []);
        $updates = [
            'suspicious_only'=>!empty($_POST['suspicious_only']),
            'ignore_paths'=>sx_join_semicolon($_POST['ignore_paths'] ?? ''),
            'ignore_ext'=>sx_join_semicolon($_POST['ignore_ext'] ?? ''),
            'suspicious_ext'=>sx_join_semicolon($_POST['suspicious_ext'] ?? ''),
            'enable_yara'=>sx_bool($scanner,'enable_yara',true),
            'enable_sanesecurity'=>sx_bool($scanner,'enable_sanesecurity',true),
            'scan_interval'=>sx_int($scanner,'scan_interval',60),
            'scan_path'=>$scanner['scan_path'] ?? '/home',
        ];
        sx_save_config_key('scanner', sx_scanner_raw_from_values($scanner, $updates), $targetUser);
        $allowLines = [];
        foreach (preg_split('/\R/', (string)($_POST['allowlist'] ?? '')) as $line) { $line=trim($line); if ($line !== '') $allowLines[]=$line; }
        $res = sx_save_config_key('allowlist', implode("\n", $allowLines)."\n", $targetUser);
        bg_flash(((int)($res['code'] ?? 1)===0)?'success':'warning', $res['output'] ?: sx('Advanced anti-ransomware settings saved.','Impostazioni anti-ransomware avanzate salvate.'));
        bg_redirect('settings.php#advanced-ransomware');
    } elseif ($a === 'update-yara' || $a === 'update-sanesecurity' || $a === 'update-phishing') {
        $cmd = ['update-yara'=>'update-yara','update-sanesecurity'=>'update-sanesecurity','update-phishing'=>'update-phishing'][$a];
        $res = bg_admin_helper([$cmd, $targetUser], 900);
        bg_flash(((int)($res['code'] ?? 1)===0)?'success':'warning', $res['output'] ?: $cmd);
        bg_redirect($a==='update-phishing'?'settings.php#antiphishing':'settings.php#antiransomware');
    } elseif ($a === 'save-antiphish') {
        $g = "# Google Safe Browsing configuration\n";
        $g .= 'google_safe_enabled=' . (!empty($_POST['google_safe_enabled']) ? 'true' : 'false') . "\n";
        $g .= 'google_safe_key=' . trim((string)($_POST['google_safe_key'] ?? '')) . "\n";
        sx_save_config_key('googlesafe', $g, $targetUser);
        $fw = 'enabled=' . (!empty($_POST['firewall_enabled']) ? '1' : '0') . "\nmode=" . preg_replace('/[^a-z0-9_-]/i','',$_POST['firewall_mode'] ?? 'auto') . "\n";
        $res = sx_save_config_key('firewall', $fw, $targetUser);
        if (!empty($_POST['auto_update'])) bg_admin_helper(['phish-auto-update','enable'],120); else bg_admin_helper(['phish-auto-update','disable'],120);
        bg_flash(((int)($res['code'] ?? 1)===0)?'success':'warning', $res['output'] ?: sx('Anti-phishing settings saved.','Impostazioni anti-phishing salvate.'));
        bg_redirect('settings.php#antiphishing');
    } elseif ($a === 'test-googlesafe') {
        $res = sx_google_safe_test($_POST['google_safe_key'] ?? '');
        bg_flash(((int)$res['code']===0)?'success':'warning', $res['output']);
        bg_redirect('settings.php#antiphishing');
    } elseif ($a === 'save-whitelist-blacklist') {
        $wl = array_values(array_unique(array_map('bg_normalize_domain', bg_normalize_lines($_POST['whitelist'] ?? ''))));
        $bl = array_values(array_unique(array_map('bg_normalize_domain', bg_normalize_lines($_POST['blacklist'] ?? ''))));
        $res = sx_save_config_key('whitelist', json_encode(['domains'=>array_values(array_filter($wl))], JSON_PRETTY_PRINT|JSON_UNESCAPED_SLASHES)."\n", $targetUser);
        $custom = implode("\n", array_values(array_filter($bl)))."\n";
        if (trim($custom) !== '') bg_admin_helper(['write-system-file-b64','phishing_custom',base64_encode($custom)], 120);
        bg_flash(((int)($res['code'] ?? 1)===0)?'success':'warning', sx('Whitelist/blacklist saved.','Whitelist/blacklist salvate.'));
        bg_redirect('settings.php#advanced-phishing');
    } elseif ($a === 'save-payments') {
        $domains = array_values(array_unique(array_filter(array_map('bg_normalize_domain', bg_normalize_lines($_POST['domains'] ?? '')))));
        $paymentsJson = ['version'=>1,'updated_at'=>gmdate('Y-m-d'),'list'=>$domains];
        sx_save_config_key('payments', json_encode($paymentsJson, JSON_PRETTY_PRINT|JSON_UNESCAPED_SLASHES)."\n", $targetUser);
        $settings = sx_json_config('settings', ['version'=>1]);
        if (!isset($settings['security']) || !is_array($settings['security'])) $settings['security']=[];
        $settings['security']['secure_payments_enabled'] = !empty($_POST['enabled']);
        $res = sx_save_config_key('settings', json_encode($settings, JSON_PRETTY_PRINT|JSON_UNESCAPED_SLASHES)."\n", $targetUser);
        $ok = ((int)($res['code'] ?? 1)===0);
        $msg = sx('Safe payments saved. The WebUI never manages CEF/PAC; use the GTK UI for desktop secure browsing.', 'Pagamenti sicuri salvati. La WebUI non gestisce mai CEF/PAC; usa la GUI GTK per la navigazione sicura desktop.');
        bg_flash($ok?'success':'warning', $msg);
        bg_redirect('settings.php#payments');
    } elseif ($a === 'save-proxy-bypass') {
        $domains = array_values(array_unique(array_filter(array_map('bg_normalize_domain', bg_normalize_lines($_POST['domains'] ?? '')))));
        $res = sx_save_config_key('proxy_bypass', json_encode(['domains'=>$domains], JSON_PRETTY_PRINT|JSON_UNESCAPED_SLASHES)."\n", $targetUser);
        $ok = ((int)($res['code'] ?? 1)===0);
        $msg = sx('Proxy bypass saved. The WebUI never manages CEF/PAC or desktop proxy ownership; use the GTK UI.', 'Bypass proxy salvato. La WebUI non gestisce mai CEF/PAC né la proprietà del proxy desktop; usa la GUI GTK.');
        bg_flash($ok?'success':'warning', $msg);
        bg_redirect('settings.php#proxy-bypass');
    } elseif ($a === 'install-secure-ca') {
        bg_flash('warning', sx('Secure browsing / CEF / PAC bootstrap is disabled in the WebUI. Use the GTK desktop UI for browser proxy setup.', 'Il bootstrap Navigazione sicura / CEF / PAC è disabilitato nella WebUI. Usa la GUI GTK desktop per configurare il proxy browser.'));
        bg_redirect('settings.php#payments');
    } elseif ($a === 'save-email') {
        $old = sx_json_config('mail', []);
        $oldProfile = $old['profiles'][0] ?? [];
        $pass = (string)($_POST['smtp_password'] ?? '');
        $profile = [
            'id'=>'default','label'=>trim((string)($_POST['profile_label'] ?? 'Default')) ?: 'Default',
            'match_from'=>sx_lines($_POST['match_from'] ?? ''),'match_from_domain'=>sx_lines($_POST['match_from_domain'] ?? ''),
            'smtp_host'=>trim((string)($_POST['smtp_host'] ?? '')),
            'smtp_port'=>max(1,min(65535,(int)($_POST['smtp_port'] ?? 587))),
            'starttls'=>!empty($_POST['starttls']),'implicit_tls'=>!empty($_POST['implicit_tls']),'username'=>trim((string)($_POST['smtp_user'] ?? '')),
            'password'=>$pass !== '' ? $pass : (string)($oldProfile['password'] ?? ''),
            'signature'=>['display_name'=>trim((string)($_POST['display_name'] ?? '')),'job_title'=>trim((string)($_POST['job_title'] ?? '')),'company'=>trim((string)($_POST['company'] ?? '')),'phone'=>trim((string)($_POST['phone'] ?? '')),'website'=>trim((string)($_POST['website'] ?? '')),'logo_path'=>'/usr/share/BastionGuard/data/logo.png']
        ];
        $mail = ['version'=>2,'enabled'=>!empty($_POST['enabled']),'scan_outgoing'=>!empty($_POST['scan_outgoing']),'inject_signature'=>!empty($_POST['inject_signature']),'local_smtp_host'=>trim((string)($_POST['local_host'] ?? '127.0.0.1')),'local_smtp_port'=>max(1,min(65535,(int)($_POST['local_port'] ?? 2525))),'local_smtp_tls_port'=>max(1,min(65535,(int)($_POST['local_tls_port'] ?? 2465))),'local_submission_port'=>max(1,min(65535,(int)($_POST['local_submission_port'] ?? 2587))),'advertise_starttls'=>!empty($_POST['advertise_starttls']),'enable_implicit_tls_listener'=>!empty($_POST['enable_implicit_tls_listener']),'default_profile_id'=>'default','profiles'=>[$profile]];
        $res = sx_save_config_key('mail', json_encode($mail, JSON_PRETTY_PRINT|JSON_UNESCAPED_SLASHES)."\n", $targetUser);
        bg_admin_helper(['restart-user-service',$targetUser,'BastionGuard-mailproxy.service'],60);
        bg_flash(((int)($res['code'] ?? 1)===0)?'success':'warning', $res['output'] ?: sx('Email configuration saved.','Configurazione email salvata.'));
        bg_redirect('settings.php#email');
    } elseif ($a === 'install-thunderbird-extension') {
        $res = bg_admin_helper(['install-thunderbird-extension',$targetUser],300);
        bg_flash(((int)($res['code'] ?? 1)===0)?'success':'warning', $res['output'] ?: 'Thunderbird extension install.');
        bg_redirect('settings.php#email');
    } elseif ($a === 'alert-email') {
        $old = bg_alert_mail_config();
        $cfg = ['enabled'=>!empty($_POST['enabled']),'use_admin_emails'=>!empty($_POST['use_admin_emails']),'recipients'=>trim((string)($_POST['recipients'] ?? '')),'from'=>trim((string)($_POST['from'] ?? 'bastionguard@localhost')),'smtp_host'=>trim((string)($_POST['smtp_host'] ?? '')),'smtp_port'=>max(1,min(65535,(int)($_POST['smtp_port'] ?? 587))),'smtp_secure'=>in_array($_POST['smtp_secure'] ?? 'starttls',['none','starttls','ssl'],true)?$_POST['smtp_secure']:'starttls','smtp_user'=>trim((string)($_POST['smtp_user'] ?? '')),'smtp_pass'=>($_POST['smtp_pass'] ?? '') !== '' ? (string)$_POST['smtp_pass'] : (string)($old['smtp_pass'] ?? ''),'sendmail_fallback'=>!empty($_POST['sendmail_fallback'])];
        bg_write_json('alert_email.json', $cfg);
        if (!empty($_POST['send_test'])) $res = bg_smtp_send($cfg, bg_alert_mail_recipients($cfg), '[BastionGuard] Test alert email', 'BastionGuard WebPanel SMTP alert test.');
        else $res = ['code'=>0,'output'=>sx('Server alert email saved.','Email avvisi server salvata.')];
        bg_flash(((int)($res['code'] ?? 1)===0)?'success':'warning', $res['output']);
        bg_redirect('settings.php#server-alerts');
    } elseif (str_starts_with($a, 'svc:')) {
        [$x,$key,$op] = array_pad(explode(':',$a,3),3,'');
        if (isset($catalog[$key])) $res = bg_service_action($catalog[$key]['services'], $op, $catalog[$key]['user']);
        else $res = ['code'=>1,'output'=>'Unknown service'];
        bg_flash(((int)($res['code'] ?? 1)===0)?'success':'warning', $res['output'] ?: 'systemctl '.$op);
        bg_redirect('settings.php#services');
    }
}

$clamd = sx_clamd_read();
$clamdParsed = sx_parse_clamd($clamd['raw']);
$configIni = sx_config_parsed('config_ini', ['quarantinePath'=>bg_bastionguard_data_dir($desktopUser).'/quarantine']);
$scanner = sx_config_parsed('scanner', []);
$allow = sx_config_read_key('allowlist');
$googlesafe = sx_config_parsed('googlesafe', ['google_safe_enabled'=>'false','google_safe_key'=>'']);
$firewall = sx_config_parsed('firewall', ['enabled'=>'1','mode'=>'auto']);
$whitelist = sx_json_config('whitelist', ['domains'=>[]]);
$settingsJson = sx_json_config('settings', ['version'=>1,'security'=>['secure_payments_enabled'=>false]]);
$payments = sx_json_config('payments', ['version'=>1,'list'=>['paypal.com','stripe.com','adyen.com','klarna.com','checkout.com','worldpay.com','braintreepayments.com','amazonpay.com','pay.google.com','pay.apple.com']]);
$proxyBypass = sx_json_config('proxy_bypass', ['domains'=>['localhost','127.0.0.1']]);
$mail = sx_json_config('mail', bg_config_catalog()['mail']['default']);
$mailProfile = $mail['profiles'][0] ?? bg_config_catalog()['mail']['default']['profiles'][0];
$alertMail = bg_alert_mail_config();
$clamdb = bg_clamdb_versions();
$yaraRules = sx_list_yara_rules();
$blacklists = sx_list_blacklists();
include 'includes/header.php';
include 'includes/sidebar.php';
?>
<div class="page-title"><div><h1><?= bg_e(bg_t('settings_title')) ?></h1><p><?= bg_e(sx('All settings are mapped to the GTK SettingsPage and write the same BastionGuard configuration files or call the privileged backend helper.','Tutte le impostazioni sono mappate alla SettingsPage GTK e scrivono gli stessi file di configurazione BastionGuard o chiamano l’helper backend privilegiato.')) ?></p></div></div>

<div class="alert <?= $desktopGuiActive ? 'alert-warning' : 'alert-success' ?> py-2">
  <strong><?= bg_e(sx('Desktop arbitration','Arbitraggio desktop')) ?>:</strong>
  <?php if ($desktopGuiActive): ?>
    <?= bg_e(sx('A graphical desktop is active. The WebUI never manages CEF/PAC; use the GTK UI for desktop proxy/browser actions.','È attiva una sessione desktop grafica. La WebUI non gestisce mai CEF/PAC; usa la GUI GTK per proxy/browser desktop.')) ?>
  <?php else: ?>
    <?= bg_e(sx('No graphical desktop session detected. CEF/PAC still stay disabled in the WebUI because they belong to the GTK/desktop UI.','Nessuna sessione desktop grafica rilevata. CEF/PAC restano comunque disabilitati nella WebUI perché appartengono alla GUI GTK/desktop.')) ?>
  <?php endif; ?>
  <div class="small mt-1"><code><?= bg_e($desktopModeSummary) ?></code></div>
</div>

<ul class="nav nav-tabs settings-tabs" role="tablist">
  <?php $tabs=[['base',sx('Base','Base')],['advanced',sx('Advanced','Avanzate')],['antiransomware','Anti-Ransomware'],['advanced-ransomware',sx('Advanced Anti-Ransomware','Anti-Ransomware avanzate')],['antiphishing','Anti-Phishing'],['advanced-phishing',sx('Advanced Anti-Phishing','Anti-Phishing avanzate')],['payments',sx('Safe Payments','Pagamenti Sicuri')],['proxy-bypass',sx('Proxy Bypass','Bypass Proxy')],['user-services',sx('User Services','Servizi Utente')],['system-services',sx('System Services','Servizi Sistema')],['email','Email'],['server-alerts',sx('Server Alerts','Avvisi Server')],['clamdb','ClamAV DB'],['options',sx('Options','Opzioni')]]; foreach($tabs as $i=>$t): ?>
  <li class="nav-item"><button class="nav-link <?= $i===0?'active':'' ?>" data-bs-toggle="tab" data-bs-target="#<?= bg_e($t[0]) ?>" type="button"><?= bg_e($t[1]) ?></button></li>
  <?php endforeach; ?>
</ul>

<div class="tab-content pt-3">
  <div class="tab-pane fade show active" id="base"><div class="row g-4">
    <div class="col-lg-5"><div class="card h-100"><div class="card-body"><h5><?= bg_e(sx('Realtime antivirus','Antivirus realtime')) ?></h5><?php $rst=bg_service_status(['clamav-clamonacc.service','clamonacc.service'],false); ?><p><?= bg_service_state_badge($rst) ?></p><p class="small-muted">clamd.conf: <?= bg_e($clamd['path'].' · '.$clamd['via']) ?></p><form method="post" class="d-flex flex-wrap gap-2"><?php csrf_field(); ?><button class="btn btn-success" name="action" value="realtime-start">Start</button><button class="btn btn-outline-danger" name="action" value="realtime-stop">Stop</button><button class="btn btn-outline-primary" name="action" value="realtime-restart">Restart</button></form></div></div></div>
    <div class="col-lg-7"><div class="card h-100"><div class="card-body"><h5><?= bg_e(sx('On-Access paths and quarantine','Percorsi On-Access e quarantena')) ?></h5><form method="post"><?php csrf_field(); ?><input type="hidden" name="action" value="save-clamav-base"><input type="hidden" name="desktop_user" value="<?= bg_e($desktopUser) ?>"><label class="form-label">OnAccessIncludePath</label><textarea class="form-control" rows="6" name="onaccess_paths"><?= bg_e(implode("\n", $clamdParsed['paths'] ?: ['/home/'.$desktopUser.'/Downloads'])) ?></textarea><label class="form-label mt-3"><?= bg_e(sx('Quarantine path','Percorso quarantena')) ?></label><input class="form-control" name="quarantine_path" value="<?= bg_e($configIni['quarantinePath'] ?? bg_bastionguard_data_dir($desktopUser).'/quarantine') ?>"><button class="btn btn-primary mt-3"><?= bg_e(bg_t('save')) ?></button></form></div></div></div>
  </div></div>

  <div class="tab-pane fade" id="advanced"><div class="card"><div class="card-body"><h5><?= bg_e(sx('ClamAV advanced scan options','Opzioni avanzate scansione ClamAV')) ?></h5><div class="alert alert-warning"><?= bg_e(sx('Change these options only if you understand ClamAV clamd.conf semantics.','Modifica queste opzioni solo se conosci la semantica di clamd.conf.')) ?></div><form method="post"><?php csrf_field(); ?><input type="hidden" name="action" value="save-clamav-advanced"><div class="d-flex gap-2 mb-3"><button type="button" class="btn btn-outline-primary btn-sm" onclick="document.querySelectorAll('#advanced input[type=checkbox]').forEach(x=>x.checked=true)"><?= bg_e(sx('Enable all','Abilita tutto')) ?></button><button type="button" class="btn btn-outline-secondary btn-sm" onclick="document.querySelectorAll('#advanced input[type=checkbox]').forEach(x=>x.checked=false)"><?= bg_e(sx('Disable all','Disabilita tutto')) ?></button></div><div class="row g-2"><?php foreach($clamdParsed['options'] as $opt=>$enabled): ?><div class="col-md-3"><div class="form-check form-switch settings-option"><input class="form-check-input" type="checkbox" name="scan_option[<?= bg_e($opt) ?>]" <?= checked($enabled) ?>><label class="form-check-label"><code><?= bg_e($opt) ?></code></label></div></div><?php endforeach; ?></div><button class="btn btn-primary mt-3"><?= bg_e(sx('Save configuration','Salva configurazione')) ?></button></form></div></div></div>

  <div class="tab-pane fade" id="antiransomware"><div class="row g-4"><div class="col-lg-4"><div class="card h-100"><div class="card-body"><h5>Anti-Ransomware</h5><?php $arst=bg_service_status(['BastionGuard-ransomware-scanner.service','BastionGuard-ransomware-realtime.service'], true); ?><p><?= bg_service_state_badge($arst) ?></p><form method="post" class="d-flex flex-wrap gap-2 mb-3"><?php csrf_field(); ?><button class="btn btn-success" name="action" value="svc:ransomware_scanner:start">Start</button><button class="btn btn-outline-danger" name="action" value="svc:ransomware_scanner:stop">Stop</button><button class="btn btn-outline-primary" name="action" value="svc:ransomware_scanner:restart">Restart</button></form><form method="post" class="d-flex flex-wrap gap-2"><?php csrf_field(); ?><button class="btn btn-outline-primary" name="action" value="update-yara"><?= bg_e(bg_t('update_yara')) ?></button><button class="btn btn-outline-secondary" name="action" value="update-sanesecurity"><?= bg_e(bg_t('update_sanesecurity')) ?></button></form></div></div></div><div class="col-lg-8"><div class="card h-100"><div class="card-body"><h5><?= bg_e(sx('Scanner configuration','Configurazione scanner')) ?></h5><form method="post"><?php csrf_field(); ?><input type="hidden" name="action" value="save-ransom-scanner"><input type="hidden" name="desktop_user" value="<?= bg_e($desktopUser) ?>"><div class="row g-3"><div class="col-md-4"><div class="form-check form-switch"><input class="form-check-input" type="checkbox" name="enable_yara" <?= checked(sx_bool($scanner,'enable_yara',true)) ?>><label class="form-check-label"><?= bg_e(bg_t('use_yara_rules')) ?></label></div></div><div class="col-md-4"><div class="form-check form-switch"><input class="form-check-input" type="checkbox" name="enable_sanesecurity" <?= checked(sx_bool($scanner,'enable_sanesecurity',true)) ?>><label class="form-check-label"><?= bg_e(bg_t('use_sanesecurity_db')) ?></label></div></div><div class="col-md-4"><label class="form-label"><?= bg_e(bg_t('scan_interval_minutes')) ?></label><input class="form-control" type="number" min="1" name="scan_interval" value="<?= bg_e(sx_int($scanner,'scan_interval',60)) ?>"></div><div class="col-12"><label class="form-label"><?= bg_e(bg_t('folders_to_scan')) ?></label><textarea class="form-control" rows="5" name="scan_path"><?= bg_e(implode("\n", sx_lines($scanner['scan_path'] ?? '', ['/home']))) ?></textarea></div></div><button class="btn btn-primary mt-3"><?= bg_e(bg_t('save_scanner_configuration')) ?></button></form></div></div></div><div class="col-12"><div class="card"><div class="card-body"><h5><?= bg_e(bg_t('loaded_yara_rules')) ?></h5><?php if($yaraRules): foreach(array_slice($yaraRules,0,120) as $r): ?><span class="badge text-bg-secondary me-1 mb-1"><?= bg_e($r) ?></span><?php endforeach; else: ?><p class="text-muted">No YARA rules found.</p><?php endif; ?></div></div></div></div></div>

  <div class="tab-pane fade" id="advanced-ransomware"><div class="card"><div class="card-body"><h5><?= bg_e(sx('Anti-Ransomware advanced','Anti-Ransomware avanzate')) ?></h5><form method="post"><?php csrf_field(); ?><input type="hidden" name="action" value="save-ransom-advanced"><input type="hidden" name="desktop_user" value="<?= bg_e($desktopUser) ?>"><div class="row g-3"><div class="col-md-3"><div class="form-check form-switch mt-4"><input class="form-check-input" type="checkbox" name="suspicious_only" <?= checked(sx_bool($scanner,'suspicious_only',false)) ?>><label class="form-check-label"><?= bg_e(sx('Analyze suspicious files only','Analizza solo file sospetti')) ?></label></div></div><div class="col-md-9"><label class="form-label">SHA256 allowlist</label><textarea class="form-control" rows="5" name="allowlist"><?= bg_e($allow['raw'] ?? '') ?></textarea></div><div class="col-md-4"><label class="form-label"><?= bg_e(bg_t('ignore_paths')) ?></label><textarea class="form-control" rows="5" name="ignore_paths"><?= bg_e(implode("\n", sx_lines($scanner['ignore_paths'] ?? '', ['/proc','/sys','/dev','/run','/tmp']))) ?></textarea></div><div class="col-md-4"><label class="form-label"><?= bg_e(bg_t('ignored_extensions')) ?></label><textarea class="form-control" rows="5" name="ignore_ext"><?= bg_e(implode("\n", sx_lines($scanner['ignore_ext'] ?? '', ['.tmp','.log','.cache']))) ?></textarea></div><div class="col-md-4"><label class="form-label"><?= bg_e(bg_t('suspicious_extensions')) ?></label><textarea class="form-control" rows="5" name="suspicious_ext"><?= bg_e(implode("\n", sx_lines($scanner['suspicious_ext'] ?? '', ['.locked','.encrypted','.crypt','.enc']))) ?></textarea></div></div><button class="btn btn-primary mt-3"><?= bg_e(bg_t('save')) ?></button></form></div></div></div>

  <div class="tab-pane fade" id="antiphishing"><div class="row g-4"><div class="col-lg-5"><div class="card h-100"><div class="card-body"><h5>Anti-Phishing</h5><?php $pst=bg_service_status(['BastionGuard-phishing-scanner.service','BastionGuard-phishing.service','bastionguard-phishing.service'], false); ?><p><?= bg_service_state_badge($pst) ?></p><form method="post" class="d-flex flex-wrap gap-2 mb-3"><?php csrf_field(); ?><button class="btn btn-success" name="action" value="svc:phishing_scanner:start">Start</button><button class="btn btn-outline-danger" name="action" value="svc:phishing_scanner:stop">Stop</button><button class="btn btn-outline-primary" name="action" value="svc:phishing_scanner:restart">Restart</button></form><form method="post"><?php csrf_field(); ?><button name="action" value="update-phishing" class="btn btn-primary"><?= bg_e(bg_t('update_blacklist')) ?></button></form></div></div></div><div class="col-lg-7"><div class="card h-100"><div class="card-body"><h5><?= bg_e(sx('Google Safe Browsing and firewall','Google Safe Browsing e firewall')) ?></h5><form method="post"><?php csrf_field(); ?><input type="hidden" name="action" value="save-antiphish"><input type="hidden" name="desktop_user" value="<?= bg_e($desktopUser) ?>"><div class="form-check form-switch"><input class="form-check-input" type="checkbox" name="auto_update"><label class="form-check-label"><?= bg_e(bg_t('auto_blacklist_update')) ?></label></div><div class="form-check form-switch mt-2"><input class="form-check-input" type="checkbox" name="google_safe_enabled" <?= checked(sx_bool($googlesafe,'google_safe_enabled',false)) ?>><label class="form-check-label"><?= bg_e(sx('Use Google Safe Browsing','Usa Google Safe Browsing')) ?></label></div><label class="form-label mt-2"><?= bg_e(bg_t('google_safe_key')) ?></label><div class="input-group"><input class="form-control" type="password" name="google_safe_key" value="<?= bg_e($googlesafe['google_safe_key'] ?? '') ?>"><button class="btn btn-outline-secondary" name="action" value="test-googlesafe"><?= bg_e(sx('Verify','Verifica')) ?></button></div><div class="form-check form-switch mt-3"><input class="form-check-input" type="checkbox" name="firewall_enabled" <?= checked(sx_bool($firewall,'enabled',true)) ?>><label class="form-check-label"><?= bg_e(bg_t('enable_firewall_ip_block')) ?></label></div><label class="form-label mt-2"><?= bg_e(sx('Firewall mode','Modalità firewall')) ?></label><select class="form-select" name="firewall_mode"><option value="auto" <?= selected($firewall['mode'] ?? 'auto','auto') ?>>auto</option><option value="ufw" <?= selected($firewall['mode'] ?? 'auto','ufw') ?>>UFW</option><option value="firewalld" <?= selected($firewall['mode'] ?? 'auto','firewalld') ?>>firewalld</option></select><button class="btn btn-primary mt-3"><?= bg_e(bg_t('save')) ?></button></form></div></div></div><div class="col-12"><div class="card"><div class="card-body"><h5><?= bg_e(bg_t('loaded_blacklists')) ?></h5><?php if($blacklists): ?><div class="table-responsive"><table class="table"><thead><tr><th>File</th><th><?= bg_e(bg_t('size')) ?></th><th>Lines</th><th><?= bg_e(bg_t('modified')) ?></th></tr></thead><tbody><?php foreach($blacklists as $b): ?><tr><td><code><?= bg_e($b['file']) ?></code></td><td><?= bg_e(bg_file_size($b['size'])) ?></td><td><?= (int)$b['lines'] ?></td><td><?= $b['mtime']?bg_e(date('Y-m-d H:i',$b['mtime'])):'—' ?></td></tr><?php endforeach; ?></tbody></table></div><?php else: ?><p class="text-muted">No phishing blacklist found.</p><?php endif; ?></div></div></div></div></div>

  <div class="tab-pane fade" id="advanced-phishing"><div class="card"><div class="card-body"><h5><?= bg_e(sx('Whitelist / custom blacklist','Whitelist / blacklist custom')) ?></h5><form method="post"><?php csrf_field(); ?><input type="hidden" name="action" value="save-whitelist-blacklist"><input type="hidden" name="desktop_user" value="<?= bg_e($desktopUser) ?>"><div class="row g-3"><div class="col-md-6"><label class="form-label"><?= bg_e(sx('Whitelist (allow)','Whitelist (consenti)')) ?></label><textarea class="form-control" rows="10" name="whitelist"><?= bg_e(implode("\n", $whitelist['domains'] ?? [])) ?></textarea></div><div class="col-md-6"><label class="form-label"><?= bg_e(sx('Custom blacklist (dnsmasq block)','Blacklist custom (blocco dnsmasq)')) ?></label><textarea class="form-control" rows="10" name="blacklist"></textarea></div></div><button class="btn btn-primary mt-3"><?= bg_e(bg_t('save')) ?></button></form></div></div></div>

  <div class="tab-pane fade" id="payments"><div class="row g-4"><div class="col-lg-8"><div class="card"><div class="card-body"><h5><?= bg_e(sx('Safe Payments list (CEF disabled in WebUI)','Lista pagamenti sicuri (CEF disabilitato nella WebUI)')) ?></h5><form method="post"><?php csrf_field(); ?><input type="hidden" name="action" value="save-payments"><input type="hidden" name="desktop_user" value="<?= bg_e($desktopUser) ?>"><div class="form-check form-switch"><input class="form-check-input" type="checkbox" name="enabled" <?= checked(!empty($settingsJson['security']['secure_payments_enabled'])) ?>><label class="form-check-label"><?= bg_e(sx('Enable safe payments','Abilita pagamenti sicuri')) ?></label></div><label class="form-label mt-3"><?= bg_e(sx('Payment domains/URLs','Domini/URL pagamenti')) ?></label><textarea class="form-control" rows="10" name="domains"><?= bg_e(implode("\n", $payments['list'] ?? $payments['domains'] ?? [])) ?></textarea><button class="btn btn-primary mt-3"><?= bg_e(bg_t('save')) ?></button></form></div></div></div><div class="col-lg-4"><div class="card"><div class="card-body"><h5><?= bg_e(sx('Secure browsing installation','Installazione navigazione sicura')) ?></h5><p class="small-muted">CEF/PAC/browser proxy bootstrap is desktop-only and disabled in the WebUI.</p><form method="post"><?php csrf_field(); ?><button class="btn btn-outline-secondary" name="action" value="install-secure-ca" disabled><?= bg_e(sx('Managed by GTK UI','Gestito dalla GUI GTK')) ?></button><p class="small-muted mt-2 mb-0"><?= bg_e(sx('The WebUI saves payment domains but never starts CEF/PAC or rewrites browser proxy settings.','La WebUI salva i domini di pagamento ma non avvia mai CEF/PAC e non riscrive le impostazioni proxy del browser.')) ?></p></form></div></div></div></div></div>

  <div class="tab-pane fade" id="proxy-bypass"><div class="card"><div class="card-body"><h5><?= bg_e(sx('Proxy bypass','Bypass Proxy')) ?></h5><form method="post"><?php csrf_field(); ?><input type="hidden" name="action" value="save-proxy-bypass"><input type="hidden" name="desktop_user" value="<?= bg_e($desktopUser) ?>"><label class="form-label"><?= bg_e(sx('Bypass domains','Domini in bypass')) ?></label><textarea class="form-control" rows="12" name="domains"><?= bg_e(implode("\n", $proxyBypass['domains'] ?? [])) ?></textarea><button class="btn btn-primary mt-3"><?= bg_e(bg_t('save')) ?></button></form></div></div></div>

  <div class="tab-pane fade" id="user-services"><div class="card"><div class="card-body"><h5><?= bg_e(sx('User Services','Servizi Utente')) ?></h5><p class="small-muted"><?= bg_e(sx('Services managed through systemctl --user for the configured desktop user.','Servizi gestiti tramite systemctl --user per l’utente desktop configurato.')) ?></p><div class="table-responsive"><table class="table align-middle"><thead><tr><th><?= bg_e(bg_t('module')) ?></th><th><?= bg_e(bg_t('unit')) ?></th><th><?= bg_e(bg_t('state')) ?></th><th>Enabled</th><th>PID</th><th><?= bg_e(bg_t('actions')) ?></th></tr></thead><tbody><?php foreach($catalog as $key=>$svc): if(empty($svc['user'])) continue; $st=bg_service_status($svc['services'],true); $proxyLocked=$desktopGuiActive && bg_proxy_sensitive_unit($st['name'] ?: ($svc['services'][0] ?? '')); ?><tr><td><?= bg_e($svc['label']) ?></td><td><span class="service-name"><?= bg_e($st['name'] ?: implode(', ',$svc['services'])) ?></span><?php if($proxyLocked): ?><div class="small text-warning"><?= bg_e(sx('GTK owns proxy while desktop is active','Proxy gestito dalla GTK mentre il desktop è attivo')) ?></div><?php endif; ?></td><td><?= bg_service_state_badge($st) ?></td><td><?= bg_e($st['unit_file_state'] ?: '—') ?></td><td><?= $st['main_pid']?(int)$st['main_pid']:'—' ?></td><td><form method="post" class="d-flex flex-wrap gap-1"><?php csrf_field(); ?><button class="btn btn-sm btn-success" name="action" value="svc:<?= bg_e($key) ?>:start" <?= $proxyLocked ? 'disabled' : '' ?>>Start</button><button class="btn btn-sm btn-outline-danger" name="action" value="svc:<?= bg_e($key) ?>:stop">Stop</button><button class="btn btn-sm btn-outline-primary" name="action" value="svc:<?= bg_e($key) ?>:restart" <?= $proxyLocked ? 'disabled' : '' ?>>Restart</button><button class="btn btn-sm btn-outline-secondary" name="action" value="svc:<?= bg_e($key) ?>:enable" <?= $proxyLocked ? 'disabled' : '' ?>>Enable</button><button class="btn btn-sm btn-outline-secondary" name="action" value="svc:<?= bg_e($key) ?>:disable">Disable</button></form></td></tr><?php endforeach; ?></tbody></table></div></div></div></div>

  <div class="tab-pane fade" id="system-services"><div class="card"><div class="card-body"><h5><?= bg_e(sx('System Services','Servizi Sistema')) ?></h5><p class="small-muted"><?= bg_e(sx('System services are controlled through the privileged backend helper and sudoers.','I servizi di sistema sono controllati tramite helper backend privilegiato e sudoers.')) ?></p><div class="table-responsive"><table class="table align-middle"><thead><tr><th><?= bg_e(bg_t('module')) ?></th><th><?= bg_e(bg_t('unit')) ?></th><th><?= bg_e(bg_t('state')) ?></th><th>Enabled</th><th>PID</th><th><?= bg_e(bg_t('actions')) ?></th></tr></thead><tbody><?php foreach($catalog as $key=>$svc): if(!empty($svc['user'])) continue; $st=bg_service_status($svc['services'],false); ?><tr><td><?= bg_e($svc['label']) ?></td><td><span class="service-name"><?= bg_e($st['name'] ?: implode(', ',$svc['services'])) ?></span></td><td><?= bg_service_state_badge($st) ?></td><td><?= bg_e($st['unit_file_state'] ?: '—') ?></td><td><?= $st['main_pid']?(int)$st['main_pid']:'—' ?></td><td><form method="post" class="d-flex flex-wrap gap-1"><?php csrf_field(); ?><button class="btn btn-sm btn-success" name="action" value="svc:<?= bg_e($key) ?>:start">Start</button><button class="btn btn-sm btn-outline-danger" name="action" value="svc:<?= bg_e($key) ?>:stop">Stop</button><button class="btn btn-sm btn-outline-primary" name="action" value="svc:<?= bg_e($key) ?>:restart">Restart</button><button class="btn btn-sm btn-outline-secondary" name="action" value="svc:<?= bg_e($key) ?>:enable">Enable</button><button class="btn btn-sm btn-outline-secondary" name="action" value="svc:<?= bg_e($key) ?>:disable">Disable</button></form></td></tr><?php endforeach; ?></tbody></table></div></div></div></div>

  <div class="tab-pane fade" id="email"><div class="card"><div class="card-body"><h5><?= bg_e(sx('Email protection','Protezione Email')) ?></h5><form method="post"><?php csrf_field(); ?><input type="hidden" name="action" value="save-email"><input type="hidden" name="desktop_user" value="<?= bg_e($desktopUser) ?>"><ul class="nav nav-pills mb-3"><li class="nav-item"><button class="nav-link active" data-bs-toggle="pill" data-bs-target="#mail-general" type="button"><?= bg_e(sx('General','Generale')) ?></button></li><li class="nav-item"><button class="nav-link" data-bs-toggle="pill" data-bs-target="#mail-signature" type="button"><?= bg_e(sx('Signature','Firma')) ?></button></li><li class="nav-item"><button class="nav-link" data-bs-toggle="pill" data-bs-target="#mail-smtp" type="button">SMTP</button></li><li class="nav-item"><button class="nav-link" data-bs-toggle="pill" data-bs-target="#mail-thunderbird" type="button">Thunderbird</button></li></ul><div class="tab-content"><div class="tab-pane fade show active" id="mail-general"><div class="row g-3"><div class="col-md-6"><?php foreach(['enabled'=>sx('Enable email protection','Abilita protezione email'),'scan_outgoing'=>sx('Scan outgoing email','Scansiona email in uscita'),'inject_signature'=>sx('Inject automatic signature','Inserisci firma automatica'),'advertise_starttls'=>'STARTTLS','enable_implicit_tls_listener'=>sx('Implicit TLS listener','Listener TLS implicito')] as $k=>$label): ?><div class="form-check form-switch"><input class="form-check-input" type="checkbox" name="<?= bg_e($k) ?>" <?= checked(!empty($mail[$k])) ?>><label class="form-check-label"><?= bg_e($label) ?></label></div><?php endforeach; ?></div><div class="col-md-6"><label class="form-label">Local host</label><input class="form-control mb-2" name="local_host" value="<?= bg_e($mail['local_smtp_host'] ?? '127.0.0.1') ?>"><div class="row g-2"><div class="col"><label class="form-label">Plain</label><input class="form-control" type="number" name="local_port" value="<?= bg_e($mail['local_smtp_port'] ?? 2525) ?>"></div><div class="col"><label class="form-label">TLS</label><input class="form-control" type="number" name="local_tls_port" value="<?= bg_e($mail['local_smtp_tls_port'] ?? 2465) ?>"></div><div class="col"><label class="form-label">Submission</label><input class="form-control" type="number" name="local_submission_port" value="<?= bg_e($mail['local_submission_port'] ?? 2587) ?>"></div></div></div></div></div><div class="tab-pane fade" id="mail-signature"><div class="row g-3"><div class="col-md-4"><label class="form-label"><?= bg_e(sx('Display name','Nome visualizzato')) ?></label><input class="form-control" name="display_name" value="<?= bg_e($mailProfile['signature']['display_name'] ?? '') ?>"></div><div class="col-md-4"><label class="form-label"><?= bg_e(bg_t('role')) ?></label><input class="form-control" name="job_title" value="<?= bg_e($mailProfile['signature']['job_title'] ?? '') ?>"></div><div class="col-md-4"><label class="form-label"><?= bg_e(sx('Company','Azienda')) ?></label><input class="form-control" name="company" value="<?= bg_e($mailProfile['signature']['company'] ?? '') ?>"></div><div class="col-md-6"><label class="form-label"><?= bg_e(sx('Phone','Telefono')) ?></label><input class="form-control" name="phone" value="<?= bg_e($mailProfile['signature']['phone'] ?? '') ?>"></div><div class="col-md-6"><label class="form-label">Website</label><input class="form-control" name="website" value="<?= bg_e($mailProfile['signature']['website'] ?? '') ?>"></div><p class="small-muted">Logo: /usr/share/BastionGuard/data/logo.png</p></div></div><div class="tab-pane fade" id="mail-smtp"><div class="row g-3"><div class="col-md-4"><label class="form-label">Profile label</label><input class="form-control" name="profile_label" value="<?= bg_e($mailProfile['label'] ?? 'Default') ?>"></div><div class="col-md-4"><label class="form-label">SMTP host</label><input class="form-control" name="smtp_host" value="<?= bg_e($mailProfile['smtp_host'] ?? '') ?>"></div><div class="col-md-2"><label class="form-label">Port</label><input class="form-control" type="number" name="smtp_port" value="<?= bg_e($mailProfile['smtp_port'] ?? 587) ?>"></div><div class="col-md-2"><div class="form-check form-switch mt-4"><input class="form-check-input" type="checkbox" name="starttls" <?= checked(!empty($mailProfile['starttls'])) ?>><label class="form-check-label">STARTTLS</label></div></div><div class="col-md-2"><div class="form-check form-switch mt-4"><input class="form-check-input" type="checkbox" name="implicit_tls" <?= checked(!empty($mailProfile['implicit_tls'])) ?>><label class="form-check-label">SSL/TLS</label></div></div><div class="col-md-5"><label class="form-label">Username</label><input class="form-control" name="smtp_user" value="<?= bg_e($mailProfile['username'] ?? '') ?>"></div><div class="col-md-5"><label class="form-label">Password</label><input class="form-control" type="password" name="smtp_password" placeholder="<?= bg_e(sx('(saved) leave empty to keep','(salvata) lascia vuoto per mantenere')) ?>"></div><div class="col-md-6"><label class="form-label">Match From</label><textarea class="form-control" rows="3" name="match_from"><?= bg_e(implode("\n", $mailProfile['match_from'] ?? [])) ?></textarea></div><div class="col-md-6"><label class="form-label">Match From Domain</label><textarea class="form-control" rows="3" name="match_from_domain"><?= bg_e(implode("\n", $mailProfile['match_from_domain'] ?? [])) ?></textarea></div></div></div><div class="tab-pane fade" id="mail-thunderbird"><p class="small-muted"><?= bg_e(sx('Installs the BastionGuard Thunderbird extension using the same script used by the GTK settings page.','Installa l’estensione Thunderbird BastionGuard usando lo stesso script della pagina GTK.')) ?></p><button class="btn btn-outline-primary" name="action" value="install-thunderbird-extension"><?= bg_e(sx('Install Thunderbird extension','Installa estensione Thunderbird')) ?></button></div></div><button class="btn btn-primary mt-3"><?= bg_e(sx('Save email configuration','Salva configurazione email')) ?></button></form></div></div></div>

  <div class="tab-pane fade" id="server-alerts"><div class="card"><div class="card-body"><h5><?= bg_e(bg_t('server_alert_email')) ?></h5><form method="post"><?php csrf_field(); ?><input type="hidden" name="action" value="alert-email"><div class="row g-3"><div class="col-md-6"><div class="form-check form-switch"><input class="form-check-input" type="checkbox" name="enabled" <?= checked(!empty($alertMail['enabled'])) ?>><label class="form-check-label"><?= bg_e(sx('Enable server alert email','Abilita email avvisi server')) ?></label></div><div class="form-check form-switch mt-2"><input class="form-check-input" type="checkbox" name="use_admin_emails" <?= checked(!empty($alertMail['use_admin_emails'])) ?>><label class="form-check-label"><?= bg_e(bg_t('use_admin_emails')) ?></label></div><div class="form-check form-switch mt-2"><input class="form-check-input" type="checkbox" name="sendmail_fallback" <?= checked(!empty($alertMail['sendmail_fallback'])) ?>><label class="form-check-label">sendmail / PHP mail() fallback</label></div><label class="form-label mt-3"><?= bg_e(bg_t('alert_recipients')) ?></label><textarea class="form-control" name="recipients" rows="4"><?= bg_e($alertMail['recipients'] ?? '') ?></textarea></div><div class="col-md-6"><label class="form-label">From</label><input class="form-control mb-2" name="from" value="<?= bg_e($alertMail['from'] ?? 'bastionguard@localhost') ?>"><label class="form-label"><?= bg_e(bg_t('smtp_host')) ?></label><input class="form-control mb-2" name="smtp_host" value="<?= bg_e($alertMail['smtp_host'] ?? '') ?>"><div class="row g-2"><div class="col-md-4"><label class="form-label"><?= bg_e(bg_t('smtp_port')) ?></label><input class="form-control" type="number" name="smtp_port" value="<?= bg_e($alertMail['smtp_port'] ?? 587) ?>"></div><div class="col-md-8"><label class="form-label"><?= bg_e(bg_t('smtp_security')) ?></label><select class="form-select" name="smtp_secure"><option value="starttls" <?= selected($alertMail['smtp_secure'] ?? 'starttls','starttls') ?>>STARTTLS</option><option value="ssl" <?= selected($alertMail['smtp_secure'] ?? '','ssl') ?>>SSL/TLS</option><option value="none" <?= selected($alertMail['smtp_secure'] ?? '','none') ?>>None</option></select></div></div><label class="form-label mt-2"><?= bg_e(bg_t('smtp_username')) ?></label><input class="form-control mb-2" name="smtp_user" value="<?= bg_e($alertMail['smtp_user'] ?? '') ?>"><label class="form-label"><?= bg_e(bg_t('smtp_password')) ?></label><input class="form-control" type="password" name="smtp_pass" placeholder="<?= bg_e(sx('Leave empty to keep current password','Lascia vuoto per mantenere la password attuale')) ?>"></div></div><div class="d-flex gap-2 mt-3"><button class="btn btn-primary"><?= bg_e(bg_t('save')) ?></button><button class="btn btn-outline-primary" name="send_test" value="1"><?= bg_e(bg_t('send_test_email')) ?></button></div></form></div></div></div>

  <div class="tab-pane fade" id="clamdb"><div class="card"><div class="card-body"><h5>ClamAV DB</h5><p>Default path: <code>/var/lib/clamav</code></p><?php if($clamdb): ?><div class="table-responsive"><table class="table"><thead><tr><th>File</th><th>Version</th><th><?= bg_e(bg_t('size')) ?></th><th><?= bg_e(bg_t('modified')) ?></th></tr></thead><tbody><?php foreach($clamdb as $v): ?><tr><td><?= bg_e($v['name']) ?></td><td><?= bg_e($v['version']) ?></td><td><?= bg_e(bg_file_size($v['size'])) ?></td><td><?= bg_e(date('Y-m-d H:i',$v['mtime'])) ?></td></tr><?php endforeach; ?></tbody></table></div><?php else: ?><p class="text-muted">No database found.</p><?php endif; ?><a class="btn btn-outline-primary" href="update.php"><?= bg_e(sx('Update DB','Aggiorna DB')) ?></a></div></div></div>

  <div class="tab-pane fade" id="options">
    <div class="row g-4">
      <div class="col-lg-6">
        <div class="card">
          <div class="card-body">
            <h5><?= bg_e(sx('Interface options','Opzioni interfaccia')) ?></h5>
            <form method="post">
              <?php csrf_field(); ?>
              <input type="hidden" name="action" value="save-web">
              <div class="row g-3">
                <div class="col-md-6">
                  <label class="form-label"><?= bg_e(bg_t('language')) ?></label>
                  <div class="btn-group w-100" role="group" aria-label="<?= bg_e(bg_t('language')) ?>">
                    <a class="btn <?= bg_language()==='en'?'btn-primary':'btn-outline-primary' ?>" href="?<?= bg_e(http_build_query(array_merge($_GET, ['bg_lang'=>'en']))) ?>#options">English</a>
                    <a class="btn <?= bg_language()==='it'?'btn-primary':'btn-outline-primary' ?>" href="?<?= bg_e(http_build_query(array_merge($_GET, ['bg_lang'=>'it']))) ?>#options">Italiano</a>
                  </div>
                </div>
                <div class="col-md-6">
                  <label class="form-label"><?= bg_e(bg_t('theme')) ?></label>
                  <div class="btn-group w-100" role="group" aria-label="<?= bg_e(bg_t('theme')) ?>">
                    <a class="btn <?= bg_theme()==='system'?'btn-primary':'btn-outline-primary' ?>" href="?<?= bg_e(http_build_query(array_merge($_GET, ['bg_theme'=>'system']))) ?>#options"><?= bg_e(bg_t('system_theme')) ?></a>
                    <a class="btn <?= bg_theme()==='light'?'btn-primary':'btn-outline-primary' ?>" href="?<?= bg_e(http_build_query(array_merge($_GET, ['bg_theme'=>'light']))) ?>#options"><?= bg_e(bg_t('light')) ?></a>
                    <a class="btn <?= bg_theme()==='dark'?'btn-primary':'btn-outline-primary' ?>" href="?<?= bg_e(http_build_query(array_merge($_GET, ['bg_theme'=>'dark']))) ?>#options"><?= bg_e(bg_t('dark')) ?></a>
                  </div>
                  <div class="form-text"><?= bg_e(sx('Language and theme are temporary WebUI session preferences; they are not saved to web_options.json, lang.conf or theme.conf.','Lingua e tema sono preferenze temporanee della sessione WebUI; non vengono salvati in web_options.json, lang.conf o theme.conf.')) ?></div>
                </div>
                <div class="col-12">
                  <hr>
                  <h6 class="mb-2"><?= bg_e(bg_t('webpanel_identity')) ?></h6>
                  <label class="form-label" for="webpanel_name"><?= bg_e(bg_t('webpanel_display_name')) ?></label>
                  <input class="form-control" id="webpanel_name" name="webpanel_name" maxlength="48" value="<?= bg_e($web['webpanel_name'] ?? 'WebPanel') ?>">
                  <div class="form-text"><?= bg_e(bg_t('webpanel_display_name_hint')) ?></div>
                </div>
                <div class="col-12">
                  <hr>
                  <h6 class="mb-2"><?= bg_e(bg_t('dashboard_visibility')) ?></h6>
                  <p class="small-muted mb-2"><?= bg_e(bg_t('dashboard_visibility_hint')) ?></p>
                  <div class="row g-2">
                    <?php foreach (bg_dashboard_widget_labels() as $widgetKey => $widgetLabel): ?>
                    <div class="col-md-6">
                      <div class="form-check form-switch settings-option">
                        <input class="form-check-input" type="checkbox" id="dash_widget_<?= bg_e($widgetKey) ?>" name="dashboard_widgets[<?= bg_e($widgetKey) ?>]" <?= checked(!empty($web['dashboard_widgets'][$widgetKey])) ?>>
                        <label class="form-check-label" for="dash_widget_<?= bg_e($widgetKey) ?>"><?= bg_e($widgetLabel) ?></label>
                      </div>
                    </div>
                    <?php endforeach; ?>
                  </div>
                </div>
                <div class="col-md-4"><label class="form-label">HTTP</label><input class="form-control" type="number" name="http_port" value="<?= bg_e($web['http_port']) ?>"></div>
                <div class="col-md-4"><label class="form-label">HTTPS</label><input class="form-control" type="number" name="https_port" value="<?= bg_e($web['https_port']) ?>"></div>
                <div class="col-md-4"><label class="form-label"><?= bg_e(bg_t('desktop_user_services')) ?></label><input class="form-control" name="desktop_user" placeholder="$USER" value="<?= bg_e($desktopUser) ?>"></div>
              </div>
              <p class="small-muted mt-3 mb-0"><?= bg_e(sx('Ports are initialized from /etc/BastionGuard/webports.conf like the GTK Settings page.','Le porte sono inizializzate da /etc/BastionGuard/webports.conf come nella pagina Settings GTK.')) ?></p>
              <button class="btn btn-primary mt-3"><?= bg_e(bg_t('save')) ?></button>
            </form>
          </div>
        </div>
      </div>
      <div class="col-lg-6">
        <div class="card">
          <div class="card-body">
            <h5><?= bg_e(sx('Web server configuration','Configurazione webserver')) ?></h5>
            <div class="alert alert-info py-2">
              <strong><?= bg_e(sx('Detected','Rilevato')) ?>:</strong>
              <?= bg_e(sx_distro_label($detectedDistro)) ?> · <?= bg_e(sx_webserver_label($detectedWebserver)) ?> · HTTP <?= bg_e($detectedHttp) ?> / HTTPS <?= bg_e($detectedHttps) ?>
            </div>
            <form method="post">
              <?php csrf_field(); ?>
              <input type="hidden" name="action" value="apply-web-config">
              <div class="row g-3">
                <div class="col-md-4">
                  <label class="form-label">OS / distro</label>
                  <select class="form-select" name="os">
                    <option value="auto" <?= selected($detectedDistro,'auto') ?>><?= bg_e(sx('Automatic detection','Rilevamento automatico')) ?></option>
                    <option value="debian" <?= selected($detectedDistro,'debian') ?>>Debian/Ubuntu/Mint</option>
                    <option value="fedora" <?= selected($detectedDistro,'fedora') ?>>Fedora/RHEL/CentOS/Alma/Rocky</option>
                    <option value="arch" <?= selected($detectedDistro,'arch') ?>>Arch/Manjaro/Endeavour</option>
                    <option value="opensuse" <?= selected($detectedDistro,'opensuse') ?>>openSUSE/SLE</option>
                    <option value="gentoo" <?= selected($detectedDistro,'gentoo') ?>>Gentoo</option>
                    <option value="slackware" <?= selected($detectedDistro,'slackware') ?>>Slackware</option>
                    <option value="bsd" <?= selected($detectedDistro,'bsd') ?>>BSD</option>
                  </select>
                </div>
                <div class="col-md-4"><label class="form-label">HTTP</label><input class="form-control" type="number" name="http_port" value="<?= bg_e($detectedHttp) ?>"></div>
                <div class="col-md-4"><label class="form-label">HTTPS</label><input class="form-control" type="number" name="https_port" value="<?= bg_e($detectedHttps) ?>"></div>
              </div>
              <p class="small-muted mt-3 mb-0"><?= bg_e(sx('The helper applies the same distro/webserver detection and webports.conf write path used by src/SettingsPage.cpp.','L’helper applica lo stesso rilevamento distro/webserver e la stessa scrittura webports.conf usati da src/SettingsPage.cpp.')) ?></p>
              <button class="btn btn-outline-primary mt-3"><?= bg_e(sx('Apply web configuration','Applica configurazione web')) ?></button>
            </form>
          </div>
        </div>
      </div>
    </div>
  </div>
</div>
<?php include 'includes/footer.php'; ?>