From 44df5596e61ffdace63fb54926e07d8fffd5e89c Mon Sep 17 00:00:00 2001
From: Taavi Pertman <taavi.pertman@tuleva.ee>
Date: Thu, 28 May 2026 15:06:17 +0300
Subject: [PATCH 1/3] Add ACF investment report field for TUK75, TUK00, TUV100
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add investment_report_file ACF field to the stocks, bonds, and third
pillar fund page templates, matching the pattern TKF100 already uses.

When the ACF field is set (via wp-admin or REST API), it overrides the
hardcoded report URL. When not set, the current hardcoded URL remains
as fallback — safe to deploy without setting the fields first.

This enables:
- Manual report updates from wp-admin (same as TKF100 today)
- Automated updates via WordPress REST API from onboarding-service

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .../tuleva/helpers/acf/fund-pension.php       | 51 +++++++++++++++++++
 .../themes/tuleva/helpers/acf/init.php        |  1 +
 .../components/fund-bonds-details.php         |  5 +-
 .../components/fund-stocks-details.php        |  5 +-
 .../components/fund-third-details.php         |  5 +-
 5 files changed, 64 insertions(+), 3 deletions(-)
 create mode 100644 src/wp-content/themes/tuleva/helpers/acf/fund-pension.php

diff --git a/src/wp-content/themes/tuleva/helpers/acf/fund-pension.php b/src/wp-content/themes/tuleva/helpers/acf/fund-pension.php
new file mode 100644
index 00000000..01093aef
--- /dev/null
+++ b/src/wp-content/themes/tuleva/helpers/acf/fund-pension.php
@@ -0,0 +1,51 @@
+<?php
+if( function_exists('acf_add_local_field_group') ):
+
+acf_add_local_field_group(array (
+    'key' => 'group_fund_pension_investment_report',
+    'title' => 'Investment Report',
+    'fields' => array (
+        array (
+            'key' => 'field_fund_pension_investment_report',
+            'label' => 'Investment Report',
+            'name' => 'investment_report_file',
+            'type' => 'file',
+            'instructions' => 'Select the latest investment report PDF from media library. When set, this replaces the hardcoded report URL in the template.',
+            'required' => 0,
+            'return_format' => 'url',
+            'library' => 'all',
+            'mime_types' => 'pdf',
+        ),
+    ),
+    'location' => array (
+        array (
+            array (
+                'param' => 'page_template',
+                'operator' => '==',
+                'value' => 'page_fund-stocks.php',
+            ),
+        ),
+        array (
+            array (
+                'param' => 'page_template',
+                'operator' => '==',
+                'value' => 'page_fund-bonds.php',
+            ),
+        ),
+        array (
+            array (
+                'param' => 'page_template',
+                'operator' => '==',
+                'value' => 'page_fund-third.php',
+            ),
+        ),
+    ),
+    'menu_order' => 10,
+    'position' => 'normal',
+    'style' => 'default',
+    'label_placement' => 'top',
+    'instruction_placement' => 'label',
+    'active' => 1,
+));
+
+endif;
diff --git a/src/wp-content/themes/tuleva/helpers/acf/init.php b/src/wp-content/themes/tuleva/helpers/acf/init.php
index 01fe256c..034ab40c 100644
--- a/src/wp-content/themes/tuleva/helpers/acf/init.php
+++ b/src/wp-content/themes/tuleva/helpers/acf/init.php
@@ -10,6 +10,7 @@
     'helpers/acf/membership.php', // Membership page
     'helpers/acf/fund-other.php', // Other fund pages
     'helpers/acf/fund-savings.php', // Savings fund page
+    'helpers/acf/fund-pension.php', // Pension fund investment report field (TUK75, TUK00, TUV100)
     'helpers/acf/fund-choosing.php', // Instructions — Step 1 page fields
     'helpers/acf/jobs.php' // Jobs page fields
 ];
diff --git a/src/wp-content/themes/tuleva/templates/components/fund-bonds-details.php b/src/wp-content/themes/tuleva/templates/components/fund-bonds-details.php
index 5f655940..15979a07 100644
--- a/src/wp-content/themes/tuleva/templates/components/fund-bonds-details.php
+++ b/src/wp-content/themes/tuleva/templates/components/fund-bonds-details.php
@@ -80,7 +80,10 @@
                         <h2 class="mt-5 mb-4 h4"><?php _e('Reports', TEXT_DOMAIN) ?></h2>
                         <ul class="list-style-arrow text-secondary">
                             <li>
-                                <?php echo generate_report_link('https://tuleva.ee/wp-content/uploads/2026/05/Tuleva-Maailma-Volakirjade-Pensionifondi-investeeringute-aruanne-aprill-2026.pdf',__('Investment reports', TEXT_DOMAIN)); ?><?php _e(' (in Estonian)', TEXT_DOMAIN) ?>
+                                <?php
+                                    $report_url = get_field('investment_report_file') ?: 'https://tuleva.ee/wp-content/uploads/2026/05/Tuleva-Maailma-Volakirjade-Pensionifondi-investeeringute-aruanne-aprill-2026.pdf';
+                                    echo generate_report_link($report_url, __('Investment reports', TEXT_DOMAIN));
+                                ?><?php _e(' (in Estonian)', TEXT_DOMAIN) ?>
                                 <br>
                                 <a href="https://www.pensionikeskus.ee/ii-sammas/kohustuslikud-pensionifondid/fid/76/" target="_blank"><?php _e('Previous reports', TEXT_DOMAIN) ?></a>
                             </li>
diff --git a/src/wp-content/themes/tuleva/templates/components/fund-stocks-details.php b/src/wp-content/themes/tuleva/templates/components/fund-stocks-details.php
index 79573f6b..3c05feba 100644
--- a/src/wp-content/themes/tuleva/templates/components/fund-stocks-details.php
+++ b/src/wp-content/themes/tuleva/templates/components/fund-stocks-details.php
@@ -79,7 +79,10 @@
                         <h2 class="mt-5 mb-4 h4"><?php _e('Reports', TEXT_DOMAIN) ?></h2>
                         <ul class="list-style-arrow mb-5 text-secondary">
                             <li>
-                                <?php echo generate_report_link('https://tuleva.ee/wp-content/uploads/2026/05/Tuleva-Maailma-Aktsiate-Pensionifondi-investeeringute-aruanne-aprill-2026.pdf',__('Investment reports', TEXT_DOMAIN)); ?><?php _e(' (in Estonian)', TEXT_DOMAIN) ?>
+                                <?php
+                                    $report_url = get_field('investment_report_file') ?: 'https://tuleva.ee/wp-content/uploads/2026/05/Tuleva-Maailma-Aktsiate-Pensionifondi-investeeringute-aruanne-aprill-2026.pdf';
+                                    echo generate_report_link($report_url, __('Investment reports', TEXT_DOMAIN));
+                                ?><?php _e(' (in Estonian)', TEXT_DOMAIN) ?>
                                 <br>
                                 <a href="https://www.pensionikeskus.ee/ii-sammas/kohustuslikud-pensionifondid/fid/77/" target="_blank"><?php _e('Previous reports', TEXT_DOMAIN) ?></a>
                             </li>
diff --git a/src/wp-content/themes/tuleva/templates/components/fund-third-details.php b/src/wp-content/themes/tuleva/templates/components/fund-third-details.php
index cd2c58e7..2fc907c9 100644
--- a/src/wp-content/themes/tuleva/templates/components/fund-third-details.php
+++ b/src/wp-content/themes/tuleva/templates/components/fund-third-details.php
@@ -79,7 +79,10 @@
                         <h2 class="mt-5 mb-4 h4"><?php _e('Reports', TEXT_DOMAIN) ?></h2>
                         <ul class="list-style-arrow text-secondary">
                             <li>
-                                <?php echo generate_report_link('https://tuleva.ee/wp-content/uploads/2026/05/Tuleva-III-Samba-Pensionifondi-investeeringute-aruanne-aprill-2026.pdf',__('Investment reports', TEXT_DOMAIN)); ?><?php _e(' (in Estonian)', TEXT_DOMAIN) ?>
+                                <?php
+                                    $report_url = get_field('investment_report_file') ?: 'https://tuleva.ee/wp-content/uploads/2026/05/Tuleva-III-Samba-Pensionifondi-investeeringute-aruanne-aprill-2026.pdf';
+                                    echo generate_report_link($report_url, __('Investment reports', TEXT_DOMAIN));
+                                ?><?php _e(' (in Estonian)', TEXT_DOMAIN) ?>
                                 <br>
                                 <a href="https://www.pensionikeskus.ee/iii-sammas/vabatahtlikud-fondid/fid/81/" target="_blank"><?php _e('Previous reports', TEXT_DOMAIN) ?></a>
                             </li>

From 0b3e6cf96bb866570bef4a60a0b41d0a5317fe89 Mon Sep 17 00:00:00 2001
From: Taavi Pertman <taavi.pertman@tuleva.ee>
Date: Thu, 28 May 2026 15:26:29 +0300
Subject: [PATCH 2/3] Fix XSS and date regex issues in generate_report_link()

Add esc_url() and esc_html() to prevent potential XSS via
ACF-managed URLs. Guard preg_match before accessing $matches
to avoid PHP notices when URL has no /YYYY/MM/ date segment.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .../themes/tuleva/helpers/extras.php          | 42 ++++++++++---------
 1 file changed, 22 insertions(+), 20 deletions(-)

diff --git a/src/wp-content/themes/tuleva/helpers/extras.php b/src/wp-content/themes/tuleva/helpers/extras.php
index 27f2f813..3f42f97c 100644
--- a/src/wp-content/themes/tuleva/helpers/extras.php
+++ b/src/wp-content/themes/tuleva/helpers/extras.php
@@ -396,24 +396,27 @@ function hyphenate_string($string) {
 }
 
 function generate_report_link($url, $link_text = null) {
-    preg_match('/\/(\d{4})\/(\d{2})\//', $url, $matches);
-    $year = intval($matches[1]);
-    $month = intval($matches[2]);
-
-    $month--;
-    if ($month === 0) {
-        $month = 12;
-        $year--;
-    }
+    if (preg_match('/\/(\d{4})\/(\d{2})\//', $url, $matches)) {
+        $year = intval($matches[1]);
+        $month = intval($matches[2]);
+
+        $month--;
+        if ($month === 0) {
+            $month = 12;
+            $year--;
+        }
 
-    $year_str = strval($year);
-    $month_str = str_pad(strval($month), 2, '0', STR_PAD_LEFT);
+        $year_str = strval($year);
+        $month_str = str_pad(strval($month), 2, '0', STR_PAD_LEFT);
+        $date_text = sprintf('%s.%s', $month_str, $year_str);
 
-    $default_text = sprintf('%s.%s', $month_str, $year_str);
-    if ($link_text !== null) {
-        $link_text = sprintf('%s (%s)', $link_text, $default_text);
-    } else {
-        $link_text = $default_text;
+        if ($link_text !== null) {
+            $link_text = sprintf('%s (%s)', $link_text, $date_text);
+        } else {
+            $link_text = $date_text;
+        }
+    } elseif ($link_text === null) {
+        $link_text = __('Report', TEXT_DOMAIN);
     }
 
     if (filter_var($url, FILTER_VALIDATE_URL)) {
@@ -423,10 +426,9 @@ function generate_report_link($url, $link_text = null) {
     }
 
     $output = sprintf(
-        '<a href="%s%s" target="_blank">%s</a>',
-        get_site_url(),
-        $path,
-        $link_text
+        '<a href="%s" target="_blank">%s</a>',
+        esc_url(get_site_url() . $path),
+        esc_html($link_text)
     );
 
     return $output;

From b7723d8c32ad85508c8fe944cd6eff5070f93b2c Mon Sep 17 00:00:00 2001
From: Taavi Pertman <taavi.pertman@tuleva.ee>
Date: Tue, 2 Jun 2026 16:57:31 +0300
Subject: [PATCH 3/3] Preserve media host and derive report period from
 filename

generate_report_link() previously discarded the URL host and rebuilt the link
against get_site_url(), which breaks ACF-supplied media URLs served from a CDN
or dedicated media host. Absolute URLs now pass through with their host intact;
only site-relative paths are resolved against the site.

The date label was derived from the WordPress upload-folder month minus one,
which is wrong when a report is uploaded in a different month than the period it
covers. The investment report pipeline encodes the period directly in the
filename as YYYY-MM, so parse that when present and fall back to the legacy
folder-month heuristic only for the old hardcoded report URLs.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .../themes/tuleva/helpers/extras.php          | 37 ++++++++++++-------
 1 file changed, 23 insertions(+), 14 deletions(-)

diff --git a/src/wp-content/themes/tuleva/helpers/extras.php b/src/wp-content/themes/tuleva/helpers/extras.php
index 3f42f97c..22bfffa9 100644
--- a/src/wp-content/themes/tuleva/helpers/extras.php
+++ b/src/wp-content/themes/tuleva/helpers/extras.php
@@ -396,7 +396,17 @@ function hyphenate_string($string) {
 }
 
 function generate_report_link($url, $link_text = null) {
-    if (preg_match('/\/(\d{4})\/(\d{2})\//', $url, $matches)) {
+    $is_absolute = (bool) filter_var($url, FILTER_VALIDATE_URL);
+    $path = $is_absolute ? parse_url($url, PHP_URL_PATH) : $url;
+    $filename = basename($path);
+
+    if (preg_match('/(\d{4})-(\d{2})/', $filename, $matches)) {
+        // Report period is encoded directly in the filename (YYYY-MM), e.g.
+        // "... investeeringute aruanne 2026-05.pdf" — use it as the label.
+        $date_text = sprintf('%s.%s', $matches[2], $matches[1]);
+    } elseif (preg_match('/\/(\d{4})\/(\d{2})\//', $url, $matches)) {
+        // Legacy uploads carry no period in the filename: the report covers the month before the
+        // upload-folder month (a report is uploaded the month after the period it covers).
         $year = intval($matches[1]);
         $month = intval($matches[2]);
 
@@ -406,28 +416,27 @@ function generate_report_link($url, $link_text = null) {
             $year--;
         }
 
-        $year_str = strval($year);
         $month_str = str_pad(strval($month), 2, '0', STR_PAD_LEFT);
-        $date_text = sprintf('%s.%s', $month_str, $year_str);
+        $date_text = sprintf('%s.%s', $month_str, strval($year));
+    } else {
+        $date_text = null;
+    }
 
-        if ($link_text !== null) {
-            $link_text = sprintf('%s (%s)', $link_text, $date_text);
-        } else {
-            $link_text = $date_text;
-        }
+    if ($date_text !== null) {
+        $link_text = $link_text !== null
+            ? sprintf('%s (%s)', $link_text, $date_text)
+            : $date_text;
     } elseif ($link_text === null) {
         $link_text = __('Report', TEXT_DOMAIN);
     }
 
-    if (filter_var($url, FILTER_VALIDATE_URL)) {
-        $path = parse_url($url, PHP_URL_PATH);
-    } else {
-        $path = $url;
-    }
+    // Preserve the original host for absolute URLs: the ACF-supplied media URL may be served from a
+    // CDN or dedicated media host. Only site-relative paths are resolved against the current site.
+    $href = $is_absolute ? $url : get_site_url() . $url;
 
     $output = sprintf(
         '<a href="%s" target="_blank">%s</a>',
-        esc_url(get_site_url() . $path),
+        esc_url($href),
         esc_html($link_text)
     );