index.php

<?php
declare(strict_types=1);

/**
 * Simple File Manager — hardened, self-hosted edition
 *
 * Inspired by jcampbell1/simple-file-manager and Tiny File Manager v2.6.
 * This application is intentionally a single PHP entry point. Its frontend
 * dependencies are stored locally in ./assets; no CDN requests are used.
 *
 * Requirements: PHP 7.4+ (PHP 8.x recommended), fileinfo extension.
 */

/* ========================================================================
 * CONFIGURATION — EDIT THIS SECTION ONLY
 * ====================================================================== */

// Display name shown in the browser.
$app_title = 'Simple File Manager';

// Directory that users may manage. Use __DIR__ to manage this project folder.
// Set an explicit absolute directory for production, e.g. '/srv/uploads'.
$root_path = __DIR__;

// Authentication is enabled by default. Generate a hash with:
// php -r "echo password_hash('change-this-password', PASSWORD_DEFAULT), PHP_EOL;"
$use_auth = true;
$auth_users = [
    // 'admin' => '$2y$10$REPLACE_WITH_A_PASSWORD_HASH',
];
$readonly_users = [];              // e.g. ['viewer']
$user_directories = [];            // e.g. ['client-a' => '/srv/client-a']

// SAFETY: Keep true until at least one real password hash is configured.
$block_placeholder_credentials = true;

// Mutating operations. Recommended production defaults are conservative.
$allow_upload = true;
$allow_delete = true;
$allow_create_folder = true;
$allow_rename = true;
$allow_copy_move = true;
$allow_edit = true;
$allow_archive_download = true;
$allow_direct_link = false;        // false forces downloads instead of direct links.

// Upload policy. Empty allowed MIME list accepts all non-blocked files.
$max_upload_size_bytes = 100 * 1024 * 1024; // 100 MiB per file; also configure PHP/nginx limits.
$allowed_upload_extensions = [];   // e.g. ['jpg', 'png', 'pdf', 'zip']; empty = no allow-list.
$blocked_upload_extensions = [
    'php', 'php3', 'php4', 'php5', 'php7', 'phtml', 'phar', 'cgi', 'pl', 'py',
    'asp', 'aspx', 'jsp', 'sh', 'bash', 'zsh', 'exe', 'dll', 'com', 'bat', 'cmd',
];
$allowed_upload_mime_types = [];   // e.g. ['image/jpeg', 'image/png', 'application/pdf']; empty = no allow-list.

// Listing and access policy.
$show_hidden_files = false;
$hidden_patterns = ['.git', '.env', '*.php']; // Applied only to the directory listing.
$disallowed_download_patterns = ['*.php', '*.env', '.git*'];

// Optional IP gate. Set mode to 'allow' and add trusted IPs / CIDRs for a private deployment.
$ip_access_mode = 'off';           // 'off', 'allow', or 'deny'
$ip_rules = [];                    // e.g. ['127.0.0.1', '192.168.1.0/24']

// Require HTTPS for authentication and modifying requests in production.
$require_https = false;

// Keep false in production. Errors are logged through PHP's normal error log.
$debug = false;

// UI defaults.
$default_theme = 'light';           // 'light' or 'dark'
$default_timezone = 'Asia/Kuala_Lumpur';

/* ========================================================================
 * END CONFIGURATION
 * ====================================================================== */

const SFM_VERSION = '2.0.0';
const SFM_SESSION_NAME = 'simple_file_manager';

ini_set('display_errors', $debug ? '1' : '0');
error_reporting($debug ? E_ALL : E_ALL & ~E_NOTICE & ~E_DEPRECATED);
date_default_timezone_set($default_timezone);

$is_https = sfm_is_https();
if ($require_https && !$is_https) {
    sfm_fail(403, 'HTTPS is required for this file manager.');
}
if (!sfm_ip_is_allowed(sfm_client_ip(), $ip_access_mode, $ip_rules)) {
    sfm_fail(403, 'Access denied.');
}

$root_path = sfm_normalize_root($root_path);
if ($root_path === null) {
    sfm_fail(500, 'Configured root path does not exist or is not readable.');
}

session_name(SFM_SESSION_NAME);
session_set_cookie_params([
    'lifetime' => 0,
    'path' => '/',
    'secure' => $is_https,
    'httponly' => true,
    'samesite' => 'Strict',
]);
session_start();

if (empty($_SESSION['csrf'])) {
    $_SESSION['csrf'] = bin2hex(random_bytes(32));
}
if (empty($_SESSION['theme'])) {
    $_SESSION['theme'] = $default_theme === 'dark' ? 'dark' : 'light';
}

// No default backdoor: empty or placeholder auth configuration is refused.
if ($use_auth && ($auth_users === [] || sfm_auth_has_placeholder($auth_users)) && $block_placeholder_credentials) {
    sfm_show_setup_error($app_title);
    exit;
}

if (isset($_GET['logout'])) {
    $_SESSION = [];
    session_regenerate_id(true);
    header('Location: ' . sfm_self_url());
    exit;
}

if ($use_auth) {
    sfm_handle_login($auth_users);
}

$current_user = $use_auth ? (string) ($_SESSION['sfm_user'] ?? '') : 'anonymous';
if ($use_auth && !isset($auth_users[$current_user])) {
    sfm_show_login($app_title);
    exit;
}

if ($use_auth && isset($user_directories[$current_user])) {
    $user_root = sfm_normalize_root((string) $user_directories[$current_user]);
    if ($user_root === null) {
        sfm_fail(500, 'The configured directory for this user is unavailable.');
    }
    $root_path = $user_root;
}

$readonly = in_array($current_user, $readonly_users, true);

// Security headers. Scripts and styles are served locally, but a nonce supports this page's small bootstrap script.
$nonce = base64_encode(random_bytes(18));
header('X-Content-Type-Options: nosniff');
header('X-Frame-Options: DENY');
header('Referrer-Policy: same-origin');
header('Permissions-Policy: camera=(), microphone=(), geolocation=()');
header("Content-Security-Policy: default-src 'self'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; img-src 'self' data:; style-src 'self' 'nonce-{$nonce}'; script-src 'self' 'nonce-{$nonce}'; connect-src 'self'");
header('Cache-Control: no-store, private');

$requested_path = (string) ($_REQUEST['path'] ?? '');
$current_path = sfm_resolve_path($root_path, $requested_path, true);
if ($current_path === null) {
    sfm_fail(403, 'Invalid or inaccessible path.');
}

$action = (string) ($_REQUEST['action'] ?? '');
if ($action !== '') {
    sfm_handle_action(
        $action,
        $root_path,
        $current_path,
        $requested_path,
        $readonly,
        [
            'upload' => $allow_upload,
            'delete' => $allow_delete,
            'mkdir' => $allow_create_folder,
            'rename' => $allow_rename,
            'copy_move' => $allow_copy_move,
            'edit' => $allow_edit,
            'archive' => $allow_archive_download,
            'direct_link' => $allow_direct_link,
            'max_upload_size' => $max_upload_size_bytes,
            'allowed_extensions' => $allowed_upload_extensions,
            'blocked_extensions' => $blocked_upload_extensions,
            'allowed_mimes' => $allowed_upload_mime_types,
            'show_hidden' => $show_hidden_files,
            'hidden_patterns' => $hidden_patterns,
            'download_patterns' => $disallowed_download_patterns,
        ]
    );
}

sfm_render_page($app_title, $root_path, $current_path, $requested_path, $current_user, $readonly, $nonce, $_SESSION['theme']);

/* ========================================================================
 * REQUEST HANDLERS
 * ====================================================================== */

function sfm_handle_login(array $auth_users): void
{
    if (isset($_SESSION['sfm_user']) && isset($auth_users[$_SESSION['sfm_user']])) {
        return;
    }

    if ($_SERVER['REQUEST_METHOD'] !== 'POST' || !isset($_POST['login'])) {
        sfm_show_login('Simple File Manager');
        exit;
    }

    if (!sfm_verify_csrf((string) ($_POST['csrf'] ?? ''))) {
        sfm_show_login('Simple File Manager', 'Your session expired. Please try again.');
        exit;
    }

    $username = (string) ($_POST['username'] ?? '');
    $password = (string) ($_POST['password'] ?? '');

    // Always take a small fixed delay to make online guessing less practical.
    usleep(500000);
    $hash = $auth_users[$username] ?? null;
    if (!is_string($hash) || !password_verify($password, $hash)) {
        sfm_show_login('Simple File Manager', 'Invalid username or password.');
        exit;
    }

    session_regenerate_id(true);
    $_SESSION['sfm_user'] = $username;
    header('Location: ' . sfm_self_url());
    exit;
}

function sfm_handle_action(string $action, string $root, string $current_path, string $requested_path, bool $readonly, array $config): void
{
    if (in_array($action, ['download', 'archive'], true)) {
        // Download links are GET so they work in browsers; protect them by session authentication.
        if ($action === 'download') {
            sfm_action_download($root, $current_path, $config['download_patterns']);
        }
        if ($readonly || !$config['archive']) {
            sfm_fail(403, 'This action is disabled.');
        }
        sfm_action_archive($root, $current_path, $requested_path);
    }

    if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
        sfm_fail(405, 'POST is required for this action.');
    }
    if (!sfm_verify_csrf((string) ($_POST['csrf'] ?? ''))) {
        sfm_fail(403, 'Invalid CSRF token.');
    }
    if ($readonly && !in_array($action, ['theme'], true)) {
        sfm_fail(403, 'This account is read-only.');
    }

    switch ($action) {
        case 'upload':
            if (!$config['upload']) sfm_fail(403, 'Uploads are disabled.');
            sfm_action_upload($root, $current_path, $requested_path, $config);
            break;
        case 'mkdir':
            if (!$config['mkdir']) sfm_fail(403, 'Folder creation is disabled.');
            sfm_action_mkdir($current_path, $requested_path);
            break;
        case 'delete':
            if (!$config['delete']) sfm_fail(403, 'Deletion is disabled.');
            sfm_action_delete($root, $current_path, $requested_path);
            break;
        case 'rename':
            if (!$config['rename']) sfm_fail(403, 'Rename is disabled.');
            sfm_action_rename($root, $current_path, $requested_path);
            break;
        case 'copy_move':
            if (!$config['copy_move']) sfm_fail(403, 'Copy and move are disabled.');
            sfm_action_copy_move($root, $current_path, $requested_path);
            break;
        case 'save':
            if (!$config['edit']) sfm_fail(403, 'Editing is disabled.');
            sfm_action_save($root, $current_path, $requested_path);
            break;
        case 'theme':
            $theme = (string) ($_POST['theme'] ?? 'light');
            $_SESSION['theme'] = $theme === 'dark' ? 'dark' : 'light';
            sfm_redirect($requested_path, 'Theme updated.');
            break;
        default:
            sfm_fail(400, 'Unknown action.');
    }
}

function sfm_action_upload(string $root, string $directory, string $requested_path, array $config): void
{
    if (!is_dir($directory) || !is_writable($directory)) sfm_fail(403, 'Destination is not writable.');
    if (empty($_FILES['files'])) sfm_fail(400, 'No files were received.');

    $files = $_FILES['files'];
    $count = is_array($files['name']) ? count($files['name']) : 0;
    $finfo = new finfo(FILEINFO_MIME_TYPE);
    $uploaded = 0;

    for ($i = 0; $i < $count; $i++) {
        $error = (int) $files['error'][$i];
        if ($error !== UPLOAD_ERR_OK) {
            sfm_fail(400, 'Upload failed: ' . sfm_upload_error_message($error));
        }
        $name = sfm_safe_filename((string) $files['name'][$i]);
        if ($name === null) sfm_fail(400, 'An uploaded filename is invalid.');
        $tmp = (string) $files['tmp_name'][$i];
        $size = (int) $files['size'][$i];
        if (!is_uploaded_file($tmp)) sfm_fail(400, 'Invalid upload source.');
        if ($size < 1 || $size > (int) $config['max_upload_size']) sfm_fail(413, 'One uploaded file exceeds the configured size limit.');

        $extension = strtolower((string) pathinfo($name, PATHINFO_EXTENSION));
        if (in_array($extension, $config['blocked_extensions'], true)) sfm_fail(403, 'This file extension is blocked.');
        if ($config['allowed_extensions'] !== [] && !in_array($extension, $config['allowed_extensions'], true)) sfm_fail(403, 'This file extension is not allowed.');

        $mime = $finfo->file($tmp) ?: 'application/octet-stream';
        if ($config['allowed_mimes'] !== [] && !in_array($mime, $config['allowed_mimes'], true)) sfm_fail(403, 'This file type is not allowed.');

        $destination = $directory . DIRECTORY_SEPARATOR . $name;
        if (file_exists($destination)) sfm_fail(409, 'A file with this name already exists: ' . $name);
        if (!move_uploaded_file($tmp, $destination)) sfm_fail(500, 'The uploaded file could not be saved.');
        @chmod($destination, 0640);
        $uploaded++;
    }
    sfm_redirect($requested_path, "Uploaded {$uploaded} file(s).");
}

function sfm_action_mkdir(string $directory, string $requested_path): void
{
    $name = sfm_safe_filename((string) ($_POST['name'] ?? ''));
    if ($name === null) sfm_fail(400, 'Invalid folder name.');
    $target = $directory . DIRECTORY_SEPARATOR . $name;
    if (file_exists($target)) sfm_fail(409, 'That name is already in use.');
    if (!mkdir($target, 0750)) sfm_fail(500, 'Folder creation failed.');
    sfm_redirect($requested_path, 'Folder created.');
}

function sfm_action_delete(string $root, string $target, string $requested_path): void
{
    if ($target === $root) sfm_fail(403, 'The configured root cannot be deleted.');
    if (!file_exists($target) && !is_link($target)) sfm_fail(404, 'Target not found.');
    if (!sfm_delete_tree($target)) sfm_fail(500, 'Could not completely delete the selected item.');
    sfm_redirect(sfm_parent_relative_path($requested_path), 'Item deleted.');
}

function sfm_action_rename(string $root, string $source, string $requested_path): void
{
    if ($source === $root) sfm_fail(403, 'The configured root cannot be renamed.');
    $name = sfm_safe_filename((string) ($_POST['name'] ?? ''));
    if ($name === null) sfm_fail(400, 'Invalid new name.');
    $target = dirname($source) . DIRECTORY_SEPARATOR . $name;
    if (file_exists($target) || is_link($target)) sfm_fail(409, 'That name is already in use.');
    if (!rename($source, $target)) sfm_fail(500, 'Rename failed.');
    sfm_redirect(sfm_parent_relative_path($requested_path), 'Item renamed.');
}

function sfm_action_copy_move(string $root, string $source, string $requested_path): void
{
    if ($source === $root) sfm_fail(403, 'The configured root cannot be moved or copied.');
    $target_relative = (string) ($_POST['destination'] ?? '');
    $destination_directory = sfm_resolve_path($root, $target_relative, true);
    if ($destination_directory === null || !is_dir($destination_directory) || !is_writable($destination_directory)) sfm_fail(400, 'Invalid destination folder.');
    $target = $destination_directory . DIRECTORY_SEPARATOR . basename($source);
    if (file_exists($target) || is_link($target)) sfm_fail(409, 'The destination already has an item with this name.');
    if (sfm_path_is_within($source, $target)) sfm_fail(400, 'Cannot place a folder inside itself.');

    $mode = (string) ($_POST['mode'] ?? 'copy');
    if ($mode === 'move') {
        if (!rename($source, $target)) sfm_fail(500, 'Move failed.');
        sfm_redirect($target_relative, 'Item moved.');
    }
    if (!sfm_copy_tree($source, $target)) sfm_fail(500, 'Copy failed.');
    sfm_redirect($target_relative, 'Item copied.');
}

function sfm_action_save(string $root, string $file, string $requested_path): void
{
    if (!is_file($file) || is_link($file)) sfm_fail(400, 'Only regular files can be edited.');
    $max_edit_size = 2 * 1024 * 1024;
    if (filesize($file) > $max_edit_size) sfm_fail(413, 'Files larger than 2 MiB cannot be edited in the browser.');
    $content = (string) ($_POST['content'] ?? '');
    if (strlen($content) > $max_edit_size) sfm_fail(413, 'Saved content exceeds the editing limit.');
    $temp = tempnam(dirname($file), '.sfm-');
    if ($temp === false || file_put_contents($temp, $content, LOCK_EX) === false || !rename($temp, $file)) {
        @unlink($temp ?: '');
        sfm_fail(500, 'Could not save the file.');
    }
    @chmod($file, 0640);
    sfm_redirect($requested_path, 'File saved.');
}

function sfm_action_download(string $root, string $file, array $disallowed_patterns): void
{
    if (!is_file($file) || is_link($file)) sfm_fail(404, 'File not found.');
    if (sfm_matches_patterns(basename($file), $disallowed_patterns)) sfm_fail(403, 'Downloads of this file type are disabled.');
    $name = basename($file);
    $mime = (new finfo(FILEINFO_MIME_TYPE))->file($file) ?: 'application/octet-stream';
    header('Content-Type: ' . $mime);
    header('Content-Length: ' . (string) filesize($file));
    header('Content-Disposition: attachment; filename="' . rawurlencode($name) . '"');
    header('X-Content-Type-Options: nosniff');
    while (ob_get_level() > 0) ob_end_clean();
    readfile($file);
    exit;
}

function sfm_action_archive(string $root, string $directory, string $requested_path): void
{
    if (!class_exists('ZipArchive')) sfm_fail(501, 'The PHP ZipArchive extension is unavailable.');
    if (!is_dir($directory)) sfm_fail(400, 'Only folders can be archived.');
    $temp = tempnam(sys_get_temp_dir(), 'sfm-archive-');
    if ($temp === false) sfm_fail(500, 'Could not create the archive.');
    $zip = new ZipArchive();
    if ($zip->open($temp, ZipArchive::OVERWRITE) !== true) sfm_fail(500, 'Could not create the archive.');
    $iterator = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($directory, FilesystemIterator::SKIP_DOTS), RecursiveIteratorIterator::LEAVES_ONLY);
    foreach ($iterator as $item) {
        if ($item->isLink()) continue;
        $path = $item->getPathname();
        $relative = substr($path, strlen($directory) + 1);
        if ($item->isFile()) $zip->addFile($path, $relative);
    }
    $zip->close();
    $archive_name = (basename($directory) ?: 'archive') . '.zip';
    header('Content-Type: application/zip');
    header('Content-Length: ' . (string) filesize($temp));
    header('Content-Disposition: attachment; filename="' . rawurlencode($archive_name) . '"');
    readfile($temp);
    @unlink($temp);
    exit;
}

/* ========================================================================
 * PAGE
 * ====================================================================== */

function sfm_render_page(string $title, string $root, string $current, string $requested_path, string $user, bool $readonly, string $nonce, string $theme): void
{
    $message = (string) ($_SESSION['flash'] ?? '');
    unset($_SESSION['flash']);
    $relative_current = sfm_relative_path($root, $current);
    $entries = sfm_list_entries($root, $current, $requested_path, $GLOBALS['show_hidden_files'], $GLOBALS['hidden_patterns']);
    $edit_target = isset($_GET['edit']) ? sfm_resolve_path($root, (string) $_GET['edit'], true) : null;
    $edit_content = null;
    $edit_relative = '';
    if ($edit_target !== null && is_file($edit_target) && !is_link($edit_target) && filesize($edit_target) <= 2 * 1024 * 1024) {
        $edit_content = file_get_contents($edit_target);
        $edit_relative = sfm_relative_path($root, $edit_target);
    }
    $root_json = json_encode($relative_current, JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT);
    $csrf_json = json_encode($_SESSION['csrf'], JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT);
    ?>
<!doctype html>
<html lang="en" data-bs-theme="<?= sfm_h($theme) ?>">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title><?= sfm_h($title) ?></title>
<link rel="stylesheet" href="assets/css/bootstrap.min.css">
<link rel="stylesheet" href="assets/css/font-awesome.min.css">
<link rel="stylesheet" href="assets/css/highlight.min.css">
<style nonce="<?= sfm_h($nonce) ?>">
body { min-height:100vh; background:var(--bs-tertiary-bg); }
.sfm-navbar { box-shadow:0 .125rem .25rem rgba(0,0,0,.08); }
.file-icon { width:2.1rem; text-align:center; font-size:1.2rem; }
.file-row:hover { background:var(--bs-secondary-bg); }
.file-name { overflow-wrap:anywhere; }
.drop-zone { border:2px dashed var(--bs-border-color); border-radius:.5rem; padding:1.25rem; text-align:center; background:var(--bs-body-bg); transition:.2s; }
.drop-zone.dragover { border-color:var(--bs-primary); background:var(--bs-primary-bg-subtle); }
.path-bar { overflow-x:auto; white-space:nowrap; }
.editor { width:100%; min-height:65vh; font-family:ui-monospace,SFMono-Regular,Consolas,monospace; tab-size:4; }
.table td, .table th { vertical-align:middle; }
@media (max-width: 767px) { .hide-mobile { display:none; } .file-icon { width:1.6rem; } }
</style>
</head>
<body>
<nav class="navbar navbar-expand-lg bg-body sfm-navbar sticky-top">
  <div class="container-fluid">
    <a class="navbar-brand fw-semibold" href="<?= sfm_h(sfm_url('')) ?>"><i class="fa fa-folder-open text-warning me-1"></i><?= sfm_h($title) ?></a>
    <div class="d-flex align-items-center gap-2 ms-auto">
      <span class="small text-body-secondary d-none d-md-inline"><i class="fa fa-user me-1"></i><?= sfm_h($user) ?><?= $readonly ? ' (read-only)' : '' ?></span>
      <form method="post" class="m-0">
        <input type="hidden" name="action" value="theme"><input type="hidden" name="path" value="<?= sfm_h($relative_current) ?>"><input type="hidden" name="csrf" value="<?= sfm_h($_SESSION['csrf']) ?>">
        <input type="hidden" name="theme" value="<?= $theme === 'dark' ? 'light' : 'dark' ?>">
        <button class="btn btn-sm btn-outline-secondary" title="Toggle theme"><i class="fa fa-<?= $theme === 'dark' ? 'sun-o' : 'moon-o' ?>"></i></button>
      </form>
      <?php if ($GLOBALS['use_auth']): ?><a class="btn btn-sm btn-outline-danger" href="?logout=1">Logout</a><?php endif; ?>
    </div>
  </div>
</nav>

<main class="container-fluid py-3">
<?php if ($message !== ''): ?><div class="alert alert-success alert-dismissible fade show" role="alert"><?= sfm_h($message) ?><button class="btn-close" data-bs-dismiss="alert"></button></div><?php endif; ?>

<div class="card shadow-sm mb-3"><div class="card-body py-2 path-bar">
  <a href="<?= sfm_h(sfm_url('')) ?>" class="text-decoration-none"><i class="fa fa-home"></i> Home</a>
  <?= sfm_breadcrumbs($relative_current) ?>
</div></div>

<?php if (!$readonly): ?>
<div class="row g-3 mb-3">
  <div class="col-lg-7">
    <div class="card shadow-sm"><div class="card-body">
      <div id="drop-zone" class="drop-zone"><i class="fa fa-cloud-upload fa-2x text-primary mb-2"></i><div class="fw-medium">Drop files here to upload</div><div class="small text-body-secondary mb-2">Maximum <?= sfm_h(sfm_format_bytes((int) $GLOBALS['max_upload_size_bytes'])) ?> per file</div>
      <form method="post" enctype="multipart/form-data" id="upload-form"><input type="hidden" name="action" value="upload"><input type="hidden" name="path" value="<?= sfm_h($relative_current) ?>"><input type="hidden" name="csrf" value="<?= sfm_h($_SESSION['csrf']) ?>"><input id="file-input" name="files[]" type="file" multiple class="form-control"></form>
      </div><div id="upload-status" class="small mt-2"></div>
    </div></div>
  </div>
  <div class="col-lg-5"><div class="card shadow-sm"><div class="card-body">
    <div class="row g-2">
      <div class="col-md-6"><form method="post" class="input-group"><input type="hidden" name="action" value="mkdir"><input type="hidden" name="path" value="<?= sfm_h($relative_current) ?>"><input type="hidden" name="csrf" value="<?= sfm_h($_SESSION['csrf']) ?>"><input class="form-control" name="name" maxlength="255" placeholder="New folder" required><button class="btn btn-primary" title="Create folder"><i class="fa fa-folder-o"></i></button></form></div>
      <div class="col-md-6"><input id="file-filter" class="form-control" placeholder="Filter this folder…" aria-label="Filter files"></div>
    </div>
  </div></div></div>
</div>
<?php else: ?><div class="mb-3"><input id="file-filter" class="form-control" placeholder="Filter this folder…" aria-label="Filter files"></div><?php endif; ?>

<div class="card shadow-sm"><div class="table-responsive"><table class="table table-hover mb-0" id="file-table">
<thead class="table-light"><tr><th>Name</th><th class="hide-mobile text-end">Size</th><th class="hide-mobile">Modified</th><th class="hide-mobile">Permissions</th><th class="text-end">Actions</th></tr></thead>
<tbody>
<?php if ($relative_current !== ''): ?><tr><td colspan="5"><a href="<?= sfm_h(sfm_url(sfm_parent_relative_path($relative_current))) ?>" class="text-decoration-none"><i class="fa fa-level-up me-2"></i>Parent folder</a></td></tr><?php endif; ?>
<?php foreach ($entries as $entry): ?>
<tr class="file-row" data-name="<?= sfm_h(strtolower($entry['name'])) ?>">
<td><div class="d-flex align-items-center"><span class="file-icon text-<?= $entry['is_dir'] ? 'warning' : 'secondary' ?>"><i class="fa fa-<?= $entry['is_dir'] ? 'folder' : sfm_icon_for_name($entry['name']) ?>"></i></span><div class="file-name"><a class="text-decoration-none fw-<?= $entry['is_dir'] ? 'semibold' : 'normal' ?>" href="<?= sfm_h($entry['href']) ?>"><?= sfm_h($entry['name']) ?></a></div></div></td>
<td class="hide-mobile text-end text-body-secondary small"><?= $entry['is_dir'] ? '—' : sfm_h(sfm_format_bytes($entry['size'])) ?></td>
<td class="hide-mobile text-body-secondary small"><?= sfm_h(date('Y-m-d H:i', $entry['mtime'])) ?></td>
<td class="hide-mobile text-body-secondary small"><code><?= sfm_h($entry['perms']) ?></code></td>
<td class="text-end text-nowrap">
<?php if (!$entry['is_dir']): ?><a class="btn btn-sm btn-outline-secondary" title="Download" href="<?= sfm_h(sfm_action_url('download', $entry['relative'])) ?>"><i class="fa fa-download"></i></a><?php endif; ?>
<?php if ($entry['is_dir'] && !$readonly && $GLOBALS['allow_archive_download']): ?><a class="btn btn-sm btn-outline-secondary" title="Download ZIP" href="<?= sfm_h(sfm_action_url('archive', $entry['relative'])) ?>"><i class="fa fa-file-archive-o"></i></a><?php endif; ?>
<?php if (!$readonly && !$entry['is_dir'] && $GLOBALS['allow_edit'] && $entry['size'] <= 2*1024*1024): ?><a class="btn btn-sm btn-outline-primary" title="Edit" href="<?= sfm_h(sfm_url($relative_current, ['edit' => $entry['relative']])) ?>"><i class="fa fa-pencil"></i></a><?php endif; ?>
<?php if (!$readonly): ?><button type="button" class="btn btn-sm btn-outline-secondary action-modal" data-bs-toggle="modal" data-bs-target="#actionModal" data-path="<?= sfm_h($entry['relative']) ?>" data-name="<?= sfm_h($entry['name']) ?>" data-dir="<?= $entry['is_dir'] ? '1' : '0' ?>" title="More actions"><i class="fa fa-ellipsis-h"></i></button><?php endif; ?>
</td></tr>
<?php endforeach; ?>
<?php if ($entries === []): ?><tr><td colspan="5" class="text-center text-body-secondary py-5">This folder is empty.</td></tr><?php endif; ?>
</tbody></table></div></div>
</main>

<?php if (!$readonly): ?>
<div class="modal fade" id="actionModal" tabindex="-1" aria-hidden="true"><div class="modal-dialog"><div class="modal-content"><div class="modal-header"><h5 class="modal-title">Manage <span id="modal-item-name"></span></h5><button class="btn-close" data-bs-dismiss="modal"></button></div><div class="modal-body">
<div class="d-grid gap-2 mb-3"><button id="show-rename" class="btn btn-outline-primary">Rename</button><button id="show-copy-move" class="btn btn-outline-secondary">Copy or move</button><button id="show-delete" class="btn btn-outline-danger">Delete permanently</button></div>
<form id="rename-form" method="post" class="d-none"><input type="hidden" name="action" value="rename"><input type="hidden" name="path" id="rename-path"><input type="hidden" name="csrf" value="<?= sfm_h($_SESSION['csrf']) ?>"><label class="form-label">New name</label><input id="rename-name" class="form-control mb-2" name="name" required><button class="btn btn-primary">Rename</button></form>
<form id="copy-move-form" method="post" class="d-none"><input type="hidden" name="action" value="copy_move"><input type="hidden" name="path" id="copy-move-path"><input type="hidden" name="csrf" value="<?= sfm_h($_SESSION['csrf']) ?>"><label class="form-label">Destination relative to Home</label><input class="form-control mb-2" name="destination" placeholder="e.g. uploads/2026" required><select class="form-select mb-2" name="mode"><option value="copy">Copy</option><option value="move">Move</option></select><button class="btn btn-primary">Continue</button></form>
<form id="delete-form" method="post" class="d-none"><input type="hidden" name="action" value="delete"><input type="hidden" name="path" id="delete-path"><input type="hidden" name="csrf" value="<?= sfm_h($_SESSION['csrf']) ?>"><p class="text-danger">This action cannot be undone.</p><button class="btn btn-danger">Delete permanently</button></form>
</div></div></div></div>
<?php endif; ?>

<?php if ($edit_content !== null && !$readonly): ?>
<div class="modal fade" id="editorModal" tabindex="-1" aria-hidden="true"><div class="modal-dialog modal-xl modal-dialog-scrollable"><div class="modal-content"><form method="post"><div class="modal-header"><h5 class="modal-title"><i class="fa fa-pencil me-2"></i><?= sfm_h($edit_relative) ?></h5><a class="btn-close" href="<?= sfm_h(sfm_url($relative_current)) ?>"></a></div><div class="modal-body"><input type="hidden" name="action" value="save"><input type="hidden" name="path" value="<?= sfm_h($edit_relative) ?>"><input type="hidden" name="csrf" value="<?= sfm_h($_SESSION['csrf']) ?>"><textarea class="form-control editor" name="content" spellcheck="false"><?= sfm_h((string) $edit_content) ?></textarea></div><div class="modal-footer"><a class="btn btn-outline-secondary" href="<?= sfm_h(sfm_url($relative_current)) ?>">Cancel</a><button class="btn btn-primary"><i class="fa fa-save me-1"></i>Save</button></div></form></div></div></div>
<?php endif; ?>

<script src="assets/js/bootstrap.bundle.min.js"></script>
<script nonce="<?= sfm_h($nonce) ?>">
(() => {
  const csrf = <?= $csrf_json ?>, currentPath = <?= $root_json ?>;
  const filter = document.getElementById('file-filter');
  if (filter) filter.addEventListener('input', () => { const q = filter.value.toLowerCase(); document.querySelectorAll('#file-table tbody tr[data-name]').forEach(row => row.hidden = !row.dataset.name.includes(q)); });
  const drop = document.getElementById('drop-zone'), input = document.getElementById('file-input'), form = document.getElementById('upload-form');
  if (drop && input && form) {
    ['dragenter','dragover'].forEach(type => drop.addEventListener(type, e => { e.preventDefault(); drop.classList.add('dragover'); }));
    ['dragleave','drop'].forEach(type => drop.addEventListener(type, e => { e.preventDefault(); drop.classList.remove('dragover'); }));
    drop.addEventListener('drop', e => { input.files = e.dataTransfer.files; form.submit(); });
    input.addEventListener('change', () => { if (input.files.length) form.submit(); });
  }
  const modal = document.getElementById('actionModal');
  if (modal) {
    modal.addEventListener('show.bs.modal', e => { const b = e.relatedTarget; const path = b.dataset.path, name = b.dataset.name; document.getElementById('modal-item-name').textContent = name; document.getElementById('rename-path').value = path; document.getElementById('rename-name').value = name; document.getElementById('copy-move-path').value = path; document.getElementById('delete-path').value = path; ['rename-form','copy-move-form','delete-form'].forEach(id => document.getElementById(id).classList.add('d-none')); });
    document.getElementById('show-rename').onclick = () => document.getElementById('rename-form').classList.remove('d-none');
    document.getElementById('show-copy-move').onclick = () => document.getElementById('copy-move-form').classList.remove('d-none');
    document.getElementById('show-delete').onclick = () => document.getElementById('delete-form').classList.remove('d-none');
  }
  const editor = document.getElementById('editorModal'); if (editor) new bootstrap.Modal(editor).show();
})();
</script>
</body></html>
<?php
}

function sfm_show_login(string $title, string $error = ''): void
{
    $nonce = base64_encode(random_bytes(18));
    header('Content-Security-Policy: default-src \'self\'; style-src \'self\' \'nonce-' . $nonce . '\'; script-src \'self\'; img-src \'self\' data:; base-uri \'self\'; form-action \'self\'; frame-ancestors \'none\'');
    ?>
<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title><?= sfm_h($title) ?> — Login</title><link rel="stylesheet" href="assets/css/bootstrap.min.css"><link rel="stylesheet" href="assets/css/font-awesome.min.css"><style nonce="<?= sfm_h($nonce) ?>">body{min-height:100vh;background:#f4f6f9}.login{max-width:420px;margin:auto}.card{box-shadow:0 .5rem 1rem rgba(0,0,0,.12)}</style></head><body class="d-flex align-items-center"><main class="login w-100 p-3"><div class="card"><div class="card-body p-4"><h1 class="h3 text-center mb-4"><i class="fa fa-folder-open text-warning me-2"></i><?= sfm_h($title) ?></h1><?php if ($error): ?><div class="alert alert-danger"><?= sfm_h($error) ?></div><?php endif; ?><form method="post" autocomplete="off"><input type="hidden" name="login" value="1"><input type="hidden" name="csrf" value="<?= sfm_h($_SESSION['csrf'] ?? '') ?>"><div class="mb-3"><label class="form-label" for="username">Username</label><input id="username" class="form-control" name="username" required autofocus></div><div class="mb-3"><label class="form-label" for="password">Password</label><input id="password" class="form-control" type="password" name="password" required></div><button class="btn btn-primary w-100">Sign in</button></form></div></div></main></body></html>
<?php
}

function sfm_show_setup_error(string $title): void
{
    http_response_code(503);
    ?>
<!doctype html><html><head><meta charset="utf-8"><title>Configuration required</title></head><body><h1><?= sfm_h($title) ?> is not configured</h1><p>Authentication is enabled but no usable password hash exists.</p><p>Edit the <strong>CONFIGURATION</strong> section at the top of <code>index.php</code>, then add a password hash to <code>$auth_users</code>.</p><pre>php -r "echo password_hash('your-strong-password', PASSWORD_DEFAULT), PHP_EOL;"</pre><p>Example: <code>'admin' =&gt; '$2y$...'</code></p></body></html>
<?php
}

/* ========================================================================
 * FILESYSTEM / SECURITY HELPERS
 * ====================================================================== */

function sfm_is_https(): bool { return (!empty($_SERVER['HTTPS']) && strtolower((string) $_SERVER['HTTPS']) !== 'off') || (($_SERVER['HTTP_X_FORWARDED_PROTO'] ?? '') === 'https'); }
function sfm_self_url(): string { return strtok($_SERVER['REQUEST_URI'] ?? $_SERVER['PHP_SELF'], '?') ?: '/'; }
function sfm_h(string $value): string { return htmlspecialchars($value, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8'); }
function sfm_verify_csrf(string $token): bool { return isset($_SESSION['csrf']) && $token !== '' && hash_equals((string) $_SESSION['csrf'], $token); }
function sfm_auth_has_placeholder(array $users): bool { foreach ($users as $hash) if (!is_string($hash) || str_contains($hash, 'REPLACE_WITH')) return true; return false; }
function sfm_normalize_root(string $root): ?string { $real = realpath($root); return ($real !== false && is_dir($real) && is_readable($real)) ? rtrim($real, DIRECTORY_SEPARATOR) : null; }

function sfm_resolve_path(string $root, string $relative, bool $must_exist): ?string
{
    $relative = str_replace('\\', '/', trim($relative));
    if ($relative === '' || $relative === '.') return $root;
    if (str_contains($relative, "\0") || preg_match('#(^/|^[a-zA-Z]:|://)#', $relative)) return null;
    $segments = [];
    foreach (explode('/', $relative) as $segment) {
        if ($segment === '' || $segment === '.') continue;
        if ($segment === '..') { if ($segments === []) return null; array_pop($segments); continue; }
        $segments[] = $segment;
    }
    $candidate = $root . DIRECTORY_SEPARATOR . implode(DIRECTORY_SEPARATOR, $segments);
    if ($must_exist) {
        $real = realpath($candidate);
        if ($real === false || !sfm_path_is_within($root, $real)) return null;
        return $real;
    }
    return sfm_path_is_within($root, $candidate) ? $candidate : null;
}

function sfm_path_is_within(string $root, string $path): bool
{
    $root = rtrim(str_replace('\\', '/', $root), '/') . '/';
    $path = rtrim(str_replace('\\', '/', $path), '/');
    return strncmp(strtolower($path . '/'), strtolower($root), strlen($root)) === 0;
}
function sfm_relative_path(string $root, string $path): string { $relative = ltrim(substr(str_replace('\\', '/', $path), strlen(rtrim(str_replace('\\', '/', $root), '/'))), '/'); return $relative; }
function sfm_parent_relative_path(string $path): string { $path = trim(str_replace('\\', '/', $path), '/'); return $path === '' ? '' : trim(str_replace('\\', '/', dirname($path)), '.'); }
function sfm_safe_filename(string $name): ?string { $name = trim($name); if ($name === '' || $name === '.' || $name === '..' || str_contains($name, "\0") || preg_match('#[\\/:*?"<>|]#', $name)) return null; return $name; }
function sfm_matches_patterns(string $name, array $patterns): bool { foreach ($patterns as $pattern) if (fnmatch($pattern, $name, FNM_CASEFOLD)) return true; return false; }

function sfm_list_entries(string $root, string $directory, string $requested_path, bool $show_hidden, array $hidden_patterns): array
{
    if (!is_dir($directory) || !is_readable($directory)) return [];
    $entries = [];
    foreach (new DirectoryIterator($directory) as $item) {
        if ($item->isDot() || $item->isLink()) continue; // Never expose symlinks through the manager.
        $name = $item->getFilename();
        if ((!$show_hidden && str_starts_with($name, '.')) || sfm_matches_patterns($name, $hidden_patterns)) continue;
        $real = $item->getRealPath();
        if ($real === false || !sfm_path_is_within($root, $real)) continue;
        $is_dir = $item->isDir();
        $relative = sfm_relative_path($root, $real);
        $entries[] = [
            'name' => $name, 'is_dir' => $is_dir, 'size' => $is_dir ? 0 : $item->getSize(), 'mtime' => $item->getMTime(),
            'perms' => substr(sprintf('%o', $item->getPerms()), -4), 'relative' => $relative,
            'href' => $is_dir ? sfm_url($relative) : ($GLOBALS['allow_direct_link'] ? sfm_url($relative) : sfm_action_url('download', $relative)),
        ];
    }
    usort($entries, static fn(array $a, array $b): int => ($a['is_dir'] === $b['is_dir']) ? strnatcasecmp($a['name'], $b['name']) : ($a['is_dir'] ? -1 : 1));
    return $entries;
}

function sfm_delete_tree(string $path): bool
{
    if (is_link($path)) return unlink($path);
    if (is_file($path)) return unlink($path);
    if (!is_dir($path)) return false;
    foreach (new FilesystemIterator($path, FilesystemIterator::SKIP_DOTS) as $item) {
        if ($item->isLink() || !sfm_delete_tree($item->getPathname())) return false;
    }
    return rmdir($path);
}
function sfm_copy_tree(string $source, string $destination): bool
{
    if (is_link($source)) return false;
    if (is_file($source)) return copy($source, $destination);
    if (!mkdir($destination, 0750)) return false;
    foreach (new FilesystemIterator($source, FilesystemIterator::SKIP_DOTS) as $item) {
        if (!sfm_copy_tree($item->getPathname(), $destination . DIRECTORY_SEPARATOR . $item->getFilename())) return false;
    }
    return true;
}
function sfm_upload_error_message(int $code): string { return [UPLOAD_ERR_INI_SIZE => 'server upload limit exceeded', UPLOAD_ERR_FORM_SIZE => 'form upload limit exceeded', UPLOAD_ERR_PARTIAL => 'partial upload', UPLOAD_ERR_NO_FILE => 'no file supplied', UPLOAD_ERR_NO_TMP_DIR => 'temporary directory missing', UPLOAD_ERR_CANT_WRITE => 'failed writing file', UPLOAD_ERR_EXTENSION => 'blocked by PHP extension'][$code] ?? 'unknown error'; }
function sfm_format_bytes(int $bytes): string { $units = ['B','KiB','MiB','GiB','TiB']; $i = 0; $value = (float) $bytes; while ($value >= 1024 && $i < count($units) - 1) { $value /= 1024; $i++; } return ($i === 0 ? (string) (int) $value : number_format($value, 1)) . ' ' . $units[$i]; }
function sfm_icon_for_name(string $name): string { $ext = strtolower((string) pathinfo($name, PATHINFO_EXTENSION)); return match ($ext) { 'jpg','jpeg','png','gif','webp','svg' => 'file-image-o', 'pdf' => 'file-pdf-o', 'zip','gz','rar','7z','tar' => 'file-archive-o', 'mp3','wav','ogg','m4a' => 'file-audio-o', 'mp4','mkv','webm','avi' => 'file-video-o', 'php','js','ts','css','html','htm','json','xml','yml','yaml','md','txt','log' => 'file-code-o', default => 'file-o' }; }

function sfm_url(string $path = '', array $extra = []): string { $query = array_merge(['path' => $path], $extra); if ($path === '') unset($query['path']); return sfm_self_url() . ($query ? '?' . http_build_query($query, '', '&', PHP_QUERY_RFC3986) : ''); }
function sfm_action_url(string $action, string $path): string { return sfm_self_url() . '?' . http_build_query(['action' => $action, 'path' => $path], '', '&', PHP_QUERY_RFC3986); }
function sfm_redirect(string $path, string $message): void { $_SESSION['flash'] = $message; header('Location: ' . sfm_url($path)); exit; }
function sfm_breadcrumbs(string $path): string { if ($path === '') return ''; $html = ''; $build = []; foreach (explode('/', $path) as $part) { $build[] = $part; $html .= ' <span class="text-body-secondary mx-1">/</span> <a class="text-decoration-none" href="' . sfm_h(sfm_url(implode('/', $build))) . '">' . sfm_h($part) . '</a>'; } return $html; }
function sfm_fail(int $status, string $message): void { http_response_code($status); header('Content-Type: text/plain; charset=utf-8'); echo $message; exit; }

function sfm_client_ip(): string { return (string) ($_SERVER['REMOTE_ADDR'] ?? ''); }
function sfm_ip_is_allowed(string $ip, string $mode, array $rules): bool { if ($mode === 'off') return true; $matched = false; foreach ($rules as $rule) { if (sfm_ip_matches_rule($ip, $rule)) { $matched = true; break; } } return $mode === 'allow' ? $matched : !$matched; }
function sfm_ip_matches_rule(string $ip, string $rule): bool { if (!str_contains($rule, '/')) return hash_equals($rule, $ip); [$network, $prefix] = explode('/', $rule, 2); if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4) === false || filter_var($network, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4) === false || !ctype_digit($prefix) || (int) $prefix > 32) return false; $mask = -1 << (32 - (int) $prefix); return ((ip2long($ip) & $mask) === (ip2long($network) & $mask)); }
?>