<?php
// =============================================================================
// --- Configuration ---
// =============================================================================

/**
 * Bcrypt hash of the login password.
 * Generate a replacement: echo password_hash('yourpassword', PASSWORD_BCRYPT);
 */
const PASSWORD_HASH = '$2a$12$xdU97LSv7YJ5lp0jA42C8.V/jH7gP8eVRJ0Pa8cjfXxv2qusmezWa';

const PAGE_TITLE = 'File Navigator';

// =============================================================================
// --- PHP 7.x / 8.x Polyfills ---
// =============================================================================

// str_starts_with() was added in PHP 8.0. Provide polyfill for PHP 7.x.
if (!function_exists('str_starts_with')) {
    function str_starts_with(string $haystack, string $needle): bool
    {
        return strncmp($haystack, $needle, strlen($needle)) === 0;
    }
}

// =============================================================================
// --- Helper Functions ---
// =============================================================================

/** Escape a value for safe HTML output. */
function h(string $s): string
{
    // ENT_SUBSTITUTE was added in PHP 8.0; use defined() guard for PHP 7.x.
    $flags = ENT_QUOTES | (defined('ENT_SUBSTITUTE') ? ENT_SUBSTITUTE : 0);
    return htmlspecialchars($s, $flags, 'UTF-8');
}

/**
 * Human-readable file size (e.g. "1.23 MB").
 *
 * Accepts int|false (PHP 8) or mixed (PHP 7) — no union type hint used
 * to maintain PHP 7.x compatibility.
 *
 * @param int|false $bytes
 */
function format_bytes($bytes): string
{
    if ($bytes === false || $bytes <= 0) return '0 B';
    $units = ['B', 'KB', 'MB', 'GB', 'TB'];
    $i     = min((int) floor(log($bytes, 1024)), count($units) - 1);
    return round($bytes / (1024 ** $i), $i === 0 ? 0 : 2) . ' ' . $units[$i];
}

/** Octal permission string for a path (e.g. "0755"). */
function get_perms(string $path): string
{
    $p = fileperms($path);
    return $p !== false ? substr(sprintf('%o', $p), -4) : '----';
}

/**
 * Recursively delete a directory and all its contents.
 * Symlinks are unlinked without descending into their targets.
 */
function recursive_delete(string $dir): bool
{
    if (!is_dir($dir)) return false;

    foreach (array_diff(scandir($dir), ['.', '..']) as $entry) {
        $entry_path = $dir . DIRECTORY_SEPARATOR . $entry;
        if (is_link($entry_path)) {
            unlink($entry_path);
        } elseif (is_dir($entry_path)) {
            recursive_delete($entry_path);
        } else {
            unlink($entry_path);
        }
    }
    return rmdir($dir);
}

/**
 * Resolve a filename within $dir and confirm it stays inside.
 *
 * Security: prevents crafted names like "../../etc/passwd" escaping $dir.
 *
 * PHP 7/8 compatible — no union return type hint used.
 *
 * @param  string $dir  Absolute path of the current directory.
 * @param  string $name Basename of the item (user-supplied).
 * @return string|false Real absolute path, or false on failure / escape attempt.
 */
function safe_item_path(string $dir, string $name)
{
    $name = basename($name);
    if ($name === '' || $name === '.' || $name === '..') return false;

    $resolved = realpath($dir . DIRECTORY_SEPARATOR . $name);
    if ($resolved === false) return false;

    // Append separator to avoid prefix-match false positives (/var/www vs /var/www2).
    $dir_prefix = rtrim(realpath($dir), DIRECTORY_SEPARATOR) . DIRECTORY_SEPARATOR;
    if (!str_starts_with($resolved . DIRECTORY_SEPARATOR, $dir_prefix)) return false;

    return $resolved;
}

/**
 * Add an entire directory tree into an open ZipArchive.
 *
 * - Uses forward-slash (/) as zip path separator (cross-platform ZIP standard).
 * - Includes empty sub-directories via addEmptyDir().
 * - Skips symlinks to avoid traversal of paths outside $src_path.
 *
 * NOT: RecursiveIteratorIterator boş klasörleri atlayabileceğinden
 * özyinelemeli (recursive) yöntem kullanılmaktadır; bu sayede boş
 * klasörler addEmptyDir() ile açıkça ZIP içine eklenir.
 *
 * @param ZipArchive $zip      Open ZipArchive instance.
 * @param string     $src_path Absolute real path to the directory on disk.
 * @param string     $zip_base Prefix used inside the ZIP (must end with "/").
 */
function zip_add_dir(ZipArchive $zip, string $src_path, string $zip_base): void
{
    // Klasörün kendisini ZIP içine ekle (boş olsa bile).
    $zip->addEmptyDir($zip_base);

    $entries = scandir($src_path);
    if ($entries === false) {
        return;
    }

    foreach ($entries as $entry_name) {
        if ($entry_name === '.' || $entry_name === '..') {
            continue;
        }

        $entry_path = $src_path . DIRECTORY_SEPARATOR . $entry_name;

        // Sembolik linkleri atla — traversal güvenliği.
        if (is_link($entry_path)) {
            continue;
        }

        // ZIP içindeki yol her zaman / ayracı kullanır.
        $zip_entry = $zip_base . $entry_name;

        if (is_dir($entry_path)) {
            // Alt klasörü "/" ile sonlandırarak özyinelemeli ekle.
            // Boş olsa bile zip_add_dir içinde addEmptyDir çağrılır.
            zip_add_dir($zip, $entry_path, $zip_entry . '/');
        } else {
            $zip->addFile($entry_path, $zip_entry);
        }
    }
}

// =============================================================================
// --- Authentication ---
// =============================================================================

// Set secure cookie parameters BEFORE session_start().
// session_set_cookie_params() array form and 'samesite' key are PHP 7.3+ only.
// Use ini_set() for full PHP 7.0–8.4 compatibility.
ini_set('session.cookie_httponly', '1');
ini_set('session.cookie_lifetime', '0');
ini_set('session.cookie_path', '/');
if (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') {
    ini_set('session.cookie_secure', '1');
}
// SameSite via ini_set is supported from PHP 7.3+; silently ignored on older.
ini_set('session.cookie_samesite', 'Strict');

session_start();

// Security headers — sent early, before any output.
header('X-Frame-Options: SAMEORIGIN');
header('X-Content-Type-Options: nosniff');
header('Referrer-Policy: no-referrer');

// Per-session CSRF token — embedded in every form, validated on every POST.
if (empty($_SESSION['csrf_token'])) {
    $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
}

if (isset($_GET['logout'])) {
    session_destroy();
    header('Location: ' . basename(__FILE__));
    exit;
}

// --- Simple session-based brute-force rate limiting ---
if (!isset($_SESSION['login_attempts'])) {
    $_SESSION['login_attempts'] = 0;
    $_SESSION['login_last']     = 0;
}

if (isset($_POST['password'])) {
    $locked = $_SESSION['login_attempts'] >= 5
           && (time() - (int) $_SESSION['login_last']) < 300;

    if ($locked) {
        $wait = 300 - (time() - (int) $_SESSION['login_last']);
        http_response_code(429);
        die('<p style="font-family:sans-serif;padding:20px;">Too many failed attempts. Please wait ' . $wait . ' seconds.</p>');
    }

    if (password_verify($_POST['password'], PASSWORD_HASH)) {
        // Regenerate session ID on successful login to prevent session fixation.
        session_regenerate_id(true);
        $_SESSION['auth']           = true;
        $_SESSION['csrf_token']     = bin2hex(random_bytes(32));
        $_SESSION['login_attempts'] = 0;
        header('Location: ' . basename(__FILE__));
        exit;
    }

    $_SESSION['login_attempts']++;
    $_SESSION['login_last'] = time();
}

if (!isset($_SESSION['auth'])) {
    http_response_code(401);
    die('<!DOCTYPE html><html lang="en"><head><title>Login</title><style>body{font-family:sans-serif;background:#f4f4f4;display:flex;justify-content:center;align-items:center;height:100vh;margin:0;}form{background:white;padding:30px;border-radius:5px;box-shadow:0 0 10px rgba(0,0,0,0.1);width:280px;}.field{margin-bottom:15px;}input[type=password]{width:100%;padding:10px;border:1px solid #ddd;border-radius:3px;box-sizing:border-box;}button{width:100%;padding:10px;border:none;background:#333;color:white;border-radius:3px;cursor:pointer;}</style></head><body><form method="post"><h2>Login</h2><div class="field"><input type="password" name="password" placeholder="Password" autofocus></div><button type="submit">Enter</button></form></body></html>');
}

// =============================================================================
// --- Current Directory Resolution ---
// =============================================================================

// Navigation is unrestricted across the filesystem.
// Individual file operations are each guarded by safe_item_path(),
// which ensures every action stays within $current_dir.
$current_dir = isset($_GET['path']) ? realpath($_GET['path']) : false;
if ($current_dir === false || !is_dir($current_dir)) {
    $current_dir = realpath(__DIR__);
}

// =============================================================================
// --- CSRF Verification ---
// =============================================================================

function verify_csrf(): void
{
    if (!hash_equals($_SESSION['csrf_token'] ?? '', $_POST['csrf_token'] ?? '')) {
        http_response_code(403);
        exit('Forbidden: invalid or missing CSRF token.');
    }
}

// =============================================================================
// --- Flash Message ---
// =============================================================================

// Messages are stored raw in the session; escaping happens at render time.
$message = $_SESSION['message'] ?? '';
unset($_SESSION['message']);

// =============================================================================
// --- POST Action Handlers ---
// =============================================================================

if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['action'])) {

    verify_csrf();

    $action = (string) ($_POST['action'] ?? '');

    // -------------------------------------------------------------------------
    // Bulk: Create ZIP from selected items
    // -------------------------------------------------------------------------
    if ($action === 'zip_selected') {
        if (empty($_POST['selected_items'])) {
            $_SESSION['message'] = 'No items selected.';
        } elseif (!class_exists('ZipArchive')) {
            $_SESSION['message'] = 'Error: ZipArchive extension is not available on this server.';
        } else {
            // Remove execution time limit for large backups.
            set_time_limit(0);

            $zip_filename = 'archive-' . date('Y-m-d-His') . '.zip';
            $zip_filepath = $current_dir . DIRECTORY_SEPARATOR . $zip_filename;
            $zip          = new ZipArchive();

            if ($zip->open($zip_filepath, ZipArchive::CREATE | ZipArchive::OVERWRITE) !== true) {
                $_SESSION['message'] = 'Error: Could not create the archive file. Check directory permissions.';
            } else {
                $items_added = 0;
                foreach ($_POST['selected_items'] as $raw_item) {
                    $item      = basename((string) $raw_item);
                    $item_path = safe_item_path($current_dir, $item);
                    if ($item_path === false) continue;

                    if (is_file($item_path)) {
                        // Single file — add directly with forward-slash name.
                        $zip->addFile($item_path, $item);
                        $items_added++;
                    } elseif (is_dir($item_path)) {
                        // Directory — recurse, including empty sub-dirs.
                        // Boş klasörler de geçerli öğedir: addEmptyDir içinde çağrılır.
                        // Symlinks inside are skipped for security (see zip_add_dir).
                        zip_add_dir($zip, $item_path, $item . '/');
                        $items_added++;
                    }
                }

                if ($items_added === 0) {
                    // Seçilen tüm öğeler geçersiz veya erişilemez — temizlik yap.
                    $zip->close();
                    if (file_exists($zip_filepath)) {
                        @unlink($zip_filepath);
                    }
                    $_SESSION['message'] = 'Error: No valid items could be added to the archive. Check permissions.';
                } elseif ($zip->close() === false) {
                    // close() başarısız — arşiv bozuk olabilir — temizlik yap.
                    if (file_exists($zip_filepath)) {
                        @unlink($zip_filepath);
                    }
                    $_SESSION['message'] = 'Error: Failed to finalize the archive. The file has been removed.';
                } else {
                    $_SESSION['message'] = 'Archive "' . $zip_filename . '" created successfully.';
                }
            }
        }

    // -------------------------------------------------------------------------
    // Bulk: Delete selected items
    // -------------------------------------------------------------------------
    } elseif ($action === 'delete_selected') {
        if (empty($_POST['selected_items'])) {
            $_SESSION['message'] = 'No items selected for deletion.';
        } else {
            $total         = count($_POST['selected_items']);
            $deleted_count = 0;
            foreach ($_POST['selected_items'] as $raw_item) {
                $item_path = safe_item_path($current_dir, (string) $raw_item);
                if ($item_path === false) continue;

                if (is_dir($item_path)) {
                    if (recursive_delete($item_path)) $deleted_count++;
                } elseif (is_file($item_path)) {
                    if (unlink($item_path)) $deleted_count++;
                }
            }

            if ($deleted_count === 0) {
                $_SESSION['message'] = 'Error: No items could be deleted. Check permissions.';
            } elseif ($deleted_count < $total) {
                // Partial failure — shown as error (red)
                $_SESSION['message'] = 'Error: Only ' . $deleted_count . ' of ' . $total . ' item(s) deleted. Some could not be removed.';
            } else {
                $_SESSION['message'] = $deleted_count . ' item(s) deleted successfully.';
            }
        }

    // -------------------------------------------------------------------------
    // Upload
    // -------------------------------------------------------------------------
    } elseif ($action === 'upload' && isset($_FILES['file'])) {
        if ($_FILES['file']['error'] !== UPLOAD_ERR_OK) {
            $upload_errors = [
                UPLOAD_ERR_INI_SIZE   => 'File exceeds the server size limit (php.ini)',
                UPLOAD_ERR_FORM_SIZE  => 'File exceeds the form size limit',
                UPLOAD_ERR_PARTIAL    => 'File was only partially uploaded',
                UPLOAD_ERR_NO_FILE    => 'No file was sent',
                UPLOAD_ERR_NO_TMP_DIR => 'Temporary upload folder is missing',
                UPLOAD_ERR_CANT_WRITE => 'Failed to write file to disk',
                UPLOAD_ERR_EXTENSION  => 'A PHP extension stopped the upload',
            ];
            $code = $_FILES['file']['error'];
            $_SESSION['message'] = 'Upload error: ' . ($upload_errors[$code] ?? 'Unknown error (code ' . $code . ')');
        } else {
            // Upload hedefi: dosya yöneticisindeki aktif dizin ($current_dir).
            // İzin kontrolü aynı dizine karşı yapılır.
            // Dosya türü / uzantı kısıtlaması yoktur — genel amaçlı dosya yöneticisi.
            $dest = $current_dir . DIRECTORY_SEPARATOR . basename($_FILES['file']['name']);
            if (file_exists($dest) && !is_writable($dest)) {
                $_SESSION['message'] = 'Error: Destination file exists and is not writable.';
            } elseif (!is_writable($current_dir)) {
                $_SESSION['message'] = 'Error: No write permission for this directory.';
            } elseif (move_uploaded_file($_FILES['file']['tmp_name'], $dest)) {
                $_SESSION['message'] = 'File uploaded successfully.';
            } elseif (copy($_FILES['file']['tmp_name'], $dest)) {
                unlink($_FILES['file']['tmp_name']);
                $_SESSION['message'] = 'File uploaded successfully (via copy).';
            } else {
                $err = error_get_last();
                $_SESSION['message'] = 'Upload failed. System error: ' . ($err['message'] ?? 'Unknown');
            }
        }

    // -------------------------------------------------------------------------
    // Delete (single item)
    // -------------------------------------------------------------------------
    } elseif ($action === 'delete') {
        $target = safe_item_path($current_dir, (string) ($_POST['target'] ?? ''));
        if ($target === false) {
            $_SESSION['message'] = 'Error: Item not found or access denied.';
        } else {
            $name    = basename($target);
            $deleted = is_dir($target) ? recursive_delete($target) : unlink($target);
            $_SESSION['message'] = $deleted
                ? '"' . $name . '" deleted successfully.'
                : 'Error: Could not delete "' . $name . '".';
        }

    // -------------------------------------------------------------------------
    // Rename
    // -------------------------------------------------------------------------
    } elseif ($action === 'rename') {
        $target   = safe_item_path($current_dir, (string) ($_POST['target'] ?? ''));
        $new_name = basename(trim((string) ($_POST['new_name'] ?? '')));

        if ($target === false) {
            $_SESSION['message'] = 'Error: Item not found or access denied.';
        } elseif ($new_name === '' || $new_name === '.' || $new_name === '..') {
            $_SESSION['message'] = 'Error: Invalid new name.';
        } else {
            $old_name = basename($target);
            $new_path = $current_dir . DIRECTORY_SEPARATOR . $new_name;
            if (file_exists($new_path)) {
                // Hedef isim zaten var — sessiz üzerine yazma yerine açık hata ver.
                $_SESSION['message'] = 'Error: "' . h($new_name) . '" already exists. Rename aborted.';
            } elseif (rename($target, $new_path)) {
                $_SESSION['message'] = 'Renamed "' . $old_name . '" to "' . $new_name . '".';
            } else {
                $_SESSION['message'] = 'Error: Rename failed.';
            }
        }

    // -------------------------------------------------------------------------
    // Chmod
    // -------------------------------------------------------------------------
    } elseif ($action === 'chmod') {
        $target    = safe_item_path($current_dir, (string) ($_POST['target'] ?? ''));
        $new_perms = trim((string) ($_POST['new_perms'] ?? ''));

        if ($target === false) {
            $_SESSION['message'] = 'Error: Item not found or access denied.';
        } elseif (!preg_match('/^[0-7]{3,4}$/', $new_perms)) {
            $_SESSION['message'] = 'Error: Invalid permission code "' . h($new_perms) . '".';
        } elseif (chmod($target, octdec($new_perms))) {
            $_SESSION['message'] = 'Permissions for "' . basename($target) . '" set to ' . $new_perms . '.';
        } else {
            $_SESSION['message'] = 'Error: Could not change permissions (check OS support).';
        }

    // -------------------------------------------------------------------------
    // Save (file editor)
    // -------------------------------------------------------------------------
    } elseif ($action === 'save') {
        $filename = basename((string) ($_POST['target'] ?? ''));
        $target   = safe_item_path($current_dir, $filename);
        $content  = (string) ($_POST['content'] ?? '');

        if ($target === false || !is_file($target)) {
            $_SESSION['message'] = 'Error: File not found or access denied.';
            header('Location: ' . basename(__FILE__) . '?path=' . urlencode($current_dir));
        } elseif (!is_writable($target)) {
            $_SESSION['message'] = 'Error: File is not writable. Check permissions.';
            header('Location: ' . basename(__FILE__) . '?path=' . urlencode($current_dir) . '&edit=' . urlencode($filename));
        } elseif (file_put_contents($target, $content, LOCK_EX) !== false) {
            $_SESSION['message'] = '"' . $filename . '" saved successfully.';
            header('Location: ' . basename(__FILE__) . '?path=' . urlencode($current_dir) . '&edit=' . urlencode($filename));
        } else {
            $_SESSION['message'] = 'Error: Could not save "' . $filename . '".';
            header('Location: ' . basename(__FILE__) . '?path=' . urlencode($current_dir) . '&edit=' . urlencode($filename));
        }
        exit;
    }

    header('Location: ' . basename(__FILE__) . '?path=' . urlencode($current_dir));
    exit;
}

// =============================================================================
// --- Download Handler ---
// =============================================================================

if (isset($_GET['download'])) {
    $file = safe_item_path($current_dir, (string) $_GET['download']);
    if ($file !== false && is_file($file) && is_readable($file)) {
        $file_size = filesize($file);

        // Clean any open output buffers to avoid buffering large files in RAM.
        if (ob_get_level()) {
            ob_end_clean();
        }

        header('Content-Description: File Transfer');
        header('Content-Type: application/octet-stream');
        // Escape any double-quotes in the filename for the Content-Disposition header.
        header('Content-Disposition: attachment; filename="' . str_replace('"', '\\"', basename($file)) . '"');
        if ($file_size !== false) {
            header('Content-Length: ' . $file_size);
        }
        readfile($file);
        exit;
    }
}

// =============================================================================
// --- File Editor ---
// =============================================================================

if (isset($_GET['edit'])) {
    $edit_file = safe_item_path($current_dir, (string) $_GET['edit']);
    if ($edit_file !== false && is_file($edit_file)) {
        $edit_name      = basename($edit_file);
        $edit_readable  = is_readable($edit_file);
        $edit_writable  = is_writable($edit_file);
        $edit_size      = filesize($edit_file);
        $edit_content   = $edit_readable ? file_get_contents($edit_file) : '';
        $edit_csrf      = h($_SESSION['csrf_token']);
        $edit_is_err    = str_starts_with($message, 'Error:');
        ?>
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>Edit: <?php echo h($edit_name); ?> — <?php echo h(PAGE_TITLE); ?></title>
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <style>
        *{box-sizing:border-box;margin:0;padding:0;}
        body{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,sans-serif;background:#1e1e2e;color:#cdd6f4;font-size:14px;height:100vh;display:flex;flex-direction:column;}
        .ed-header{background:#181825;border-bottom:1px solid #313244;padding:10px 16px;display:flex;align-items:center;gap:10px;flex-wrap:wrap;min-height:50px;}
        .ed-title{font-size:1em;color:#cba6f7;font-weight:600;white-space:nowrap;overflow:hidden;text-overflow:ellipsis;max-width:350px;}
        .ed-path{font-family:monospace;font-size:0.8em;color:#6c7086;flex:1;white-space:nowrap;overflow:hidden;text-overflow:ellipsis;}
        .btn{padding:6px 14px;border:none;border-radius:4px;cursor:pointer;font-size:0.875em;text-decoration:none;display:inline-flex;align-items:center;gap:5px;font-family:inherit;}
        .btn-save{background:#a6e3a1;color:#1e1e2e;font-weight:700;}
        .btn-save:hover{background:#94e2d5;}
        .btn-cancel{background:#313244;color:#cdd6f4;}
        .btn-cancel:hover{background:#45475a;}
        .ed-msg{padding:8px 16px;font-size:0.875em;}
        .ed-msg.ok{background:#a6e3a1;color:#1e1e2e;}
        .ed-msg.err{background:#f38ba8;color:#1e1e2e;}
        .ed-notice{padding:7px 16px;background:#f9e2af;color:#1e1e2e;font-size:0.85em;}
        .ed-meta{padding:5px 16px;background:#181825;border-bottom:1px solid #313244;font-size:0.78em;color:#6c7086;display:flex;gap:20px;flex-wrap:wrap;}
        .ed-wrap{flex:1;display:flex;flex-direction:column;overflow:hidden;}
        textarea{flex:1;width:100%;border:none;outline:none;resize:none;background:#1e1e2e;color:#cdd6f4;font-family:"Fira Code","Cascadia Code",Consolas,"Courier New",monospace;font-size:13px;padding:14px 18px;line-height:1.65;tab-size:4;}
        textarea:focus{background:#181825;}
    </style>
</head>
<body>
<div class="ed-header">
    <span class="ed-title">&#9998; <?php echo h($edit_name); ?></span>
    <span class="ed-path"><?php echo h($edit_file); ?></span>
    <?php if ($edit_readable && $edit_writable): ?>
    <button type="submit" form="editorForm" class="btn btn-save">&#128190; Save</button>
    <?php endif; ?>
    <a href="?path=<?php echo urlencode($current_dir); ?>" class="btn btn-cancel">&#8592; Back</a>
</div>

<?php if ($message !== ''): ?>
<div class="ed-msg <?php echo $edit_is_err ? 'err' : 'ok'; ?>"><?php echo h($message); ?></div>
<?php endif; ?>

<?php if (!$edit_readable): ?>
<div class="ed-notice">&#9888; This file is not readable.</div>
<?php elseif (!$edit_writable): ?>
<div class="ed-notice">&#9888; This file is read-only. You can view but not save changes.</div>
<?php endif; ?>

<div class="ed-meta">
    <span>File: <strong><?php echo h($edit_name); ?></strong></span>
    <span>Size: <?php echo h(format_bytes($edit_size)); ?></span>
    <span>Modified: <?php echo date('Y-m-d H:i:s', (int) filemtime($edit_file)); ?></span>
    <span>Permissions: <?php echo h(get_perms($edit_file)); ?></span>
    <?php if ($edit_readable && $edit_writable): ?><span style="color:#a6e3a1;">&#10003; Editable</span><?php endif; ?>
    <span style="color:#6c7086;font-size:0.9em;">Ctrl+S to save</span>
</div>

<form id="editorForm" method="post" action="<?php echo h(basename(__FILE__) . '?path=' . urlencode($current_dir)); ?>" class="ed-wrap">
    <input type="hidden" name="csrf_token" value="<?php echo $edit_csrf; ?>">
    <input type="hidden" name="action"     value="save">
    <input type="hidden" name="target"     value="<?php echo h($edit_name); ?>">
    <textarea name="content" spellcheck="false"<?php echo !$edit_writable ? ' readonly' : ''; ?>><?php
        echo h($edit_content !== false ? $edit_content : '');
    ?></textarea>
</form>

<script>
document.addEventListener('keydown', function(e) {
    if ((e.ctrlKey || e.metaKey) && e.key === 's') {
        e.preventDefault();
        var form = document.getElementById('editorForm');
        if (form) form.submit();
    }
});
var ta = document.querySelector('textarea');
if (ta && !ta.readOnly) {
    ta.addEventListener('keydown', function(e) {
        if (e.key === 'Tab') {
            e.preventDefault();
            var s = this.selectionStart, end = this.selectionEnd;
            this.value = this.value.substring(0, s) + '    ' + this.value.substring(end);
            this.selectionStart = this.selectionEnd = s + 4;
        }
    });
}
</script>
</body>
</html>
        <?php
        exit;
    }
}

// =============================================================================
// --- Directory Listing ---
// =============================================================================

$folders = [];
$files   = [];
foreach (scandir($current_dir) as $item) {
    if ($item === '.' || $item === '..') continue;
    $path = $current_dir . DIRECTORY_SEPARATOR . $item;
    if (is_dir($path)) {
        $folders[] = $item;
    } else {
        $files[] = $item;
    }
}

$parent_dir = dirname($current_dir);

// =============================================================================
// --- View ---
// =============================================================================

$csrf_token = h($_SESSION['csrf_token']);
?>
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title><?php echo h(PAGE_TITLE); ?></title>
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css">
    <style>
        body { font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif; margin: 0; background: #fafafa; color: #222; font-size: 14px; }
        .container { max-width: 900px; margin: 25px auto; padding: 20px; background: white; border: 1px solid #e0e0e0; box-shadow: 0 2px 4px rgba(0,0,0,0.05); border-radius: 8px; }
        header { display: flex; justify-content: space-between; align-items: center; border-bottom: 1px solid #eee; padding-bottom: 15px; margin-bottom: 20px; }
        header h1 { font-size: 1.5em; margin: 0; color: #333; }
        header a { font-size: 0.9em; color: #d9534f; text-decoration: none; padding: 5px 10px; border: 1px solid #d9534f; border-radius: 4px; transition: background-color 0.2s; }
        header a:hover { background-color: #d9534f; color: white; }
        .path { font-family: monospace; background: #e9ecef; padding: 10px; border-radius: 4px; word-break: break-all; margin-bottom: 20px; font-size: 0.9em; color: #495057; }
        .message { padding: 12px; border-radius: 4px; margin-bottom: 20px; font-size: 0.9em; background: #d4edda; border: 1px solid #c3e6cb; color: #155724; }
        .message.error { background: #f8d7da; border-color: #f5c6cb; color: #721c24; }
        table { width: 100%; border-collapse: collapse; margin-bottom: 20px; }
        th, td { padding: 12px 10px; text-align: left; border-bottom: 1px solid #e9ecef; }
        th { font-weight: 600; font-size: 0.95em; color: #555; background-color: #f8f9fa; }
        td a { color: #007bff; text-decoration: none; }
        td a:hover { text-decoration: underline; }
        .actions a { margin: 0 7px; color: #6c757d; font-size: 0.9em; }
        .upload-form, .bulk-action-container { margin-top: 25px; padding-top: 25px; border-top: 1px solid #eee; }
        .upload-form button, .bulk-action-btn { padding: 9px 18px; border: none; color: white; cursor: pointer; border-radius: 4px; font-size: 0.9em; }
        .bulk-action-btn { background: #007bff; margin-right: 10px; }
        .bulk-delete-btn { background: #dc3545; }
        .upload-form button { background: #28a745; }
    </style>
</head>
<body>
<div class="container">

    <header>
        <h1><?php echo h(PAGE_TITLE); ?></h1>
        <a href="?logout=1"><i class="fas fa-sign-out-alt"></i> Logout</a>
    </header>

    <div class="path"><code><?php echo h($current_dir); ?></code></div>

    <?php if ($message !== ''): ?>
        <?php $is_error = str_starts_with($message, 'Error:'); ?>
        <div class="message<?php echo $is_error ? ' error' : ''; ?>"><?php echo h($message); ?></div>
    <?php endif; ?>

    <!-- Hidden form for single-item actions: delete / rename / chmod -->
    <form id="singleActionForm" method="post" style="display:none;">
        <input type="hidden" name="csrf_token" value="<?php echo $csrf_token; ?>">
        <input type="hidden" name="action"    id="actionInput">
        <input type="hidden" name="target"    id="targetInput">
        <input type="hidden" name="new_name"  id="newNameInput">
        <input type="hidden" name="new_perms" id="newPermsInput">
    </form>

    <!-- Bulk actions form wraps the file table -->
    <form method="post" id="bulkActionForm">
        <input type="hidden" name="csrf_token" value="<?php echo $csrf_token; ?>">
        <input type="hidden" name="action" id="bulkActionType">

        <table>
            <thead>
                <tr>
                    <th style="width:30px;"><input type="checkbox" id="selectAll"></th>
                    <th>Name</th>
                    <th>Size</th>
                    <th>Permissions</th>
                    <th>Modified</th>
                    <th>Actions</th>
                </tr>
            </thead>
            <tbody>
                <?php if ($parent_dir !== $current_dir): ?>
                <tr>
                    <td></td>
                    <td colspan="5">
                        <i class="fas fa-folder-open" style="margin-right:5px;"></i>
                        <a href="?path=<?php echo urlencode($parent_dir); ?>">.. Parent Directory</a>
                    </td>
                </tr>
                <?php endif; ?>

                <?php foreach ($folders as $folder):
                    $path  = $current_dir . DIRECTORY_SEPARATOR . $folder;
                    $perms = get_perms($path);  // compute once per row
                ?>
                <tr>
                    <td><input type="checkbox" class="item-checkbox" name="selected_items[]" value="<?php echo h($folder); ?>"></td>
                    <td>
                        <i class="fas fa-folder" style="margin-right:5px;color:#ffc107;"></i>
                        <a href="?path=<?php echo urlencode($path); ?>"><?php echo h($folder); ?></a>
                    </td>
                    <td>-</td>
                    <td><?php echo h($perms); ?></td>
                    <td><?php echo date('Y-m-d H:i', (int) filemtime($path)); ?></td>
                    <td class="actions">
                        <a href="#" onclick="changePerms(<?php echo h(json_encode($folder)); ?>, <?php echo h(json_encode($perms)); ?>)" title="Permissions"><i class="fas fa-key"></i></a>
                        <a href="#" onclick="renameItem(<?php echo h(json_encode($folder)); ?>)" title="Rename"><i class="fas fa-edit"></i></a>
                        <a href="#" onclick="deleteItem(<?php echo h(json_encode($folder)); ?>)" title="Delete"><i class="fas fa-trash-alt" style="color:#dc3545;"></i></a>
                    </td>
                </tr>
                <?php endforeach; ?>

                <?php foreach ($files as $file):
                    $path  = $current_dir . DIRECTORY_SEPARATOR . $file;
                    $perms = get_perms($path);  // compute once per row
                ?>
                <tr>
                    <td><input type="checkbox" class="item-checkbox" name="selected_items[]" value="<?php echo h($file); ?>"></td>
                    <td>
                        <i class="fas fa-file" style="margin-right:5px;color:#6c757d;"></i>
                        <?php echo h($file); ?>
                    </td>
                    <td><?php echo h(format_bytes(filesize($path))); ?></td>
                    <td><?php echo h($perms); ?></td>
                    <td><?php echo date('Y-m-d H:i', (int) filemtime($path)); ?></td>
                    <td class="actions">
                        <a href="?path=<?php echo urlencode($current_dir); ?>&amp;download=<?php echo urlencode($file); ?>" title="Download"><i class="fas fa-download"></i></a>
                        <a href="?path=<?php echo urlencode($current_dir); ?>&amp;edit=<?php echo urlencode($file); ?>" title="Edit File"><i class="fas fa-code" style="color:#6f42c1;"></i></a>
                        <a href="#" onclick="changePerms(<?php echo h(json_encode($file)); ?>, <?php echo h(json_encode($perms)); ?>)" title="Permissions"><i class="fas fa-key"></i></a>
                        <a href="#" onclick="renameItem(<?php echo h(json_encode($file)); ?>)" title="Rename"><i class="fas fa-edit"></i></a>
                        <a href="#" onclick="deleteItem(<?php echo h(json_encode($file)); ?>)" title="Delete"><i class="fas fa-trash-alt" style="color:#dc3545;"></i></a>
                    </td>
                </tr>
                <?php endforeach; ?>
            </tbody>
        </table>

        <div class="bulk-action-container">
            <button type="button" class="bulk-action-btn" onclick="submitBulkAction('zip_selected')">
                <i class="fas fa-file-archive"></i> Create Zip from Selected
            </button>
            <button type="button" class="bulk-action-btn bulk-delete-btn" onclick="submitBulkAction('delete_selected')">
                <i class="fas fa-trash-alt"></i> Delete Selected
            </button>
        </div>
    </form>

    <!-- Upload form -->
    <div class="upload-form">
        <h3 style="margin-bottom:15px;font-size:1.1em;color:#333;">
            <i class="fas fa-cloud-upload-alt"></i> Upload File
        </h3>
        <form method="post" enctype="multipart/form-data" id="uploadForm">
            <input type="hidden" name="csrf_token" value="<?php echo $csrf_token; ?>">
            <input type="hidden" name="action" value="upload">
            <div style="display:flex;align-items:center;gap:10px;flex-wrap:wrap;">
                <label for="fileInput" style="padding:9px 18px;background:#007bff;color:white;border-radius:4px;cursor:pointer;font-size:0.9em;display:inline-flex;align-items:center;gap:8px;">
                    <i class="fas fa-folder-open"></i> Choose File
                </label>
                <input type="file" name="file" id="fileInput" required style="display:none;" onchange="updateFileName(this)">
                <span id="fileName" style="color:#6c757d;font-size:0.9em;flex:1;min-width:200px;">No file selected</span>
                <button type="submit" id="uploadBtn" disabled style="padding:9px 18px;border:none;background:#28a745;color:white;cursor:not-allowed;border-radius:4px;font-size:0.9em;display:inline-flex;align-items:center;gap:8px;opacity:0.6;">
                    <i class="fas fa-upload"></i> Upload
                </button>
            </div>
        </form>
    </div>

</div>
<script>
    // Select-all checkbox
    document.getElementById('selectAll').addEventListener('change', function (e) {
        document.querySelectorAll('.item-checkbox').forEach(function(c) { c.checked = e.target.checked; });
    });

    // Submit a single-item action via the hidden form
    function performSingleAction(action, target, extraName, extraVal) {
        document.getElementById('actionInput').value   = action;
        document.getElementById('targetInput').value   = target;
        document.getElementById('newNameInput').value  = (extraName === 'new_name')  ? extraVal : '';
        document.getElementById('newPermsInput').value = (extraName === 'new_perms') ? extraVal : '';
        document.getElementById('singleActionForm').submit();
    }

    function deleteItem(target) {
        if (confirm('"' + target + '" will be permanently deleted. Are you sure?')) {
            performSingleAction('delete', target, null, null);
        }
    }

    function renameItem(target) {
        var newName = prompt('New name for "' + target + '":', target);
        if (newName && newName.trim() && newName.trim() !== target) {
            performSingleAction('rename', target, 'new_name', newName.trim());
        }
    }

    function changePerms(target, currentPerms) {
        var newPerms = prompt('New permissions for "' + target + '" (e.g. 755):', currentPerms);
        if (newPerms && newPerms.trim() && newPerms.trim() !== currentPerms) {
            performSingleAction('chmod', target, 'new_perms', newPerms.trim());
        }
    }

    function submitBulkAction(actionType) {
        if (document.querySelectorAll('.item-checkbox:checked').length === 0) {
            alert('Please select at least one item.');
            return;
        }
        var msg = actionType === 'delete_selected'
            ? 'Are you sure you want to permanently delete the selected items?'
            : 'Are you sure you want to create a ZIP archive from the selected items?';
        if (confirm(msg)) {
            document.getElementById('bulkActionType').value = actionType;
            document.getElementById('bulkActionForm').submit();
        }
    }

    // Safely display selected file name (no innerHTML injection)
    function updateFileName(input) {
        var fileNameSpan = document.getElementById('fileName');
        var uploadBtn    = document.getElementById('uploadBtn');
        if (input.files && input.files.length > 0) {
            var file     = input.files[0];
            var fileSize = file.size > 1024 * 1024
                ? (file.size / (1024 * 1024)).toFixed(2) + ' MB'
                : (file.size / 1024).toFixed(2) + ' KB';
            // Use textContent to avoid DOM XSS via crafted file names
            fileNameSpan.textContent = file.name + ' (' + fileSize + ')';
            fileNameSpan.style.color = '#28a745';
            uploadBtn.disabled       = false;
            uploadBtn.style.cursor   = 'pointer';
            uploadBtn.style.opacity  = '1';
        } else {
            fileNameSpan.textContent = 'No file selected';
            fileNameSpan.style.color = '#6c757d';
            uploadBtn.disabled       = true;
            uploadBtn.style.cursor   = 'not-allowed';
            uploadBtn.style.opacity  = '0.6';
        }
    }
</script>
</body>
</html>