Refactor API endpoints and modularize controllers and models
This commit is contained in:
Ryan
86
addUser.php
86
addUser.php
@@ -1,86 +0,0 @@
|
|||||||
<?php
|
|
||||||
require_once 'config.php';
|
|
||||||
header('Content-Type: application/json');
|
|
||||||
|
|
||||||
$usersFile = USERS_DIR . USERS_FILE;
|
|
||||||
|
|
||||||
// Determine if we are in setup mode:
|
|
||||||
// - Query parameter setup=1 is passed
|
|
||||||
// - And users.txt is either missing or empty (zero bytes or trimmed content is empty)
|
|
||||||
$isSetup = (isset($_GET['setup']) && $_GET['setup'] === '1');
|
|
||||||
if ($isSetup && (!file_exists($usersFile) || filesize($usersFile) == 0 || trim(file_get_contents($usersFile)) === '')) {
|
|
||||||
// Allow initial admin creation without session checks.
|
|
||||||
$setupMode = true;
|
|
||||||
} else {
|
|
||||||
$setupMode = false;
|
|
||||||
// In non-setup mode, check CSRF token and require admin privileges.
|
|
||||||
$headers = array_change_key_case(getallheaders(), CASE_LOWER);
|
|
||||||
$receivedToken = isset($headers['x-csrf-token']) ? trim($headers['x-csrf-token']) : '';
|
|
||||||
if (!isset($_SESSION['csrf_token']) || $receivedToken !== $_SESSION['csrf_token']) {
|
|
||||||
echo json_encode(["error" => "Invalid CSRF token"]);
|
|
||||||
http_response_code(403);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
if (
|
|
||||||
!isset($_SESSION['authenticated']) || $_SESSION['authenticated'] !== true ||
|
|
||||||
!isset($_SESSION['isAdmin']) || $_SESSION['isAdmin'] !== true
|
|
||||||
) {
|
|
||||||
echo json_encode(["error" => "Unauthorized"]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Get input data from JSON.
|
|
||||||
$data = json_decode(file_get_contents("php://input"), true);
|
|
||||||
$newUsername = trim($data["username"] ?? "");
|
|
||||||
$newPassword = trim($data["password"] ?? "");
|
|
||||||
|
|
||||||
// In setup mode, force the new user to be admin.
|
|
||||||
if ($setupMode) {
|
|
||||||
$isAdmin = "1";
|
|
||||||
} else {
|
|
||||||
$isAdmin = !empty($data["isAdmin"]) ? "1" : "0"; // "1" for admin, "0" for regular user.
|
|
||||||
}
|
|
||||||
|
|
||||||
// Validate input.
|
|
||||||
if (!$newUsername || !$newPassword) {
|
|
||||||
echo json_encode(["error" => "Username and password required"]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Validate username using preg_match (allow letters, numbers, underscores, dashes, and spaces).
|
|
||||||
if (!preg_match(REGEX_USER, $newUsername)) {
|
|
||||||
echo json_encode(["error" => "Invalid username. Only letters, numbers, underscores, dashes, and spaces are allowed."]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Ensure users.txt exists.
|
|
||||||
if (!file_exists($usersFile)) {
|
|
||||||
file_put_contents($usersFile, '');
|
|
||||||
}
|
|
||||||
|
|
||||||
// Check if username already exists.
|
|
||||||
$existingUsers = file($usersFile, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES);
|
|
||||||
foreach ($existingUsers as $line) {
|
|
||||||
list($storedUser, $storedHash, $storedRole) = explode(':', trim($line));
|
|
||||||
if ($newUsername === $storedUser) {
|
|
||||||
echo json_encode(["error" => "User already exists"]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Hash the password.
|
|
||||||
$hashedPassword = password_hash($newPassword, PASSWORD_BCRYPT);
|
|
||||||
|
|
||||||
// Prepare new user line.
|
|
||||||
$newUserLine = $newUsername . ":" . $hashedPassword . ":" . $isAdmin . PHP_EOL;
|
|
||||||
|
|
||||||
// In setup mode, overwrite users.txt; otherwise, append to it.
|
|
||||||
if ($setupMode) {
|
|
||||||
file_put_contents($usersFile, $newUserLine);
|
|
||||||
} else {
|
|
||||||
file_put_contents($usersFile, $newUserLine, FILE_APPEND);
|
|
||||||
}
|
|
||||||
|
|
||||||
echo json_encode(["success" => "User added successfully"]);
|
|
||||||
?>
|
|
||||||
270
auth.php
270
auth.php
@@ -1,270 +0,0 @@
|
|||||||
<?php
|
|
||||||
require_once 'vendor/autoload.php';
|
|
||||||
require_once 'config.php';
|
|
||||||
|
|
||||||
use RobThree\Auth\Algorithm;
|
|
||||||
use RobThree\Auth\Providers\Qr\GoogleChartsQrCodeProvider;
|
|
||||||
|
|
||||||
header('Content-Type: application/json');
|
|
||||||
|
|
||||||
// Global exception handler: logs errors and returns a generic error message.
|
|
||||||
set_exception_handler(function ($e) {
|
|
||||||
error_log("Unhandled exception: " . $e->getMessage());
|
|
||||||
http_response_code(500);
|
|
||||||
echo json_encode(["error" => "Internal Server Error"]);
|
|
||||||
exit();
|
|
||||||
});
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Helper: Get the user's role from users.txt.
|
|
||||||
*/
|
|
||||||
function getUserRole($username) {
|
|
||||||
$usersFile = USERS_DIR . USERS_FILE;
|
|
||||||
if (file_exists($usersFile)) {
|
|
||||||
foreach (file($usersFile, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES) as $line) {
|
|
||||||
$parts = explode(":", trim($line));
|
|
||||||
if (count($parts) >= 3 && $parts[0] === $username) {
|
|
||||||
return trim($parts[2]);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return null;
|
|
||||||
}
|
|
||||||
|
|
||||||
/* --- OIDC Authentication Flow --- */
|
|
||||||
// Detect either ?oidc=… or a callback that only has ?code=
|
|
||||||
$oidcAction = $_GET['oidc'] ?? null;
|
|
||||||
if (!$oidcAction && isset($_GET['code'])) {
|
|
||||||
$oidcAction = 'callback';
|
|
||||||
}
|
|
||||||
if ($oidcAction) {
|
|
||||||
$adminConfigFile = USERS_DIR . 'adminConfig.json';
|
|
||||||
if (file_exists($adminConfigFile)) {
|
|
||||||
$enc = file_get_contents($adminConfigFile);
|
|
||||||
$dec = decryptData($enc, $encryptionKey);
|
|
||||||
$cfg = $dec !== false ? json_decode($dec, true) : [];
|
|
||||||
} else {
|
|
||||||
$cfg = [];
|
|
||||||
}
|
|
||||||
$oidc_provider_url = $cfg['oidc']['providerUrl'] ?? 'https://your-oidc-provider.com';
|
|
||||||
$oidc_client_id = $cfg['oidc']['clientId'] ?? 'YOUR_CLIENT_ID';
|
|
||||||
$oidc_client_secret = $cfg['oidc']['clientSecret'] ?? 'YOUR_CLIENT_SECRET';
|
|
||||||
// Use your production domain for redirect URI.
|
|
||||||
$oidc_redirect_uri = $cfg['oidc']['redirectUri'] ?? 'https://yourdomain.com/auth.php?oidc=callback';
|
|
||||||
|
|
||||||
$oidc = new Jumbojett\OpenIDConnectClient(
|
|
||||||
$oidc_provider_url,
|
|
||||||
$oidc_client_id,
|
|
||||||
$oidc_client_secret
|
|
||||||
);
|
|
||||||
$oidc->setRedirectURL($oidc_redirect_uri);
|
|
||||||
|
|
||||||
if ($oidcAction === 'callback') {
|
|
||||||
try {
|
|
||||||
$oidc->authenticate();
|
|
||||||
$username = $oidc->requestUserInfo('preferred_username');
|
|
||||||
|
|
||||||
// Check if this user has a TOTP secret.
|
|
||||||
$usersFile = USERS_DIR . USERS_FILE;
|
|
||||||
$totp_secret = null;
|
|
||||||
if (file_exists($usersFile)) {
|
|
||||||
foreach (file($usersFile, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES) as $line) {
|
|
||||||
$parts = explode(":", trim($line));
|
|
||||||
if (count($parts) >= 4 && $parts[0] === $username && !empty($parts[3])) {
|
|
||||||
$totp_secret = decryptData($parts[3], $encryptionKey);
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if ($totp_secret) {
|
|
||||||
// Hold pending login & prompt for TOTP.
|
|
||||||
$_SESSION['pending_login_user'] = $username;
|
|
||||||
$_SESSION['pending_login_secret'] = $totp_secret;
|
|
||||||
header("Location: index.html?totp_required=1");
|
|
||||||
exit();
|
|
||||||
}
|
|
||||||
|
|
||||||
// No TOTP → finalize login.
|
|
||||||
session_regenerate_id(true);
|
|
||||||
$_SESSION["authenticated"] = true;
|
|
||||||
$_SESSION["username"] = $username;
|
|
||||||
$_SESSION["isAdmin"] = (getUserRole($username) === "1");
|
|
||||||
$_SESSION["folderOnly"] = loadUserPermissions($username);
|
|
||||||
|
|
||||||
header("Location: index.html");
|
|
||||||
exit();
|
|
||||||
} catch (Exception $e) {
|
|
||||||
error_log("OIDC authentication error: " . $e->getMessage());
|
|
||||||
http_response_code(401);
|
|
||||||
echo json_encode(["error" => "Authentication failed."]);
|
|
||||||
exit();
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
// Initiate OIDC authentication.
|
|
||||||
try {
|
|
||||||
$oidc->authenticate();
|
|
||||||
exit();
|
|
||||||
} catch (Exception $e) {
|
|
||||||
error_log("OIDC initiation error: " . $e->getMessage());
|
|
||||||
http_response_code(401);
|
|
||||||
echo json_encode(["error" => "Authentication initiation failed."]);
|
|
||||||
exit();
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
/* --- Fallback: Form-based Authentication --- */
|
|
||||||
$usersFile = USERS_DIR . USERS_FILE;
|
|
||||||
$maxAttempts = 5;
|
|
||||||
$lockoutTime = 30 * 60; // 30 minutes
|
|
||||||
$attemptsFile = USERS_DIR . 'failed_logins.json';
|
|
||||||
$failedLogFile = USERS_DIR . 'failed_login.log';
|
|
||||||
$persistentTokensFile = USERS_DIR . 'persistent_tokens.json';
|
|
||||||
|
|
||||||
function loadFailedAttempts($file) {
|
|
||||||
if (file_exists($file)) {
|
|
||||||
$data = json_decode(file_get_contents($file), true);
|
|
||||||
if (is_array($data)) {
|
|
||||||
return $data;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return [];
|
|
||||||
}
|
|
||||||
|
|
||||||
function saveFailedAttempts($file, $data) {
|
|
||||||
file_put_contents($file, json_encode($data, JSON_PRETTY_PRINT), LOCK_EX);
|
|
||||||
}
|
|
||||||
|
|
||||||
$ip = $_SERVER['REMOTE_ADDR'];
|
|
||||||
$currentTime = time();
|
|
||||||
$failedAttempts = loadFailedAttempts($attemptsFile);
|
|
||||||
|
|
||||||
if (isset($failedAttempts[$ip])) {
|
|
||||||
$attemptData = $failedAttempts[$ip];
|
|
||||||
if ($attemptData['count'] >= $maxAttempts && ($currentTime - $attemptData['last_attempt']) < $lockoutTime) {
|
|
||||||
http_response_code(429);
|
|
||||||
echo json_encode(["error" => "Too many failed login attempts. Please try again later."]);
|
|
||||||
exit();
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
function authenticate($username, $password) {
|
|
||||||
global $usersFile, $encryptionKey;
|
|
||||||
if (!file_exists($usersFile)) {
|
|
||||||
return false;
|
|
||||||
}
|
|
||||||
$lines = file($usersFile, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES);
|
|
||||||
foreach ($lines as $line) {
|
|
||||||
$parts = explode(':', trim($line));
|
|
||||||
if (count($parts) < 3) continue;
|
|
||||||
if ($username === $parts[0] && password_verify($password, $parts[1])) {
|
|
||||||
$result = ['role' => $parts[2]];
|
|
||||||
$result['totp_secret'] = (isset($parts[3]) && !empty($parts[3]))
|
|
||||||
? decryptData($parts[3], $encryptionKey)
|
|
||||||
: null;
|
|
||||||
return $result;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return false;
|
|
||||||
}
|
|
||||||
|
|
||||||
$data = json_decode(file_get_contents("php://input"), true);
|
|
||||||
$username = trim($data["username"] ?? "");
|
|
||||||
$password = trim($data["password"] ?? "");
|
|
||||||
$rememberMe = isset($data["remember_me"]) && $data["remember_me"] === true;
|
|
||||||
|
|
||||||
if (!$username || !$password) {
|
|
||||||
http_response_code(400);
|
|
||||||
echo json_encode(["error" => "Username and password are required"]);
|
|
||||||
exit();
|
|
||||||
}
|
|
||||||
|
|
||||||
if (!preg_match(REGEX_USER, $username)) {
|
|
||||||
http_response_code(400);
|
|
||||||
echo json_encode(["error" => "Invalid username format. Only letters, numbers, underscores, dashes, and spaces are allowed."]);
|
|
||||||
exit();
|
|
||||||
}
|
|
||||||
|
|
||||||
$user = authenticate($username, $password);
|
|
||||||
if ($user !== false) {
|
|
||||||
if (!empty($user['totp_secret'])) {
|
|
||||||
// If TOTP code is missing or malformed, indicate that TOTP is required.
|
|
||||||
if (empty($data['totp_code']) || !preg_match('/^\d{6}$/', $data['totp_code'])) {
|
|
||||||
// ← STORE pending user & secret so recovery can see it
|
|
||||||
$_SESSION['pending_login_user'] = $username;
|
|
||||||
$_SESSION['pending_login_secret'] = $user['totp_secret'];
|
|
||||||
echo json_encode([
|
|
||||||
"totp_required" => true,
|
|
||||||
"message" => "TOTP code required"
|
|
||||||
]);
|
|
||||||
exit();
|
|
||||||
} else {
|
|
||||||
$tfa = new \RobThree\Auth\TwoFactorAuth(
|
|
||||||
new GoogleChartsQrCodeProvider(), // QR code provider
|
|
||||||
'FileRise', // issuer
|
|
||||||
6, // number of digits
|
|
||||||
30, // period in seconds
|
|
||||||
Algorithm::Sha1 // Correct enum case name from your enum
|
|
||||||
);
|
|
||||||
$providedCode = trim($data['totp_code']);
|
|
||||||
if (!$tfa->verifyCode($user['totp_secret'], $providedCode)) {
|
|
||||||
echo json_encode(["error" => "Invalid TOTP code"]);
|
|
||||||
exit();
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if (isset($failedAttempts[$ip])) {
|
|
||||||
unset($failedAttempts[$ip]);
|
|
||||||
saveFailedAttempts($attemptsFile, $failedAttempts);
|
|
||||||
}
|
|
||||||
session_regenerate_id(true);
|
|
||||||
$_SESSION["authenticated"] = true;
|
|
||||||
$_SESSION["username"] = $username;
|
|
||||||
$_SESSION["isAdmin"] = ($user['role'] === "1");
|
|
||||||
$_SESSION["folderOnly"] = loadUserPermissions($username);
|
|
||||||
|
|
||||||
if ($rememberMe) {
|
|
||||||
$token = bin2hex(random_bytes(32));
|
|
||||||
$expiry = time() + (30 * 24 * 60 * 60);
|
|
||||||
$persistentTokens = [];
|
|
||||||
if (file_exists($persistentTokensFile)) {
|
|
||||||
$encryptedContent = file_get_contents($persistentTokensFile);
|
|
||||||
$decryptedContent = decryptData($encryptedContent, $encryptionKey);
|
|
||||||
$persistentTokens = json_decode($decryptedContent, true);
|
|
||||||
if (!is_array($persistentTokens)) {
|
|
||||||
$persistentTokens = [];
|
|
||||||
}
|
|
||||||
}
|
|
||||||
$persistentTokens[$token] = [
|
|
||||||
"username" => $username,
|
|
||||||
"expiry" => $expiry,
|
|
||||||
"isAdmin" => ($_SESSION["isAdmin"] === true)
|
|
||||||
];
|
|
||||||
$encryptedContent = encryptData(json_encode($persistentTokens, JSON_PRETTY_PRINT), $encryptionKey);
|
|
||||||
file_put_contents($persistentTokensFile, $encryptedContent, LOCK_EX);
|
|
||||||
// Define $secure based on whether HTTPS is enabled
|
|
||||||
$secure = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off');
|
|
||||||
setcookie('remember_me_token', $token, $expiry, '/', '', $secure, true);
|
|
||||||
}
|
|
||||||
|
|
||||||
echo json_encode([
|
|
||||||
"status" => "ok",
|
|
||||||
"success" => "Login successful",
|
|
||||||
"isAdmin" => $_SESSION["isAdmin"],
|
|
||||||
"folderOnly"=> $_SESSION["folderOnly"],
|
|
||||||
"username" => $_SESSION["username"]
|
|
||||||
]);
|
|
||||||
} else {
|
|
||||||
if (isset($failedAttempts[$ip])) {
|
|
||||||
$failedAttempts[$ip]['count']++;
|
|
||||||
$failedAttempts[$ip]['last_attempt'] = $currentTime;
|
|
||||||
} else {
|
|
||||||
$failedAttempts[$ip] = ['count' => 1, 'last_attempt' => $currentTime];
|
|
||||||
}
|
|
||||||
saveFailedAttempts($attemptsFile, $failedAttempts);
|
|
||||||
$logLine = date('Y-m-d H:i:s') . " - Failed login attempt for username: " . $username . " from IP: " . $ip . PHP_EOL;
|
|
||||||
file_put_contents($failedLogFile, $logLine, FILE_APPEND);
|
|
||||||
http_response_code(401);
|
|
||||||
echo json_encode(["error" => "Invalid credentials"]);
|
|
||||||
}
|
|
||||||
?>
|
|
||||||
@@ -1,99 +0,0 @@
|
|||||||
<?php
|
|
||||||
// changePassword.php
|
|
||||||
require_once 'config.php';
|
|
||||||
header('Content-Type: application/json');
|
|
||||||
|
|
||||||
if (!isset($_SESSION['authenticated']) || $_SESSION['authenticated'] !== true) {
|
|
||||||
echo json_encode(["error" => "Unauthorized"]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
$username = $_SESSION['username'] ?? '';
|
|
||||||
if (!$username) {
|
|
||||||
echo json_encode(["error" => "No username in session"]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// CSRF token check.
|
|
||||||
$headers = array_change_key_case(getallheaders(), CASE_LOWER);
|
|
||||||
$receivedToken = isset($headers['x-csrf-token']) ? trim($headers['x-csrf-token']) : '';
|
|
||||||
if ($receivedToken !== $_SESSION['csrf_token']) {
|
|
||||||
echo json_encode(["error" => "Invalid CSRF token"]);
|
|
||||||
http_response_code(403);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Get POST data.
|
|
||||||
$data = json_decode(file_get_contents("php://input"), true);
|
|
||||||
$oldPassword = trim($data["oldPassword"] ?? "");
|
|
||||||
$newPassword = trim($data["newPassword"] ?? "");
|
|
||||||
$confirmPassword = trim($data["confirmPassword"] ?? "");
|
|
||||||
|
|
||||||
// Validate input.
|
|
||||||
if (!$oldPassword || !$newPassword || !$confirmPassword) {
|
|
||||||
echo json_encode(["error" => "All fields are required."]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
if ($newPassword !== $confirmPassword) {
|
|
||||||
echo json_encode(["error" => "New passwords do not match."]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Path to users file.
|
|
||||||
$usersFile = USERS_DIR . USERS_FILE;
|
|
||||||
if (!file_exists($usersFile)) {
|
|
||||||
echo json_encode(["error" => "Users file not found"]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Read current users.
|
|
||||||
$lines = file($usersFile, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES);
|
|
||||||
$userFound = false;
|
|
||||||
$newLines = [];
|
|
||||||
|
|
||||||
foreach ($lines as $line) {
|
|
||||||
$parts = explode(':', trim($line));
|
|
||||||
// Expect at least 3 parts: username, hashed password, and role.
|
|
||||||
if (count($parts) < 3) {
|
|
||||||
// Skip invalid lines.
|
|
||||||
$newLines[] = $line;
|
|
||||||
continue;
|
|
||||||
}
|
|
||||||
$storedUser = $parts[0];
|
|
||||||
$storedHash = $parts[1];
|
|
||||||
$storedRole = $parts[2];
|
|
||||||
// Preserve TOTP secret if it exists.
|
|
||||||
$totpSecret = (count($parts) >= 4) ? $parts[3] : "";
|
|
||||||
|
|
||||||
if ($storedUser === $username) {
|
|
||||||
$userFound = true;
|
|
||||||
// Verify the old password.
|
|
||||||
if (!password_verify($oldPassword, $storedHash)) {
|
|
||||||
echo json_encode(["error" => "Old password is incorrect."]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
// Hash the new password.
|
|
||||||
$newHashedPassword = password_hash($newPassword, PASSWORD_BCRYPT);
|
|
||||||
// Rebuild the line with the new hash and preserve TOTP secret if present.
|
|
||||||
if ($totpSecret !== "") {
|
|
||||||
$newLines[] = $username . ":" . $newHashedPassword . ":" . $storedRole . ":" . $totpSecret;
|
|
||||||
} else {
|
|
||||||
$newLines[] = $username . ":" . $newHashedPassword . ":" . $storedRole;
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
$newLines[] = $line;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
if (!$userFound) {
|
|
||||||
echo json_encode(["error" => "User not found."]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Save updated users file.
|
|
||||||
if (file_put_contents($usersFile, implode(PHP_EOL, $newLines) . PHP_EOL)) {
|
|
||||||
echo json_encode(["success" => "Password updated successfully."]);
|
|
||||||
} else {
|
|
||||||
echo json_encode(["error" => "Could not update password."]);
|
|
||||||
}
|
|
||||||
?>
|
|
||||||
@@ -1,70 +0,0 @@
|
|||||||
<?php
|
|
||||||
require_once 'config.php';
|
|
||||||
header('Content-Type: application/json');
|
|
||||||
|
|
||||||
// Check if users.txt is empty or doesn't exist.
|
|
||||||
$usersFile = USERS_DIR . USERS_FILE;
|
|
||||||
if (!file_exists($usersFile) || trim(file_get_contents($usersFile)) === '') {
|
|
||||||
// In production, you might log that the system is in setup mode.
|
|
||||||
error_log("checkAuth: users file not found or empty; entering setup mode.");
|
|
||||||
echo json_encode(["setup" => true]);
|
|
||||||
exit();
|
|
||||||
}
|
|
||||||
|
|
||||||
// Check session authentication.
|
|
||||||
if (!isset($_SESSION['authenticated']) || $_SESSION['authenticated'] !== true) {
|
|
||||||
echo json_encode(["authenticated" => false]);
|
|
||||||
exit();
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Helper function to get a user's role from users.txt.
|
|
||||||
* Returns the role as a string (e.g. "1") or null if not found.
|
|
||||||
*/
|
|
||||||
function getUserRole($username) {
|
|
||||||
global $usersFile;
|
|
||||||
if (file_exists($usersFile)) {
|
|
||||||
$lines = file($usersFile, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES);
|
|
||||||
foreach ($lines as $line) {
|
|
||||||
$parts = explode(":", trim($line));
|
|
||||||
if (count($parts) >= 3 && $parts[0] === $username) {
|
|
||||||
return trim($parts[2]);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return null;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Determine if TOTP is enabled by checking users.txt.
|
|
||||||
$totp_enabled = false;
|
|
||||||
$username = $_SESSION['username'] ?? '';
|
|
||||||
if ($username) {
|
|
||||||
$lines = file($usersFile, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES);
|
|
||||||
foreach ($lines as $line) {
|
|
||||||
$parts = explode(":", trim($line));
|
|
||||||
// Assuming first field is username and fourth (if exists) is the TOTP secret.
|
|
||||||
if ($parts[0] === $username) {
|
|
||||||
if (isset($parts[3]) && trim($parts[3]) !== "") {
|
|
||||||
$totp_enabled = true;
|
|
||||||
}
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Use getUserRole() to determine admin status.
|
|
||||||
// We cast the role to an integer so that "1" (string) is treated as true.
|
|
||||||
$userRole = getUserRole($username);
|
|
||||||
$isAdmin = ((int)$userRole === 1);
|
|
||||||
|
|
||||||
// Build and return the JSON response.
|
|
||||||
$response = [
|
|
||||||
"authenticated" => true,
|
|
||||||
"isAdmin" => $isAdmin,
|
|
||||||
"totp_enabled" => $totp_enabled,
|
|
||||||
"username" => $username,
|
|
||||||
"folderOnly" => isset($_SESSION["folderOnly"]) ? $_SESSION["folderOnly"] : false
|
|
||||||
];
|
|
||||||
|
|
||||||
echo json_encode($response);
|
|
||||||
?>
|
|
||||||
@@ -17,6 +17,7 @@ header("Permissions-Policy: geolocation=(), microphone=(), camera=()");
|
|||||||
header("X-XSS-Protection: 1; mode=block");
|
header("X-XSS-Protection: 1; mode=block");
|
||||||
|
|
||||||
// Define constants.
|
// Define constants.
|
||||||
|
define('PROJECT_ROOT', dirname(__DIR__));
|
||||||
define('UPLOAD_DIR', '/var/www/uploads/');
|
define('UPLOAD_DIR', '/var/www/uploads/');
|
||||||
define('USERS_DIR', '/var/www/users/');
|
define('USERS_DIR', '/var/www/users/');
|
||||||
define('USERS_FILE', 'users.txt');
|
define('USERS_FILE', 'users.txt');
|
||||||
@@ -116,7 +117,11 @@ $cookieParams = [
|
|||||||
'httponly' => true,
|
'httponly' => true,
|
||||||
'samesite' => 'Lax'
|
'samesite' => 'Lax'
|
||||||
];
|
];
|
||||||
|
// At the very beginning of config.php
|
||||||
|
ini_set('session.save_path', __DIR__ . '/../sessions');
|
||||||
|
if (!is_dir(__DIR__ . '/../sessions')) {
|
||||||
|
mkdir(__DIR__ . '/../sessions', 0777, true);
|
||||||
|
}
|
||||||
if (session_status() === PHP_SESSION_NONE) {
|
if (session_status() === PHP_SESSION_NONE) {
|
||||||
session_set_cookie_params($cookieParams);
|
session_set_cookie_params($cookieParams);
|
||||||
ini_set('session.gc_maxlifetime', 7200);
|
ini_set('session.gc_maxlifetime', 7200);
|
||||||
@@ -160,8 +165,8 @@ define('BASE_URL', 'http://yourwebsite/uploads/');
|
|||||||
if (strpos(BASE_URL, 'yourwebsite') !== false) {
|
if (strpos(BASE_URL, 'yourwebsite') !== false) {
|
||||||
$defaultShareUrl = isset($_SERVER['HTTP_HOST'])
|
$defaultShareUrl = isset($_SERVER['HTTP_HOST'])
|
||||||
? "http://" . $_SERVER['HTTP_HOST'] . "/share.php"
|
? "http://" . $_SERVER['HTTP_HOST'] . "/share.php"
|
||||||
: "http://localhost/share.php";
|
: "http://localhost/public/api/file/share.php";
|
||||||
} else {
|
} else {
|
||||||
$defaultShareUrl = rtrim(BASE_URL, '/') . "/share.php";
|
$defaultShareUrl = rtrim(BASE_URL, '/') . "api/file/share.php";
|
||||||
}
|
}
|
||||||
define('SHARE_URL', getenv('SHARE_URL') ? getenv('SHARE_URL') : $defaultShareUrl);
|
define('SHARE_URL', getenv('SHARE_URL') ? getenv('SHARE_URL') : $defaultShareUrl);
|
||||||
153
copyFiles.php
153
copyFiles.php
@@ -1,153 +0,0 @@
|
|||||||
<?php
|
|
||||||
require_once 'config.php';
|
|
||||||
header('Content-Type: application/json');
|
|
||||||
|
|
||||||
// --- CSRF Protection ---
|
|
||||||
$headers = array_change_key_case(getallheaders(), CASE_LOWER);
|
|
||||||
$receivedToken = isset($headers['x-csrf-token']) ? trim($headers['x-csrf-token']) : '';
|
|
||||||
if ($receivedToken !== $_SESSION['csrf_token']) {
|
|
||||||
echo json_encode(["error" => "Invalid CSRF token"]);
|
|
||||||
http_response_code(403);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Ensure user is authenticated
|
|
||||||
if (!isset($_SESSION['authenticated']) || $_SESSION['authenticated'] !== true) {
|
|
||||||
echo json_encode(["error" => "Unauthorized"]);
|
|
||||||
http_response_code(401);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
$username = $_SESSION['username'] ?? '';
|
|
||||||
$userPermissions = loadUserPermissions($username);
|
|
||||||
if ($username) {
|
|
||||||
$userPermissions = loadUserPermissions($username);
|
|
||||||
if (isset($userPermissions['readOnly']) && $userPermissions['readOnly'] === true) {
|
|
||||||
echo json_encode(["error" => "Read-only users are not allowed to copy files."]);
|
|
||||||
exit();
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
$data = json_decode(file_get_contents("php://input"), true);
|
|
||||||
if (
|
|
||||||
!$data ||
|
|
||||||
!isset($data['source']) ||
|
|
||||||
!isset($data['destination']) ||
|
|
||||||
!isset($data['files'])
|
|
||||||
) {
|
|
||||||
echo json_encode(["error" => "Invalid request"]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
$sourceFolder = trim($data['source']);
|
|
||||||
$destinationFolder = trim($data['destination']);
|
|
||||||
$files = $data['files'];
|
|
||||||
|
|
||||||
// Validate folder names: allow letters, numbers, underscores, dashes, spaces, and forward slashes.
|
|
||||||
$folderPattern = REGEX_FOLDER_NAME;
|
|
||||||
if ($sourceFolder !== 'root' && !preg_match($folderPattern, $sourceFolder)) {
|
|
||||||
echo json_encode(["error" => "Invalid source folder name."]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
if ($destinationFolder !== 'root' && !preg_match($folderPattern, $destinationFolder)) {
|
|
||||||
echo json_encode(["error" => "Invalid destination folder name."]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Trim any leading/trailing slashes and spaces.
|
|
||||||
$sourceFolder = trim($sourceFolder, "/\\ ");
|
|
||||||
$destinationFolder = trim($destinationFolder, "/\\ ");
|
|
||||||
|
|
||||||
// Build the source and destination directories.
|
|
||||||
$baseDir = rtrim(UPLOAD_DIR, '/\\');
|
|
||||||
$sourceDir = ($sourceFolder === 'root')
|
|
||||||
? $baseDir . DIRECTORY_SEPARATOR
|
|
||||||
: $baseDir . DIRECTORY_SEPARATOR . $sourceFolder . DIRECTORY_SEPARATOR;
|
|
||||||
$destDir = ($destinationFolder === 'root')
|
|
||||||
? $baseDir . DIRECTORY_SEPARATOR
|
|
||||||
: $baseDir . DIRECTORY_SEPARATOR . $destinationFolder . DIRECTORY_SEPARATOR;
|
|
||||||
|
|
||||||
// Helper: Generate the metadata file path for a given folder.
|
|
||||||
function getMetadataFilePath($folder) {
|
|
||||||
if (strtolower($folder) === 'root' || $folder === '') {
|
|
||||||
return META_DIR . "root_metadata.json";
|
|
||||||
}
|
|
||||||
return META_DIR . str_replace(['/', '\\', ' '], '-', $folder) . '_metadata.json';
|
|
||||||
}
|
|
||||||
|
|
||||||
// Helper: Generate a unique file name if a file with the same name exists.
|
|
||||||
function getUniqueFileName($destDir, $fileName) {
|
|
||||||
$fullPath = $destDir . $fileName;
|
|
||||||
clearstatcache(true, $fullPath);
|
|
||||||
if (!file_exists($fullPath)) {
|
|
||||||
return $fileName;
|
|
||||||
}
|
|
||||||
$basename = pathinfo($fileName, PATHINFO_FILENAME);
|
|
||||||
$extension = pathinfo($fileName, PATHINFO_EXTENSION);
|
|
||||||
$counter = 1;
|
|
||||||
do {
|
|
||||||
$newName = $basename . " (" . $counter . ")" . ($extension ? "." . $extension : "");
|
|
||||||
$newFullPath = $destDir . $newName;
|
|
||||||
clearstatcache(true, $newFullPath);
|
|
||||||
$counter++;
|
|
||||||
} while (file_exists($destDir . $newName));
|
|
||||||
return $newName;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Load source and destination metadata.
|
|
||||||
$srcMetaFile = getMetadataFilePath($sourceFolder);
|
|
||||||
$destMetaFile = getMetadataFilePath($destinationFolder);
|
|
||||||
|
|
||||||
$srcMetadata = file_exists($srcMetaFile) ? json_decode(file_get_contents($srcMetaFile), true) : [];
|
|
||||||
$destMetadata = file_exists($destMetaFile) ? json_decode(file_get_contents($destMetaFile), true) : [];
|
|
||||||
|
|
||||||
$errors = [];
|
|
||||||
|
|
||||||
// Define a safe file name pattern: letters, numbers, underscores, dashes, dots, parentheses, and spaces.
|
|
||||||
$safeFileNamePattern = REGEX_FILE_NAME;
|
|
||||||
|
|
||||||
foreach ($files as $fileName) {
|
|
||||||
// Save the original name for metadata lookup.
|
|
||||||
$originalName = basename(trim($fileName));
|
|
||||||
$basename = $originalName;
|
|
||||||
if (!preg_match($safeFileNamePattern, $basename)) {
|
|
||||||
$errors[] = "$basename has an invalid name.";
|
|
||||||
continue;
|
|
||||||
}
|
|
||||||
|
|
||||||
$srcPath = $sourceDir . $originalName;
|
|
||||||
$destPath = $destDir . $basename;
|
|
||||||
|
|
||||||
clearstatcache();
|
|
||||||
if (!file_exists($srcPath)) {
|
|
||||||
$errors[] = "$originalName does not exist in source.";
|
|
||||||
continue;
|
|
||||||
}
|
|
||||||
|
|
||||||
if (file_exists($destPath)) {
|
|
||||||
$uniqueName = getUniqueFileName($destDir, $basename);
|
|
||||||
$basename = $uniqueName; // update the file name for metadata and destination path
|
|
||||||
$destPath = $destDir . $uniqueName;
|
|
||||||
}
|
|
||||||
|
|
||||||
if (!copy($srcPath, $destPath)) {
|
|
||||||
$errors[] = "Failed to copy $basename";
|
|
||||||
continue;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Update destination metadata: if there's metadata for the original file in source, add it under the new name.
|
|
||||||
if (isset($srcMetadata[$originalName])) {
|
|
||||||
$destMetadata[$basename] = $srcMetadata[$originalName];
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
if (file_put_contents($destMetaFile, json_encode($destMetadata, JSON_PRETTY_PRINT)) === false) {
|
|
||||||
$errors[] = "Failed to update destination metadata.";
|
|
||||||
}
|
|
||||||
|
|
||||||
if (empty($errors)) {
|
|
||||||
echo json_encode(["success" => "Files copied successfully"]);
|
|
||||||
} else {
|
|
||||||
echo json_encode(["error" => implode("; ", $errors)]);
|
|
||||||
}
|
|
||||||
?>
|
|
||||||
@@ -1,96 +0,0 @@
|
|||||||
<?php
|
|
||||||
require_once 'config.php';
|
|
||||||
header('Content-Type: application/json');
|
|
||||||
|
|
||||||
// Ensure user is authenticated
|
|
||||||
if (!isset($_SESSION['authenticated']) || $_SESSION['authenticated'] !== true) {
|
|
||||||
echo json_encode(["error" => "Unauthorized"]);
|
|
||||||
http_response_code(401);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Ensure the request is a POST
|
|
||||||
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
|
|
||||||
echo json_encode(['success' => false, 'error' => 'Invalid request method.']);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
$headers = array_change_key_case(getallheaders(), CASE_LOWER);
|
|
||||||
$receivedToken = isset($headers['x-csrf-token']) ? trim($headers['x-csrf-token']) : '';
|
|
||||||
|
|
||||||
if ($receivedToken !== $_SESSION['csrf_token']) {
|
|
||||||
echo json_encode(['success' => false, 'error' => 'Invalid CSRF token.']);
|
|
||||||
http_response_code(403);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
$username = $_SESSION['username'] ?? '';
|
|
||||||
$userPermissions = loadUserPermissions($username);
|
|
||||||
if ($username) {
|
|
||||||
$userPermissions = loadUserPermissions($username);
|
|
||||||
if (isset($userPermissions['readOnly']) && $userPermissions['readOnly'] === true) {
|
|
||||||
echo json_encode(["error" => "Read-only users are not allowed to create folders."]);
|
|
||||||
exit();
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Get the JSON input and decode it
|
|
||||||
$input = json_decode(file_get_contents('php://input'), true);
|
|
||||||
if (!isset($input['folderName'])) {
|
|
||||||
echo json_encode(['success' => false, 'error' => 'Folder name not provided.']);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
$folderName = trim($input['folderName']);
|
|
||||||
$parent = isset($input['parent']) ? trim($input['parent']) : "";
|
|
||||||
|
|
||||||
// Basic sanitation: allow only letters, numbers, underscores, dashes, and spaces in folderName
|
|
||||||
if (!preg_match(REGEX_FOLDER_NAME, $folderName)) {
|
|
||||||
echo json_encode(['success' => false, 'error' => 'Invalid folder name.']);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Optionally, sanitize the parent folder if needed.
|
|
||||||
if ($parent && !preg_match(REGEX_FOLDER_NAME, $parent)) {
|
|
||||||
echo json_encode(['success' => false, 'error' => 'Invalid parent folder name.']);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Build the full folder path.
|
|
||||||
$baseDir = rtrim(UPLOAD_DIR, '/\\');
|
|
||||||
if ($parent && strtolower($parent) !== "root") {
|
|
||||||
$fullPath = $baseDir . DIRECTORY_SEPARATOR . $parent . DIRECTORY_SEPARATOR . $folderName;
|
|
||||||
$relativePath = $parent . "/" . $folderName;
|
|
||||||
} else {
|
|
||||||
$fullPath = $baseDir . DIRECTORY_SEPARATOR . $folderName;
|
|
||||||
$relativePath = $folderName;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Check if the folder already exists.
|
|
||||||
if (file_exists($fullPath)) {
|
|
||||||
echo json_encode(['success' => false, 'error' => 'Folder already exists.']);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Attempt to create the folder.
|
|
||||||
if (mkdir($fullPath, 0755, true)) {
|
|
||||||
|
|
||||||
// --- Create an empty metadata file for the new folder ---
|
|
||||||
// Helper: Generate the metadata file path for a given folder.
|
|
||||||
// For "root", returns "root_metadata.json". Otherwise, replaces slashes, backslashes, and spaces with dashes and appends "_metadata.json".
|
|
||||||
function getMetadataFilePath($folder) {
|
|
||||||
if (strtolower($folder) === 'root' || $folder === '') {
|
|
||||||
return META_DIR . "root_metadata.json";
|
|
||||||
}
|
|
||||||
return META_DIR . str_replace(['/', '\\', ' '], '-', $folder) . '_metadata.json';
|
|
||||||
}
|
|
||||||
|
|
||||||
$metadataFile = getMetadataFilePath($relativePath);
|
|
||||||
// Create an empty associative array (i.e. empty metadata) and write to the metadata file.
|
|
||||||
file_put_contents($metadataFile, json_encode([], JSON_PRETTY_PRINT));
|
|
||||||
|
|
||||||
echo json_encode(['success' => true]);
|
|
||||||
} else {
|
|
||||||
echo json_encode(['success' => false, 'error' => 'Failed to create folder.']);
|
|
||||||
}
|
|
||||||
?>
|
|
||||||
@@ -1,94 +0,0 @@
|
|||||||
<?php
|
|
||||||
// createFolderShareLink.php
|
|
||||||
|
|
||||||
require_once 'config.php';
|
|
||||||
|
|
||||||
// Get POST input.
|
|
||||||
$input = json_decode(file_get_contents("php://input"), true);
|
|
||||||
if (!$input) {
|
|
||||||
echo json_encode(["error" => "Invalid input."]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
$username = $_SESSION['username'] ?? '';
|
|
||||||
$userPermissions = loadUserPermissions($username);
|
|
||||||
if ($username) {
|
|
||||||
$userPermissions = loadUserPermissions($username);
|
|
||||||
if (isset($userPermissions['readOnly']) && $userPermissions['readOnly'] === true) {
|
|
||||||
echo json_encode(["error" => "Read-only users are not allowed to create shared folders."]);
|
|
||||||
exit();
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
$folder = isset($input['folder']) ? trim($input['folder']) : "";
|
|
||||||
$expirationMinutes = isset($input['expirationMinutes']) ? intval($input['expirationMinutes']) : 60;
|
|
||||||
$password = isset($input['password']) ? $input['password'] : "";
|
|
||||||
$allowUpload = isset($input['allowUpload']) ? intval($input['allowUpload']) : 0;
|
|
||||||
|
|
||||||
// Validate folder name using regex.
|
|
||||||
// Allow letters, numbers, underscores, hyphens, spaces and slashes.
|
|
||||||
if ($folder !== 'root' && !preg_match(REGEX_FOLDER_NAME, $folder)) {
|
|
||||||
echo json_encode(["error" => "Invalid folder name."]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Generate a secure token.
|
|
||||||
try {
|
|
||||||
$token = bin2hex(random_bytes(16)); // 32 hex characters.
|
|
||||||
} catch (Exception $e) {
|
|
||||||
echo json_encode(["error" => "Could not generate token."]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Calculate expiration time (Unix timestamp).
|
|
||||||
$expires = time() + ($expirationMinutes * 60);
|
|
||||||
|
|
||||||
// Hash password if provided.
|
|
||||||
$hashedPassword = !empty($password) ? password_hash($password, PASSWORD_DEFAULT) : "";
|
|
||||||
|
|
||||||
// Define the file to store share folder links.
|
|
||||||
$shareFile = META_DIR . "share_folder_links.json";
|
|
||||||
$shareLinks = [];
|
|
||||||
if (file_exists($shareFile)) {
|
|
||||||
$data = file_get_contents($shareFile);
|
|
||||||
$shareLinks = json_decode($data, true);
|
|
||||||
if (!is_array($shareLinks)) {
|
|
||||||
$shareLinks = [];
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Clean up expired share links.
|
|
||||||
$currentTime = time();
|
|
||||||
foreach ($shareLinks as $key => $link) {
|
|
||||||
if (isset($link["expires"]) && $link["expires"] < $currentTime) {
|
|
||||||
unset($shareLinks[$key]);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Add the new share record.
|
|
||||||
$shareLinks[$token] = [
|
|
||||||
"folder" => $folder,
|
|
||||||
"expires" => $expires,
|
|
||||||
"password" => $hashedPassword,
|
|
||||||
"allowUpload" => $allowUpload
|
|
||||||
];
|
|
||||||
|
|
||||||
// Save the share links.
|
|
||||||
if (file_put_contents($shareFile, json_encode($shareLinks, JSON_PRETTY_PRINT))) {
|
|
||||||
// Determine base URL.
|
|
||||||
if (defined('BASE_URL') && !empty(BASE_URL) && strpos(BASE_URL, 'yourwebsite') === false) {
|
|
||||||
$baseUrl = rtrim(BASE_URL, '/');
|
|
||||||
} else {
|
|
||||||
// Prefer HTTP_HOST over SERVER_ADDR.
|
|
||||||
$protocol = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') ? "https" : "http";
|
|
||||||
// Use HTTP_HOST if set; fallback to gethostbyname if needed.
|
|
||||||
$host = !empty($_SERVER['HTTP_HOST']) ? $_SERVER['HTTP_HOST'] : gethostbyname($_SERVER['SERVER_ADDR'] ?? 'localhost');
|
|
||||||
$baseUrl = $protocol . "://" . $host;
|
|
||||||
}
|
|
||||||
// The share URL points to shareFolder.php.
|
|
||||||
$link = $baseUrl . "/shareFolder.php?token=" . urlencode($token);
|
|
||||||
echo json_encode(["token" => $token, "expires" => $expires, "link" => $link]);
|
|
||||||
} else {
|
|
||||||
echo json_encode(["error" => "Could not save share link."]);
|
|
||||||
}
|
|
||||||
?>
|
|
||||||
@@ -1,75 +0,0 @@
|
|||||||
<?php
|
|
||||||
// createShareLink.php
|
|
||||||
require_once 'config.php';
|
|
||||||
|
|
||||||
// Get POST input.
|
|
||||||
$input = json_decode(file_get_contents("php://input"), true);
|
|
||||||
if (!$input) {
|
|
||||||
echo json_encode(["error" => "Invalid input."]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
$username = $_SESSION['username'] ?? '';
|
|
||||||
$userPermissions = loadUserPermissions($username);
|
|
||||||
if ($username) {
|
|
||||||
$userPermissions = loadUserPermissions($username);
|
|
||||||
if (isset($userPermissions['readOnly']) && $userPermissions['readOnly'] === true) {
|
|
||||||
echo json_encode(["error" => "Read-only users are not allowed to create share files."]);
|
|
||||||
exit();
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
$folder = isset($input['folder']) ? trim($input['folder']) : "";
|
|
||||||
$file = isset($input['file']) ? basename($input['file']) : "";
|
|
||||||
$expirationMinutes = isset($input['expirationMinutes']) ? intval($input['expirationMinutes']) : 60;
|
|
||||||
$password = isset($input['password']) ? $input['password'] : "";
|
|
||||||
|
|
||||||
// Validate folder using regex.
|
|
||||||
if ($folder !== 'root' && !preg_match(REGEX_FOLDER_NAME, $folder)) {
|
|
||||||
echo json_encode(["error" => "Invalid folder name."]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Generate a secure token.
|
|
||||||
$token = bin2hex(random_bytes(16)); // 32 hex characters.
|
|
||||||
|
|
||||||
// Calculate expiration (Unix timestamp).
|
|
||||||
$expires = time() + ($expirationMinutes * 60);
|
|
||||||
|
|
||||||
// Hash password if provided.
|
|
||||||
$hashedPassword = !empty($password) ? password_hash($password, PASSWORD_DEFAULT) : "";
|
|
||||||
|
|
||||||
// File to store share links.
|
|
||||||
$shareFile = META_DIR . "share_links.json";
|
|
||||||
$shareLinks = [];
|
|
||||||
if (file_exists($shareFile)) {
|
|
||||||
$data = file_get_contents($shareFile);
|
|
||||||
$shareLinks = json_decode($data, true);
|
|
||||||
if (!is_array($shareLinks)) {
|
|
||||||
$shareLinks = [];
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Clean up expired share links.
|
|
||||||
$currentTime = time();
|
|
||||||
foreach ($shareLinks as $key => $link) {
|
|
||||||
if ($link["expires"] < $currentTime) {
|
|
||||||
unset($shareLinks[$key]);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Add record.
|
|
||||||
$shareLinks[$token] = [
|
|
||||||
"folder" => $folder,
|
|
||||||
"file" => $file,
|
|
||||||
"expires" => $expires,
|
|
||||||
"password" => $hashedPassword
|
|
||||||
];
|
|
||||||
|
|
||||||
// Save the share links.
|
|
||||||
if (file_put_contents($shareFile, json_encode($shareLinks, JSON_PRETTY_PRINT))) {
|
|
||||||
echo json_encode(["token" => $token, "expires" => $expires]);
|
|
||||||
} else {
|
|
||||||
echo json_encode(["error" => "Could not save share link."]);
|
|
||||||
}
|
|
||||||
?>
|
|
||||||
161
deleteFiles.php
161
deleteFiles.php
@@ -1,161 +0,0 @@
|
|||||||
<?php
|
|
||||||
require_once 'config.php';
|
|
||||||
header('Content-Type: application/json');
|
|
||||||
|
|
||||||
// --- CSRF Protection ---
|
|
||||||
$headers = array_change_key_case(getallheaders(), CASE_LOWER);
|
|
||||||
$receivedToken = isset($headers['x-csrf-token']) ? trim($headers['x-csrf-token']) : '';
|
|
||||||
|
|
||||||
if ($receivedToken !== $_SESSION['csrf_token']) {
|
|
||||||
echo json_encode(["error" => "Invalid CSRF token"]);
|
|
||||||
http_response_code(403);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Ensure user is authenticated
|
|
||||||
if (!isset($_SESSION['authenticated']) || $_SESSION['authenticated'] !== true) {
|
|
||||||
echo json_encode(["error" => "Unauthorized"]);
|
|
||||||
http_response_code(401);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Define $username first.
|
|
||||||
$username = $_SESSION['username'] ?? '';
|
|
||||||
|
|
||||||
// Now load the user's permissions.
|
|
||||||
$userPermissions = loadUserPermissions($username);
|
|
||||||
|
|
||||||
// Check if the user is read-only.
|
|
||||||
if ($username) {
|
|
||||||
if (isset($userPermissions['readOnly']) && $userPermissions['readOnly'] === true) {
|
|
||||||
echo json_encode(["error" => "Read-only users are not allowed to delete files."]);
|
|
||||||
exit();
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Setup Trash Folder & Metadata ---
|
|
||||||
$trashDir = rtrim(TRASH_DIR, '/\\') . DIRECTORY_SEPARATOR;
|
|
||||||
if (!file_exists($trashDir)) {
|
|
||||||
mkdir($trashDir, 0755, true);
|
|
||||||
}
|
|
||||||
$trashMetadataFile = $trashDir . "trash.json";
|
|
||||||
$trashData = [];
|
|
||||||
if (file_exists($trashMetadataFile)) {
|
|
||||||
$json = file_get_contents($trashMetadataFile);
|
|
||||||
$trashData = json_decode($json, true);
|
|
||||||
if (!is_array($trashData)) {
|
|
||||||
$trashData = [];
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Helper: Generate the metadata file path for a given folder.
|
|
||||||
function getMetadataFilePath($folder) {
|
|
||||||
if (strtolower($folder) === 'root' || $folder === '') {
|
|
||||||
return META_DIR . "root_metadata.json";
|
|
||||||
}
|
|
||||||
return META_DIR . str_replace(['/', '\\', ' '], '-', $folder) . '_metadata.json';
|
|
||||||
}
|
|
||||||
|
|
||||||
// Read request body
|
|
||||||
$data = json_decode(file_get_contents("php://input"), true);
|
|
||||||
|
|
||||||
// Validate request
|
|
||||||
if (!isset($data['files']) || !is_array($data['files'])) {
|
|
||||||
echo json_encode(["error" => "No file names provided"]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Determine folder – default to 'root'
|
|
||||||
$folder = isset($data['folder']) ? trim($data['folder']) : 'root';
|
|
||||||
|
|
||||||
// Validate folder: allow letters, numbers, underscores, dashes, spaces, and forward slashes
|
|
||||||
if ($folder !== 'root' && !preg_match(REGEX_FOLDER_NAME, $folder)) {
|
|
||||||
echo json_encode(["error" => "Invalid folder name."]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
$folder = trim($folder, "/\\ ");
|
|
||||||
|
|
||||||
// Build the upload directory.
|
|
||||||
if ($folder !== 'root') {
|
|
||||||
$uploadDir = rtrim(UPLOAD_DIR, '/\\') . DIRECTORY_SEPARATOR . $folder . DIRECTORY_SEPARATOR;
|
|
||||||
} else {
|
|
||||||
$uploadDir = rtrim(UPLOAD_DIR, '/\\') . DIRECTORY_SEPARATOR;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Load folder metadata (if exists) to retrieve uploader and upload date.
|
|
||||||
$metadataFile = getMetadataFilePath($folder);
|
|
||||||
$folderMetadata = [];
|
|
||||||
if (file_exists($metadataFile)) {
|
|
||||||
$folderMetadata = json_decode(file_get_contents($metadataFile), true);
|
|
||||||
if (!is_array($folderMetadata)) {
|
|
||||||
$folderMetadata = [];
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
$movedFiles = [];
|
|
||||||
$errors = [];
|
|
||||||
|
|
||||||
// Define a safe file name pattern: allow letters, numbers, underscores, dashes, dots, and spaces.
|
|
||||||
$safeFileNamePattern = REGEX_FILE_NAME;
|
|
||||||
|
|
||||||
foreach ($data['files'] as $fileName) {
|
|
||||||
$basename = basename(trim($fileName));
|
|
||||||
|
|
||||||
// Validate the file name.
|
|
||||||
if (!preg_match($safeFileNamePattern, $basename)) {
|
|
||||||
$errors[] = "$basename has an invalid name.";
|
|
||||||
continue;
|
|
||||||
}
|
|
||||||
|
|
||||||
$filePath = $uploadDir . $basename;
|
|
||||||
|
|
||||||
if (file_exists($filePath)) {
|
|
||||||
// Append a timestamp to the file name in trash to avoid collisions.
|
|
||||||
$timestamp = time();
|
|
||||||
$trashFileName = $basename . "_" . $timestamp;
|
|
||||||
if (rename($filePath, $trashDir . $trashFileName)) {
|
|
||||||
$movedFiles[] = $basename;
|
|
||||||
// Record trash metadata for possible restoration.
|
|
||||||
$trashData[] = [
|
|
||||||
'type' => 'file',
|
|
||||||
'originalFolder' => $uploadDir, // You could also store a relative path here.
|
|
||||||
'originalName' => $basename,
|
|
||||||
'trashName' => $trashFileName,
|
|
||||||
'trashedAt' => $timestamp,
|
|
||||||
// Enrich trash record with uploader and upload date from folder metadata (if available)
|
|
||||||
'uploaded' => isset($folderMetadata[$basename]['uploaded']) ? $folderMetadata[$basename]['uploaded'] : "Unknown",
|
|
||||||
'uploader' => isset($folderMetadata[$basename]['uploader']) ? $folderMetadata[$basename]['uploader'] : "Unknown",
|
|
||||||
// NEW: Record the username of the user who deleted the file.
|
|
||||||
'deletedBy' => isset($_SESSION['username']) ? $_SESSION['username'] : "Unknown"
|
|
||||||
];
|
|
||||||
} else {
|
|
||||||
$errors[] = "Failed to move $basename to Trash.";
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
// Consider file already deleted.
|
|
||||||
$movedFiles[] = $basename;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Write back the updated trash metadata.
|
|
||||||
file_put_contents($trashMetadataFile, json_encode($trashData, JSON_PRETTY_PRINT));
|
|
||||||
|
|
||||||
// Update folder-specific metadata file by removing deleted files.
|
|
||||||
if (file_exists($metadataFile)) {
|
|
||||||
$metadata = json_decode(file_get_contents($metadataFile), true);
|
|
||||||
if (is_array($metadata)) {
|
|
||||||
foreach ($movedFiles as $delFile) {
|
|
||||||
if (isset($metadata[$delFile])) {
|
|
||||||
unset($metadata[$delFile]);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
file_put_contents($metadataFile, json_encode($metadata, JSON_PRETTY_PRINT));
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
if (empty($errors)) {
|
|
||||||
echo json_encode(["success" => "Files moved to Trash: " . implode(", ", $movedFiles)]);
|
|
||||||
} else {
|
|
||||||
echo json_encode(["error" => implode("; ", $errors) . ". Files moved to Trash: " . implode(", ", $movedFiles)]);
|
|
||||||
}
|
|
||||||
?>
|
|
||||||
@@ -1,99 +0,0 @@
|
|||||||
<?php
|
|
||||||
require_once 'config.php';
|
|
||||||
header('Content-Type: application/json');
|
|
||||||
|
|
||||||
// Ensure user is authenticated
|
|
||||||
if (!isset($_SESSION['authenticated']) || $_SESSION['authenticated'] !== true) {
|
|
||||||
echo json_encode(["error" => "Unauthorized"]);
|
|
||||||
http_response_code(401);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Ensure the request is a POST
|
|
||||||
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
|
|
||||||
echo json_encode(['success' => false, 'error' => 'Invalid request method.']);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
$headers = array_change_key_case(getallheaders(), CASE_LOWER);
|
|
||||||
$receivedToken = isset($headers['x-csrf-token']) ? trim($headers['x-csrf-token']) : '';
|
|
||||||
|
|
||||||
if ($receivedToken !== $_SESSION['csrf_token']) {
|
|
||||||
echo json_encode(['success' => false, 'error' => 'Invalid CSRF token.']);
|
|
||||||
http_response_code(403);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
$username = $_SESSION['username'] ?? '';
|
|
||||||
$userPermissions = loadUserPermissions($username);
|
|
||||||
if ($username) {
|
|
||||||
$userPermissions = loadUserPermissions($username);
|
|
||||||
if (isset($userPermissions['readOnly']) && $userPermissions['readOnly'] === true) {
|
|
||||||
echo json_encode(["error" => "Read-only users are not allowed to delete folders."]);
|
|
||||||
exit();
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Get the JSON input and decode it
|
|
||||||
$input = json_decode(file_get_contents('php://input'), true);
|
|
||||||
if (!isset($input['folder'])) {
|
|
||||||
echo json_encode(['success' => false, 'error' => 'Folder name not provided.']);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
$folderName = trim($input['folder']);
|
|
||||||
|
|
||||||
// Prevent deletion of root.
|
|
||||||
if ($folderName === 'root') {
|
|
||||||
echo json_encode(['success' => false, 'error' => 'Cannot delete root folder.']);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Allow letters, numbers, underscores, dashes, spaces, and forward slashes.
|
|
||||||
if (!preg_match(REGEX_FOLDER_NAME, $folderName)) {
|
|
||||||
echo json_encode(['success' => false, 'error' => 'Invalid folder name.']);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Build the folder path (supports subfolder paths like "FolderTest/FolderTestSub")
|
|
||||||
$folderPath = rtrim(UPLOAD_DIR, '/\\') . DIRECTORY_SEPARATOR . $folderName;
|
|
||||||
|
|
||||||
// Check if the folder exists and is a directory
|
|
||||||
if (!file_exists($folderPath) || !is_dir($folderPath)) {
|
|
||||||
echo json_encode(['success' => false, 'error' => 'Folder does not exist.']);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Prevent deletion if the folder is not empty
|
|
||||||
if (count(scandir($folderPath)) > 2) {
|
|
||||||
echo json_encode(['success' => false, 'error' => 'Folder is not empty.']);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Helper: Generate the metadata file path for a given folder.
|
|
||||||
* For "root", returns "root_metadata.json". Otherwise, it replaces
|
|
||||||
* slashes, backslashes, and spaces with dashes and appends "_metadata.json".
|
|
||||||
*
|
|
||||||
* @param string $folder The folder's relative path.
|
|
||||||
* @return string The full path to the folder's metadata file.
|
|
||||||
*/
|
|
||||||
function getMetadataFilePath($folder) {
|
|
||||||
if (strtolower($folder) === 'root' || $folder === '') {
|
|
||||||
return META_DIR . "root_metadata.json";
|
|
||||||
}
|
|
||||||
return META_DIR . str_replace(['/', '\\', ' '], '-', $folder) . '_metadata.json';
|
|
||||||
}
|
|
||||||
|
|
||||||
// Attempt to delete the folder.
|
|
||||||
if (rmdir($folderPath)) {
|
|
||||||
// Remove corresponding metadata file if it exists.
|
|
||||||
$metadataFile = getMetadataFilePath($folderName);
|
|
||||||
if (file_exists($metadataFile)) {
|
|
||||||
unlink($metadataFile);
|
|
||||||
}
|
|
||||||
echo json_encode(['success' => true]);
|
|
||||||
} else {
|
|
||||||
echo json_encode(['success' => false, 'error' => 'Failed to delete folder.']);
|
|
||||||
}
|
|
||||||
?>
|
|
||||||
@@ -1,104 +0,0 @@
|
|||||||
<?php
|
|
||||||
require_once 'config.php';
|
|
||||||
header('Content-Type: application/json');
|
|
||||||
|
|
||||||
// --- CSRF Protection ---
|
|
||||||
$headers = array_change_key_case(getallheaders(), CASE_LOWER);
|
|
||||||
$receivedToken = isset($headers['x-csrf-token']) ? trim($headers['x-csrf-token']) : '';
|
|
||||||
|
|
||||||
if ($receivedToken !== $_SESSION['csrf_token']) {
|
|
||||||
echo json_encode(["error" => "Invalid CSRF token"]);
|
|
||||||
http_response_code(403);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Ensure user is authenticated
|
|
||||||
if (!isset($_SESSION['authenticated']) || $_SESSION['authenticated'] !== true) {
|
|
||||||
echo json_encode(["error" => "Unauthorized"]);
|
|
||||||
http_response_code(401);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Setup Trash Folder & Metadata ---
|
|
||||||
$trashDir = rtrim(TRASH_DIR, '/\\') . DIRECTORY_SEPARATOR;
|
|
||||||
if (!file_exists($trashDir)) {
|
|
||||||
mkdir($trashDir, 0755, true);
|
|
||||||
}
|
|
||||||
$trashMetadataFile = $trashDir . "trash.json";
|
|
||||||
|
|
||||||
// Load trash metadata into an associative array keyed by trashName.
|
|
||||||
$trashData = [];
|
|
||||||
if (file_exists($trashMetadataFile)) {
|
|
||||||
$json = file_get_contents($trashMetadataFile);
|
|
||||||
$tempData = json_decode($json, true);
|
|
||||||
if (is_array($tempData)) {
|
|
||||||
foreach ($tempData as $item) {
|
|
||||||
if (isset($item['trashName'])) {
|
|
||||||
$trashData[$item['trashName']] = $item;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Read request body.
|
|
||||||
$data = json_decode(file_get_contents("php://input"), true);
|
|
||||||
if (!$data) {
|
|
||||||
echo json_encode(["error" => "Invalid input"]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Determine deletion mode: if "deleteAll" is true, delete all trash items; otherwise, use provided "files" array.
|
|
||||||
$filesToDelete = [];
|
|
||||||
if (isset($data['deleteAll']) && $data['deleteAll'] === true) {
|
|
||||||
$filesToDelete = array_keys($trashData);
|
|
||||||
} elseif (isset($data['files']) && is_array($data['files'])) {
|
|
||||||
$filesToDelete = $data['files'];
|
|
||||||
} else {
|
|
||||||
echo json_encode(["error" => "No trash file identifiers provided"]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
$deletedFiles = [];
|
|
||||||
$errors = [];
|
|
||||||
|
|
||||||
// Define a safe file name pattern.
|
|
||||||
$safeFileNamePattern = REGEX_FILE_NAME;
|
|
||||||
|
|
||||||
foreach ($filesToDelete as $trashName) {
|
|
||||||
$trashName = trim($trashName);
|
|
||||||
if (!preg_match($safeFileNamePattern, $trashName)) {
|
|
||||||
$errors[] = "$trashName has an invalid format.";
|
|
||||||
continue;
|
|
||||||
}
|
|
||||||
|
|
||||||
if (!isset($trashData[$trashName])) {
|
|
||||||
$errors[] = "Trash item $trashName not found.";
|
|
||||||
continue;
|
|
||||||
}
|
|
||||||
|
|
||||||
$filePath = $trashDir . $trashName;
|
|
||||||
|
|
||||||
if (file_exists($filePath)) {
|
|
||||||
if (unlink($filePath)) {
|
|
||||||
$deletedFiles[] = $trashName;
|
|
||||||
unset($trashData[$trashName]);
|
|
||||||
} else {
|
|
||||||
$errors[] = "Failed to delete $trashName.";
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
// If the file doesn't exist, remove its metadata entry.
|
|
||||||
unset($trashData[$trashName]);
|
|
||||||
$deletedFiles[] = $trashName;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Write the updated trash metadata back (as an indexed array).
|
|
||||||
file_put_contents($trashMetadataFile, json_encode(array_values($trashData), JSON_PRETTY_PRINT));
|
|
||||||
|
|
||||||
if (empty($errors)) {
|
|
||||||
echo json_encode(["success" => "Trash items deleted: " . implode(", ", $deletedFiles)]);
|
|
||||||
} else {
|
|
||||||
echo json_encode(["error" => implode("; ", $errors) . ". Trash items deleted: " . implode(", ", $deletedFiles)]);
|
|
||||||
}
|
|
||||||
exit;
|
|
||||||
?>
|
|
||||||
85
download.php
85
download.php
@@ -1,85 +0,0 @@
|
|||||||
<?php
|
|
||||||
require_once 'config.php';
|
|
||||||
|
|
||||||
// Check if the user is authenticated.
|
|
||||||
if (!isset($_SESSION['authenticated']) || $_SESSION['authenticated'] !== true) {
|
|
||||||
http_response_code(401);
|
|
||||||
header('Content-Type: application/json');
|
|
||||||
echo json_encode(["error" => "Unauthorized"]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Get file parameters from the GET request.
|
|
||||||
$file = isset($_GET['file']) ? basename($_GET['file']) : '';
|
|
||||||
$folder = isset($_GET['folder']) ? trim($_GET['folder']) : 'root';
|
|
||||||
|
|
||||||
// Validate file name (allowing letters, numbers, underscores, dashes, dots, and parentheses)
|
|
||||||
if (!preg_match(REGEX_FILE_NAME, $file)) {
|
|
||||||
http_response_code(400);
|
|
||||||
echo json_encode(["error" => "Invalid file name."]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Get the realpath of the upload directory.
|
|
||||||
$uploadDirReal = realpath(UPLOAD_DIR);
|
|
||||||
if ($uploadDirReal === false) {
|
|
||||||
http_response_code(500);
|
|
||||||
echo json_encode(["error" => "Server misconfiguration."]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Determine the directory.
|
|
||||||
if ($folder === 'root') {
|
|
||||||
$directory = $uploadDirReal;
|
|
||||||
} else {
|
|
||||||
// Prevent path traversal in folder parameter.
|
|
||||||
if (strpos($folder, '..') !== false) {
|
|
||||||
http_response_code(400);
|
|
||||||
echo json_encode(["error" => "Invalid folder name."]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
$directoryPath = rtrim(UPLOAD_DIR, '/\\') . DIRECTORY_SEPARATOR . $folder;
|
|
||||||
$directory = realpath($directoryPath);
|
|
||||||
|
|
||||||
// Ensure that the resolved directory exists and is within the allowed UPLOAD_DIR.
|
|
||||||
if ($directory === false || strpos($directory, $uploadDirReal) !== 0) {
|
|
||||||
http_response_code(400);
|
|
||||||
echo json_encode(["error" => "Invalid folder path."]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Build the file path.
|
|
||||||
$filePath = $directory . DIRECTORY_SEPARATOR . $file;
|
|
||||||
$realFilePath = realpath($filePath);
|
|
||||||
|
|
||||||
// Validate that the real file path exists and is within the allowed directory.
|
|
||||||
if ($realFilePath === false || strpos($realFilePath, $uploadDirReal) !== 0) {
|
|
||||||
http_response_code(403);
|
|
||||||
echo json_encode(["error" => "Access forbidden."]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
if (!file_exists($realFilePath)) {
|
|
||||||
http_response_code(404);
|
|
||||||
echo json_encode(["error" => "File not found."]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Serve the file.
|
|
||||||
$mimeType = mime_content_type($realFilePath);
|
|
||||||
header("Content-Type: " . $mimeType);
|
|
||||||
|
|
||||||
// For images, serve inline; for other types, force download.
|
|
||||||
$ext = strtolower(pathinfo($realFilePath, PATHINFO_EXTENSION));
|
|
||||||
if (in_array($ext, ['jpg','jpeg','png','gif','bmp','webp','svg','ico'])) {
|
|
||||||
header('Content-Disposition: inline; filename="' . basename($realFilePath) . '"');
|
|
||||||
} else {
|
|
||||||
header('Content-Disposition: attachment; filename="' . basename($realFilePath) . '"');
|
|
||||||
}
|
|
||||||
header('Content-Length: ' . filesize($realFilePath));
|
|
||||||
|
|
||||||
readfile($realFilePath);
|
|
||||||
exit;
|
|
||||||
?>
|
|
||||||
@@ -1,85 +0,0 @@
|
|||||||
<?php
|
|
||||||
// downloadSharedFile.php
|
|
||||||
|
|
||||||
require_once 'config.php';
|
|
||||||
|
|
||||||
// Retrieve and sanitize token and file name from GET.
|
|
||||||
$token = filter_input(INPUT_GET, 'token', FILTER_SANITIZE_STRING);
|
|
||||||
$file = filter_input(INPUT_GET, 'file', FILTER_SANITIZE_STRING);
|
|
||||||
|
|
||||||
if (empty($token) || empty($file)) {
|
|
||||||
http_response_code(400);
|
|
||||||
echo "Missing token or file parameter.";
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Load the share folder records.
|
|
||||||
$shareFile = META_DIR . "share_folder_links.json";
|
|
||||||
if (!file_exists($shareFile)) {
|
|
||||||
http_response_code(404);
|
|
||||||
echo "Share link not found.";
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
$shareLinks = json_decode(file_get_contents($shareFile), true);
|
|
||||||
if (!is_array($shareLinks) || !isset($shareLinks[$token])) {
|
|
||||||
http_response_code(404);
|
|
||||||
echo "Share link not found.";
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
$record = $shareLinks[$token];
|
|
||||||
|
|
||||||
// Check if the link has expired.
|
|
||||||
if (time() > $record['expires']) {
|
|
||||||
http_response_code(403);
|
|
||||||
echo "This share link has expired.";
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Get the shared folder from the record.
|
|
||||||
$folder = trim($record['folder'], "/\\ ");
|
|
||||||
$folderPath = rtrim(UPLOAD_DIR, '/\\') . DIRECTORY_SEPARATOR . $folder;
|
|
||||||
$realFolderPath = realpath($folderPath);
|
|
||||||
$uploadDirReal = realpath(UPLOAD_DIR);
|
|
||||||
|
|
||||||
if ($realFolderPath === false || strpos($realFolderPath, $uploadDirReal) !== 0 || !is_dir($realFolderPath)) {
|
|
||||||
http_response_code(404);
|
|
||||||
echo "Shared folder not found.";
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Sanitize the filename to prevent directory traversal.
|
|
||||||
if (strpos($file, "/") !== false || strpos($file, "\\") !== false) {
|
|
||||||
http_response_code(400);
|
|
||||||
echo "Invalid file name.";
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
$file = basename($file);
|
|
||||||
|
|
||||||
// Build the full file path and verify it is inside the shared folder.
|
|
||||||
$filePath = $realFolderPath . DIRECTORY_SEPARATOR . $file;
|
|
||||||
$realFilePath = realpath($filePath);
|
|
||||||
if ($realFilePath === false || strpos($realFilePath, $realFolderPath) !== 0 || !is_file($realFilePath)) {
|
|
||||||
http_response_code(404);
|
|
||||||
echo "File not found.";
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Determine MIME type.
|
|
||||||
$mimeType = mime_content_type($realFilePath);
|
|
||||||
header("Content-Type: " . $mimeType);
|
|
||||||
|
|
||||||
// Set Content-Disposition header.
|
|
||||||
// Inline if the file is an image; attachment for others.
|
|
||||||
$ext = strtolower(pathinfo($realFilePath, PATHINFO_EXTENSION));
|
|
||||||
if (in_array($ext, ['jpg','jpeg','png','gif','bmp','webp','svg','ico'])) {
|
|
||||||
header('Content-Disposition: inline; filename="' . basename($realFilePath) . '"');
|
|
||||||
} else {
|
|
||||||
header('Content-Disposition: attachment; filename="' . basename($realFilePath) . '"');
|
|
||||||
}
|
|
||||||
|
|
||||||
// Read and output the file.
|
|
||||||
readfile($realFilePath);
|
|
||||||
exit;
|
|
||||||
?>
|
|
||||||
133
downloadZip.php
133
downloadZip.php
@@ -1,133 +0,0 @@
|
|||||||
<?php
|
|
||||||
require_once 'config.php';
|
|
||||||
|
|
||||||
// --- CSRF Protection ---
|
|
||||||
$headers = array_change_key_case(getallheaders(), CASE_LOWER);
|
|
||||||
$receivedToken = isset($headers['x-csrf-token']) ? trim($headers['x-csrf-token']) : '';
|
|
||||||
|
|
||||||
if ($receivedToken !== $_SESSION['csrf_token']) {
|
|
||||||
echo json_encode(["error" => "Invalid CSRF token"]);
|
|
||||||
http_response_code(403);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Check if the user is authenticated.
|
|
||||||
if (!isset($_SESSION['authenticated']) || $_SESSION['authenticated'] !== true) {
|
|
||||||
http_response_code(401);
|
|
||||||
header('Content-Type: application/json');
|
|
||||||
echo json_encode(["error" => "Unauthorized"]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Read and decode the JSON input.
|
|
||||||
$rawData = file_get_contents("php://input");
|
|
||||||
$data = json_decode($rawData, true);
|
|
||||||
|
|
||||||
if (!is_array($data) || !isset($data['folder']) || !isset($data['files']) || !is_array($data['files'])) {
|
|
||||||
http_response_code(400);
|
|
||||||
header('Content-Type: application/json');
|
|
||||||
echo json_encode(["error" => "Invalid input."]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
$folder = $data['folder'];
|
|
||||||
$files = $data['files'];
|
|
||||||
|
|
||||||
// Validate folder name to allow subfolders.
|
|
||||||
// "root" is allowed; otherwise, split by "/" and validate each segment.
|
|
||||||
if ($folder !== "root") {
|
|
||||||
$parts = explode('/', $folder);
|
|
||||||
foreach ($parts as $part) {
|
|
||||||
if (empty($part) || $part === '.' || $part === '..' || !preg_match(REGEX_FOLDER_NAME, $part)) {
|
|
||||||
http_response_code(400);
|
|
||||||
header('Content-Type: application/json');
|
|
||||||
echo json_encode(["error" => "Invalid folder name."]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
$relativePath = implode(DIRECTORY_SEPARATOR, $parts) . DIRECTORY_SEPARATOR;
|
|
||||||
} else {
|
|
||||||
$relativePath = "";
|
|
||||||
}
|
|
||||||
|
|
||||||
// Use the absolute UPLOAD_DIR from config.php.
|
|
||||||
$baseDir = realpath(UPLOAD_DIR);
|
|
||||||
if ($baseDir === false) {
|
|
||||||
http_response_code(500);
|
|
||||||
header('Content-Type: application/json');
|
|
||||||
echo json_encode(["error" => "Uploads directory not configured correctly."]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
$folderPath = $baseDir . DIRECTORY_SEPARATOR . $relativePath;
|
|
||||||
$folderPathReal = realpath($folderPath);
|
|
||||||
if ($folderPathReal === false || strpos($folderPathReal, $baseDir) !== 0) {
|
|
||||||
http_response_code(404);
|
|
||||||
header('Content-Type: application/json');
|
|
||||||
echo json_encode(["error" => "Folder not found."]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
if (empty($files)) {
|
|
||||||
http_response_code(400);
|
|
||||||
header('Content-Type: application/json');
|
|
||||||
echo json_encode(["error" => "No files specified."]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
foreach ($files as $fileName) {
|
|
||||||
if (!preg_match(REGEX_FILE_NAME, $fileName)) {
|
|
||||||
http_response_code(400);
|
|
||||||
header('Content-Type: application/json');
|
|
||||||
echo json_encode(["error" => "Invalid file name: " . $fileName]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Build an array of files to include in the ZIP.
|
|
||||||
$filesToZip = [];
|
|
||||||
foreach ($files as $fileName) {
|
|
||||||
$filePath = $folderPathReal . DIRECTORY_SEPARATOR . $fileName;
|
|
||||||
if (file_exists($filePath)) {
|
|
||||||
$filesToZip[] = $filePath;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
if (empty($filesToZip)) {
|
|
||||||
http_response_code(400);
|
|
||||||
header('Content-Type: application/json');
|
|
||||||
echo json_encode(["error" => "No valid files found to zip."]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Create a temporary file for the ZIP archive.
|
|
||||||
$tempZip = tempnam(sys_get_temp_dir(), 'zip');
|
|
||||||
unlink($tempZip); // Remove the temporary file so ZipArchive can create a new one.
|
|
||||||
$tempZip .= '.zip';
|
|
||||||
|
|
||||||
$zip = new ZipArchive();
|
|
||||||
if ($zip->open($tempZip, ZipArchive::CREATE) !== TRUE) {
|
|
||||||
http_response_code(500);
|
|
||||||
header('Content-Type: application/json');
|
|
||||||
echo json_encode(["error" => "Could not create zip archive."]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Add each file to the archive using its base name.
|
|
||||||
foreach ($filesToZip as $filePath) {
|
|
||||||
$zip->addFile($filePath, basename($filePath));
|
|
||||||
}
|
|
||||||
$zip->close();
|
|
||||||
|
|
||||||
// Send headers to force download and disable caching.
|
|
||||||
header('Content-Type: application/zip');
|
|
||||||
header('Content-Disposition: attachment; filename="files.zip"');
|
|
||||||
header('Content-Length: ' . filesize($tempZip));
|
|
||||||
header('Cache-Control: no-store, no-cache, must-revalidate');
|
|
||||||
header('Pragma: no-cache');
|
|
||||||
|
|
||||||
// Output the file and delete it afterward.
|
|
||||||
readfile($tempZip);
|
|
||||||
unlink($tempZip);
|
|
||||||
exit;
|
|
||||||
?>
|
|
||||||
165
extractZip.php
165
extractZip.php
@@ -1,165 +0,0 @@
|
|||||||
<?php
|
|
||||||
require_once 'config.php';
|
|
||||||
header('Content-Type: application/json');
|
|
||||||
|
|
||||||
// --- CSRF Protection ---
|
|
||||||
$headers = array_change_key_case(getallheaders(), CASE_LOWER);
|
|
||||||
$receivedToken = isset($headers['x-csrf-token']) ? trim($headers['x-csrf-token']) : '';
|
|
||||||
if ($receivedToken !== $_SESSION['csrf_token']) {
|
|
||||||
http_response_code(403);
|
|
||||||
echo json_encode(["error" => "Invalid CSRF token"]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Ensure user is authenticated.
|
|
||||||
if (!isset($_SESSION['authenticated']) || $_SESSION['authenticated'] !== true) {
|
|
||||||
http_response_code(401);
|
|
||||||
echo json_encode(["error" => "Unauthorized"]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
$username = $_SESSION['username'] ?? '';
|
|
||||||
$userPermissions = loadUserPermissions($username);
|
|
||||||
if ($username) {
|
|
||||||
$userPermissions = loadUserPermissions($username);
|
|
||||||
if (isset($userPermissions['readOnly']) && $userPermissions['readOnly'] === true) {
|
|
||||||
echo json_encode(["error" => "Read-only users are not allowed to extract zip files"]);
|
|
||||||
exit();
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Read and decode the JSON input.
|
|
||||||
$rawData = file_get_contents("php://input");
|
|
||||||
$data = json_decode($rawData, true);
|
|
||||||
if (!is_array($data) || !isset($data['folder']) || !isset($data['files']) || !is_array($data['files'])) {
|
|
||||||
http_response_code(400);
|
|
||||||
echo json_encode(["error" => "Invalid input."]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
$folder = $data['folder'];
|
|
||||||
$files = $data['files'];
|
|
||||||
|
|
||||||
if (empty($files)) {
|
|
||||||
http_response_code(400);
|
|
||||||
echo json_encode(["error" => "No files specified."]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Validate folder name (allow "root" or valid subfolder names).
|
|
||||||
if ($folder !== "root") {
|
|
||||||
$parts = explode('/', $folder);
|
|
||||||
foreach ($parts as $part) {
|
|
||||||
if (empty($part) || $part === '.' || $part === '..' || !preg_match(REGEX_FOLDER_NAME, $part)) {
|
|
||||||
http_response_code(400);
|
|
||||||
echo json_encode(["error" => "Invalid folder name."]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
$relativePath = implode(DIRECTORY_SEPARATOR, $parts) . DIRECTORY_SEPARATOR;
|
|
||||||
} else {
|
|
||||||
$relativePath = "";
|
|
||||||
}
|
|
||||||
|
|
||||||
$baseDir = realpath(UPLOAD_DIR);
|
|
||||||
if ($baseDir === false) {
|
|
||||||
http_response_code(500);
|
|
||||||
echo json_encode(["error" => "Uploads directory not configured correctly."]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
$folderPath = $baseDir . DIRECTORY_SEPARATOR . $relativePath;
|
|
||||||
$folderPathReal = realpath($folderPath);
|
|
||||||
if ($folderPathReal === false || strpos($folderPathReal, $baseDir) !== 0) {
|
|
||||||
http_response_code(404);
|
|
||||||
echo json_encode(["error" => "Folder not found."]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// ---------- Metadata Setup ----------
|
|
||||||
function getMetadataFilePath($folder) {
|
|
||||||
if (strtolower($folder) === 'root' || $folder === '') {
|
|
||||||
return META_DIR . "root_metadata.json";
|
|
||||||
}
|
|
||||||
return META_DIR . str_replace(['/', '\\', ' '], '-', $folder) . '_metadata.json';
|
|
||||||
}
|
|
||||||
|
|
||||||
$srcMetaFile = getMetadataFilePath($folder);
|
|
||||||
$destMetaFile = getMetadataFilePath($folder);
|
|
||||||
$srcMetadata = file_exists($srcMetaFile) ? json_decode(file_get_contents($srcMetaFile), true) : [];
|
|
||||||
$destMetadata = file_exists($destMetaFile) ? json_decode(file_get_contents($destMetaFile), true) : [];
|
|
||||||
|
|
||||||
$errors = [];
|
|
||||||
$allSuccess = true;
|
|
||||||
$extractedFiles = array(); // Array to collect names of extracted files
|
|
||||||
$safeFileNamePattern = REGEX_FILE_NAME;
|
|
||||||
|
|
||||||
// ---------- Process Each File ----------
|
|
||||||
foreach ($files as $zipFileName) {
|
|
||||||
$originalName = basename(trim($zipFileName));
|
|
||||||
// Process only .zip files.
|
|
||||||
if (strtolower(substr($originalName, -4)) !== '.zip') {
|
|
||||||
continue;
|
|
||||||
}
|
|
||||||
if (!preg_match($safeFileNamePattern, $originalName)) {
|
|
||||||
$errors[] = "$originalName has an invalid name.";
|
|
||||||
$allSuccess = false;
|
|
||||||
continue;
|
|
||||||
}
|
|
||||||
|
|
||||||
$zipFilePath = $folderPathReal . DIRECTORY_SEPARATOR . $originalName;
|
|
||||||
if (!file_exists($zipFilePath)) {
|
|
||||||
$errors[] = "$originalName does not exist in folder.";
|
|
||||||
$allSuccess = false;
|
|
||||||
continue;
|
|
||||||
}
|
|
||||||
|
|
||||||
$zip = new ZipArchive();
|
|
||||||
if ($zip->open($zipFilePath) !== TRUE) {
|
|
||||||
$errors[] = "Could not open $originalName as a zip file.";
|
|
||||||
$allSuccess = false;
|
|
||||||
continue;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Attempt extraction.
|
|
||||||
if (!$zip->extractTo($folderPathReal)) {
|
|
||||||
$errors[] = "Failed to extract $originalName.";
|
|
||||||
$allSuccess = false;
|
|
||||||
} else {
|
|
||||||
// Collect extracted file names from this zip.
|
|
||||||
for ($i = 0; $i < $zip->numFiles; $i++) {
|
|
||||||
$entryName = $zip->getNameIndex($i);
|
|
||||||
$extractedFileName = basename($entryName);
|
|
||||||
if ($extractedFileName) {
|
|
||||||
$extractedFiles[] = $extractedFileName;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
// Update metadata for each extracted file if the zip file has metadata.
|
|
||||||
if (isset($srcMetadata[$originalName])) {
|
|
||||||
$zipMeta = $srcMetadata[$originalName];
|
|
||||||
// Iterate through all entries in the zip.
|
|
||||||
for ($i = 0; $i < $zip->numFiles; $i++) {
|
|
||||||
$entryName = $zip->getNameIndex($i);
|
|
||||||
$extractedFileName = basename($entryName);
|
|
||||||
if ($extractedFileName) {
|
|
||||||
$destMetadata[$extractedFileName] = $zipMeta;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
$zip->close();
|
|
||||||
}
|
|
||||||
|
|
||||||
// Write updated metadata back to the destination metadata file.
|
|
||||||
if (file_put_contents($destMetaFile, json_encode($destMetadata, JSON_PRETTY_PRINT)) === false) {
|
|
||||||
$errors[] = "Failed to update metadata.";
|
|
||||||
$allSuccess = false;
|
|
||||||
}
|
|
||||||
|
|
||||||
if ($allSuccess) {
|
|
||||||
echo json_encode(["success" => true, "extractedFiles" => $extractedFiles]);
|
|
||||||
} else {
|
|
||||||
echo json_encode(["success" => false, "error" => implode(" ", $errors)]);
|
|
||||||
}
|
|
||||||
exit;
|
|
||||||
?>
|
|
||||||
@@ -1,46 +0,0 @@
|
|||||||
<?php
|
|
||||||
require_once 'config.php';
|
|
||||||
header('Content-Type: application/json');
|
|
||||||
|
|
||||||
$configFile = USERS_DIR . 'adminConfig.json';
|
|
||||||
if (file_exists($configFile)) {
|
|
||||||
$encryptedContent = file_get_contents($configFile);
|
|
||||||
$decryptedContent = decryptData($encryptedContent, $encryptionKey);
|
|
||||||
if ($decryptedContent === false) {
|
|
||||||
http_response_code(500);
|
|
||||||
echo json_encode(['error' => 'Failed to decrypt configuration.']);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
// Decode the configuration and ensure required fields are set
|
|
||||||
$config = json_decode($decryptedContent, true);
|
|
||||||
|
|
||||||
// Ensure globalOtpauthUrl is set
|
|
||||||
if (!isset($config['globalOtpauthUrl'])) {
|
|
||||||
$config['globalOtpauthUrl'] = "";
|
|
||||||
}
|
|
||||||
|
|
||||||
// NEW: Ensure header_title is set.
|
|
||||||
if (!isset($config['header_title']) || empty($config['header_title'])) {
|
|
||||||
$config['header_title'] = "FileRise"; // default value
|
|
||||||
}
|
|
||||||
|
|
||||||
echo json_encode($config);
|
|
||||||
} else {
|
|
||||||
// If no config file exists, provide defaults
|
|
||||||
echo json_encode([
|
|
||||||
'header_title' => "FileRise",
|
|
||||||
'oidc' => [
|
|
||||||
'providerUrl' => 'https://your-oidc-provider.com',
|
|
||||||
'clientId' => 'YOUR_CLIENT_ID',
|
|
||||||
'clientSecret' => 'YOUR_CLIENT_SECRET',
|
|
||||||
'redirectUri' => 'https://yourdomain.com/auth.php?oidc=callback'
|
|
||||||
],
|
|
||||||
'loginOptions' => [
|
|
||||||
'disableFormLogin' => false,
|
|
||||||
'disableBasicAuth' => false,
|
|
||||||
'disableOIDCLogin' => false
|
|
||||||
],
|
|
||||||
'globalOtpauthUrl' => ""
|
|
||||||
]);
|
|
||||||
}
|
|
||||||
?>
|
|
||||||
106
getFileList.php
106
getFileList.php
@@ -1,106 +0,0 @@
|
|||||||
<?php
|
|
||||||
require_once 'config.php';
|
|
||||||
header('Content-Type: application/json');
|
|
||||||
|
|
||||||
// Ensure user is authenticated
|
|
||||||
if (!isset($_SESSION['authenticated']) || $_SESSION['authenticated'] !== true) {
|
|
||||||
echo json_encode(["error" => "Unauthorized"]);
|
|
||||||
http_response_code(401);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
$folder = isset($_GET['folder']) ? trim($_GET['folder']) : 'root';
|
|
||||||
// Allow only safe characters in the folder parameter (letters, numbers, underscores, dashes, spaces, and forward slashes).
|
|
||||||
if ($folder !== 'root' && !preg_match(REGEX_FOLDER_NAME, $folder)) {
|
|
||||||
echo json_encode(["error" => "Invalid folder name."]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Determine the directory based on the folder parameter.
|
|
||||||
if ($folder !== 'root') {
|
|
||||||
$directory = rtrim(UPLOAD_DIR, '/\\') . DIRECTORY_SEPARATOR . $folder;
|
|
||||||
} else {
|
|
||||||
$directory = UPLOAD_DIR;
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Helper: Generate the metadata file path for a given folder.
|
|
||||||
*/
|
|
||||||
function getMetadataFilePath($folder) {
|
|
||||||
if (strtolower($folder) === 'root' || $folder === '') {
|
|
||||||
return META_DIR . "root_metadata.json";
|
|
||||||
}
|
|
||||||
return META_DIR . str_replace(['/', '\\', ' '], '-', $folder) . '_metadata.json';
|
|
||||||
}
|
|
||||||
|
|
||||||
$metadataFile = getMetadataFilePath($folder);
|
|
||||||
$metadata = file_exists($metadataFile) ? json_decode(file_get_contents($metadataFile), true) : [];
|
|
||||||
|
|
||||||
if (!is_dir($directory)) {
|
|
||||||
echo json_encode(["error" => "Directory not found."]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
$files = array_values(array_diff(scandir($directory), array('.', '..')));
|
|
||||||
$fileList = [];
|
|
||||||
|
|
||||||
// Define a safe file name pattern: letters, numbers, underscores, dashes, dots, parentheses, and spaces.
|
|
||||||
$safeFileNamePattern = REGEX_FILE_NAME;
|
|
||||||
|
|
||||||
foreach ($files as $file) {
|
|
||||||
// Skip hidden files (those that begin with a dot)
|
|
||||||
if (substr($file, 0, 1) === '.') {
|
|
||||||
continue;
|
|
||||||
}
|
|
||||||
|
|
||||||
$filePath = $directory . DIRECTORY_SEPARATOR . $file;
|
|
||||||
// Only include files (skip directories)
|
|
||||||
if (!is_file($filePath)) continue;
|
|
||||||
|
|
||||||
// Optionally, skip files with unsafe names.
|
|
||||||
if (!preg_match($safeFileNamePattern, $file)) {
|
|
||||||
continue;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Since metadata is stored per folder, the key is simply the file name.
|
|
||||||
$metaKey = $file;
|
|
||||||
$fileDateModified = filemtime($filePath) ? date(DATE_TIME_FORMAT, filemtime($filePath)) : "Unknown";
|
|
||||||
$fileUploadedDate = isset($metadata[$metaKey]["uploaded"]) ? $metadata[$metaKey]["uploaded"] : "Unknown";
|
|
||||||
$fileUploader = isset($metadata[$metaKey]["uploader"]) ? $metadata[$metaKey]["uploader"] : "Unknown";
|
|
||||||
|
|
||||||
$fileSizeBytes = filesize($filePath);
|
|
||||||
if ($fileSizeBytes >= 1073741824) {
|
|
||||||
$fileSizeFormatted = sprintf("%.1f GB", $fileSizeBytes / 1073741824);
|
|
||||||
} elseif ($fileSizeBytes >= 1048576) {
|
|
||||||
$fileSizeFormatted = sprintf("%.1f MB", $fileSizeBytes / 1048576);
|
|
||||||
} elseif ($fileSizeBytes >= 1024) {
|
|
||||||
$fileSizeFormatted = sprintf("%.1f KB", $fileSizeBytes / 1024);
|
|
||||||
} else {
|
|
||||||
$fileSizeFormatted = sprintf("%s bytes", number_format($fileSizeBytes));
|
|
||||||
}
|
|
||||||
|
|
||||||
// Build the basic file entry.
|
|
||||||
$fileEntry = [
|
|
||||||
'name' => $file,
|
|
||||||
'modified' => $fileDateModified,
|
|
||||||
'uploaded' => $fileUploadedDate,
|
|
||||||
'size' => $fileSizeFormatted,
|
|
||||||
'uploader' => $fileUploader,
|
|
||||||
'tags' => isset($metadata[$metaKey]['tags']) ? $metadata[$metaKey]['tags'] : []
|
|
||||||
];
|
|
||||||
|
|
||||||
// Add file content for text-based files.
|
|
||||||
if (preg_match('/\.(txt|html|htm|md|js|css|json|xml|php|py|ini|conf|log)$/i', $file)) {
|
|
||||||
$content = file_get_contents($filePath);
|
|
||||||
$fileEntry['content'] = $content;
|
|
||||||
}
|
|
||||||
|
|
||||||
$fileList[] = $fileEntry;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Load global tags from createdTags.json.
|
|
||||||
$globalTagsFile = META_DIR . "createdTags.json";
|
|
||||||
$globalTags = file_exists($globalTagsFile) ? json_decode(file_get_contents($globalTagsFile), true) : [];
|
|
||||||
|
|
||||||
echo json_encode(["files" => $fileList, "globalTags" => $globalTags]);
|
|
||||||
?>
|
|
||||||
@@ -1,40 +0,0 @@
|
|||||||
<?php
|
|
||||||
declare(strict_types=1);
|
|
||||||
|
|
||||||
// getFileTag.php
|
|
||||||
|
|
||||||
require_once 'config.php';
|
|
||||||
|
|
||||||
// Set security and content headers
|
|
||||||
header('Content-Type: application/json; charset=utf-8');
|
|
||||||
|
|
||||||
$metadataPath = META_DIR . 'createdTags.json';
|
|
||||||
|
|
||||||
// Check if the metadata file exists and is readable
|
|
||||||
if (!file_exists($metadataPath) || !is_readable($metadataPath)) {
|
|
||||||
error_log('Metadata file does not exist or is not readable: ' . $metadataPath);
|
|
||||||
http_response_code(200); // Return empty array with HTTP 200 so the client can handle it gracefully
|
|
||||||
echo json_encode([]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
$data = file_get_contents($metadataPath);
|
|
||||||
if ($data === false) {
|
|
||||||
error_log('Failed to read metadata file: ' . $metadataPath);
|
|
||||||
http_response_code(500);
|
|
||||||
echo json_encode(["error" => "Unable to read metadata file."]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Decode the JSON data to check for validity
|
|
||||||
$jsonData = json_decode($data, true);
|
|
||||||
if (json_last_error() !== JSON_ERROR_NONE) {
|
|
||||||
error_log('Invalid JSON in metadata file: ' . $metadataPath . ' Error: ' . json_last_error_msg());
|
|
||||||
http_response_code(500);
|
|
||||||
echo json_encode(["error" => "Metadata file contains invalid JSON."]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Output the re-encoded JSON to ensure well-formed output
|
|
||||||
echo json_encode($jsonData);
|
|
||||||
exit;
|
|
||||||
@@ -1,97 +0,0 @@
|
|||||||
<?php
|
|
||||||
require_once 'config.php';
|
|
||||||
header('Content-Type: application/json');
|
|
||||||
|
|
||||||
// Ensure user is authenticated
|
|
||||||
if (!isset($_SESSION['authenticated']) || $_SESSION['authenticated'] !== true) {
|
|
||||||
echo json_encode(["error" => "Unauthorized"]);
|
|
||||||
http_response_code(401);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Recursively scan a directory for subfolders.
|
|
||||||
*
|
|
||||||
* @param string $dir The full path to the directory.
|
|
||||||
* @param string $relative The relative path from the base upload directory.
|
|
||||||
* @return array An array of folder paths (relative to the base).
|
|
||||||
*/
|
|
||||||
function getSubfolders($dir, $relative = '') {
|
|
||||||
$folders = [];
|
|
||||||
$items = scandir($dir);
|
|
||||||
// Allow letters, numbers, underscores, dashes, and spaces in folder names.
|
|
||||||
$safeFolderNamePattern = REGEX_FOLDER_NAME;
|
|
||||||
foreach ($items as $item) {
|
|
||||||
if ($item === '.' || $item === '..') continue;
|
|
||||||
if (!preg_match($safeFolderNamePattern, $item)) {
|
|
||||||
continue;
|
|
||||||
}
|
|
||||||
$path = $dir . DIRECTORY_SEPARATOR . $item;
|
|
||||||
if (is_dir($path)) {
|
|
||||||
// Build the relative path.
|
|
||||||
$folderPath = ($relative ? $relative . '/' : '') . $item;
|
|
||||||
$folders[] = $folderPath;
|
|
||||||
// Recursively get subfolders.
|
|
||||||
$subFolders = getSubfolders($path, $folderPath);
|
|
||||||
$folders = array_merge($folders, $subFolders);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return $folders;
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Helper: Generate the metadata file path for a given folder.
|
|
||||||
* For "root", it returns "root_metadata.json"; otherwise, it replaces
|
|
||||||
* slashes, backslashes, and spaces with dashes and appends "_metadata.json".
|
|
||||||
*
|
|
||||||
* @param string $folder The folder's relative path.
|
|
||||||
* @return string The full path to the folder's metadata file.
|
|
||||||
*/
|
|
||||||
function getMetadataFilePath($folder) {
|
|
||||||
if (strtolower($folder) === 'root' || $folder === '') {
|
|
||||||
return META_DIR . "root_metadata.json";
|
|
||||||
}
|
|
||||||
return META_DIR . str_replace(['/', '\\', ' '], '-', $folder) . '_metadata.json';
|
|
||||||
}
|
|
||||||
|
|
||||||
$baseDir = rtrim(UPLOAD_DIR, '/\\');
|
|
||||||
|
|
||||||
// Build an array to hold folder information.
|
|
||||||
$folderInfoList = [];
|
|
||||||
|
|
||||||
// Include "root" as a folder.
|
|
||||||
$rootMetaFile = getMetadataFilePath('root');
|
|
||||||
$rootFileCount = 0;
|
|
||||||
if (file_exists($rootMetaFile)) {
|
|
||||||
$rootMetadata = json_decode(file_get_contents($rootMetaFile), true);
|
|
||||||
$rootFileCount = is_array($rootMetadata) ? count($rootMetadata) : 0;
|
|
||||||
}
|
|
||||||
$folderInfoList[] = [
|
|
||||||
"folder" => "root",
|
|
||||||
"fileCount" => $rootFileCount,
|
|
||||||
"metadataFile" => basename($rootMetaFile)
|
|
||||||
];
|
|
||||||
|
|
||||||
// Scan for subfolders.
|
|
||||||
$subfolders = [];
|
|
||||||
if (is_dir($baseDir)) {
|
|
||||||
$subfolders = getSubfolders($baseDir);
|
|
||||||
}
|
|
||||||
|
|
||||||
// For each subfolder, load its metadata and record file count.
|
|
||||||
foreach ($subfolders as $folder) {
|
|
||||||
$metaFile = getMetadataFilePath($folder);
|
|
||||||
$fileCount = 0;
|
|
||||||
if (file_exists($metaFile)) {
|
|
||||||
$metadata = json_decode(file_get_contents($metaFile), true);
|
|
||||||
$fileCount = is_array($metadata) ? count($metadata) : 0;
|
|
||||||
}
|
|
||||||
$folderInfoList[] = [
|
|
||||||
"folder" => $folder,
|
|
||||||
"fileCount" => $fileCount,
|
|
||||||
"metadataFile" => basename($metaFile)
|
|
||||||
];
|
|
||||||
}
|
|
||||||
|
|
||||||
echo json_encode($folderInfoList);
|
|
||||||
?>
|
|
||||||
@@ -1,68 +0,0 @@
|
|||||||
<?php
|
|
||||||
require_once 'config.php';
|
|
||||||
header('Content-Type: application/json');
|
|
||||||
|
|
||||||
// Ensure user is authenticated.
|
|
||||||
if (!isset($_SESSION['authenticated']) || $_SESSION['authenticated'] !== true) {
|
|
||||||
echo json_encode(["error" => "Unauthorized"]);
|
|
||||||
http_response_code(401);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Define the trash directory and trash metadata file.
|
|
||||||
$trashDir = rtrim(TRASH_DIR, '/\\') . DIRECTORY_SEPARATOR;
|
|
||||||
$trashMetadataFile = $trashDir . "trash.json";
|
|
||||||
|
|
||||||
// Helper: Generate the metadata file path for a given folder.
|
|
||||||
// For "root", returns "root_metadata.json". Otherwise, replaces slashes, backslashes, and spaces with dashes and appends "_metadata.json".
|
|
||||||
function getMetadataFilePath($folder) {
|
|
||||||
if (strtolower($folder) === 'root' || $folder === '') {
|
|
||||||
return META_DIR . "root_metadata.json";
|
|
||||||
}
|
|
||||||
return META_DIR . str_replace(['/', '\\', ' '], '-', $folder) . '_metadata.json';
|
|
||||||
}
|
|
||||||
|
|
||||||
// Read the trash metadata.
|
|
||||||
$trashItems = [];
|
|
||||||
if (file_exists($trashMetadataFile)) {
|
|
||||||
$json = file_get_contents($trashMetadataFile);
|
|
||||||
$trashItems = json_decode($json, true);
|
|
||||||
if (!is_array($trashItems)) {
|
|
||||||
$trashItems = [];
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Enrich each trash record.
|
|
||||||
foreach ($trashItems as &$item) {
|
|
||||||
// Ensure deletedBy is set and not empty.
|
|
||||||
if (empty($item['deletedBy'])) {
|
|
||||||
$item['deletedBy'] = "Unknown";
|
|
||||||
}
|
|
||||||
// Enrich with uploader and uploaded date if not already present.
|
|
||||||
if (empty($item['uploaded']) || empty($item['uploader'])) {
|
|
||||||
if (isset($item['originalFolder']) && isset($item['originalName'])) {
|
|
||||||
$metadataFile = getMetadataFilePath($item['originalFolder']);
|
|
||||||
if (file_exists($metadataFile)) {
|
|
||||||
$metadata = json_decode(file_get_contents($metadataFile), true);
|
|
||||||
if (is_array($metadata) && isset($metadata[$item['originalName']])) {
|
|
||||||
$item['uploaded'] = !empty($metadata[$item['originalName']]['uploaded']) ? $metadata[$item['originalName']]['uploaded'] : "Unknown";
|
|
||||||
$item['uploader'] = !empty($metadata[$item['originalName']]['uploader']) ? $metadata[$item['originalName']]['uploader'] : "Unknown";
|
|
||||||
} else {
|
|
||||||
$item['uploaded'] = "Unknown";
|
|
||||||
$item['uploader'] = "Unknown";
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
$item['uploaded'] = "Unknown";
|
|
||||||
$item['uploader'] = "Unknown";
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
$item['uploaded'] = "Unknown";
|
|
||||||
$item['uploader'] = "Unknown";
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
unset($item);
|
|
||||||
|
|
||||||
echo json_encode($trashItems);
|
|
||||||
exit;
|
|
||||||
?>
|
|
||||||
@@ -1,47 +0,0 @@
|
|||||||
<?php
|
|
||||||
require_once 'config.php';
|
|
||||||
header('Content-Type: application/json');
|
|
||||||
|
|
||||||
// Check if the user is authenticated.
|
|
||||||
if (!isset($_SESSION['authenticated']) || $_SESSION['authenticated'] !== true) {
|
|
||||||
echo json_encode(["error" => "Unauthorized"]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
$permissionsFile = USERS_DIR . "userPermissions.json";
|
|
||||||
$permissionsArray = [];
|
|
||||||
|
|
||||||
// Load permissions file if it exists.
|
|
||||||
if (file_exists($permissionsFile)) {
|
|
||||||
$content = file_get_contents($permissionsFile);
|
|
||||||
// Attempt to decrypt the content.
|
|
||||||
$decryptedContent = decryptData($content, $encryptionKey);
|
|
||||||
if ($decryptedContent === false) {
|
|
||||||
// If decryption fails, assume the file is plain JSON.
|
|
||||||
$permissionsArray = json_decode($content, true);
|
|
||||||
} else {
|
|
||||||
$permissionsArray = json_decode($decryptedContent, true);
|
|
||||||
}
|
|
||||||
if (!is_array($permissionsArray)) {
|
|
||||||
$permissionsArray = [];
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// If the user is an admin, return all permissions.
|
|
||||||
if (isset($_SESSION['isAdmin']) && $_SESSION['isAdmin'] === true) {
|
|
||||||
echo json_encode($permissionsArray);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Otherwise, return only the current user's permissions.
|
|
||||||
$username = $_SESSION['username'] ?? '';
|
|
||||||
foreach ($permissionsArray as $storedUsername => $data) {
|
|
||||||
if (strcasecmp($storedUsername, $username) === 0) {
|
|
||||||
echo json_encode($data);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// If no permissions are found for the current user, return an empty object.
|
|
||||||
echo json_encode(new stdClass());
|
|
||||||
?>
|
|
||||||
31
getUsers.php
31
getUsers.php
@@ -1,31 +0,0 @@
|
|||||||
<?php
|
|
||||||
require_once 'config.php';
|
|
||||||
header('Content-Type: application/json');
|
|
||||||
|
|
||||||
if (!isset($_SESSION['authenticated']) || $_SESSION['authenticated'] !== true ||
|
|
||||||
!isset($_SESSION['isAdmin']) || $_SESSION['isAdmin'] !== true) {
|
|
||||||
echo json_encode(["error" => "Unauthorized"]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
$usersFile = USERS_DIR . USERS_FILE;
|
|
||||||
$users = [];
|
|
||||||
|
|
||||||
if (file_exists($usersFile)) {
|
|
||||||
$lines = file($usersFile, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES);
|
|
||||||
foreach ($lines as $line) {
|
|
||||||
$parts = explode(':', trim($line));
|
|
||||||
if (count($parts) >= 3) {
|
|
||||||
// Validate username format:
|
|
||||||
if (preg_match(REGEX_USER, $parts[0])) {
|
|
||||||
$users[] = [
|
|
||||||
"username" => $parts[0],
|
|
||||||
"role" => trim($parts[2])
|
|
||||||
];
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
echo json_encode($users);
|
|
||||||
?>
|
|
||||||
120
login_basic.php
120
login_basic.php
@@ -1,120 +0,0 @@
|
|||||||
<?php
|
|
||||||
require_once 'config.php';
|
|
||||||
|
|
||||||
$usersFile = USERS_DIR . USERS_FILE; // Make sure the users file path is defined
|
|
||||||
|
|
||||||
// Helper: retrieve a user's TOTP secret from users.txt
|
|
||||||
function getUserTOTPSecret($username) {
|
|
||||||
global $encryptionKey, $usersFile;
|
|
||||||
if (!file_exists($usersFile)) return null;
|
|
||||||
foreach (file($usersFile, FILE_IGNORE_NEW_LINES|FILE_SKIP_EMPTY_LINES) as $line) {
|
|
||||||
$parts = explode(':', trim($line));
|
|
||||||
if (count($parts) >= 4 && $parts[0] === $username && !empty($parts[3])) {
|
|
||||||
return decryptData($parts[3], $encryptionKey);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return null;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Reuse the same authentication function
|
|
||||||
function authenticate($username, $password)
|
|
||||||
{
|
|
||||||
global $usersFile;
|
|
||||||
if (!file_exists($usersFile)) {
|
|
||||||
error_log("authenticate(): users file not found");
|
|
||||||
return false;
|
|
||||||
}
|
|
||||||
$lines = file($usersFile, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES);
|
|
||||||
foreach ($lines as $line) {
|
|
||||||
list($storedUser, $storedPass, $storedRole) = explode(':', trim($line), 3);
|
|
||||||
if ($username === $storedUser && password_verify($password, $storedPass)) {
|
|
||||||
return $storedRole; // Return the user's role
|
|
||||||
}
|
|
||||||
}
|
|
||||||
error_log("authenticate(): authentication failed for '$username'");
|
|
||||||
return false;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Define helper function to get a user's role from users.txt
|
|
||||||
function getUserRole($username) {
|
|
||||||
global $usersFile;
|
|
||||||
if (file_exists($usersFile)) {
|
|
||||||
$lines = file($usersFile, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES);
|
|
||||||
foreach ($lines as $line) {
|
|
||||||
$parts = explode(":", trim($line));
|
|
||||||
if (count($parts) >= 3 && $parts[0] === $username) {
|
|
||||||
return trim($parts[2]);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return null;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Add the loadFolderPermission function here:
|
|
||||||
function loadFolderPermission($username) {
|
|
||||||
global $encryptionKey;
|
|
||||||
$permissionsFile = USERS_DIR . 'userPermissions.json';
|
|
||||||
if (file_exists($permissionsFile)) {
|
|
||||||
$content = file_get_contents($permissionsFile);
|
|
||||||
$decrypted = decryptData($content, $encryptionKey);
|
|
||||||
$permissions = $decrypted !== false ? json_decode($decrypted, true) : json_decode($content, true);
|
|
||||||
if (is_array($permissions)) {
|
|
||||||
foreach ($permissions as $storedUsername => $data) {
|
|
||||||
if (strcasecmp($storedUsername, $username) === 0 && isset($data['folderOnly'])) {
|
|
||||||
return (bool)$data['folderOnly'];
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return false;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Check if the user has sent HTTP Basic auth credentials.
|
|
||||||
if (!isset($_SERVER['PHP_AUTH_USER'])) {
|
|
||||||
header('WWW-Authenticate: Basic realm="FileRise Login"');
|
|
||||||
header('HTTP/1.0 401 Unauthorized');
|
|
||||||
echo 'Authorization Required';
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
$username = trim($_SERVER['PHP_AUTH_USER']);
|
|
||||||
$password = trim($_SERVER['PHP_AUTH_PW']);
|
|
||||||
|
|
||||||
// Validate username format (optional)
|
|
||||||
if (!preg_match(REGEX_USER, $username)) {
|
|
||||||
header('WWW-Authenticate: Basic realm="FileRise Login"');
|
|
||||||
header('HTTP/1.0 401 Unauthorized');
|
|
||||||
echo 'Invalid username format';
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Attempt authentication
|
|
||||||
$roleFromAuth = authenticate($username, $password);
|
|
||||||
if ($roleFromAuth !== false) {
|
|
||||||
// --- NEW: check for TOTP secret ---
|
|
||||||
$secret = getUserTOTPSecret($username);
|
|
||||||
if ($secret) {
|
|
||||||
// hold user & secret in session and ask client for TOTP
|
|
||||||
$_SESSION['pending_login_user'] = $username;
|
|
||||||
$_SESSION['pending_login_secret'] = $secret;
|
|
||||||
header("Location: index.html?totp_required=1");
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// no TOTP, proceed as before
|
|
||||||
session_regenerate_id(true);
|
|
||||||
$_SESSION["authenticated"] = true;
|
|
||||||
$_SESSION["username"] = $username;
|
|
||||||
$_SESSION["isAdmin"] = (getUserRole($username) === "1");
|
|
||||||
$_SESSION["folderOnly"] = loadFolderPermission($username);
|
|
||||||
|
|
||||||
header("Location: index.html");
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Invalid credentials; prompt again
|
|
||||||
header('WWW-Authenticate: Basic realm="FileRise Login"');
|
|
||||||
header('HTTP/1.0 401 Unauthorized');
|
|
||||||
echo 'Invalid credentials';
|
|
||||||
exit;
|
|
||||||
?>
|
|
||||||
50
logout.php
50
logout.php
@@ -1,50 +0,0 @@
|
|||||||
<?php
|
|
||||||
require_once 'config.php';
|
|
||||||
|
|
||||||
// Retrieve headers and check CSRF token.
|
|
||||||
$headers = array_change_key_case(getallheaders(), CASE_LOWER);
|
|
||||||
$receivedToken = isset($headers['x-csrf-token']) ? trim($headers['x-csrf-token']) : '';
|
|
||||||
|
|
||||||
// Log CSRF mismatch but proceed with logout.
|
|
||||||
if (isset($_SESSION['csrf_token']) && $receivedToken !== $_SESSION['csrf_token']) {
|
|
||||||
error_log("CSRF token mismatch on logout. Proceeding with logout.");
|
|
||||||
}
|
|
||||||
|
|
||||||
// Remove the remember_me token.
|
|
||||||
if (isset($_COOKIE['remember_me_token'])) {
|
|
||||||
$token = $_COOKIE['remember_me_token'];
|
|
||||||
$persistentTokensFile = USERS_DIR . 'persistent_tokens.json';
|
|
||||||
if (file_exists($persistentTokensFile)) {
|
|
||||||
$encryptedContent = file_get_contents($persistentTokensFile);
|
|
||||||
$decryptedContent = decryptData($encryptedContent, $encryptionKey);
|
|
||||||
$persistentTokens = json_decode($decryptedContent, true);
|
|
||||||
if (is_array($persistentTokens) && isset($persistentTokens[$token])) {
|
|
||||||
unset($persistentTokens[$token]);
|
|
||||||
$newEncryptedContent = encryptData(json_encode($persistentTokens, JSON_PRETTY_PRINT), $encryptionKey);
|
|
||||||
file_put_contents($persistentTokensFile, $newEncryptedContent, LOCK_EX);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
// Clear the cookie.
|
|
||||||
// Ensure $secure is defined; for example:
|
|
||||||
$secure = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off');
|
|
||||||
setcookie('remember_me_token', '', time() - 3600, '/', '', $secure, true);
|
|
||||||
}
|
|
||||||
|
|
||||||
// Clear session data and remove session cookie.
|
|
||||||
$_SESSION = [];
|
|
||||||
|
|
||||||
// Clear the session cookie.
|
|
||||||
if (ini_get("session.use_cookies")) {
|
|
||||||
$params = session_get_cookie_params();
|
|
||||||
setcookie(session_name(), '', time() - 42000,
|
|
||||||
$params["path"], $params["domain"],
|
|
||||||
$params["secure"], $params["httponly"]
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
// Destroy the session.
|
|
||||||
session_destroy();
|
|
||||||
|
|
||||||
header("Location: index.html?logout=1");
|
|
||||||
exit;
|
|
||||||
?>
|
|
||||||
164
moveFiles.php
164
moveFiles.php
@@ -1,164 +0,0 @@
|
|||||||
<?php
|
|
||||||
require_once 'config.php';
|
|
||||||
header('Content-Type: application/json');
|
|
||||||
|
|
||||||
// --- CSRF Protection ---
|
|
||||||
$headers = array_change_key_case(getallheaders(), CASE_LOWER);
|
|
||||||
$receivedToken = isset($headers['x-csrf-token']) ? trim($headers['x-csrf-token']) : '';
|
|
||||||
if ($receivedToken !== $_SESSION['csrf_token']) {
|
|
||||||
echo json_encode(["error" => "Invalid CSRF token"]);
|
|
||||||
http_response_code(403);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Ensure user is authenticated
|
|
||||||
if (!isset($_SESSION['authenticated']) || $_SESSION['authenticated'] !== true) {
|
|
||||||
echo json_encode(["error" => "Unauthorized"]);
|
|
||||||
http_response_code(401);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
$username = $_SESSION['username'] ?? '';
|
|
||||||
$userPermissions = loadUserPermissions($username);
|
|
||||||
if ($username) {
|
|
||||||
$userPermissions = loadUserPermissions($username);
|
|
||||||
if (isset($userPermissions['readOnly']) && $userPermissions['readOnly'] === true) {
|
|
||||||
echo json_encode(["error" => "Read-only users are not allowed to move files."]);
|
|
||||||
exit();
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
$data = json_decode(file_get_contents("php://input"), true);
|
|
||||||
if (
|
|
||||||
!$data ||
|
|
||||||
!isset($data['source']) ||
|
|
||||||
!isset($data['destination']) ||
|
|
||||||
!isset($data['files'])
|
|
||||||
) {
|
|
||||||
echo json_encode(["error" => "Invalid request"]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
$sourceFolder = trim($data['source']) ?: 'root';
|
|
||||||
$destinationFolder = trim($data['destination']) ?: 'root';
|
|
||||||
|
|
||||||
// Allow only letters, numbers, underscores, dashes, spaces, and forward slashes in folder names.
|
|
||||||
$folderPattern = REGEX_FOLDER_NAME;
|
|
||||||
if ($sourceFolder !== 'root' && !preg_match($folderPattern, $sourceFolder)) {
|
|
||||||
echo json_encode(["error" => "Invalid source folder name."]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
if ($destinationFolder !== 'root' && !preg_match($folderPattern, $destinationFolder)) {
|
|
||||||
echo json_encode(["error" => "Invalid destination folder name."]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Remove any leading/trailing slashes.
|
|
||||||
$sourceFolder = trim($sourceFolder, "/\\ ");
|
|
||||||
$destinationFolder = trim($destinationFolder, "/\\ ");
|
|
||||||
|
|
||||||
// Build the source and destination directories.
|
|
||||||
$baseDir = rtrim(UPLOAD_DIR, '/\\');
|
|
||||||
$sourceDir = ($sourceFolder === 'root')
|
|
||||||
? $baseDir . DIRECTORY_SEPARATOR
|
|
||||||
: $baseDir . DIRECTORY_SEPARATOR . $sourceFolder . DIRECTORY_SEPARATOR;
|
|
||||||
$destDir = ($destinationFolder === 'root')
|
|
||||||
? $baseDir . DIRECTORY_SEPARATOR
|
|
||||||
: $baseDir . DIRECTORY_SEPARATOR . $destinationFolder . DIRECTORY_SEPARATOR;
|
|
||||||
|
|
||||||
// Ensure destination directory exists.
|
|
||||||
if (!is_dir($destDir)) {
|
|
||||||
if (!mkdir($destDir, 0775, true)) {
|
|
||||||
echo json_encode(["error" => "Could not create destination folder"]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Helper: Generate the metadata file path for a given folder.
|
|
||||||
function getMetadataFilePath($folder) {
|
|
||||||
if (strtolower($folder) === 'root' || $folder === '') {
|
|
||||||
return META_DIR . "root_metadata.json";
|
|
||||||
}
|
|
||||||
return META_DIR . str_replace(['/', '\\', ' '], '-', $folder) . '_metadata.json';
|
|
||||||
}
|
|
||||||
|
|
||||||
// Helper: Generate a unique file name if a file with the same name exists.
|
|
||||||
function getUniqueFileName($destDir, $fileName) {
|
|
||||||
$fullPath = $destDir . $fileName;
|
|
||||||
clearstatcache(true, $fullPath);
|
|
||||||
if (!file_exists($fullPath)) {
|
|
||||||
return $fileName;
|
|
||||||
}
|
|
||||||
$basename = pathinfo($fileName, PATHINFO_FILENAME);
|
|
||||||
$extension = pathinfo($fileName, PATHINFO_EXTENSION);
|
|
||||||
$counter = 1;
|
|
||||||
do {
|
|
||||||
$newName = $basename . " (" . $counter . ")" . ($extension ? "." . $extension : "");
|
|
||||||
$newFullPath = $destDir . $newName;
|
|
||||||
clearstatcache(true, $newFullPath);
|
|
||||||
$counter++;
|
|
||||||
} while (file_exists($destDir . $newName));
|
|
||||||
return $newName;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Prepare metadata files.
|
|
||||||
$srcMetaFile = getMetadataFilePath($sourceFolder);
|
|
||||||
$destMetaFile = getMetadataFilePath($destinationFolder);
|
|
||||||
|
|
||||||
$srcMetadata = file_exists($srcMetaFile) ? json_decode(file_get_contents($srcMetaFile), true) : [];
|
|
||||||
$destMetadata = file_exists($destMetaFile) ? json_decode(file_get_contents($destMetaFile), true) : [];
|
|
||||||
|
|
||||||
$errors = [];
|
|
||||||
$safeFileNamePattern = REGEX_FILE_NAME;
|
|
||||||
|
|
||||||
foreach ($data['files'] as $fileName) {
|
|
||||||
// Save the original name for metadata lookup.
|
|
||||||
$originalName = basename(trim($fileName));
|
|
||||||
$basename = $originalName; // Start with the original name.
|
|
||||||
|
|
||||||
// Validate the file name.
|
|
||||||
if (!preg_match($safeFileNamePattern, $basename)) {
|
|
||||||
$errors[] = "$basename has invalid characters.";
|
|
||||||
continue;
|
|
||||||
}
|
|
||||||
|
|
||||||
$srcPath = $sourceDir . $originalName;
|
|
||||||
$destPath = $destDir . $basename;
|
|
||||||
|
|
||||||
clearstatcache();
|
|
||||||
if (!file_exists($srcPath)) {
|
|
||||||
$errors[] = "$originalName does not exist in source.";
|
|
||||||
continue;
|
|
||||||
}
|
|
||||||
|
|
||||||
// If a file with the same name exists in destination, generate a unique name.
|
|
||||||
if (file_exists($destPath)) {
|
|
||||||
$uniqueName = getUniqueFileName($destDir, $basename);
|
|
||||||
$basename = $uniqueName;
|
|
||||||
$destPath = $destDir . $uniqueName;
|
|
||||||
}
|
|
||||||
|
|
||||||
if (!rename($srcPath, $destPath)) {
|
|
||||||
$errors[] = "Failed to move $basename";
|
|
||||||
continue;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Update metadata: if there is metadata for the original file, move it under the new name.
|
|
||||||
if (isset($srcMetadata[$originalName])) {
|
|
||||||
$destMetadata[$basename] = $srcMetadata[$originalName];
|
|
||||||
unset($srcMetadata[$originalName]);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
if (file_put_contents($srcMetaFile, json_encode($srcMetadata, JSON_PRETTY_PRINT)) === false) {
|
|
||||||
$errors[] = "Failed to update source metadata.";
|
|
||||||
}
|
|
||||||
if (file_put_contents($destMetaFile, json_encode($destMetadata, JSON_PRETTY_PRINT)) === false) {
|
|
||||||
$errors[] = "Failed to update destination metadata.";
|
|
||||||
}
|
|
||||||
|
|
||||||
if (empty($errors)) {
|
|
||||||
echo json_encode(["success" => "Files moved successfully"]);
|
|
||||||
} else {
|
|
||||||
echo json_encode(["error" => implode("; ", $errors)]);
|
|
||||||
}
|
|
||||||
?>
|
|
||||||
8
public/api/addUser.php
Normal file
8
public/api/addUser.php
Normal file
@@ -0,0 +1,8 @@
|
|||||||
|
<?php
|
||||||
|
// public/api/addUser.php
|
||||||
|
|
||||||
|
require_once __DIR__ . '/../../config/config.php';
|
||||||
|
require_once PROJECT_ROOT . '/src/controllers/userController.php';
|
||||||
|
|
||||||
|
$userController = new UserController();
|
||||||
|
$userController->addUser();
|
||||||
8
public/api/admin/getConfig.php
Normal file
8
public/api/admin/getConfig.php
Normal file
@@ -0,0 +1,8 @@
|
|||||||
|
<?php
|
||||||
|
// public/api/admin/getConfig.php
|
||||||
|
|
||||||
|
require_once __DIR__ . '/../../../config/config.php';
|
||||||
|
require_once PROJECT_ROOT . '/src/controllers/adminController.php';
|
||||||
|
|
||||||
|
$adminController = new AdminController();
|
||||||
|
$adminController->getConfig();
|
||||||
8
public/api/admin/updateConfig.php
Normal file
8
public/api/admin/updateConfig.php
Normal file
@@ -0,0 +1,8 @@
|
|||||||
|
<?php
|
||||||
|
// public/api/admin/updateConfig.php
|
||||||
|
|
||||||
|
require_once __DIR__ . '/../../../config/config.php';
|
||||||
|
require_once PROJECT_ROOT . '/src/controllers/adminController.php';
|
||||||
|
|
||||||
|
$adminController = new AdminController();
|
||||||
|
$adminController->updateConfig();
|
||||||
9
public/api/auth/auth.php
Normal file
9
public/api/auth/auth.php
Normal file
@@ -0,0 +1,9 @@
|
|||||||
|
<?php
|
||||||
|
// public/api/auth/auth.php
|
||||||
|
|
||||||
|
require_once __DIR__ . '/../../../config/config.php';
|
||||||
|
require_once PROJECT_ROOT . '/vendor/autoload.php';
|
||||||
|
require_once PROJECT_ROOT . '/src/controllers/authController.php';
|
||||||
|
|
||||||
|
$authController = new AuthController();
|
||||||
|
$authController->auth();
|
||||||
8
public/api/auth/checkAuth.php
Normal file
8
public/api/auth/checkAuth.php
Normal file
@@ -0,0 +1,8 @@
|
|||||||
|
<?php
|
||||||
|
// public/api/auth/checkAuth.php
|
||||||
|
|
||||||
|
require_once __DIR__ . '/../../../config/config.php';
|
||||||
|
require_once PROJECT_ROOT . '/src/controllers/authController.php';
|
||||||
|
|
||||||
|
$authController = new AuthController();
|
||||||
|
$authController->checkAuth();
|
||||||
8
public/api/auth/login_basic.php
Normal file
8
public/api/auth/login_basic.php
Normal file
@@ -0,0 +1,8 @@
|
|||||||
|
<?php
|
||||||
|
// public/api/auth/login_basic.php
|
||||||
|
|
||||||
|
require_once __DIR__ . '/../../../config/config.php';
|
||||||
|
require_once PROJECT_ROOT . '/src/controllers/authController.php';
|
||||||
|
|
||||||
|
$authController = new AuthController();
|
||||||
|
$authController->loginBasic();
|
||||||
8
public/api/auth/logout.php
Normal file
8
public/api/auth/logout.php
Normal file
@@ -0,0 +1,8 @@
|
|||||||
|
<?php
|
||||||
|
// public/api/auth/logout.php
|
||||||
|
|
||||||
|
require_once __DIR__ . '/../../../config/config.php';
|
||||||
|
require_once PROJECT_ROOT . '/src/controllers/authController.php';
|
||||||
|
|
||||||
|
$authController = new AuthController();
|
||||||
|
$authController->logout();
|
||||||
8
public/api/auth/token.php
Normal file
8
public/api/auth/token.php
Normal file
@@ -0,0 +1,8 @@
|
|||||||
|
<?php
|
||||||
|
// public/api/auth/token.php
|
||||||
|
|
||||||
|
require_once __DIR__ . '/../../../config/config.php';
|
||||||
|
require_once PROJECT_ROOT . '/src/controllers/authController.php';
|
||||||
|
|
||||||
|
$authController = new AuthController();
|
||||||
|
$authController->getToken();
|
||||||
8
public/api/changePassword.php
Normal file
8
public/api/changePassword.php
Normal file
@@ -0,0 +1,8 @@
|
|||||||
|
<?php
|
||||||
|
// public/api/changePassword.php
|
||||||
|
|
||||||
|
require_once __DIR__ . '/../../config/config.php';
|
||||||
|
require_once PROJECT_ROOT . '/src/controllers/userController.php';
|
||||||
|
|
||||||
|
$userController = new UserController();
|
||||||
|
$userController->changePassword();
|
||||||
8
public/api/file/copyFiles.php
Normal file
8
public/api/file/copyFiles.php
Normal file
@@ -0,0 +1,8 @@
|
|||||||
|
<?php
|
||||||
|
// public/api/file/copyFiles.php
|
||||||
|
|
||||||
|
require_once __DIR__ . '/../../../config/config.php';
|
||||||
|
require_once PROJECT_ROOT . '/src/controllers/fileController.php';
|
||||||
|
|
||||||
|
$fileController = new FileController();
|
||||||
|
$fileController->copyFiles();
|
||||||
8
public/api/file/createShareLink.php
Normal file
8
public/api/file/createShareLink.php
Normal file
@@ -0,0 +1,8 @@
|
|||||||
|
<?php
|
||||||
|
// public/api/file/createShareLink.php
|
||||||
|
|
||||||
|
require_once __DIR__ . '/../../../config/config.php';
|
||||||
|
require_once PROJECT_ROOT . '/src/controllers/fileController.php';
|
||||||
|
|
||||||
|
$fileController = new FileController();
|
||||||
|
$fileController->createShareLink();
|
||||||
8
public/api/file/deleteFiles.php
Normal file
8
public/api/file/deleteFiles.php
Normal file
@@ -0,0 +1,8 @@
|
|||||||
|
<?php
|
||||||
|
// public/api/file/deleteFiles.php
|
||||||
|
|
||||||
|
require_once __DIR__ . '/../../../config/config.php';
|
||||||
|
require_once PROJECT_ROOT . '/src/controllers/fileController.php';
|
||||||
|
|
||||||
|
$fileController = new FileController();
|
||||||
|
$fileController->deleteFiles();
|
||||||
8
public/api/file/deleteTrashFiles.php
Normal file
8
public/api/file/deleteTrashFiles.php
Normal file
@@ -0,0 +1,8 @@
|
|||||||
|
<?php
|
||||||
|
// public/api/file/deleteTrashFiles.php
|
||||||
|
|
||||||
|
require_once __DIR__ . '/../../../config/config.php';
|
||||||
|
require_once PROJECT_ROOT . '/src/controllers/fileController.php';
|
||||||
|
|
||||||
|
$fileController = new FileController();
|
||||||
|
$fileController->deleteTrashFiles();
|
||||||
8
public/api/file/download.php
Normal file
8
public/api/file/download.php
Normal file
@@ -0,0 +1,8 @@
|
|||||||
|
<?php
|
||||||
|
// public/api/file/download.php
|
||||||
|
|
||||||
|
require_once __DIR__ . '/../../../config/config.php';
|
||||||
|
require_once PROJECT_ROOT . '/src/controllers/fileController.php';
|
||||||
|
|
||||||
|
$fileController = new FileController();
|
||||||
|
$fileController->downloadFile();
|
||||||
8
public/api/file/downloadZip.php
Normal file
8
public/api/file/downloadZip.php
Normal file
@@ -0,0 +1,8 @@
|
|||||||
|
<?php
|
||||||
|
// public/api/file/downloadZip.php
|
||||||
|
|
||||||
|
require_once __DIR__ . '/../../../config/config.php';
|
||||||
|
require_once PROJECT_ROOT . '/src/controllers/fileController.php';
|
||||||
|
|
||||||
|
$fileController = new FileController();
|
||||||
|
$fileController->downloadZip();
|
||||||
8
public/api/file/extractZip.php
Normal file
8
public/api/file/extractZip.php
Normal file
@@ -0,0 +1,8 @@
|
|||||||
|
<?php
|
||||||
|
// public/api/file/extractZip.php
|
||||||
|
|
||||||
|
require_once __DIR__ . '/../../../config/config.php';
|
||||||
|
require_once PROJECT_ROOT . '/src/controllers/fileController.php';
|
||||||
|
|
||||||
|
$fileController = new FileController();
|
||||||
|
$fileController->extractZip();
|
||||||
8
public/api/file/getFileList.php
Normal file
8
public/api/file/getFileList.php
Normal file
@@ -0,0 +1,8 @@
|
|||||||
|
<?php
|
||||||
|
// public/api/file/getFileList.php
|
||||||
|
|
||||||
|
require_once __DIR__ . '/../../../config/config.php';
|
||||||
|
require_once PROJECT_ROOT . '/src/controllers/fileController.php';
|
||||||
|
|
||||||
|
$fileController = new FileController();
|
||||||
|
$fileController->getFileList();
|
||||||
8
public/api/file/getFileTag.php
Normal file
8
public/api/file/getFileTag.php
Normal file
@@ -0,0 +1,8 @@
|
|||||||
|
<?php
|
||||||
|
// public/api/file/getFileTag.php
|
||||||
|
|
||||||
|
require_once __DIR__ . '/../../../config/config.php';
|
||||||
|
require_once PROJECT_ROOT . '/src/controllers/fileController.php';
|
||||||
|
|
||||||
|
$fileController = new FileController();
|
||||||
|
$fileController->getFileTags();
|
||||||
8
public/api/file/getTrashItems.php
Normal file
8
public/api/file/getTrashItems.php
Normal file
@@ -0,0 +1,8 @@
|
|||||||
|
<?php
|
||||||
|
// public/api/file/getTrashItems.php
|
||||||
|
|
||||||
|
require_once __DIR__ . '/../../../config/config.php';
|
||||||
|
require_once PROJECT_ROOT . '/src/controllers/fileController.php';
|
||||||
|
|
||||||
|
$fileController = new FileController();
|
||||||
|
$fileController->getTrashItems();
|
||||||
8
public/api/file/moveFiles.php
Normal file
8
public/api/file/moveFiles.php
Normal file
@@ -0,0 +1,8 @@
|
|||||||
|
<?php
|
||||||
|
// public/api/file/moveFiles.php
|
||||||
|
|
||||||
|
require_once __DIR__ . '/../../../config/config.php';
|
||||||
|
require_once PROJECT_ROOT . '/src/controllers/fileController.php';
|
||||||
|
|
||||||
|
$fileController = new FileController();
|
||||||
|
$fileController->moveFiles();
|
||||||
8
public/api/file/renameFile.php
Normal file
8
public/api/file/renameFile.php
Normal file
@@ -0,0 +1,8 @@
|
|||||||
|
<?php
|
||||||
|
// public/api/file/renameFile.php
|
||||||
|
|
||||||
|
require_once __DIR__ . '/../../../config/config.php';
|
||||||
|
require_once PROJECT_ROOT . '/src/controllers/fileController.php';
|
||||||
|
|
||||||
|
$fileController = new FileController();
|
||||||
|
$fileController->renameFile();
|
||||||
8
public/api/file/restoreFiles.php
Normal file
8
public/api/file/restoreFiles.php
Normal file
@@ -0,0 +1,8 @@
|
|||||||
|
<?php
|
||||||
|
// public/api/file/restoreFiles.php
|
||||||
|
|
||||||
|
require_once __DIR__ . '/../../../config/config.php';
|
||||||
|
require_once PROJECT_ROOT . '/src/controllers/fileController.php';
|
||||||
|
|
||||||
|
$fileController = new FileController();
|
||||||
|
$fileController->restoreFiles();
|
||||||
8
public/api/file/saveFile.php
Normal file
8
public/api/file/saveFile.php
Normal file
@@ -0,0 +1,8 @@
|
|||||||
|
<?php
|
||||||
|
// public/api/file/saveFile.php
|
||||||
|
|
||||||
|
require_once __DIR__ . '/../../../config/config.php';
|
||||||
|
require_once PROJECT_ROOT . '/src/controllers/fileController.php';
|
||||||
|
|
||||||
|
$fileController = new FileController();
|
||||||
|
$fileController->saveFile();
|
||||||
8
public/api/file/saveFileTag.php
Normal file
8
public/api/file/saveFileTag.php
Normal file
@@ -0,0 +1,8 @@
|
|||||||
|
<?php
|
||||||
|
// public/api/file/saveFileTag.php
|
||||||
|
|
||||||
|
require_once __DIR__ . '/../../../config/config.php';
|
||||||
|
require_once PROJECT_ROOT . '/src/controllers/fileController.php';
|
||||||
|
|
||||||
|
$fileController = new FileController();
|
||||||
|
$fileController->saveFileTag();
|
||||||
8
public/api/file/share.php
Normal file
8
public/api/file/share.php
Normal file
@@ -0,0 +1,8 @@
|
|||||||
|
<?php
|
||||||
|
// public/api/file/share.php
|
||||||
|
|
||||||
|
require_once __DIR__ . '/../../../config/config.php';
|
||||||
|
require_once PROJECT_ROOT . '/src/controllers/fileController.php';
|
||||||
|
|
||||||
|
$fileController = new FileController();
|
||||||
|
$fileController->shareFile();
|
||||||
2
public/api/file/symlink
Normal file
2
public/api/file/symlink
Normal file
@@ -0,0 +1,2 @@
|
|||||||
|
cd /var/www/public
|
||||||
|
ln -s ../uploads uploads
|
||||||
8
public/api/folder/createFolder.php
Normal file
8
public/api/folder/createFolder.php
Normal file
@@ -0,0 +1,8 @@
|
|||||||
|
<?php
|
||||||
|
// public/api/folder/createFolder.php
|
||||||
|
|
||||||
|
require_once __DIR__ . '/../../../config/config.php';
|
||||||
|
require_once PROJECT_ROOT . '/src/controllers/folderController.php';
|
||||||
|
|
||||||
|
$folderController = new FolderController();
|
||||||
|
$folderController->createFolder();
|
||||||
8
public/api/folder/createShareFolderLink.php
Normal file
8
public/api/folder/createShareFolderLink.php
Normal file
@@ -0,0 +1,8 @@
|
|||||||
|
<?php
|
||||||
|
// public/api/folder/createShareFolderLink.php
|
||||||
|
|
||||||
|
require_once __DIR__ . '/../../../config/config.php';
|
||||||
|
require_once PROJECT_ROOT . '/src/controllers/folderController.php';
|
||||||
|
|
||||||
|
$folderController = new FolderController();
|
||||||
|
$folderController->createShareFolderLink();
|
||||||
8
public/api/folder/deleteFolder.php
Normal file
8
public/api/folder/deleteFolder.php
Normal file
@@ -0,0 +1,8 @@
|
|||||||
|
<?php
|
||||||
|
// public/api/folder/deleteFolder.php
|
||||||
|
|
||||||
|
require_once __DIR__ . '/../../../config/config.php';
|
||||||
|
require_once PROJECT_ROOT . '/src/controllers/folderController.php';
|
||||||
|
|
||||||
|
$folderController = new FolderController();
|
||||||
|
$folderController->deleteFolder();
|
||||||
8
public/api/folder/downloadSharedFile.php
Normal file
8
public/api/folder/downloadSharedFile.php
Normal file
@@ -0,0 +1,8 @@
|
|||||||
|
<?php
|
||||||
|
// public/api/folder/downloadSharedFile.php
|
||||||
|
|
||||||
|
require_once __DIR__ . '/../../../config/config.php';
|
||||||
|
require_once PROJECT_ROOT . '/src/controllers/folderController.php';
|
||||||
|
|
||||||
|
$folderController = new FolderController();
|
||||||
|
$folderController->downloadSharedFile();
|
||||||
8
public/api/folder/getFolderList.php
Normal file
8
public/api/folder/getFolderList.php
Normal file
@@ -0,0 +1,8 @@
|
|||||||
|
<?php
|
||||||
|
// public/api/folder/getFolderList.php
|
||||||
|
|
||||||
|
require_once __DIR__ . '/../../../config/config.php';
|
||||||
|
require_once PROJECT_ROOT . '/src/controllers/folderController.php';
|
||||||
|
|
||||||
|
$folderController = new FolderController();
|
||||||
|
$folderController->getFolderList();
|
||||||
8
public/api/folder/renameFolder.php
Normal file
8
public/api/folder/renameFolder.php
Normal file
@@ -0,0 +1,8 @@
|
|||||||
|
<?php
|
||||||
|
// public/api/folder/renameFolder.php
|
||||||
|
|
||||||
|
require_once __DIR__ . '/../../../config/config.php';
|
||||||
|
require_once PROJECT_ROOT . '/src/controllers/folderController.php';
|
||||||
|
|
||||||
|
$folderController = new FolderController();
|
||||||
|
$folderController->renameFolder();
|
||||||
8
public/api/folder/shareFolder.php
Normal file
8
public/api/folder/shareFolder.php
Normal file
@@ -0,0 +1,8 @@
|
|||||||
|
<?php
|
||||||
|
// public/api/folder/shareFolder.php
|
||||||
|
|
||||||
|
require_once __DIR__ . '/../../../config/config.php';
|
||||||
|
require_once PROJECT_ROOT . '/src/controllers/folderController.php';
|
||||||
|
|
||||||
|
$folderController = new FolderController();
|
||||||
|
$folderController->shareFolder();
|
||||||
8
public/api/folder/uploadToSharedFolder.php
Normal file
8
public/api/folder/uploadToSharedFolder.php
Normal file
@@ -0,0 +1,8 @@
|
|||||||
|
<?php
|
||||||
|
// public/api/folder/uploadToSharedFolder.php
|
||||||
|
|
||||||
|
require_once __DIR__ . '/../../../config/config.php';
|
||||||
|
require_once PROJECT_ROOT . '/src/controllers/folderController.php';
|
||||||
|
|
||||||
|
$folderController = new FolderController();
|
||||||
|
$folderController->uploadToSharedFolder();
|
||||||
8
public/api/getUserPermissions.php
Normal file
8
public/api/getUserPermissions.php
Normal file
@@ -0,0 +1,8 @@
|
|||||||
|
<?php
|
||||||
|
// public/api/getUserPermissions.php
|
||||||
|
|
||||||
|
require_once __DIR__ . '/../../config/config.php';
|
||||||
|
require_once PROJECT_ROOT . '/src/controllers/userController.php';
|
||||||
|
|
||||||
|
$userController = new UserController();
|
||||||
|
$userController->getUserPermissions();
|
||||||
8
public/api/getUsers.php
Normal file
8
public/api/getUsers.php
Normal file
@@ -0,0 +1,8 @@
|
|||||||
|
<?php
|
||||||
|
// public/api/getUsers.php
|
||||||
|
|
||||||
|
require_once __DIR__ . '/../../config/config.php';
|
||||||
|
require_once PROJECT_ROOT . '/src/controllers/userController.php';
|
||||||
|
|
||||||
|
$userController = new UserController();
|
||||||
|
$userController->getUsers(); // This will output the JSON response
|
||||||
8
public/api/removeUser.php
Normal file
8
public/api/removeUser.php
Normal file
@@ -0,0 +1,8 @@
|
|||||||
|
<?php
|
||||||
|
// public/api/removeUser.php
|
||||||
|
|
||||||
|
require_once __DIR__ . '/../../config/config.php';
|
||||||
|
require_once PROJECT_ROOT . '/src/controllers/userController.php';
|
||||||
|
|
||||||
|
$userController = new UserController();
|
||||||
|
$userController->removeUser();
|
||||||
9
public/api/totp_disable.php
Normal file
9
public/api/totp_disable.php
Normal file
@@ -0,0 +1,9 @@
|
|||||||
|
<?php
|
||||||
|
// public/api/totp_disable.php
|
||||||
|
|
||||||
|
require_once __DIR__ . '/../../config/config.php';
|
||||||
|
require_once PROJECT_ROOT . '/vendor/autoload.php';
|
||||||
|
require_once PROJECT_ROOT . '/src/controllers/userController.php';
|
||||||
|
|
||||||
|
$userController = new UserController();
|
||||||
|
$userController->disableTOTP();
|
||||||
8
public/api/totp_recover.php
Normal file
8
public/api/totp_recover.php
Normal file
@@ -0,0 +1,8 @@
|
|||||||
|
<?php
|
||||||
|
// public/api/totp_recover.php
|
||||||
|
|
||||||
|
require_once __DIR__ . '/../../config/config.php';
|
||||||
|
require_once PROJECT_ROOT . '/src/controllers/userController.php';
|
||||||
|
|
||||||
|
$userController = new UserController();
|
||||||
|
$userController->recoverTOTP();
|
||||||
8
public/api/totp_saveCode.php
Normal file
8
public/api/totp_saveCode.php
Normal file
@@ -0,0 +1,8 @@
|
|||||||
|
<?php
|
||||||
|
// public/api/totp_saveCode.php
|
||||||
|
|
||||||
|
require_once __DIR__ . '/../../config/config.php';
|
||||||
|
require_once PROJECT_ROOT . '/src/controllers/userController.php';
|
||||||
|
|
||||||
|
$userController = new UserController();
|
||||||
|
$userController->saveTOTPRecoveryCode();
|
||||||
9
public/api/totp_setup.php
Normal file
9
public/api/totp_setup.php
Normal file
@@ -0,0 +1,9 @@
|
|||||||
|
<?php
|
||||||
|
// public/api/totp_setup.php
|
||||||
|
|
||||||
|
require_once __DIR__ . '/../../config/config.php';
|
||||||
|
require_once PROJECT_ROOT . '/vendor/autoload.php';
|
||||||
|
require_once PROJECT_ROOT . '/src/controllers/userController.php';
|
||||||
|
|
||||||
|
$userController = new UserController();
|
||||||
|
$userController->setupTOTP();
|
||||||
9
public/api/totp_verify.php
Normal file
9
public/api/totp_verify.php
Normal file
@@ -0,0 +1,9 @@
|
|||||||
|
<?php
|
||||||
|
// public/api/totp_verify.php
|
||||||
|
|
||||||
|
require_once __DIR__ . '/../../config/config.php';
|
||||||
|
require_once PROJECT_ROOT . '/vendor/autoload.php';
|
||||||
|
require_once PROJECT_ROOT . '/src/controllers/userController.php';
|
||||||
|
|
||||||
|
$userController = new UserController();
|
||||||
|
$userController->verifyTOTP();
|
||||||
8
public/api/updateUserPanel.php
Normal file
8
public/api/updateUserPanel.php
Normal file
@@ -0,0 +1,8 @@
|
|||||||
|
<?php
|
||||||
|
// public/api/updateUserPanel.php
|
||||||
|
|
||||||
|
require_once __DIR__ . '/../../config/config.php';
|
||||||
|
require_once PROJECT_ROOT . '/src/controllers/userController.php';
|
||||||
|
|
||||||
|
$userController = new UserController();
|
||||||
|
$userController->updateUserPanel();
|
||||||
8
public/api/updateUserPermissions.php
Normal file
8
public/api/updateUserPermissions.php
Normal file
@@ -0,0 +1,8 @@
|
|||||||
|
<?php
|
||||||
|
// public/api/updateUserPermissions.php
|
||||||
|
|
||||||
|
require_once __DIR__ . '/../../config/config.php';
|
||||||
|
require_once PROJECT_ROOT . '/src/controllers/userController.php';
|
||||||
|
|
||||||
|
$userController = new UserController();
|
||||||
|
$userController->updateUserPermissions();
|
||||||
8
public/api/upload/removeChunks.php
Normal file
8
public/api/upload/removeChunks.php
Normal file
@@ -0,0 +1,8 @@
|
|||||||
|
<?php
|
||||||
|
// public/api/upload/removeChunks.php
|
||||||
|
|
||||||
|
require_once __DIR__ . '/../../../config/config.php';
|
||||||
|
require_once PROJECT_ROOT . '/src/controllers/uploadController.php';
|
||||||
|
|
||||||
|
$uploadController = new UploadController();
|
||||||
|
$uploadController->removeChunks();
|
||||||
7
public/api/upload/upload.php
Normal file
7
public/api/upload/upload.php
Normal file
@@ -0,0 +1,7 @@
|
|||||||
|
<?php
|
||||||
|
// public/api/upload/upload.php
|
||||||
|
require_once __DIR__ . '/../../../config/config.php';
|
||||||
|
require_once PROJECT_ROOT . '/src/controllers/uploadController.php';
|
||||||
|
|
||||||
|
$uploadController = new UploadController();
|
||||||
|
$uploadController->handleUpload();
|
||||||
|
Before Width: | Height: | Size: 4.2 KiB After Width: | Height: | Size: 4.2 KiB |
|
Before Width: | Height: | Size: 1.6 KiB After Width: | Height: | Size: 1.6 KiB |
|
Before Width: | Height: | Size: 1.9 KiB After Width: | Height: | Size: 1.9 KiB |
485
public/index.html
Normal file
485
public/index.html
Normal file
@@ -0,0 +1,485 @@
|
|||||||
|
<!DOCTYPE html>
|
||||||
|
<html lang="en">
|
||||||
|
|
||||||
|
<head>
|
||||||
|
<meta charset="UTF-8" />
|
||||||
|
<meta name="viewport" content="width=device-width, initial-scale=1" />
|
||||||
|
<title data-i18n-key="title">FileRise</title>
|
||||||
|
<script>
|
||||||
|
const params = new URLSearchParams(window.location.search);
|
||||||
|
if (params.get('logout') === '1') {
|
||||||
|
localStorage.removeItem("username");
|
||||||
|
localStorage.removeItem("userTOTPEnabled");
|
||||||
|
}
|
||||||
|
</script>
|
||||||
|
<link rel="icon" type="image/png" href="/assets/logo.png">
|
||||||
|
<link rel="icon" type="image/svg+xml" href="/assets/logo.svg">
|
||||||
|
<meta name="csrf-token" content="">
|
||||||
|
<meta name="share-url" content="">
|
||||||
|
<!-- Google Fonts and Material Icons -->
|
||||||
|
<link href="https://fonts.googleapis.com/css2?family=Roboto:wght@400;500&display=swap" rel="stylesheet" />
|
||||||
|
<link href="https://fonts.googleapis.com/icon?family=Material+Icons" rel="stylesheet" />
|
||||||
|
<!-- Bootstrap CSS -->
|
||||||
|
<link href="https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/css/bootstrap.min.css" rel="stylesheet" />
|
||||||
|
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/codemirror/5.65.5/codemirror.min.css" />
|
||||||
|
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/codemirror/5.65.5/theme/material-darker.min.css">
|
||||||
|
<script src="https://cdnjs.cloudflare.com/ajax/libs/codemirror/5.65.5/codemirror.min.js"
|
||||||
|
integrity="sha384-UXbkZAbZYZ/KCAslc6UO4d6UHNKsOxZ/sqROSQaPTZCuEIKhfbhmffQ64uXFOcma"
|
||||||
|
crossorigin="anonymous"></script>
|
||||||
|
<script src="https://cdnjs.cloudflare.com/ajax/libs/codemirror/5.65.5/mode/xml/xml.min.js"
|
||||||
|
integrity="sha384-xPpkMo5nDgD98fIcuRVYhxkZV6/9Y4L8s3p0J5c4MxgJkyKJ8BJr+xfRkq7kn6Tw"
|
||||||
|
crossorigin="anonymous"></script>
|
||||||
|
<script src="https://cdnjs.cloudflare.com/ajax/libs/codemirror/5.65.5/mode/css/css.min.js"
|
||||||
|
integrity="sha384-to8njsu2GAiXQnY/aLGzz0DIY/SFSeSDodtvSl869n2NmsBdHOTZNNqbEBPYh7Pa"
|
||||||
|
crossorigin="anonymous"></script>
|
||||||
|
<script src="https://cdnjs.cloudflare.com/ajax/libs/codemirror/5.65.5/mode/javascript/javascript.min.js"
|
||||||
|
integrity="sha384-kmQrbJf09Uo1WRLMDVGoVG3nM6F48frIhcj7f3FDUjeRzsiHwyBWDjMUIttnIeAf"
|
||||||
|
crossorigin="anonymous"></script>
|
||||||
|
<script src="https://cdnjs.cloudflare.com/ajax/libs/resumable.js/1.1.0/resumable.min.js"
|
||||||
|
integrity="sha384-EXTg7rRfdTPZWoKVCslusAAev2TYw76fm+Wox718iEtFQ+gdAdAc5Z/ndLHSo4mq"
|
||||||
|
crossorigin="anonymous"></script>
|
||||||
|
<script src="https://cdnjs.cloudflare.com/ajax/libs/dompurify/2.4.0/purify.min.js"
|
||||||
|
integrity="sha384-Tsl3d5pUAO7a13enIvSsL3O0/95nsthPJiPto5NtLuY8w3+LbZOpr3Fl2MNmrh1E"
|
||||||
|
crossorigin="anonymous"></script>
|
||||||
|
<script src="https://cdn.jsdelivr.net/npm/fuse.js@6.6.2/dist/fuse.min.js"
|
||||||
|
integrity="sha384-zPE55eyESN+FxCWGEnlNxGyAPJud6IZ6TtJmXb56OFRGhxZPN4akj9rjA3gw5Qqa"
|
||||||
|
crossorigin="anonymous"></script>
|
||||||
|
<link rel="stylesheet" href="css/styles.css" />
|
||||||
|
</head>
|
||||||
|
|
||||||
|
<body>
|
||||||
|
<header class="header-container">
|
||||||
|
<div class="header-left">
|
||||||
|
<a href="index.html">
|
||||||
|
<div class="header-logo">
|
||||||
|
<svg version="1.1" id="filingCabinetLogo" xmlns="http://www.w3.org/2000/svg"
|
||||||
|
xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 64 64" xml:space="preserve">
|
||||||
|
<defs>
|
||||||
|
<!-- Gradient for the cabinet body -->
|
||||||
|
<linearGradient id="cabinetGradient" x1="0%" y1="0%" x2="0%" y2="100%">
|
||||||
|
<stop offset="0%" style="stop-color:#2196F3;stop-opacity:1" />
|
||||||
|
<stop offset="100%" style="stop-color:#1976D2;stop-opacity:1" />
|
||||||
|
</linearGradient>
|
||||||
|
<!-- Drop shadow filter with animated attributes for a lifting effect -->
|
||||||
|
<filter id="shadowFilter" x="-20%" y="-20%" width="140%" height="140%">
|
||||||
|
<feDropShadow id="dropShadow" dx="0" dy="2" stdDeviation="2" flood-color="#000" flood-opacity="0.2">
|
||||||
|
<!-- Animate the vertical offset: from 2 to 1 (as it rises), hold, then back to 2 -->
|
||||||
|
<animate attributeName="dy" values="2;1;1;2" keyTimes="0;0.2;0.8;1" dur="5s" fill="freeze" />
|
||||||
|
<!-- Animate the blur similarly: from 2 to 1.5 then back to 2 -->
|
||||||
|
<animate attributeName="stdDeviation" values="2;1.5;1.5;2" keyTimes="0;0.2;0.8;1" dur="5s"
|
||||||
|
fill="freeze" />
|
||||||
|
</feDropShadow>
|
||||||
|
</filter>
|
||||||
|
</defs>
|
||||||
|
<style type="text/css">
|
||||||
|
/* Cabinet with gradient, white outline, and drop shadow */
|
||||||
|
.cabinet {
|
||||||
|
fill: url(#cabinetGradient);
|
||||||
|
stroke: white;
|
||||||
|
stroke-width: 2;
|
||||||
|
}
|
||||||
|
|
||||||
|
.divider {
|
||||||
|
stroke: #1565C0;
|
||||||
|
stroke-width: 1.5;
|
||||||
|
}
|
||||||
|
|
||||||
|
.drawer {
|
||||||
|
fill: #FFFFFF;
|
||||||
|
}
|
||||||
|
|
||||||
|
.handle {
|
||||||
|
fill: #1565C0;
|
||||||
|
}
|
||||||
|
</style>
|
||||||
|
<!-- Group that will animate upward and then back down once -->
|
||||||
|
<g id="cabinetGroup">
|
||||||
|
<!-- Cabinet Body with rounded corners, white outline, and drop shadow -->
|
||||||
|
<rect x="4" y="4" width="56" height="56" rx="6" ry="6" class="cabinet" filter="url(#shadowFilter)" />
|
||||||
|
<!-- Divider lines for drawers -->
|
||||||
|
<line x1="5" y1="22" x2="59" y2="22" class="divider" />
|
||||||
|
<line x1="5" y1="34" x2="59" y2="34" class="divider" />
|
||||||
|
<!-- Drawers with Handles -->
|
||||||
|
<rect x="8" y="24" width="48" height="6" rx="1" ry="1" class="drawer" />
|
||||||
|
<circle cx="54" cy="27" r="1.5" class="handle" />
|
||||||
|
<rect x="8" y="36" width="48" height="6" rx="1" ry="1" class="drawer" />
|
||||||
|
<circle cx="54" cy="39" r="1.5" class="handle" />
|
||||||
|
<rect x="8" y="48" width="48" height="6" rx="1" ry="1" class="drawer" />
|
||||||
|
<circle cx="54" cy="51" r="1.5" class="handle" />
|
||||||
|
<!-- Additional detail: a small top handle on the cabinet door -->
|
||||||
|
<rect x="28" y="10" width="8" height="4" rx="1" ry="1" fill="#1565C0" />
|
||||||
|
<!-- Animate transform: rises by 2 pixels over 1s, holds for 3s, then falls over 1s (total 5s) -->
|
||||||
|
<animateTransform attributeName="transform" type="translate" values="0 0; 0 -2; 0 -2; 0 0"
|
||||||
|
keyTimes="0;0.2;0.8;1" dur="5s" fill="freeze" />
|
||||||
|
</g>
|
||||||
|
</svg>
|
||||||
|
</div>
|
||||||
|
</a>
|
||||||
|
</div>
|
||||||
|
<div class="header-title">
|
||||||
|
<h1 data-i18n-key="header_title">FileRise</h1>
|
||||||
|
</div>
|
||||||
|
<div class="header-right">
|
||||||
|
<div class="header-buttons-wrapper" style="display: flex; align-items: center; gap: 10px;">
|
||||||
|
<!-- Your header drop zone -->
|
||||||
|
<div id="headerDropArea" class="header-drop-zone"></div>
|
||||||
|
<div class="header-buttons">
|
||||||
|
<button id="logoutBtn" data-i18n-title="logout">
|
||||||
|
<i class="material-icons">exit_to_app</i>
|
||||||
|
</button>
|
||||||
|
<button id="changePasswordBtn" data-i18n-title="change_password" style="display: none;">
|
||||||
|
<i class="material-icons">vpn_key</i>
|
||||||
|
</button>
|
||||||
|
<div id="restoreFilesModal" class="modal centered-modal" style="display: none;">
|
||||||
|
<div class="modal-content">
|
||||||
|
<h4 class="custom-restore-header">
|
||||||
|
<i class="material-icons orange-icon">restore_from_trash</i>
|
||||||
|
<span data-i18n-key="restore_text">Restore or</span>
|
||||||
|
<i class="material-icons red-icon">delete_for_ever</i>
|
||||||
|
<span data-i18n-key="delete_text">Delete Trash Items</span>
|
||||||
|
</h4>
|
||||||
|
<div id="restoreFilesList"
|
||||||
|
style="max-height:300px; overflow-y:auto; border:1px solid #ccc; padding:10px; margin-bottom:10px;">
|
||||||
|
<!-- Trash items will be loaded here -->
|
||||||
|
</div>
|
||||||
|
<div style="text-align: right;">
|
||||||
|
<button id="restoreSelectedBtn" class="btn btn-primary" data-i18n-key="restore_selected">Restore
|
||||||
|
Selected</button>
|
||||||
|
<button id="restoreAllBtn" class="btn btn-secondary" data-i18n-key="restore_all">Restore All</button>
|
||||||
|
<button id="deleteTrashSelectedBtn" class="btn btn-warning" data-i18n-key="delete_selected_trash">Delete
|
||||||
|
Selected</button>
|
||||||
|
<button id="deleteAllBtn" class="btn btn-danger" data-i18n-key="delete_all">Delete All</button>
|
||||||
|
<button id="closeRestoreModal" class="btn btn-dark" data-i18n-key="close">Close</button>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
<button id="addUserBtn" data-i18n-title="add_user" style="display: none;">
|
||||||
|
<i class="material-icons">person_add</i>
|
||||||
|
</button>
|
||||||
|
<button id="removeUserBtn" data-i18n-title="remove_user" style="display: none;">
|
||||||
|
<i class="material-icons">person_remove</i>
|
||||||
|
</button>
|
||||||
|
<button id="darkModeToggle" class="dark-mode-toggle" data-i18n-key="dark_mode_toggle">Dark Mode</button>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</header>
|
||||||
|
|
||||||
|
<!-- Custom Toast Container -->
|
||||||
|
<div id="customToast"></div>
|
||||||
|
<div id="hiddenCardsContainer" style="display:none;"></div>
|
||||||
|
|
||||||
|
<!-- Main Wrapper: Hidden by default; remove "display: none;" after login -->
|
||||||
|
<div class="main-wrapper">
|
||||||
|
<!-- Sidebar Drop Zone: Hidden until you drag a card (display controlled by JS) -->
|
||||||
|
<div id="sidebarDropArea" class="drop-target-sidebar"></div>
|
||||||
|
<!-- Main Column -->
|
||||||
|
<div id="mainColumn" class="main-column">
|
||||||
|
<div class="container-fluid">
|
||||||
|
<!-- Login Form (unchanged) -->
|
||||||
|
<div class="row" id="loginForm">
|
||||||
|
<div class="col-12">
|
||||||
|
<form id="authForm" method="post">
|
||||||
|
<div class="form-group">
|
||||||
|
<label for="loginUsername" data-i18n-key="user">User:</label>
|
||||||
|
<input type="text" class="form-control" id="loginUsername" name="username" required />
|
||||||
|
</div>
|
||||||
|
<div class="form-group">
|
||||||
|
<label for="loginPassword" data-i18n-key="password">Password:</label>
|
||||||
|
<input type="password" class="form-control" id="loginPassword" name="password" required />
|
||||||
|
</div>
|
||||||
|
<button type="submit" class="btn btn-primary btn-block btn-login" data-i18n-key="login">Login</button>
|
||||||
|
<div class="form-group remember-me-container">
|
||||||
|
<input type="checkbox" id="rememberMeCheckbox" name="remember_me" />
|
||||||
|
<label for="rememberMeCheckbox" data-i18n-key="remember_me">Remember me</label>
|
||||||
|
</div>
|
||||||
|
</form>
|
||||||
|
<!-- OIDC Login Option -->
|
||||||
|
<div class="text-center mt-3">
|
||||||
|
<button id="oidcLoginBtn" class="btn btn-secondary" data-i18n-key="login_oidc">Login with OIDC</button>
|
||||||
|
</div>
|
||||||
|
<!-- Basic HTTP Login Option -->
|
||||||
|
<div class="text-center mt-3">
|
||||||
|
<a href="/public/api/auth/login_basic.php" class="btn btn-secondary" data-i18n-key="basic_http_login">Use Basic HTTP
|
||||||
|
Login</a>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<!-- Main Operations: Upload and Folder Management -->
|
||||||
|
<div id="mainOperations">
|
||||||
|
<div class="container" style="max-width: 1400px; margin: 0 auto;">
|
||||||
|
<!-- Top Zone: Two columns (60% and 40%) -->
|
||||||
|
<div id="uploadFolderRow" class="row">
|
||||||
|
<!-- Left Column (60% for Upload Card) -->
|
||||||
|
<div id="leftCol" class="col-md-7" style="display: flex; justify-content: center;">
|
||||||
|
<div id="uploadCard" class="card" style="width: 100%;">
|
||||||
|
<div class="card-header" data-i18n-key="upload_header">Upload Files/Folders</div>
|
||||||
|
<div class="card-body d-flex flex-column">
|
||||||
|
<form id="uploadFileForm" method="post" enctype="multipart/form-data" class="d-flex flex-column">
|
||||||
|
<div class="form-group flex-grow-1" style="margin-bottom: 1rem;">
|
||||||
|
<div id="uploadDropArea"
|
||||||
|
style="border:2px dashed #ccc; padding:20px; cursor:pointer; display:flex; flex-direction:column; justify-content:center; align-items:center; position:relative;">
|
||||||
|
<span data-i18n-key="upload_instruction">Drop files/folders here or click 'Choose
|
||||||
|
Files'</span>
|
||||||
|
<br />
|
||||||
|
<input type="file" id="file" name="file[]" class="form-control-file" multiple
|
||||||
|
style="opacity:0; position:absolute; width:1px; height:1px;" />
|
||||||
|
<button type="button" id="customChooseBtn" data-i18n-key="choose_files">Choose Files</button>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
<button type="submit" id="uploadBtn" class="btn btn-primary d-block mx-auto"
|
||||||
|
data-i18n-key="upload">Upload</button>
|
||||||
|
<div id="uploadProgressContainer"></div>
|
||||||
|
</form>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
<!-- Right Column (40% for Folder Management Card) -->
|
||||||
|
<div id="rightCol" class="col-md-5" style="display: flex; justify-content: center;">
|
||||||
|
<div id="folderManagementCard" class="card" style="width: 100%; position: relative;">
|
||||||
|
<div class="card-header" style="display: flex; justify-content: space-between; align-items: center;">
|
||||||
|
<span data-i18n-key="folder_navigation">Folder Navigation & Management</span>
|
||||||
|
<button id="folderHelpBtn" class="btn btn-link" data-i18n-title="folder_help"
|
||||||
|
style="padding: 0; border: none; background: none;">
|
||||||
|
<i class="material-icons folder-help-icon" style="font-size: 24px;">info</i>
|
||||||
|
</button>
|
||||||
|
</div>
|
||||||
|
<div class="card-body custom-folder-card-body">
|
||||||
|
<div class="form-group d-flex align-items-top" style="padding-top:0; margin-bottom:0;">
|
||||||
|
<div id="folderTreeContainer"></div>
|
||||||
|
</div>
|
||||||
|
<div class="folder-actions mt-3">
|
||||||
|
<button id="createFolderBtn" class="btn btn-primary" data-i18n-title="create_folder">
|
||||||
|
<i class="material-icons">create_new_folder</i>
|
||||||
|
</button>
|
||||||
|
<div id="createFolderModal" class="modal">
|
||||||
|
<div class="modal-content">
|
||||||
|
<h4 data-i18n-key="create_folder_title">Create Folder</h4>
|
||||||
|
<input type="text" id="newFolderName" class="form-control"
|
||||||
|
data-i18n-placeholder="enter_folder_name" placeholder="Enter folder name"
|
||||||
|
style="margin-top:10px;" />
|
||||||
|
<div style="margin-top:15px; text-align:right;">
|
||||||
|
<button id="cancelCreateFolder" class="btn btn-secondary"
|
||||||
|
data-i18n-key="cancel">Cancel</button>
|
||||||
|
<button id="submitCreateFolder" class="btn btn-primary"
|
||||||
|
data-i18n-key="create">Create</button>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
<button id="renameFolderBtn" class="btn btn-warning ml-2" data-i18n-title="rename_folder">
|
||||||
|
<i class="material-icons">drive_file_rename_outline</i>
|
||||||
|
</button>
|
||||||
|
<div id="renameFolderModal" class="modal">
|
||||||
|
<div class="modal-content">
|
||||||
|
<h4 data-i18n-key="rename_folder_title">Rename Folder</h4>
|
||||||
|
<input type="text" id="newRenameFolderName" class="form-control"
|
||||||
|
data-i18n-placeholder="rename_folder_placeholder" placeholder="Enter new folder name"
|
||||||
|
style="margin-top:10px;" />
|
||||||
|
<div style="margin-top:15px; text-align:right;">
|
||||||
|
<button id="cancelRenameFolder" class="btn btn-secondary"
|
||||||
|
data-i18n-key="cancel">Cancel</button>
|
||||||
|
<button id="submitRenameFolder" class="btn btn-primary"
|
||||||
|
data-i18n-key="rename">Rename</button>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<button id="shareFolderBtn" class="btn btn-secondary ml-2" data-i18n-title="share_folder">
|
||||||
|
<i class="material-icons">share</i>
|
||||||
|
</button>
|
||||||
|
<button id="deleteFolderBtn" class="btn btn-danger ml-2" data-i18n-title="delete_folder">
|
||||||
|
<i class="material-icons">delete</i>
|
||||||
|
</button>
|
||||||
|
<div id="deleteFolderModal" class="modal">
|
||||||
|
<div class="modal-content">
|
||||||
|
<h4 data-i18n-key="delete_folder_title">Delete Folder</h4>
|
||||||
|
<p id="deleteFolderMessage" data-i18n-key="delete_folder_message">Are you sure you want to
|
||||||
|
delete this folder?</p>
|
||||||
|
<div style="margin-top:15px; text-align:right;">
|
||||||
|
<button id="cancelDeleteFolder" class="btn btn-secondary"
|
||||||
|
data-i18n-key="cancel">Cancel</button>
|
||||||
|
<button id="confirmDeleteFolder" class="btn btn-danger"
|
||||||
|
data-i18n-key="delete">Delete</button>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
<div id="folderHelpTooltip" class="folder-help-tooltip"
|
||||||
|
style="display: none; position: absolute; top: 50px; right: 15px; background: #fff; border: 1px solid #ccc; padding: 10px; z-index: 1000; box-shadow: 2px 2px 6px rgba(0,0,0,0.2);">
|
||||||
|
<ul class="folder-help-list" style="margin: 0; padding-left: 20px;">
|
||||||
|
<li data-i18n-key="folder_help_item_1">Click on a folder in the tree to view its files.</li>
|
||||||
|
<li data-i18n-key="folder_help_item_2">Use [-] to collapse and [+] to expand folders.</li>
|
||||||
|
<li data-i18n-key="folder_help_item_3">Select a folder and click "Create Folder" to add a
|
||||||
|
subfolder.</li>
|
||||||
|
<li data-i18n-key="folder_help_item_4">To rename or delete a folder, select it and then click
|
||||||
|
the appropriate button.</li>
|
||||||
|
</ul>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</div> <!-- end uploadFolderRow -->
|
||||||
|
</div> <!-- end container -->
|
||||||
|
</div> <!-- end mainOperations -->
|
||||||
|
|
||||||
|
<!-- File List Section -->
|
||||||
|
<div id="fileListContainer" style="display: none;">
|
||||||
|
<h2 id="fileListTitle" data-i18n-key="file_list_title">Files in (Root)</h2>
|
||||||
|
<div id="fileListActions" class="file-list-actions">
|
||||||
|
<button id="deleteSelectedBtn" class="btn action-btn" style="display: none;"
|
||||||
|
data-i18n-key="delete_files">Delete Files</button>
|
||||||
|
<div id="deleteFilesModal" class="modal">
|
||||||
|
<div class="modal-content">
|
||||||
|
<h4 data-i18n-key="delete_selected_files_title">Delete Selected Files</h4>
|
||||||
|
<p id="deleteFilesMessage" data-i18n-key="delete_files_message">Are you sure you want to delete the
|
||||||
|
selected files?</p>
|
||||||
|
<div class="modal-footer">
|
||||||
|
<button id="cancelDeleteFiles" class="btn btn-secondary" data-i18n-key="cancel">Cancel</button>
|
||||||
|
<button id="confirmDeleteFiles" class="btn btn-danger" data-i18n-key="delete">Delete</button>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
<button id="copySelectedBtn" class="btn action-btn" style="display: none;" disabled
|
||||||
|
data-i18n-key="copy_files">Copy Files</button>
|
||||||
|
<div id="copyFilesModal" class="modal">
|
||||||
|
<div class="modal-content">
|
||||||
|
<h4 data-i18n-key="copy_files_title">Copy Selected Files</h4>
|
||||||
|
<p id="copyFilesMessage" data-i18n-key="copy_files_message">Select a target folder for copying the
|
||||||
|
selected files:</p>
|
||||||
|
<select id="copyTargetFolder" class="form-control modal-input"></select>
|
||||||
|
<div class="modal-footer">
|
||||||
|
<button id="cancelCopyFiles" class="btn btn-secondary" data-i18n-key="cancel">Cancel</button>
|
||||||
|
<button id="confirmCopyFiles" class="btn btn-primary" data-i18n-key="copy">Copy</button>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
<button id="moveSelectedBtn" class="btn action-btn" style="display: none;" disabled
|
||||||
|
data-i18n-key="move_files">Move Files</button>
|
||||||
|
<div id="moveFilesModal" class="modal">
|
||||||
|
<div class="modal-content">
|
||||||
|
<h4 data-i18n-key="move_files_title">Move Selected Files</h4>
|
||||||
|
<p id="moveFilesMessage" data-i18n-key="move_files_message">Select a target folder for moving the
|
||||||
|
selected files:</p>
|
||||||
|
<select id="moveTargetFolder" class="form-control modal-input"></select>
|
||||||
|
<div class="modal-footer">
|
||||||
|
<button id="cancelMoveFiles" class="btn btn-secondary" data-i18n-key="cancel">Cancel</button>
|
||||||
|
<button id="confirmMoveFiles" class="btn btn-primary" data-i18n-key="move">Move</button>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
<button id="downloadZipBtn" class="btn action-btn" style="display: none;" disabled
|
||||||
|
data-i18n-key="download_zip">Download ZIP</button>
|
||||||
|
<button id="extractZipBtn" class="btn btn-sm btn-info" data-i18n-title="extract_zip"
|
||||||
|
data-i18n-key="extract_zip_button">Extract Zip</button>
|
||||||
|
<div id="downloadZipModal" class="modal" style="display:none;">
|
||||||
|
<div class="modal-content">
|
||||||
|
<h4 data-i18n-key="download_zip_title">Download Selected Files as Zip</h4>
|
||||||
|
<p data-i18n-key="download_zip_prompt">Enter a name for the zip file:</p>
|
||||||
|
<input type="text" id="zipFileNameInput" class="form-control" data-i18n-placeholder="zip_placeholder"
|
||||||
|
placeholder="files.zip" />
|
||||||
|
<div class="modal-footer" style="margin-top:15px; text-align:right;">
|
||||||
|
<button id="cancelDownloadZip" class="btn btn-secondary" data-i18n-key="cancel">Cancel</button>
|
||||||
|
<button id="confirmDownloadZip" class="btn btn-primary" data-i18n-key="download">Download</button>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
<div id="fileList"></div>
|
||||||
|
</div>
|
||||||
|
</div> <!-- end container-fluid -->
|
||||||
|
</div> <!-- end mainColumn -->
|
||||||
|
</div> <!-- end main-wrapper -->
|
||||||
|
|
||||||
|
<!-- Download Progress Modal -->
|
||||||
|
<div id="downloadProgressModal" class="modal" style="display: none;">
|
||||||
|
<div class="modal-content" style="text-align: center; padding: 20px;">
|
||||||
|
<!-- Material icon spinner with a dedicated class -->
|
||||||
|
<span class="material-icons download-spinner">autorenew</span>
|
||||||
|
<p data-i18n-key="preparing_download">Preparing your download...</p>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<!-- Single File Download Modal -->
|
||||||
|
<div id="downloadFileModal" class="modal" style="display: none;">
|
||||||
|
<div class="modal-content" style="text-align: center; padding: 20px;">
|
||||||
|
<h4 data-i18n-key="download_file">Download File</h4>
|
||||||
|
<p data-i18n-key="confirm_or_change_filename">Confirm or change the download file name:</p>
|
||||||
|
<input type="text" id="downloadFileNameInput" class="form-control" data-i18n-placeholder="filename" placeholder="Filename" />
|
||||||
|
<div style="margin-top: 15px; text-align: right;">
|
||||||
|
<button id="cancelDownloadFile" class="btn btn-secondary"
|
||||||
|
onclick="document.getElementById('downloadFileModal').style.display = 'none';"
|
||||||
|
data-i18n-key="cancel">Cancel</button>
|
||||||
|
<button id="confirmSingleDownloadButton" class="btn btn-primary"
|
||||||
|
onclick="confirmSingleDownload()"
|
||||||
|
data-i18n-key="download">Download</button>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<!-- Change Password, Add User, Remove User, Rename File, and Custom Confirm Modals (unchanged) -->
|
||||||
|
<div id="changePasswordModal" class="modal" style="display:none;">
|
||||||
|
<div class="modal-content" style="max-width:400px; margin:auto;">
|
||||||
|
<span id="closeChangePasswordModal" style="position:absolute; top:10px; right:10px; cursor:pointer; font-size:24px;">×</span>
|
||||||
|
<h3 data-i18n-key="change_password_title">Change Password</h3>
|
||||||
|
<input type="password" id="oldPassword" class="form-control" data-i18n-placeholder="old_password"
|
||||||
|
placeholder="Old Password" style="width:100%; margin: 5px 0;" />
|
||||||
|
<input type="password" id="newPassword" class="form-control" data-i18n-placeholder="new_password"
|
||||||
|
placeholder="New Password" style="width:100%; margin: 5px 0;" />
|
||||||
|
<input type="password" id="confirmPassword" class="form-control" data-i18n-placeholder="confirm_new_password"
|
||||||
|
placeholder="Confirm New Password" style="width:100%; margin: 5px 0;" />
|
||||||
|
<button id="saveNewPasswordBtn" class="btn btn-primary" data-i18n-key="save" style="width:100%;">Save</button>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
<div id="addUserModal" class="modal">
|
||||||
|
<div class="modal-content">
|
||||||
|
<h3 data-i18n-key="create_new_user_title">Create New User</h3>
|
||||||
|
<label for="newUsername" data-i18n-key="username">Username:</label>
|
||||||
|
<input type="text" id="newUsername" class="form-control" />
|
||||||
|
<label for="addUserPassword" data-i18n-key="password">Password:</label>
|
||||||
|
<input type="password" id="addUserPassword" class="form-control" />
|
||||||
|
<div id="adminCheckboxContainer">
|
||||||
|
<input type="checkbox" id="isAdmin" />
|
||||||
|
<label for="isAdmin" data-i18n-key="grant_admin">Grant Admin Access</label>
|
||||||
|
</div>
|
||||||
|
<div class="button-container">
|
||||||
|
<button id="cancelUserBtn" class="btn btn-secondary" data-i18n-key="cancel">Cancel</button>
|
||||||
|
<button id="saveUserBtn" class="btn btn-primary" data-i18n-key="save_user">Save User</button>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
<div id="removeUserModal" class="modal">
|
||||||
|
<div class="modal-content">
|
||||||
|
<h3 data-i18n-key="remove_user_title">Remove User</h3>
|
||||||
|
<label for="removeUsernameSelect" data-i18n-key="select_user_remove">Select a user to remove:</label>
|
||||||
|
<select id="removeUsernameSelect" class="form-control"></select>
|
||||||
|
<div class="button-container">
|
||||||
|
<button id="cancelRemoveUserBtn" class="btn btn-secondary" data-i18n-key="cancel">Cancel</button>
|
||||||
|
<button id="deleteUserBtn" class="btn btn-danger" data-i18n-key="delete_user">Delete User</button>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
<div id="renameFileModal" class="modal">
|
||||||
|
<div class="modal-content">
|
||||||
|
<h4 data-i18n-key="rename_file_title">Rename File</h4>
|
||||||
|
<input type="text" id="newFileName" class="form-control" data-i18n-placeholder="rename_file_placeholder"
|
||||||
|
placeholder="Enter new file name" style="margin-top:10px;" />
|
||||||
|
<div style="margin-top:15px; text-align:right;">
|
||||||
|
<button id="cancelRenameFile" class="btn btn-secondary" data-i18n-key="cancel">Cancel</button>
|
||||||
|
<button id="submitRenameFile" class="btn btn-primary" data-i18n-key="rename">Rename</button>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
<div id="customConfirmModal" class="modal" style="display:none;">
|
||||||
|
<div class="modal-content">
|
||||||
|
<p id="confirmMessage"></p>
|
||||||
|
<div class="modal-actions">
|
||||||
|
<button id="confirmYesBtn" class="btn btn-primary" data-i18n-key="yes">Yes</button>
|
||||||
|
<button id="confirmNoBtn" class="btn btn-secondary" data-i18n-key="no">No</button>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
<script type="module" src="js/main.js"></script>
|
||||||
|
</body>
|
||||||
|
|
||||||
|
</html>
|
||||||
@@ -51,7 +51,7 @@ function openTOTPLoginModal() {
|
|||||||
const isFormLogin = Boolean(window.__lastLoginData);
|
const isFormLogin = Boolean(window.__lastLoginData);
|
||||||
if (!isFormLogin) {
|
if (!isFormLogin) {
|
||||||
// disable Basic‑Auth link
|
// disable Basic‑Auth link
|
||||||
const basicLink = document.querySelector("a[href='login_basic.php']");
|
const basicLink = document.querySelector("a[href='api/auth/login_basic.php']");
|
||||||
if (basicLink) {
|
if (basicLink) {
|
||||||
basicLink.style.pointerEvents = 'none';
|
basicLink.style.pointerEvents = 'none';
|
||||||
basicLink.style.opacity = '0.5';
|
basicLink.style.opacity = '0.5';
|
||||||
@@ -78,8 +78,9 @@ function updateItemsPerPageSelect() {
|
|||||||
|
|
||||||
function updateLoginOptionsUI({ disableFormLogin, disableBasicAuth, disableOIDCLogin }) {
|
function updateLoginOptionsUI({ disableFormLogin, disableBasicAuth, disableOIDCLogin }) {
|
||||||
const authForm = document.getElementById("authForm");
|
const authForm = document.getElementById("authForm");
|
||||||
|
|
||||||
if (authForm) authForm.style.display = disableFormLogin ? "none" : "block";
|
if (authForm) authForm.style.display = disableFormLogin ? "none" : "block";
|
||||||
const basicAuthLink = document.querySelector("a[href='login_basic.php']");
|
const basicAuthLink = document.querySelector("a[href='api/auth/login_basic.php']");
|
||||||
if (basicAuthLink) basicAuthLink.style.display = disableBasicAuth ? "none" : "inline-block";
|
if (basicAuthLink) basicAuthLink.style.display = disableBasicAuth ? "none" : "inline-block";
|
||||||
const oidcLoginBtn = document.getElementById("oidcLoginBtn");
|
const oidcLoginBtn = document.getElementById("oidcLoginBtn");
|
||||||
if (oidcLoginBtn) oidcLoginBtn.style.display = disableOIDCLogin ? "none" : "inline-block";
|
if (oidcLoginBtn) oidcLoginBtn.style.display = disableOIDCLogin ? "none" : "inline-block";
|
||||||
@@ -94,19 +95,17 @@ function updateLoginOptionsUIFromStorage() {
|
|||||||
}
|
}
|
||||||
|
|
||||||
export function loadAdminConfigFunc() {
|
export function loadAdminConfigFunc() {
|
||||||
return fetch("getConfig.php", { credentials: "include" })
|
return fetch("api/admin/getConfig.php", { credentials: "include" })
|
||||||
.then(response => response.json())
|
.then(response => response.json())
|
||||||
.then(config => {
|
.then(config => {
|
||||||
// Save header_title into localStorage (if needed)
|
|
||||||
localStorage.setItem("headerTitle", config.header_title || "FileRise");
|
localStorage.setItem("headerTitle", config.header_title || "FileRise");
|
||||||
|
|
||||||
// Update login options and global OTPAuth URL as before
|
// Update login options using the nested loginOptions object.
|
||||||
localStorage.setItem("disableFormLogin", config.loginOptions.disableFormLogin);
|
localStorage.setItem("disableFormLogin", config.loginOptions.disableFormLogin);
|
||||||
localStorage.setItem("disableBasicAuth", config.loginOptions.disableBasicAuth);
|
localStorage.setItem("disableBasicAuth", config.loginOptions.disableBasicAuth);
|
||||||
localStorage.setItem("disableOIDCLogin", config.loginOptions.disableOIDCLogin);
|
localStorage.setItem("disableOIDCLogin", config.loginOptions.disableOIDCLogin);
|
||||||
localStorage.setItem("globalOtpauthUrl", config.globalOtpauthUrl || "otpauth://totp/{label}?secret={secret}&issuer=FileRise");
|
localStorage.setItem("globalOtpauthUrl", config.globalOtpauthUrl || "otpauth://totp/{label}?secret={secret}&issuer=FileRise");
|
||||||
|
|
||||||
// Update the UI for login options
|
|
||||||
updateLoginOptionsUIFromStorage();
|
updateLoginOptionsUIFromStorage();
|
||||||
|
|
||||||
const headerTitleElem = document.querySelector(".header-title h1");
|
const headerTitleElem = document.querySelector(".header-title h1");
|
||||||
@@ -115,7 +114,7 @@ export function loadAdminConfigFunc() {
|
|||||||
}
|
}
|
||||||
})
|
})
|
||||||
.catch(() => {
|
.catch(() => {
|
||||||
// Fallback defaults in case of error
|
// Use defaults.
|
||||||
localStorage.setItem("headerTitle", "FileRise");
|
localStorage.setItem("headerTitle", "FileRise");
|
||||||
localStorage.setItem("disableFormLogin", "false");
|
localStorage.setItem("disableFormLogin", "false");
|
||||||
localStorage.setItem("disableBasicAuth", "false");
|
localStorage.setItem("disableBasicAuth", "false");
|
||||||
@@ -214,7 +213,7 @@ function updateAuthenticatedUI(data) {
|
|||||||
}
|
}
|
||||||
|
|
||||||
function checkAuthentication(showLoginToast = true) {
|
function checkAuthentication(showLoginToast = true) {
|
||||||
return sendRequest("checkAuth.php")
|
return sendRequest("api/auth/checkAuth.php")
|
||||||
.then(data => {
|
.then(data => {
|
||||||
if (data.setup) {
|
if (data.setup) {
|
||||||
window.setupMode = true;
|
window.setupMode = true;
|
||||||
@@ -250,12 +249,12 @@ function checkAuthentication(showLoginToast = true) {
|
|||||||
function submitLogin(data) {
|
function submitLogin(data) {
|
||||||
setLastLoginData(data);
|
setLastLoginData(data);
|
||||||
window.__lastLoginData = data;
|
window.__lastLoginData = data;
|
||||||
sendRequest("auth.php", "POST", data, { "X-CSRF-Token": window.csrfToken })
|
sendRequest("api/auth/auth.php", "POST", data, { "X-CSRF-Token": window.csrfToken })
|
||||||
.then(response => {
|
.then(response => {
|
||||||
if (response.success || response.status === "ok") {
|
if (response.success || response.status === "ok") {
|
||||||
sessionStorage.setItem("welcomeMessage", "Welcome back, " + data.username + "!");
|
sessionStorage.setItem("welcomeMessage", "Welcome back, " + data.username + "!");
|
||||||
// Fetch and update permissions, then reload.
|
// Fetch and update permissions, then reload.
|
||||||
sendRequest("getUserPermissions.php", "GET")
|
sendRequest("api/getUserPermissions.php", "GET")
|
||||||
.then(permissionData => {
|
.then(permissionData => {
|
||||||
if (permissionData && typeof permissionData === "object") {
|
if (permissionData && typeof permissionData === "object") {
|
||||||
localStorage.setItem("folderOnly", permissionData.folderOnly ? "true" : "false");
|
localStorage.setItem("folderOnly", permissionData.folderOnly ? "true" : "false");
|
||||||
@@ -313,9 +312,11 @@ function closeRemoveUserModal() {
|
|||||||
}
|
}
|
||||||
|
|
||||||
function loadUserList() {
|
function loadUserList() {
|
||||||
fetch("getUsers.php", { credentials: "include" })
|
// Updated path: from "getUsers.php" to "api/getUsers.php"
|
||||||
|
fetch("api/getUsers.php", { credentials: "include" })
|
||||||
.then(response => response.json())
|
.then(response => response.json())
|
||||||
.then(data => {
|
.then(data => {
|
||||||
|
// Assuming the endpoint returns an array of users.
|
||||||
const users = Array.isArray(data) ? data : (data.users || []);
|
const users = Array.isArray(data) ? data : (data.users || []);
|
||||||
const selectElem = document.getElementById("removeUsernameSelect");
|
const selectElem = document.getElementById("removeUsernameSelect");
|
||||||
selectElem.innerHTML = "";
|
selectElem.innerHTML = "";
|
||||||
@@ -330,7 +331,7 @@ function loadUserList() {
|
|||||||
closeRemoveUserModal();
|
closeRemoveUserModal();
|
||||||
}
|
}
|
||||||
})
|
})
|
||||||
.catch(() => { });
|
.catch(() => { /* handle errors if needed */ });
|
||||||
}
|
}
|
||||||
window.loadUserList = loadUserList;
|
window.loadUserList = loadUserList;
|
||||||
|
|
||||||
@@ -353,7 +354,7 @@ function initAuth() {
|
|||||||
});
|
});
|
||||||
}
|
}
|
||||||
document.getElementById("logoutBtn").addEventListener("click", function () {
|
document.getElementById("logoutBtn").addEventListener("click", function () {
|
||||||
fetch("logout.php", {
|
fetch("api/auth/logout.php", {
|
||||||
method: "POST",
|
method: "POST",
|
||||||
credentials: "include",
|
credentials: "include",
|
||||||
headers: { "X-CSRF-Token": window.csrfToken }
|
headers: { "X-CSRF-Token": window.csrfToken }
|
||||||
@@ -372,7 +373,7 @@ function initAuth() {
|
|||||||
showToast("Username and password are required!");
|
showToast("Username and password are required!");
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
let url = "addUser.php";
|
let url = "api/addUser.php";
|
||||||
if (window.setupMode) url += "?setup=1";
|
if (window.setupMode) url += "?setup=1";
|
||||||
fetch(url, {
|
fetch(url, {
|
||||||
method: "POST",
|
method: "POST",
|
||||||
@@ -407,7 +408,7 @@ function initAuth() {
|
|||||||
}
|
}
|
||||||
const confirmed = await showCustomConfirmModal("Are you sure you want to delete user " + usernameToRemove + "?");
|
const confirmed = await showCustomConfirmModal("Are you sure you want to delete user " + usernameToRemove + "?");
|
||||||
if (!confirmed) return;
|
if (!confirmed) return;
|
||||||
fetch("removeUser.php", {
|
fetch("api/removeUser.php", {
|
||||||
method: "POST",
|
method: "POST",
|
||||||
credentials: "include",
|
credentials: "include",
|
||||||
headers: { "Content-Type": "application/json", "X-CSRF-Token": window.csrfToken },
|
headers: { "Content-Type": "application/json", "X-CSRF-Token": window.csrfToken },
|
||||||
@@ -446,7 +447,7 @@ function initAuth() {
|
|||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
const data = { oldPassword, newPassword, confirmPassword };
|
const data = { oldPassword, newPassword, confirmPassword };
|
||||||
fetch("changePassword.php", {
|
fetch("api/changePassword.php", {
|
||||||
method: "POST",
|
method: "POST",
|
||||||
credentials: "include",
|
credentials: "include",
|
||||||
headers: { "Content-Type": "application/json", "X-CSRF-Token": window.csrfToken },
|
headers: { "Content-Type": "application/json", "X-CSRF-Token": window.csrfToken },
|
||||||
@@ -479,7 +480,7 @@ document.addEventListener("DOMContentLoaded", function () {
|
|||||||
const oidcLoginBtn = document.getElementById("oidcLoginBtn");
|
const oidcLoginBtn = document.getElementById("oidcLoginBtn");
|
||||||
if (oidcLoginBtn) {
|
if (oidcLoginBtn) {
|
||||||
oidcLoginBtn.addEventListener("click", () => {
|
oidcLoginBtn.addEventListener("click", () => {
|
||||||
window.location.href = "auth.php?oidc=initiate";
|
window.location.href = "api/auth/auth.php?oidc=initiate";
|
||||||
});
|
});
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -84,7 +84,7 @@ export function openTOTPLoginModal() {
|
|||||||
showToast(t("please_enter_recovery_code"));
|
showToast(t("please_enter_recovery_code"));
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
fetch("totp_recover.php", {
|
fetch("api/totp_recover.php", {
|
||||||
method: "POST",
|
method: "POST",
|
||||||
credentials: "include",
|
credentials: "include",
|
||||||
headers: {
|
headers: {
|
||||||
@@ -113,7 +113,7 @@ export function openTOTPLoginModal() {
|
|||||||
totpInput.addEventListener("input", function () {
|
totpInput.addEventListener("input", function () {
|
||||||
const code = this.value.trim();
|
const code = this.value.trim();
|
||||||
if (code.length === 6) {
|
if (code.length === 6) {
|
||||||
fetch("totp_verify.php", {
|
fetch("api/totp_verify.php", {
|
||||||
method: "POST",
|
method: "POST",
|
||||||
credentials: "include",
|
credentials: "include",
|
||||||
headers: {
|
headers: {
|
||||||
@@ -229,7 +229,7 @@ export function openUserPanel() {
|
|||||||
totpCheckbox.addEventListener("change", function () {
|
totpCheckbox.addEventListener("change", function () {
|
||||||
localStorage.setItem("userTOTPEnabled", this.checked ? "true" : "false");
|
localStorage.setItem("userTOTPEnabled", this.checked ? "true" : "false");
|
||||||
const enabled = this.checked;
|
const enabled = this.checked;
|
||||||
fetch("updateUserPanel.php", {
|
fetch("api/updateUserPanel.php", {
|
||||||
method: "POST",
|
method: "POST",
|
||||||
credentials: "include",
|
credentials: "include",
|
||||||
headers: {
|
headers: {
|
||||||
@@ -353,7 +353,7 @@ export function openTOTPModal() {
|
|||||||
showToast(t("please_enter_valid_code"));
|
showToast(t("please_enter_valid_code"));
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
fetch("totp_verify.php", {
|
fetch("api/totp_verify.php", {
|
||||||
method: "POST",
|
method: "POST",
|
||||||
credentials: "include",
|
credentials: "include",
|
||||||
headers: {
|
headers: {
|
||||||
@@ -367,7 +367,7 @@ export function openTOTPModal() {
|
|||||||
if (result.status === 'ok') {
|
if (result.status === 'ok') {
|
||||||
showToast(t("totp_enabled_successfully"));
|
showToast(t("totp_enabled_successfully"));
|
||||||
// After successful TOTP verification, fetch the recovery code
|
// After successful TOTP verification, fetch the recovery code
|
||||||
fetch("totp_saveCode.php", {
|
fetch("api/totp_saveCode.php", {
|
||||||
method: "POST",
|
method: "POST",
|
||||||
credentials: "include",
|
credentials: "include",
|
||||||
headers: {
|
headers: {
|
||||||
@@ -431,7 +431,7 @@ export function openTOTPModal() {
|
|||||||
}
|
}
|
||||||
|
|
||||||
function loadTOTPQRCode() {
|
function loadTOTPQRCode() {
|
||||||
fetch("totp_setup.php", {
|
fetch("api/totp_setup.php", {
|
||||||
method: "GET",
|
method: "GET",
|
||||||
credentials: "include",
|
credentials: "include",
|
||||||
headers: {
|
headers: {
|
||||||
@@ -470,7 +470,7 @@ export function closeTOTPModal(disable = true) {
|
|||||||
localStorage.setItem("userTOTPEnabled", "false");
|
localStorage.setItem("userTOTPEnabled", "false");
|
||||||
}
|
}
|
||||||
// Call endpoint to remove the TOTP secret from the user's record
|
// Call endpoint to remove the TOTP secret from the user's record
|
||||||
fetch("totp_disable.php", {
|
fetch("api/totp_disable.php", {
|
||||||
method: "POST",
|
method: "POST",
|
||||||
credentials: "include",
|
credentials: "include",
|
||||||
headers: {
|
headers: {
|
||||||
@@ -556,7 +556,7 @@ function showCustomConfirmModal(message) {
|
|||||||
}
|
}
|
||||||
|
|
||||||
export function openAdminPanel() {
|
export function openAdminPanel() {
|
||||||
fetch("getConfig.php", { credentials: "include" })
|
fetch("api/admin/getConfig.php", { credentials: "include" })
|
||||||
.then(response => response.json())
|
.then(response => response.json())
|
||||||
.then(config => {
|
.then(config => {
|
||||||
if (config.header_title) {
|
if (config.header_title) {
|
||||||
@@ -718,7 +718,7 @@ export function openAdminPanel() {
|
|||||||
const disableBasicAuth = disableBasicAuthCheckbox.checked;
|
const disableBasicAuth = disableBasicAuthCheckbox.checked;
|
||||||
const disableOIDCLogin = disableOIDCLoginCheckbox.checked;
|
const disableOIDCLogin = disableOIDCLoginCheckbox.checked;
|
||||||
const globalOtpauthUrl = document.getElementById("globalOtpauthUrl").value.trim();
|
const globalOtpauthUrl = document.getElementById("globalOtpauthUrl").value.trim();
|
||||||
sendRequest("updateConfig.php", "POST", {
|
sendRequest("api/admin/updateConfig.php", "POST", {
|
||||||
header_title: newHeaderTitle,
|
header_title: newHeaderTitle,
|
||||||
oidc: newOIDCConfig,
|
oidc: newOIDCConfig,
|
||||||
disableFormLogin,
|
disableFormLogin,
|
||||||
@@ -891,7 +891,7 @@ export function openUserPermissionsModal() {
|
|||||||
});
|
});
|
||||||
});
|
});
|
||||||
// Send the permissionsData to the server.
|
// Send the permissionsData to the server.
|
||||||
sendRequest("updateUserPermissions.php", "POST", { permissions: permissionsData }, { "X-CSRF-Token": window.csrfToken })
|
sendRequest("api/updateUserPermissions.php", "POST", { permissions: permissionsData }, { "X-CSRF-Token": window.csrfToken })
|
||||||
.then(response => {
|
.then(response => {
|
||||||
if (response.success) {
|
if (response.success) {
|
||||||
showToast(t("user_permissions_updated_successfully"));
|
showToast(t("user_permissions_updated_successfully"));
|
||||||
@@ -917,11 +917,11 @@ function loadUserPermissionsList() {
|
|||||||
listContainer.innerHTML = "";
|
listContainer.innerHTML = "";
|
||||||
|
|
||||||
// First, fetch the current permissions from the server.
|
// First, fetch the current permissions from the server.
|
||||||
fetch("getUserPermissions.php", { credentials: "include" })
|
fetch("api/getUserPermissions.php", { credentials: "include" })
|
||||||
.then(response => response.json())
|
.then(response => response.json())
|
||||||
.then(permissionsData => {
|
.then(permissionsData => {
|
||||||
// Then, fetch the list of users.
|
// Then, fetch the list of users.
|
||||||
return fetch("getUsers.php", { credentials: "include" })
|
return fetch("api/getUsers.php", { credentials: "include" })
|
||||||
.then(response => response.json())
|
.then(response => response.json())
|
||||||
.then(usersData => {
|
.then(usersData => {
|
||||||
const users = Array.isArray(usersData) ? usersData : (usersData.users || []);
|
const users = Array.isArray(usersData) ? usersData : (usersData.users || []);
|
||||||
@@ -32,7 +32,7 @@ document.addEventListener("DOMContentLoaded", function () {
|
|||||||
const confirmDelete = document.getElementById("confirmDeleteFiles");
|
const confirmDelete = document.getElementById("confirmDeleteFiles");
|
||||||
if (confirmDelete) {
|
if (confirmDelete) {
|
||||||
confirmDelete.addEventListener("click", function () {
|
confirmDelete.addEventListener("click", function () {
|
||||||
fetch("deleteFiles.php", {
|
fetch("api/file/deleteFiles.php", {
|
||||||
method: "POST",
|
method: "POST",
|
||||||
credentials: "include",
|
credentials: "include",
|
||||||
headers: {
|
headers: {
|
||||||
@@ -111,7 +111,7 @@ export function confirmSingleDownload() {
|
|||||||
|
|
||||||
// Build the URL for download.php using GET parameters.
|
// Build the URL for download.php using GET parameters.
|
||||||
const folder = window.currentFolder || "root";
|
const folder = window.currentFolder || "root";
|
||||||
const downloadURL = "download.php?folder=" + encodeURIComponent(folder) +
|
const downloadURL = "api/file/download.php?folder=" + encodeURIComponent(folder) +
|
||||||
"&file=" + encodeURIComponent(window.singleFileToDownload);
|
"&file=" + encodeURIComponent(window.singleFileToDownload);
|
||||||
|
|
||||||
fetch(downloadURL, {
|
fetch(downloadURL, {
|
||||||
@@ -178,7 +178,7 @@ export function handleExtractZipSelected(e) {
|
|||||||
// Show the progress modal.
|
// Show the progress modal.
|
||||||
document.getElementById("downloadProgressModal").style.display = "block";
|
document.getElementById("downloadProgressModal").style.display = "block";
|
||||||
|
|
||||||
fetch("extractZip.php", {
|
fetch("api/file/extractZip.php", {
|
||||||
method: "POST",
|
method: "POST",
|
||||||
credentials: "include",
|
credentials: "include",
|
||||||
headers: {
|
headers: {
|
||||||
@@ -245,7 +245,7 @@ document.addEventListener("DOMContentLoaded", function () {
|
|||||||
console.log("Download confirmed. Showing progress modal.");
|
console.log("Download confirmed. Showing progress modal.");
|
||||||
document.getElementById("downloadProgressModal").style.display = "block";
|
document.getElementById("downloadProgressModal").style.display = "block";
|
||||||
const folder = window.currentFolder || "root";
|
const folder = window.currentFolder || "root";
|
||||||
fetch("downloadZip.php", {
|
fetch("api/file/downloadZip.php", {
|
||||||
method: "POST",
|
method: "POST",
|
||||||
credentials: "include",
|
credentials: "include",
|
||||||
headers: {
|
headers: {
|
||||||
@@ -309,7 +309,7 @@ export async function loadCopyMoveFolderListForModal(dropdownId) {
|
|||||||
if (window.userFolderOnly) {
|
if (window.userFolderOnly) {
|
||||||
const username = localStorage.getItem("username") || "root";
|
const username = localStorage.getItem("username") || "root";
|
||||||
try {
|
try {
|
||||||
const response = await fetch("getFolderList.php?restricted=1");
|
const response = await fetch("api/folder/getFolderList.php?restricted=1");
|
||||||
let folders = await response.json();
|
let folders = await response.json();
|
||||||
if (Array.isArray(folders) && folders.length && typeof folders[0] === "object" && folders[0].folder) {
|
if (Array.isArray(folders) && folders.length && typeof folders[0] === "object" && folders[0].folder) {
|
||||||
folders = folders.map(item => item.folder);
|
folders = folders.map(item => item.folder);
|
||||||
@@ -339,7 +339,7 @@ export async function loadCopyMoveFolderListForModal(dropdownId) {
|
|||||||
}
|
}
|
||||||
|
|
||||||
try {
|
try {
|
||||||
const response = await fetch("getFolderList.php");
|
const response = await fetch("api/folder/getFolderList.php");
|
||||||
let folders = await response.json();
|
let folders = await response.json();
|
||||||
if (Array.isArray(folders) && folders.length && typeof folders[0] === "object" && folders[0].folder) {
|
if (Array.isArray(folders) && folders.length && typeof folders[0] === "object" && folders[0].folder) {
|
||||||
folders = folders.map(item => item.folder);
|
folders = folders.map(item => item.folder);
|
||||||
@@ -397,7 +397,7 @@ document.addEventListener("DOMContentLoaded", function () {
|
|||||||
showToast("Error: Cannot copy files to the same folder.");
|
showToast("Error: Cannot copy files to the same folder.");
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
fetch("copyFiles.php", {
|
fetch("api/file/copyFiles.php", {
|
||||||
method: "POST",
|
method: "POST",
|
||||||
credentials: "include",
|
credentials: "include",
|
||||||
headers: {
|
headers: {
|
||||||
@@ -448,7 +448,7 @@ document.addEventListener("DOMContentLoaded", function () {
|
|||||||
showToast("Error: Cannot move files to the same folder.");
|
showToast("Error: Cannot move files to the same folder.");
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
fetch("moveFiles.php", {
|
fetch("api/file/moveFiles.php", {
|
||||||
method: "POST",
|
method: "POST",
|
||||||
credentials: "include",
|
credentials: "include",
|
||||||
headers: {
|
headers: {
|
||||||
@@ -514,7 +514,7 @@ document.addEventListener("DOMContentLoaded", () => {
|
|||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
const folderUsed = window.fileFolder;
|
const folderUsed = window.fileFolder;
|
||||||
fetch("renameFile.php", {
|
fetch("api/file/renameFile.php", {
|
||||||
method: "POST",
|
method: "POST",
|
||||||
credentials: "include",
|
credentials: "include",
|
||||||
headers: {
|
headers: {
|
||||||
@@ -96,7 +96,7 @@ export function folderDropHandler(event) {
|
|||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
if (!dragData || !dragData.fileName) return;
|
if (!dragData || !dragData.fileName) return;
|
||||||
fetch("moveFiles.php", {
|
fetch("api/file/moveFiles.php", {
|
||||||
method: "POST",
|
method: "POST",
|
||||||
credentials: "include",
|
credentials: "include",
|
||||||
headers: {
|
headers: {
|
||||||
@@ -160,7 +160,7 @@ export function saveFile(fileName, folder) {
|
|||||||
content: editor.getValue(),
|
content: editor.getValue(),
|
||||||
folder: folderUsed
|
folder: folderUsed
|
||||||
};
|
};
|
||||||
fetch("saveFile.php", {
|
fetch("api/file/saveFile.php", {
|
||||||
method: "POST",
|
method: "POST",
|
||||||
credentials: "include",
|
credentials: "include",
|
||||||
headers: {
|
headers: {
|
||||||
@@ -193,7 +193,7 @@ export function loadFileList(folderParam) {
|
|||||||
fileListContainer.style.visibility = "hidden";
|
fileListContainer.style.visibility = "hidden";
|
||||||
fileListContainer.innerHTML = "<div class='loader'>Loading files...</div>";
|
fileListContainer.innerHTML = "<div class='loader'>Loading files...</div>";
|
||||||
|
|
||||||
return fetch("getFileList.php?folder=" + encodeURIComponent(folder) + "&recursive=1&t=" + new Date().getTime())
|
return fetch("api/file/getFileList.php?folder=" + encodeURIComponent(folder) + "&recursive=1&t=" + new Date().getTime())
|
||||||
.then(response => {
|
.then(response => {
|
||||||
if (response.status === 401) {
|
if (response.status === 401) {
|
||||||
showToast("Session expired. Please log in again.");
|
showToast("Session expired. Please log in again.");
|
||||||
@@ -48,7 +48,7 @@ export function openShareModal(file, folder) {
|
|||||||
document.getElementById("generateShareLinkBtn").addEventListener("click", () => {
|
document.getElementById("generateShareLinkBtn").addEventListener("click", () => {
|
||||||
const expiration = document.getElementById("shareExpiration").value;
|
const expiration = document.getElementById("shareExpiration").value;
|
||||||
const password = document.getElementById("sharePassword").value;
|
const password = document.getElementById("sharePassword").value;
|
||||||
fetch("createShareLink.php", {
|
fetch("api/file/createShareLink.php", {
|
||||||
method: "POST",
|
method: "POST",
|
||||||
credentials: "include",
|
credentials: "include",
|
||||||
headers: {
|
headers: {
|
||||||
@@ -67,7 +67,7 @@ export function openShareModal(file, folder) {
|
|||||||
if (data.token) {
|
if (data.token) {
|
||||||
let shareEndpoint = document.querySelector('meta[name="share-url"]')
|
let shareEndpoint = document.querySelector('meta[name="share-url"]')
|
||||||
? document.querySelector('meta[name="share-url"]').getAttribute('content')
|
? document.querySelector('meta[name="share-url"]').getAttribute('content')
|
||||||
: (window.SHARE_URL || "share.php");
|
: (window.SHARE_URL || "api/file/share.php");
|
||||||
const shareUrl = `${shareEndpoint}?token=${encodeURIComponent(data.token)}`;
|
const shareUrl = `${shareEndpoint}?token=${encodeURIComponent(data.token)}`;
|
||||||
const displayDiv = document.getElementById("shareLinkDisplay");
|
const displayDiv = document.getElementById("shareLinkDisplay");
|
||||||
const inputField = document.getElementById("shareLinkInput");
|
const inputField = document.getElementById("shareLinkInput");
|
||||||
@@ -261,7 +261,7 @@ function removeGlobalTag(tagName) {
|
|||||||
|
|
||||||
// NEW: Save global tag removal to the server.
|
// NEW: Save global tag removal to the server.
|
||||||
function saveGlobalTagRemoval(tagName) {
|
function saveGlobalTagRemoval(tagName) {
|
||||||
fetch("saveFileTag.php", {
|
fetch("api/file/saveFileTag.php", {
|
||||||
method: "POST",
|
method: "POST",
|
||||||
credentials: "include",
|
credentials: "include",
|
||||||
headers: {
|
headers: {
|
||||||
@@ -305,7 +305,7 @@ if (localStorage.getItem('globalTags')) {
|
|||||||
|
|
||||||
// New function to load global tags from the server's persistent JSON.
|
// New function to load global tags from the server's persistent JSON.
|
||||||
export function loadGlobalTags() {
|
export function loadGlobalTags() {
|
||||||
fetch("getFileTag.php", { credentials: "include" })
|
fetch("api/file/getFileTag.php", { credentials: "include" })
|
||||||
.then(response => {
|
.then(response => {
|
||||||
if (!response.ok) {
|
if (!response.ok) {
|
||||||
// If the file doesn't exist, assume there are no global tags.
|
// If the file doesn't exist, assume there are no global tags.
|
||||||
@@ -438,7 +438,7 @@ export function saveFileTags(file, deleteGlobal = false, tagToDelete = null) {
|
|||||||
payload.deleteGlobal = true;
|
payload.deleteGlobal = true;
|
||||||
payload.tagToDelete = tagToDelete;
|
payload.tagToDelete = tagToDelete;
|
||||||
}
|
}
|
||||||
fetch("saveFileTag.php", {
|
fetch("api/file/saveFileTag.php", {
|
||||||
method: "POST",
|
method: "POST",
|
||||||
credentials: "include",
|
credentials: "include",
|
||||||
headers: {
|
headers: {
|
||||||
@@ -154,7 +154,7 @@ function breadcrumbDropHandler(e) {
|
|||||||
}
|
}
|
||||||
const filesToMove = dragData.files ? dragData.files : (dragData.fileName ? [dragData.fileName] : []);
|
const filesToMove = dragData.files ? dragData.files : (dragData.fileName ? [dragData.fileName] : []);
|
||||||
if (filesToMove.length === 0) return;
|
if (filesToMove.length === 0) return;
|
||||||
fetch("moveFiles.php", {
|
fetch("api/file/moveFiles.php", {
|
||||||
method: "POST",
|
method: "POST",
|
||||||
credentials: "include",
|
credentials: "include",
|
||||||
headers: {
|
headers: {
|
||||||
@@ -202,7 +202,7 @@ function checkUserFolderPermission() {
|
|||||||
window.currentFolder = username;
|
window.currentFolder = username;
|
||||||
return Promise.resolve(true);
|
return Promise.resolve(true);
|
||||||
}
|
}
|
||||||
return fetch("getUserPermissions.php", { credentials: "include" })
|
return fetch("api/getUserPermissions.php", { credentials: "include" })
|
||||||
.then(response => response.json())
|
.then(response => response.json())
|
||||||
.then(permissionsData => {
|
.then(permissionsData => {
|
||||||
console.log("checkUserFolderPermission: permissionsData =", permissionsData);
|
console.log("checkUserFolderPermission: permissionsData =", permissionsData);
|
||||||
@@ -302,7 +302,7 @@ function folderDropHandler(event) {
|
|||||||
}
|
}
|
||||||
const filesToMove = dragData.files ? dragData.files : (dragData.fileName ? [dragData.fileName] : []);
|
const filesToMove = dragData.files ? dragData.files : (dragData.fileName ? [dragData.fileName] : []);
|
||||||
if (filesToMove.length === 0) return;
|
if (filesToMove.length === 0) return;
|
||||||
fetch("moveFiles.php", {
|
fetch("api/file/moveFiles.php", {
|
||||||
method: "POST",
|
method: "POST",
|
||||||
credentials: "include",
|
credentials: "include",
|
||||||
headers: {
|
headers: {
|
||||||
@@ -353,7 +353,7 @@ export async function loadFolderTree(selectedFolder) {
|
|||||||
}
|
}
|
||||||
|
|
||||||
// Build fetch URL.
|
// Build fetch URL.
|
||||||
let fetchUrl = 'getFolderList.php';
|
let fetchUrl = 'api/folder/getFolderList.php';
|
||||||
if (window.userFolderOnly) {
|
if (window.userFolderOnly) {
|
||||||
fetchUrl += '?restricted=1';
|
fetchUrl += '?restricted=1';
|
||||||
}
|
}
|
||||||
@@ -547,7 +547,7 @@ document.getElementById("submitRenameFolder").addEventListener("click", function
|
|||||||
showToast("CSRF token not loaded yet! Please try again.");
|
showToast("CSRF token not loaded yet! Please try again.");
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
fetch("renameFolder.php", {
|
fetch("api/folder/renameFolder.php", {
|
||||||
method: "POST",
|
method: "POST",
|
||||||
credentials: "include",
|
credentials: "include",
|
||||||
headers: {
|
headers: {
|
||||||
@@ -592,7 +592,7 @@ attachEnterKeyListener("deleteFolderModal", "confirmDeleteFolder");
|
|||||||
document.getElementById("confirmDeleteFolder").addEventListener("click", function () {
|
document.getElementById("confirmDeleteFolder").addEventListener("click", function () {
|
||||||
const selectedFolder = window.currentFolder || "root";
|
const selectedFolder = window.currentFolder || "root";
|
||||||
const csrfToken = document.querySelector('meta[name="csrf-token"]').getAttribute('content');
|
const csrfToken = document.querySelector('meta[name="csrf-token"]').getAttribute('content');
|
||||||
fetch("deleteFolder.php", {
|
fetch("api/folder/deleteFolder.php", {
|
||||||
method: "POST",
|
method: "POST",
|
||||||
headers: {
|
headers: {
|
||||||
"Content-Type": "application/json",
|
"Content-Type": "application/json",
|
||||||
@@ -639,7 +639,7 @@ document.getElementById("submitCreateFolder").addEventListener("click", function
|
|||||||
fullFolderName = selectedFolder + "/" + folderInput;
|
fullFolderName = selectedFolder + "/" + folderInput;
|
||||||
}
|
}
|
||||||
const csrfToken = document.querySelector('meta[name="csrf-token"]').getAttribute('content');
|
const csrfToken = document.querySelector('meta[name="csrf-token"]').getAttribute('content');
|
||||||
fetch("createFolder.php", {
|
fetch("api/folder/createFolder.php", {
|
||||||
method: "POST",
|
method: "POST",
|
||||||
headers: {
|
headers: {
|
||||||
"Content-Type": "application/json",
|
"Content-Type": "application/json",
|
||||||
@@ -64,7 +64,7 @@ export function openFolderShareModal(folder) {
|
|||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
// Post to the createFolderShareLink endpoint.
|
// Post to the createFolderShareLink endpoint.
|
||||||
fetch("/createFolderShareLink.php", {
|
fetch("api/folder/createShareFolderLink.php", {
|
||||||
method: "POST",
|
method: "POST",
|
||||||
credentials: "include",
|
credentials: "include",
|
||||||
headers: {
|
headers: {
|
||||||
@@ -14,7 +14,7 @@ import { t, applyTranslations, setLocale } from './i18n.js';
|
|||||||
|
|
||||||
// Remove the retry logic version and just use loadCsrfToken directly:
|
// Remove the retry logic version and just use loadCsrfToken directly:
|
||||||
function loadCsrfToken() {
|
function loadCsrfToken() {
|
||||||
return fetch('token.php', { credentials: 'include' })
|
return fetch('api/auth/token.php', { credentials: 'include' })
|
||||||
.then(response => {
|
.then(response => {
|
||||||
if (!response.ok) {
|
if (!response.ok) {
|
||||||
throw new Error("Token fetch failed with status: " + response.status);
|
throw new Error("Token fetch failed with status: " + response.status);
|
||||||
@@ -69,7 +69,7 @@ export function setupTrashRestoreDelete() {
|
|||||||
showToast(t("no_trash_selected"));
|
showToast(t("no_trash_selected"));
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
fetch("restoreFiles.php", {
|
fetch("api/file/restoreFiles.php", {
|
||||||
method: "POST",
|
method: "POST",
|
||||||
credentials: "include",
|
credentials: "include",
|
||||||
headers: {
|
headers: {
|
||||||
@@ -109,7 +109,7 @@ export function setupTrashRestoreDelete() {
|
|||||||
showToast(t("trash_empty"));
|
showToast(t("trash_empty"));
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
fetch("restoreFiles.php", {
|
fetch("api/file/restoreFiles.php", {
|
||||||
method: "POST",
|
method: "POST",
|
||||||
credentials: "include",
|
credentials: "include",
|
||||||
headers: {
|
headers: {
|
||||||
@@ -151,7 +151,7 @@ export function setupTrashRestoreDelete() {
|
|||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
showConfirm("Are you sure you want to permanently delete the selected trash items?", () => {
|
showConfirm("Are you sure you want to permanently delete the selected trash items?", () => {
|
||||||
fetch("deleteTrashFiles.php", {
|
fetch("api/file/deleteTrashFiles.php", {
|
||||||
method: "POST",
|
method: "POST",
|
||||||
credentials: "include",
|
credentials: "include",
|
||||||
headers: {
|
headers: {
|
||||||
@@ -186,7 +186,7 @@ export function setupTrashRestoreDelete() {
|
|||||||
if (deleteAllBtn) {
|
if (deleteAllBtn) {
|
||||||
deleteAllBtn.addEventListener("click", () => {
|
deleteAllBtn.addEventListener("click", () => {
|
||||||
showConfirm("Are you sure you want to permanently delete all trash items? This action cannot be undone.", () => {
|
showConfirm("Are you sure you want to permanently delete all trash items? This action cannot be undone.", () => {
|
||||||
fetch("deleteTrashFiles.php", {
|
fetch("api/file/deleteTrashFiles.php", {
|
||||||
method: "POST",
|
method: "POST",
|
||||||
credentials: "include",
|
credentials: "include",
|
||||||
headers: {
|
headers: {
|
||||||
@@ -234,7 +234,7 @@ export function setupTrashRestoreDelete() {
|
|||||||
* Loads trash items from the server and updates the restore modal list.
|
* Loads trash items from the server and updates the restore modal list.
|
||||||
*/
|
*/
|
||||||
export function loadTrashItems() {
|
export function loadTrashItems() {
|
||||||
fetch("getTrashItems.php", { credentials: "include" })
|
fetch("api/file/getTrashItems.php", { credentials: "include" })
|
||||||
.then(response => response.json())
|
.then(response => response.json())
|
||||||
.then(trashItems => {
|
.then(trashItems => {
|
||||||
const listContainer = document.getElementById("restoreFilesList");
|
const listContainer = document.getElementById("restoreFilesList");
|
||||||
@@ -271,7 +271,7 @@ export function loadTrashItems() {
|
|||||||
* Automatically purges (permanently deletes) trash items older than 3 days.
|
* Automatically purges (permanently deletes) trash items older than 3 days.
|
||||||
*/
|
*/
|
||||||
function autoPurgeOldTrash() {
|
function autoPurgeOldTrash() {
|
||||||
fetch("getTrashItems.php", { credentials: "include" })
|
fetch("api/file/getTrashItems.php", { credentials: "include" })
|
||||||
.then(response => response.json())
|
.then(response => response.json())
|
||||||
.then(trashItems => {
|
.then(trashItems => {
|
||||||
const now = Date.now();
|
const now = Date.now();
|
||||||
@@ -279,7 +279,7 @@ function autoPurgeOldTrash() {
|
|||||||
const oldItems = trashItems.filter(item => (now - (item.trashedAt * 1000)) > threeDays);
|
const oldItems = trashItems.filter(item => (now - (item.trashedAt * 1000)) > threeDays);
|
||||||
if (oldItems.length > 0) {
|
if (oldItems.length > 0) {
|
||||||
const files = oldItems.map(item => item.trashName);
|
const files = oldItems.map(item => item.trashName);
|
||||||
fetch("deleteTrashFiles.php", {
|
fetch("api/file/deleteTrashFiles.php", {
|
||||||
method: "POST",
|
method: "POST",
|
||||||
credentials: "include",
|
credentials: "include",
|
||||||
headers: {
|
headers: {
|
||||||
@@ -126,7 +126,7 @@ function removeChunkFolderRepeatedly(identifier, csrfToken, maxAttempts = 3, int
|
|||||||
// Prefix with "resumable_" to match your PHP regex.
|
// Prefix with "resumable_" to match your PHP regex.
|
||||||
params.append('folder', 'resumable_' + identifier);
|
params.append('folder', 'resumable_' + identifier);
|
||||||
params.append('csrf_token', csrfToken);
|
params.append('csrf_token', csrfToken);
|
||||||
fetch('removeChunks.php', {
|
fetch('api/upload/removeChunks.php', {
|
||||||
method: 'POST',
|
method: 'POST',
|
||||||
credentials: 'include',
|
credentials: 'include',
|
||||||
headers: {
|
headers: {
|
||||||
@@ -405,7 +405,7 @@ const useResumable = true; // Enable resumable for file picker uploads
|
|||||||
let resumableInstance;
|
let resumableInstance;
|
||||||
function initResumableUpload() {
|
function initResumableUpload() {
|
||||||
resumableInstance = new Resumable({
|
resumableInstance = new Resumable({
|
||||||
target: "upload.php",
|
target: "api/upload/upload.php",
|
||||||
query: { folder: window.currentFolder || "root", upload_token: window.csrfToken },
|
query: { folder: window.currentFolder || "root", upload_token: window.csrfToken },
|
||||||
chunkSize: 1.5 * 1024 * 1024, // 1.5 MB chunks
|
chunkSize: 1.5 * 1024 * 1024, // 1.5 MB chunks
|
||||||
simultaneousUploads: 3,
|
simultaneousUploads: 3,
|
||||||
@@ -664,7 +664,7 @@ function submitFiles(allFiles) {
|
|||||||
}
|
}
|
||||||
});
|
});
|
||||||
|
|
||||||
xhr.open("POST", "upload.php", true);
|
xhr.open("POST", "api/upload/upload.php", true);
|
||||||
xhr.setRequestHeader("X-CSRF-Token", window.csrfToken);
|
xhr.setRequestHeader("X-CSRF-Token", window.csrfToken);
|
||||||
xhr.send(formData);
|
xhr.send(formData);
|
||||||
});
|
});
|
||||||
@@ -1,53 +0,0 @@
|
|||||||
<?php
|
|
||||||
require_once 'config.php';
|
|
||||||
header('Content-Type: application/json');
|
|
||||||
|
|
||||||
$receivedToken = isset($_POST['csrf_token']) ? trim($_POST['csrf_token']) : '';
|
|
||||||
if ($receivedToken !== $_SESSION['csrf_token']) {
|
|
||||||
http_response_code(403);
|
|
||||||
echo json_encode(["error" => "Invalid CSRF token"]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
if (!isset($_POST['folder'])) {
|
|
||||||
http_response_code(400);
|
|
||||||
echo json_encode(["error" => "No folder specified"]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
$folder = urldecode($_POST['folder']);
|
|
||||||
// The folder name should match the "resumable_" pattern exactly.
|
|
||||||
$regex = "/^resumable_" . PATTERN_FOLDER_NAME . "$/u";
|
|
||||||
if (!preg_match($regex, $folder)) {
|
|
||||||
http_response_code(400);
|
|
||||||
echo json_encode(["error" => "Invalid folder name"]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
$tempDir = rtrim(UPLOAD_DIR, '/\\') . DIRECTORY_SEPARATOR . $folder;
|
|
||||||
if (!is_dir($tempDir)) {
|
|
||||||
echo json_encode(["success" => true, "message" => "Temporary folder already removed."]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
function rrmdir($dir) {
|
|
||||||
if (!is_dir($dir)) return;
|
|
||||||
$it = new RecursiveIteratorIterator(
|
|
||||||
new RecursiveDirectoryIterator($dir, FilesystemIterator::SKIP_DOTS),
|
|
||||||
RecursiveIteratorIterator::CHILD_FIRST
|
|
||||||
);
|
|
||||||
foreach ($it as $file) {
|
|
||||||
$file->isDir() ? rmdir($file->getRealPath()) : unlink($file->getRealPath());
|
|
||||||
}
|
|
||||||
rmdir($dir);
|
|
||||||
}
|
|
||||||
|
|
||||||
rrmdir($tempDir);
|
|
||||||
|
|
||||||
if (!is_dir($tempDir)) {
|
|
||||||
echo json_encode(["success" => true, "message" => "Temporary folder removed."]);
|
|
||||||
} else {
|
|
||||||
http_response_code(500);
|
|
||||||
echo json_encode(["error" => "Failed to remove temporary folder."]);
|
|
||||||
}
|
|
||||||
?>
|
|
||||||
@@ -1,88 +0,0 @@
|
|||||||
<?php
|
|
||||||
require_once 'config.php';
|
|
||||||
header('Content-Type: application/json');
|
|
||||||
|
|
||||||
$usersFile = USERS_DIR . USERS_FILE;
|
|
||||||
$headers = array_change_key_case(getallheaders(), CASE_LOWER);
|
|
||||||
$receivedToken = isset($headers['x-csrf-token']) ? trim($headers['x-csrf-token']) : '';
|
|
||||||
if ($receivedToken !== $_SESSION['csrf_token']) {
|
|
||||||
echo json_encode(["error" => "Invalid CSRF token"]);
|
|
||||||
http_response_code(403);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Only allow admins to remove users
|
|
||||||
if (
|
|
||||||
!isset($_SESSION['authenticated']) || $_SESSION['authenticated'] !== true ||
|
|
||||||
!isset($_SESSION['isAdmin']) || $_SESSION['isAdmin'] !== true
|
|
||||||
) {
|
|
||||||
echo json_encode(["error" => "Unauthorized"]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Get input data from JSON
|
|
||||||
$data = json_decode(file_get_contents("php://input"), true);
|
|
||||||
$usernameToRemove = trim($data["username"] ?? "");
|
|
||||||
|
|
||||||
if (!$usernameToRemove) {
|
|
||||||
echo json_encode(["error" => "Username is required"]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Optional: Validate the username format (allow letters, numbers, underscores, dashes, and spaces)
|
|
||||||
if (!preg_match(REGEX_USER, $usernameToRemove)) {
|
|
||||||
echo json_encode(["error" => "Invalid username format"]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Prevent removal of the currently logged-in user
|
|
||||||
if (isset($_SESSION['username']) && $_SESSION['username'] === $usernameToRemove) {
|
|
||||||
echo json_encode(["error" => "Cannot remove yourself"]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Read existing users from the file
|
|
||||||
if (!file_exists($usersFile)) {
|
|
||||||
echo json_encode(["error" => "Users file not found"]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
$existingUsers = file($usersFile, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES);
|
|
||||||
$newUsers = [];
|
|
||||||
$userFound = false;
|
|
||||||
|
|
||||||
// Remove the user with the specified username
|
|
||||||
foreach ($existingUsers as $line) {
|
|
||||||
$parts = explode(':', trim($line));
|
|
||||||
if (count($parts) < 3) {
|
|
||||||
continue;
|
|
||||||
}
|
|
||||||
$storedUser = $parts[0];
|
|
||||||
if ($storedUser === $usernameToRemove) {
|
|
||||||
$userFound = true;
|
|
||||||
continue; // Skip this user
|
|
||||||
}
|
|
||||||
$newUsers[] = $line;
|
|
||||||
}
|
|
||||||
|
|
||||||
if (!$userFound) {
|
|
||||||
echo json_encode(["error" => "User not found"]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Write the updated list back to users.txt
|
|
||||||
file_put_contents($usersFile, implode(PHP_EOL, $newUsers) . PHP_EOL);
|
|
||||||
|
|
||||||
// Also update the userPermissions.json file
|
|
||||||
$permissionsFile = USERS_DIR . "userPermissions.json";
|
|
||||||
if (file_exists($permissionsFile)) {
|
|
||||||
$permissionsJson = file_get_contents($permissionsFile);
|
|
||||||
$permissionsArray = json_decode($permissionsJson, true);
|
|
||||||
if (is_array($permissionsArray) && isset($permissionsArray[$usernameToRemove])) {
|
|
||||||
unset($permissionsArray[$usernameToRemove]);
|
|
||||||
file_put_contents($permissionsFile, json_encode($permissionsArray, JSON_PRETTY_PRINT));
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
echo json_encode(["success" => "User removed successfully"]);
|
|
||||||
?>
|
|
||||||
114
renameFile.php
114
renameFile.php
@@ -1,114 +0,0 @@
|
|||||||
<?php
|
|
||||||
require_once 'config.php';
|
|
||||||
header('Content-Type: application/json');
|
|
||||||
header("Cache-Control: no-cache, no-store, must-revalidate");
|
|
||||||
header("Pragma: no-cache");
|
|
||||||
header("Expires: 0");
|
|
||||||
|
|
||||||
// --- CSRF Protection ---
|
|
||||||
$headers = array_change_key_case(getallheaders(), CASE_LOWER);
|
|
||||||
$receivedToken = isset($headers['x-csrf-token']) ? trim($headers['x-csrf-token']) : '';
|
|
||||||
|
|
||||||
if ($receivedToken !== $_SESSION['csrf_token']) {
|
|
||||||
echo json_encode(["error" => "Invalid CSRF token"]);
|
|
||||||
http_response_code(403);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Ensure user is authenticated
|
|
||||||
if (!isset($_SESSION['authenticated']) || $_SESSION['authenticated'] !== true) {
|
|
||||||
echo json_encode(["error" => "Unauthorized"]);
|
|
||||||
http_response_code(401);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
$username = $_SESSION['username'] ?? '';
|
|
||||||
$userPermissions = loadUserPermissions($username);
|
|
||||||
if ($username) {
|
|
||||||
$userPermissions = loadUserPermissions($username);
|
|
||||||
if (isset($userPermissions['readOnly']) && $userPermissions['readOnly'] === true) {
|
|
||||||
echo json_encode(["error" => "Read-only users are not allowed to rename files."]);
|
|
||||||
exit();
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
$data = json_decode(file_get_contents("php://input"), true);
|
|
||||||
if (!$data || !isset($data['folder']) || !isset($data['oldName']) || !isset($data['newName'])) {
|
|
||||||
echo json_encode(["error" => "Invalid input"]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
$folder = trim($data['folder']) ?: 'root';
|
|
||||||
// For subfolders, allow letters, numbers, underscores, dashes, spaces, and forward slashes.
|
|
||||||
if ($folder !== 'root' && !preg_match(REGEX_FOLDER_NAME, $folder)) {
|
|
||||||
echo json_encode(["error" => "Invalid folder name"]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
$oldName = basename(trim($data['oldName']));
|
|
||||||
$newName = basename(trim($data['newName']));
|
|
||||||
|
|
||||||
// Validate file names: allow letters, numbers, underscores, dashes, dots, parentheses, and spaces.
|
|
||||||
if (!preg_match(REGEX_FILE_NAME, $oldName) || !preg_match(REGEX_FILE_NAME, $newName)) {
|
|
||||||
echo json_encode(["error" => "Invalid file name."]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Determine the directory path based on the folder.
|
|
||||||
if ($folder !== 'root') {
|
|
||||||
$directory = rtrim(UPLOAD_DIR, '/\\') . DIRECTORY_SEPARATOR . $folder . DIRECTORY_SEPARATOR;
|
|
||||||
} else {
|
|
||||||
$directory = UPLOAD_DIR;
|
|
||||||
}
|
|
||||||
|
|
||||||
$oldPath = $directory . $oldName;
|
|
||||||
$newPath = $directory . $newName;
|
|
||||||
|
|
||||||
// Helper: Generate a unique file name if a file with the same name exists.
|
|
||||||
function getUniqueFileName($directory, $fileName) {
|
|
||||||
$fullPath = $directory . $fileName;
|
|
||||||
clearstatcache(true, $fullPath);
|
|
||||||
if (!file_exists($fullPath)) {
|
|
||||||
return $fileName;
|
|
||||||
}
|
|
||||||
$basename = pathinfo($fileName, PATHINFO_FILENAME);
|
|
||||||
$extension = pathinfo($fileName, PATHINFO_EXTENSION);
|
|
||||||
$counter = 1;
|
|
||||||
do {
|
|
||||||
$newName = $basename . " (" . $counter . ")" . ($extension ? "." . $extension : "");
|
|
||||||
$newFullPath = $directory . $newName;
|
|
||||||
clearstatcache(true, $newFullPath);
|
|
||||||
$counter++;
|
|
||||||
} while (file_exists($directory . $newName));
|
|
||||||
return $newName;
|
|
||||||
}
|
|
||||||
|
|
||||||
if (!file_exists($oldPath)) {
|
|
||||||
echo json_encode(["error" => "File does not exist"]);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// If a file with the new name exists, generate a unique name.
|
|
||||||
if (file_exists($newPath)) {
|
|
||||||
$newName = getUniqueFileName($directory, $newName);
|
|
||||||
$newPath = $directory . $newName;
|
|
||||||
}
|
|
||||||
|
|
||||||
if (rename($oldPath, $newPath)) {
|
|
||||||
// --- Update Metadata in the Folder-Specific JSON ---
|
|
||||||
$metadataKey = ($folder === 'root') ? "root" : $folder;
|
|
||||||
$metadataFile = META_DIR . str_replace(['/', '\\', ' '], '-', $metadataKey) . '_metadata.json';
|
|
||||||
|
|
||||||
if (file_exists($metadataFile)) {
|
|
||||||
$metadata = json_decode(file_get_contents($metadataFile), true);
|
|
||||||
if (isset($metadata[$oldName])) {
|
|
||||||
$metadata[$newName] = $metadata[$oldName];
|
|
||||||
unset($metadata[$oldName]);
|
|
||||||
file_put_contents($metadataFile, json_encode($metadata, JSON_PRETTY_PRINT));
|
|
||||||
}
|
|
||||||
}
|
|
||||||
echo json_encode(["success" => "File renamed successfully", "newName" => $newName]);
|
|
||||||
} else {
|
|
||||||
echo json_encode(["error" => "Error renaming file"]);
|
|
||||||
}
|
|
||||||
?>
|
|
||||||
@@ -1,98 +0,0 @@
|
|||||||
<?php
|
|
||||||
require_once 'config.php';
|
|
||||||
header('Content-Type: application/json');
|
|
||||||
|
|
||||||
// Ensure user is authenticated
|
|
||||||
if (!isset($_SESSION['authenticated']) || $_SESSION['authenticated'] !== true) {
|
|
||||||
echo json_encode(["error" => "Unauthorized"]);
|
|
||||||
http_response_code(401);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Ensure the request method is POST
|
|
||||||
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
|
|
||||||
echo json_encode(['success' => false, 'error' => 'Invalid request method.']);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// CSRF Protection: Read token from the custom header "X-CSRF-Token"
|
|
||||||
$headers = array_change_key_case(getallheaders(), CASE_LOWER);
|
|
||||||
$receivedToken = isset($headers['x-csrf-token']) ? trim($headers['x-csrf-token']) : '';
|
|
||||||
|
|
||||||
if ($receivedToken !== $_SESSION['csrf_token']) {
|
|
||||||
echo json_encode(['success' => false, 'error' => 'Invalid CSRF token.']);
|
|
||||||
http_response_code(403);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
$username = $_SESSION['username'] ?? '';
|
|
||||||
$userPermissions = loadUserPermissions($username);
|
|
||||||
if ($username) {
|
|
||||||
$userPermissions = loadUserPermissions($username);
|
|
||||||
if (isset($userPermissions['readOnly']) && $userPermissions['readOnly'] === true) {
|
|
||||||
echo json_encode(["error" => "Read-only users are not allowed to rename folders."]);
|
|
||||||
exit();
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Get the JSON input and decode it
|
|
||||||
$input = json_decode(file_get_contents('php://input'), true);
|
|
||||||
if (!isset($input['oldFolder']) || !isset($input['newFolder'])) {
|
|
||||||
echo json_encode(['success' => false, 'error' => 'Required folder names not provided.']);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
$oldFolder = trim($input['oldFolder']);
|
|
||||||
$newFolder = trim($input['newFolder']);
|
|
||||||
|
|
||||||
// Validate folder names
|
|
||||||
if (!preg_match(REGEX_FOLDER_NAME, $oldFolder) || !preg_match(REGEX_FOLDER_NAME, $newFolder)) {
|
|
||||||
echo json_encode(['success' => false, 'error' => 'Invalid folder name(s).']);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
$oldFolder = trim($oldFolder, "/\\ ");
|
|
||||||
$newFolder = trim($newFolder, "/\\ ");
|
|
||||||
|
|
||||||
$baseDir = rtrim(UPLOAD_DIR, '/\\');
|
|
||||||
$oldPath = $baseDir . DIRECTORY_SEPARATOR . $oldFolder;
|
|
||||||
$newPath = $baseDir . DIRECTORY_SEPARATOR . $newFolder;
|
|
||||||
|
|
||||||
if ((realpath($oldPath) === false) || (realpath(dirname($newPath)) === false) ||
|
|
||||||
strpos(realpath($oldPath), realpath($baseDir)) !== 0 ||
|
|
||||||
strpos(realpath(dirname($newPath)), realpath($baseDir)) !== 0) {
|
|
||||||
echo json_encode(['success' => false, 'error' => 'Invalid folder path.']);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
if (!file_exists($oldPath) || !is_dir($oldPath)) {
|
|
||||||
echo json_encode(['success' => false, 'error' => 'Folder to rename does not exist.']);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
if (file_exists($newPath)) {
|
|
||||||
echo json_encode(['success' => false, 'error' => 'New folder name already exists.']);
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Attempt to rename the folder.
|
|
||||||
if (rename($oldPath, $newPath)) {
|
|
||||||
// --- Update Metadata Files ---
|
|
||||||
// Generate a metadata prefix for the old folder path and new folder path.
|
|
||||||
$oldPrefix = str_replace(['/', '\\', ' '], '-', $oldFolder);
|
|
||||||
$newPrefix = str_replace(['/', '\\', ' '], '-', $newFolder);
|
|
||||||
|
|
||||||
// Find all metadata files whose names start with the old prefix.
|
|
||||||
$metadataFiles = glob(META_DIR . $oldPrefix . '*_metadata.json');
|
|
||||||
foreach ($metadataFiles as $oldMetaFile) {
|
|
||||||
$baseName = basename($oldMetaFile);
|
|
||||||
// Replace the old prefix with the new prefix in the filename.
|
|
||||||
$newBaseName = preg_replace('/^' . preg_quote($oldPrefix, '/') . '/', $newPrefix, $baseName);
|
|
||||||
$newMetaFile = META_DIR . $newBaseName;
|
|
||||||
rename($oldMetaFile, $newMetaFile);
|
|
||||||
}
|
|
||||||
|
|
||||||
echo json_encode(['success' => true]);
|
|
||||||
} else {
|
|
||||||
echo json_encode(['success' => false, 'error' => 'Failed to rename folder.']);
|
|
||||||
}
|
|
||||||
?>
|
|
||||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user