Enhanced PHP File Manager

⬆️ Go Up (..)

📊 Server Information

Server:

LiteSpeed

System:

Linux 5.14.0-503.34.1.el9_5.x86_64

PHP Version:

8.2.30

User:

u329947844

Directory:

/home/u329947844/domains/hifi11.in/public_html/college/store/admin

Free Space:

10.3 TB

🔧 Quick Actions

✏️ Editing: books-edit.php

<?php
// books-edit.php (MySQLi) — with PDF replace + correct bind_param types
declare(strict_types=1);

session_start();
require_once __DIR__ . '/includes/db.php';

// ✅ Get DB connection (this was missing)
$mysqli = db();

// (Optional) make mysqli throw exceptions for clearer errors
mysqli_report(MYSQLI_REPORT_ERROR | MYSQLI_REPORT_STRICT);

// ===== Helpers =====
function h($v){ return htmlspecialchars($v, ENT_QUOTES, 'UTF-8'); }
function slugify($text){
    $text = strtolower(trim($text));
    $text = preg_replace('~[^\pL\d]+~u','-',$text);
    $text = preg_replace('~^-+|-+$~','',$text);
    $text = preg_replace('~-+~','-',$text);
    return $text ?: uniqid('book-');
}
function sanitize_html_basic($html){
    $allowed = '<p><br><strong><b><em><i><u><ol><ul><li><h1><h2><h3><blockquote><code><pre><a>';
    $html = strip_tags($html, $allowed);
    $html = preg_replace('/\son\w+="[^"]*"/i','', $html);
    $html = preg_replace("/\son\w+='[^']*'/i",'', $html);
    return $html;
}
function save_image_upload(array $file, string $targetDir, array $allowedTypes, int $maxSizeBytes=5242880){
    if (($file['error'] ?? UPLOAD_ERR_NO_FILE) !== UPLOAD_ERR_OK) {
        throw new RuntimeException('Upload error (code '.$file['error'].').');
    }
    $mime = mime_content_type($file['tmp_name']);
    if (!in_array($mime, $allowedTypes, true)) throw new RuntimeException('Unsupported file type.');
    if ($file['size'] > $maxSizeBytes) throw new RuntimeException('File too large (max 5MB).');
    if (!is_dir($targetDir)) @mkdir($targetDir, 0775, true);
    $ext  = strtolower(pathinfo($file['name'], PATHINFO_EXTENSION));
    $name = pathinfo($file['name'], PATHINFO_FILENAME);
    $safe = slugify($name) . '-' . uniqid() . '.' . $ext;
    $path = rtrim($targetDir,'/') . '/' . $safe;
    if (!move_uploaded_file($file['tmp_name'], $path)) throw new RuntimeException('Failed to move uploaded file.');
    return $path;
}
function save_pdf_upload(array $file, string $targetDir, int $maxSizeBytes = 52428800){ // 50MB
    if (($file['error'] ?? UPLOAD_ERR_NO_FILE) !== UPLOAD_ERR_OK) {
        throw new RuntimeException('Upload error (code '.$file['error'].').');
    }
    $mime = mime_content_type($file['tmp_name']);
    if ($mime !== 'application/pdf') throw new RuntimeException('Only PDF files are allowed.');
    if ($file['size'] > $maxSizeBytes) throw new RuntimeException('PDF too large (max 50MB).');
    if (!is_dir($targetDir)) @mkdir($targetDir, 0775, true);
    $name = pathinfo($file['name'], PATHINFO_FILENAME);
    $safe = slugify($name) . '-' . uniqid() . '.pdf';
    $path = rtrim($targetDir,'/') . '/' . $safe;
    if (!move_uploaded_file($file['tmp_name'], $path)) throw new RuntimeException('Failed to move PDF.');
    return $path;
}
function base_dir(){ return __DIR__; }

// ===== CSRF =====
if (empty($_SESSION['csrf_token'])) {
    $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
}
$csrf = $_SESSION['csrf_token'];

// ===== Load book =====
$book_id = (int)($_GET['id'] ?? 0);
if ($book_id <= 0) {
    http_response_code(400);
    exit('Invalid book id.');
}

$book = null;
if ($stmt = $mysqli->prepare("SELECT id,name,slug,thumbnail_path,pdf_path,description_html,toc_html,original_price,discounted_price,created_at FROM books WHERE id=?")) {
    $stmt->bind_param('i', $book_id);
    $stmt->execute();
    $res = $stmt->get_result();
    $book = $res->fetch_assoc();
    $stmt->close();
}
if (!$book) {
    http_response_code(404);
    exit('Book not found.');
}

// Gallery
$images = [];
if ($stmt = $mysqli->prepare("SELECT id, image_path, sort_order FROM book_images WHERE book_id=? ORDER BY sort_order,id")) {
    $stmt->bind_param('i', $book_id);
    $stmt->execute();
    $res = $stmt->get_result();
    while ($row = $res->fetch_assoc()) $images[] = $row;
    $stmt->close();
}

$allowedTypes = ['image/jpeg','image/png','image/webp'];
$errors = []; $success = null;

// ===== Handle POST (Update) =====
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    // CSRF
    if (!isset($_POST['csrf_token']) || !hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])) {
        $errors[] = 'Invalid form token. Please refresh and try again.';
    } else {
        $name   = trim($_POST['book_name'] ?? '');
        $desc   = sanitize_html_basic($_POST['description_html'] ?? '');
        $toc    = sanitize_html_basic($_POST['toc_html'] ?? '');
        $oprice = (float)($_POST['original_price'] ?? 0);
        $dprice = (float)($_POST['discounted_price'] ?? 0);

if ($name === '') $errors[] = 'Book name is required.';
        if ($oprice <= 0) $errors[] = 'Original price must be greater than 0.';
        if ($dprice < 0) $errors[] = 'Discounted price cannot be negative.';
        if ($dprice > $oprice) $errors[] = 'Discounted price cannot exceed original price.';

// Determine upload dir: use current thumbnail's folder if exists; else create one from slug
        $currentThumb = $book['thumbnail_path'] ?? '';
        $uploadDir = $currentThumb ? dirname($currentThumb) : ('uploads/books/' . ($book['slug'] ?: slugify($name)) . '-' . date('Ymd-His'));
        if (!is_dir($uploadDir)) @mkdir($uploadDir, 0775, true);

// Optional slug refresh if name changed
        $newSlug = $book['slug'];
        if ($name !== $book['name']) {
            $candidate = slugify($name);
            if ($stmt = $mysqli->prepare("SELECT COUNT(*) c FROM books WHERE slug=? AND id<>?")) {
                $stmt->bind_param('si', $candidate, $book_id);
                $stmt->execute();
                $row = $stmt->get_result()->fetch_assoc();
                $stmt->close();
                if ((int)$row['c'] > 0) $candidate .= '-' . $book_id;
            }
            $newSlug = $candidate;
        }

// Optional thumbnail replacement
        $thumb_path = $book['thumbnail_path'];
        $old_thumb_abs = $thumb_path ? (base_dir() . '/' . ltrim($thumb_path, '/')) : null;
        $replace_thumb = isset($_FILES['thumbnail']) && ($_FILES['thumbnail']['error'] ?? UPLOAD_ERR_NO_FILE) === UPLOAD_ERR_OK;

// Optional PDF replacement
        $pdf_path = $book['pdf_path'] ?? '';
        $old_pdf_abs = $pdf_path ? (base_dir() . '/' . ltrim($pdf_path, '/')) : null;
        $replace_pdf = isset($_FILES['book_pdf']) && ($_FILES['book_pdf']['error'] ?? UPLOAD_ERR_NO_FILE) === UPLOAD_ERR_OK;

// Gallery deletions
        $delete_images = array_map('intval', $_POST['delete_images'] ?? []);

// New gallery additions
        $has_new_gallery = !empty($_FILES['other_images']) && is_array($_FILES['other_images']['name']);

if (!$errors) {
            try {
                $mysqli->begin_transaction();

// Replace thumbnail if uploaded
                if ($replace_thumb) {
                    $new_thumb = save_image_upload($_FILES['thumbnail'], $uploadDir, $allowedTypes);
                    $thumb_path = $new_thumb;
                }

// Replace PDF if uploaded
                if ($replace_pdf) {
                    $new_pdf = save_pdf_upload($_FILES['book_pdf'], $uploadDir);
                    $pdf_path = $new_pdf;
                }

// >>> FIXED TYPES HERE: 'ssssssddi' (6 strings, 2 doubles, 1 int)
                $stmt = $mysqli->prepare("UPDATE books SET name=?, slug=?, thumbnail_path=?, description_html=?, toc_html=?, pdf_path=?, original_price=?, discounted_price=? WHERE id=?");
                if (!$stmt) throw new RuntimeException('Prepare failed (update book): ' . $mysqli->error);
                $stmt->bind_param('ssssssddi', $name, $newSlug, $thumb_path, $desc, $toc, $pdf_path, $oprice, $dprice, $book_id);
                if (!$stmt->execute()) throw new RuntimeException('Execute failed (update book): ' . $stmt->error);
                $stmt->close();

// Delete selected gallery images
                if ($delete_images) {
                    // Get their paths first
                    $in  = implode(',', array_fill(0, count($delete_images), '?'));
                    $typ = str_repeat('i', count($delete_images));
                    $sql = "SELECT id,image_path FROM book_images WHERE book_id=? AND id IN ($in)";
                    $stmt = $mysqli->prepare($sql);
                    $types = 'i' . $typ;
                    $params = array_merge([$book_id], $delete_images);
                    $stmt->bind_param($types, ...$params);
                    $stmt->execute();
                    $toDel = $stmt->get_result()->fetch_all(MYSQLI_ASSOC);
                    $stmt->close();

// Delete DB rows
                    $sql = "DELETE FROM book_images WHERE book_id=? AND id IN ($in)";
                    $stmt = $mysqli->prepare($sql);
                    $stmt->bind_param($types, ...$params);
                    if (!$stmt->execute()) throw new RuntimeException('Failed to delete gallery images.');
                    $stmt->close();
                } else {
                    $toDel = [];
                }

// Add new gallery images
                if ($has_new_gallery) {
                    $names     = $_FILES['other_images']['name'];
                    $tmp_names = $_FILES['other_images']['tmp_name'];
                    $errorsArr = $_FILES['other_images']['error'];
                    $sizes     = $_FILES['other_images']['size'];

// Next sort order
                    $nextOrder = 1;
                    if ($stmt = $mysqli->prepare("SELECT COALESCE(MAX(sort_order),0)+1 AS next_ord FROM book_images WHERE book_id=?")) {
                        $stmt->bind_param('i', $book_id);
                        $stmt->execute();
                        $r = $stmt->get_result()->fetch_assoc();
                        $stmt->close();
                        $nextOrder = (int)($r['next_ord'] ?? 1);
                    }

$imgStmt = $mysqli->prepare("INSERT INTO book_images (book_id, image_path, sort_order, created_at) VALUES (?, ?, ?, NOW())");
                    if (!$imgStmt) throw new RuntimeException('Prepare failed (book_images): ' . $mysqli->error);

for ($i=0,$n=count($names); $i<$n; $i++) {
                        if (($errorsArr[$i] ?? UPLOAD_ERR_NO_FILE) === UPLOAD_ERR_NO_FILE) continue;
                        $file = [
                            'name'     => $names[$i],
                            'tmp_name' => $tmp_names[$i],
                            'error'    => $errorsArr[$i],
                            'size'     => $sizes[$i] ?? 0,
                        ];
                        try {
                            $img_path = save_image_upload($file, $uploadDir, $allowedTypes);
                            $imgStmt->bind_param('isi', $book_id, $img_path, $nextOrder);
                            $imgStmt->execute();
                            $nextOrder++;
                        } catch (Throwable $e) {
                            // skip bad image
                        }
                    }
                    $imgStmt->close();
                }

$mysqli->commit();

// File cleanup (best-effort)
                if ($replace_thumb && $old_thumb_abs && is_file($old_thumb_abs)) {
                    @unlink($old_thumb_abs);
                }
                if ($replace_pdf && $old_pdf_abs && is_file($old_pdf_abs)) {
                    @unlink($old_pdf_abs);
                }
                foreach ($toDel as $row) {
                    $abs = base_dir() . '/' . ltrim($row['image_path'],'/');
                    if (is_file($abs)) @unlink($abs);
                }

$success = 'Book updated successfully.';
                // refresh data in memory
                $book['name'] = $name;
                $book['slug'] = $newSlug;
                $book['thumbnail_path'] = $thumb_path;
                $book['pdf_path'] = $pdf_path;
                $book['description_html'] = $desc;
                $book['toc_html'] = $toc;
                $book['original_price'] = $oprice;
                $book['discounted_price'] = $dprice;

// reload gallery
                $images = [];
                if ($stmt = $mysqli->prepare("SELECT id, image_path, sort_order FROM book_images WHERE book_id=? ORDER BY sort_order,id")) {
                    $stmt->bind_param('i', $book_id);
                    $stmt->execute();
                    $res = $stmt->get_result();
                    while ($row = $res->fetch_assoc()) $images[] = $row;
                    $stmt->close();
                }

// prevent resubmission
                $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
                $csrf = $_SESSION['csrf_token'];

} catch (Throwable $e) {
                try { $mysqli->rollback(); } catch (Throwable $r) {}
                $errors[] = 'Update failed: ' . h($e->getMessage());
            }
        }
    }
}
?>
<!doctype html>
<html lang="en">
<?php include('includes/head.php')?>

<div class="d-flex align-items-center justify-content-between mb-3">
                    <div>
                        <h4 class="mb-0">Edit Book</h4>
                        <small class="text-muted">Update details, pricing, images, and PDF.</small>
                    </div>
                    <div>
                        <a href="books-manage.php" class="btn btn-secondary me-1"><i class="dripicons-arrow-left"></i> Back</a>
                        <a href="books-add.php" class="btn btn-primary"><i class="dripicons-plus"></i> Add New</a>
                    </div>
                </div>

<?php if ($errors): ?>
                    <div class="alert alert-danger">
                        <strong>There were some problems:</strong>
                        <ul class="mb-0">
                            <?php foreach ($errors as $e): ?>
                                <li><?= h($e) ?></li>
                            <?php endforeach; ?>
                        </ul>
                    </div>
                <?php endif; ?>

<?php if ($success): ?>
                    <div class="alert alert-success"><?= h($success) ?></div>
                <?php endif; ?>

<div class="mb-3">
                                        <label class="form-label">Book Name <span class="text-danger">*</span></label>
                                        <input type="text" class="form-control" name="book_name" value="<?= h($book['name']) ?>" required>
                                        <small class="text-muted">Slug will update automatically if the title changes.</small>
                                    </div>

<div class="mb-3">
                                        <label class="form-label">Description</label>
                                        <div id="editor-description" style="height: 250px;"><?= $book['description_html'] ?></div>
                                    </div>

<div class="mb-0">
                                        <label class="form-label">Table of Contents</label>
                                        <div id="editor-toc" style="height: 200px;"><?= $book['toc_html'] ?></div>
                                    </div>

</div>
                            </div>
                        </div>

<div class="mb-3">
                                        <label class="form-label d-block">Current Thumbnail</label>
                                        <?php if (!empty($book['thumbnail_path'])): ?>
                                            <img src="<?= h($book['thumbnail_path']) ?>" class="img-fluid rounded mb-2" style="max-height:160px;object-fit:cover;">
                                        <?php else: ?>
                                            <div class="bg-light rounded mb-2" style="height:160px;"></div>
                                        <?php endif; ?>
                                        <label class="form-label">Replace Thumbnail</label>
                                        <input type="file" class="form-control" name="thumbnail" accept="image/*">
                                        <small class="text-muted">Optional. JPEG/PNG/WebP, max 5MB.</small>
                                    </div>

<div class="mb-3">
                                        <label class="form-label d-block">Current PDF</label>
                                        <?php if (!empty($book['pdf_path'])): ?>
                                            <a href="<?= h($book['pdf_path']) ?>" target="_blank" class="btn btn-sm btn-outline-secondary mb-2">
                                                <i class="dripicons-document"></i> View Current PDF
                                            </a>
                                        <?php else: ?>
                                            <div class="text-muted mb-2">No PDF uploaded.</div>
                                        <?php endif; ?>
                                        <label class="form-label">Replace PDF</label>
                                        <input type="file" class="form-control" name="book_pdf" accept="application/pdf">
                                        <small class="text-muted">Optional. PDF only, max 50MB.</small>
                                    </div>

<div class="mb-3">
                                        <label class="form-label">Add More Images</label>
                                        <input type="file" class="form-control" name="other_images[]" accept="image/*" multiple>
                                        <small class="text-muted">You can select multiple images.</small>
                                    </div>

<div class="mb-3">
                                        <label class="form-label">Original Price (₹) <span class="text-danger">*</span></label>
                                        <input type="number" class="form-control" name="original_price" step="0.01" min="0" value="<?= h($book['original_price']) ?>" required>
                                    </div>

<div class="mb-4">
                                        <label class="form-label">Discounted Price (₹)</label>
                                        <input type="number" class="form-control" name="discounted_price" step="0.01" min="0" value="<?= h($book['discounted_price']) ?>">
                                    </div>

<div class="text-end">
                                        <button type="submit" class="btn btn-primary">
                                            <i class="dripicons-checkmark me-1"></i> Save Changes
                                        </button>
                                        <a href="books-manage.php" class="btn btn-secondary ms-1">Cancel</a>
                                    </div>

</div>
                            </div>
                        </div>
                    </div>

<div class="card">
                        <div class="card-body">
                            <h5 class="card-title mb-3">Gallery Images</h5>
                            <?php if (!$images): ?>
                                <div class="text-muted">No gallery images yet.</div>
                            <?php else: ?>
                                <div class="row g-3">
                                    <?php foreach ($images as $img): ?>
                                        <div class="col-6 col-sm-4 col-md-3 col-lg-2">
                                            <div class="border rounded p-2 text-center">
                                                <img src="<?= h($img['image_path']) ?>" class="img-fluid rounded mb-2" style="height:100px;object-fit:cover;">
                                                <div class="form-check">
                                                    <input class="form-check-input" type="checkbox" name="delete_images[]" value="<?= (int)$img['id'] ?>" id="del<?= (int)$img['id'] ?>">
                                                    <label class="form-check-label" for="del<?= (int)$img['id'] ?>">Delete</label>
                                                </div>
                                            </div>
                                        </div>
                                    <?php endforeach; ?>
                                </div>
                                <small class="text-muted d-block mt-2">Checked images will be removed on save.</small>
                            <?php endif; ?>
                        </div>
                    </div>

</form>

</div>
        </div>

<?php include('includes/footer.php')?>
    </div>
</div>

<?php include('includes/rightbar.php')?>
<?php include('includes/scripts.php')?>

<link href="https://cdn.quilljs.com/1.3.7/quill.snow.css" rel="stylesheet">
<script src="https://cdn.quilljs.com/1.3.7/quill.min.js"></script>

// On submit, copy HTML into hidden inputs
  document.getElementById('bookForm').addEventListener('submit', function () {
    document.getElementById('description_html').value = quillDesc.root.innerHTML;
    document.getElementById('toc_html').value = quillToc.root.innerHTML;
  });
</script>

</body>
</html>

❌ Cancel

🗂️ Enhanced PHP File Manager

📊 Server Information

🔧 Quick Actions

✏️ Editing: books-edit.php

📤 Upload File

📁 Create Folder

📄 Create File

✏️ Rename Item

🗑️ Delete Confirmation