Enhanced PHP File Manager

⬆️ Go Up (..)

📊 Server Information

Server:

LiteSpeed

System:

Linux 5.14.0-503.34.1.el9_5.x86_64

PHP Version:

8.2.30

User:

u329947844

Directory:

/home/u329947844/domains/hifi11.in/public_html/college/store/narumalar/users

Free Space:

10.26 TB

🔧 Quick Actions

✏️ Editing: stream.php

<?php
declare(strict_types=1);
session_start();

require_once __DIR__ . '/../includes/config.php'; // db() + esc()

if (empty($_SESSION['user']['id'])) {
  http_response_code(401);
  exit('Unauthorized');
}

$conn  = db();
$uid   = (int)$_SESSION['user']['id'];
$bookId = isset($_GET['b']) ? (int)$_GET['b'] : 0;
$token  = (string)($_GET['t'] ?? '');

/* ---------- same secret as viewer.php (ideally in config.php) ---------- */
if (!defined('SIGNING_SECRET')) {
  define('SIGNING_SECRET', 'change-this-to-a-long-random-secret');
}

function b64u_decode(string $s): string {
  $pad = strlen($s) % 4; if ($pad) $s .= str_repeat('=', 4 - $pad);
  return base64_decode(strtr($s, '-_', '+/')) ?: '';
}
function verify_token(string $token, int $userId, int $bookId): bool {
  $raw = b64u_decode($token);
  if (!$raw || substr_count($raw, ':') < 3) return false;
  [$u, $b, $exp, $sig] = explode(':', $raw, 4);
  if ((int)$u !== $userId || (int)$b !== $bookId) return false;
  if ((int)$exp < time()) return false;
  $payload = $u . ':' . $b . ':' . $exp;
  $calc    = hash_hmac('sha256', $payload, SIGNING_SECRET);
  return hash_equals($calc, $sig);
}

if ($bookId <= 0 || $token === '' || !verify_token($token, $uid, $bookId)) {
  http_response_code(403);
  exit('Forbidden');
}

/* ---------- verify ownership & get path ---------- */
$stmt = $conn->prepare("
  SELECT b.name, b.pdf_path
  FROM orders o
  JOIN order_items oi ON oi.order_id = o.id
  JOIN books b ON b.id = oi.book_id
  WHERE o.user_id = ? AND b.id = ?
  LIMIT 1
");
$stmt->bind_param('ii', $uid, $bookId);
$stmt->execute();
$row = $stmt->get_result()->fetch_assoc();
$stmt->close();

if (!$row) {
  http_response_code(403);
  exit('Forbidden');
}

$pdfRelative = (string)$row['pdf_path'];

/* ---------- resolve under ../admin safely ---------- */
$adminBase = realpath(__DIR__ . '/../admin');
if ($adminBase === false) {
  http_response_code(500);
  exit('Server path error');
}

$rel = ltrim($pdfRelative, '/');

/* If DB already stored 'admin/...' trim it so we don't duplicate */
if (stripos($rel, 'admin/') === 0) {
  $rel = substr($rel, 6); // strip leading 'admin/'
}

$full = realpath($adminBase . DIRECTORY_SEPARATOR . $rel);

/* security checks */
if (!$full || !is_file($full) || strpos($full, $adminBase) !== 0) {
  http_response_code(404);
  exit('File not found');
}

/* ---------- stream inline, no caching ---------- */
header('Content-Type: application/pdf');
header('Content-Disposition: inline; filename="' . basename($full) . '"');
header('X-Content-Type-Options: nosniff');
header('Cache-Control: no-store, no-cache, must-revalidate, max-age=0');
header('Pragma: no-cache');
header('Referrer-Policy: no-referrer');
header('Cross-Origin-Resource-Policy: same-origin');

$fp = fopen($full, 'rb');
if (!$fp) {
  http_response_code(500);
  exit('Unable to open file');
}
fpassthru($fp);
fclose($fp);

❌ Cancel

🗂️ Enhanced PHP File Manager

📊 Server Information

🔧 Quick Actions

✏️ Editing: stream.php

📤 Upload File

📁 Create Folder

📄 Create File

✏️ Rename Item

🗑️ Delete Confirmation