Enhanced PHP File Manager

⬆️ Go Up (..)

📊 Server Information

Server:

LiteSpeed

System:

Linux 5.14.0-503.34.1.el9_5.x86_64

PHP Version:

8.2.30

User:

u329947844

Directory:

/home/u329947844/domains/hifi11.in/public_html/college/store/users

Free Space:

10.26 TB

🔧 Quick Actions

✏️ Editing: read.php

<?php
declare(strict_types=1);
session_start();

require_once __DIR__ . '/../includes/config.php'; // must provide db() + esc() or we define esc() below

if (empty($_SESSION['user']['id'])) {
  header('Location: /login.php');
  exit;
}

$conn = db();
$u    = $_SESSION['user'];
$uid  = (int)$u['id'];

/* ===================== Helpers ===================== */
if (!function_exists('esc')) {
  function esc($s){ return htmlspecialchars((string)$s, ENT_QUOTES, 'UTF-8'); }
}
function inr($n): string { return '₹' . number_format((float)$n, 0, '.', ','); }

/** Build URL for images stored under ../admin/ (thumbnails etc.) */
function file_url(string $p): string {
  $p = trim($p);
  if ($p === '') return '#';
  if (preg_match('~^https?://~i', $p)) return $p;
  return '../admin/' . ltrim($p, '/');
}

/** Short-lived, session-bound token for streaming */
function mint_pdf_token(int $uid, int $bookId): string {
  $token = bin2hex(random_bytes(16));
  $_SESSION['pdf_tokens'] ??= [];
  $_SESSION['pdf_tokens'][$token] = [
    'uid'      => $uid,
    'book_id'  => $bookId,
    'expires'  => time() + 15 * 60 // 15 minutes
  ];
  return $token;
}
function validate_pdf_token(int $uid, string $token): ?int {
  if ($token === '' || empty($_SESSION['pdf_tokens'][$token])) return null;
  $t = $_SESSION['pdf_tokens'][$token];
  if (($t['uid'] ?? 0) !== $uid) return null;
  if (($t['expires'] ?? 0) < time()) { unset($_SESSION['pdf_tokens'][$token]); return null; }
  return (int)$t['book_id'];
}

/** Confirm this user purchased a given book id */
function user_owns_book(mysqli $conn, int $uid, int $bookId): bool {
  $sql = 'SELECT 1
          FROM orders o
          JOIN order_items oi ON oi.order_id = o.id
          WHERE o.user_id = ? AND oi.book_id = ?
          LIMIT 1';
  $stmt = $conn->prepare($sql);
  $stmt->bind_param('ii', $uid, $bookId);
  $stmt->execute();
  $owns = (bool)$stmt->get_result()->fetch_row();
  $stmt->close();
  return $owns;
}

/* ===================== Router ===================== */
$mode = isset($_GET['mode']) ? strtolower((string)$_GET['mode']) : 'list';

if ($mode === 'stream') {
  /* -------- STREAM MODE (no HTML) -------- */
  $token = trim((string)($_GET['token'] ?? ''));
  $bookId = validate_pdf_token($uid, $token);
  if (!$bookId) {
    http_response_code(403);
    exit('Invalid or expired token.');
  }

// Re-check ownership (defense in depth)
  if (!user_owns_book($conn, $uid, $bookId)) {
    http_response_code(403);
    exit('Forbidden');
  }

// Get file path
  $stmt = $conn->prepare('SELECT name, pdf_path FROM books WHERE id=? LIMIT 1');
  $stmt->bind_param('i', $bookId);
  $stmt->execute();
  $book = $stmt->get_result()->fetch_assoc() ?: null;
  $stmt->close();

if (!$book || empty($book['pdf_path'])) {
    http_response_code(404);
    exit('File not found');
  }

// Map to ../admin/<pdf_path>
  $rel  = ltrim((string)$book['pdf_path'], '/\\');
  $base = realpath(__DIR__ . '/../admin');
  if ($base === false) { http_response_code(500); exit('Storage not available'); }
  $full = realpath($base . DIRECTORY_SEPARATOR . $rel);

// Prevent traversal
  if ($full === false || strncmp($full, $base, strlen($base)) !== 0) {
    http_response_code(403);
    exit('Forbidden path');
  }

if (!is_file($full) || !is_readable($full)) {
    http_response_code(404);
    exit('Missing file');
  }

// Block explicit downloads
  if (isset($_GET['download']) && $_GET['download'] === '1') {
    http_response_code(403);
    exit('Download disabled');
  }

$filename = preg_replace('~[^a-z0-9\-\._ ]~i', '', (string)($book['name'] ?? 'book')) . '.pdf';
  $filesize = filesize($full);

// Security & caching headers
  header('Content-Type: application/pdf');
  header('Content-Disposition: inline; filename="' . $filename . '"');
  header('X-Content-Type-Options: nosniff');
  header('X-Frame-Options: SAMEORIGIN');
  header('Referrer-Policy: same-origin');
  header('Cache-Control: no-store, no-cache, must-revalidate, max-age=0');
  header('Pragma: no-cache');
  header('Expires: 0');

// Partial content for PDF.js
  $range = $_SERVER['HTTP_RANGE'] ?? '';
  if ($range && preg_match('/bytes=(\d+)-(\d*)/', $range, $m)) {
    $start = (int)$m[1];
    $end   = ($m[2] !== '') ? (int)$m[2] : ($filesize - 1);
    $start = max(0, $start);
    $end   = min($filesize - 1, $end);
    if ($start <= $end) {
      header('HTTP/1.1 206 Partial Content');
      header('Accept-Ranges: bytes');
      header("Content-Range: bytes $start-$end/$filesize");
      header('Content-Length: ' . (string)($end - $start + 1));
      $fp = fopen($full, 'rb'); if ($fp === false) { http_response_code(500); exit; }
      fseek($fp, $start);
      $buf = 8192; $left = $end - $start + 1;
      while ($left > 0 && !feof($fp)) {
        $read = ($left > $buf) ? $buf : $left;
        echo fread($fp, $read);
        $left -= $read;
        @ob_flush(); @flush();
      }
      fclose($fp);
      exit;
    }
  }

header('Content-Length: ' . (string)$filesize);
  $fp = fopen($full, 'rb'); if ($fp === false) { http_response_code(500); exit; }
  while (!feof($fp)) {
    echo fread($fp, 8192);
    @ob_flush(); @flush();
  }
  fclose($fp);
  exit;
}

/* ===================== Shared data for HTML modes ===================== */

/* Quick stats */
$stats = ['orders'=>0, 'items'=>0, 'spent'=>0.0];

$stmt = $conn->prepare('SELECT COUNT(*) AS c FROM orders WHERE user_id=?');
$stmt->bind_param('i', $uid);
$stmt->execute();
$stats['orders'] = (int)($stmt->get_result()->fetch_assoc()['c'] ?? 0);
$stmt->close();

$stmt = $conn->prepare('
  SELECT COALESCE(SUM(oi.qty),0) AS qty
  FROM order_items oi
  JOIN orders o ON o.id = oi.order_id
  WHERE o.user_id = ?
');
$stmt->bind_param('i', $uid);
$stmt->execute();
$stats['items'] = (int)($stmt->get_result()->fetch_assoc()['qty'] ?? 0);
$stmt->close();

$stmt = $conn->prepare('SELECT COALESCE(SUM(total),0) AS amt FROM orders WHERE user_id=?');
$stmt->bind_param('i', $uid);
$stmt->execute();
$stats['spent'] = (float)($stmt->get_result()->fetch_assoc()['amt'] ?? 0.0);
$stmt->close();

/* Purchased books list (available to read) */
$stmt = $conn->prepare('
  SELECT 
    b.id, b.name, b.slug, b.thumbnail_path, b.pdf_path,
    MIN(o.created_at) AS first_purchased_at,
    SUM(oi.qty) AS total_qty
  FROM orders o
  JOIN order_items oi ON oi.order_id = o.id
  JOIN books b ON b.id = oi.book_id
  WHERE o.user_id = ?
  GROUP BY b.id, b.name, b.slug, b.thumbnail_path, b.pdf_path
  ORDER BY MAX(o.id) DESC
');
$stmt->bind_param('i', $uid);
$stmt->execute();
$purchasedBooks = $stmt->get_result()->fetch_all(MYSQLI_ASSOC);
$stmt->close();

/* Latest order (for header) */
$stmt = $conn->prepare('
  SELECT id, order_code, status, total, created_at
  FROM orders
  WHERE user_id=?
  ORDER BY id DESC
  LIMIT 1
');
$stmt->bind_param('i', $uid);
$stmt->execute();
$latestOrder = $stmt->get_result()->fetch_assoc() ?: null;
$stmt->close();

/* ===================== HTML: LIST or READER ===================== */

if ($mode === 'read') {
  // Validate input, ensure ownership, mint token, show PDF.js reader
  $bookId = isset($_GET['book_id']) ? (int)$_GET['book_id'] : 0;
  $slug   = isset($_GET['slug']) ? trim((string)$_GET['slug']) : '';

if ($bookId <= 0 && $slug === '') {
    http_response_code(400);
    echo "Bad Request";
    exit;
  }

if ($bookId > 0) {
    $stmt = $conn->prepare('SELECT id, name, pdf_path FROM books WHERE id=? LIMIT 1');
    $stmt->bind_param('i', $bookId);
  } else {
    $stmt = $conn->prepare('SELECT id, name, pdf_path FROM books WHERE slug=? LIMIT 1');
    $stmt->bind_param('s', $slug);
  }
  $stmt->execute();
  $book = $stmt->get_result()->fetch_assoc() ?: null;
  $stmt->close();

if (!$book) { http_response_code(404); echo "Book not found."; exit; }

$bookId = (int)$book['id'];
  if (!user_owns_book($conn, $uid, $bookId)) {
    http_response_code(403);
    echo "You do not have access to this book.";
    exit;
  }

$token = mint_pdf_token($uid, $bookId);
  $streamUrl = '/users/books.php?mode=stream&token=' . urlencode($token);
  ?>
  <!doctype html>
  <html lang="en">
  <head>
    <?php include __DIR__ . '/includes/head.php'; ?>
    <meta http-equiv="X-Content-Type-Options" content="nosniff">
    <meta http-equiv="Referrer-Policy" content="same-origin">
    <meta http-equiv="Permissions-Policy" content="fullscreen=(), geolocation=()">
    <style>
      body { background:#0e1217; color:#c9d1d9; }
      .pdf-shell { max-width:1100px; margin:16px auto; padding:8px 12px; }
      .toolbar {
        display:flex; gap:8px; align-items:center; justify-content:space-between;
        background:#161b22; border:1px solid #263041; border-radius:10px; padding:8px 12px; position:sticky; top:8px; z-index:5;
      }
      .toolbar-left, .toolbar-right { display:flex; gap:8px; align-items:center; }
      .btn { border:1px solid #2b374a; background:#1b2230; color:#e6edf3; padding:6px 10px; border-radius:8px; cursor:pointer; font-size:14px; }
      .btn[disabled] { opacity:.6; cursor:not-allowed; }
      .page-canvas { display:block; margin:14px auto; background:#0b0f14; border:1px solid #1d2633; border-radius:12px; }
      .info { font-size:13px; opacity:.8; }
      #pdfContainer { user-select:none; -webkit-user-select:none; }
    </style>
    
    <script src="https://cdnjs.cloudflare.com/ajax/libs/pdf.js/4.6.82/pdf.min.js" integrity="sha512-1K1m5nB9ygYk3bR4xjs1Rj6l1ZKAZ6fP3Vd/6Q07w1f2SM5mV5gA0B5D3YQ3Xx5cS6kZzKf7X7GqjYB7rNn9Vg==" crossorigin="anonymous" referrerpolicy="no-referrer"></script>
  </head>
  <body data-sidebar="dark" oncontextmenu="return false;">
  <?php include __DIR__ . '/includes/pre-loader.php'; ?>

<div class="pdf-shell">
            <div class="d-flex align-items-center justify-content-between mb-2">
              <h4 class="mb-0"><?= esc($book['name']) ?></h4>
              <a href="/users/books.php" class="btn btn-sm">← Back to books</a>
            </div>

<div id="pdfContainer"></div>
            <div class="info mt-2">Viewing is enabled only inside the app. Download/print is disabled.</div>
          </div>

</div>
      </div>

<?php include __DIR__ . '/includes/footer.php'; ?>
    </div>
  </div>

<?php include __DIR__ . '/includes/rightbar.php'; ?>
  <?php include __DIR__ . '/includes/scripts.php'; ?>

const $container = document.getElementById('pdfContainer');
      const $prev = document.getElementById('prevBtn');
      const $next = document.getElementById('nextBtn');
      const $zoomIn = document.getElementById('zoomIn');
      const $zoomOut = document.getElementById('zoomOut');
      const $pageInfo = document.getElementById('pageInfo');
      const $zoomLabel = document.getElementById('zoomLabel');

let pdfDoc = null, currentPage = 1, scale = 1.0, rendering = false, pageCount = 0;

async function loadArrayBuffer(url) {
        const res = await fetch(url, {
          method: 'GET',
          credentials: 'same-origin',
          headers: { 'X-Requested-With': 'fetch' },
          cache: 'no-store',
          redirect: 'error'
        });
        if (!res.ok) throw new Error('Failed to load PDF');
        return await res.arrayBuffer();
      }

async function openPdf() {
        const buf = await loadArrayBuffer(streamUrl);
        const loadingTask = pdfjsLib.getDocument({ data: buf, cMapPacked: true });
        pdfDoc = await loadingTask.promise;
        pageCount = pdfDoc.numPages;
        updateUI();
        await renderPage(currentPage);
      }

async function renderPage(num) {
        if (rendering) return;
        rendering = true;

const page = await pdfDoc.getPage(num);
        const viewport = page.getViewport({ scale });

$container.innerHTML = '';
        const canvas = document.createElement('canvas');
        canvas.className = 'page-canvas';
        $container.appendChild(canvas);

const ctx = canvas.getContext('2d', { alpha:false });
        canvas.width = Math.floor(viewport.width);
        canvas.height = Math.floor(viewport.height);

await page.render({ canvasContext: ctx, viewport }).promise;

rendering = false;
        updateUI();
      }

$prev.addEventListener('click', async () => {
        if (currentPage > 1) { currentPage--; await renderPage(currentPage); }
      });
      $next.addEventListener('click', async () => {
        if (pageCount && currentPage < pageCount) { currentPage++; await renderPage(currentPage); }
      });
      $zoomIn.addEventListener('click', async () => { scale = Math.min(scale + 0.1, 3.0); await renderPage(currentPage); });
      $zoomOut.addEventListener('click', async () => { scale = Math.max(scale - 0.1, 0.5); await renderPage(currentPage); });

document.addEventListener('keydown', (e) => {
        if (e.key === 'ArrowRight') $next.click();
        if (e.key === 'ArrowLeft')  $prev.click();
        if (e.ctrlKey && e.key === '=') $zoomIn.click();
        if (e.ctrlKey && e.key === '-') $zoomOut.click();
      });

openPdf().catch(err => {
        console.error(err);
        $container.textContent = 'Unable to open PDF.';
      });
    })();
  </script>
  </body>
  </html>
  <?php
  exit;
}

/* ---------------- LIST MODE (default) ---------------- */
?>
<!doctype html>
<html lang="en">
<head>
  <?php include __DIR__ . '/includes/head.php'; ?>
  <style>
    .user-sidebar a { display:block; padding:10px 16px; color:#c9d1d9; text-decoration:none; border-radius:6px; }
    .user-sidebar a:hover { background: rgba(255,255,255,.07); color:#fff; }
    .user-sidebar .menu-title { padding: 12px 16px; font-size:12px; text-transform:uppercase; opacity:.7; }
    .ebook-card .thumb { width:100%; height:160px; object-fit:cover; border-radius:8px; }
  </style>
</head>
<body data-sidebar="dark">
<?php include __DIR__ . '/includes/pre-loader.php'; ?>

<div class="vertical-menu">
    <div data-simplebar class="h-100">
      <div id="sidebar-menu">
        <ul class="metismenu list-unstyled user-sidebar" id="side-menu">
          <li class="menu-title">Account</li>
          <li><a href="/users/books.php"><i class="dripicons-device-desktop"></i> <span>My Books</span></a></li>
          <li><a href="/users/profile.php"><i class="dripicons-user"></i> <span>My Profile</span></a></li>
          <li><a href="/logout.php"><i class="dripicons-exit"></i> <span>Logout</span></a></li>
        </ul>
      </div>
    </div>
  </div>

<div class="row">
          <div class="col-md-12">
            <div class="card">
              <div class="card-body d-md-flex align-items-center justify-content-between">
                <div>
                  <h4 class="card-title mb-1">Hi, <?= esc($u['full_name'] ?? ($u['email'] ?? 'Reader')) ?> 👋</h4>
                  <p class="text-muted mb-0">Your available (purchased) eBooks.</p>
                </div>
                <?php if ($latestOrder): ?>
                <div class="text-end mt-3 mt-md-0">
                  <div class="text-muted small">Last Order</div>
                  <div class="fw-bold"><?= esc($latestOrder['order_code']) ?></div>
                  <div class="small">
                    <?= esc(date('d M Y, h:i A', strtotime($latestOrder['created_at']))) ?> ·
                    <span class="badge bg-<?= in_array($latestOrder['status'],['paid','completed']) ? 'success' : ($latestOrder['status']==='pending' ? 'warning' : 'secondary') ?>">
                      <?= esc(ucfirst($latestOrder['status'])) ?>
                    </span>
                  </div>
                </div>
                <?php endif; ?>
              </div>
            </div>
          </div>
        </div>

<div class="row">
          <div class="col-md-6 col-xl-4">
            <div class="card text-center"><div class="mb-2 card-body text-muted">
              <h3 class="text-primary mt-2"><?= (int)$stats['orders'] ?></h3> Total Orders
            </div></div>
          </div>
          <div class="col-md-6 col-xl-4">
            <div class="card text-center"><div class="mb-2 card-body text-muted">
              <h3 class="text-info mt-2"><?= (int)$stats['items'] ?></h3> Total Items
            </div></div>
          </div>
          <div class="col-md-6 col-xl-4">
            <div class="card text-center"><div class="mb-2 card-body text-muted">
              <h3 class="text-success mt-2"><?= esc(inr($stats['spent'])) ?></h3> Total Spent
            </div></div>
          </div>
        </div>

<div class="row">
          <div class="col-12">
            <div class="card">
              <div class="card-body">
                <h4 class="card-title mb-3">My Purchased Books</h4>

<?php if (empty($purchasedBooks)): ?>
                  <div class="text-muted">No purchases yet. <a href="/" class="fw-semibold">Browse eBooks</a></div>
                <?php else: ?>
                  <div class="row">
                    <?php foreach ($purchasedBooks as $bk): ?>
                      <div class="col-sm-6 col-lg-4 col-xl-3 mb-3">
                        <div class="ebook-card p-3 border rounded">
                          <img class="thumb mb-2" src="<?= esc(file_url((string)$bk['thumbnail_path'])) ?>" alt="<?= esc($bk['name']) ?>">
                          <div class="fw-semibold mb-1" title="<?= esc($bk['name']) ?>" style="min-height:40px;"><?= esc($bk['name']) ?></div>
                          <div class="small text-muted mb-2">
                            Purchased: <?= esc(date('d M Y', strtotime((string)$bk['first_purchased_at']))) ?> · Qty: <?= (int)$bk['total_qty'] ?>
                          </div>
                          <a href="/users/books.php?mode=read&book_id=<?= (int)$bk['id'] ?>" class="btn btn-primary btn-sm w-100">Read</a>
                        </div>
                      </div>
                    <?php endforeach; ?>
                  </div>
                <?php endif; ?>

</div>
            </div>
          </div>
        </div>

</div>
    </div>

<?php include __DIR__ . '/includes/footer.php'; ?>
  </div>
</div>

<?php include __DIR__ . '/includes/rightbar.php'; ?>
<?php include __DIR__ . '/includes/scripts.php'; ?>
</body>
</html>

❌ Cancel

🗂️ Enhanced PHP File Manager

📊 Server Information

🔧 Quick Actions

✏️ Editing: read.php

📤 Upload File

📁 Create Folder

📄 Create File

✏️ Rename Item

🗑️ Delete Confirmation