Enhanced PHP File Manager

⬆️ Go Up (..)

📊 Server Information

Server:

LiteSpeed

System:

Linux 5.14.0-503.34.1.el9_5.x86_64

PHP Version:

8.2.30

User:

u329947844

Directory:

/home/u329947844/domains/hifi11.in/public_html/college/store/users

Free Space:

10.26 TB

🔧 Quick Actions

✏️ Editing: stream_pdf.php

<?php
declare(strict_types=1);
session_start();

require_once __DIR__ . '/../includes/config.php'; // db() + esc()

if (empty($_SESSION['user']['id'])) {
  http_response_code(401);
  exit('Unauthorized');
}

$uid   = (int)$_SESSION['user']['id'];
$conn  = db();
$token = isset($_GET['token']) ? trim((string)$_GET['token']) : '';

if ($token === '' || empty($_SESSION['pdf_tokens'][$token])) {
  http_response_code(403);
  exit('Invalid or expired token.');
}
$tok = $_SESSION['pdf_tokens'][$token];
if ($tok['uid'] !== $uid || $tok['expires'] < time()) {
  unset($_SESSION['pdf_tokens'][$token]);
  http_response_code(403);
  exit('Invalid or expired token.');
}
$bookId = (int)$tok['book_id'];

/* Optional: make token single-use */
// unset($_SESSION['pdf_tokens'][$token]);

/* ownership check */
$stmt = $conn->prepare('
  SELECT 1
  FROM orders o
  JOIN order_items oi ON oi.order_id = o.id
  WHERE o.user_id = ? AND oi.book_id = ?
  LIMIT 1
');
$stmt->bind_param('ii', $uid, $bookId);
$stmt->execute();
$owns = (bool)$stmt->get_result()->fetch_row();
$stmt->close();

if (!$owns) { http_response_code(403); exit('Forbidden'); }

/* fetch path */
$stmt = $conn->prepare('SELECT name, pdf_path FROM books WHERE id=? LIMIT 1');
$stmt->bind_param('i', $bookId);
$stmt->execute();
$book = $stmt->get_result()->fetch_assoc() ?: null;
$stmt->close();

if (!$book || !($book['pdf_path'] ?? '')) { http_response_code(404); exit('File not found'); }

/* absolute file under ../admin/ */
$rel  = ltrim((string)$book['pdf_path'], '/\\');
$base = realpath(__DIR__ . '/../admin');
if ($base === false) { http_response_code(500); exit('Storage not available'); }
$full = realpath($base . DIRECTORY_SEPARATOR . $rel);

/* path traversal guard */
if ($full === false || strncmp($full, $base, strlen($base)) !== 0) {
  http_response_code(403);
  exit('Forbidden path');
}

/* block explicit downloads */
if (isset($_GET['download']) && $_GET['download'] === '1') {
  http_response_code(403);
  exit('Download disabled');
}

/* stream */
if (!is_file($full) || !is_readable($full)) { http_response_code(404); exit('Missing file'); }

$filename = preg_replace('~[^a-z0-9\-\._ ]~i', '', (string)($book['name'] ?? 'book')) . '.pdf';
$filesize = filesize($full);

header('Content-Type: application/pdf');
header('Content-Disposition: inline; filename="' . $filename . '"');
header('X-Content-Type-Options: nosniff');
header('X-Frame-Options: SAMEORIGIN');
header('Referrer-Policy: same-origin');
header('Cache-Control: no-store, no-cache, must-revalidate, max-age=0');
header('Pragma: no-cache');
header('Expires: 0');

/* partial content (for PDF.js) */
$range = $_SERVER['HTTP_RANGE'] ?? '';
if ($range && preg_match('/bytes=(\d+)-(\d*)/', $range, $m)) {
  $start = (int)$m[1];
  $end   = ($m[2] !== '') ? (int)$m[2] : ($filesize - 1);
  $start = max(0, $start);
  $end   = min($filesize - 1, $end);
  if ($start <= $end) {
    header('HTTP/1.1 206 Partial Content');
    header('Accept-Ranges: bytes');
    header("Content-Range: bytes $start-$end/$filesize");
    header('Content-Length: ' . (string)($end - $start + 1));
    $fp = fopen($full, 'rb'); if ($fp === false) { http_response_code(500); exit; }
    fseek($fp, $start);
    $buf = 8192; $left = $end - $start + 1;
    while ($left > 0 && !feof($fp)) {
      $read = ($left > $buf) ? $buf : $left;
      echo fread($fp, $read);
      $left -= $read;
      @ob_flush(); @flush();
    }
    fclose($fp);
    exit;
  }
}

/* full content */
header('Content-Length: ' . (string)$filesize);
$fp = fopen($full, 'rb'); if ($fp === false) { http_response_code(500); exit; }
while (!feof($fp)) {
  echo fread($fp, 8192);
  @ob_flush(); @flush();
}
fclose($fp);

❌ Cancel

🗂️ Enhanced PHP File Manager

📊 Server Information

🔧 Quick Actions

✏️ Editing: stream_pdf.php

📤 Upload File

📁 Create Folder

📄 Create File

✏️ Rename Item

🗑️ Delete Confirmation