<?php
/*
 * findex - file lister and browser in php
 * Copyright (C) 2010-2014  ed <tripflag@gmail.com>
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License v2
 * (version 2) as published by the Free Software Foundation.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, refer to the following URL:
 * http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt
 */


/* == INSTALLATION ==
 * copy php/css/js/jpg files (and the hidden .ico folder)
 * into whatever directory, then run the following as root:
 *
 * mkdir .th
 * chmod 700 .th
 * chown www-data.www-data .th
 */


// list of folders to hide from browser
$hidden = array( 'index.php', 'the.css', 'the.js', 'the.jq.js', 'the.jpg' );

// putting index.php in these locations will disable javscript (media player)
$noscript = array( '/home/kilim/www/droid' );



if (isset($_GET['dat']) && $_GET['dat']=='sauce') die(highlight_file('index.php'));

function denied(){ die('<h1>403 forbiddena</h1>'); }
function buglol(){ die('<h1>fuckdamn shitcunts</h1>'); }
function sploit($m){ die('<h1>you tryin ter sploit me brah</h1><h2>'.$m.'</h2>'); }

header('Content-Type: text/html; charset=UTF-8');
header('Cache-Control: no-cache, must-revalidate');
header('Expires: Sat, 09 Jan 2009 09:09:09 GMT');
?><!DOCTYPE html><html><head>
<meta charset="utf-8" />
<link rel="stylesheet" type="text/css" media="screen" href="the.css" />
</head><body><div id="deblug">
<?php

// because php syntax is pig disgusting
function startsWith($a,$b) {return (strncmp($a,$b,strlen($b))===0);}
function endsWith($a,$b) {return (strlen($a)>=strlen($b)&&strcmp(substr($a,strlen($b)),$b)===0);}

$path = $_SERVER['REQUEST_URI'];
//echo $path;
$path = explode('?',$path);
// extract path, die if illegal format
    if (count($path) == 1) $path = '';
elseif (count($path) == 2) $path = $path[1];
else {
	print_r($path);
	sploit('1)'.$path);
}

//$path = urldecode($path);
$orgpath = $path;
$path = dec($path);
//$path = rawurldecode($path);
$self = realpath(dirname(__FILE__));
$path = realpath($path);
if (!startsWith($path, $self)) sploit('2)'.$orgpath);
$path = substr($path, strlen($self)+1);
$pathp = './'.$path.'/';
if (!is_dir($pathp)) sploit('3)'.$orgpath);

// validate that we have GD installed
if (!function_exists('ImageCreate') ||
	!function_exists('ImageCreateFromJPEG') ||
	!function_exists('ImageCreateFromPNG') ||
	!function_exists('ImageCreateFromGIF')) {
	die('WHAT THE FUCK ARE YOU DOING');
}

$listraw = array();
$ptr = @dir($pathp) or buglol();
while (($item = $ptr->read()) !== false) {
	if (startsWith($item, '.')) continue;
	$listraw[] = $item;
}
$ptr->close();
sort($listraw);
echo('</div>');

echo('<div id="top"><a href="#" id="mediaswitch">media player</a><a href="?dat=sauce">source code</a></div>');

$nope = false;
$dirs = array();
$fils = array();
for ($a=0; $a<count($listraw); $a++) {
	$fn = $listraw[$a];
	$ip = $pathp.$fn;
	$add = array(
		'path' => $ip,
		'name' => $fn,
		'last' => date(
			'Y-m-d, H:i:s',
			filemtime($ip))
	);
	if (is_dir($ip)) {
		$add['size'] = 0;
		$add['type'] = 'Directory';
		$dirs[] = $add;
	} elseif ($fn == 'index.html') {
		$nope = true;
	} elseif (is_readable($ip) && !in_array($fn, $hidden)) {
		$add['type'] = mime_content_type($ip);
		$add['size'] = number_format(
			filesize($ip));// / 1024,
			//3, ",", "'") . "kB";
		$fils[] = $add;
	}
}
$list = array_merge($dirs,$fils);

$pathsc = '';
$paths = explode('/', $path);
echo('<div id="plist"><a href="?">/</a>'."\r\n");
for ($a=0; $a<count($paths); $a++) {
	$pathsc .= $paths[$a];
	echo('<b></b>');
	echo('<a href="?'.enc($pathsc).'">'.$paths[$a].'</a>'."\r\n");
	$pathsc .= '/';
}

$patha = $path;
if($patha != '') $patha .= '/';
echo('</div><div id="flist">'."\r\n");
if ($nope) denied();
for ($a=0; $a<count($list); $a++) {
	$i = $list[$a];
	$fn = $i['name'];
	$ext = $fn;
	$ip = $patha.$fn;
	$qm = '';
	if ($i['type'] == 'Directory') {
		$ext = 'folder';
		$qm = '?';
	} else {
		$fn = substr($fn, 0, strrpos($fn, '.'));
		$ext = substr($ext, strlen($fn) + 1);
	}
	$lxt = strtolower($ext);
	$ico = '.ico/'. $ext. '.png';
	if ($qm == '?') {
		$burl = $ip . '/';
		$icob = $burl . 'cover.jpg';
		$icoc = $burl . 'cover.png';
		if (file_exists($icob)) $ico = $icob;
		if (file_exists($icoc)) $ico = $icoc;
		if (file_exists($burl . 'index.html')) $ico = '.ico/403.png';
	} else if (($fn == 'cover') && ($ext == 'png' || $ext == 'gif' || $ext == 'jpg')) {
		$ico = $ip;
	} else if(
		$lxt == 'jpg' ||
		$lxt == 'png' ||
		$lxt == 'gif') {
		$th = '.th/'.$ip.'.jpg';
		if (!file_exists($th)) {
			@mkdir('./.th/'.$patha, 0700, true);

			$im = '';
			$is = GetImageSize($ip);
			if ($is[2]==1) $im = @ImageCreateFromGIF($ip);
			if ($is[2]==2) $im = @ImageCreateFromJPEG($ip);
			if ($is[2]==3) $im = @ImageCreateFromPNG($ip);
			if (!$im) {
				$ico = '.ico/bad.png';
			} else {
				$ico = $th;
				$x = 256; $y = 256;
				if ($x>=$is[0] && $y>=$is[1]) {
					copy($ip, $th);
				} else {
					$dx = $is[0] / $x;
					$dy = $is[1] / $y;
					$dd = min($dx, $dy);
					$sx = $x * $dd;
					$sy = $y * $dd;
					$ox = ($sx - $is[0]) /-2;
					$oy = ($sy - $is[1]) /-2;
					if (function_exists('ImageCreateTrueColor'))
						$od = ImageCreateTrueColor($x, $y);
					else $od = ImageCreate($x, $y);
					@ImageCopyResampled(
						$od, $im, 0, 0, $ox, $oy,
						$x, $y, $sx, $sy);
					$tf = tempnam('/tmp','ith');
					@ImageJPEG($od, $tf, 70);
					@ImageDestroy($im);
					@ImageDestroy($od);
					@copy($tf, $th);
					@unlink($tf);
					@chmod($th, 0644);
				}
			}
		} else $ico = $th;
	}
	if (!file_exists($ico))
	{
		$ico = '.ico/unknown.png';
	}
	echo('<a href="'.$qm.enc($ip).'" title="'.
		$i['type'] .'<br />'.
		$i['last'] .'<br />'.
		$i['size'] .'">'.
		'<img src="'.$ico.'" />'.
		'<span>'. $i['name'] .'</span></a>'."\r\n");
}
echo("<b class=\"clr\"></b></div>\n");
//die("[eof]\r\n");

//function enc($a) { return str_replace(' ', '%20', $a); }
//function dec($a) { return str_replace('%20', ' ', $a); }
function dec($a) { return rawurldecode($a); }
function enc($a) { return str_replace('%2F', '/', rawurlencode($a)); }

if (!in_array($self, $noscript)) { ?>
<script src="the.jq.js"></script>
<script src="the.js"></script>
<?php } ?>
</body></html>
