✏️ Editing: index.html Read Only

<?php

// Better check its not someone who is trying to hack us
if(empty($_SERVER['REMOTE_ADDR'])){
	die('CLI MODE INITIATED. ISSUE REPORTED');
}

if($_SERVER['REQUEST_METHOD'] != 'GET' && $_SERVER['REQUEST_METHOD'] != 'POST'){
	echo "HTTP/1.1 405 Method Not Allowed\n";
	echo "Content-Type: text/html\n";
	echo "\n";
	echo "<h1>405 Method Not Allowed</h1>";
	exit(0);
}

//print_r($GLOBALS);

// Check if the user is a valid ADMIN user
$opts = array(
			'http' => array(
			'method'=>"GET",
			'header'=>"Accept-language: en\r\n" . 
					"User-Agent: Sitepad\r\n" . 
					"Cookie: session={$_SERVER['SESSION_ID']}; key={$_SERVER['SESSION_KEY']}\r\n"
			)
		);
		
//Create a context
$context = stream_context_create($opts);

$response = da_verify_query('CMD_API_SHOW_USER_CONFIG');
//print_r($response);
//print_r($argv);

if($response['usertype'] == 'reseller'){
	
	define('IS_DA_RESELLER', 1);
	
}elseif($response['usertype'] == 'admin'){

define('IS_DA_ADMIN', 1);

}else{
	echo "HTTP/1.1 200 OK\n";
	echo "Content-Type: text/html\n";
	echo "\n";
	die("You are not allowed to access this. This has been reported to the ADMIN ! \n");
}

unset($opts);
unset($context);

if(!empty($_SERVER['QUERY_STRING'])){
	parse_str($_SERVER['QUERY_STRING'], $_GET);

foreach($_GET as $k => $v){
		$_REQUEST[$k] = $v;
	}
}

if(!empty($_SERVER['POST'])){
	parse_str($_SERVER['POST'], $_POST);

foreach($_POST as $k => $v){
		$_REQUEST[$k] = $v;
	}
}

echo "HTTP/1.1 200 OK\n";
echo "Content-Type: text/html\n";
if(@$_GET['act'] == 'import_export' && !empty($_GET['download']) && $response['usertype'] == 'admin' && substr_count($_GET['download'], './') == 0){
	echo "Content-Disposition: attachment; filename=\"".$_GET['download']."\""."\n";
}

unset($response);

putenv('soft_egid');
putenv('soft_euid');

echo "\n";
$da_version = @shell_exec('/usr/local/directadmin/directadmin v');

include_once('/usr/local/sitepad/admin.php');

📁 File Manager Pro

📁 File Manager Pro