setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); $db->exec("CREATE TABLE IF NOT EXISTS users (id INTEGER PRIMARY KEY AUTOINCREMENT, username TEXT UNIQUE, email TEXT, password TEXT, status TEXT DEFAULT 'pending')"); } catch (Exception $e) { die("Database setup failed: " . $e->getMessage()); } if (isset($_GET['action']) && $_GET['action'] == 'logout') { $old_user = $_SESSION['user'] ?? 'Unknown'; write_log("LOGOUT", $old_user, "User logged out successfully"); session_destroy(); header("Location: files.php"); exit; } $msg = ""; if ($_SERVER['REQUEST_METHOD'] == 'POST') { if (isset($_POST['action_login'])) { $user = trim($_POST['username']); $pass = trim($_POST['password']); $stmt = $db->prepare("SELECT * FROM users WHERE username = :user"); $stmt->execute([':user' => $user]); $row = $stmt->fetch(PDO::FETCH_ASSOC); if ($row && password_verify($pass, $row['password'])) { if ($row['status'] === 'approved') { $_SESSION['user'] = $row['username']; $_SESSION['role'] = ($row['username'] === 'admin') ? 'admin' : 'user'; write_log("LOGIN_SUCCESS", $user, "Logged in as " . $_SESSION['role']); header("Location: files.php"); exit; } else { $msg = "

Your registration is pending admin approval.

"; write_log("LOGIN_PENDING", $user, "Attempted login while status is pending"); } } else { $msg = "

Invalid username or password.

"; write_log("LOGIN_FAILED", $user, "Failed login attempt (invalid credentials)"); } } if (isset($_POST['action_register'])) { $user = trim($_POST['username']); $email = trim($_POST['email']); $pass = trim($_POST['password']); if (!empty($user) && !empty($email) && !empty($pass)) { $hash = password_hash($pass, PASSWORD_DEFAULT); try { $stmt = $db->prepare("INSERT INTO users (username, email, password, status) VALUES (:user, :email, :hash, 'pending')"); $stmt->execute([':user' => $user, ':email' => $email, ':hash' => $hash]); $msg = "

Registration submitted! Awaiting approval.

"; write_log("REGISTRATION", $user, "New account registration requested (Email: $email)"); } catch (Exception $e) { $msg = "

Username already exists.

"; write_log("REGISTRATION_REJECTED", $user, "Username collision or DB block"); } } else { $msg = "

All fields are required.

"; } } if (isset($_SESSION['role']) && $_SESSION['role'] === 'admin') { if (isset($_POST['approve_user'])) { $stmt = $db->prepare("SELECT username FROM users WHERE id = :id"); $stmt->execute([':id' => $_POST['user_id']]); $u_target = $stmt->fetchColumn(); $stmt = $db->prepare("UPDATE users SET status = 'approved' WHERE id = :id AND username != 'admin'"); $stmt->execute([':id' => $_POST['user_id']]); write_log("ADMIN_ACTION", $_SESSION['user'], "Approved user account: $u_target"); } if (isset($_POST['delete_user'])) { $stmt = $db->prepare("SELECT username FROM users WHERE id = :id"); $stmt->execute([':id' => $_POST['user_id']]); $u_target = $stmt->fetchColumn(); $stmt = $db->prepare("DELETE FROM users WHERE id = :id AND username != 'admin'"); $stmt->execute([':id' => $_POST['user_id']]); write_log("ADMIN_ACTION", $_SESSION['user'], "Permanently deleted user account: $u_target"); } if (isset($_POST['delete_file'])) { $file_to_del = basename($_POST['file_name']); $target_del_path = $upload_dir . $file_to_del; if (file_exists($target_del_path) && unlink($target_del_path)) { $msg = "

File safely deleted.

"; write_log("FILE_DELETE", $_SESSION['user'], "Admin deleted file: $file_to_del"); } else { $msg = "

Failed to delete file.

"; } } } if (isset($_SESSION['user']) && isset($_FILES['uploaded_file'])) { $f_err = $_FILES['uploaded_file']['error']; $f_sz = $_FILES['uploaded_file']['size']; $f_name = basename($_FILES['uploaded_file']['name']); $tgt = $upload_dir . $f_name; $ext = strtolower(pathinfo($tgt, PATHINFO_EXTENSION)); if ($f_err === UPLOAD_ERR_INI_SIZE || $f_err === UPLOAD_ERR_FORM_SIZE || $f_sz > MAX_FILE_SIZE) { $msg = "

File exceeds 15MB limit.

"; write_log("UPLOAD_FAILED", $_SESSION['user'], "Attempted file over 15MB limit: $f_name"); } else if (!in_array($ext, ['jpg', 'jpeg', 'png', 'webp', 'gif', 'pdf', 'txt', 'mp3', 'mp4', 'doc', 'docx', 'xls', 'xlsx'])) { $msg = "

Scripts are forbidden.

"; write_log("SECURITY_ALERT", $_SESSION['user'], "Attempted to upload malicious script file extension: $f_name"); } else if (move_uploaded_file($_FILES['uploaded_file']['tmp_name'], $tgt)) { $msg = "

Uploaded successfully.

"; write_log("FILE_UPLOAD", $_SESSION['user'], "Successfully uploaded file: $f_name (" . round($f_sz/1024, 2) . " KB)"); } else { $msg = "

Failed to save file.

"; } } } if (isset($_GET['download']) && isset($_SESSION['user'])) { $file = basename($_GET['download']); $filepath = $upload_dir . $file; if (file_exists($filepath)) { write_log("FILE_DOWNLOAD", $_SESSION['user'], "Downloaded file: $file"); header('Content-Description: File Transfer'); header('Content-Type: application/octet-stream'); header('Content-Disposition: attachment; filename="' . $file . '"'); header('Content-Length: ' . filesize($filepath)); readfile($filepath); exit; } } ?> Secure File Server

Secure File Server ← Portal Home

Login

Request Access (Register)

User: Logout

Admin User Control Panel

query("SELECT * FROM users WHERE username != 'admin'")->fetchAll(PDO::FETCH_ASSOC); foreach ($users as $u): ?>
UsernameEmailActions
[]

System Activity Log

Upload a File (Max 15MB)

Available Files