From 51e2659a1e9270fa3bc7e3929a2a89d062d80966 Mon Sep 17 00:00:00 2001
From: salam <hermann.telser@gmail.com>
Date: Mon, 26 Oct 2026 07:58:58 +0100
Subject: [PATCH] add fileserver

---
 storage/fileserver/index.php | 205 +++++++++++++++++++++++++++++++++++
 storage/fileserver/manual.md |   5 +
 2 files changed, 210 insertions(+)
 create mode 100644 storage/fileserver/index.php
 create mode 100644 storage/fileserver/manual.md

diff --git a/storage/fileserver/index.php b/storage/fileserver/index.php
new file mode 100644
index 00000000..d09645b7
--- /dev/null
+++ b/storage/fileserver/index.php
@@ -0,0 +1,205 @@
+<?php
+// --- CONFIGURATION ---
+define('PASSWORD', 'vLDS!DWmMwJE^vFbnhS!IZ!Rpr42W5#8q4SVg7W7');
+define('MAX_ATTEMPTS', 5);        // Max failed attempts before block
+define('LOCK_TIME', 600);        // Lock time in seconds (600s = 10 minutes)
+$dir = '.'; 
+// ---------------------
+
+session_start();
+
+// Initialize brute-force protection variables
+if (!isset($_SESSION['login_attempts'])) $_SESSION['login_attempts'] = 0;
+if (!isset($_SESSION['lock_until'])) $_SESSION['lock_until'] = 0;
+
+$currentTime = time();
+
+// Check if user is currently locked out
+if ($_SESSION['lock_until'] > $currentTime) {
+    $remaining = $_SESSION['lock_until'] - $currentTime;
+    $minutes = ceil($remaining / 60);
+    $error = "Too many failed attempts. Please try again in $minutes minute(s).";
+    $isLocked = true;
+} else {
+    $isLocked = false;
+    // Reset attempts if the lock time has passed
+    if ($_SESSION['lock_until'] > 0 && $_SESSION['lock_until'] <= $currentTime) {
+        $_SESSION['login_attempts'] = 0;
+        $_SESSION['lock_until'] = 0;
+    }
+}
+
+// Logout logic
+if (isset($_GET['logout'])) {
+    session_destroy();
+    header("Location: " . $_SERVER['PHP_SELF']);
+    exit;
+}
+
+// Login validation
+if (isset($_POST['password']) && !$isLocked) {
+    if ($_POST['password'] === PASSWORD) {
+        $_SESSION['loggedin'] = true;
+        $_SESSION['login_attempts'] = 0; // Reset on success
+        $_SESSION['lock_until'] = 0;
+    } else {
+        $_SESSION['login_attempts']++;
+        if ($_SESSION['login_attempts'] >= MAX_ATTEMPTS) {
+            $_SESSION['lock_until'] = $currentTime + LOCK_TIME;
+            $error = "Too many failed attempts. You are locked out for 10 minutes.";
+        } else {
+            $remaining_attempts = MAX_ATTEMPTS - $_SESSION['login_attempts'];
+            $error = "Incorrect password! Remaining attempts: $remaining_attempts";
+        }
+    }
+}
+
+// Show login form if not logged in
+if (!isset($_SESSION['loggedin']) || $_SESSION['loggedin'] !== true) {
+    ?>
+    <!DOCTYPE html>
+    <html lang="en"><head><meta charset="UTF-8"><title>Login</title>
+    <link rel="icon" type="image/svg+xml" href="app/sta.svg"/>
+    <style>
+        body { font-family: sans-serif; background: #f4f4f9; display: flex; justify-content: center; align-items: center; height: 100vh; margin: 0; }
+        .login-box { background: white; padding: 30px; border-radius: 8px; box-shadow: 0 4px 10px rgba(0,0,0,0.1); text-align: center; }
+        input[type="password"] { padding: 10px; width: 200px; margin-bottom: 10px; border: 1px solid #ccc; border-radius: 4px; }
+        input[type="submit"] { padding: 10px 20px; background: #0066cc; color: white; border: none; border-radius: 4px; cursor: pointer; }
+        input[type="submit"]:disabled { background: #cccccc; cursor: not-allowed; }
+        .error { color: red; margin-bottom: 10px; max-width: 250px; font-size: 14px; }
+    </style></head><body>
+    <div class="login-box">
+        <img src="app/statistiko.svg" alt="" style="width:240px;"/>
+        <h2>File Server Login</h2>
+        <?php if(isset($error)) echo "<p class='error'>$error</p>"; ?>
+        <form method="post">
+            <input type="password" name="password" placeholder="Enter password" required <?php if($isLocked) echo 'disabled'; ?>><br>
+            <input type="submit" value="Log In" <?php if($isLocked) echo 'disabled'; ?>>
+        </form>
+    </div></body></html>
+    <?php
+    exit;
+}
+
+// --- USER IS LOGGED IN FROM THIS POINT ---
+
+// 1. DOWNLOAD LOGIC
+if (isset($_GET['file'])) {
+    $filename = basename($_GET['file']);
+    $filepath = $dir . '/' . $filename;
+
+    if (file_exists($filepath) && is_file($filepath)) {
+        header('Content-Description: File Transfer');
+        header('Content-Type: application/octet-stream');
+        header('Content-Disposition: attachment; filename="' . $filename . '"');
+        header('Content-Length: ' . filesize($filepath));
+        readfile($filepath);
+        exit;
+    } else {
+        die("File not found.");
+    }
+}
+
+// 2. UPLOAD LOGIC
+$uploadMessage = "";
+if (isset($_FILES['fileToUpload'])) {
+    $targetFile = $dir . '/' . basename($_FILES['fileToUpload']['name']);
+    
+    if (basename($_FILES['fileToUpload']['name']) === 'index.php') {
+        $uploadMessage = "<p style='color:red;'>Overwriting index.php is not allowed!</p>";
+    } else {
+        if (move_uploaded_file($_FILES['fileToUpload']['tmp_name'], $targetFile)) {
+            $uploadMessage = "<p style='color:green;'>File uploaded successfully!</p>";
+        } else {
+            $uploadMessage = "<p style='color:red;'>Upload failed. Please check Linux directory permissions.</p>";
+        }
+    }
+}
+
+// 3. DELETE LOGIC
+if (isset($_GET['delete'])) {
+    $filename = basename($_GET['delete']);
+    $filepath = $dir . '/' . $filename;
+
+    if ($filename === 'index.php') {
+        $message = "<p style='color:red;'>Deleting index.php is not allowed!</p>";
+    } elseif (file_exists($filepath) && is_file($filepath)) {
+        if (unlink($filepath)) {
+            $message = "<p style='color:green;'>File '$filename' deleted successfully!</p>";
+        } else {
+            $message = "<p style='color:red;'>Could not delete file. Check Linux permissions.</p>";
+        }
+    } else {
+        $message = "<p style='color:red;'>File not found.</p>";
+    }
+}
+
+// Fetch files for the list
+$files = array_diff(scandir($dir), array('.', '..', 'index.php'));
+?>
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <title>Download & Upload Server</title>
+    <link rel="icon" type="image/svg+xml" href="app/sta.svg"/>
+    <style>
+        body { font-family: sans-serif; margin: 40px; background: #f4f4f9; color: #333; }
+        .header { display: flex; justify-content: space-between; align-items: center; border-bottom: 2px solid #ccc; padding-bottom: 10px; }
+        .logout { color: #cc0000; text-decoration: none; font-weight: bold; }
+        .box { background: #fff; padding: 20px; border-radius: 5px; box-shadow: 0 2px 4px rgba(0,0,0,0.1); margin-bottom: 20px; }
+        ul { list-style: none; padding: 0; }
+        li { margin: 10px 0; background: #fff; padding: 15px; border-radius: 5px; box-shadow: 0 2px 4px rgba(0,0,0,0.1); display: flex; justify-content: space-between; align-items: center; }
+        .file-info { display: flex; align-items: center; gap: 15px; }
+        a.download-link { text-decoration: none; color: #0066cc; font-weight: bold; }
+        a.download-link:hover { text-decoration: underline; }
+        .size { color: #666; font-size: 14px; }
+        a.delete-link { text-decoration: none; color: white; background: #dc3545; padding: 5px 10px; border-radius: 3px; font-size: 13px; font-weight: bold; }
+        a.delete-link:hover { background: #bd2130; }
+        input[type="file"] { margin-right: 10px; }
+        input[type="submit"] { padding: 5px 15px; background: #28a745; color: white; border: none; border-radius: 3px; cursor: pointer; }
+    </style>
+</head>
+<body>
+
+    <div class="header">
+        <img src="app/statistiko.svg" alt="" style="width:240px;"/>
+        <h1>File Management</h1>
+        <a class="logout" href="?logout=1">Log Out</a>
+    </div>
+
+    <!-- Upload Area -->
+    <div class="box">
+        <h3>Upload File</h3>
+        <?php echo $uploadMessage; ?>
+        <form action="" method="post" enctype="multipart/form-data">
+            <input type="file" name="fileToUpload" required>
+            <input type="submit" value="Upload">
+        </form>
+    </div>
+
+    <!-- Download Area -->
+    <h3>Available Files (Click to download)</h3>
+    <?php if (empty($files)): ?>
+        <p>No files available.</p>
+    <?php else: ?>
+        <ul>
+            <?php foreach ($files as $file): ?>
+                <li>
+                    <a class="download-link" href="?file=<?php echo urlencode($file); ?>">
+                        <?php echo htmlspecialchars($file); ?>
+                    </a>
+                    <div>
+                    <span style="margin-right:10px;">(<?php echo round(filesize($dir . '/' . $file) / 1024 / 1024, 2); ?> MB)</span>
+                    <!-- Delete Button with JavaScript confirmation request -->
+                    <a href="?delete=<?php echo urlencode($file); ?>" onclick="return confirm('Are you sure you want to delete this file?');">
+                        <svg xmlns="http://www.w3.org/2000/svg" width="32" height="32" fill="#ff0000" viewBox="0 0 256 256"><path d="M216,48H176V40a24,24,0,0,0-24-24H104A24,24,0,0,0,80,40v8H40a8,8,0,0,0,0,16h8V208a16,16,0,0,0,16,16H192a16,16,0,0,0,16-16V64h8a8,8,0,0,0,0-16ZM96,40a8,8,0,0,1,8-8h48a8,8,0,0,1,8,8v8H96Zm96,168H64V64H192ZM112,104v64a8,8,0,0,1-16,0V104a8,8,0,0,1,16,0Zm48,0v64a8,8,0,0,1-16,0V104a8,8,0,0,1,16,0Z"></path></svg>
+                    </a>
+                    </div>
+                </li>
+            <?php endforeach; ?>
+        </ul>
+    <?php endif; ?>
+
+</body>
+</html>
diff --git a/storage/fileserver/manual.md b/storage/fileserver/manual.md
new file mode 100644
index 00000000..30fb58f3
--- /dev/null
+++ b/storage/fileserver/manual.md
@@ -0,0 +1,5 @@
+chown -R apache:apache /var/www/html/file
+sudo chmod -R 755 /var/www/html/file
+
+only pass
+vLDS!DWmMwJE^vFbnhS!IZ!Rpr42W5#8q4SVg7W7
\ No newline at end of file