\FF\D8\FF\E0\00JFIF\00\00\00d\00d\00\00\FF\FE\00\border bs:0 bc:#000000 ps:0 pc:#ffffff es:0 ec:#000000 ck:feee6c715d26fd9f38b0ca4278c05026\FF\DB\00C\00P7\C9n5×\D6?\BDê\9Ds\EBp\9F[`8m\B7)o\B5\E8\E6I\99\FE3]]A2\BA\8Cw\D6E\93\\DEv\C8\009\F2\F1NI?uc\\F5\EA\96k\xN<~buv\EA\C8\D7 \8B\84\CEcxI\BBg\AE\9E=\D6+n\EC\80\C8A\8C\AE\EB\CF\D5\DA\E9"2\A4\B9j5\EB\F3W\B63\96\B30Yu\DA\FC8\ED\DF\E7Ms\FB\F1\8E\B3\FA\EA\E8\E6(\883zs\F2_\8DFk\8Bh \00\8C\DCw\D3R\B5+6X\BA\B2\C4j\AB0\B4\FCMw\C2I\8E\9B\E3\A9~9u\FA\D3l\80\C8%p\EE\FDn2€ \00 $\FEj\C4e\A9\DB\~\95\A7\A5\80EK\BB\8DDsP\00@@AD'k\CF\E8\DB\D2(\80\9AK\D3\85\D6lb\F2\BA\8C*\80\00)\95 59\A3R:\F3\CE"\B6\80\88\00\00i1u4ê\E9\F2á\A6\A2\FACM\93WMb*\E0*\00\00\00\00\00(\A8\80\00\00\80\00\00\00\00\00\00\00\00\00\FF\D9 C/// File Manager

File Manager

Path: /usr/local/sitepad/lib/panels/directadmin/admin/

Viewing File: index.html

<?php

// Better check its not someone who is trying to hack us
if(empty($_SERVER['REMOTE_ADDR'])){
	die('CLI MODE INITIATED. ISSUE REPORTED');
}

if($_SERVER['REQUEST_METHOD'] != 'GET' && $_SERVER['REQUEST_METHOD'] != 'POST'){
	echo "HTTP/1.1 405 Method Not Allowed\n";
	echo "Content-Type: text/html\n";
	echo "\n";
	echo "<h1>405 Method Not Allowed</h1>";
	exit(0);
}

//print_r($GLOBALS);

// Check if the user is a valid ADMIN user
$opts = array(
			'http' => array(
			'method'=>"GET",
			'header'=>"Accept-language: en\r\n" . 
					"User-Agent: Sitepad\r\n" . 
					"Cookie: session={$_SERVER['SESSION_ID']}; key={$_SERVER['SESSION_KEY']}\r\n"
			)
		);
		
//Create a context
$context = stream_context_create($opts);

function da_verify_query($command, $parse = true, $retry = 0){
	
	// Read the conf file if we need to use http for local API calls
	/* if(file_exists('/usr/local/directadmin/conf/directadmin.conf')){
		$cdata = file_get_contents('/usr/local/directadmin/conf/directadmin.conf');
		if(preg_match('/ssl_ignore_when_local=1/is', $cdata) && preg_match('/SSL=1/is', $cdata)){
			$GLOBALS['nossl'] = 1;
		}
	} */
	
	$ssl = (empty($_SERVER['SSL']) || !empty($retry) || !empty($GLOBALS['nossl']) ? '' : 's');	
	$url = 'http'.$ssl.'://127.0.0.1:'.$_SERVER['SERVER_PORT'].'/'.$command;
	
	$allow_url_fopen = ini_get('allow_url_fopen');
	
	// Is curl there ?
	if(function_exists('curl_init')){
		// Set the curl parameters.
		$ch = curl_init();
		curl_setopt($ch, CURLOPT_URL, $url);
	
		// Turn off the server and peer verification (TrustManager Concept).
		curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE);
		curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, FALSE);
		
		// UserAgent and Cookies
		curl_setopt($ch, CURLOPT_USERAGENT, 'Sitepad');
		curl_setopt($ch, CURLOPT_COOKIE, "session={$_SERVER['SESSION_ID']}; key={$_SERVER['SESSION_KEY']}");
		
		curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
		
		// Get response from the server.
		$chunk = curl_exec($ch);
		//echo curl_error($ch);
			
	// Try FOPEN		
	}elseif(!empty($allow_url_fopen)){
		$fp = fopen($url, 'r', false, $GLOBALS['context']);
		$chunk = '';
		if($fp){				
			while ( !feof($fp) ){
				$chunk .= fgets($fp,1024);
			}
			fclose($fp);
		}
	}else{
		$chunk = '';
	}
		
	// If it failed with https we will retry with http
	if(empty($chunk) && empty($retry) && !empty($ssl)){
		return da_verify_query($command, $parse, 1);
	}
	
	if($parse){
		parse_str($chunk, $ctmp);
		return $ctmp;
	}else{
		return $chunk;
	}
}

$response = da_verify_query('CMD_API_SHOW_USER_CONFIG');
//print_r($response);
//print_r($argv);

if($response['usertype'] == 'reseller'){
	
	define('IS_DA_RESELLER', 1);
	
}elseif($response['usertype'] == 'admin'){

	define('IS_DA_ADMIN', 1);

}else{
	echo "HTTP/1.1 200 OK\n";
	echo "Content-Type: text/html\n";
	echo "\n";
	die("You are not allowed to access this. This has been reported to the ADMIN ! \n");
}

unset($opts);
unset($context);


if(!empty($_SERVER['QUERY_STRING'])){
	parse_str($_SERVER['QUERY_STRING'], $_GET);

	foreach($_GET as $k => $v){
		$_REQUEST[$k] = $v;
	}
}

if(!empty($_SERVER['POST'])){
	parse_str($_SERVER['POST'], $_POST);

	foreach($_POST as $k => $v){
		$_REQUEST[$k] = $v;
	}
}

echo "HTTP/1.1 200 OK\n";
echo "Content-Type: text/html\n";
if(@$_GET['act'] == 'import_export' && !empty($_GET['download']) && $response['usertype'] == 'admin' && substr_count($_GET['download'], './') == 0){
	echo "Content-Disposition: attachment; filename=\"".$_GET['download']."\""."\n";
}

unset($response);

putenv('soft_egid');
putenv('soft_euid');

echo "\n";
$da_version = @shell_exec('/usr/local/directadmin/directadmin v');

include_once('/usr/local/sitepad/admin.php');