Add file/folder deletion

action.php

@@ -236,7 +236,7 @@ switch ($VARS['action']) {
                 $errors[] = htmlspecialchars($f['name']) . " $err";
                 continue;
             }
-            
+
             $filename = basename($f['name']);
             $filename = preg_replace("/[^a-z0-9\._\-]/", "_", strtolower($filename));
             $n = 1;
@@ -262,6 +262,29 @@ switch ($VARS['action']) {
 
         returnToSender("upload_success", "&path=" . $VARS['path']);
         break;
+    case "filedelete":
+        $file = FILE_UPLOAD_PATH . $VARS['file'];
+        if (strpos(realpath($file), FILE_UPLOAD_PATH) !== 0) {
+            returnToSender("file_security_error");
+        }
+        if (!file_exists($file)) {
+            // Either way the file is gone
+            returnToSender("file_deleted");
+        }
+        if (!is_writable($file) || realpath($file) == realpath(FILE_UPLOAD_PATH)) {
+            returnToSender("undeletable_file");
+        }
+        if (is_dir($file)) {
+            if (!rmdir($file)) {
+                returnToSender("folder_not_empty");
+            }
+        } else {
+            if (!unlink($file)) {
+                returnToSender("file_not_deleted");
+            }
+        }
+        returnToSender("file_deleted");
+        break;
     case "signout":
         session_destroy();
         header('Location: index.php');

lang/en_us.php

@@ -109,4 +109,9 @@ define("STRINGS", [
     "destination folder does not exist" => "Destination folder does not exist.",
     "destination folder does not allow uploads" => "Destination folder does not allow uploads.",
     "uploaded data too large" => "Uploaded data too large.",
+    "undeletable file" => "The file could not be deleted.",
+    "folder not empty" => "Folder must be empty to be deleted.",
+    "file not deleted" => "The file could not be deleted.",
+    "file deleted" => "File deleted.",
+    "folder deleted" => "Folder deleted.",
 ]);

lang/messages.php

@@ -57,4 +57,24 @@ define("MESSAGES", [
         "string" => "uploaded data too large",
         "type" => "danger"
     ],
+    "undeletable_file" => [
+        "string" => "undeletable file",
+        "type" => "danger"
+    ],
+    "folder_not_empty" => [
+        "string" => "folder not empty",
+        "type" => "danger"
+    ],
+    "file_not_deleted" => [
+        "string" => "file not deleted",
+        "type" => "danger"
+    ],
+    "file_deleted" => [
+        "string" => "file deleted",
+        "type" => "success"
+    ],
+    "folder_deleted" => [
+        "string" => "folder deleted",
+        "type" => "success"
+    ],
 ]);

pages/files.php

@@ -73,7 +73,6 @@ $fullpath = $base . $folder;
             $files = scandir($fullpath);
             foreach ($files as $f) {
                 if (strpos($f, '.') !== 0) {
-                    echo "<div class=\"list-group-item d-flex\">\n";
                     $link = "$folder/$f";
                     $target = "_BLANK";
                     $isdir = false;
@@ -105,9 +104,19 @@ $fullpath = $base . $folder;
                             }
                         }
                     }
-                    echo "\t<a href=\"$link\" target=\"$target\">";
-                    echo "<span class=\"$icon fa-fw\"></span> ";
-                    echo $f . "</a>\n</div>\n";
+                    ?>
+                    <div class="list-group-item d-flex justify-content-between">
+                        <a href="<?php echo $link; ?>" target="<?php echo $target; ?>">
+                            <span class="<?php echo $icon; ?> fa-fw"></span> <?php echo $f; ?>
+                        </a>
+                        <form action="action.php" method="POST">
+                            <input type="hidden" name="action" value="filedelete" />
+                            <input type="hidden" name="source" value="files" />
+                            <input type="hidden" name="file" value="<?php echo "$folder/$f"; ?>" />
+                            <button type="submit" class="btn btn-outline-danger btn-sm"><i class="fas fa-trash"></i> <?php lang("delete"); ?></button>
+                        </form>
+                    </div>
+                    <?php
                 }
             }
             ?>