Merge pull request #13 from qkqpttgf/master

2.0.0.4

.htaccess

@@ -1,2 +1,15 @@
+# apache
+# LoadModule rewrite_module modules/mod_rewrite.so
+# AllowOverride All
 RewriteEngine On
 RewriteRule ^(.*) index.php?/$1 [L]
+
+#-----------------------------------
+# nginx
+# rewrite ^(.*) index.php?/$1 last;
+#
+# caddy (not sure)
+# rewrite {
+#     to index.php?/$1
+# }
+#-----------------------------------

conststr.php

@@ -13,7 +13,7 @@ $constStr = [
         'zh-cn' => '中文',
         'ja' => '日本語',
         'ko-kr' => '한국어',
-        'fa' => 'Persian',
+        'fa' => 'فارسی',
     ],
     'Week' => [
         'en-us' => [
@@ -72,6 +72,7 @@ $constStr = [
             'downloadencrypt' => '0 or 1. if 1, the files in encrypt folder can be downloaded without password',
             'background' => 'Set an url as background photo, or put a \'background.jpg\' at showed path.',
             'guestup_path' => 'Set guest upload dir, before set this, the files in this dir will show as normal.',
+            'hideFunctionalityFile' => '0 or 1. if 1, some file will not show in list to guest, like readme.md',
             'passfile' => 'The password of dir will save in this file.',
             'public_path' => 'Show this Onedrive dir when through the long url of API Gateway; public show files less than private.',
             'sitename' => 'sitename',
@@ -86,6 +87,7 @@ $constStr = [
             'downloadencrypt' => '0 或 1。如果 1, 那加密目录内的文件可以不需要密码就能下载。',
             'background' => '设置一个url作为背景，或者在你显示的目录放一个background.jpg文件。',
             'guestup_path' => '设置游客上传路径（图床路径），不设置这个值时该目录内容会正常列文件出来，设置后只有上传界面，不显示其中文件（登录后显示）。',
+            'hideFunctionalityFile' => '0 或 1。如果 1, 某些文件不列表给游客看，但它的功能正常，比如readme.md',
             'passfile' => '自定义密码文件的名字，可以是\'pppppp\'，也可以是\'aaaa.txt\'等等；列目录时不会显示，只有知道密码才能查看或下载此文件。密码是这个文件的内容，可以空格、可以中文；',
             'public_path' => '使用API长链接访问时，显示网盘文件的路径，不设置时默认为根目录；不能是private_path的上级（public看到的不能比private多，要么看到的就不一样）。',
             'sitename' => '网站的名称',

function/common.php

@@ -12,6 +12,7 @@ $Base64Env = [
     //'disktag',
     //'downloadencrypt',
     //'function_name', // used in heroku.
+    //'hideFunctionalityFile',
     //'language',
     //'passfile',
     'sitename',
@@ -36,6 +37,7 @@ $CommonEnv = [
     'background',
     'disktag',
     'function_name', // used in heroku.
+    'hideFunctionalityFile',
     'language',
     'passfile',
     'sitename',
@@ -52,6 +54,7 @@ $ShowedCommonEnv = [
     'background',
     //'disktag',
     //'function_name', // used in heroku.
+    'hideFunctionalityFile',
     'language',
     'passfile',
     'sitename',
@@ -84,16 +87,30 @@ $ShowedInnerEnv = [
     //'token_expires',
 ];
 
+function isHideFile($name)
+{
+    $FunctionalityFile = [
+        'head.md',
+        'readme.md',
+        'favicon.ico',
+    ];
+
+    if ($name == getConfig('passfile')) return true;
+    if (substr($name,0,1) == '.') return true;
+    if (getConfig('hideFunctionalityFile')) if (in_array(strtolower($name), $FunctionalityFile)) return true;
+    return false;
+}
+
 function getcache($str)
 {
-    $cache = null;
+    //$cache = null;
     $cache = new \Doctrine\Common\Cache\FilesystemCache(sys_get_temp_dir(), __DIR__.'/Onedrive/'.$_SERVER['disktag']);
     return $cache->fetch($str);
 }
 
-function savecache($key, $value, $exp = 3300)
+function savecache($key, $value, $exp = 1800)
 {
-    $cache = null;
+    //$cache = null;
     $cache = new \Doctrine\Common\Cache\FilesystemCache(sys_get_temp_dir(), __DIR__.'/Onedrive/'.$_SERVER['disktag']);
     $cache->save($key, $value, $exp);
 }
@@ -364,7 +381,8 @@ function message($message, $title = 'Message', $statusCode = 200)
 
         </p>
     </body>
-</html>', $statusCode);
+</html>
+', $statusCode);
 }
 
 function needUpdate()
@@ -488,8 +506,8 @@ function main($path)
     global $constStr;
 //echo 'main.enterpath:'.$path.'
 //';
-    $constStr['language'] = $_COOKIE['language'];
+    if (isset($_COOKIE['language'])) $constStr['language'] = $_COOKIE['language'];
-    if ($constStr['language']=='') $constStr['language'] = getConfig('language');
+    if (!$constStr['language']) $constStr['language'] = getConfig('language');
     if ($constStr['language']=='') $constStr['language'] = 'en-us';
     $_SERVER['language'] = $constStr['language'];
     $_SERVER['PHP_SELF'] = path_format($_SERVER['base_path'] . $path);
@@ -501,6 +519,7 @@ function main($path)
         $_SERVER['disktag'] = $path;
         $pos = strpos($path, '/');
         if ($pos>1) $_SERVER['disktag'] = substr($path, 0, $pos);
+        if (!in_array($_SERVER['disktag'], $disktags)) return message('Please visit from <a href="'.$_SERVER['base_path'].'">Home Page</a>.', 'Error', 404);
         $path = substr($path, strlen('/'.$_SERVER['disktag']));
         if ($_SERVER['disktag']!='') $_SERVER['base_disk_path'] = path_format($_SERVER['base_disk_path']. '/' . $_SERVER['disktag'] . '/');
     } else $_SERVER['disktag'] = $disktags[0];
@@ -517,8 +536,8 @@ function main($path)
     } else {
         $adminloginpage = getConfig('adminloginpage');
     }
-    if ($_GET[$adminloginpage]) {
+    if (isset($_GET[$adminloginpage])) {
-        if ($_GET['preview']) {
+        if (isset($_GET['preview'])) {
             $url = $_SERVER['PHP_SELF'] . '?preview';
         } else {
             $url = path_format($_SERVER['PHP_SELF'] . '/');
@@ -532,13 +551,13 @@ function main($path)
         }
     }
     if (getConfig('admin')!='')
-        if ( $_COOKIE['admin']==md5(getConfig('admin')) || $_POST['password1']==getConfig('admin') ) {
+        if ( (isset($_COOKIE['admin'])&&$_COOKIE['admin']==md5(getConfig('admin'))) || (isset($_POST['password1'])&&$_POST['password1']==getConfig('admin')) ) {
             $_SERVER['admin']=1;
             $_SERVER['needUpdate'] = needUpdate();
         } else {
             $_SERVER['admin']=0;
         }
-    if ($_GET['setup'])
+    if (isset($_GET['setup']))
         if ($_SERVER['admin']) {
             // setup Environments. 设置，对环境变量操作
             return EnvOpt($_SERVER['needUpdate']);
@@ -549,7 +568,7 @@ function main($path)
     
     if (getConfig('admin')=='') return install();
     config_oauth();
-    if ($_SERVER['admin']) if ($_GET['AddDisk']||$_GET['authorization_code']) return get_refresh_token();
+    if ($_SERVER['admin']) if (isset($_GET['AddDisk'])||isset($_GET['authorization_code'])) return get_refresh_token();
     $refresh_token = getConfig('refresh_token');
     //if (!$refresh_token) return get_refresh_token();
     if (!$refresh_token) {
@@ -566,7 +585,7 @@ function main($path)
         error_log('Get access token:'.json_encode($ret, JSON_PRETTY_PRINT));
         $_SERVER['access_token'] = $ret['access_token'];
         savecache('access_token', $_SERVER['access_token'], $ret['expires_in'] - 300);
-        if (time()>getConfig('token_expires')) setConfig([ 'refresh_token' => $ret['refresh_token'], 'token_expires' => time()+30*24*60*60 ]);
+        if (time()>getConfig('token_expires')) setConfig([ 'refresh_token' => $ret['refresh_token'], 'token_expires' => time()+7*24*60*60 ]);
     }
 
     $_SERVER['retry'] = 0;
@@ -607,7 +626,7 @@ function main($path)
         if ($_SERVER['ajax']) return output(getconstStr('RefreshtoLogin'),401);
     }
     $_SERVER['ishidden'] = passhidden($path);
-    if ($_GET['thumbnails']) {
+    if (isset($_GET['thumbnails'])) {
         if ($_SERVER['ishidden']<4) {
             if (in_array(strtolower(substr($path, strrpos($path, '.') + 1)), $exts['img'])) {
                 return get_thumbnails_url($path);
@@ -624,11 +643,13 @@ function main($path)
                 if (strtolower(splitlast($filename,'.')[1])==strtolower($_GET['random'])) $tmp[$filename] = $files['children'][$filename]['@microsoft.graph.downloadUrl'];
             }
             $tmp = array_values($tmp);
-            if (count($tmp)>0) return output('', 302, [ 'Location' => $tmp[rand(0,count($tmp)-1)] ]);
+            if (count($tmp)>0) {
-            else return output('',404);
+		if (isset($_GET['url'])) return output($tmp[rand(0,count($tmp)-1)], 200);
+		return output('', 302, [ 'Location' => $tmp[rand(0,count($tmp)-1)] ]);
+            } else return output('',404);
         } else return output('',401);
     }
-    if (isset($files['file']) && !$_GET['preview']) {
+    if (isset($files['file']) && !isset($_GET['preview'])) {
         // is file && not preview mode
         if ( $_SERVER['ishidden']<4 || (!!getConfig('downloadencrypt')&&$files['name']!=getConfig('passfile')) ) return output('', 302, [ 'Location' => $files['@microsoft.graph.downloadUrl'] ]);
     }
@@ -699,7 +720,7 @@ function adminoperate($path)
     $path1 = path_format($_SERVER['list_path'] . path_format($path));
     if (substr($path1,-1)=='/') $path1=substr($path1,0,-1);
     $tmparr['statusCode'] = 0;
-    if ($_GET['rename_newname']!=$_GET['rename_oldname'] && $_GET['rename_newname']!='') {
+    if (isset($_GET['rename_newname'])&&$_GET['rename_newname']!=$_GET['rename_oldname'] && $_GET['rename_newname']!='') {
         // rename 重命名
         $oldname = spurlencode($_GET['rename_oldname']);
         $oldname = path_format($path1 . '/' . $oldname);
@@ -709,7 +730,7 @@ function adminoperate($path)
         //savecache('path_' . $path1, json_decode('{}',true), 1);
         return output($result['body'], $result['stat']);
     }
-    if ($_GET['delete_name']!='') {
+    if (isset($_GET['delete_name'])) {
         // delete 删除
         $filename = spurlencode($_GET['delete_name']);
         $filename = path_format($path1 . '/' . $filename);
@@ -718,7 +739,7 @@ function adminoperate($path)
         //savecache('path_' . $path1, json_decode('{}',true), 1);
         return output($result['body'], $result['stat']);
     }
-    if ($_GET['operate_action']==getconstStr('encrypt')) {
+    if (isset($_GET['operate_action'])&&$_GET['operate_action']==getconstStr('encrypt')) {
         // encrypt 加密
         if (getConfig('passfile')=='') return message(getconstStr('SetpassfileBfEncrypt'),'',403);
         if ($_GET['encrypt_folder']=='/') $_GET['encrypt_folder']=='';
@@ -730,7 +751,7 @@ function adminoperate($path)
         savecache('path_' . $path1 . '/?password', '', 1);
         return output($result['body'], $result['stat']);
     }
-    if ($_GET['move_folder']!='') {
+    if (isset($_GET['move_folder'])) {
         // move 移动
         $moveable = 1;
         if ($path == '/' && $_GET['move_folder'] == '/../') $moveable=0;
@@ -750,7 +771,7 @@ function adminoperate($path)
             return output('{"error":"'.getconstStr('CannotMove').'"}', 403);
         }
     }
-    if ($_GET['copy_name']!='') {
+    if (isset($_GET['copy_name'])) {
         // copy 复制
         $filename = spurlencode($_GET['copy_name']);
         $filename = path_format($path1 . '/' . $filename);
@@ -786,7 +807,7 @@ function adminoperate($path)
             //savecache('path_' . $path2, json_decode('{}',true), 1);
         return output($result['body'].json_encode($result['Location']), $result['stat']);
     }
-    if ($_POST['editfile']!='') {
+    if (isset($_POST['editfile'])) {
         // edit 编辑
         $data = $_POST['editfile'];
         /*TXT一般不会超过4M，不用二段上传
@@ -799,7 +820,7 @@ function adminoperate($path)
         $resultarry = json_decode($result,true);
         if (isset($resultarry['error'])) return message($resultarry['error']['message']. '<hr><a href="javascript:history.back(-1)">'.getconstStr('Back').'</a>','Error',403);
     }
-    if ($_GET['create_name']!='') {
+    if (isset($_GET['create_name'])) {
         // create 新建
         if ($_GET['create_type']=='file') {
             $filename = spurlencode($_GET['create_name']);
@@ -813,7 +834,7 @@ function adminoperate($path)
         //savecache('path_' . $path1, json_decode('{}',true), 1);
         return output($result['body'], $result['stat']);
     }
-    if ($_GET['RefreshCache']) {
+    if (isset($_GET['RefreshCache'])) {
         $path1 = path_format($_SERVER['list_path'] . path_format($path));
         savecache('path_' . $path1 . '/?password', '', 1);
         return message('<meta http-equiv="refresh" content="2;URL=./">', getconstStr('RefreshCache'), 302);
@@ -937,16 +958,13 @@ function fetch_files($path = '/')
                 if ($files['folder']['childCount']>200) {
                     // files num > 200 , then get nextlink
                     $page = $_POST['pagenum']==''?1:$_POST['pagenum'];
-                    $files=fetch_files_children($files, $path1, $page);
+                    if ($page>1) $files=fetch_files_children($files, $path1, $page);
+                    $files['children'] = children_name($files['children']);
                 } else {
                 // files num < 200 , then cache
-                    if (isset($files['children'])) {
+                    //if (isset($files['children'])) {
-                        $tmp = [];
+                        $files['children'] = children_name($files['children']);
-                        foreach ($files['children'] as $file) {
+                    //}
-                            $tmp[$file['name']] = $file;
-                        }
-                        $files['children'] = $tmp;
-                    }
                     savecache('path_' . $path, $files);
                 }
             }
@@ -962,6 +980,15 @@ function fetch_files($path = '/')
     return $files;
 }
 
+function children_name($children)
+{
+    $tmp = [];
+    foreach ($children as $file) {
+        $tmp[$file['name']] = $file;
+    }
+    return $tmp;
+}
+
 function fetch_files_children($files, $path, $page)
 {
     $path1 = path_format($path);
@@ -1108,7 +1135,7 @@ function render_list($path = '', $files = '')
     Github ： https://github.com/qkqpttgf/OneManager-php
 -->' . ob_get_clean();
     if (isset($htmlpage['statusCode'])) return $htmlpage;
-    if ($_SERVER['Set-Cookie']!='') return output($html, $statusCode, [ 'Set-Cookie' => $_SERVER['Set-Cookie'], 'Content-Type' => 'text/html' ]);
+    if (isset($_SERVER['Set-Cookie'])) return output($html, $statusCode, [ 'Set-Cookie' => $_SERVER['Set-Cookie'], 'Content-Type' => 'text/html' ]);
     return output($html,$statusCode);
 }
 
@@ -1116,9 +1143,10 @@ function get_refresh_token()
 {
     global $constStr;
     global $CommonEnv;
+    $envs = '';
     foreach ($CommonEnv as $env) $envs .= '\'' . $env . '\', ';
     $url = path_format($_SERVER['PHP_SELF'] . '/');
-    if ($_GET['authorization_code'] && isset($_GET['code'])) {
+    if (isset($_GET['authorization_code']) && isset($_GET['code'])) {
         $_SERVER['disktag'] = $_COOKIE['disktag'];
         config_oauth();
         $tmp = curl_request($_SERVER['oauth_url'] . 'token', 'client_id=' . $_SERVER['client_id'] .'&client_secret=' . $_SERVER['client_secret'] . '&grant_type=authorization_code&requested_token_use=on_behalf_of&redirect_uri=' . $_SERVER['redirect_uri'] .'&code=' . $_GET['code']);
@@ -1148,7 +1176,7 @@ function get_refresh_token()
         return message('<pre>' . json_encode(json_decode($tmp['body']), JSON_PRETTY_PRINT) . '</pre>', $tmp['stat']);
         //return message('<pre>' . json_encode($ret, JSON_PRETTY_PRINT) . '</pre>', 500);
     }
-    if ($_GET['install1']) {
+    if (isset($_GET['install1'])) {
         $_SERVER['disk_oprating'] = $_COOKIE['disktag'];
         $_SERVER['disktag'] = $_COOKIE['disktag'];
         config_oauth();
@@ -1167,7 +1195,7 @@ function get_refresh_token()
             return message('something error, try after a few seconds.', 'retry', 201);
         }
     }
-    if ($_GET['install0']) {
+    if (isset($_GET['install0'])) {
         if ($_POST['disktag_add']!='' && ($_POST['Onedrive_ver']=='MS' || $_POST['Onedrive_ver']=='CN' || $_POST['Onedrive_ver']=='MSC')) {
             if (in_array($_COOKIE['disktag'], $CommonEnv)) {
                 return message('Do not input ' . $envs . '<br><button onclick="location.href = location.href;">'.getconstStr('Refresh').'</button><script>document.cookie=\'disktag=; path=/\';</script>', 'Error', 201);
@@ -1246,7 +1274,7 @@ function EnvOpt($needUpdate = 0)
     asort($ShowedCommonEnv);
     asort($ShowedInnerEnv);
     $html = '<title>OneManager '.getconstStr('Setup').'</title>';
-    if ($_POST['updateProgram']==getconstStr('updateProgram')) {
+    if (isset($_POST['updateProgram'])&&$_POST['updateProgram']==getconstStr('updateProgram')) {
         $response = OnekeyUpate();
         if (api_error($response)) {
             $html = api_error_msg($response);
@@ -1259,7 +1287,7 @@ function EnvOpt($needUpdate = 0)
         }
         return message($html, $title);
     }
-    if ($_POST['submit1']) {
+    if (isset($_POST['submit1'])) {
         $_SERVER['disk_oprating'] = '';
         foreach ($_POST as $k => $v) {
             if (in_array($k, $ShowedCommonEnv)||in_array($k, $ShowedInnerEnv)||$k=='disktag_del' || $k=='disktag_add') {
@@ -1289,7 +1317,7 @@ function EnvOpt($needUpdate = 0)
         }
         return message($html, $title);
     }
-    if ($_GET['preview']) {
+    if (isset($_GET['preview'])) {
         $preurl = $_SERVER['PHP_SELF'] . '?preview';
     } else {
         $preurl = path_format($_SERVER['PHP_SELF'] . '/');
@@ -1297,7 +1325,7 @@ function EnvOpt($needUpdate = 0)
     $html .= '
 <a href="'.$preurl.'">'.getconstStr('Back').'</a>&nbsp;&nbsp;&nbsp;<a href="'.$_SERVER['base_path'].'">'.getconstStr('Back').getconstStr('Home').'</a><br>
 <a href="https://github.com/qkqpttgf/OneManager-php">Github</a><br>';
-    if (!($_SERVER['USER']==='qcloud'||$_SERVER['HEROKU_APP_DIR']==='/app')) {
+    if (!((isset($_SERVER['USER'])&&$_SERVER['USER']==='qcloud')||(isset($_SERVER['HEROKU_APP_DIR'])&&$_SERVER['HEROKU_APP_DIR']==='/app'))) {
         $html .= '
 In VPS can not update by a click!<br>';
     } else {

function/heroku.php

@@ -41,13 +41,18 @@ function getConfig($str, $disktag = '')
 {
     global $InnerEnv;
     global $Base64Env;
-    if ($disktag=='') $disktag = $_SERVER['disktag'];
     if (in_array($str, $InnerEnv)) {
-        if (in_array($str, $Base64Env)) return equal_replace(json_decode(getenv($disktag), true)[$str],1);
+        if ($disktag=='') $disktag = $_SERVER['disktag'];
-        else return json_decode(getenv($disktag), true)[$str];
+        $env = json_decode(getenv($disktag), true);
+        if (isset($env[$str])) {
+            if (in_array($str, $Base64Env)) return equal_replace($env[$str],1);
+            else return $env[$str];
 	}
+    } else {
 	if (in_array($str, $Base64Env)) return equal_replace(getenv($str),1);
         else return getenv($str);
+    }
+    return '';
 }
 
 function setConfig($arr, $disktag = '')

function/normal.php

@@ -41,19 +41,23 @@ function getConfig($str, $disktag = '')
     global $InnerEnv;
     global $Base64Env;
     //include 'config.php';
-    if ($disktag=='') $disktag = $_SERVER['disktag'];
     $s = file_get_contents('config.php');
     $configs = substr($s, 18, -2);
     if ($configs!='') {
         $envs = json_decode($configs, true);
         if (in_array($str, $InnerEnv)) {
+            if ($disktag=='') $disktag = $_SERVER['disktag'];
+            if (isset($envs[$disktag][$str])) {
                 if (in_array($str, $Base64Env)) return equal_replace($envs[$disktag][$str],1);
                 else return $envs[$disktag][$str];
+            }
         } else {
+            if (isset($envs[$str])) {
                 if (in_array($str, $Base64Env)) return equal_replace($envs[$str],1);
                 else return $envs[$str];
             }
         }
+    }
     return '';
 }
 

function/scf.php

@@ -58,13 +58,18 @@ function getConfig($str, $disktag = '')
 {
     global $InnerEnv;
     global $Base64Env;
-    if ($disktag=='') $disktag = $_SERVER['disktag'];
     if (in_array($str, $InnerEnv)) {
-        if (in_array($str, $Base64Env)) return equal_replace(json_decode(getenv($disktag), true)[$str],1);
+        if ($disktag=='') $disktag = $_SERVER['disktag'];
-        else return json_decode(getenv($disktag), true)[$str];
+        $env = json_decode(getenv($disktag), true);
+        if (isset($env[$str])) {
+            if (in_array($str, $Base64Env)) return equal_replace($env[$str],1);
+            else return $env[$str];
         }
+    } else {
         if (in_array($str, $Base64Env)) return equal_replace(getenv($str),1);
         else return getenv($str);
+    }
+    return '';
 }
 
 function setConfig($arr, $disktag = '')

index.php

@@ -4,9 +4,9 @@ include 'conststr.php';
 include 'function/common.php';
 
 //echo '<pre>'. json_encode($_SERVER, JSON_PRETTY_PRINT).'</pre>';
-if ($_SERVER['USER']==='qcloud') {
+if (isset($_SERVER['USER'])&&$_SERVER['USER']==='qcloud') {
     include 'function/scf.php';
-} elseif ($_SERVER['HEROKU_APP_DIR']==='/app') {
+} elseif (isset($_SERVER['HEROKU_APP_DIR'])&&$_SERVER['HEROKU_APP_DIR']==='/app') {
     include 'function/heroku.php';
     $path = getpath();
     //echo 'path:'. $path;

readme.md

@@ -13,7 +13,7 @@ How to Install:
     1.Start web service on your server (httpd or other), make sure you can visit it.  
     启动web服务器，确保你能访问到。  
     2.Make the rewrite works, the rule is in .htaccess file, make sure any query redirect to index.php.  
-    开启伪静态(重写)功能，规则在.htaccess文件中，ngnix自行转换，我们的目的是不管访问什么都让index.php来处理。  
+    开启伪静态(重写)功能，规则在.htaccess文件中，ngnix从里面复制，我们的目的是不管访问什么都让index.php来处理。  
     3.Upload code.  
     上传好代码。  
     4.Change the file config.php can be read&write (666 is suggested).  
@@ -26,7 +26,7 @@ Official: https://cloud.tencent.com/product/scf
 
 ~~How to Install:  https://service-pgxgvop2-1258064400.ap-hongkong.apigateway.myqcloud.com/test/abcdef/%E6%97%A0%E6%9C%8D%E5%8A%A1%E5%99%A8%E5%87%BD%E6%95%B0SCF%E6%90%AD%E5%BB%BAOneDrive.mp4?preview~~  
 
-先在环境变量添加Region，ap-hongkong或ap-guangzhou之类，再安装。  
+先手动在环境变量添加Region，ap-hongkong或ap-guangzhou之类，具体看 https://cloud.tencent.com/document/api/583/17238 最底下，然后再安装。  
 添加网盘时，SCF反应不过来，会添加失败，请不要删除，再添加一次相同的就可以了。  
 
 DEMO:  https://service-pgxgvop2-1258064400.ap-hongkong.apigateway.myqcloud.com/test/abcdef/  
@@ -41,7 +41,7 @@ The XXX_path in setting is the path in Onedrive, not in url, program will find t
 LOGO ICON: put your 'favicon.ico' in the path you showed, make sure xxxxx.com/favicon.ico can be visited.   
 网站图标：将favicon.ico文件放在你要展示的目录中，确保 xxxxx.com/favicon.ico 可以访问到。  
 Program will show content of 'readme.md' & 'head.md'.  
-可以在文件列表下面显示readme.md文件的内容。  
+可以在文件列表显示head.md跟readme.md文件的内容。  
 guest up path, is a folder that the guest can upload files, but can not be list (exclude admin).  
 游客上传目录（也叫图床目录），是指定一个目录，让游客可以上传文件，不限格式，不限大小。这个目录里面的内容不列清单（除非管理登录）。  
 If there is 'index.html' file, program will only show the content of 'index.html', not list the files.  

theme/classic.php

@@ -51,6 +51,7 @@
             .list-wrapper{width:95%; margin-bottom:24px;}
             .list-table {padding:8px}
             .list-table td, .list-table th{white-space:nowrap;overflow:auto;max-width:80px}
+            .size, .updated_at{display:none}
         }
     </style>
 </head>
@@ -69,7 +70,7 @@
             <li><a onclick="showdiv(event,'encrypt','');"><ion-icon name="lock"></ion-icon><?php echo getconstStr('encrypt'); ?></a></li>
             <li><a href="?RefreshCache"><ion-icon name="refresh"></ion-icon><?php echo getconstStr('RefreshCache'); ?></a></li>
 <?php   } ?>
-            <li><a href="<?php echo $_GET['preview']?'?preview&':'?';?>setup"><ion-icon name="settings"></ion-icon><?php echo getconstStr('Setup'); ?></a></li>
+            <li><a href="<?php echo isset($_GET['preview'])?'?preview&':'?';?>setup"><ion-icon name="settings"></ion-icon><?php echo getconstStr('Setup'); ?></a></li>
             <li><a onclick="logout()"><ion-icon name="log-out"></ion-icon><?php echo getconstStr('Logout'); ?></a></li>
         </ul></li>
 <?php
@@ -85,7 +86,7 @@
         </select>
     </div>
 <?php
-    if ($_SERVER['needUpdate']) { ?>
+    if (isset($_SERVER['needUpdate'])&&$_SERVER['needUpdate']) { ?>
     <div style='position:absolute;'><font color='red'><?php echo getconstStr('NeedUpdate'); ?></font></div>
 <?php } ?>
     <h1 class="title">
@@ -132,6 +133,10 @@
             </div>
             <div class="list-body-container">
 <?php
+    $head = false;
+    $readme = false;
+    $pdfurl = false;
+    $DPvideo = false;
     if ($_SERVER['is_guestup_path']&&!$_SERVER['admin']) { ?>
                 <div id="upload_div" style="margin:10px">
                 <center>
@@ -154,8 +159,6 @@
                     </div>
                     <div style="margin: 24px">
 <?php               $ext = strtolower(substr($path, strrpos($path, '.') + 1));
-                    $DPvideo = '';
-                    $pdfurl = '';
                     if (in_array($ext, $exts['img'])) {
                         echo '                        <img src="' . $files['@microsoft.graph.downloadUrl'] . '" alt="' . substr($path, strrpos($path, '/')) . '" onload="if(this.offsetWidth>document.getElementById(\'url\').offsetWidth) this.style.width=\'100%\';" />
 ';
@@ -201,12 +204,12 @@
                     </div>
                 </div>
 <?php           } elseif (isset($files['folder'])) {
-                    $filenum = $_POST['filenum'];
+                    if (isset($_POST['filenum'])) $filenum = $_POST['filenum'];
-                    if (!$filenum and $files['folder']['page']) $filenum = ($files['folder']['page']-1)*200;
+                    if (!isset($filenum) and isset($files['folder']['page'])) $filenum = ($files['folder']['page']-1)*200;
-                    $readme = false; ?>
+                    else $filenum = 0; ?>
                 <table class="list-table" id="list-table">
                     <tr id="tr0">
-                        <th class="file"><a onclick="sortby('a');"><?php echo getconstStr('File'); ?></a><?php if ($_SERVER['USER']!='qcloud') { ?>&nbsp;&nbsp;&nbsp;<button onclick="showthumbnails(this);"><?php echo getconstStr('ShowThumbnails'); ?></button><?php } ?><button onclick="CopyAllDownloadUrl();"><?php echo getconstStr('CopyAllDownloadUrl'); ?></button></th>
+                        <th class="file"><a onclick="sortby('a');"><?php echo getconstStr('File'); ?></a><?php if (!(isset($_SERVER['USER'])&&$_SERVER['USER']=='qcloud')) { ?>&nbsp;&nbsp;&nbsp;<button onclick="showthumbnails(this);"><?php echo getconstStr('ShowThumbnails'); ?></button><?php } ?><button onclick="CopyAllDownloadUrl();"><?php echo getconstStr('CopyAllDownloadUrl'); ?></button></th>
                         <th class="updated_at" width="25%"><a onclick="sortby('time');"><?php echo getconstStr('EditTime'); ?></a></th>
                         <th class="size" width="15%"><a onclick="sortby('size');"><?php echo getconstStr('Size'); ?></a></th>
                     </tr>
@@ -241,13 +244,13 @@
                     foreach ($files['children'] as $file) {
                         // Files
                         if (isset($file['file'])) {
-                            if ($_SERVER['admin'] or (substr($file['name'],0,1) !== '.' and $file['name'] !== getConfig('passfile') ) ) {
                             if (strtolower($file['name']) === 'head.md') $head = $file;
                             if (strtolower($file['name']) === 'readme.md') $readme = $file;
                             if (strtolower($file['name']) === 'index.html' && !$_SERVER['admin']) {
                                 $html = curl_request(fetch_files(spurlencode(path_format($path . '/' .$file['name']),'/'))['@microsoft.graph.downloadUrl'])['body'];
                                 return output($html,200);
                             }
+                            if ($_SERVER['admin'] or !isHideFile($file['name'])) {
                                 $filenum++; ?>
                     <tr data-to id="tr<?php echo $filenum;?>">
                         <td class="file">
@@ -405,7 +408,7 @@
     <div id="mask" class="mask" style="display:none;"></div>
 <?php
     if ($_SERVER['admin']) {
-        if (!$_GET['preview']) { ?>
+        if (!isset($_GET['preview'])) { ?>
     <div style="word-break: break-all;word-wrap: break-word;">
         <div id="rename_div" class="operatediv" style="display:none">
             <div>
@@ -514,7 +517,7 @@
         <div style="margin:50px">
             <a onclick="operatediv_close('login')" class="operatediv_close"><?php echo getconstStr('Close'); ?></a>
 	        <center>
-	            <form action="<?php echo $_GET['preview']?'?preview&':'?';?>admin" method="post">
+	            <form action="<?php echo isset($_GET['preview'])?'?preview&':'?';?>admin" method="post">
 		        <input id="login_input" name="password1" type="password" placeholder="<?php echo getconstStr('InputPassword'); ?>">
 		        <input type="submit" value="<?php echo getconstStr('Login'); ?>">
 	            </form>
@@ -571,7 +574,7 @@
         $readme.innerHTML = marked(document.getElementById('readme-md').innerText);
     }
 <?php
-    if ($_GET['preview']) { //is preview mode. 在预览时处理 ?>
+    if (isset($_GET['preview'])) { //is preview mode. 在预览时处理 ?>
     var $url = document.getElementById('url');
     if ($url) {
         $url.innerHTML = location.protocol + '//' + location.host + $url.innerHTML;
@@ -820,7 +823,7 @@
         location.href=location.protocol + "//" + location.host + "<?php echo path_format($_SERVER['base_path'] . '/' . $path );?>" ;
     }
 <?php }
-    if ($files['folder']['childCount']>200) { // more than 200. 有下一页 ?>
+    if (isset($files['folder']['childCount'])&&$files['folder']['childCount']>200) { // more than 200. 有下一页 ?>
     function nextpage(num) {
         document.getElementById('pagenum').value=num;
         document.getElementById('nextpageform').submit();
@@ -1061,7 +1064,7 @@
         document.cookie = "admin=; path=/";
         location.href = location.href;
     }
-<?php   if (!$_GET['preview']) {?>
+<?php   if (!isset($_GET['preview'])) {?>
     function showdiv(event,action,num) {
         var $operatediv=document.getElementsByName('operatediv');
         for ($i=0;$i<$operatediv.length;$i++) {

version

@@ -1,7 +1,14 @@
+20200311-2150.14
+Add a switch, can download a known file or not, while the folder is encrypted.
+Hide time and size in mobile.
+Now, you can get a random 'jpg' from a folder when you type '?random=jpg' after the folder.
+增加一个开关，在目录加密后能否下载其中的某个文件。
+在手机上浏览时，隐藏修改时间跟大小。
+加入一个功能，现在可以在某个目录后面加上'?random=jpg'来得到本目录里面的一张随机jpg。
+
 20200229-1300.13
 In SCF, some config can input Special symbols now, like ?&= 。
 在SCF中，某些配置可以输入特殊符号了，像background可以用?&=之类的了。
-
 20200225-1310.12
 Can update by one click any time. fix bugs: special tag, reupload.
 可以不管版本直接一键更新（覆盖）了。修复可以使用特殊onedrive标签的bug，修复断网续传的问题。