diff --git a/common.php b/common.php
index 48af4a8..cd3ed6e 100644
--- a/common.php
+++ b/common.php
@@ -1,155 +1,59 @@
  0b000, // used in heroku.
+    'SecretId'          => 0b000, // used in SCF.
+    'SecretKey'         => 0b000, // used in SCF.
+    'AccessKeyID'       => 0b000, // used in FC.
+    'AccessKeySecret'   => 0b000, // used in FC.
+    'HW_urn'            => 0b000, // used in FG.
+    'HW_key'            => 0b000, // used in FG.
+    'HW_secret'         => 0b000, // used in FG.
+    'function_name'     => 0b000, // used in heroku.
 
-$CommonEnv = [
-    'APIKey', // used in heroku.
-    'SecretId', // used in SCF.
-    'SecretKey', // used in SCF.
-    'AccessKeyID', // used in FC.
-    'AccessKeySecret', // used in FC.
-    'HW_urn', // used in FG.
-    'HW_key', // used in FG.
-    'HW_secret', // used in FG.
-    'admin',
-    'adminloginpage',
-    'autoJumpFirstDisk',
-    'background',
-    'backgroundm',
-    'disktag',
-    'disableShowThumb',
-    'disableChangeTheme',
-    'function_name', // used in heroku.
-    'hideFunctionalityFile',
-    'timezone',
-    'passfile',
-    'sitename',
-    'customScript',
-    'customCss',
-    'customTheme',
-    'theme',
-];
+    'admin'             => 0b001,
+    'adminloginpage'    => 0b010,
+    'autoJumpFirstDisk' => 0b010,
+    'background'        => 0b011,
+    'backgroundm'       => 0b011,
+    'disableShowThumb'  => 0b010,
+    'disableChangeTheme'=> 0b010,
+    'disktag'           => 0b000,
+    'hideFunctionalityFile'=> 0b010,
+    'timezone'          => 0b010,
+    'passfile'          => 0b011,
+    'sitename'          => 0b011,
+    'customScript'      => 0b011,
+    'customCss'         => 0b011,
+    'customTheme'       => 0b011,
+    'theme'             => 0b010,
 
-$ShowedCommonEnv = [
-    //'APIKey', // used in heroku.
-    //'SecretId', // used in SCF.
-    //'SecretKey', // used in SCF.
-    //'AccessKeyID', // used in FC.
-    //'AccessKeySecret', // used in FC.
-    //'HW_urn', // used in FG.
-    //'HW_key', // used in FG.
-    //'HW_secret', // used in FG.
-    //'admin',
-    'adminloginpage',
-    'autoJumpFirstDisk',
-    'background',
-    'backgroundm',
-    //'disktag',
-    'disableShowThumb',
-    'disableChangeTheme',
-    //'function_name', // used in heroku.
-    'hideFunctionalityFile',
-    'timezone',
-    'passfile',
-    'sitename',
-    'customScript',
-    'customCss',
-    'customTheme',
-    'theme',
-];
-
-$InnerEnv = [
-    'Drive_ver',
-    'Drive_custom',
-    'client_id',
-    'client_secret',
-    'diskname',
-    'domain_path',
-    'downloadencrypt',
-    'guestup_path',
-    'usesharepoint',
-    'sharepointSiteAddress',
-    'siteid',
-    'shareurl',
-    //'sharecookie',
-    'shareapiurl',
-    'domainforproxy',
-    'public_path',
-    'refresh_token',
-    'token_expires',
-];
-
-$ShowedInnerEnv = [
-    //'Drive_ver',
-    //'Drive_custom',
-    //'client_id',
-    //'client_secret',
-    'diskname',
-    'domain_path',
-    'downloadencrypt',
-    'guestup_path',
-    //'usesharepoint',
-    //'sharepointSiteAddress',
-    //'siteid',
-    //'shareurl',
-    //'sharecookie',
-    //'shareapiurl',
-    'domainforproxy',
-    'public_path',
-    //'refresh_token',
-    //'token_expires',
+    'Driver'            => 0b100,
+    'client_id'         => 0b100,
+    'client_secret'     => 0b101,
+    'diskname'          => 0b111,
+    'domain_path'       => 0b111,
+    'downloadencrypt'   => 0b110,
+    'guestup_path'      => 0b111,
+    'sharepointSite'    => 0b101,
+    'shareurl'          => 0b101,
+    //'sharecookie'       => 0b101,
+    'shareapiurl'       => 0b101,
+    'siteid'            => 0b100,
+    'domainforproxy'    => 0b111,
+    'public_path'       => 0b111,
+    'refresh_token'     => 0b100,
+    'token_expires'     => 0b100,
+    'default_drive_id'  => 0b100,
+    'default_sbox_drive_id'=> 0b100,
 ];
 
 $timezones = array( 
@@ -186,11 +90,43 @@ $timezones = array(
     '12'=>'Asia/Kamchatka'
 );
 
+function isCommonEnv($str)
+{
+    global $EnvConfigs;
+    if (isset($EnvConfigs[$str])) return ( $EnvConfigs[$str] & 0b100 ) ? false : true;
+    else return null;
+}
+
+function isInnerEnv($str)
+{
+    global $EnvConfigs;
+    if (isset($EnvConfigs[$str])) return ( $EnvConfigs[$str] & 0b100 ) ? true : false;
+    else return null;
+}
+
+function isShowedEnv($str)
+{
+    global $EnvConfigs;
+    if (isset($EnvConfigs[$str])) return ( $EnvConfigs[$str] & 0b010 ) ? true : false;
+    else return null;
+}
+
+function isBase64Env($str)
+{
+    global $EnvConfigs;
+    if (isset($EnvConfigs[$str])) return ( $EnvConfigs[$str] & 0b001 ) ? true : false;
+    else return null;
+}
+
 function main($path)
 {
     global $exts;
     global $constStr;
+    global $slash;
+    global $drive;
 
+    $slash = '/';
+    if (strpos(__DIR__, ':')) $slash = '\\';
     $_SERVER['php_starttime'] = microtime(true);
     $path = path_format($path);
     if (in_array($_SERVER['firstacceptlanguage'], array_keys($constStr['languages']))) {
@@ -211,6 +147,7 @@ function main($path)
     if (isset($_COOKIE['timezone'])&&$_COOKIE['timezone']!='') $_SERVER['timezone'] = $_COOKIE['timezone'];
     if ($_SERVER['timezone']=='') $_SERVER['timezone'] = 0;
     $_SERVER['PHP_SELF'] = path_format($_SERVER['base_path'] . $path);
+    
 
     if (getConfig('admin')=='') return install();
     if (getConfig('adminloginpage')=='') {
@@ -255,16 +192,17 @@ function main($path)
     if (count($disktags)>1) {
         if ($path=='/'||$path=='') {
             if (getConfig('autoJumpFirstDisk')) return output('', 302, [ 'Location' => path_format($_SERVER['base_path'].'/'.$disktags[0].'/') ]);
+            $files['type'] = 'folder';
+            $files['childcount'] = count($disktags);
             $files['showname'] = 'root';
-            $files['folder']['childCount'] = count($disktags);
             foreach ($disktags as $disktag) {
-                $files['children'][$disktag]['folder'] = 1;
-                $files['children'][$disktag]['name'] = $disktag;
-                $files['children'][$disktag]['showname'] = getConfig('diskname', $disktag);
+                $files['list'][$disktag]['type'] = 'folder';
+                $files['list'][$disktag]['name'] = $disktag;
+                $files['list'][$disktag]['showname'] = getConfig('diskname', $disktag);
             }
             if ($_GET['json']) {
                 // return a json
-                return files_json($files);
+                return output(json_encode($files));
             }
         } else {
             $_SERVER['disktag'] = splitfirst( substr(path_format($path), 1), '/' )[0];
@@ -295,133 +233,188 @@ function main($path)
     $_SERVER['ajax']=0;
     if (isset($_SERVER['HTTP_X_REQUESTED_WITH'])) if ($_SERVER['HTTP_X_REQUESTED_WITH']=='XMLHttpRequest') $_SERVER['ajax']=1;
 
-    if ($_SERVER['admin']) if (isset($_GET['AddDisk'])) return get_refresh_token();
-
-    if ($files['showname'] == 'root') return render_list($path, $files);
-    config_oauth();
-    $refresh_token = getConfig('refresh_token');
-    if (!$refresh_token) {
-        return render_list();
-    } else {
-        if (!($_SERVER['access_token'] = getcache('access_token', $_SERVER['disktag']))) {
-            $response = get_access_token($refresh_token);
-            if (isset($response['stat'])) return message($response['body'], 'Error', $response['stat']);
-        }
-
-        if ($_SERVER['ajax']) {
-            if ($_GET['action']=='del_upload_cache') {
-                // del '.tmp' without login. 无需登录即可删除.tmp后缀文件
-                error_log('del.tmp:GET,'.json_encode($_GET,JSON_PRETTY_PRINT));
-                $tmp = splitlast($_GET['filename'], '/');
-                if ($tmp[1]!='') {
-                    $filename = $tmp[0] . '/.' . $_GET['filelastModified'] . '_' . $_GET['filesize'] . '_' . $tmp[1] . '.tmp';
-                } else {
-                    $filename = '.' . $_GET['filelastModified'] . '_' . $_GET['filesize'] . '_' . $_GET['filename'] . '.tmp';
-                }
-                $filename = path_format( path_format($_SERVER['list_path'] . path_format($path)) . '/' . spurlencode($filename, '/') );
-                $tmp = MSAPI('DELETE', $filename, '', $_SERVER['access_token']);
-                $path1 = path_format($_SERVER['list_path'] . path_format($path));
-                if ($path1!='/'&&substr($path1,-1)=='/') $path1=substr($path1,0,-1);
-                savecache('path_' . $path1, json_decode('{}',true), $_SERVER['disktag'], 1);
-                return output($tmp['body'],$tmp['stat']);
-            }
-            if ($_GET['action']=='uploaded_rename') {
-                // rename .scfupload file without login.
-                // 无需登录即可重命名.scfupload后缀文件,filemd5为用户提交,可被构造,问题不大,以后处理
-                $oldname = spurlencode($_GET['filename']);
-                $pos = strrpos($oldname, '.');
-                if ($pos>0) $ext = strtolower(substr($oldname, $pos));
-                //$oldname = path_format(path_format($_SERVER['list_path'] . path_format($path)) . '/' . $oldname . '.scfupload' );
-                $oldname = path_format(path_format($_SERVER['list_path'] . path_format($path)) . '/' . $oldname);
-                $data = '{"name":"' . $_GET['filemd5'] . $ext . '"}';
-                //echo $oldname .'
'. $data;
-                $tmp = MSAPI('PATCH',$oldname,$data,$_SERVER['access_token']);
-                if ($tmp['stat']==409) {
-                    MSAPI('DELETE',$oldname,'',$_SERVER['access_token']);
-                    $tmpbody = json_decode($tmp['body'], true);
-                    $tmpbody['name'] = $_GET['filemd5'] . $ext;
-                    $tmp['body'] = json_encode($tmpbody);
-                }
-                $path1 = path_format($_SERVER['list_path'] . path_format($path));
-                if ($path1!='/'&&substr($path1,-1)=='/') $path1=substr($path1,0,-1);
-                savecache('path_' . $path1, json_decode('{}',true), $_SERVER['disktag'], 1);
-                return output($tmp['body'],$tmp['stat']);
-            }
-            if ($_GET['action']=='upbigfile') return bigfileupload($path);
-        }
+    // Add disk
+    if (isset($_GET['AddDisk'])) {
         if ($_SERVER['admin']) {
-            $tmp = adminoperate($path);
-            if ($tmp['statusCode'] > 0) {
-                $path1 = path_format($_SERVER['list_path'] . path_format($path));
-                if ($path1!='/'&&substr($path1,-1)=='/') $path1=substr($path1,0,-1);
-                savecache('path_' . $path1, json_decode('{}',true), $_SERVER['disktag'], 1);
-                return $tmp;
-            }
+            if (!class_exists($_GET['AddDisk'])) require 'disk' . $slash . $_GET['AddDisk'] . '.php';
+                $drive = new $_GET['AddDisk']($_COOKIE['disktag']);
+                return $drive->AddDisk();
         } else {
-            if ($_SERVER['ajax']) return output(getconstStr('RefreshtoLogin'),401);
-        }
-        $_SERVER['ishidden'] = passhidden($path);
-        if (isset($_GET['thumbnails'])) {
-            if ($_SERVER['ishidden']<4) {
-                if (in_array(strtolower(substr($path, strrpos($path, '.') + 1)), $exts['img'])) {
-                    return get_thumbnails_url($path, $_GET['location']);
-                } else return output(json_encode($exts['img']),400);
-            } else return output('',401);
-        }
-
-        $files = list_files($path);
-        //echo json_encode(array_keys($files['children']), JSON_PRETTY_PRINT);
-        if ($_GET['json']) {
-            // return a json
-            return files_json($files);
-        }
-        if (isset($_GET['random'])&&$_GET['random']!=='') {
-            if ($_SERVER['ishidden']<4) {
-                $tmp = [];
-                foreach (array_keys($files['children']) as $filename) {
-                    if (strtolower(splitlast($filename,'.')[1])==strtolower($_GET['random'])) $tmp[$filename] = $files['children'][$filename][$_SERVER['DownurlStrName']];
-                }
-                $tmp = array_values($tmp);
-                if (count($tmp)>0) {
-                    $url = $tmp[rand(0,count($tmp)-1)];
-                    if (isset($_GET['url'])) return output($url, 200);
-                    $domainforproxy = '';
-                    $domainforproxy = getConfig('domainforproxy');
-                    if ($domainforproxy!='') {
-                        $url = proxy_replace_domain($url, $domainforproxy);
+            $url = $_SERVER['PHP_SELF'];
+            if ($_GET) {
+                $tmp = null;
+                $tmp = '';
+                foreach ($_GET as $k => $v) {
+                    if ($k!='setup') {
+                        if ($v===true) $tmp .= '&' . $k;
+                        else $tmp .= '&' . $k . '=' . $v;
                     }
-                    return output('', 302, [ 'Location' => $url ]);
-                } else return output('',404);
-            } else return output('',401);
+                }
+                $tmp = substr($tmp, 1);
+                if ($tmp!='') $url .= '?' . $tmp;
+            }
+            return output('', 302, [ 'Location' => $url ]);
         }
-        if (isset($files['file']) && !isset($_GET['preview'])) {
-            // is file && not preview mode
-            if ( $_SERVER['ishidden']<4 || (!!getConfig('downloadencrypt')&&$files['name']!=getConfig('passfile')) ) {
-                $url = $files[$_SERVER['DownurlStrName']];
+    }
+
+    // Show disks in root
+    if ($files['showname'] == 'root') return render_list($path, $files);
+
+    $disktype = getConfig('Driver', $_SERVER['disktag']);
+    if ($disktype=='') return render_list();
+
+    if (!class_exists($disktype)) require 'disk' . $slash . $disktype . '.php';
+    $drive = new $disktype($_SERVER['disktag']);
+    if (!driveisfine($_SERVER['disktag'])) return render_list();
+
+    // Operate
+    if ($_SERVER['ajax']) {
+        if ($_GET['action']=='del_upload_cache') {
+            // del '.tmp' without login. 无需登录即可删除.tmp后缀文件
+            return $drive->del_upload_cache();
+        }
+        if ($_GET['action']=='upbigfile') {
+            if (!$_SERVER['admin']) {
+                if (!is_guestup_path($path)) return output('Not_Guest_Upload_Folder', 400);
+                if (strpos($_GET['upbigfilename'], '../')!==false) return output('Not_Allow_Cross_Path', 400);
+            }
+            $path1 = path_format($_SERVER['list_path'] . path_format($path));
+            if (substr($path1, -1)=='/') $path1=substr($path1, 0, -1);
+            return $drive->bigfileupload($path1);
+        }
+    }
+    if ($_SERVER['admin']) {
+        $tmp = adminoperate($path);
+        if ($tmp['statusCode'] > 0) {
+            $path1 = path_format($_SERVER['list_path'] . path_format($path));
+            //savecache('path_' . $path1, json_decode('{}',true), $_SERVER['disktag'], 1);
+            if ($path1!='/'&&substr($path1,-1)=='/') $path1=substr($path1,0,-1);
+            savecache('path_' . $path1, json_decode('{}',true), $_SERVER['disktag'], 1);
+            return $tmp;
+        }
+    } else {
+        if ($_SERVER['ajax']) return output(getconstStr('RefreshtoLogin'),401);
+    }
+    $_SERVER['ishidden'] = passhidden($path);
+    if (isset($_GET['thumbnails'])) {
+        if ($_SERVER['ishidden']<4) {
+            if (in_array(strtolower(substr($path, strrpos($path, '.') + 1)), $exts['img'])) {
+                $path1 = path_format($_SERVER['list_path'] . path_format($path));
+                if ($path1!='/'&&substr($path1, -1)=='/') $path1=substr($path1, 0, -1);
+                $thumb_url = $drive->get_thumbnails_url($path1);
+                if ($thumb_url!='') {
+                    if ($_GET['location']) {
+                        $url = $thumb_url;
+                        $domainforproxy = '';
+                        $domainforproxy = getConfig('domainforproxy', $_SERVER['disktag']);
+                        if ($domainforproxy!='') {
+                            $url = proxy_replace_domain($url, $domainforproxy);
+                        }
+                        return output('', 302, [ 'Location' => $url ]);
+                    } else return output($thumb_url);
+                }
+                return output('', 404);
+            } else return output(json_encode($exts['img']), 400);
+        } else return output('', 401);
+    }
+
+    // list folder
+    if ($_SERVER['is_guestup_path'] && !$_SERVER['admin']) {
+        $files = json_decode('{"type":"folder"}', true);
+    } elseif (!getConfig('downloadencrypt', $_SERVER['disktag'])) {
+        if ($_SERVER['ishidden']==4) $files = json_decode('{"type":"folder"}', true);
+        else {
+            $path1 = path_format($_SERVER['list_path'] . path_format($path));
+            if ($path1!='/'&&substr($path1,-1)=='/') $path1=substr($path1, 0, -1);
+            $files = $drive->list_files($path1);
+        } 
+    } else {
+        $path1 = path_format($_SERVER['list_path'] . path_format($path));
+        if ($path1!='/'&&substr($path1,-1)=='/') $path1=substr($path1, 0, -1);
+        $files = $drive->list_files($path1);
+    }
+
+    if ($_GET['json']) {
+        // return a json
+        return output(json_encode($files));
+    }
+    // random file
+    if (isset($_GET['random'])&&$_GET['random']!=='') {
+        if ($_SERVER['ishidden']<4) {
+            $tmp = [];
+            foreach (array_keys($files['list']) as $filename) {
+                if (strtolower(splitlast($filename, '.')[1])==strtolower($_GET['random'])) $tmp[$filename] = $files['list'][$filename]['url'];
+            }
+            $tmp = array_values($tmp);
+            if (count($tmp)>0) {
+                $url = $tmp[rand(0, count($tmp)-1)];
+                if (isset($_GET['url'])) return output($url, 200);
                 $domainforproxy = '';
-                $domainforproxy = getConfig('domainforproxy');
+                $domainforproxy = getConfig('domainforproxy', $_SERVER['disktag']);
                 if ($domainforproxy!='') {
                     $url = proxy_replace_domain($url, $domainforproxy);
                 }
-                if ( strtolower(splitlast($files['name'],'.')[1])=='html' ) return output($files['content']['body'], $files['content']['stat']);
-                else {
-                    if ($_SERVER['HTTP_RANGE']!='') $header['Range'] = $_SERVER['HTTP_RANGE'];
-                    $header['Location'] = $url;
-                    return output('', 302, $header);
-                }
+                return output('', 302, [ 'Location' => $url ]);
+            } else return output('No ' . $_GET['random'] . 'file', 404);
+        } else return output('Hidden', 401);
+    }
+    // is file && not preview mode, download file
+    if ($files['type']=='file' && !isset($_GET['preview'])) {
+        if ( $_SERVER['ishidden']<4 || (!!getConfig('downloadencrypt', $_SERVER['disktag'])&&$files['name']!=getConfig('passfile')) ) {
+            $url = $files['url'];
+            $domainforproxy = '';
+            $domainforproxy = getConfig('domainforproxy', $_SERVER['disktag']);
+            if ($domainforproxy!='') {
+                $url = proxy_replace_domain($url, $domainforproxy);
             }
-        }
-        if ( isset($files['folder']) || isset($files['file']) ) {
-            return render_list($path, $files);
-        } else {
-            if (!isset($files['error'])) {
-                $files['error']['message'] = json_encode($files, JSON_PRETTY_PRINT);
-                $files['error']['code'] = 'unknownError';
-                $files['error']['stat'] = 500;
+            if ( strtolower(splitlast($files['name'], '.')[1])=='html' ) return output($files['content']['body'], $files['content']['stat']);
+            else {
+                if ($_SERVER['HTTP_RANGE']!='') $header['Range'] = $_SERVER['HTTP_RANGE'];
+                $header['Location'] = $url;
+                return output('', 302, $header);
             }
-            return message(''.getconstStr('Back').getconstStr('Home').'
' . $files['error']['message'] . '
' . $files['error']['message'] . '
' . json_encode($ispassfile, JSON_PRETTY_PRINT) . ''; - if (isset($ispassfile['file'])) { - $arr = curl_request($ispassfile[$_SERVER['DownurlStrName']]); + if ($ispassfile['type']=='file') { + $arr = curl('GET', $ispassfile['url']); if ($arr['stat']==200) { $passwordf=explode("\n",$arr['body']); $password=$passwordf[0]; @@ -935,17 +767,18 @@ function message($message, $title = 'Message', $statusCode = 200) function needUpdate() { - $slash = '/'; - if (strpos(__DIR__, ':')) $slash = '\\'; + global $slash; $current_version = file_get_contents(__DIR__ . $slash . 'version'); $current_ver = substr($current_version, strpos($current_version, '.')+1); $current_ver = explode(urldecode('%0A'),$current_ver)[0]; $current_ver = explode(urldecode('%0D'),$current_ver)[0]; $split = splitfirst($current_version, '.' . $current_ver)[0] . '.' . $current_ver; - //$github_version = file_get_contents('https://raw.githubusercontent.com/qkqpttgf/OneManager-php/master/version'); - $tmp = curl_request('https://raw.githubusercontent.com/qkqpttgf/OneManager-php/master/version'); - if ($tmp['stat']==0) return 0; - $github_version = $tmp['body']; + if (!($github_version = getcache('github_version'))) { + $tmp = curl('GET', 'https://raw.githubusercontent.com/qkqpttgf/OneManager-php/master/version'); + if ($tmp['stat']==0) return 0; + $github_version = $tmp['body']; + savecache('github_version', $github_version); + } $github_ver = substr($github_version, strpos($github_version, '.')+1); $github_ver = explode(urldecode('%0A'),$github_ver)[0]; $github_ver = explode(urldecode('%0D'),$github_ver)[0]; @@ -976,7 +809,7 @@ function passhidden($path) if (getConfig('passfile') != '') { $path = spurlencode($path,'/'); if (substr($path,-1)=='/') $path=substr($path,0,-1); - $hiddenpass=gethiddenpass($path,getConfig('passfile')); + $hiddenpass=gethiddenpass($path, getConfig('passfile')); if ($hiddenpass != '') { return comppass($hiddenpass); } else { @@ -1009,86 +842,13 @@ function time_format($ISO) return date('Y-m-d H:i:s',strtotime($ISO . " UTC")); } -function get_thumbnails_url($path = '/', $location = 0) -{ - $path1 = path_format($path); - $path = path_format($_SERVER['list_path'] . path_format($path)); - if ($path!='/'&&substr($path,-1)=='/') $path=substr($path,0,-1); - $thumb_url = getcache('thumb_'.$path, $_SERVER['disktag']); - if ($thumb_url=='') { - $url = $_SERVER['api_url']; - if ($path !== '/') { - $url .= ':' . $path; - if (substr($url,-1)=='/') $url=substr($url,0,-1); - } - $url .= ':/thumbnails/0/medium'; - $files = json_decode(curl_request($url, false, ['Authorization' => 'Bearer ' . $_SERVER['access_token']])['body'], true); - if (isset($files['url'])) { - savecache('thumb_'.$path, $files['url'], $_SERVER['disktag']); - $thumb_url = $files['url']; - } - } - if ($thumb_url!='') { - if ($location) { - $url = $thumb_url; - $domainforproxy = ''; - $domainforproxy = getConfig('domainforproxy'); - if ($domainforproxy!='') { - $url = proxy_replace_domain($url, $domainforproxy); - } - return output('', 302, [ 'Location' => $url ]); - } else return output($thumb_url); - } - return output('', 404); -} - -function bigfileupload($path) -{ - if (!$_SERVER['admin']) { - if (!is_guestup_path($path)) return output('Not_Guest_Upload_Folder', 400); - if (strpos($_GET['upbigfilename'], '../')!==false) return output('Not_Allow_Cross_Path', 400); - } - $path1 = path_format($_SERVER['list_path'] . path_format($path)); - if (substr($path1,-1)=='/') $path1=substr($path1,0,-1); - if ($_GET['upbigfilename']!=''&&$_GET['filesize']>0) { - $tmp = splitlast($_GET['upbigfilename'], '/'); - if ($tmp[1]!='') { - $fileinfo['name'] = $tmp[1]; - $fileinfo['path'] = $tmp[0]; - } else { - $fileinfo['name'] = $_GET['upbigfilename']; - } - $fileinfo['size'] = $_GET['filesize']; - $fileinfo['lastModified'] = $_GET['lastModified']; - $filename = spurlencode($_GET['upbigfilename'],'/'); - if ($fileinfo['size']>10*1024*1024) { - $cachefilename = spurlencode( $fileinfo['path'] . '/.' . $fileinfo['lastModified'] . '_' . $fileinfo['size'] . '_' . $fileinfo['name'] . '.tmp', '/'); - $getoldupinfo=fetch_files(path_format($path . '/' . $cachefilename)); - //echo json_encode($getoldupinfo, JSON_PRETTY_PRINT); - if (isset($getoldupinfo['file'])&&$getoldupinfo['size']<5120) { - $getoldupinfo_j = curl_request($getoldupinfo[$_SERVER['DownurlStrName']]); - $getoldupinfo = json_decode($getoldupinfo_j['body'], true); - if ( json_decode( curl_request($getoldupinfo['uploadUrl'])['body'], true)['@odata.context']!='' ) return output($getoldupinfo_j['body'], $getoldupinfo_j['stat']); - } - } - //if (!$_SERVER['admin']) $filename = spurlencode( $fileinfo['name'] ) . '.scfupload'; - $response = MSAPI('createUploadSession', path_format($path1 . '/' . $filename), '{"item": { "@microsoft.graph.conflictBehavior": "fail" }}', $_SERVER['access_token']); - if ($response['stat']<500) { - $responsearry = json_decode($response['body'],true); - if (isset($responsearry['error'])) return output($response['body'], $response['stat']); - $fileinfo['uploadUrl'] = $responsearry['uploadUrl']; - if ($fileinfo['size']>10*1024*1024) MSAPI('PUT', path_format($path1 . '/' . $cachefilename), json_encode($fileinfo, JSON_PRETTY_PRINT), $_SERVER['access_token']); - } - return output($response['body'], $response['stat']); - } - return output('error', 400); -} - function adminform($name = '', $pass = '', $path = '') { $html = '