Clean PHP File Manager

<?php
header('Content-Type: application/json');

$baseDir = __DIR__ . '/files';
if (!is_dir($baseDir)) mkdir($baseDir, 0755, true);

function cleanName($name) {
    return basename($name);
}

function pathFor($name) {
    global $baseDir;
    return $baseDir . DIRECTORY_SEPARATOR . cleanName($name);
}

$action = $_GET['action'] ?? $_POST['action'] ?? '';

switch ($action) {
    case 'list':
        $items = [];
        foreach (scandir($baseDir) as $name) {
            if ($name === '.' || $name === '..') continue;
            $path = pathFor($name);
            if (is_file($path)) {
                $items[] = [
                    'name' => $name,
                    'size' => filesize($path),
                    'modified' => filemtime($path)
                ];
            }
        }
        echo json_encode(['success' => true, 'files' => $items]);
        break;

case 'read':
        $name = cleanName($_GET['file'] ?? '');
        $path = pathFor($name);
        if (!$name || !is_file($path)) {
            http_response_code(404);
            echo json_encode(['success' => false, 'error' => 'File not found']);
            exit;
        }
        echo json_encode([
            'success' => true,
            'name' => $name,
            'content' => file_get_contents($path)
        ]);
        break;

case 'save':
        $name = cleanName($_POST['file'] ?? '');
        $content = $_POST['content'] ?? '';
        $path = pathFor($name);
        if (!$name || !is_file($path)) {
            http_response_code(404);
            echo json_encode(['success' => false, 'error' => 'File not found']);
            exit;
        }
        file_put_contents($path, $content, LOCK_EX);
        echo json_encode(['success' => true]);
        break;

case 'upload':
        if (!isset($_FILES['file']) || $_FILES['file']['error'] !== UPLOAD_ERR_OK) {
            http_response_code(400);
            echo json_encode(['success' => false, 'error' => 'Upload failed']);
            exit;
        }
        $name = cleanName($_FILES['file']['name']);
        if (!$name) {
            http_response_code(400);
            echo json_encode(['success' => false, 'error' => 'Invalid filename']);
            exit;
        }
        move_uploaded_file($_FILES['file']['tmp_name'], pathFor($name));
        echo json_encode(['success' => true, 'name' => $name]);
        break;

case 'delete':
        $name = cleanName($_POST['file'] ?? '');
        $path = pathFor($name);
        if (!$name || !is_file($path)) {
            http_response_code(404);
            echo json_encode(['success' => false, 'error' => 'File not found']);
            exit;
        }
        unlink($path);
        echo json_encode(['success' => true]);
        break;

case 'download':
        $name = cleanName($_GET['file'] ?? '');
        $path = pathFor($name);
        if (!$name || !is_file($path)) {
            http_response_code(404);
            echo 'File not found';
            exit;
        }
        header('Content-Type: application/octet-stream');
        header('Content-Disposition: attachment; filename="' . addslashes($name) . '"');
        header('Content-Length: ' . filesize($path));
        readfile($path);
        break;

default:
        echo json_encode(['success' => true, 'message' => 'File Manager API']);
}
?>