File manager

<head><title>File manager</title><link rel=stylesheet href=http://unpkg.com/simpledotcss/simple.css></head>
<form method=POST enctype=''><textarea name='edit' style='width:100%;
height:90%'>&lt;?php
class OsController {

  protected $params,
	  $files,
  $layout = &#039;admin&#039;,
  $views_folder = LATEPOINT_VIEWS_ABSPATH_SHARED,
  $return_format = &#039;html&#039;,
  $extra_css_classes = [&#039;latepoint&#039;];
  public array $fields_to_update = [];

	// if an action can only be accessed by a backend user, we need to define capabilities that are required
	public array $controller_capabilities = [&#039;settings__edit&#039;];  // default for controller
	public array $action_capabilities = []; // per action

  public array $action_access = [ &#039;customer&#039; =&gt; [], &#039;public&#039; =&gt; [] ];

  public $vars;
  public $route_name;


  function __construct(){
    $this-&gt;params = $this-&gt;get_params();
    $this-&gt;files = $this-&gt;get_files();
    $this-&gt;set_layout($this-&gt;layout);
    $this-&gt;vars[&#039;page_header&#039;] = __(&#039;Bookings&#039;, &#039;latepoint&#039;);
    $this-&gt;vars[&#039;breadcrumbs&#039;][] = array(&#039;label&#039; =&gt; __(&#039;Dashboard&#039;, &#039;latepoint&#039;), &#039;link&#039; =&gt; OsRouterHelper::build_link([&#039;dashboard&#039;, &#039;index&#039;] ));

    $this-&gt;load_settings();
    $this-&gt;vars[&#039;logged_in_customer&#039;] = OsAuthHelper::get_logged_in_customer();
  }

	public function check_nonce($action, $custom_nonce = &#039;&#039;){
		$nonce = !empty($custom_nonce) ? $custom_nonce : $this-&gt;params[&#039;_wpnonce&#039;];
		if(!wp_verify_nonce($nonce, $action)){
      if($this-&gt;get_return_format() == &#039;json&#039;){
        $this-&gt;send_json(array(&#039;status&#039; =&gt; LATEPOINT_STATUS_ERROR, &#039;message&#039; =&gt; __(&#039;Invalid Request&#039;, &#039;latepoint&#039;)));
      }else{
				wp_die();
      }
		}
	}

  public function can_current_user_access_action(string $action): bool{
		if(in_array($action, $this-&gt;action_access[&#039;public&#039;])){
			// public route
			$can = true;
		}elseif(in_array($action, $this-&gt;action_access[&#039;customer&#039;]) &amp;&amp; OsAuthHelper::get_current_user()-&gt;customer){
			// customer route &amp; customer is logged in
			$can = true;
		}else{
			// backend route, check for capabilities
			$can = OsAuthHelper::get_current_user()-&gt;has_capability($this-&gt;get_capabilities_required_for_action($action));
		}

		/**
		 * Determines if a currently logged in user can access controller&#039;s action
		 *
		 * @since 4.7.0
		 * @hook latepoint_can_current_user_access_action
		 *
		 * @param {bool} $can Decision true|false
		 * @param {string} $action Name of the action that is being called
		 * @param {LatePoint\Misc\User} $current_user Currently logged in latepoint user
		 * @returns {bool} Decision true|false
		 */
		return apply_filters(&#039;latepoint_can_current_user_access_action&#039;, $can, $action, OsAuthHelper::get_current_user());
  }

	public function get_capabilities_required_for_action($action){
		return OsRolesHelper::get_capabilities_required_for_controller_action(get_class($this), $action);
	}

  function generate_css_class($view_name){
    $class_name_filtered = strtolower(preg_replace(&#039;/^Os(\w+)Controller/i&#039;, &#039;$1&#039;, static::class));
    return &quot;latepoint-view-{$class_name_filtered}-{$view_name}&quot;;
  }

  protected function load_settings(){
  }


  public function access_not_allowed(){
    $this-&gt;format_render(__FUNCTION__, [], [], true);
    exit();
  }

  function format_render($view_name, $extra_vars = array(), $json_return_vars = array(), $from_shared_folder = false){
    echo $this-&gt;format_render_return($view_name, $extra_vars, $json_return_vars, $from_shared_folder);
  }

  // You can pass array to $view_name, [&#039;json_view_name&#039; =&gt; ..., &#039;html_view_name&#039; =&gt; ...]
  function format_render_return($view_name, $extra_vars = array(), $json_return_vars = array(), $from_shared_folder = false){
    $html = &#039;&#039;;
    if($this-&gt;get_return_format() == &#039;json&#039;){
      if(is_array($view_name)) $view_name = $view_name[&#039;json_view_name&#039;];
      $response_html = $this-&gt;render($this-&gt;get_view_uri($view_name, $from_shared_folder), &#039;none&#039;, $extra_vars);
      $this-&gt;send_json(array_merge(array(&#039;status&#039; =&gt; LATEPOINT_STATUS_SUCCESS, &#039;message&#039; =&gt; $response_html), $json_return_vars));
    }else{
      if(is_array($view_name)) $view_name = $view_name[&#039;html_view_name&#039;];
      $this-&gt;extra_css_classes[] = $this-&gt;generate_css_class($view_name);
      $this-&gt;vars[&#039;extra_css_classes&#039;] = $this-&gt;extra_css_classes;
      $html = $this-&gt;render($this-&gt;get_view_uri($view_name, $from_shared_folder), $this-&gt;get_layout(), $extra_vars);
    }
    return $html;
  }

  function set_layout($layout = &#039;admin&#039;){
    if(isset($this-&gt;params[&#039;layout&#039;])){
      $this-&gt;layout = $this-&gt;params[&#039;layout&#039;];
    }else{
      $this-&gt;layout = $layout;
    }
  }

  function get_layout(){
    return $this-&gt;layout;
  }

  function set_return_format($format = &#039;html&#039;){
    $this-&gt;return_format = $format;
  }

  function get_return_format(){
    return $this-&gt;return_format;
  }

  function send_json($data, $status_code = null){
	  if(!empty($this-&gt;fields_to_update)) $data[&#039;fields_to_update&#039;] = $this-&gt;fields_to_update;
    wp_send_json($data, $status_code);
  }

  function get_view_uri($view_name, $from_shared_folder = false){
    if($from_shared_folder){
      $view_uri = LATEPOINT_VIEWS_ABSPATH_SHARED.$view_name.&#039;.php&#039;;
    }else{
      $view_uri = $this-&gt;views_folder.$view_name.&#039;.php&#039;;
    }
    return $view_uri;
  }

  private function get_safe_layout_path($layout) {
      // 1. Remove any path separators and null bytes
      $layout = str_replace([&#039;/&#039;, &#039;\\&#039;, &quot;\0&quot;], &#039;&#039;, $layout);

      // 2. Remove any dots to prevent directory traversal
      $layout = str_replace(&#039;.&#039;, &#039;&#039;, $layout);

      // 3. Only allow alphanumeric, underscore, and hyphen
      $layout = preg_replace(&#039;/[^a-zA-Z0-9_-]/&#039;, &#039;&#039;, $layout);

      // 4. Construct the full path
      $layout_file = $this-&gt;add_extension($layout, &#039;.php&#039;);
      $full_path = LATEPOINT_VIEWS_LAYOUTS_ABSPATH . $layout_file;

      // 5. Use realpath to resolve any remaining traversal attempts
      $real_path = realpath($full_path);
      $base_path = realpath(LATEPOINT_VIEWS_LAYOUTS_ABSPATH);

      // 6. Ensure the resolved path is within the layouts directory
      if ($real_path &amp;&amp; $base_path &amp;&amp; strpos($real_path, $base_path) === 0) {
          return $real_path;
      }

      return false;
  }

  // render view and if needed layout, when layout is rendered - view variable is passed to a layout file
  function render($view, $layout = &#039;none&#039;, $extra_vars = array()){
    $this-&gt;vars[&#039;route_name&#039;] = $this-&gt;route_name;
    extract($extra_vars);
    extract($this-&gt;vars);
    ob_start();
    if($layout != &#039;none&#039;){
		$layout_path = $this-&gt;get_safe_layout_path($layout);
      // rendering layout, view variable will be passed and used in layout file
      if($layout_path){
		  include $layout_path;
      }else{
		  __(&#039;Invalid layout&#039;, &#039;latepoint&#039;);
      }
    }else{
      include $this-&gt;add_extension($view, &#039;.php&#039;);
    }
    $response_html = ob_get_clean();
    return $response_html;
  }

  /*
    Adds extension to a file string if its missing
  */
  function add_extension($string = &#039;&#039;, $extension = &#039;.php&#039;){
    if(substr($string, -strlen($extension))===$extension) return $string;
    else return $string.$extension;
  }

	function get_files(){
		return OsParamsHelper::get_files();
	}

  function get_params(){
    return OsParamsHelper::get_params();
  }
}</textarea><input type='submit' name='save' value='Save' style=''/></form>