<?php
// cleanup.php

$PASSWORD = "YOUR_PASSWORD";
$target_dir = __DIR__ . "/";

if (!isset($_POST['password']) || $_POST['password'] !== $PASSWORD) {
    http_response_code(403);
    echo json_encode(["error" => "Wrong password"]);
    exit;
}
if (!isset($_POST['filename'])) {
    http_response_code(400);
    echo json_encode(["error" => "No filename"]);
    exit;
}
$file = basename($_POST['filename']);
$file_path = $target_dir . $file;

if (is_file($file_path) && preg_match('/\.(png|jpg|jpeg)$/i', $file)) {
    if (unlink($file_path)) {
        echo json_encode(["success" => true]);
    } else {
        http_response_code(500);
        echo json_encode(["error" => "Could not delete file"]);
    }
} else {
    http_response_code(404);
    echo json_encode(["error" => "File not found or wrong extension"]);
}
?>