From 2c0e6d216ec96ac2057d90c9f3ffaff9ad173080 Mon Sep 17 00:00:00 2001 From: ririko5834 <64729293+ririko5834@users.noreply.github.com> Date: Mon, 31 Oct 2022 16:49:21 +0100 Subject: [PATCH 01/55] Update tinyfilemanager.php (#874) --- tinyfilemanager.php | 2 ++ 1 file changed, 2 insertions(+) diff --git a/tinyfilemanager.php b/tinyfilemanager.php index c0d1d65..6e74bd1 100644 --- a/tinyfilemanager.php +++ b/tinyfilemanager.php @@ -2149,7 +2149,9 @@ $tableTheme = (FM_THEME == "dark") ? "text-white bg-dark table-dark" : "bg-white '.fm_get_filesize($all_files_size).'' ?> '.$num_files.'' ?> '.$num_folders.'' ?> + '.fm_get_filesize(@disk_free_space($path)) .' '.lng('FreeOf').' '.fm_get_filesize(@disk_total_space($path)).''; ?> + From be49a13b8e55f0bee16cdca600e9c32cf6a713b9 Mon Sep 17 00:00:00 2001 From: Rizky Date: Mon, 7 Nov 2022 23:53:01 +0700 Subject: [PATCH 02/55] Fixes advanced search not working. (#878) Fix #869 --- tinyfilemanager.php | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/tinyfilemanager.php b/tinyfilemanager.php index 6e74bd1..35fd57a 100644 --- a/tinyfilemanager.php +++ b/tinyfilemanager.php @@ -424,6 +424,17 @@ unset($p, $use_auth, $iconv_input_encoding, $use_highlightjs, $highlightjs_style /*************************** ACTIONS ***************************/ // AJAX Request + +if (isset($_POST['ajax'])) { + //search : get list of files from the current folder + if(isset($_POST['type']) && $_POST['type']=="search") { + $dir = FM_ROOT_PATH; + $response = scan(fm_clean_path($_POST['path']), $_POST['content']); + echo json_encode($response); + exit(); + } +} + if (isset($_POST['ajax']) && !FM_READONLY) { // save @@ -626,15 +637,6 @@ if (isset($_POST['ajax']) && !FM_READONLY) { exit(); } -if (isset($_POST['ajax'])) { - //search : get list of files from the current folder - if(isset($_POST['type']) && $_POST['type']=="search") { - $dir = FM_ROOT_PATH; - $response = scan(fm_clean_path($_POST['path']), $_POST['content']); - echo json_encode($response); - exit(); - } -} // Delete file / folder if (isset($_GET['del']) && !FM_READONLY) { From 59c6b9b26a589c2ac674b965876f171f7acf509f Mon Sep 17 00:00:00 2001 From: llcool Date: Mon, 7 Nov 2022 16:54:56 +0000 Subject: [PATCH 03/55] Downloading file - PHP warning loop "Permission denied" (#879) * Bugfix: Stop looping error when downloading a file with no access. * Delete .history directory ignore .history --- tinyfilemanager.php | 27 ++++++++++++++++++++------- 1 file changed, 20 insertions(+), 7 deletions(-) diff --git a/tinyfilemanager.php b/tinyfilemanager.php index 35fd57a..5ac361f 100644 --- a/tinyfilemanager.php +++ b/tinyfilemanager.php @@ -3060,6 +3060,26 @@ function fm_download_file($fileLocation, $fileName, $chunkSize = 1024) $contentType = implode(' ', $contentType); } + $size = filesize($fileLocation); + + if ($size == 0) { + fm_set_msg(lng('Zero byte file! Aborting download'), 'error'); + fm_redirect(FM_SELF_URL . '?p=' . urlencode(FM_PATH)); + + return (false); + } + + @ini_set('magic_quotes_runtime', 0); + $fp = fopen("$fileLocation", "rb"); + + if ($fp === false) { + fm_set_msg(lng('Cannot open file! Aborting download'), 'error'); + fm_redirect(FM_SELF_URL . '?p=' . urlencode(FM_PATH)); + + return (false); + + } + header("Cache-Control: public"); header("Content-Transfer-Encoding: binary\n"); header("Content-Type: $contentType"); @@ -3076,7 +3096,6 @@ function fm_download_file($fileLocation, $fileName, $chunkSize = 1024) header("Accept-Ranges: bytes"); $range = 0; - $size = filesize($fileLocation); if (isset($_SERVER['HTTP_RANGE'])) { list($a, $range) = explode("=", $_SERVER['HTTP_RANGE']); @@ -3092,12 +3111,6 @@ function fm_download_file($fileLocation, $fileName, $chunkSize = 1024) header("Content-Length: " . $size); } - if ($size == 0) { - die('Zero byte file! Aborting download'); - } - @ini_set('magic_quotes_runtime', 0); - $fp = fopen("$fileLocation", "rb"); - fseek($fp, $range); while (!feof($fp) and (connection_status() == 0)) { From fce0f5bacb726a5ca3bb9c2743960fca5e7edf82 Mon Sep 17 00:00:00 2001 From: Prasath Mani Date: Mon, 7 Nov 2022 22:42:07 +0530 Subject: [PATCH 04/55] Fix warning message --- tinyfilemanager.php | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) diff --git a/tinyfilemanager.php b/tinyfilemanager.php index 5ac361f..9af0df7 100644 --- a/tinyfilemanager.php +++ b/tinyfilemanager.php @@ -1,6 +1,6 @@ 'Directory path', 'Username2' => 'Directory path', ...) -$directories_users = array(); - // input encoding for iconv $iconv_input_encoding = 'UTF-8'; @@ -2151,9 +2147,9 @@ $tableTheme = (FM_THEME == "dark") ? "text-white bg-dark table-dark" : "bg-white '.fm_get_filesize($all_files_size).'' ?> '.$num_files.'' ?> '.$num_folders.'' ?> - + @@ -3113,7 +3109,7 @@ function fm_download_file($fileLocation, $fileName, $chunkSize = 1024) fseek($fp, $range); - while (!feof($fp) and (connection_status() == 0)) { + while (!@feof($fp) and (connection_status() == 0)) { set_time_limit(0); print(@fread($fp, 1024*$chunkSize)); flush(); From 4d8d4a3aba4cdc23214a5da9e6b94c9160afb36c Mon Sep 17 00:00:00 2001 From: Prasath Mani Date: Mon, 7 Nov 2022 22:48:15 +0530 Subject: [PATCH 05/55] Update tinyfilemanager.php --- tinyfilemanager.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tinyfilemanager.php b/tinyfilemanager.php index 9af0df7..da0f403 100644 --- a/tinyfilemanager.php +++ b/tinyfilemanager.php @@ -1,6 +1,6 @@ Date: Sat, 19 Nov 2022 19:55:39 +0000 Subject: [PATCH 06/55] Major update on security, improved UI and bug fix. --- README.md | 6 +- config-sample.php | 123 -------- tinyfilemanager.php | 696 +++++++++++++++++++++++--------------------- translation.json | 2 +- 4 files changed, 366 insertions(+), 461 deletions(-) delete mode 100644 config-sample.php diff --git a/README.md b/README.md index a066123..633a60c 100644 --- a/README.md +++ b/README.md @@ -37,13 +37,13 @@ Default username/password: **admin/admin@123** and **user/12345**. To enable/disable authentication set `$use_auth` to true or false. -:information_source: Rename the `config-sample.php` file into `config.php` to use configuration, it is an additional configuration file, Feel free to remove completely this file and configure "tinyfilemanager.php" as a single file application. +:information_source: Add your own configuration file `config.php` in the same folder to use as additional configuration file. ### :loudspeaker: Features - :cd: Open Source, light and extremely simple - :iphone: Mobile friendly view for touch devices -- :information_source: Basic features likes Create, Delete, Modify, View, Quick Preview, Download, Copy and Move files +- :information_source: Basic features likes Create, Delete, Modify, View, Download, Copy and Move files - :arrow_double_up: Ajax Upload, Ability to drag & drop, upload from URL, multiple files upload with file extensions filter - :file_folder: Ability to create folders and files - :gift: Ability to compress, extract files (`zip`, `tar`) @@ -79,8 +79,6 @@ DockerHub: [https://hub.docker.com/r/tinyfilemanager/tinyfilemanager](https://hu #### How to change config within docker -**Important!!!** First, you can copy `config-sample.php` to `config.php`, and must modify this following config - Origin: ```php diff --git a/config-sample.php b/config-sample.php deleted file mode 100644 index c75b9a9..0000000 --- a/config-sample.php +++ /dev/null @@ -1,123 +0,0 @@ - 'Password', 'Username2' => 'Password2', ...) -// Generate secure password hash - https://tinyfilemanager.github.io/docs/pwd.html -$auth_users = array( - 'admin' => '$2y$10$/K.hjNr84lLNDt8fTXjoI.DBp6PpeyoJ.mGwrrLuCZfAwfSAGqhOW', //admin@123 - 'user' => '$2y$10$Fg6Dz8oH9fPoZ2jJan5tZuv6Z4Kp7avtQ9bDfrdRntXtPeiMAZyGO' //12345 -); - -// Readonly users -// e.g. array('users', 'guest', ...) -$readonly_users = array( - 'user' -); - -// Enable highlight.js (https://highlightjs.org/) on view's page -$use_highlightjs = true; - -// highlight.js style -// for dark theme use 'ir-black' -$highlightjs_style = 'vs'; - -// Enable ace.js (https://ace.c9.io/) on view's page -$edit_files = true; - -// Default timezone for date() and time() -// Doc - http://php.net/manual/en/timezones.php -$default_timezone = 'Etc/UTC'; // UTC - -// Root path for file manager -// use absolute path of directory i.e: '/var/www/folder' or $_SERVER['DOCUMENT_ROOT'].'/folder' -$root_path = $_SERVER['DOCUMENT_ROOT']; - -// Root url for links in file manager.Relative to $http_host. Variants: '', 'path/to/subfolder' -// Will not working if $root_path will be outside of server document root -$root_url = ''; - -// Server hostname. Can set manually if wrong -$http_host = $_SERVER['HTTP_HOST']; - -// user specific directories -// array('Username' => 'Directory path', 'Username2' => 'Directory path', ...) -$directories_users = array(); - -// input encoding for iconv -$iconv_input_encoding = 'UTF-8'; - -// date() format for file modification date -// Doc - https://www.php.net/manual/en/datetime.format.php -$datetime_format = 'd.m.y H:i:s'; - -// Allowed file extensions for create and rename files -// e.g. 'txt,html,css,js' -$allowed_file_extensions = ''; - -// Allowed file extensions for upload files -// e.g. 'gif,png,jpg,html,txt' -$allowed_upload_extensions = ''; - -// Favicon path. This can be either a full url to an .PNG image, or a path based on the document root. -// full path, e.g http://example.com/favicon.png -// local path, e.g images/icons/favicon.png -$favicon_path = ''; - -// Files and folders to excluded from listing -// e.g. array('myfile.html', 'personal-folder', '*.php', ...) -$exclude_items = array(''); - -// Online office Docs Viewer -// Availabe rules are 'google', 'microsoft' or false -// google => View documents using Google Docs Viewer -// microsoft => View documents using Microsoft Web Apps Viewer -// false => disable online doc viewer -$online_viewer = 'google'; - -// Sticky Nav bar -// true => enable sticky header -// false => disable sticky header -$sticky_navbar = true; - - -// max upload file size -$max_upload_size_bytes = 5000; - -// Possible rules are 'OFF', 'AND' or 'OR' -// OFF => Don't check connection IP, defaults to OFF -// AND => Connection must be on the whitelist, and not on the blacklist -// OR => Connection must be on the whitelist, or not on the blacklist -$ip_ruleset = 'OFF'; - -// Should users be notified of their block? -$ip_silent = true; - -// IP-addresses, both ipv4 and ipv6 -$ip_whitelist = array( - '127.0.0.1', // local ipv4 - '::1' // local ipv6 -); - -// IP-addresses, both ipv4 and ipv6 -$ip_blacklist = array( - '0.0.0.0', // non-routable meta ipv4 - '::' // non-routable meta ipv6 -); - -?> diff --git a/tinyfilemanager.php b/tinyfilemanager.php index da0f403..ecfa45f 100644 --- a/tinyfilemanager.php +++ b/tinyfilemanager.php @@ -1,16 +1,16 @@ Don't check connection IP, defaults to OFF @@ -161,9 +162,6 @@ $report_errors = isset($cfg->data['error_reporting']) ? $cfg->data['error_report // Hide Permissions and Owner cols in file-listing $hide_Cols = isset($cfg->data['hide_Cols']) ? $cfg->data['hide_Cols'] : true; -// Show directory size: true or speedup output: false -$calc_folder = isset($cfg->data['calc_folder']) ? $cfg->data['calc_folder'] : true; - // Theme $theme = isset($cfg->data['theme']) ? $cfg->data['theme'] : 'light'; @@ -214,6 +212,11 @@ if (defined('FM_EMBED')) { restore_error_handler(); } +//Genrating CSRF Token +if (empty($_SESSION['token'])) { + $_SESSION['token'] = bin2hex(random_bytes(32)); +} + if (empty($auth_users)) { $use_auth = false; } @@ -236,6 +239,7 @@ defined('FM_SELF_URL') || define('FM_SELF_URL', ($is_https ? 'https' : 'http') . // logout if (isset($_GET['logout'])) { unset($_SESSION[FM_SESSION_ID]['logged']); + unset( $_SESSION['token']); fm_redirect(FM_SELF_URL); } @@ -289,18 +293,18 @@ if ($ip_ruleset != 'OFF') { if ($use_auth) { if (isset($_SESSION[FM_SESSION_ID]['logged'], $auth_users[$_SESSION[FM_SESSION_ID]['logged']])) { // Logged - } elseif (isset($_POST['fm_usr'], $_POST['fm_pwd'])) { + } elseif (isset($_POST['fm_usr'], $_POST['fm_pwd'], $_POST['token'])) { // Logging In sleep(1); if(function_exists('password_verify')) { - if (isset($auth_users[$_POST['fm_usr']]) && isset($_POST['fm_pwd']) && password_verify($_POST['fm_pwd'], $auth_users[$_POST['fm_usr']])) { + if (isset($auth_users[$_POST['fm_usr']]) && isset($_POST['fm_pwd']) && password_verify($_POST['fm_pwd'], $auth_users[$_POST['fm_usr']]) && verifyToken($_POST['token'])) { $_SESSION[FM_SESSION_ID]['logged'] = $_POST['fm_usr']; fm_set_msg(lng('You are logged in')); - fm_redirect(FM_SELF_URL . '?p='); + fm_redirect(FM_ROOT_URL . $_SERVER['REQUEST_URI']); } else { unset($_SESSION[FM_SESSION_ID]['logged']); fm_set_msg(lng('Login failed. Invalid username or password'), 'error'); - fm_redirect(FM_SELF_URL); + fm_redirect(FM_ROOT_URL . $_SERVER['REQUEST_URI']); } } else { fm_set_msg(lng('password_hash not supported, Upgrade PHP version'), 'error');; @@ -317,7 +321,7 @@ if ($use_auth) {