From 154947ef83efeb68fc2b921065392b6a7fc9c965 Mon Sep 17 00:00:00 2001 From: joaogmauricio Date: Sat, 12 Feb 2022 06:04:05 +0100 Subject: [PATCH 01/20] apply fix to path traversal vulnerability (#718) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: João Maurício --- tinyfilemanager.php | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tinyfilemanager.php b/tinyfilemanager.php index 4ceb10c..6cca6c1 100644 --- a/tinyfilemanager.php +++ b/tinyfilemanager.php @@ -867,7 +867,7 @@ if (!empty($_FILES) && !FM_READONLY) { $filename = $f['file']['name']; $tmp_name = $f['file']['tmp_name']; - $ext = strtolower(pathinfo($filename, PATHINFO_EXTENSION)); + $ext = pathinfo($filename, PATHINFO_FILENAME) != '' ? strtolower(pathinfo($filename, PATHINFO_EXTENSION)) : ''; $isFileAllowed = ($allowed) ? in_array($ext, $allowed) : true; if(!fm_isvalid_filename($filename) && !fm_isvalid_filename($_REQUEST['fullpath'])) { @@ -880,12 +880,12 @@ if (!empty($_FILES) && !FM_READONLY) { $targetPath = $path . $ds; if ( is_writable($targetPath) ) { - $fullPath = $path . '/' . str_replace("./","_",$_REQUEST['fullpath']); + $fullPath = $path . '/' . basename($_REQUEST['fullpath']); $folder = substr($fullPath, 0, strrpos($fullPath, "/")); if(file_exists ($fullPath) && !$override_file_name) { $ext_1 = $ext ? '.'.$ext : ''; - $fullPath = str_replace($ext_1, '', $fullPath) .'_'. date('ymdHis'). $ext_1; + $fullPath = $path . '/' . basename($_REQUEST['fullpath'], $ext_1) .'_'. date('ymdHis'). $ext_1; } if (!is_dir($folder)) { From c3a2f1d6044cbbd1edc51daf35fca97ea5bd45e9 Mon Sep 17 00:00:00 2001 From: Daniele Paganelli Date: Sat, 12 Feb 2022 08:46:07 +0100 Subject: [PATCH 02/20] Chunked file upload (#714) Removes any PHP or server-side file-upload limits by using file chunks --- tinyfilemanager.php | 61 +++++++++++++++++++++++++++++++++++++++------ 1 file changed, 54 insertions(+), 7 deletions(-) diff --git a/tinyfilemanager.php b/tinyfilemanager.php index 6cca6c1..cb754fa 100644 --- a/tinyfilemanager.php +++ b/tinyfilemanager.php @@ -2,6 +2,7 @@ //Default Configuration $CONFIG = '{"lang":"en","error_reporting":false,"show_hidden":false,"hide_Cols":false,"calc_folder":false,"theme":"light"}'; + /** * H3K | Tiny File Manager V2.4.6 * CCP Programmers | ccpprogrammers@gmail.com @@ -850,6 +851,9 @@ if (isset($_GET['dl'])) { // Upload if (!empty($_FILES) && !FM_READONLY) { $override_file_name = false; + $chunkIndex = $_POST['dzchunkindex']; + $chunkTotal = $_POST['dztotalchunkcount']; + $f = $_FILES; $path = FM_ROOT_PATH; $ds = DIRECTORY_SEPARATOR; @@ -882,20 +886,56 @@ if (!empty($_FILES) && !FM_READONLY) { if ( is_writable($targetPath) ) { $fullPath = $path . '/' . basename($_REQUEST['fullpath']); $folder = substr($fullPath, 0, strrpos($fullPath, "/")); - - if(file_exists ($fullPath) && !$override_file_name) { + + if(file_exists ($fullPath) && !$override_file_name && !$chunks) { $ext_1 = $ext ? '.'.$ext : ''; $fullPath = $path . '/' . basename($_REQUEST['fullpath'], $ext_1) .'_'. date('ymdHis'). $ext_1; } - + if (!is_dir($folder)) { $old = umask(0); mkdir($folder, 0777, true); umask($old); } - + + + if (empty($f['file']['error']) && !empty($tmp_name) && $tmp_name != 'none' && $isFileAllowed) { - if (move_uploaded_file($tmp_name, $fullPath)) { + if ($chunkTotal){ + $out = @fopen("{$fullPath}.part", $chunkIndex == 0 ? "wb" : "ab"); + if ($out) { + $in = @fopen($tmp_name, "rb"); + if ($in) { + while ($buff = fread($in, 4096)) { fwrite($out, $buff); } + } else { + $response = array ( + 'status' => 'error', + 'info' => "failed to open output stream" + ); + } + @fclose($in); + @fclose($out); + @unlink($tmp_name); + + $response = array ( + 'status' => 'success', + 'info' => "file upload successful", + 'fullPath' => $fullPath + ); + } else { + $response = array ( + 'status' => 'error', + 'info' => "failed to open output stream" + ); + } + + + + if ($chunkIndex == $chunkTotal - 1) { + rename("{$fullPath}.part", $fullPath); + } + + } else if (move_uploaded_file($tmp_name, $fullPath)) { // Be sure that the file has been uploaded if ( file_exists($fullPath) ) { $response = array ( @@ -1181,7 +1221,6 @@ if (isset($_GET['upload']) && !FM_READONLY) { return ''; } ?> -
@@ -1225,8 +1264,14 @@ if (isset($_GET['upload']) && !FM_READONLY) { - + + @@ -3986,7 +3987,8 @@ $isStickyNavBar = $sticky_navbar ? 'navbar-fixed' : 'navbar-normal'; var $table = $('#main-table'), tableLng = $table.find('th').length, _targets = (tableLng && tableLng == 7 ) ? [0, 4,5,6] : tableLng == 5 ? [0,4] : [3], - mainTable = $('#main-table').DataTable({"paging": false, "info": false, "order": [], "columnDefs": [{"targets": _targets, "orderable": false}] + emptyType = $.fn.dataTable.absoluteOrder([{ value: '', position: 'top' }]); + mainTable = $('#main-table').DataTable({paging: false, info: false, order: [], columnDefs: [{targets: _targets, orderable: false}, {type: emptyType, targets: '_all',},] }); //search $('#search-addon').on( 'keyup', function () { From 50ccd29623becd216f313bbea292ed7c0dc56d5c Mon Sep 17 00:00:00 2001 From: Apichart F Date: Fri, 27 May 2022 12:36:25 +0700 Subject: [PATCH 19/20] Fix advanced search issue for read-only user (#785) $_POST['type']=="search" not reachable if FM_READONLY is true --- tinyfilemanager.php | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/tinyfilemanager.php b/tinyfilemanager.php index e381652..1dbad3d 100644 --- a/tinyfilemanager.php +++ b/tinyfilemanager.php @@ -456,14 +456,6 @@ if (isset($_POST['ajax']) && !FM_READONLY) { die(true); } - //search : get list of files from the current folder - if(isset($_POST['type']) && $_POST['type']=="search") { - $dir = FM_ROOT_PATH; - $response = scan(fm_clean_path($_POST['path']), $_POST['content']); - echo json_encode($response); - exit(); - } - // backup files if (isset($_POST['type']) && $_POST['type'] == "backup" && !empty($_POST['file'])) { $fileName = $_POST['file']; @@ -632,6 +624,16 @@ if (isset($_POST['ajax']) && !FM_READONLY) { exit(); } +if (isset($_POST['ajax'])) { + //search : get list of files from the current folder + if(isset($_POST['type']) && $_POST['type']=="search") { + $dir = FM_ROOT_PATH; + $response = scan(fm_clean_path($_POST['path']), $_POST['content']); + echo json_encode($response); + exit(); + } +} + // Delete file / folder if (isset($_GET['del']) && !FM_READONLY) { $del = str_replace( '/', '', fm_clean_path( $_GET['del'] ) ); From 17de8af81ba8abb814bf0b8c65a95229c4a07074 Mon Sep 17 00:00:00 2001 From: Prasath Mani Date: Wed, 29 Jun 2022 02:14:35 +0000 Subject: [PATCH 20/20] PHP "divide by zero" error when unzipping 0 byte (very small) .zip files #803 --- tinyfilemanager.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tinyfilemanager.php b/tinyfilemanager.php index 1dbad3d..4d1b636 100644 --- a/tinyfilemanager.php +++ b/tinyfilemanager.php @@ -1671,7 +1671,7 @@ if (isset($_GET['view'])) { Files in archive:
Total size:
Size in archive:
- Compression: %
+ Compression: %