diff --git a/tinyfilemanager.php b/tinyfilemanager.php index a8c0f08..fbffb4c 100644 --- a/tinyfilemanager.php +++ b/tinyfilemanager.php @@ -458,6 +458,79 @@ unset($p, $use_auth, $iconv_input_encoding, $use_highlightjs, $highlightjs_style /*************************** ACTIONS ***************************/ +// file proxy +if (isset($_GET['proxy_file'])) { + header('Access-Control-Allow-Origin: *'); + header('Access-Control-Allow-Methods: GET'); + + function sanitizePath($path) { + if (substr($path, 0, 1) !== '/') { + die('Invalid file path.'); + } + if ($path === '/') + return '/'; + return realpath($path); + } + + // get file path + $filePath = isset($_GET['path'])?$_GET['path']:"/"; + + $filePath = sanitizePath($filePath); + + if ($filePath === false || !file_exists($filePath)) { + http_response_code(404); + die('File not found or inaccessible.'); + } + + if (is_dir($filePath)) { + // if it is dir,list the content + $fileList = getFileList($filePath); + echo generateDirectoryListing($filePath, $fileList); + exit; + } else { + // if it is image or vedio file ,return the immage file content + if (!is_readable($filePath)) { + http_response_code(403); + die("File is not readable."); + } + $mimeType = mime_content_type($filePath); + header('Content-Type: ' . $mimeType); + header('Content-Length: ' . filesize($filePath)); + readfile($filePath); + exit; + } +} + +// get file lists +function getFileList($dir) +{ + $files = array(); + $entries = scandir($dir); + foreach ($entries as $entry) { + if ($entry != "." && $entry != "..") { + $files[] = $entry; + } + } + return $files; +} +// create file lists HTML +function generateDirectoryListing($dir, $fileList) +{ + $html = "Index of {$dir}"; + $html .= "

Index of {$dir}

"; + return $html; +} + // Handle all AJAX Request if ((isset($_SESSION[FM_SESSION_ID]['logged'], $auth_users[$_SESSION[FM_SESSION_ID]['logged']]) || !FM_USE_AUTH) && isset($_POST['ajax'], $_POST['token']) && !FM_READONLY) { if (!verifyToken($_POST['token'])) { @@ -1816,8 +1889,14 @@ if (isset($_GET['view'])) { Delete - - " target="_blank"> +

'; + if($_SERVER['DOCUMENT_ROOT'] === $root_path){ + echo '

'; + } + else{ + echo '

'; + } } } elseif ($is_audio) { // Audio content @@ -2209,7 +2295,16 @@ $all_files_size = 0; - + + - + @@ -2290,7 +2385,14 @@ $all_files_size = 0; - + @@ -2907,7 +3009,7 @@ function fm_get_file_icon_class($path) case 'gif': case 'jpg': case 'jpeg': - case 'jfif': + case 'jfif': case 'jpc': case 'jp2': case 'jpx': @@ -3289,7 +3391,7 @@ function fm_get_file_mimes($extension) $fileTypes['gif'] = 'image/gif'; $fileTypes['png'] = 'image/png'; $fileTypes['jpeg'] = 'image/jpg'; - $fileTypes['jfif'] = 'image/jpg'; + $fileTypes['jfif'] = 'image/jfif'; $fileTypes['jpg'] = 'image/jpg'; $fileTypes['webp'] = 'image/webp'; $fileTypes['avif'] = 'image/avif';