Script allows read-only users to read credentials of other users

[C-Duv]

Because the script allow opening/viewing itself, if the script is located in $root_path a read only user can read credentials of others users (in $auth_users configuration variable) and then gain write access.

Proposition: add an option to disallow the script to view itself.

[alexantr]

This filemanager was created as developer tool. And I'm planning to remove some features which not usable for me as developer: hiding hidden files, readonly users etc.
Please use elFinder if you want to give access to unreliable users. Or fork this repo and create new features.

[alexantr]

Sorry, but I removed supporting read-only users and hidding hidden files.

Please try tinyfilemanager