Security Concern

[alenbhclynpblc]

Hello,

I know this is a "file manager" and got your point about what you want to do but this application will give a security leak.

Application need to resist about editing/uploading interpretable files.

Suggestions;

• Put an setting variable for "allow_only_safe_actions". (default value need to be true)
• For safety you need to restrict editing ".php", ".htaccess" / ".phtml" files (and much more i think, parameterize solution will be great)
• For safety you need to restrict renaming extension which listed at previous item (and also copy)
• For zip files, extract them to tmp directory and move only secure ones

Otherwise, after a simple bruteforce everything will be gone :-)

[alecos71]

as long as the filemanger remains private there is no reason to restrict the modification of some files ... of course if you have to give public access to the filemanger, take a road full of dangers of all sorts ...