feat: harden and modernize the file manager (v2.0.0)

Browse Source

Security hardening:
- bcrypt password auth via password_hash()/password_verify(), no default creds
- Session CSRF token verified with hash_equals()
- Secure session cookies: HttpOnly, SameSite=Strict, Secure over HTTPS
- Nonce-based Content-Security-Policy, frame/clickjack + nosniff headers
- realpath() root containment + symlink exclusion to block traversal
- Server-side upload size + MIME(finfo) + extension validation
- Configurable IP allow/deny with CIDR, optional HTTPS enforcement
- Fixed 500ms login delay to slow brute-force guessing

Features (single PHP file, no CDN):
- New Bootstrap 5 responsive UI with light/dark theme toggle
- Upload (drag+drop), download-only links, delete, rename, copy/move, mkdir
- Folder ZIP download, in-browser text editor (<=2MiB)
- Multi-user, per-user read-only + per-user root directories
- All frontend assets vendored locally under assets/ (349K)

Docs: full config reference, password hash guide, Tor hidden-service guide.

...

This commit is contained in:

hoelee

2026-08-19 23:55:07 +08:00

parent 204033157b

commit e457e14b30

7 changed files with 1345 additions and 480 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

assets/css/font-awesome.min.css

Vendored

+4

File diff suppressed because one or more lines are too long