 hoelee
|
e457e14b30
|
feat: harden and modernize the file manager (v2.0.0)
Security hardening:
- bcrypt password auth via password_hash()/password_verify(), no default creds
- Session CSRF token verified with hash_equals()
- Secure session cookies: HttpOnly, SameSite=Strict, Secure over HTTPS
- Nonce-based Content-Security-Policy, frame/clickjack + nosniff headers
- realpath() root containment + symlink exclusion to block traversal
- Server-side upload size + MIME(finfo) + extension validation
- Configurable IP allow/deny with CIDR, optional HTTPS enforcement
- Fixed 500ms login delay to slow brute-force guessing
Features (single PHP file, no CDN):
- New Bootstrap 5 responsive UI with light/dark theme toggle
- Upload (drag+drop), download-only links, delete, rename, copy/move, mkdir
- Folder ZIP download, in-browser text editor (<=2MiB)
- Multi-user, per-user read-only + per-user root directories
- All frontend assets vendored locally under assets/ (349K)
Docs: full config reference, password hash guide, Tor hidden-service guide.
|
2026-08-19 23:55:07 +08:00 |
|
Diego Bernal