hoelee/simple-file-manager
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

1 Release 1 Tag

RSS Feed
  • v2.0.0 e457e14b30
    Compare

    v2.0.0 — Hardened & Modernized Stable

    hoelee released this 2026-08-19 15:55:09 +00:00 | 0 commits to master since this release

    v2.0.0 — Hardened & Modernized single-file PHP file manager

    Complete rewrite of the frontend and a thorough security hardening pass, drawing on patterns from Tiny File Manager v2.6. Still one PHP file; frontend assets are downloaded locally (no CDN).

    Security hardening

    • bcrypt authentication via password_hash() / password_verify() — no default backdoor
    • Session CSRF token verified with hash_equals()
    • Secure session cookies: HttpOnly, SameSite=Strict, Secure over HTTPS
    • Nonce-based Content-Security-Policy plus frame/nosniff/referrer headers
    • Path traversal protection: realpath() containment + symlinks excluded
    • Upload validation: server-side size + MIME(finfo) + extension blocklist
    • IP allow/deny with CIDR, optional HTTPS enforcement, anti-brute-force delay

    Features

    • Bootstrap 5 responsive UI with light/dark theme toggle
    • Upload (drag & drop), download-only links, delete, rename, copy/move, mkdir
    • ZIP download for folders, in-browser text editor (<=2 MiB)
    • Multi-user: per-user password, read-only accounts, per-user root dirs
    • All frontend assets vendored locally under assets/ (~350 KB)

    Docs

    Full configuration reference, password-hash guide, and Tor hidden-service guide in README.md.

    Downloads