admin/Studio-42-elFinder
1
0
Fork 0
mirror of https://github.com/Studio-42/elFinder synced 2026-06-08 12:37:09 +00:00
Code Issues Packages Projects Releases Wiki Activity
6,951 Commits 9 Branches 143 Tags
master
Commit Graph

510 Commits

Author SHA1 Message Date
nao-pon e311a7db22 elFinder version 2.1.69 2026-05-07 21:52:56 +09:00
nao-pon 0fadad49b4 elFinder version 2.1.68 2026-05-07 17:19:02 +09:00
nao-pon ea1a352fb9 fix(connector): normalize PHP error handling and mount failures 2026-05-07 10:37:04 +09:00
nao-pon 11b5e6b82d fix(connector): refine CSRF token refresh timing and protected commands 
- refresh CSRF TTL after successful open/info/protected commands
- extend token lifetime on open requests during normal navigation
- limit CSRF protection to stable write commands
- fix callback script syntax in OAuth popup handling
 2026-04-21 18:11:59 +09:00
Naoki Sawada 2a860167b8 fix: improve PHP 8 compatibility in session, cURL, and callback handling (#3780) 
- replace curl_close() handling for PHP 8 CurlHandle compatibility
- refine session cookie params and read-only session behavior
- change session get() default fallback from '' to null
- improve OAuth callback window close/message fallback
- add type-safe adjustments in watermark processing
 2026-04-20 10:28:31 +09:00
ctrlaltca 33201ec1d2 Correctly urlencode path in setcookie(); fix Studio-42#3538 (#3754) 
Some characters are valid in URLs but not in cookies, eg. comma or semicolon.
They needs to be encoded properly.
 2026-04-18 10:00:02 +09:00
colemanw 44aa9331ce Update deprecated php type casts (#3739) 
In PHP 8.5, non-canonical scalar type casts (boolean|double|integer|binary) deprecated.

See https://php.watch/versions/8.5/boolean-double-integer-binary-casts-deprecated.
 2026-04-17 21:37:45 +09:00
Andres Rosado ecdc053963 Fixing bug where uploading large files sometimes fails (#3761) 
Sometimes uploading large files fails with the following error: Unsupported operand types: string + int {"userId":2,"exception":"[object] (TypeError(code: 0): Unsupported operand types: string + int at <path>/vendor/studio-42/elfinder/php/elFinder.php:4476). 

The function file_get_contents returns a string, and PHP 8 doesn't do implicit conversion. It requires the conversion to be explicit to not give problems.
 2026-04-17 19:57:09 +09:00
nao-pon 162bff682d elFinder version 2.1.67 2026-04-17 11:44:14 +09:00
Naoki Sawada bf02465a19 Merge commit from fork 2026-04-17 11:33:38 +09:00
nao-pon 3d4e9883dc elFinder version 2.1.66 2025-08-28 20:50:27 +09:00
Jesper Noordsij 2d718b5d0f Replace usage of deprecated E_STRICT constant (#3705) 
* Replace usage of deprecated E_STRICT constant

* Remove trailing whitespace
 2025-08-28 20:11:33 +09:00
Andre Wachsmuth 9022cc8143 Ignore posted message that are not intended for ElFinder (#3692) 
https://github.com/Studio-42/elFinder/issues/3432

Co-authored-by: Andre Wachsmuth <awa@xima.de>
 2025-08-28 20:02:59 +09:00
Kevin Wydler a560291043 Fix CVE-2025-0818 (#3723) 
* CVE-2025-0818 (Part 1)
- Fixed arbitrary file delete by prepending the tempath to the global temp file array paths before deleting them

- This also required a new global array (elFinderAbortFiles) because the temp path could be different depeing on the configuration of elFInder.

- Removed the ability of getTempPath() to return the writableTmb path because this would unnecessarly complicate things when checking the path before deletion

* CVE-2025-0818 (Part II)
- Prevented arbitrary file read by prepending the common temp directory to the extracted onetime file path of the 'file' commands 'ontime' function.

- Prevented directory traversal and the general use of paths by using basename() for the appended file name.

- This patch currently prevents arbitrary file reads and deletes. However, it still allows this for files in the .tmp directory. This should also at least be mitigated.
 2025-08-28 19:53:03 +09:00
Ayesh Karunaratne 3df8f949d7 [PHP 8.4] Fix: Curl CURLOPT_BINARYTRANSFER deprecated 
The `CURLOPT_BINARYTRANSFER` PHP constant from the Curl extension was no-op since
PHP 5.1, and is deprecated in PHP 8.4. This removes the constant usage to avoid
the deprecation notice in PHP 8.4 and later.

Because this constant was no-op since PHP 5.1 (circa 2005), this change has no
impact.

See:

 - [PHP.Watch - PHP 8.4 - Curl: CURLOPT_BINARYTRANSFER deprecated](https://php.watch/versions/8.4/CURLOPT_BINARYTRANSFER-deprecated)
 - [commit](https://github.com/php/php-src/commit/fc16285538e96ecb35d017231051f83dcbd8b55b)
 2024-01-16 22:44:54 +07:00
nao-pon 1ad203a186 elFinder version 2.1.65 2024-01-05 14:00:53 +09:00
nao-pon c615f814fc elFinder version 2.1.64 2023-12-20 16:42:23 +09:00
nao-pon a54337c675 elFinder version 2.1.63 2023-12-20 11:33:38 +09:00
Nounours13 443f7e414e Update elFinder.class.php (#3619) 
When you download a file via context menu the windows download popup don't close
 2023-12-20 10:51:33 +09:00
nao-pon ba48342df1 elFinder version 2.1.62 2023-06-14 01:38:19 +09:00
nao-pon 099803dabf [php:core] fix #3546 Use elFinder::getCmdOfBind instead of self::getCmdOfBind which is deprecated in PHP v8.2 2023-06-03 21:22:48 +09:00
ctrlaltca 34dcd44121 Correctly urlencode path in setcookie(); fix #3538 (#3561) 
Some characters are valid in URLs but not in cookies, eg. comma or semicolon.
They needs to be encoded properly.
 2023-06-02 09:21:06 +09:00
nao-pon def49cffb9 [php:core] prevent garbled file name when URL upload 2022-04-27 21:00:59 +09:00
nao-pon e61f59290a elFinder version 2.1.61 2022-03-14 21:26:24 +09:00
Naoki Sawada 69be51eea5 [security] fix #3458 filename bypass leading to RCE on Windows server (#3470) 
Windows servers do not allow "." (Dots) at the end of a file name.
 2022-03-10 00:05:21 +09:00
nao-pon 4b0cd0e2a9 elFinder version 2.1.60 2021-11-12 14:59:36 +09:00
nao-pon 8e2fa59c45 [php:core,VD:abstract] fix #3370 broken PHP 5.3 compat 2021-07-07 23:57:12 +09:00
nao-pon 803d9f391e [php:core] Don't make sure to report the real path in debug messages 2021-06-14 21:14:04 +09:00
nao-pon 1b552e3673 elFinder version 2.1.59 2021-06-13 23:46:40 +09:00
Naoki Sawada a106c350b7 Merge pull request from GHSA-wph3-44rj-92pr 
* [php] fix multiple vulnerabilities

* fix archiver args

* fix remote Code Execution of zip command

* re-fix remote Code Execution of zip command

* re-fix Improper hostname validation in upload and put

* re-fix Directory traversal in the actions mkfile and mkdir

* Add check targets in archive()
 2021-06-13 23:38:02 +09:00
nao-pon 5c2f999cb9 elFinder version 2.1.58 2021-06-09 17:24:30 +09:00
Stanimir Stoyanov f6db283def [php:core] Add cwd param to proc_open (#3281) 2021-06-08 17:52:03 +09:00
nao-pon b13f09b1bd [VD:abstract] fix #3181 add an option uploadMaxMkdirs 
that Maximum number of folders that can be created at one time. (0:
unlimited)
 2021-06-02 23:34:02 +09:00
nao-pon 6a97635e59 [php:core fix #3250 error only variables can be passed by reference 2021-03-10 23:50:45 +09:00
f2h2h1 451697c9e8 [VD:abstract,php] make the thumbnail support webp (#3265) 
* make the thumbnail support webp

* Fix syntax errors

* check 'imagecreatefromwebp' by function_exists

Co-authored-by: lqt <805799838@qq.com>
Co-authored-by: Naoki Sawada <hypweb+github@gmail.com>
 2021-03-10 21:05:53 +09:00
nao-pon c4ab070ca8 [VD:abstract] fix #3151 support RAR5 lib 2020-07-21 21:58:06 +09:00
nao-pon b83ec8f71d elFinder version 2.1.57 2020-06-05 17:05:44 +09:00
nao-pon 662c7dbd78 [php:core] fix #3154 volume that require online access cannot be specified as default 2020-05-06 17:17:51 +09:00
nao-pon bd16f9913b elFinder version 2.1.56 2020-04-09 11:32:14 +09:00
nao-pon 2332f257ca [cmd:netmount] fix #3138 OAuth not possible with CORS due to new ITP 2020-03-30 15:44:47 +09:00
nao-pon 6dc9fbbf64 [php:core] fix #3136 zipdl fails on Chrome on iOS / iPadOS 2020-03-29 13:37:52 +09:00
nao-pon a9d9bc81e1 [php:core] fix #3134 close file pointer before deleting temporary file on shutdown 2020-03-28 17:33:27 +09:00
nao-pon 399f64a8f1 elFinder version 2.1.55 2020-03-18 20:36:47 +09:00
nao-pon ebed6322fa elFinder version 2.1.54 2020-03-14 22:35:48 +09:00
nao-pon 08300ac5f1 [php:core] fix #3120 allow plugins (Sanitizer etc) to be applied when pasting from another volume 2020-03-03 15:38:01 +09:00
nao-pon 55a967b94a [php:core,VD] fix #3119 disallow extract of uncompressed size larger than option "maxArcFilesSize" 2020-02-28 00:15:46 +09:00
nao-pon 79a838be29 [php] fix #3114 stream proxy function using the file cmd corresponds to range request 2020-02-23 18:26:37 +09:00
nao-pon 9b1a77b90c [php:core] support POST method redirect in getStreamByUrl() 2020-02-17 23:04:37 +09:00
nao-pon a926323d9f [php:core] add a public method utf8Encode() and make new main option utf8Encoder @callable 2020-02-06 23:00:30 +09:00
nao-pon 282ab23f44 [php:core] add toastErrorHandler for send toast message to client side 2020-01-28 17:24:42 +09:00