|
1 | 1 | <?php |
2 | 2 | /** |
3 | | - * Tiny File Manager Integration for EngineScript Admin |
4 | | - * Secure file management interface with restricted access |
5 | | - * |
6 | | - * @version 1.0.0 |
7 | | - * @security HIGH - File system access |
| 3 | + * Simple redirect to Tiny File Manager |
| 4 | + * Official TinyFileManager from GitHub repository |
8 | 5 | */ |
9 | 6 |
|
10 | | -// Security checks - prevent direct access |
11 | | -if (!isset($_SERVER['HTTP_HOST']) || !isset($_SERVER['REQUEST_URI'])) { |
12 | | - http_response_code(403); |
13 | | - die('Direct access forbidden'); |
14 | | -} |
15 | | - |
16 | | -// Basic authentication check (integrate with your auth system) |
17 | | -session_start(); |
18 | | -$client_ip = isset($_SERVER['REMOTE_ADDR']) ? $_SERVER['REMOTE_ADDR'] : 'unknown'; |
19 | | - |
20 | | -// Rate limiting for file operations |
21 | | -$rate_limit_key = 'fm_rate_' . hash('sha256', $client_ip); |
22 | | -if (!isset($_SESSION[$rate_limit_key])) { |
23 | | - $_SESSION[$rate_limit_key] = ['count' => 0, 'reset' => time() + 300]; // 5 minute window |
24 | | -} |
25 | | - |
26 | | -if (time() > $_SESSION[$rate_limit_key]['reset']) { |
27 | | - $_SESSION[$rate_limit_key] = ['count' => 0, 'reset' => time() + 300]; |
28 | | -} |
29 | | - |
30 | | -if ($_SESSION[$rate_limit_key]['count'] >= 50) { // 50 operations per 5 minutes |
31 | | - http_response_code(429); |
32 | | - die('Rate limit exceeded for file operations'); |
33 | | -} |
34 | | - |
35 | | -$_SESSION[$rate_limit_key]['count']++; |
36 | | - |
37 | | -// Load file manager configuration |
38 | | -$fm_config_file = '/etc/enginescript/filemanager.conf'; |
39 | | -$fm_config = []; |
40 | | - |
41 | | -if (file_exists($fm_config_file)) { |
42 | | - $config_content = file_get_contents($fm_config_file); |
43 | | - $config_lines = explode("\n", $config_content); |
44 | | - |
45 | | - foreach ($config_lines as $line) { |
46 | | - $line = trim($line); |
47 | | - if (empty($line) || strpos($line, '#') === 0) { |
48 | | - continue; // Skip empty lines and comments |
49 | | - } |
50 | | - |
51 | | - if (strpos($line, '=') !== false) { |
52 | | - list($key, $value) = explode('=', $line, 2); |
53 | | - $fm_config[trim($key)] = trim($value); |
54 | | - } |
55 | | - } |
56 | | -} |
57 | | - |
58 | | -// Set values from configuration file only - no defaults |
59 | | -$fm_username = isset($fm_config['fm_username']) && !empty($fm_config['fm_username']) ? $fm_config['fm_username'] : null; |
60 | | -$fm_password_hash = isset($fm_config['fm_password_hash']) && !empty($fm_config['fm_password_hash']) ? $fm_config['fm_password_hash'] : null; |
61 | | - |
62 | | -// Check if credentials are properly configured |
63 | | -if (empty($fm_username) || empty($fm_password_hash)) { |
64 | | - // Check if main credentials file exists and has been configured |
65 | | - if (file_exists('/home/EngineScript/enginescript-install-options.txt')) { |
66 | | - $credentials_content = file_get_contents('/home/EngineScript/enginescript-install-options.txt'); |
67 | | - |
68 | | - // Check if credentials are still PLACEHOLDER values |
69 | | - if (strpos($credentials_content, 'FILEMANAGER_USERNAME="PLACEHOLDER"') !== false || |
70 | | - strpos($credentials_content, 'FILEMANAGER_PASSWORD="PLACEHOLDER"') !== false) { |
71 | | - |
72 | | - die('File Manager credentials not configured. Please edit your credentials file with command: es.config'); |
73 | | - } else { |
74 | | - // Credentials configured but config file not updated |
75 | | - die('File Manager configuration needs to be updated. Please run: sudo /usr/local/bin/enginescript/scripts/functions/shared/update-config-files.sh'); |
76 | | - } |
77 | | - } else { |
78 | | - die('EngineScript credentials file not found. Please ensure EngineScript is properly installed.'); |
79 | | - } |
80 | | -} |
81 | | - |
82 | | -$fm_root_path = isset($fm_config['fm_root_path']) && !empty($fm_config['fm_root_path']) ? $fm_config['fm_root_path'] : '/var/www'; |
83 | | -$fm_max_upload = isset($fm_config['fm_max_upload_size']) && !empty($fm_config['fm_max_upload_size']) ? (int)$fm_config['fm_max_upload_size'] : 104857600; |
84 | | -$fm_readonly = isset($fm_config['fm_readonly']) && $fm_config['fm_readonly'] === 'true' ? true : false; |
85 | | - |
86 | | -// Additional security headers |
87 | | -header('X-Frame-Options: SAMEORIGIN'); |
88 | | -header('X-Content-Type-Options: nosniff'); |
89 | | -header('X-XSS-Protection: 1; mode=block'); |
90 | | -header('Referrer-Policy: strict-origin-when-cross-origin'); |
91 | | - |
92 | | -// Log file manager access |
93 | | -$log_entry = date('Y-m-d H:i:s') . " [FILE_MANAGER] Access from IP: " . $client_ip . "\n"; |
94 | | -error_log($log_entry, 3, '/var/log/enginescript-filemanager.log'); |
95 | | - |
96 | | -// Download and include Tiny File Manager |
97 | | -$tfm_file = __DIR__ . '/tinyfilemanager.php'; |
98 | | -$tfm_url = 'https://raw.githubusercontent.com/prasathmani/tinyfilemanager/master/tinyfilemanager.php'; |
99 | | - |
100 | | -// Download TFM if not exists or older than 30 days |
101 | | -if (!file_exists($tfm_file) || (time() - filemtime($tfm_file)) > (30 * 24 * 60 * 60)) { |
102 | | - $tfm_content = @file_get_contents($tfm_url); |
103 | | - if ($tfm_content !== false) { |
104 | | - file_put_contents($tfm_file, $tfm_content); |
105 | | - chmod($tfm_file, 0644); |
106 | | - } else { |
107 | | - die('Unable to download Tiny File Manager. Please check internet connection.'); |
108 | | - } |
109 | | -} |
110 | | - |
111 | | -// Modify TFM file to use our credentials |
112 | | -if (file_exists($tfm_file)) { |
113 | | - $tfm_content = file_get_contents($tfm_file); |
114 | | - |
115 | | - // Replace the hardcoded auth_users array with our credentials |
116 | | - $new_auth_array = '$auth_users = array(\'' . $fm_username . '\' => \'' . $fm_password_hash . '\');'; |
117 | | - |
118 | | - // Pattern to match the existing $auth_users array (handles multi-line arrays) |
119 | | - $pattern = '/\$auth_users\s*=\s*array\s*\([^;]*\);/s'; |
120 | | - |
121 | | - if (preg_match($pattern, $tfm_content)) { |
122 | | - $tfm_content = preg_replace($pattern, $new_auth_array, $tfm_content); |
123 | | - file_put_contents($tfm_file, $tfm_content); |
124 | | - } |
125 | | - |
126 | | - include $tfm_file; |
127 | | -} else { |
128 | | - die('Tiny File Manager not found. Please check installation.'); |
129 | | -} |
| 7 | +// Redirect to the official TinyFileManager installation |
| 8 | +header('Location: /enginescript/tinyfilemanager/'); |
| 9 | +exit; |
130 | 10 | ?> |
0 commit comments