Secure PHP File Manager

A secure, single-file PHP web application that provides a comprehensive file management interface with authentication, allowing users to list, upload, download, create, rename, and delete files and directories.

Overview

This PHP file manager is designed as a secure alternative to basic directory listings, featuring session-based authentication, CSRF protection, and comprehensive security measures. It's contained in a single PHP file for easy deployment and includes mobile-responsive design for modern usage.

Features

Core Functionality

• Session-Based Authentication: Secure login/logout with configurable credentials
• File & Directory Listing: Paginated display with sorting and navigation
• File Upload: Support for multiple file uploads with size limits and type validation
• Directory Management: Create, rename, and delete directories with confirmation prompts
• File Operations: Download, rename, and delete files securely
• Breadcrumb Navigation: Easy navigation through directory structure
• Pagination: Efficient handling of large directory contents

Security Features

• CSRF Protection: Token-based protection against cross-site request forgery
• Input Sanitization: Prevention of directory traversal and injection attacks
• Path Validation: Strict validation of file paths within base directory
• Secure File Handling: Safe upload and download operations
• Session Management: Proper session handling with logout functionality
• Audit Logging: Comprehensive logging of all user actions

User Interface

• Mobile Responsive: Optimized for mobile devices with touch-friendly controls
• Clean Design: Simple HTML/CSS interface with user-friendly messages
• Error Handling: Comprehensive error messages and validation feedback
• Modal Dialogs: Confirmation prompts for destructive actions

Installation

1. Prerequisites:

   • PHP 7.1 or higher (tested up to 8.2)
   • Web server (Apache, Nginx, or built-in PHP server)
   • Write permissions for the base directory

2. Deployment:

   # Copy filemanager.php to your web directory
   cp filemanager.php /var/www/html/
   
   # Ensure proper permissions
   chmod 644 filemanager.php

3. Start the Server (for development):

   php -S localhost:8080 filemanager.php

Configuration

Edit the constants at the top of filemanager.php:

define('BASE_DIR', './files');           // Base directory for file management
define('MAX_FILE_SIZE', 30 * 1024 * 1024); // 30MB max file size
define('USERNAME', 'admin');            // Login username
define('PASSWORD', 'admin123');         // Login password
define('LOG_FILE', 'filemanager.log');  // Audit log file

Directory Setup

The script automatically creates the base directory if it doesn't exist. Ensure your web server has write permissions:

mkdir files
chmod 755 files

Usage

Accessing the File Manager

1. Navigate to filemanager.php in your web browser
2. Login with configured credentials (default: admin/admin123)
3. Use the interface to manage files and directories

File Operations

• Upload: Use the file input to select and upload files
• Download: Click the "Download" link next to files
• Rename: Click "Rename" and enter new name in the modal
• Delete: Click "Delete" and confirm in the modal
• Create Directory: Enter directory name and click "Create Directory"

Navigation

• Use breadcrumbs to navigate up the directory tree
• Click on directory names to enter them
• Pagination links appear for directories with many items

Security Notes

Implemented Protections

• CSRF Tokens: All forms include unique tokens validated server-side
• Path Sanitization: Input paths are cleaned to prevent traversal attacks
• Directory Containment: All operations are restricted to the base directory
• Session Security: Proper session management with regeneration
• Input Validation: All user inputs are validated and sanitized

Best Practices

• Change default credentials before deployment
• Use HTTPS in production
• Regularly review audit logs
• Keep PHP and server software updated
• Restrict file permissions appropriately

Audit Logging

All actions are logged to filemanager.log with format:

YYYY-MM-DD HH:MM:SS - ACTION - DETAILS - IP: xxx.xxx.xxx.xxx

Dependencies

• PHP Core: File system functions, sessions, hashing
• Optional: ZipArchive extension (not used in current version)
• Web Server: Any server supporting PHP

Changelog

Version 1.0 (Current)

• Initial release with full file management capabilities
• Session-based authentication with CSRF protection
• Mobile-responsive design with touch-friendly interface
• Comprehensive security measures and audit logging
• Single-file deployment for simplicity

Development Context

• Built as a secure replacement for basic directory scripts
• Incorporates mobile optimization and modern security practices
• Designed for easy deployment and configuration
• Tested with PHP 7.1+ and various mobile devices

Troubleshooting

Common Issues

Login not working:

• Verify username/password constants
• Check PHP session configuration
• Ensure cookies are enabled

Upload failures:

• Check file size against MAX_FILE_SIZE
• Verify web server upload limits (php.ini)
• Ensure write permissions on base directory

Permission errors:

# Set proper permissions
chmod 755 files/
chmod 644 filemanager.php

Mobile display issues:

• Ensure viewport meta tag is present
• Check for conflicting CSS
• Test on actual mobile devices

Debug Mode

Add temporary logging for debugging:

error_reporting(E_ALL);
ini_set('display_errors', 1);

Server Configuration

For production deployment, ensure:

• upload_max_filesize and post_max_size in php.ini are sufficient
• session.save_path is writable
• Appropriate file permissions

License

This script is provided as-is for educational and personal use. Please review and comply with your local laws and regulations regarding file management and security.

Support

For issues or questions:

1. Check the troubleshooting section
2. Review server logs
3. Verify configuration settings
4. Test with minimal setup

---

Security Notice: This script implements multiple security measures, but no system is completely secure. Use appropriate security practices and keep software updated.