| Name | Owner | Perms | Size | Modified | Actions | |
|---|---|---|---|---|---|---|
| .. (parent directory) | ||||||
| + | ${f.type === 'dir' + ? `📁 ${nameEsc}${f.link ? ' (symlink)' : ''}` + : `📄 ${nameEsc}${f.link ? ' (symlink)' : ''}`} | +${Nova.escHtml(f.owner)}:${Nova.escHtml(f.group)} | +${f.perms} |
+ ${f.size || '—'} | +${f.modified} | ++ ${f.type === 'file' ? `` : ''} + ${f.type === 'file' ? `↓` : ''} + ${f.type === 'file' && /\.(zip|tar|gz|tgz)$/i.test(f.name) ? `` : ''} + + + + + | +
| Empty directory | ||||||
File operations run as the web server's own OS user (www-data) — some root-owned system files may be visible here but not readable or writable.
`; +} + +window.fmNav = async (path) => { + _fmPath = path; + const wrap = document.getElementById('fm-table-wrap'); + const crumb = document.getElementById('fm-breadcrumb'); + if (!wrap) return; + wrap.innerHTML = 'Only succeeds if the web server's OS user has permission to change ownership to the target user/group.
`, + ` + `); +}; +window.fmSubmitChown = (path) => { + const owner = document.getElementById('fm-owner')?.value || ''; + const group = document.getElementById('fm-group')?.value || ''; + document.querySelector('.modal-overlay')?.remove(); + fmGuard(path, 'change ownership on', async (confirm_dangerous) => { + const res = await Nova.api('files', 'chown', { method: 'POST', body: { path, owner, group, confirm_dangerous } }); + if (res?.success) { Nova.toast('Ownership updated', 'success'); fmNav(_fmPath); } else Nova.toast(res?.message || 'chown failed', 'error'); + }); +}; +window.fmUpload = () => { + Nova.modal('Upload File', ``, + ` + `); +}; +window.fmSubmitUpload = () => { + const fileInput = document.getElementById('fm-upfile'); + if (!fileInput?.files[0]) return; + document.querySelector('.modal-overlay')?.remove(); + fmGuard(_fmPath, 'upload a file into', async (confirm_dangerous) => { + const fd = new FormData(); + fd.append('file', fileInput.files[0]); + fd.append('path', _fmPath); + fd.append('confirm_dangerous', confirm_dangerous ? '1' : ''); + const res = await fetch(`/api/files/upload?path=${encodeURIComponent(_fmPath)}`, { method: 'POST', credentials: 'include', body: fd }).then(r => r.json()); + if (res?.success) { Nova.toast('Uploaded', 'success'); fmNav(_fmPath); } else Nova.toast(res?.message || 'Upload failed', 'error'); + }); +}; +window.fmExtract = (path) => { + Nova.confirm(`Extract this archive into the current directory?`, () => { + fmGuard(_fmPath, 'extract an archive into', async (confirm_dangerous) => { + const res = await Nova.api('files', 'extract', { method: 'POST', body: { path, dest: _fmPath, confirm_dangerous } }); + if (res?.success) { Nova.toast('Extracted', 'success'); fmNav(_fmPath); } else Nova.toast(res?.message, 'error'); + }); + }); +}; +window.fmCompressSelected = () => { + const sel = Array.from(document.querySelectorAll('.fm-sel:checked')).map(c => c.value); + if (!sel.length) { Nova.toast('Select at least one file or folder first', 'error'); return; } + window._fmCompressPaths = sel; + Nova.modal('Compress Selected', ` +${sel.length} item(s) selected
`, + ` + `); +}; +window.fmSubmitCompress = () => { + const paths = window._fmCompressPaths || []; + const name = document.getElementById('fm-arcname')?.value || 'archive.zip'; + const dest = (_fmPath === '/' ? '' : _fmPath) + '/' + name; + document.querySelector('.modal-overlay')?.remove(); + fmGuard(dest, 'create an archive in', async (confirm_dangerous) => { + const res = await Nova.api('files', 'compress', { method: 'POST', body: { paths, dest, confirm_dangerous } }); + if (res?.success) { Nova.toast('Archive created', 'success'); fmNav(_fmPath); } else Nova.toast(res?.message, 'error'); + }); +}; + +/* ── File Manager: system/security-critical path guard ───────────────────── + * Mirrors the server-side zone list in files.php's is_dangerous_path(). This + * client-side copy is only for showing the warning early — the server enforces + * it regardless (rejects with dangerous_path:true unless confirm_dangerous is set), + * so this can't be bypassed by skipping the modal. + */ +const FM_DANGEROUS_ZONES = ['/etc','/boot','/root','/sys','/proc','/dev','/run', + '/lib','/lib64','/usr/lib','/usr/lib64','/bin','/sbin','/usr/bin','/usr/sbin','/var/lib','/snap']; + +function fmIsDangerous(path) { + return FM_DANGEROUS_ZONES.some(z => path === z || path.startsWith(z + '/')); +} + +// Wraps an action: if any of the given paths fall in a dangerous zone, shows a warning +// modal requiring a checkbox + typed "CONFIRM" before calling doIt(true). Otherwise +// calls doIt(false) immediately. doIt receives the confirm_dangerous flag to include in the API body. +function fmGuard(paths, actionLabel, doIt) { + const list = (Array.isArray(paths) ? paths : [paths]).filter(Boolean); + const hit = list.find(fmIsDangerous); + if (!hit) { doIt(false); return; } + window._fmGuardCallback = () => doIt(true); + Nova.modal('⚠️ System File Warning', ` +You are about to ${Nova.escHtml(actionLabel)} a path in a system/security-critical location:
+${Nova.escHtml(hit)}
+Editing, deleting, or changing permissions/ownership outside the web server's own files (www-data) can break running services, lock out access to this server, or open a security hole. This is not easily undone.
+