From d6321c32686de130360936b7d8d897517f49bf6e Mon Sep 17 00:00:00 2001 From: NovaCPX Admin Date: Wed, 15 Jul 2026 14:19:44 -0500 Subject: [PATCH] fix: File Manager upload never read target path from multipart POST/query string upload only checked [path], which is parsed from JSON php://input and is always empty for multipart/form-data uploads. It silently fell back to a hardcoded /public_html, which does not exist at filesystem root - breaking uploads for the admin File Manager (baseDir=/) entirely, though it went unnoticed for regular hosting accounts since /public_html happens to be their real default. Now falls back through and as well. --- panel/api/endpoints/files.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/panel/api/endpoints/files.php b/panel/api/endpoints/files.php index 75851d1..ad0e75d 100644 --- a/panel/api/endpoints/files.php +++ b/panel/api/endpoints/files.php @@ -220,7 +220,7 @@ match ($action) { })(), 'upload' => (function() use ($baseDir, $body) { - $dir = safe_path($baseDir, $body['path'] ?? '/public_html'); + $dir = safe_path($baseDir, $body['path'] ?? $_POST['path'] ?? $_GET['path'] ?? '/public_html'); require_dangerous_confirm($baseDir, $dir, $body); if (!is_dir($dir)) Response::error("Target directory not found"); if (!is_writable($dir)) Response::error("Permission denied writing to this directory");