Advanced Search not working for read-only users #1325

Co-authored-by: Milan Mitrovic <milan.mitrovic@abstract.rs>

tinyfilemanager.php

@@ -3,7 +3,7 @@
 $CONFIG = '{"lang":"en","error_reporting":false,"show_hidden":false,"hide_Cols":false,"theme":"light"}';
 
 /**
- * H3K - Tiny File Manager V2.6
+ * H3K ~ Tiny File Manager V2.6
  * @author CCP Programmers
  * @github https://github.com/prasathmani/tinyfilemanager
  * @link https://tinyfilemanager.github.io
@@ -97,7 +97,7 @@ $allowed_upload_extensions = '';
 $favicon_path = '';
 
 // Files and folders to excluded from listing
-// e.g. array('myfile.html', 'personal-folder', '*.php', ...)
+// e.g. array('myfile.html', 'personal-folder', '*.php', '/path/to/folder', ...)
 $exclude_items = array();
 
 // Online office Docs Viewer
@@ -257,7 +257,7 @@ if (empty($auth_users)) {
     $use_auth = false;
 }
 
-$is_https = isset($_SERVER['HTTPS']) && ($_SERVER['HTTPS'] == 'on' || $_SERVER['HTTPS'] == 1)
+$is_https = isset($_SERVER['HTTPS']) && (strtolower($_SERVER['HTTPS']) == 'on' || $_SERVER['HTTPS'] == 1)
     || isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https';
 
 // update $root_url based on user specific directories
@@ -459,7 +459,7 @@ unset($p, $use_auth, $iconv_input_encoding, $use_highlightjs, $highlightjs_style
 /*************************** ACTIONS ***************************/
 
 // Handle all AJAX Request
-if ((isset($_SESSION[FM_SESSION_ID]['logged'], $auth_users[$_SESSION[FM_SESSION_ID]['logged']]) || !FM_USE_AUTH) && isset($_POST['ajax'], $_POST['token']) && !FM_READONLY) {
+if ((isset($_SESSION[FM_SESSION_ID]['logged'], $auth_users[$_SESSION[FM_SESSION_ID]['logged']]) || !FM_USE_AUTH) && isset($_POST['ajax'], $_POST['token'])) {
     if (!verifyToken($_POST['token'])) {
         header('HTTP/1.0 401 Unauthorized');
         die("Invalid Token.");
@@ -473,6 +473,10 @@ if ((isset($_SESSION[FM_SESSION_ID]['logged'], $auth_users[$_SESSION[FM_SESSION_
         exit();
     }
 
+    if(FM_READONLY){
+        exit();
+    }
+
     // save editor file
     if (isset($_POST['type']) && $_POST['type'] == "save") {
         // get current path
@@ -806,6 +810,7 @@ if (isset($_POST['file'], $_POST['copy_to'], $_POST['finish'], $_POST['token'])
 
     if (!verifyToken($_POST['token'])) {
         fm_set_msg(lng('Invalid Token.'), 'error');
+        die("Invalid Token.");
     }
 
     // from
@@ -875,6 +880,7 @@ if (isset($_POST['file'], $_POST['copy_to'], $_POST['finish'], $_POST['token'])
 if (isset($_POST['rename_from'], $_POST['rename_to'], $_POST['token']) && !FM_READONLY) {
     if (!verifyToken($_POST['token'])) {
         fm_set_msg("Invalid Token.", 'error');
+        die("Invalid Token.");
     }
     // old name
     $old = urldecode($_POST['rename_from']);
@@ -1089,6 +1095,7 @@ if (isset($_POST['group'], $_POST['delete'], $_POST['token']) && !FM_READONLY) {
 
     if (!verifyToken($_POST['token'])) {
         fm_set_msg(lng("Invalid Token."), 'error');
+        die("Invalid Token.");
     }
 
     $path = FM_ROOT_PATH;
@@ -1125,6 +1132,7 @@ if (isset($_POST['group'], $_POST['token']) && (isset($_POST['zip']) || isset($_
 
     if (!verifyToken($_POST['token'])) {
         fm_set_msg(lng("Invalid Token."), 'error');
+        die("Invalid Token.");
     }
 
     $path = FM_ROOT_PATH;
@@ -1189,6 +1197,7 @@ if (isset($_POST['unzip'], $_POST['token']) && !FM_READONLY) {
 
     if (!verifyToken($_POST['token'])) {
         fm_set_msg(lng("Invalid Token."), 'error');
+        die("Invalid Token.");
     }
 
     $unzip = urldecode($_POST['unzip']);
@@ -1259,6 +1268,7 @@ if (isset($_POST['chmod'], $_POST['token']) && !FM_READONLY && !FM_IS_WIN) {
 
     if (!verifyToken($_POST['token'])) {
         fm_set_msg(lng("Invalid Token."), 'error');
+        die("Invalid Token.");
     }
 
     $path = FM_ROOT_PATH;
@@ -1334,7 +1344,7 @@ $objects = is_readable($path) ? scandir($path) : array();
 $folders = array();
 $files = array();
 $current_path = array_slice(explode("/", $path), -1)[0];
-if (is_array($objects) && fm_is_exclude_items($current_path)) {
+if (is_array($objects) && fm_is_exclude_items($current_path, $path)) {
     foreach ($objects as $file) {
         if ($file == '.' || $file == '..') {
             continue;
@@ -1343,9 +1353,9 @@ if (is_array($objects) && fm_is_exclude_items($current_path)) {
             continue;
         }
         $new_path = $path . '/' . $file;
-        if (@is_file($new_path) && fm_is_exclude_items($file)) {
+        if (@is_file($new_path) && fm_is_exclude_items($file, $new_path)) {
             $files[] = $file;
-        } elseif (@is_dir($new_path) && $file != '.' && $file != '..' && fm_is_exclude_items($file)) {
+        } elseif (@is_dir($new_path) && $file != '.' && $file != '..' && fm_is_exclude_items($file, $new_path)) {
             $folders[] = $file;
         }
     }
@@ -1640,7 +1650,7 @@ if (isset($_GET['settings']) && !FM_READONLY) {
                         </div>
                     </div>
 
-                    <small class="text-body-secondary">* <?php echo lng('Sometimes the save action may not work on the first try, so please attempt it again') ?>.</span>
+                    <small class="text-body-secondary">* <?php echo lng('Sometimes the save action may not work on the first try, so please attempt it again') ?>.</small>
                 </form>
             </div>
         </div>
@@ -1712,7 +1722,7 @@ if (isset($_GET['view'])) {
     $file = $_GET['view'];
     $file = fm_clean_path($file, false);
     $file = str_replace('/', '', $file);
-    if ($file == '' || !is_file($path . '/' . $file) || !fm_is_exclude_items($file)) {
+    if ($file == '' || !is_file($path . '/' . $file) || !fm_is_exclude_items($file, $path . '/' . $file)) {
         fm_set_msg(lng('File not found'), 'error');
         $FM_PATH = FM_PATH;
         fm_redirect(FM_SELF_URL . '?p=' . urlencode($FM_PATH));
@@ -1769,8 +1779,9 @@ if (isset($_GET['view'])) {
                 <li class="list-group-item active" aria-current="true"><strong><?php echo lng($view_title) ?>:</strong> <?php echo fm_enc(fm_convert_win($file)) ?></li>
                 <?php $display_path = fm_get_display_path($file_path); ?>
                 <li class="list-group-item"><strong><?php echo $display_path['label']; ?>:</strong> <?php echo $display_path['path']; ?></li>
-                <li class="list-group-item"><strong>File size:</strong> <?php echo ($filesize_raw <= 1000) ? "$filesize_raw bytes" : $filesize; ?></li>
-                <li class="list-group-item"><strong>MIME-type:</strong> <?php echo $mime_type ?></li>
+                <li class="list-group-item"><strong><?php echo lng('Date Modified') ?>:</strong> <?php echo date(FM_DATETIME_FORMAT, filemtime($file_path)); ?></li>
+                <li class="list-group-item"><strong><?php echo lng('File size') ?>:</strong> <?php echo ($filesize_raw <= 1000) ? "$filesize_raw bytes" : $filesize; ?></li>
+                <li class="list-group-item"><strong><?php echo lng('MIME-type') ?>:</strong> <?php echo $mime_type ?></li>
                 <?php
                 // ZIP info
                 if (($is_zip || $is_gzip) && $filenames !== false) {
@@ -1917,7 +1928,7 @@ if (isset($_GET['edit']) && !FM_READONLY) {
     $file = $_GET['edit'];
     $file = fm_clean_path($file, false);
     $file = str_replace('/', '', $file);
-    if ($file == '' || !is_file($path . '/' . $file) || !fm_is_exclude_items($file)) {
+    if ($file == '' || !is_file($path . '/' . $file) || !fm_is_exclude_items($file, $path . '/' . $file)) {
         fm_set_msg(lng('File not found'), 'error');
         $FM_PATH = FM_PATH;
         fm_redirect(FM_SELF_URL . '?p=' . urlencode($FM_PATH));
@@ -2153,18 +2164,25 @@ $all_files_size = 0;
                 $filesize_raw = "";
                 $filesize = lng('Folder');
                 $perms = substr(decoct(fileperms($path . '/' . $f)), -4);
+                $owner = array('name' => '?'); 
+                $group = array('name' => '?');
                 if (function_exists('posix_getpwuid') && function_exists('posix_getgrgid')) {
-                    $owner = posix_getpwuid(fileowner($path . '/' . $f));
-                    $group = posix_getgrgid(filegroup($path . '/' . $f));
-                    if ($owner === false) {
-                        $owner = array('name' => '?');
+                    try {
+                        $owner_id = fileowner($path . '/' . $f);
+                        if ($owner_id != 0) {
+                            $owner_info = posix_getpwuid($owner_id);
+                            if ($owner_info) {
+                                $owner =  $owner_info;
+                            }
+                        }
+                        $group_id = filegroup($path . '/' . $f);
+                        $group_info = posix_getgrgid($group_id);
+                        if ($group_info) {
+                            $group =  $group_info;
+                        }
+                    } catch (Exception $e) {
+                        error_log("exception:" . $e->getMessage());
                     }
-                    if ($group === false) {
-                        $group = array('name' => '?');
-                    }
-                } else {
-                    $owner = array('name' => '?');
-                    $group = array('name' => '?');
                 }
             ?>
                 <tr>
@@ -2218,18 +2236,25 @@ $all_files_size = 0;
                 $filelink = '?p=' . urlencode(FM_PATH) . '&amp;view=' . urlencode($f);
                 $all_files_size += $filesize_raw;
                 $perms = substr(decoct(fileperms($path . '/' . $f)), -4);
+                $owner = array('name' => '?'); 
+                $group = array('name' => '?');
                 if (function_exists('posix_getpwuid') && function_exists('posix_getgrgid')) {
-                    $owner = posix_getpwuid(fileowner($path . '/' . $f));
-                    $group = posix_getgrgid(filegroup($path . '/' . $f));
-                    if ($owner === false) {
-                        $owner = array('name' => '?');
+                    try {
+                        $owner_id = fileowner($path . '/' . $f);
+                        if ($owner_id != 0) {
+                            $owner_info = posix_getpwuid($owner_id);
+                            if ($owner_info) {
+                                $owner =  $owner_info;
+                            }
+                        }
+                        $group_id = filegroup($path . '/' . $f);
+                        $group_info = posix_getgrgid($group_id);
+                        if ($group_info) {
+                            $group =  $group_info;
+                        }
+                    } catch (Exception $e) {
+                        error_log("exception:" . $e->getMessage());
                     }
-                    if ($group === false) {
-                        $group = array('name' => '?');
-                    }
-                } else {
-                    $owner = array('name' => '?');
-                    $group = array('name' => '?');
                 }
             ?>
                 <tr>
@@ -2650,12 +2675,13 @@ function fm_get_display_path($file_path)
 
 /**
  * Check file is in exclude list
- * @param string $file
+ * @param string $name The name of the file/folder
+ * @param string $path The full path of the file/folder
  * @return bool
  */
-function fm_is_exclude_items($file)
+function fm_is_exclude_items($name, $path)
 {
-    $ext = strtolower(pathinfo($file, PATHINFO_EXTENSION));
+    $ext = strtolower(pathinfo($name, PATHINFO_EXTENSION));
     if (isset($exclude_items) and sizeof($exclude_items)) {
         unset($exclude_items);
     }
@@ -2664,7 +2690,7 @@ function fm_is_exclude_items($file)
     if (version_compare(PHP_VERSION, '7.0.0', '<')) {
         $exclude_items = unserialize($exclude_items);
     }
-    if (!in_array($file, $exclude_items) && !in_array("*.$ext", $exclude_items)) {
+    if (!in_array($name, $exclude_items) && !in_array("*.$ext", $exclude_items) && !in_array($path, $exclude_items)) {
         return true;
     }
     return false;
@@ -3284,7 +3310,7 @@ function fm_get_file_mimes($extension)
     $fileTypes['divx'] = 'video/x-msvideo';
 
     $fileTypes['mp3'] = 'audio/mpeg';
-    $fileTypes['mp4'] = 'audio/mpeg';
+    $fileTypes['mp4'] = 'video/mp4';
     $fileTypes['mpeg'] = 'video/mpeg';
     $fileTypes['mpg'] = 'video/mpeg';
     $fileTypes['mpe'] = 'video/mpeg';
@@ -3747,7 +3773,8 @@ function fm_show_nav_path($path)
                             <a class="nav-link dropdown-toggle" id="navbarDropdownMenuLink-5" data-bs-toggle="dropdown" aria-expanded="false">
                                 <i class="fa fa-user-circle"></i>
                             </a>
-                            <div class="dropdown-menu text-small shadow" aria-labelledby="navbarDropdownMenuLink-5" data-bs-theme="<?php echo FM_THEME; ?>">
+
+                            <div class="dropdown-menu dropdown-menu-end text-small shadow" aria-labelledby="navbarDropdownMenuLink-5" data-bs-theme="<?php echo FM_THEME; ?>">
                                 <?php if (!FM_READONLY): ?>
                                     <a title="<?php echo lng('Settings') ?>" class="dropdown-item nav-link" href="?p=<?php echo urlencode(FM_PATH) ?>&amp;settings=1"><i class="fa fa-cog" aria-hidden="true"></i> <?php echo lng('Settings') ?></a>
                                 <?php endif ?>
@@ -5570,6 +5597,9 @@ function fm_show_header_login()
         $tr['en']['File or folder with this path already exists']   = 'File or folder with this path already exists';
         $tr['en']['Are you sure want to rename?']                   = 'Are you sure want to rename?';
         $tr['en']['Are you sure want to']                           = 'Are you sure want to';
+        $tr['en']['Date Modified']                                  = 'Date Modified';
+        $tr['en']['File size']                                      = 'File size';
+        $tr['en']['MIME-type']                                      = 'MIME-type';
 
         $i18n = fm_get_translations($tr);
         $tr = $i18n ? $i18n : $tr;
@@ -5580,4 +5610,4 @@ function fm_show_header_login()
         else return "$txt";
     }
 
-?>
+?>

translation.json

@@ -863,10 +863,10 @@
         "Rename": "Umbenennen",
         "CopyTo": "Kopieren nach",
         "DirectLink": "Direktlink",
-        "UploadingFiles": "Datei hochladen",
+        "UploadingFiles": "Dateien hochladen",
         "ChangePermissions": "Berechtigungen ändern",
         "Copying": "Kopieren",
-        "CreateNewItem": "Neue Datei erstellen",
+        "CreateNewItem": "Neues Element erstellen",
         "Name": "Name",
         "AdvancedEditor": "Erweiterter Editor",
         "RememberMe": "Eingeloggt bleiben",
@@ -933,7 +933,7 @@
         "already exists": "existiert bereits",
         "Error while moving from": "Fehler beim Verschieben aus",
         "Create archive?": "Archiv erstellen?",
-        "Invalid file or folder name": "Ungältiger Datei- oder Ordnername",
+        "Invalid file or folder name": "Ungültiger Datei- oder Ordnername",
         "Archive unpacked": "Archive entpackt",
         "File extension is not allowed": "Dateityp nicht erlaubt",
         "Root path": "Quellverzeichnis",
@@ -948,7 +948,7 @@
         "Search file in folder and subfolders...": "Suchen in Ordnern und Unterordnern...",
         "Access denied. IP restriction applicable": "Zugriff verweigert - IP-Beschränkung.",
         "Invalid characters in file or folder name": "Unzulässige Zeichen im Datei- oder Ordnernamen",
-        "Operations with archives are not available": "Archiv-Funktionen nicht verfägbar",
+        "Operations with archives are not available": "Archiv-Funktionen nicht verfügbar",
         "File or folder with this path already exists": "Datei oder Ordner mit diesem Pfad existiert bereits",
         "Moved from": "Verschoben aus"
       }
@@ -1393,8 +1393,8 @@
       }
     },
     {
-      "name": "Português",
-      "code": "pt",
+      "name": "Português Brasileiro",
+      "code": "pt_BR",
       "translation": {
         "AppName": "Gerenciador de arquivos Tiny",
         "AppTitle": "Gerenciador de arquivos",
@@ -1517,6 +1517,120 @@
         "Are you sure want to": "Tem certeza de que deseja"
       }
     },
+    {
+      "name": "Português Europeu",
+      "code": "pt_PT",
+      "translation": {
+        "AppName": "Gestor de Ficheiros",
+        "AppTitle": "Gestor de Ficheiros",
+        "Login": "Iniciar sessão",
+        "Username": "Nome de utilizador",
+        "Password": "Palavra-passe",
+        "Logout": "Terminar sessão",
+        "Move": "Mover",
+        "Copy": "Copiar",
+        "Save": "Guardar",
+        "SelectAll": "Seleccionar tudo",
+        "UnSelectAll": "Desseleccionar tudo",
+        "File": "Ficheiro",
+        "Back": "Voltar",
+        "Size": "Tamanho",
+        "Perms": "Permissões",
+        "Modified": "Modificado",
+        "Owner": "Proprietário",
+        "Search": "Procurar",
+        "NewItem": "Novo item",
+        "Folder": "Pasta",
+        "Delete": "Eliminar",
+        "Rename": "Renomear",
+        "CopyTo": "Copiar para",
+        "DirectLink": "Ligação directa",
+        "UploadingFiles": "A enviar ficheiros",
+        "ChangePermissions": "Alterar permissões",
+        "Copying": "A copiar",
+        "CreateNewItem": "Criar novo item",
+        "Name": "Nome",
+        "AdvancedEditor": "Editor avançado",
+        "Actions": "Acções",
+        "Folder is empty": "A pasta está vazia",
+        "Upload": "Enviar",
+        "Cancel": "Cancelar",
+        "InvertSelection": "Inverter selecção",
+        "DestinationFolder": "Pasta de destino",
+        "ItemType": "Tipo de item",
+        "ItemName": "Nome do item",
+        "CreateNow": "Criar agora",
+        "Download": "Descarregar",
+        "Open": "Abrir",
+        "UnZip": "Descomprimir",
+        "UnZipToFolder": "Descomprimir para pasta",
+        "Edit": "Editar",
+        "NormalEditor": "Editor normal",
+        "BackUp": "Cópia de segurança",
+        "SourceFolder": "Pasta de origem",
+        "Files": "Ficheiros",
+        "Change": "Alterar",
+        "Settings": "Definições",
+        "Language": "Idioma",
+        "ErrorReporting": "Relatório de erros",
+        "ShowHiddenFiles": "Mostrar ficheiros ocultos",
+        "Help": "Ajuda",
+        "Created": "Criado",
+        "Help Documents": "Documentos de ajuda",
+        "Report Issue": "Comunicar problema",
+        "Generate": "Gerar",
+        "FullSize": "Tamanho total",
+        "HideColumns": "Ocultar colunas de permissões/proprietário",
+        "You are logged in": "Sessão iniciada",
+        "Nothing selected": "Nenhum ficheiro seleccionado seleccionado",
+        "Paths must be not equal": "Os caminhos não podem ser iguais",
+        "Renamed from": "Renomeado de",
+        "Archive not unpacked": "Arquivo não descomprimido",
+        "Deleted": "Eliminado",
+        "Archive not created": "Arquivo não criado",
+        "Copied from": "Copiado de",
+        "Permissions changed": "Permissões alteradas",
+        "to": "para",
+        "Saved Successfully": "Guardado com sucesso",
+        "not found!": "não encontrado!",
+        "File Saved Successfully": "Ficheiro guardado com sucesso",
+        "Archive": "Arquivo",
+        "Permissions not changed": "Permissões não alteradas",
+        "Select folder": "Seleccionar pasta",
+        "Source path not defined": "Caminho de origem não definido",
+        "already exists": "já existe",
+        "Error while moving from": "Erro ao mover de",
+        "Create archive?": "Deseja criar um arquivo?",
+        "Invalid file or folder name": "Nome de ficheiro ou pasta inválido",
+        "Archive unpacked": "Arquivo descomprimido",
+        "File extension is not allowed": "Extensão de ficheiro não permitida",
+        "Root path": "Caminho raiz",
+        "Error while renaming from": "Erro ao renomear de",
+        "File not found": "Ficheiro não encontrado",
+        "Error while deleting items": "Erro ao eliminar itens",
+        "Moved from": "Movido de",
+        "Generate new password hash": "Gerar novo hash de palavra-passe",
+        "Login failed. Invalid username or password": "Falha na autenticação. Nome de utilizador ou palavra-passe inválido",
+        "password_hash not supported, Upgrade PHP version": "password_hash não suportado. Actualize a versão do PHP",
+        "Advanced Search": "Pesquisa avançada",
+        "Error while copying from": "Erro ao copiar de",
+        "Invalid characters in file name": "Caracteres inválidos no nome do ficheiro",
+        "FILE EXTENSION HAS NOT SUPPORTED": "A EXTENSÃO DO FICHEIRO NÃO É SUPORTADA",
+        "Selected files and folder deleted": "Ficheiros e pasta seleccionados eliminados",
+        "Error while fetching archive info": "Erro ao obter informações do arquivo",
+        "Delete selected files and folders?": "Deseja eliminar os ficheiros e pastas seleccionados?",
+        "Search file in folder and subfolders...": "Procurar ficheiro na pasta e subpastas...",
+        "Access denied. IP restriction applicable": "Acesso negado. Restrição de IP activa",
+        "Invalid characters in file or folder name": "Caracteres inválidos no nome do ficheiro ou da pasta",
+        "Operations with archives are not available": "As operações com arquivos não estão disponíveis",
+        "File or folder with this path already exists": "Já existe um ficheiro ou pasta com este caminho",
+        "Are you sure want to rename?": "Tem a certeza que deseja renomear?",
+        "Are you sure want to": "Tem a certeza que deseja",
+        "Date Modified": "Data de modificação",
+        "File size": "Tamanho do ficheiro",
+        "MIME-type": "Tipo MIME"
+      }
+    },
     {
       "name": "Polski",
       "code": "pl",
@@ -2812,4 +2926,4 @@
       }
     }
   ]
-}
+}