Changeset 3319016

Timestamp:

06/28/2025 03:35:52 AM (6 months ago)

Author:

ninjateam

Message:

Version 1.9

Location:

filester/trunk

Files:

• assets/js/file_manager_admin.js (modified) (2 diffs)
• includes/File_manager/FileManager.php (modified) (6 diffs)
• includes/File_manager/lib/php/elFinder.class.php (modified) (1 diff)
• ninja-file-manager.php (modified) (2 diffs)
• readme.txt (modified) (2 diffs)
• views/pages/html-filemanager-settings.php (modified) (1 diff)

filester/trunk/assets/js/file_manager_admin.js

@@ -209 +209 @@
       const enable_htaccess = jQuery("#enable_htaccess").is(":checked")
       const enable_trash = jQuery("#enable_trash").is(":checked")
+      const enable_sensitive_protection = jQuery("#enable_sensitive_protection").is(":checked")
       const data = {
         'nonce': wpData.nonce,
@@ -218 +219 @@
         'fm_locale': fm_locale,
         'enable_htaccess': enable_htaccess,
-        'enable_trash': enable_trash
+        'enable_trash': enable_trash,
+        'enable_sensitive_protection': enable_sensitive_protection
 
       }

filester/trunk/includes/File_manager/FileManager.php

@@ -53 +53 @@
                 'njt_fs_file_manager_settings' => array(
                     'root_folder_path' =>  ABSPATH,
-                    'root_folder_url' => site_url()
+                    'root_folder_url' => site_url(),
+                    'enable_sensitive_protection' => '1'
                 ),
             );
@@ -290 +291 @@
                     'uploadDeny'    => array('htaccess'),
                     //'acceptedName' => 'validName',
-                    'attributes' => array(
-                        array(
-                            'pattern' => '/.htaccess/',
-                            'read' => true,
-                            'write' => false,
-                            'hidden' => false,
-                            'locked' => true
-                        )
-                    ) // default is empty
+                    'attributes' => array() // default is empty
                 ),
             ),
         );
 
-        // .htaccess
-        if(isset($this->options['njt_fs_file_manager_settings']['enable_htaccess']) && ($this->options['njt_fs_file_manager_settings']['enable_htaccess'] == '1')) {
-            $attributes = array(
-                'pattern' => '/.htaccess/',
-                'read' => true,
-                'write' => false,
-                'hidden' => true,
-                'locked' => true
-            );
-            array_push($opts['roots'][0]['attributes'], $attributes);
-        }
+    
 
         //Enable Trash
@@ -483 +466 @@
        }
 
-       
+        // Sensitive files protection
+        if(isset($this->options['njt_fs_file_manager_settings']['enable_sensitive_protection']) && ($this->options['njt_fs_file_manager_settings']['enable_sensitive_protection'] == '1')) {
+            $sensitive_files = apply_filters('njt_fs_sensitive_files', array(
+                '.htaccess',
+                'wp-config.php', 
+                '.env',
+                'wp-config-sample.php',
+                'readme.html',
+                'license.txt',
+                'xmlrpc.php'
+            ));
+
+            foreach ($sensitive_files as $file) {
+                $attributes = array(
+                    'pattern' => '/' . preg_quote($file, '/') . '/',
+                    'read' => $this->canAccessSensitiveFiles(),
+                    'write' => $this->canEditSensitiveFiles(),
+                    'hidden' => !$this->canAccessSensitiveFiles(),
+                    'locked' => !$this->canEditSensitiveFiles()
+                );
+                array_push($opts['roots'][0]['attributes'], $attributes);
+            }
+        }
+
+        // .htaccess
+        if(isset($this->options['njt_fs_file_manager_settings']['enable_htaccess']) && ($this->options['njt_fs_file_manager_settings']['enable_htaccess'] == '1')) {
+            $attributes = array(
+                'pattern' => '/.htaccess/',
+                'read' => true,
+                'write' => false,
+                'hidden' => true,
+                'locked' => true
+            );
+            array_push($opts['roots'][0]['attributes'], $attributes);
+        }
 
         //End --setting User Role Restrictions
@@ -566 +583 @@
         $enable_htaccess =  isset($_POST['enable_htaccess']) && $_POST['enable_htaccess'] == 'true' ? 1 : 0;
         $enable_trash = isset($_POST['enable_trash']) && $_POST['enable_trash'] == 'true' ? 1 : 0;
+        $enable_sensitive_protection = isset($_POST['enable_sensitive_protection']) && $_POST['enable_sensitive_protection'] == 'true' ? 1 : 0;
         //save options
         $this->options['njt_fs_file_manager_settings']['root_folder_path'] = $root_folder_path;
@@ -574 +592 @@
         $this->options['njt_fs_file_manager_settings']['enable_htaccess'] = $enable_htaccess;
         $this->options['njt_fs_file_manager_settings']['enable_trash'] = $enable_trash;
+        $this->options['njt_fs_file_manager_settings']['enable_sensitive_protection'] = $enable_sensitive_protection;
         //update options
         update_option('njt_fs_settings', $this->options);
@@ -618 +637 @@
     }
 
+    public function canAccessSensitiveFiles() {
+        // Filter hook for developers
+        if (apply_filters('njt_fs_allow_sensitive_access', false)) {
+            return true;
+        }
+        
+        return false;
+    }
+
+    public function canEditSensitiveFiles() {
+        // Filter hook for developers
+        if (apply_filters('njt_fs_allow_sensitive_edit', false)) {
+            return true;
+        }
+        
+        return false;
+    }
+
 }

filester/trunk/includes/File_manager/lib/php/elFinder.class.php

@@ -2009 +2009 @@
                     return $a404;
                 }
+                
+                // SECURITY FIX: Validate $src path to prevent directory traversal
+                $realSrc = realpath($src);
+                $realTmpDir = realpath($tmpdir);
+                if (!$realSrc || !$realTmpDir || strpos($realSrc, $realTmpDir) !== 0) {
+                    fclose($fp);
+                    return $a403;
+                }
+                
                 if (strpos($src, $tmpdir) === 0) {
                     $GLOBALS['elFinderTempFiles'][$src] = true;

filester/trunk/ninja-file-manager.php

@@ -4 +4 @@
  * Plugin URI: https://ninjateam.org/filester
  * Description: Made to help you focus on WordPress file management and avoid being distracted.
- * Version: 1.8.9
+ * Version: 1.9
  * Author: Ninja Team
  * Author URI: https://ninjateam.org
@@ -36 +36 @@
 
 define('NJT_FS_BN_PREFIX', 'njt-fs');
-define('NJT_FS_BN_VERSION', '1.8.9');
+define('NJT_FS_BN_VERSION', '1.9');
 define('NJT_FS_BN_DOMAIN', 'filester');
 

filester/trunk/readme.txt

@@ -5 +5 @@
 Requires at least: 3.0
 Tested up to: 6.8
-Stable tag: 1.8.9
+Stable tag: 1.9
 License: GPLv2 or later
 License URI: http://www.gnu.org/licenses/gpl-2.0.html
@@ -112 +112 @@
 == Changelog ==
 
+= Jun 28, 2025 - Version 1.9 =
+- Fixed: Authenticated (Subscriber+) Directory Traversal to Arbitrary File Deletion
+
 = Jun 11, 2025 - Version 1.8.9 =
 - Fixed: Patchstack security report

filester/trunk/views/pages/html-filemanager-settings.php

@@ -141 +141 @@
           </td>
         </tr>
+        <!-- Sensitive Files Protection -->
+        <tr>
+          <th><?php _e("Sensitive Files Protection", 'filester'); ?></th>
+          <td>
+            <label class="shortcode-switch" for="enable_sensitive_protection">
+              <input name="enable_sensitive_protection" type="checkbox" id="enable_sensitive_protection" value="1"
+                <?php echo isset($this->options['njt_fs_file_manager_settings']['enable_sensitive_protection']) && ($this->options['njt_fs_file_manager_settings']['enable_sensitive_protection'] == '1') ? 'checked="checked"' : '';?>>
+              <div class="slider round"></div>
+            </label>
+            <p class="description njt-settting-width">
+              <?php _e("Protect sensitive files like wp-config.php, .env, etc. Only administrators can access.", 'filester'); ?>
+            </p>
+          </td>
+        </tr>
         <!-- button submit -->
         <tr>