Celerik\Ui\FileManager

FileManagerConfig

final class Celerik\Ui\FileManager\FileManagerConfig

A locked-down elFinder connector configuration for one local folder.

• Files have no public URL: they are served through the connector, so keep the root outside the web root and protect the connector route with authorization.
• Uploads are checked like UploadHandler does: real MIME type, extension matching the content, no executable or script formats, no double extensions.
• New names (upload, mkdir, rename) can never be dotfiles or use a forbidden extension.
• Dotfiles (.htaccess, elFinder's .tmb thumbnails...) are hidden and inaccessible.
• Commands that extract archives, mount remote storage, change permissions or edit file contents are disabled; SVG and HTML are never displayed inline.

Constants

Constant	Value
ALWAYS_DISABLED	['archive', 'extract', 'netmount', 'chmod']
OPTIONAL_COMMANDS	['mkfile', 'put', 'zipdl', 'resize']
WRITE_COMMANDS	['mkdir', 'mkfile', 'rm', 'rename', 'duplicate', 'paste', 'upload', 'put', 'resize']

Methods

local

static local(string $root, ?UploadRules $rules = null): self

• $root: Existing directory, ideally outside the web root.
• $rules: Accepted uploads (defaults to images and documents up to 5 MB).

alias

alias(string $alias): self

Name of the root folder shown to users.

readOnly

readOnly(bool $readOnly = true): self

Browse and download only: every command that changes files is disabled.

allow

allow(string ...$commands): self

Enables optional commands (mkfile, put, zipdl, resize). Archive, extract, netmount and chmod can never be enabled.

getRoot

getRoot(): string

disabledCommands

disabledCommands(): array

isAcceptedName

static isAcceptedName(string $name): bool

Whether a new file or folder name is acceptable (elFinder's acceptedName).

access

static access(string $attribute, string $path): ?bool

elFinder access control: dotfiles are hidden and can be neither read nor written.

toArray

toArray(): array

The elFinder connector options.

FileManagerConnector

final class Celerik\Ui\FileManager\FileManagerConnector

Runs the elFinder connector (studio-42/elfinder) for one request.

elFinder writes its own response (JSON or a file stream, with range support) and ends the request, so call this as the last thing in the controller. elFinder checks its own CSRF token on every command that changes files; send the framework's CSRF token as well with FileManager::csrf().

Methods

run

static run(FileManagerConfig $config, bool $authorized): never

                    role...). There is deliberately no default.

• $authorized: Result of the application's authorization check (policy, voter,