sunhater/kcfinder

KCFinder web file manager

kcfinder's Issues

version 3 : Not work with ckeditor

Use Grunt for CSS/JS preparation

I'm confused by and disagree with the decision to include CSS and JS minification and concatenation functions in KCFinder 3.

In my opinion, it would be much more appropriate to do this with a task runner such as Grunt. Outside of developing KCFinder and/or a theme, the average user has no need to rebuild the CSS and JS files.

Any thoughts? I would be willing to send in a pull request for this if there is agreement on the matter. Thanks!

Cancel / close iFrame with no select

As example:
http://kcfinder.sunhater.com/demos/iframe

How would a user cancel and not select anything?

Unknown error

I get "Unknown error" when I try to set the upload/ directory to the upload root. I don't want subfolders (files, images, etc). I want to all uploads goes the same root directory. I could not find anywhere a description how to set this.

The folder structure, and the root file names is rendered good, but when I clicked any folder I get the unknown error.

My config.php:
...
'uploadURL' => "../uploads",
'uploadDir' => "../uploads",
'types' => array(
'' => "",
),
...

I tried this: http://stackoverflow.com/a/12751375
The result is same.

Another question: How to hide the .htaccess file in the root upload folder?

Unicode support

Please support unicode in file name.
It allow me to upload a file named "你好.png". But when I select that file, it returns an incorrect file name.

Please fix that, or tell me how to fix.
Thank you!

PDF unreadable ?

Hi,

I use KCfinder last stable version with CKeditor.

But on my server when I upload PDFs, they become unreadable. On my local with WAMP .. no problem.

Any Idea ?

KCFinder on unusual port not working

I'm building an intranet right now and i use your soft in my cms.

To manage this intranet from outside of my work lan network i have created a port forward in my router so when i try to manage file from my home the url of KCFinder is for exemple:

http://exempledomain.com:8064/data/browse.php?lng=fr&type=files&dir=files/Politiques_Entreprise

And KCFinder is not working on port different of 80.

This is a print screen of the result outside of my intranet. If im inside my network on port 80 everything work perfect.

Could you help me with that please.

Sorry about my English i speak french.

Add custom option on right click like copy file path

Hi,
it is possibile to add custom element on the file right click??
For example I like to copy the file path on the clipboard.
Thank you

Auth check security problem in the BolmerCMS and Drupal (?)

As I've worked on a new integration, and based it on BolmerCMS' and Drupals integration, I think I found a (small) security problem.

Imagine a website with two admins. AdminGood is a good and AdminBad is a bad admin. AdminBad logs in to the admin panel, so in his session the $_SESSION["KCFINDER"]["disabled"] has been set to false. Admin good finds out that AdminBad is bad, so he disables his account. Now AdminBad can't log in anymore. However if his session is not destroyed, he still has the "disabled" kcfinder session variable set to false, so even if he can't log in, he will still have access to /path/to/kcfinder/browse.php and upload.php.

So I think when we are checking the authentication like:

if ($userIsAuthenticated) {
    //...
    $_SESSION['KCFINDER']['disabled'] = false;
    //...
}

we should also use

else {
    $_SESSION['KCFINDER'] = array();
    //or unset($_SESSION['KCFINDER']);
}

to make sure to clean the session variable if the user is not authenticated anymore.

Is this right?

[UPDATED]

ERROR - Cannot allocate memory: couldn't create child process

Hey!

When I open the file manager to view or upload files from CKeditor, most of the time I just get a grey screen, it vary rarely loads fully.

When I check the server logs I have the following:

[error] client xxipremovedxxCannot allocate memory: couldn't create child process: /opt/suphp/sbin/suphp for /home/xxremovedxx/public_html/index.php, referer: https://xxremovedxx/editors/kcfinder/browse.php?opener=ckeditor&type=images&CKEditor=pages_html_text&CKEditorFuncNum=1&langCode=en

[error] client xxipremovedxxCannot allocate memory: couldn't create child process: /opt/suphp/sbin/suphp for /home/xxremovedxx/public_html/editors/kcfinder/browse.php, referer: https://xxremovedxx/editors/kcfinder/browse.php?opener=ckeditor&type=images&CKEditor=pages_html_text&CKEditorFuncNum=1&langCode=en

Also just after accessing the kcfinder the virtual memory maxes out.

Our server details:
OS: Lunix
Virtual Memory Usage: 1024MB
Physical Memory Usage: 1024MB

If there any way to over come this?

Styling it more modern

I wonder if there are plans on restyling it to a modern version.
Just like the Tinymce 4 and CKEditor.

dynamic permission settings for create dirs

I need to dynamic permission settings for create dirs. example: If user is admin dirs create=> true or if user is normal create => false.

Stackoverflow issus: http://stackoverflow.com/questions/24914899/how-to-set-dynamic-permission-settings-in-kcfinder

How Do can in create this?

Upload folder created in default location when session has expired

Consider the following scenario:

.1. KCFinder is integrated with an external application. The session config enables KCFinder and sets the uploadDir, following the instructions (http://kcfinder.sunhater.com/integrate):

$_SESSION['KCFINDER'] = array();
$_SESSION['KCFINDER']['disabled'] = false;
$_SESSION['KCFINDER']['uploadURL'] = "/users/" . $user['username'] . "/upload";
$_SESSION['KCFINDER']['uploadDir'] = "";

.2. A user tries to access browse.php while the session has expired or by using a direct link.
.3. The action get stopped because config setting disabled defaults to true: https://github.com/sunhater/kcfinder/blob/master/core/class/browser.php#L82

However, between step 2 and 3, browser::__construct() is called, which creates the upload directory if it doesn't exist yet. Because the session config is missing, this means the upload folders (with default permissions) are created in the default location. We end up with an extra set of (bogus) folders, which in our circumstances cannot be deleted easily because of file permissions.

Could the code be modified to check disabled earlier in the process, or to postpone folder creation until after this check? I can imagine this problem scenario applies to other settings as well.

Suggestion: Allow upload from URLs

Please allow upload from URLs:

• Drag and drop image from web.
• Enter URLs.

Thank you for an awesome tool!

Suggestion: FTP support

I had a need with CKFinder to have the files all uploaded and managed via an FTP connection to the server, rather than working with the filesystem directly, so that file ownership/permissions remained tied to the FTP user rather than whatever user the web-server is running as.

This diff contains the complete changes I made to CKFinder to support this: https://gist.github.com/worthers/4086884

Could this be useful for KCFinder also?

Kcfinder memory_limit requiered?

Does anyone know how much memory is required on the server to resize large images?
I want to upload large images with kcfinder but does not work.
Example:
type: png
width: 4230px
height: 2350px
size: 4.4mb
resolution: 96pps

these are the values ​​that I have in phpinfo and doesn´t work ...

Directive Local Value Master Value
allow_url_fopen On On
allow_url_include Off Off
always_populate_raw_post_data Off Off
arg_separator.input & &
arg_separator.output & &
asp_tags Off Off
auto_append_file no value no value
auto_globals_jit On On
auto_prepend_file no value no value
browscap no value no value
default_charset no value no value
default_mimetype text/html text/html
disable_classes no value no value
disable_functions no value no value
display_errors On On
display_startup_errors Off Off
doc_root no value no value
docref_ext no value no value
docref_root no value no value
enable_dl On On
enable_post_data_reading On On
error_append_string no value no value
error_log xxxxxxxxxxxxxx
error_prepend_string no value no value
error_reporting -1 -1
exit_on_timeout Off Off
expose_php On On
extension_dir /usr/lib/php5.5/extensions/no-debug-non-zts-20121212 /usr/lib/php5.5/extensions/no-debug-non-zts-20121212
file_uploads On On
highlight.comment #FF8000 #FF8000
highlight.default #0000BB #0000BB
highlight.html #000000 #000000
highlight.keyword #007700 #007700
highlight.string #DD0000 #DD0000
html_errors On On
ignore_repeated_errors Off Off
ignore_repeated_source Off Off
ignore_user_abort Off Off
implicit_flush Off Off
include_path .:/usr/lib/php5.5 .:/usr/lib/php5.5
log_errors On On
log_errors_max_len 1024 1024
mail.add_x_header Off Off
mail.force_extra_parameters no value no value
mail.log no value no value
max_execution_time 30 30
max_file_uploads 20 20
max_input_nesting_level 64 64
max_input_time -1 -1
max_input_vars 1000 1000
memory_limit 256M 256M
open_basedir no value no value
output_buffering 0 0
output_handler no value no value
post_max_size 100M 100M
precision 14 14
realpath_cache_size 16K 16K
realpath_cache_ttl 120 120
register_argc_argv On On
report_memleaks On On
report_zend_debug On On
request_order no value no value
sendmail_from no value no value
sendmail_path /usr/sbin/sendmail -t -i /usr/sbin/sendmail -t -i
serialize_precision 17 17
short_open_tag On On
SMTP localhost localhost
smtp_port 25 25
sql.safe_mode Off Off
sys_temp_dir no value no value
track_errors Off Off
unserialize_callback_func no value no value
upload_max_filesize 30M 30M
upload_tmp_dir no value no value
user_dir no value no value
user_ini.cache_ttl 300 300
user_ini.filename .user.ini .user.ini
variables_order EGPCS EGPCS
xmlrpc_error_number 0 0
xmlrpc_errors Off Off
zend.detect_unicode On On
zend.enable_gc On On
zend.multibyte Off Off
zend.script_encoding no value no value

Cross-site Scripting Vulnerability - CVE-2014-3988

Please be advised:

KCFinder is prone to a Cross-site Scripting (XSS) vulnerability. The problem exists because the application does not sanitize the names of files that are web-browsed by users of the server upon which the application is running. HTML and script can be added to the names of files and/or folders. When a user traverses to a location on the server where a file/folder contains embedded HTML/script within its name, then the HTML/script contained within the file name (or folder name) will execute within the user’s browser environment. This XSS is persistent in that the XSS will be triggered for any user who can access the KCFinder application on a server until the affected file/folder is removed or renamed. I have verified that this XSS issue exists in versions 3.11 of KCFinder. Other older versions of KCFinder could be prone to this vulnerability.

Mitre has assigned CVE-2014-3988 to this issue.

The following two images show how the XSS can be triggered. The first image gives an example of a filename that contains script. The second image shows the script in the filename executing in a user's browser.

Question & Suggestion: Image editing

Hi,
Does kcfinder have the feature of image editing (crop, resize, rotate)?
If not, will you implement that feature?

Thank you!

Inefficiency caused by getimagesize

In file core/browser.php function getFiles calls inefficient getimagesize on every file. This tends to be very slow operation for large files. As a result, displaying contents of directories that contain many large files is very slow.

An attempt to workaround the problem by filtering out non-images can be found here: http://sourceforge.net/apps/phpbb/kcfinder/viewtopic.php?f=5&t=300

In one of my projects (where directory contained many video files), I've applied that patch and the difference was significant (something like 10 seconds delay -> almost instant).

Accented file names

When i upload a file with accented characters the file name on the server will be flawed.
For example "Nénuphars.jpg" become "Nénuphars.jpg"

When i changed the return code of the uploader class normalizeFilename() to this

return utf8_encode($filename);

the file name is written in the correct format on the server but then the file explorer doesn't work anymore because i get a javascript error

Uncaught TypeError: Cannot call method 'toLowerCase' of null
in the file index.php line 4320

When i checked the json response after uploading the file or even when reload the page, i found that the name of the file "Nénuphars.jpg" is sent as null.

When i added utf8_decode in the dir class content() an error occurs at class_fastImage class

CKEditor 4.2 integration

Hi all,
I integrated KCFinder into my website but I have a strange problem.
I add the tool into CKEditor 4.2 (revision f74e558) using this code:

[CODE]

<textarea id="contentEditor" name="contentEditor"></textarea> <script type="text/javascript"> CKEDITOR.replace('contentEditor', { resize_enabled:false, filebrowserBrowseUrl : 'http://www.mywebsite.com/kcfinder/browse.php?type=files', filebrowserImageBrowseUrl : 'http://www.mywebsite.com/kcfinder/browse.php?type=images', filebrowserFlashBrowseUrl : 'http://www.mywebsite.com/kcfinder/browse.php?type=flash', filebrowserUploadUrl : 'http://www.mywebsite.com/kcfinder/upload.php?type=files', filebrowserImageUploadUrl : 'http://www.mywebsite.com/kcfinder/upload.php?type=images', filebrowserFlashUploadUrl : 'http://www.mywebsite.com/kcfinder/upload.php?type=flash' } ); CKEDITOR.add </script>

[/CODE]

When I click on Search on the server, KCFinder open, but wher I select an image to insert into my editor, I get this Javascript Exception:

Errore: TypeError: _.opener.CKEditor.object is undefined
File sorgente: http://www.mywebsite.com/kcfinder/js/index.php
Riga: 3137

I have this problem on linux system. In my local machine (windows) the tool is ok

Can you help me please?

Thanks

Code to URL LINK for file (PDF,IMAGES; VIDEOS .......)

I added a menu to the right click on the file, this button opens a new window and allows you to view PDF, Video, Images ... provided you have the codecs on your browser.

Add code in /js/091.menu.js in a // SINGLE FILE MENU after // DOWNLOAD (line260 in the last version 3.20test)

// DIRECTLINK change www.YOURDOMAIN.com for your domain.
        _.menu.addItem("kcact:directlink", _.label("DirectLink"), function() {

 _.alert('<a href="' + 'http:' + "//" + "www.YOURDOMAIN.com" + _.uploadURL + "/" + _.dir + "/" + $(file).data('name') + '"' + 'target="_blank">' + 'http:' + "//" + "www.YOURDOMAIN.com" + _.uploadURL + "/" + _.dir + "/" + $(file).data('name') + '</a>');

          return false;
            });

¿¿any idea to watch the videos on a popup as images??

Thank you.

great project

Multiple file when drag and drop in FF

Hi,

It seem to duplicate my uploaded picture twice when i drap and drop it in kcfinder. It work like a charm in chrome but not in FF.

sincerely,

Class Imagick not found in lib/class_image_imagick.php

I have OS X, Imagick installed, version of KCFinder downloaded via composer using tag 2.52. In said file there are multiple references to Imagick class without leading backslash which sets root namespace.

add kcfinder in button(or link) action

Hi,
I see This demo : http://kcfinder.sunhater.com/demos/textbox
in your example if i need to delete upload url(empty textbox), kcfinder open in onclick textbox. I need to add kcfinder in button(or link) action and send upload url to textbox.

How to be?

Thanks
Best Regards

Unknown error when upload folder too big.

I have an image folder with with a few hundred images. However when i use the filebrowser it returns an 500 server error and does not finish building all thumbs. The browser self only returns "unknown error"

I use kcfinder 2.54 and the latest Ckeditor.

IE8 not working

init.js:33: console.log(this.opener); causing an JS error in IE8

[2.52] Bug on debian (chrome and firefox)

The install works fine on a windows server but does nothing (files folder not shown) under debian.

After investigation I found the pb in /js/browser/settings.js

I had to comments 2 lines :

// $('#order input[value="' + _.kuki.get('order') + '"]').get(0).checked = true;

and

// $('#view input[value="' + _.kuki.get('view') + '"]').get(0).checked = true;

in both cases get(0) returned undefined.

Regards,

Luc

Blank page response when opening browser if "uploadURL" is invalid

Blank page response when opening browser if "uploadURL" is invalid.

• A user accidentaly sets uploadURL to an invalid value ( like if they think they should enter a path, so they enter: C:/path/to/upload/folder/ ) $this->config['uploadDir'] will also be invalid, when it's been set (here).
• As a result of this, $this->backMsg will be called with an error message (here).
• backMsg runs and calls $this->callBack (here) with the error message.
• But (here) get_class($this)=="kcfinder\browser" is true and $this->action is null, so we simply reach a "return".
• Back to backMsg we just get to a die; (here) so user will se an empty/blank page.

Removing the if contition here temporary solved the problem for me, but I don't know if this causes any other problems or not. Please take a look into this.

Laravel Administrator integration

Hi!

First, I would like to thank you this cool project, as I found it really useful in many-many situations.

Currently I'm working on a project with Laravel, and I'm using Laravel Administrator for managing the website. The only thing I really miss from Laravel Administrator is your kcfinder, so I started working on implementing it. I've already worked a couple of days on this, and now I can successfully configure ckfinder from L.A. I'm really close to finishing the integration, so I would like to know if I submit a PR with an integration file for L.A., will you please merge it in the current project?

Thanks in advance!

No Select Button TinyMCE

Hi creator, thanks for this awesome plugin. I already integrate it with my website on textbox and there is no problemo. But I also integrate this with TinyMCE 4 but when browse from server. There is no select button or even double click to select the image is do nothing.
Why this could be happen? There's also an error said like this (dont know if this related) : GET path/to/plugins/tinymce/tiny_mce_popup.js 404 (Not Found)

Here is the script :
function openKCFinderTinyMCE(field_name, url, type, win) {
tinyMCE.activeEditor.windowManager.open({
file: 'path/to/kcfinder/browse.php?opener=tinymce&type=' + type,
title: 'KCFinder',
width: 700,
height: 500,
resizable: "yes",
inline: true,
close_previous: "no",
popup_css: false
}, {
window: win,
input: field_name
});
return false;
}

I search everywhere but there is not help. Thanks

Blank Browser

Thank you for your greate job.
I tried to use KCFinder 3.11 with CKEditor, but I got blank browse screen.
And after browse screen blanked, web browser hanged.
v. 3.11 Upload works OK.
v. 2.54 everything works OK.
I use XAMPP with window 7, Chrome browser, CKeditor 4.4 PHP with Laravel.
Thanks

Multiple instances of KCFinder on the same page

Hi!

I am currently using this method http://kcfinder.sunhater.com/demos/iframe to embed KCFinder on my site in order to make an simple CMS.

I would like to call KCFinder more then once on the same site but for some reason I can't. The point here is that when I click on a button a modal pops up and KCFinder is there. It works fine with only one instance but when I add other modals KCFinder stops working. I tried to add more kcfinder_div both on javascript, html and CSS but it didn't work. I tried like this: var div = document.getElementById('kcfinder_div', 'kcfinder_div1');

I can't call the same modal for every button because every button is associated with a different image with a different description, so I really need to call the same instance or a new instance in different modals on the same page.

How do I do it?

It would be great to have some options to ignore specified directories...

Было бы здорово иметь возможность опционально игнорировать некоторые директории. Пригодилось бы для защиты от несанкционированного доступа в "системные" папки.

images of large dimension not upload

Images of large dimension not upload to the server and they do not give any error message!!
type: png
width: 4230px
height: 2350px
size: 4.4mb
resolution: 96pps

image makes the whole process of uploading, but in reality it does not upload to the server and it do not give any error message!!

the problem is not the size of the image because I have uploaded other files with larger size.
I have the 8mb limit in one file or 40mb in multiple uploads.
I have also set the resize to 1024px and works well with other images.
What can be the problem?

• this is my settings in config.php :

// IMAGE SETTINGS

    'imageDriversPriority' => "imagick gmagick gd",
    'jpegQuality' => 90,
    'thumbsDir' => ".thumbs",

    'maxImageWidth' => 1024,
    'maxImageHeight' => 0,

    'thumbWidth' => 100,
    'thumbHeight' => 100,

    'watermark' => "",

Integration with mysql?

You can integrate kcfinder with mysql? wanted to enter a description for easy identification of files.

would be something like the ability to rename, just that the result would be saved in mysql.

Optimal design, congratulation.

I await the return.

David

Display image dimensions

Any interest in adding as an option under Settings->Show the ability to display image dimensions?

browse.php?type=files doesn't work

Never mind :)

Unknown error while refresh and view

I have use kcfinder V 3.12, V 3.10 and got same problem
I got "unknown error" while refreshing images
then thumbnail preview ddn't available for me so i cannot swith between thumbnails or list view...

Then i rolled back to V.2.5.2 and everything works fine
please how to fix this error

thanks

Last Version (FOR PHP 5.2)

Can someone give me a download link?

I cant update my PHP version, so i need the last version compatible with php 5.2

Thanks!

symbolic links

this issue is the continuation of #30

Scenario

• PHP's DOCUMENT_ROOT ( i.e. /var/www ) is a symbolic link to other folder ( i.e. /other/www )
• I don't have permissions to change PHP's or directories on the server, so I have to deal with the symbolic links.

Description

In uploader->checkFilePath realpath resolves the symbolic link to its linked folder and returns false, producing an 'Unknow error'.

Solution

Changing the initial declaration of $this->typeDir on the uploader's constructor, to set the 'real path' does the trick for me.
In my code I've changed lines 224, 232 and 243 of core/class/uploader.php
from
$this->typeDir = "{$this->config['uploadDir']}/{$this->type}";
to
$this->typeDir = realpath("{$this->config['uploadDir']}/{$this->type}");

It's working, but could this have any undesired effect??

Create composer.json

Could create a composer.json and publish the packagist.org.
The developers, keep our files updated, and help in corrections in new versions.

Get error when accessing site with ip addess

I Get:

TypeError: $(...).get(...) is undefined

at this line:

$('#order input[value="' + $.$.kuki.get('order') + '"]').get(0).checked = true;

nothing show in file browser when accessing from ip address.

There are no versions on packagist.org

https://packagist.org/packages/sunhater/kcfinder

Why is that?

Uploader fails with "Unknown Error"

This issue ( and the fix that is part of the PR) is discussed at: https://issues.civicrm.org/jira/browse/CRM-12975

My pull request:
#74

Cannot set property 'checked' of undefined in index.php:2560

Kcfinder loads blank, with no files.

When i comment rows 2560 and 2579 in base.js - kcfinder show files, but cannot set view thumbnail/list.

Interesting thing - all works on my (shared) hosting, but on the development computer i have this error. Same site files. It was works with old kcfinder version.. i think 3.0 was ok..

Tried 3.11 and 3.12

I use it with CodeIgniter - all works, before update to 3.11/3.12.

Thank you.

PDF files

When I upload a PDF everything is fine but when I click on the link in the browser it opens a TXT file (instead of the PDF).

Create directory

Hi!

I have for a while ago used KCFinder 2.52. All is well except my costumer has now asked to be able to create directories inside the automatically created folders. I went to read the documentation and found that one should have:

// PERMISSION SETTINGS

    'dirPerms' => 0755,
    'filePerms' => 0644,

    'access' => array(

    'files' => array(
    'upload' => true,
    'delete' => true,
    'copy'   => true,
    'move'   => true,
    'rename' => true
    ),

    'dirs' => array(
    'create' => true,
    'delete' => true,
    'rename' => true
    )
)

After checking my config.php I realised that I already had this there and yet, if I right click on the KCFinder window nothing will happen. I have been searching for a button of creating folder but I cannot see it neither.

I am using KCFinder integrated with CKEditor.

What am I missing here?

"Unknown error" because of checkFilePath/realpath

When clicking on "Refresh" in KCFinder after a clean install I get an "Unknown error".
"uploadURL" is set up like this: "http://www.example.com/kcfinder/upload"
"uploadDir" is set up like this: ""
Setting "uploadDir" to an absolute path like "/document_root/example/kcfinder/upload" doesn't help.
The error happen in line 821 in browser.php when checkFilePath() is called.
The function realpath in line 406 in uploader.php deletes the beginning of the path string of the document root, so the result of checkFilePath is always false.
For example:
document_root = /customers/homepages/12/d12345678/htdocs
$file = /customers/homepages/12/d12345678/htdocs/example/kcfinder/upload
realpath($file) = /homepages/12/d12345678/htdocs/example/kcfinder/upload

Demo not working.

The demo on http://kcfinder.sunhater.com/demos/standalone is generating javascript error.

P.S. Glad to see this project active again.