Security

Secure Roxy FilemanFileman's PHP or .NET scripts will not manipulate files or folders that are outside the directory set in FILES_ROOT setting. Also Fileman script which is not set in the configuration cannot be executed - it will exit.
Example: 
MOVEDIR is set to "your_script_to_move_dir.php", if the original Fileman "php/movedir.php" script is requested, it will check the configuration and exit, because the mismatch of it's own name and the value of MOVEDIR setting. The same mechanism is used in the .NET distribution.

However, it's up to you to implement application level access restriction! If you are using protected directory and Fileman resides in it, you are good to go.

 

.NET users can use web.config file to apply user authentication.

 

To implement your own security checks in PHP, you have to fill "checkAccess($action)" function located in fileman/php/security.inc.php file. This function is executed in the beginning of each PHP script, and you can validate user or the action which is about to be performed ($action will contain the name of the setting i.e "MOVEDIR" when moving directory). Usually user login validation is pretty simple, it could be something like "if($_SESSION['is_admin_logged'] !== true)exit;".

You can also use HTTP Basic authentication or any other authentication mechanism you want.


 

User comments

Please see the FAQ page before ask a question.

I don't review comments very often, and I will NOT answer the questions asked here, please use the contact form.

L. Arsov


Author: JerryKax 04-07-2020 15:28:30 (GMT)
Знаете ли вы?
Мама и четверо детей снимают фильмы о своей жизни во время войны.
Двое капитанов первого кругосветного плавания были казнены, следующего высадили на необитаемый остров.
Акадийка много раз становилась первой.
Водитель ледового комбайна стал звездой единственного матча НХЛ, в котором принял участие.
Художник-карикатурист известен пародией на мунковский «Крик».


<a href=http://arbeca.net/>arbeca</a>
Author: pawtheope 02-07-2020 16:26:11 (GMT)
Levitra Online In Usa https://agenericcialise.com/ - Cialis Propecia Wirkt Nicht Mehr <a href=https://agenericcialise.com/#>Cialis</a> Preis Viagra Levitra
Author: DannyWep 01-06-2020 05:31:32 (GMT)
free sex cams no credit card <a href=https://sexcams00.space>sexcams00</a> xname xname sex cams.
Author: DavidZesty 21-05-2020 23:57:53 (GMT)
sex cams en vivo <a href=https://sexcams00.space>best online sex cams </a> mom son sex cams.
Author: JamesHal 13-05-2020 13:41:25 (GMT)
camgirls <a href=https://camgirls1.com>nude romanian girls </a> best cam girl websites.
best free cam site <a href=https://adultfreewebcamsites.com>best cam site reddit </a> new webcam sites.
free live sex cam <a href=https://bestonlinesexwebcams.com>teen sex cam </a> voyeur sex cam.
nude cam sites <a href=https://adultcamsites1.com>adultcamsites1</a> nude webcam sites.
sex webcam <a href=https://bestonlinesexcams1.com>girls sex cam </a> fire sex cam.
live cam sex video <a href=https://bestonlinesexcams1.com>bestonlinesexcams1.com</a> boy cam sex.
Author: DwightKek 11-05-2020 11:39:08 (GMT)
live cam girls <a href=https://hotcamgirls1.com>hotcamgirls1</a> russian cam girls.
girl cam <a href=https://hotcamgirls1.com>real amateur cam girls </a> girl live web cam.
girl cam <a href=https://camgirls1.com>camgirls1</a> girls stripping webcams.
sex cam sites <a href=https://adultcamsites1.com>adultcamsites1</a> cheapest cam site.
asian cam site <a href=https://adultcamsites1.com>best adult webcam sites </a> online webcam sites.
asian cam girls <a href=https://camgirls1.com>camgirls1.com</a> cam girl ass.
Author: Georgedam 11-05-2020 10:42:17 (GMT)
webcam sex live <a href=https://bestonlinesexcams1.com>hidden cam sex videos tumblr </a> private sex cam.
Author: Sanjeev kumar 29-09-2018 07:37:38 (GMT)
How we call session in security inc.php they give error Undefined variable: _SESSION
Author: zinchronize 29-12-2016 08:50:25 (GMT)
I inject a code inside the a code inside the main.ashx file under public method "ProcessRequest". Sample snippet below:

public void ProcessRequest (HttpContext context) {

//Custom code here
var auth = new SMIC_Intranet2.Models.AuthorizationGateway();
.UsersRepository credentials = auth.AuthorizeUser();

if (!(credentials.Role == SMIC_Intranet2.Models.UserRoles.ADMINISTRATOR || credentials.Role == SMIC_Intranet2.Models.UserRoles.PUBLISHER))
{
//here throws 401 if condition has met otherwise continue execution
context.Response.StatusCode = 401;
context.Response.End();
}



}
Author: Daniel Wiberg 23-09-2014 09:40:00 (GMT)
@Martin Curly
Sorry for late response.
Open the "Web.config" file in "fileman" directory
Add this three lines right under "<system.web>"
<authorization>
<deny users="?" />
</authorization>

When you do that you deny all users that are not logged in.
Author: Martin Curly 14-09-2014 10:15:20 (GMT)
".NET users can use web.config file to apply user authentication."

How this process?. Please helpme.

Add comment