Studio-42 / elFinder

📁 Open-source file manager for web, written in JavaScript using jQuery and jQuery UI
https://studio-42.github.io/elFinder/
Other
4.6k stars 1.41k forks source link

Copying not allowed files #3654

Open B0D0B0P0T opened 1 month ago

B0D0B0P0T commented 1 month ago

Describe the bug Copying files with an unauthorized extension between server directories. In some apps the misconfiguration lead to different security issues(secrets exposure, RCE, etc.)

To Reproduce Steps to reproduce the behavior:

  1. Create 2 folders on filesystem
  2. Manually create php file in one
  3. Be sure that php file upload restricted
  4. Be sure that you cant just copy and paste php files
  5. Copy folder with php file to other folder
  6. Check that folder copied with not allowed file php

Expected behavior Message like "Unable to copy folder with not allowed file types"

Screenshots

Last version 2.1.65 image

Check if you can upload php files image

Manually create php file on folder image image

Check if you can copy not allowed files on the same directory image

Check if you can copy not allowed files on the other directory image

Copy the entire folder to another one and check if the php file exists image

Desktop: