Feature Request: Method to Extend Filemanager Operations.

shadowdao

First, I would like to say I really like the layout and function you have built so far. I had looked at a few different options, and yours was the best I had looked at and tested. I even have purchased a license, since I intend to include it in the new control panel I am working on building.

Which leads me to the issue I am facing. Since I am running the scripts as a user that has visibility into all customer's accounts and has write access to all the accounts, I need a way to make sure that the files that get created are owned by the client's user, not the super user.

I know I could edit the code directly and make it change owner after the file/directory is created or moved from upload, but I would rather not have to make that change every time you release an update.

Ideally there would be a hook that I could write a plugin for to change ownership of the newly created element to the user that is logged in. Alternatively, it could be a option in the config that would perform the action based on if values for user and group have been set in the config.

I appreciate your time looking at this and if you need more information or even if this is not something you want to do please let me know.

Thanks you.

Karl

Hi, and thanks for your question!

shadowdao Which leads me to the issue I am facing. Since I am running the scripts as a user that has visibility into all customer's accounts and has write access to all the accounts, I need a way to make sure that the files that get created are owned by the client's user, not the super user.

I know I could edit the code directly and make it change owner after the file/directory is created or moved from upload, but I would rather not have to make that change every time you release an update.

I understand the issue, but it's a bit unclear from the above how your system works. If you have Files Gallery installed for each customer, surely it could inherit that customers user in the first place? Also, we are speaking of "user" of the file system here, like the PHP-user? I guess my point is, it's difficult for me to make any suggestions without understanding the full context. Ideally, the owner of the index.php file should be the same user as the files that get managed. Optionally, I'm pretty sure there is a way in server/PHP settings to force files that get created in a specific dir, to be owned by the owner of the dir, and not the owner of the PHP file that creates them.

shadowdao Ideally there would be a hook that I could write a plugin for to change ownership of the newly created element to the user that is logged in.

Even if there was some plugin/API, it's not usual for PHP to be able to change the OWNER of files after they get created. After all, this is one of the reasons for users. Besides, how would you distinguish what client "user" triggers the file creation?

shadowdao Alternatively, it could be a option in the config that would perform the action based on if values for user and group have been set in the config.

Just to be clear, we are speaking of your system users right? Next release in Files Gallery will be about multi-user login with permissions, which could be related to your request, but these "users" have nothing to do with your server users. Just to avoid any confusion. Also, from the above, it seems like you want to use a single Files Gallery index.php for multiple users/websites? I don't see how you intend to do this without customizing in the first place.

Thanks again for feedback. Happy to assist further, but I might need more information to provide better suggestions.

shadowdao

My web app is installed in a centralized place, and uses PAM Auth to authenticate to the system. It is a control panel in the same vein as like cPanel/Plesk (trying to ditch cPanel because they keep jacking up their prices, but not really adding value).

I have security checks and I am using nonces to keep user sessions secure, and I have auto-prepend configured so that included elements are locked down.

I am using a shell_exec command to get the authenticated user's home directory, and setting that as the location the file manager looks at, but when files/folders are created, they are created as my super user account that has access to everything, which is to be expected as that is who my scripts are running as.

My hope would be that I could have a hook that would allow me to run another shell_exec command to change the ownership of the files to the authenticated user.

Karl

Thanks for the explanation.

shadowdao I am using a shell_exec command to get the authenticated user's home directory, and setting that as the location the file manager looks at

Did you then edit the config.php file to assign the root dir based on your authenticated user?

The best solution would of course be to instruct the server that created files in a certain dir must inherit "user" from the owner of the dir, instead of from the script that created them. My server knowledge is limited, but I did see a couple of posts::
stackoverflow.com/a/30605456/3040364
askubuntu.com/questions/642236/how-to-make-the-newly-created-files-inherit-the-directorys-permissions
machiine.com/2013/setup-a-folder-so-that-new-files-created-in-it-inherit-default-permissions-and-group/

Optionally, you could run a shell script on server whenever a folder changes, and then make sure all files in the folder are owned by the same user as the actual folder (eg. not the script that created them), Ref. Or maybe it's possible to change the owner of the current script during runtime (and only during runtime).

shadowdao My hope would be that I could have a hook that would allow me to run another shell_exec command to change the ownership of the files to the authenticated user.

I'm a little hesitant about this for a few reasons. It would need to be something that triggers after every single file edit/create event in index.php, and it would require some included PHP plugin functionality to trigger your custom events. This case seems a bit too specific at the moment for a single-file PHP script that attempts to remain relatively minimal. I may consider something like this in the future, in which case it would need to get implemented properly, also taking errors and fails into consideration.

In the meantime, unless any of the above suggestions are suitable, the only way would be to edit the index.php file. You would probably run some function myhook() after all file create events, which in turn would be a predefined function that triggers your shell_exec('cmd').

Thanks for your feedback.

shadowdao

Thank you for the response, I'll give the group sticky bit a try, as that does seem the easiest, and I appreciate the help.

I did configure the root_dir in the config.php to look at the home dir variable that is defined in the auto-prepend, which is how I am able to switch directories based on who is logged in.