: str_replace(): Passing null to parameter #2 ($replace) of type array|string is deprecated in
$result['warning'] = $this->error(self::ERROR_LOCKED, $rm['name']);
if (!$volume->rm($target)) {
$result['warning'] = $this->error($volume->error());
* @param array command arguments
* @author Dmitry Naoki Sawada
protected function subdirs($args)
$result = array('subdirs' => array());
$targets = $args['targets'];
foreach ($targets as $target) {
if (($volume = $this->volume($target)) !== false) {
$result['subdirs'][$target] = $volume->subdirs($target) ? 1 : 0;
* Gateway for custom contents editor
* @param array $args command arguments
protected function editor($args = array())
/* @var elFinderEditor $editor */
$class = 'elFinderEditor' . $c;
if (class_exists($class)) {
$editor = new $class($this, $args['args']);
$res[$c] = $editor->enabled();
$class = 'elFinderEditor' . $name;
if (class_exists($class)) {
$editor = new $class($this, $args['args']);
$method = $args['method'];
if ($editor->isAllowedMethod($method) && method_exists($editor, $method)) {
return $editor->$method();
return array('error', $this->error(self::ERROR_UNKNOWN_CMD, 'editor.' . $name . '.' . $method));
* Abort current request and make flag file to running check
protected function abort($args = array())
if (!elFinder::$connectionFlagsPath || $_SERVER['REQUEST_METHOD'] === 'HEAD') {
$flagFile = elFinder::$connectionFlagsPath . DIRECTORY_SEPARATOR . 'elfreq%s';
if (!empty($args['makeFile'])) {
self::$abortCheckFile = sprintf($flagFile, self::filenameDecontaminate($args['makeFile']));
touch(self::$abortCheckFile);
$GLOBALS['elFinderTempFiles'][self::$abortCheckFile] = true;
$file = !empty($args['id']) ? sprintf($flagFile, self::filenameDecontaminate($args['id'])) : self::$abortCheckFile;
$file && is_file($file) && unlink($file);
* Validate an URL to prevent SSRF attacks.
* To prevent any risk of DNS rebinding, always use the IP address resolved by
* this method, as returned in the array entry `ip`.
protected function validate_address($url)
$host = trim(strtolower($info['host']), '.');
// do not support IPv6 address
if (preg_match('/^\[.*\]$/', $host)) {
// do not support non dot host
if (strpos($host, '.') === false) {
// do not support URL-encoded host
if (strpos($host, '%') !== false) {
// disallow including "localhost" and "localdomain"
if (preg_match('/\b(?:localhost|localdomain)\b/', $host)) {
// check IPv4 local loopback, private network and link local
$ip = gethostbyname($host);
if (preg_match('/^0x[0-9a-f]+|[0-9]+(?:\.(?:0x[0-9a-f]+|[0-9]+)){1,3}$/', $ip, $m)) {
$long = (int)sprintf('%u', ip2long($ip));
$local = (int)sprintf('%u', ip2long('127.255.255.255')) >> 24;
$prv1 = (int)sprintf('%u', ip2long('10.255.255.255')) >> 24;
$prv2 = (int)sprintf('%u', ip2long('172.31.255.255')) >> 20;
$prv3 = (int)sprintf('%u', ip2long('192.168.255.255')) >> 16;
$link = (int)sprintf('%u', ip2long('169.254.255.255')) >> 16;
if (!isset($this->uploadAllowedLanIpClasses['local']) && $long >> 24 === $local) {
if (!isset($this->uploadAllowedLanIpClasses['private_a']) && $long >> 24 === $prv1) {
if (!isset($this->uploadAllowedLanIpClasses['private_b']) && $long >> 20 === $prv2) {
if (!isset($this->uploadAllowedLanIpClasses['private_c']) && $long >> 16 === $prv3) {
if (!isset($this->uploadAllowedLanIpClasses['link']) && $long >> 16 === $link) {
$info['ip'] = long2ip($long);
if (!isset($info['port'])) {
$info['port'] = $info['scheme'] === 'https' ? 443 : 80;
if (!isset($info['path'])) {
* @param string $url target url
* @param int $timeout timeout (sec)
* @param int $redirect_max redirect max count
* @return string, resource or bool(false)
* @retval string contents
* @retval resource conttents
protected function get_remote_contents(&$url, $timeout = 30, $redirect_max = 5, $ua = 'Mozilla/5.0', $fp = null)
if (preg_match('~^(?:ht|f)tps?://[-_.!\~*\'()a-z0-9;/?:\@&=+\$,%#\*\[\]]+~i', $url)) {
$info = $this->validate_address($url);
// dose not support 'user' and 'pass' for security reasons
$url = $info['scheme'].'://'.$info['host'].(!empty($info['port'])? (':'.$info['port']) : '').$info['path'].(!empty($info['query'])? ('?'.$info['query']) : '').(!empty($info['fragment'])? ('#'.$info['fragment']) : '');
// check by URL upload filter
if ($this->urlUploadFilter && is_callable($this->urlUploadFilter)) {
if (!call_user_func_array($this->urlUploadFilter, array($url, $this))) {
$method = (function_exists('curl_exec')) ? 'curl_get_contents' : 'fsock_get_contents';
return $this->$method($url, $timeout, $redirect_max, $ua, $fp, $info);
* Get remote contents with cURL
* @param string $url target url
* @param int $timeout timeout (sec)
* @param int $redirect_max redirect max count
* @return string, resource or bool(false)
* @retval string contents
* @retval resource conttents
protected function curl_get_contents(&$url, $timeout, $redirect_max, $ua, $outfp, $info)
if ($redirect_max == 0) {
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_HEADER, false);
curl_setopt($ch, CURLOPT_FILE, $outfp);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_BINARYTRANSFER, true);
curl_setopt($ch, CURLOPT_LOW_SPEED_LIMIT, 1);
curl_setopt($ch, CURLOPT_LOW_SPEED_TIME, $timeout);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, false);
curl_setopt($ch, CURLOPT_USERAGENT, $ua);
curl_setopt($ch, CURLOPT_RESOLVE, array($info['host'] . ':' . $info['port'] . ':' . $info['ip']));
$result = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
if ($http_code == 301 || $http_code == 302) {
$new_url = curl_getinfo($ch, CURLINFO_REDIRECT_URL);
$info = $this->validate_address($new_url);
return $this->curl_get_contents($new_url, $timeout, $redirect_max - 1, $ua, $outfp, $info);
return $outfp ? $outfp : $result;
* Get remote contents with fsockopen()
* @param int $timeout timeout (sec)
* @param int $redirect_max redirect max count
* @return string, resource or bool(false)
* @retval string contents
* @retval resource conttents
* @throws elFinderAbortException
protected function fsock_get_contents(&$url, $timeout, $redirect_max, $ua, $outfp, $info)
if ($arr['scheme'] === 'https') {
$arr['query'] = isset($arr['query']) ? '?' . $arr['query'] : '';
$url_base = $arr['scheme'] . '://' . $info['host'] . ':' . $info['port'];
$url_path = isset($arr['path']) ? $arr['path'] : '/';
$uri = $url_path . $arr['query'];
$query = $method . ' ' . $uri . " HTTP/1.0\r\n";
$query .= "Host: " . $arr['host'] . "\r\n";
$query .= "Accept: */*\r\n";
$query .= "Connection: close\r\n";
if (!empty($ua)) $query .= "User-Agent: " . $ua . "\r\n";
if (!is_null($getSize)) $query .= 'Range: bytes=0-' . ($getSize - 1) . "\r\n";
$fp = $connect_try_count = 0;
while (!$fp && $connect_try_count < $connect_try) {
$errno, $errstr, $connect_timeout);
if (connection_aborted()) {
throw new elFinderAbortException();
for ($written = 0; $written < strlen($query); $written += $fwrite) {
$fwrite = fwrite($fp, substr($query, $written));
socket_set_timeout($fp, $timeout);
while ($_response !== "\r\n") {
$_response = fgets($fp, $readsize);
$rccd = array_pad(explode(' ', $header, 2), 2, ''); // array('HTTP/1.1','200')
case 307: // Temporary Redirect
case 302: // Moved Temporarily
case 301: // Moved Permanently
if (preg_match('/^Location: (.+?)(#.+)?$/im', $header, $matches) && --$redirect_max > 0) {
$url = trim($matches[1]);
if (!preg_match('/^https?:\//', $url)) { // no scheme
if ($url[0] != '/') { // Relative path
$url = substr($url_path, 0, strrpos($url_path, '/')) . '/' . $url;
$info = $this->validate_address($url);
return $this->fsock_get_contents($url, $timeout, $redirect_max, $ua, $outfp, $info);
$outfp = fopen('php://temp', 'rwb');
while (fwrite($outfp, fread($fp, $readsize))) {
$_status = socket_get_status($fp);
if ($_status['timed_out']) {
return false; // Request Time-out
$body = stream_get_contents($outfp);
return $outfp ? $outfp : $body; // Data
protected function parse_data_scheme($str, $extTable, $args = null)
$data = $name = $mime = '';
// Scheme 'data://' require `allow_url_fopen` and `allow_url_include`
if ($fp = fopen('data://' . substr($str, 5), 'rb')) {
if ($data = stream_get_contents($fp)) {
$meta = stream_get_meta_data($fp);
$mime = $meta['mediatype'];
} else if (preg_match('~^data:(.+?/.+?)?(?:;charset=.+?)?;base64,~', substr($str, 0, 128), $m)) {
$data = base64_decode(substr($str, strlen($m[0])));
$ext = ($mime && isset($extTable[$mime])) ? '.' . $extTable[$mime] : '';
// Set name if name eq 'image.png' and $args has 'name' array, e.g. clipboard data
if (is_array($args['name']) && isset($args['name'][0])) {
$name = $args['name'][0];
$name = preg_replace('/\.[^.]*$/', '', $name);
$name = substr(md5($data), 0, 8);
return array($data, $name);
* Detect file MIME Type by local path
* @param string $path Local path
* @return string file MIME Type
protected function detectMimeType($path)
if (class_exists('finfo', false)) {
$tmpFileInfo = explode(';', finfo_file(finfo_open(FILEINFO_MIME), __FILE__));
$regexp = '/text\/x\-(php|c\+\+)/';
if ($tmpFileInfo && preg_match($regexp, array_shift($tmpFileInfo))) {
$finfo = finfo_open(FILEINFO_MIME);
} elseif (function_exists('mime_content_type')
&& ($_ctypes = explode(';', mime_content_type(__FILE__)))
&& preg_match($regexp, array_shift($_ctypes))) {
$type = 'mime_content_type';
} elseif (function_exists('getimagesize')) {
$mime = finfo_file($finfo, $path);
} elseif ($type === 'mime_content_type') {
$mime = mime_content_type($path);
} elseif ($type === 'getimagesize') {
if ($img = getimagesize($path)) {
$mime = explode(';', $mime);