Files can be renamed to any extension about filemanager HOT 5 CLOSED

it's not a bug, it's a feature! By the way, the /userfiles/ folder should be protected by .htaccess file similar to that :

<IfModule mod_php5.c>
php_value engine off
</IfModule>
<IfModule mod_php4.c>
php_value engine off
</IfModule>
Options -Indexes*

I'm still available to discuss that point

from filemanager.

I'm just thinking this opens a lot of doorways to XSS attacks and such, if someone found a creative way to make a file that .htaccess wasn't stopping.

It might be a good idea to allow an ACL on file types.

What is the benefit of being able to change the file extension?

from filemanager.

Indeed, I'm not sure there is a benefit.
Regarding ACL and file extensions, see issue #43

from filemanager.

I believe it should be a concern of the connector file; perhaps the connector should get it's own allowed/denied extensions and use it for upload/rename.

from filemanager.

Done, see commit a663764

from filemanager.