M2-AdminFileManager

Restricted Magento Admin file browser and text editor.

#v1.1.0

Clickable breadcrumbs Directory headings now display clickable navigation such as: Magento root / app / code / Merlin / BrandLogo / Block

Each parent segment is a link, allowing you to jump directly back to: Magento root app app/code app/code/Merlin app/code/Merlin/BrandLogo

The same breadcrumb navigation is also displayed while editing a file, with the current filename shown as the final non-clickable segment.

File activity log

A new section is available at: System → Tools → File Manager Log

It records:

File views Successful edits Rejected edit attempts Rejected file-view attempts Admin username and user ID Full relative file path Date and time IP address Action status Saved file size or rejection reason

The log is stored in the new database table: merlin_admin_filemanager_log

Records are also written to: var/log/merlin_file_manager.log

A separate ACL permission has been added: File Manager → View Activity Log

#v1.0.1

This version fixes the error when trying to view/edit php files / The 404 was caused by the PHP filename appearing directly in the request URI

Nginx interprets the decoded .php URI as a PHP script request and returns 404 before Magento’s admin controller receives it.

File paths in edit URLs are now encoded as opaque URL-safe tokens

Security model

• Admin-area route only.
• Separate ACL resources for browse/view and edit.
• Form-key protected POST save action.
• Canonical path validation prevents .. traversal and root escape.
• Symbolic links are not followed.
• Sensitive files and directories are denied, including app/etc/env.php, auth.json, .env, VCS metadata, SSH key names and backup directories.
• Only a conservative text-extension allowlist is accepted.
• Binary files and files larger than 2 MiB cannot be opened.
• Atomic same-directory saves preserve the existing permission bits.
• Successful and rejected writes are logged to var/log/merlin_file_manager.log.
• No upload, create, delete, rename, chmod, archive extraction or shell execution functionality.

Installation

Copy to:

app/code/Merlin/AdminFileManager

Then run:

php bin/magento module:enable Merlin_AdminFileManager
php bin/magento setup:upgrade
php bin/magento setup:di:compile
php bin/magento cache:flush

Assign permissions under System > Permissions > User Roles:

• File Manager > Browse and View Files
• File Manager > Edit Files

The menu is located at System > Tools > File Manager.

Extending the deny list

Edit Model/FileManager.php and add paths to DENIED_RELATIVE_PATHS or file names to DENIED_BASENAMES. Paths are relative to the Magento root and apply recursively.