The file manager
Uploading, editing, moving, archiving and extracting a website's files from the browser, with the three trees a website has and what each one is for. This page also says what the file manager refuses and why, because most of its refusals are deliberate.
Where the files are
Three trees, and only one is served.
Every website has three places to put files, and the tabs at the top of the file manager switch between them. Which one you are in matters more than anything else on this page.
| Tree | What it is for | Who can read it |
|---|---|---|
| Public | What the website serves. An index.html here is the home page. | Anybody on the internet, through the web server. |
| App | Your application's own code, for a Node.js or container website, or anything a PHP site should not serve directly. | Your application and you. Not served. |
| Private | Data an application writes and nobody should fetch: uploads it processes, caches, keys. | Your application and you. Never served. |
Putting something in Private is the difference between a file nobody can fetch and a file anybody can fetch if they guess the name. If you are not sure, that is the one to use.
Getting files in
Drag them onto the list, or press the button.
Drop files anywhere on the listing and they upload into the folder you are looking at. The button does the same thing for anybody who would rather pick them. While it runs it says how far through it is and which file of how many, so a large upload does not look like a hung page.
One file is at most 64 MiB. For anything larger, or for a whole tree of files, use SFTP: it is the right tool for a thousand files and the file manager is the right tool for ten.
A name that already exists is not overwritten quietly. The upload stops and says which name it was.
Editing
Open a file, change it, save it.
Click a file to open it in the editor. Files up to 2 MiB open; past that the file manager offers the download instead, because an editor holding a twenty megabyte log in a browser tab is not an editor anybody wants.
A dotfile is an ordinary file here. .env, .htaccess and .user.ini are the files most applications keep their settings in, and they open and save like any other.
Moving things
Rename, copy, move.
Rename changes a name in place. Copy makes a second file beside the first. Move puts something into another folder, and it takes a folder path from the top of the tree: app/config rather than a name.
Leave the destination empty to move something to the top of the tree. That is the answer to the commonest version of this: an archive that unpacked into a folder of its own, leaving the application one level below where it has to be. Tick everything inside that folder, press Move, leave the box empty, and it all comes up.
Nothing is replaced by a move. If the destination already holds one of the names, the move stops at that one and says so, and the ones already moved stay moved.
Archives
Make a zip, or unpack one.
Tick what you want and press Archive to make a .zip of it. To unpack, use the archive's own extract button: .zip, .tar.gz and .tgz can be extracted.
It unpacks beside the archive. Leave the destination empty and the contents land in the same folder the archive is in, wherever that is. Type a name and that folder is made there, beside the archive, rather than at the top of the tree.
Three things an extraction will not do, each on purpose:
- It never replaces a file you already have. The extraction stops and says which name it was, so an archive unpacked over a live website cannot quietly overwrite a configuration file.
- It writes nothing but plain files and folders. A symlink inside an archive is the classic way out of a directory, so one is not created, and neither is anything else with a type of its own.
- It stops a compression bomb partway. At most 20,000 files and 2 GiB come out of one archive, counted as it goes rather than after the disk is full.
Permissions
What you can set, and the one thing you cannot.
A file or folder's permissions can be changed from its own row, from the usual three digits. What is not offered is write access for the group or for everybody, and that is deliberate: the web server reads your files through the group, so a group-writable file is a file the web server could change. An application that genuinely needs to write somewhere writes into its own folder, which it owns.
If something will not save and you have just changed permissions, that is almost always why. Files want 640, folders 750.
Finding and removing
Search, and delete.
Search takes two characters or more and looks through the tree you are in, replacing the listing with what it found. Clearing it puts you back where you were browsing.
Deleting one named thing asks first, and a folder has to be empty. Deleting everything you have ticked is a different dialog and it will take a folder with what is inside it, because that is what somebody ticking twelve things means. Neither can be undone from here: a recovery point is what gets a file back.
What it cannot reach
Inside the website, and nowhere else.
Every path is resolved inside the website's own tree, and a path that climbs out of it is refused rather than followed. That applies to a path typed into a form and to a name inside an archive, which is the same check in both places.
It also cannot reach the website's home directory itself, only the three trees below it. A website's SSH keys and shell profile are not files the file manager can see.