folder-explorer

A browser that focuses on the disk space that folders takes up.

⬇ Download the newest version (folder-explorer-boot.zip, about 1 MB) - one installer: unpack it on your web server, open folder-explorer-install.php in the browser, choose a folder and your administrator - done. See Minimal installation - all versions: Releases.

Built with php2html – Clever HTML Engine, a PHP library that writes the HTML for you: every field, table, card and menu of this program is one PHP call. Folder-explorer is a real-world example of it, especially of the advanced table function htm_Table(). A taste of the code (the login card, shortened):

htm_Card_(capt:'@Log in', icon:'fas fa-user-check', form:'signup', clas:'cardW320');
    htm_Input(labl:'@Your account',  vrnt:'text', name:'p2h_usr', hint:'@Type account name', attr:'required');
    htm_Input(labl:'@Your password', vrnt:'pass', name:'p2h_pwd', hint:'@Type your password for your account', attr:'required');
htm_Card_end();

Install the library for your own projects with composer require ev-soft/clever-html-engine or from GitHub.

Look / try a demo here - it runs on PHP 8.5 (requires PHP 8.1 or newer)

Description:

With Folder Explorer, you can browse files and folders on a web server and see used space.

The file list are displayed in a table, where you can sort and filter the data.

Analyse mode: content in subfolders is analyzed, so that file-data for the entire subtree can be displayed.

For example, you can search for a filename in the subtrees.

File/Folder space is also displayed graphically.

Quick mode: it speeds up and works like a typical file-browser without analyzing subfolder content. One button in the header of the Folder-Details card switches between the two modes (the search field is beside it).

Menus - most of the program is in them:

Menu	How to open it	What is in it
File menu	rest the mouse on a file name, click it - or right-click the row	view, download, properties, share link, basket, edit, rename / move, copy, ZIP, unpack, delete
Folder menu	right-click the row of a folder	open, download as ZIP, properties, share link, basket, rename, copy, ZIP, synchronize, delete
Program menu	right-click the table outside the rows	trash, shared links, change my password, help, about, log out - administrators also: users, activity log, translations, remove restrictions
Card menu	right-click a card heading	fold / open all cards, heights, the original order

Keyboard: the menu key or Shift+F10 (on a row: its menu - elsewhere in the table: the program menu), arrow up / down, Esc. Touch screen: a long press is a right-click. The line below the table says it too.

Folder tree:

• Drawn connector lines and folder icons; the level number of each folder at the far left and a level axis below the tree.
• Only the current folder is shown in bold with an open folder icon.
• The card tool hdd icon shows the used space of every folder as a column: size, a share bar and the total above the tree. The bars can show the share of the parent folder or of BASE.
• The card can be dragged to its full height with the size grip.

What is new in 2.4.2:

• Closed cards all have the same height (38 px) - also Folder content in Analyse mode (Gallery and Duplicates only as icons while it is closed).
• The cards fill the page also with a page zoom below 100 % (90 % left 10 % unused at the sides) - and a centred card (Transfer, Folder tree) can be dragged to the full width: its size grip now follows the mouse (php2html 1.9.3 bundled).
• The hint of the size grip of Folder content is no longer hidden behind the locked file features.
• UPLOAD is in its own field (From your PC:) - on one line with the other buttons of the Transfer card.
• The menus are told: a line below the table says where the right-click menus are - and the README has a Menus table.
• Manual: users (make, change, delete), share links, edit, duplicates, search - and limits, your account, keys.

Updating from 2.4.1: replace folder-explorer.php, php2html.lib.php and _trans.sys.json.

What is new in 2.4.1:

• Files without a known type (error_log, access_log.1, LICENSE ...): the content decides - text is previewed, searched and edited as text, with the text icon; binary files stay hex.
• Share links of a deleted account are deleted with it (a new account of the same name got them back).
• The cached ZIP of a shared folder no longer has the link token in its name (the temp folder may be shared on a web hotel).
• Editor: one old version per file per 15 minutes goes into the trash (many saves pushed deleted files out of the trash) - and the line ends most lines have are kept (one CRLF made all lines CRLF; CR-only files got LF).
• Gallery: one thumbnail is made at a time (big photos at once could use a lot of memory on the server).
• README: a download link to the newest boot file at the top.

Updating from 2.4.0: replace folder-explorer.php and _trans.sys.json.

What is new in 2.4.0:

• Share link (file and folder menu): a link for people without an account - it works for 1, 7, 30 or $fe_share_days days (administrators: also without an end) and may have a password. A folder is fetched as one ZIP file. The link works only while its maker may still download the file - program menu Shared links: copy, see the downloads, delete. Stored in fe-shares.php. The page of the link speaks the language of the browser, when there is a translation.
• Edit (file menu): text files up to 2 MB in a folder you may write in - Ctrl+S saves, the old version goes to the trash, the line ends and a byte order mark are kept. Changed by someone else meanwhile: you are asked before your version replaces it.
• Edit with TinyMCE (file menu of an HTML file): a word-processor view - only the body is edited (the head is kept), <script>, <style> and PHP tags are kept as they are, relative images are shown when the folder is on the web. TinyMCE (8.9.3, cdnjs) and its language pack (tinymce-i18n, jsdelivr) are fetched the first time it is used, not on every page - settings $fe_tinymce_url and $fe_tinymce_lang ('' = not offered / English). Without internet access the text editor is used.
• Search in all subfolders - also in Quick mode: the search field in the heading of Folder content searches this folder and all below it, by name (* and ? for the whole name) and if you like in the text of text files you may download (up to 2 MB per file).
• Gallery (button in the heading of Folder content): the files as tiles, images as small pictures made with GD (kept a week in the temp folder) - a tile opens the file menu, a double-click views it, the check box selects it. Remembered in the browser.
• Duplicates (Analyse mode): files with the same content in this folder and below it (the same size, the same first 64 KB, the same SHA-1) - the most space to save first, with a button to move a copy to the trash.
• The download icon before the file name is gone - Download is in the file menu (rest the mouse on the name, or right-click the row).
• The checked rows: the status text below All / None / Inverse / Basket; the file features are locked to the bottom of the scrolling file window; the file window is higher; the line below the card headings; the % text on the bar of Used space.
• Fixed: ?dl[]=x (and fsz, pv, fdl) gave a PHP warning.

Updating from 2.3.x: replace folder-explorer.php, fe-preview.js and _trans.sys.json. New files made by the program: fe-shares.php (the share links).

What is new in 2.3.3:

• The checked rows below the table: how many - and the total size of the checked files, beside All / None / Inverse (folders are counted in Analyse mode).
• README: the minimal installation, the requirements and the first log-in.
• The boot file folder-explorer-<version>-boot.zip: one installer that unpacks the program in a new folder and makes the first administrator.

Updating from 2.3.x: replace folder-explorer.php and _trans.sys.json.

What is new in 2.3.2:

• Security (important): a request with csvFile=<name> made the table write a file of that name in the program folder - any logged-in account, also a read only demo account, could overwrite folder-explorer.php or fe-users.php. Removed - please update.
• Deleting one file with the trash switched off could remove a file of the program - refused now.
• A ZIP made of a folder x.php was called x.php.zip (a name upload and rename refuse) - now x_php.zip.
• ?show[]=x gave a fatal error - and file names with invalid UTF-8 (old Latin-1 names on Linux) are shown again.
• Layout: the Transfer card is below the folder content, and the manual is a card of its own at the bottom of the page.

Updating from 2.3.x: replace folder-explorer.php and _trans.sys.json.

What is new in 2.3.1:

• Built with php2html 1.9.2 - ten fixes, among them: My notes are kept per program folder (other programs on the same domain saw them), number fields accept units longer than 4 characters, choices with & or ' are marked again, and the log-in always waits after wrong passwords.

Updating from 2.3.0: replace php2html.lib.php and _trans.sys.json.

What is new in 2.3.0:

• A taken name - you choose: the field A taken name on the Transfer card decides what copy, move, unpack and upload do when the name is there already - remembered in your browser:

  • Stop and ask (the default): nothing is done before you answer. A dialog shows each taken name with the size and date of the new one and of the one there (the newer date in bold) - choose for each, or one choice for All. Cancel does nothing. Upload asks before the files are sent.
  • New name - name (2), as before.
  • Overwrite - the old file goes to the trash (it can be restored there).
  • Skip - the one there is kept.

  Two folders of the same name are merged: the files inside follow the choice. A file against a folder of the same name only gets a new name - and a protected file is never replaced. The message lists what was renamed, overwritten and skipped.

• Without JavaScript nothing is overwritten: name (2), as before.

• Safer: the files of the program (its PHP files, fe-*.js, _trans*.json, the accounts, _assets) are never overwritten, deleted, renamed / moved or synchronized over - also with the restrictions removed. Before, a write account with the program folder as a write folder could replace a script of the program.

• The quota of the shared folder counts only the difference when a file is overwritten.

What is new in 2.2.1:

• A taken name is told: when a copy, move or unpack had to save a file as name (2), the message lists it (report.pdf → report (2).pdf).
• Faster pages: php2html loads only the libraries a page uses - the login page loads no jQuery and no Tablesorter.
• Caps Lock warning at the password field of the login - shown only while Caps Lock is on.
• Built with php2html 1.9.1 (bundled, with p2h_audit.inc.php and p2h_trans.inc.php).

Updating from 2.2.0: replace the program files (folder-explorer.php, php2html.lib.php, p2h_audit.inc.php, p2h_trans.inc.php, fe-*.js, _trans.sys.json) - copy your settings at the top of folder-explorer.php over; the accounts in fe-users.php stay.

What is new in 2.2.0:

• Trash: what is deleted goes to the trash (program menu - Trash, or the link in the message): restore it to its folder, delete it for good, or empty the trash. Everybody sees what was deleted in the folders they may write in, administrators all of it. Deleted for good after 30 days - and the oldest first above 500 MB ($fe_trash_days, $fe_trash_max). A hidden folder, never shown or browsed.
• Activity log (administrators: program menu - Activity log): who did what, when and from where - logins (also failed and blocked), uploads, downloads, copy, move, ZIP, delete, trash, users, passwords, translations - with the result.
• Translations in the program (administrators: program menu - Translations): choose a language (a list with flags), search, the missing texts first; Suggestions without a key (the translator of the browser, else MyMemory) or Copy for AI - the whole table for ChatGPT / Claude, and its answer pasted back. Only the changed texts are saved. A new language is in the language selector as soon as it has a translation; 51 languages have a flag (all of Europe), $gbl_Flags adds more.
• Manual below the table - eight tabs: Nice to know, Step by step, Questions, Mouse and keys, Your account (your rights, here), Limits (the numbers of this installation), File viewers, About.
• Keyboard in the table: Ctrl+A checks all rows, Ctrl+Shift+A none, Delete deletes (into the trash), F2 renames.
• Analyse mode shows the used space of every folder in the tree - each folder counted once.
• Danish everywhere: about 75 texts that were still English (the buttons below the table, messages, column headings).
• Safer: the folder of the program (and the trash) is never deleted or moved - also with the restrictions removed; All / Inverse only check the rows the filter shows; the public developer tool translate.page.php is removed (with translate.inc.php and filedata.inc.php); hints stand at their own button; the buttons keep their colours in the dark and custom themes.
• Fixes: trash names with : ? * were lost, synchronize found the destination as shown and counts the quota by what it copies, the max file size leaves room for the rest of the upload, the tree forgets old sizes after a change - and more (see the commits).
• Built with php2html 1.8.0 (bundled, with p2h_audit.inc.php and p2h_trans.inc.php).

What is new in 2.1.0:

• Transfer with a basket (source -> destination) replaces the exchange area card: collect files and folders from any folder in the basket, go to the destination folder, and Copy here / Move here - or Download as ZIP to your PC. Upload from your PC goes to the folder you are in, and a ZIP file is unpacked there with Unpack here. See Transfer below.
• File features below the table work now (were Future file features): select all / none / inverse, put the checked rows in the basket, and for the checked rows: COPY / MOVE / Create ZIP to the Destination folder (empty = this folder; the folders you may write in are suggested), DELETE (folders with their content - protected files and the folders they are in are kept), Property (number and size) and DOWNLOAD (one file directly, more as a ZIP). UPLOAD opens the file chooser of the Transfer card.
• Write folders per account: the 4th field of $auth_users lists the folders an account may write in.
• File preview: rest the mouse on a file icon in Folder-Details:
  • images, video (plays muted), audio (length), fonts (sample text) - everywhere;
  • code and text with syntax colours and line numbers (the first 40 lines), PDF, the file list of a ZIP and the text of Word / ODT - only where you may read the content (your write folders and the shared folder). Elsewhere the preview says so.
  • tables: CSV / TSV, Excel (xlsx) and Calc (ods) - the first 40 rows; the text of PowerPoint (pptx), Impress (odp), RTF and e-books (epub); the file list of tar, tar.gz / tgz (and a single .gz: its text); any other file you may read: its first 512 bytes (hex) and its type.
  • In Analyse mode the file information is shown below the preview. fe-preview.js has no external library.
• File menu: rest the mouse on a file name: View, Download, File properties, Put in / take out of the basket - and in a folder you may write in: Rename / move (also into a subfolder: sub/name.ext), Copy file, Create ZIP, Unpack here (a ZIP) and Delete file. Actions you may not do are greyed, with the reason below. Nothing is ever overwritten.
• Program menu (right-click the table outside a row): Users ... (administrators), Change my password, Remove / restore restrictions (administrators), Help, About, Log out.
• Users (administrators): create, change and delete accounts - right (read / read + write), write folders, administrator, password. Saved in fe-users.php next to the program (password hashes only; a PHP file, it shows nothing in the browser). When it exists it replaces $auth_users and $fe_admins in folder-explorer.php. You can not delete yourself or remove the last administrator.
• Change my password: every account that may write, and administrators (not a read only demo account).
• Right-click a row: the same menu - for a file, and for a folder: Open the folder, Download as ZIP, Folder properties, basket, Rename / move folder, Copy folder, Create ZIP, Synchronize to ..., Delete folder - and New folder where you may write. (The old demo menu and the two demo buttons beside a folder name in Analyse mode are removed.) Synchronize to ... copies what is missing or newer in the folder to a destination folder; an older file there is replaced, nothing is deleted.
• Folder sizes in the tree are shown at once: closed folders are counted afterwards in the browser, two at a time (fe-tree.js, ?fsz=), and remembered 15 minutes - a whole disk no longer holds the page back. Only the current folder and its sub folders are counted at once; the rest of the tree is counted when you click its calculator icon, or Count all (at BASE everything is counted as before).
• Long work is not stopped after 30 s: Analyse, the folder sizes of the tree and copy / ZIP of big folders extend PHP's time limit while they work - up to $fe_max_time (default 300 s). The web server may still have its own limit.
• No session timeout: an open page keeps the login alive by itself ($gbl_SessionKeep= true, the default). You are logged out when you log out, or when no page has been open for the session lifetime. Set $gbl_SessionKeep= false; to get the old behaviour: logged out after session.gc_maxlifetime without activity, with a warning dialog.
• Login and safety: at most 10 failed logins per address and account in 15 minutes, the slider is checked on the server, a password change logs out the other sessions, log out needs the session token, a new CSRF token at login, and after login you are back in the folder you asked for.
• Keyboard, touch and dark theme: all menus by keyboard (Enter, menu key, Shift+F10, arrows, Esc), by a tap or a long press on touch screens; every part of the program follows the light / dark theme.
• More file types in the preview: tables (CSV, TSV, Excel, Calc - with dates), PowerPoint, Impress, RTF, e-books, tar archives, UTF-16 text, and the first bytes (hex) of any other file you may read.
• Hex view and Develop cards removed; the demo leftovers (program menu items, "forgotten password", e-mail field) are gone or work.
• The unused Base-path field on the login page and the setting $locked_path are removed.
• Bundled php2html (Clever-Html-Engine) 1.7.5.

Updating from 2.0.0:

1. Copy all the files over the old ones, also the new fe-preview.js, fe-tree.js and _trans.sys.json. Keep your folder-explorer.php settings.
2. $auth_users got a 4th field: the write folders of each account ([''] = everything, missing = the shared folder _exchange). Or make the accounts in the program: program menu (right-click the table) - Users. They are then saved in fe-users.php.
3. The Exchange area card is now the Transfer card (basket, destination, upload).

What is new in 2.0.0 (update from 1.4.0):

• Security: browsing locked to $fe_root_path, login before any data is read, escaped output, CSRF token on every POST.
• Exchange area for upload / download / delete between the server and your PC (drag and drop, folders, batches).
• Remove restrictions for administrators ($fe_admins).
• Folder tree with levels, connector lines and the used space of every folder.
• Quick / Analyse in one toggle button (were Simple / Advanced); search and mode in the card header.
• View bar with the logged in user and logout (the old Language and green Logout buttons are removed).
• Library hints instead of browser tooltips everywhere; sizes in columns with 2 decimals.
• Bundled php2html upgraded from 1.4.2 to 1.7.4. PHP 8.1 or newer is now required.

Updating from 1.4.0:

1. Keep a copy of your folder-explorer.php (your $auth_users).
2. Copy all the new files over the old ones, also the folder _assets/ and the new fe-upload.js, favicon.svg, _trans.sys.json.
3. Put your $auth_users lines back into the new folder-explorer.php. The 1.4 setting $locked_path is not used - use $fe_root_path (see Security / configuration).
4. The folders _cache/ and _exchange/ are created automatically - the web server must be able to write them.
5. 2.1: add the write folders as the 4th field of each account in $auth_users (see Transfer).

Transfer - basket, write folders, upload and download:

• Write folders: the 4th field of an account in $auth_users lists the folders it may write in, below $fe_root_path ('' = all of it). Default: fe-admin everything, fe-user _exchange, visitor nothing (read only). An account with w without the 4th field writes in the shared folder $fe_exchange_path (_exchange/). A write folder that does not exist is created with a .htaccess that blocks direct web access. An existing folder is used as it is - files uploaded to a folder the web server shows can be opened directly in the browser, so choose such folders with care.
• Read (download, preview of the content): in the account's write folders, and in the shared folder for accounts with r. Server scripts, server config and hidden files are never served (except to an administrator without restrictions).
• Basket: put files and folders in it from any folder you can see - with the file menu, or check rows and click Put the checked rows in the basket. Then choose the destination:
  • Copy here - everything you may read is copied (folders with their content); the basket is kept.
  • Move here - from folders you may write in; moved items leave the basket.
  • Download as ZIP - one ZIP file with everything in the basket you may read.
  • Nothing is ever overwritten: name (2).ext, folder (2) - the message after the copy or move lists the names that were changed (report.pdf → report (2).pdf, at most 5, then (+3)). The same for Unpack here and the checked rows.
• Destination: one field in the Transfer card for upload and the basket - the folder you are in when you may write there, else your first write folder. Choose one of your write folders, or type a folder below it (folder-explorer/_exchange/photos).
• Upload: to the destination, drag files or whole folders from your PC onto the drop zone, or use Choose files / Choose a folder. A list shows every file with a check box; files the server would refuse are marked with the reason and not sent. Folder structure is kept, and large selections are sent in batches that fit PHP's max_file_uploads / post_max_size (fe-upload.js; without JavaScript the plain file field still works).
• Unpack a ZIP: file menu Unpack here - in the folder of the ZIP. Refused: ../ and absolute paths, hidden files and folders, server scripts; at most 20000 files; never over an existing file.
• Server scripts (.php, .phtml, .phar, .cgi, .py, .sh ..., also as a double extension like x.php.jpg), server config and hidden files are refused everywhere.
• Limits: $fe_max_upload per file (20 MB); $fe_exchange_quota (200 MB) for the shared folder only - PHP's upload_max_filesize and post_max_size also apply.

Settings (near the top of folder-explorer.php - each can also be set before the file is included):

Setting	Default	Meaning
$fe_root_path	the program folder	browsing never goes above it
$fe_exchange_path	_exchange	the shared folder (closed for direct web access)
$fe_max_upload	20 MB	max size per uploaded file (PHP's own limits also apply)
$fe_exchange_quota	200 MB	max total size of the shared folder
$fe_admins	['fe-admin']	administrators (replaced by fe-users.php when it exists)
$fe_unlocked_root	the folder above the web root	what an administrator sees without restrictions
$fe_users_file	fe-users.php	the accounts made in the program (program menu - Users)
$fe_demo_login	['visitor', 'xxxxxxxx']	the login form suggests this demo account - only while its password is still this one
$fe_max_time	300 s	long work (Analyse, sizes, copy, ZIP) may extend PHP's time limit up to this
$gbl_SessionKeep	true	an open page keeps the login alive
$gbl_AuditFile	fe-audit.log.php	the activity log (program menu - Activity log)
$gbl_TransFile	_trans.sys.json	the translations (program menu - Translations)
$gbl_Flags	[]	own flags for the language selector: ['el' => ['0 0 3 2', '<rect .../>']] - a new language: program menu - Translations
$fe_trash_path	.fe-trash	the trash (program menu - Trash): a hidden folder next to the program, never shown in the tree
$fe_trash_days	30	days in the trash before it is deleted for good - 0: no trash, deleted at once
$fe_trash_max	500 MB	bytes in the trash - above it the oldest are deleted for good
$fe_shares_file	fe-shares.php	the share links (file menu - Share link, program menu - Shared links)
$fe_share_days	90	the longest time a share link may work - 0: no share links
$fe_tinymce_url	cdnjs TinyMCE 8.9.3	where TinyMCE is fetched (Edit with TinyMCE) - '': not offered, '_assets/tinymce/': a local copy
$fe_tinymce_lang	jsdelivr tinymce-i18n	the language packs of TinyMCE - '': English

Login and safety:

• At most 10 failed logins per address and account in 15 minutes; the slider Are you human? is checked on the server too.
• A password change logs out the other sessions of the account. Log out needs the token of the session (a link on another site can not log you out).
• Accounts and passwords: program menu (right-click the table) - Users / Change my password.
• Activity log (administrators: program menu - Activity log): who did what, when and from where - logins (also failed and blocked ones), log out, upload, download, rename / move, copy, ZIP, unpack, new folder, synchronize, delete, basket and checked-row actions, users, passwords and the restrictions - with the result. Saved in fe-audit.log.php next to the program (a PHP file: it shows nothing in the browser); at 2 MB it is renamed to fe-audit.log.old.php and a new one is started. It needs p2h_audit.inc.php.
• Translations (administrators: program menu - Translations): the texts of the program in another language - choose the language, search, the missing first, Suggestions for them (the translator of the browser - else MyMemory, free, no key) - or better: Copy for AI, the whole table for an AI chat, and its answer pasted back; only the changed texts are saved (into _trans.sys.json, the old file kept as _trans.sys.bak.json). Simple HTML (b, i, br, code) is allowed - never a script. It needs p2h_trans.inc.php.
• Trash: what is deleted goes to the trash (program menu - Trash, or the link in the message): restore it to its folder (a name taken there: name (2)), delete it for good, or empty the trash. Everybody sees what was deleted in the folders they may write in, administrators all of it. Deleted for good after 30 days - and the oldest first above 500 MB.

Keyboard, touch, theme:

• Tab to a file name and Enter, or the menu key / Shift+F10 on a row: the file / folder menu; outside a row: the program menu. Arrow up / down in the menu, Esc or Tab closes it.
• In the table: Ctrl+A checks all rows, Ctrl+Shift+A none - Delete deletes the checked rows (none checked: the row you are on) - F2 renames the row you are on (or the one checked row).
• Touch screens: tap a file name, or press long on a row (or the table) - the same menus.
• The light / dark theme of the view bar applies to all parts of the program.

Remove restrictions (administrators only):

• Accounts in $fe_admins (default fe-admin) get a lock icon in the Transfer card. For that session only: browse, download and write everywhere below $fe_unlocked_root (default: the folder above the web root, e.g. /home/<account>), any file type, and no quota or size limit of its own (PHP's limits still apply).
• Still refused: hidden files (.htaccess, .user.ini ...).
• A red banner shows while the restrictions are removed; Restore restrictions, logout or a new login ends it.

Requirements:

• PHP 8.1 or newer (tested on 8.3 and 8.5). short_open_tag is not needed.
• PHP extensions: mbstring (required). Optional - the program works without them, only that feature is missing: zip (create / unpack ZIP, download several files as one ZIP, preview of ZIP and Office files), fileinfo (the file type in File properties), xmlreader (preview of spreadsheets).
• Web server: Apache or LiteSpeed (the program closes its folders with .htaccess). On nginx those files do nothing: deny direct access to the write folders, the shared folder and .fe-trash/ in the server configuration yourself.
• Browser: a current browser. jQuery, Tablesorter and Font Awesome are loaded from cdnjs.cloudflare.com - without internet access copy _assets/ too and add $gbl_LibSource= '1'; at the top of folder-explorer.php, before the line require_once (__DIR__.'/php2html.lib.php');.
• Built with Clever-Html-Engine / PHP2HTML 1.9.2 (bundled, with its modules p2h_audit.inc.php and p2h_trans.inc.php) - the bundled copy is always used.

Minimal installation:

The easiest way - the boot file: folder-explorer-boot.zip (the newest version) - or folder-explorer-<version>-boot.zip on the release page holds one file, folder-explorer-install.php. Unpack it on the web server and open it in the browser: it checks PHP and the folder, asks for a folder name and your administrator (name and password) - unpacks the program in the new folder, writes fe-users.php and deletes itself. Choose Minimal (the 7 required files, English only), Standard (and the other languages, the icon, README - recommended) or Maximal (and the local libraries _assets/ - without internet access). (Made with php tools/make-boot.php.)

By hand: Required - 7 files, about 0.9 MB, in one folder on the web server:

File	What
folder-explorer.php	the program (open this one in the browser)
php2html.lib.php	the HTML library
p2h_audit.inc.php	the activity log
p2h_trans.inc.php	the translations (also the editor of administrators)
fe-preview.js	the file and folder menus, the preview, the keyboard in the table
fe-tree.js	the used space in the folder tree
fe-upload.js	upload: the file list, drag and drop, batches

Optional:

File / folder	Size	Without it
_trans.sys.json	0.26 MB	English only (it holds Danish and the other languages)
_assets/	2.4 MB	the libraries come from the CDN - needed only with $gbl_LibSource= '1' (no internet access)
favicon.svg		no icon in the browser tab
README.md, .gitignore		-

Made by the program (the folder must be writable by the web server): _exchange/ (the shared folder, closed with .htaccess), .fe-trash/ (the trash), _cache/ (CSS / JS cache - only faster, the page works without it), fe-audit.log.php (the activity log), fe-users.php (the accounts - when they are saved in the program) and fe-shares.php (the share links). The log and the accounts are PHP files and the folders are closed: opened in the browser they show nothing (_cache/ holds only the CSS / JS of the library).

The first log-in: the accounts in folder-explorer.php are examples - their passwords are not published. Make your own administrator before the first log-in:

1. Make a password hash - on the server or any PC with PHP: php -r "echo password_hash('your password', PASSWORD_DEFAULT), PHP_EOL;"
2. Save a file fe-users.php next to the program (it replaces the example accounts):

   <?php return ['users' => ['admin' => ['$2y$10$...the hash...', 'root', 'rwx', ['']]], 'admins' => ['admin']];

   [''] = it may write everywhere below the root folder ($fe_root_path) - e.g. ['_exchange', 'docs'] for some folders only.
3. Open folder-explorer.php, log in as admin - and make the other accounts in the program: right-click the table - Users.

Security / configuration:

• Browsing is restricted to $fe_root_path (default: the folder containing folder-explorer.php) and its subfolders. Paths outside it (also via ../) fall back to the root. Set $fe_root_path near the top of folder-explorer.php to change it.
• Accounts: see The first log-in above - then the program menu (right-click the table) - Users. Only password hashes are saved.
• Change or remove the example and demo accounts before you put the program on a public server.
• All POST forms carry a CSRF token (php2html 1.7) - a POST without a valid token is rejected with 403.
• $gbl_SessionKeep (default true): an open page keeps the session alive. On a shared computer, set it to false.