Joomla! Issue Tracker | Joomla! CMS #29564 - [4.0] Media Manager delete eveerything

No Code Attached Yet bug

Confirmed
Medium
Build: 4.0-b2-dev
# 29564

brianteeman
10 Jun 2020

With the new media manager it is possible to download or delete any file

Steps to reproduce the issue

in the filesystem local plugin create a directory such as adminitrator
in the media manager options set xml and php as allowed filteypes
use the media manager to browse the administrator and to download and delete anything

Additional comments

You can say its a stupid user issue but we know users are stupid

brianteeman - open - 10 Jun 2020

joomla-cms-bot - change - 10 Jun 2020

Labels

Added: ?

joomla-cms-bot - labeled - 10 Jun 2020

gerryfrancis - comment - 10 Jun 2020

we know users are stupid

Actually some of them, yes. ;)

PhilETaylor - comment - 10 Jun 2020

#20367

joomla-projects/media-manager-improvement#469

Edit; ah I see by "everything" you mean you can manipulate to delete xml/php as well as images, and not as the above issues, delete "everything" with just two clicks

HOWEVER:
Note that if you delete a FOLDER that contains xml/php/pdf and images, REGARDLESS of the allowed file types, ALL the files are deleted from that folder...