PHP File Manager

/public_html/
  manager.php
  app/
  assets/

/private-or-parent-storage/
  .tyrusmanager/
    .manager_config
    .activity_log
    .login_attempts
    .blocked_ips
    backups/

Activation happens before the one-time setup. The downloadable build validates the license key against the current domain and stores the local license state in the private manager storage.

On first launch, the licensed build validates the license for the current domain and then opens the one-time setup wizard. The setup screen keeps the cinematic dark interface with its animated SVG background and Tyrus branding.

• Minimum 15 characters
• Live password strength meter with length-first scoring
• Live password match indicator for the two password fields
• Suggest strong password generates a cryptographically secure password with Web Crypto
• Show or hide either password field

• Full site URL used by Preview and the site-cache purge action
• Inline URL validation
• Logo tip: capitalize each word in the domain to split the dynamic logo into separate color groups

• Preset buttons: 10 / 20 / 50 / 100 / 200 GB, plus a custom value
• Custom GB input with step controls
• Live conversion from GB to bytes

• Password verified against the bcrypt hash in the private .tyrusmanager/.manager_config
• Change password from Settings → Security. The current password is re-verified with password_verify(), attempts are rate-limited and the new bcrypt hash is written atomically to the private .tyrusmanager/.manager_config.
• Built-in password generator with a 16–64 character length control, Web Crypto randomness and a live length-first strength meter
• Brute-force protection: failed-login state is stored privately in .tyrusmanager/.login_attempts
• Attempt 1: “Something doesn’t seem right here.”
• Attempt 2: “Interesting... do you continue?”
• Attempt 3: the IP is locked for 15 minutes and recorded in the private .tyrusmanager/.blocked_ips.
• Session timeout: 30 minutes of inactivity, followed by an automatic return to login
• A warning bar appears 2 minutes before expiry with a live countdown
• The Extend control refreshes both the browser inactivity timer and the PHP session
• Mouse, keyboard, click and scroll activity refresh the browser inactivity counter
• Actions are timestamped in the private .tyrusmanager/.activity_log; the IP address is recorded for LOGIN and LOGOUT only

During a temporary IP lockout, the normal login page is replaced by a dedicated full-screen blocked-access canvas:

• Human face drawn procedurally using ctx.bezierCurveTo and ctx.ellipse
• Eyes that follow the cursor in real time; pupils track mouse with clamped movement
• Random blinking with variable timing (randomized 180–480 frames)
• Periodic glitch effect; getImageData/putImageData slice displacement + red tint
• CRT scanlines; horizontal lines at 4px intervals across the full canvas
• Radial vignette; dark edges closing in
• Custom cursor; default cursor hidden, replaced by small red dot
• Blocked: right-click, F12, Ctrl+U/I/S, Escape, scroll
• Messages with progressive fade-in (2s and 5s delays)
• Mouse leaving window: text color shifts + letter spacing expands
• Subtle breathing animation on the body element

• Dynamic logo; generated from the site URL. Each word colored differently. Capitalizing words in the URL = separate color per word
• Disk usage bar; visual bar showing used / total space with exact MiB/GiB values. Cache refreshed every 30 minutes
• Animated language switcher; pill slides smoothly between EN / RO / DK (cubic-bezier). Zero page reload; full UI re-renders via applyUiLang(). On mobile: simple bordered buttons
• Header buttons: 📋 Log · ⚠ Errors · 🐘 PHP · ⌨ Shortcuts · 🔓/🔑 Root OFF/ON · ▶ Preview · 💾 Save · Logout

• Navigation; ← Back / → Forward with full history. Buttons disabled correctly at history boundaries
• Breadcrumb; clickable path segments for fast navigation
• Search files; filename search (max 100 results, case-insensitive, recursive)
• In files; toggle for content search panel
• New Folder / New File; modal with name input

• Resizable; drag border (min 160px, max 520px). Persisted in localStorage + sessionStorage. Double-click = reset to 270px
• SERVER FILES; full file/folder tree with type icons
• Favorites ⭐; star/unstar any file or folder. Stored server-side. Inline SVG star icon in list
• Multiple selection; checkboxes + Select All. Bulk: ZIP · Download · Rename · Delete
• Bulk ZIP; create named archive from selected items
• Bulk Download; selected as ZIP, streamed directly to browser (built via tempnam, deleted immediately after transfer)
• Multi-rename; batch rename wizard for selected files
• Upload zone; drag & drop or click. Conflict modal: Replace / Keep both (auto-numbered) / Cancel
• Content search input; search inside files from sidebar

Built on CodeMirror 5. The editor bundle is embedded in manager.php and served by the same file, with no third-party runtime CDN.

Special filename detection: .htaccess → shell · .env → shell · Dockerfile → dockerfile · Makefile → shell · .gitignore → shell · .babelrc / .eslintrc → JSON

• Bracket matching · Auto-close brackets · Active line highlight
• Code folding; foldGutter with 4 fold addons (brace, indent, XML, comment)
• Autocomplete; 5 hint engines (anyword, JS, CSS, HTML, XML). 400ms delay, min 3 chars, suppressed in strings/comments. Ctrl+Space = manual
• Comment/uncomment; Ctrl+/
• Font size control; A− / A+ in bottom bar
• Custom scrollbars; macOS-style (3px transparent border)
• Image preview; jpg, jpeg, png, gif, webp, svg, ico shown inline instead of editor

• Multiple files open simultaneously
• Drag & drop reordering; left/right drop indicator with violet box-shadow
• Modified dot; visual indicator when file has unsaved changes
• Tab context menu (right-click): Close / Close Others / Close Unmodified / Close All
• Unsaved changes warning on close

• Highlights all matches simultaneously with markText
• Active match in different color; counter display: 3 / 12
• Navigate: Enter (next) / Shift+Enter (previous)
• Replace One → / Replace All ⟳

Opens as a side panel next to the editor via the 🔍 Analyze button. Supports: .php · .css · .scss · .less · .js · .ts · .jsx · .tsx

Every save can preserve the previous version as .bak. The selected mode controls where new backups are written; existing backups remain usable when the mode changes.

• Auto — recommended: after login, a same-origin probe checks whether a harmless temporary .bak can be read over HTTP. Protected servers use sibling backups; exposed or unverified servers use private storage.
• Next to original: writes file.ext.bak beside file.ext. Use only when direct HTTP access to .bak files is blocked by the web server.
• Private storage: writes a mirrored backup path under private .tyrusmanager/backups outside the public web root. No separate backup catalog is created.

Click any .zip file → opens as panel replacing the editor area.

• Expandable tree; hierarchical with depth indentation
• Cascading checkboxes; select folder = select all children recursively. Partial selection = individual files sent
• Custom hierarchical sort; folders first, files alphabetically
• Selective extraction; intelligent prefix-stripping, no unwanted nested paths
• Conflict pre-check; shows exact files that would be overwritten before extracting
• Drag & drop extraction; drag from ZIP panel onto folder in file panel. Destination folder highlights on hover
• Full extract; extract all contents at once

Toolbar search box; recursive filename search, case-insensitive, max 100 results, instant sidebar results.

• Searches inside files; max 50 files × 5 matches per file
• Results grouped by file with match count badge
• Line number + content with search term highlighted in yellow
• Click result → opens file, jumps to exact line
• Text extensions only; skips binaries

Every save automatically creates a .bak of the previous version in the active backup location. ↕ Diff .bak and Restore resolve both sibling and private backups transparently, so switching location does not make an existing backup unusable. If a file is deleted with backup while Private storage is active, its mirrored backup remains under .tyrusmanager/backups and can be reached with ROOT ON.

• File 1: current editor file (automatic)
• File 2: click any file in sidebar while panel is open
• Stats: +N added / -N removed
• Color-coded: changed (amber/blue) · added (green) · removed (red) · separator (dark)
• Independent scrolling per column

• Pattern controls: Prefix · Suffix · Find · Replace (all combinable)
• Auto-numbering: 001, 002, 003…
• Live preview: old name → new name per file. Individual inputs editable
• Changed names highlighted yellow
• All renames in one operation with conflict detection

Every action is logged with timestamp, action type and file path. LOGIN and LOGOUT also record the IP address. The private JSON log is stored in .tyrusmanager/.activity_log, keeps the latest 50 entries and can be cleared from the Log panel.

• Parses CI4 format (LEVEL - DATE --> MSG) and PHP standard ([date] PHP Fatal error:) log formats
• Reconstructs full stack traces
• Groups by severity: Critical/Error · Warning · Notice/Info
• Collapse/expand per group
• Stack traces displayed inline with APPPATH/SYSTEMPATH highlighting
• Reverse chronological order

Root OFF (default); navigation limited to document root (public_html).

Root ON; navigate above public_html to server root. Access logs, configs, files outside web root. Warning shown as toast notification and header button changes to 🔑 Root ON when active.

All operations via manager.php?action=ACTION:

416 UI keys per language. The complete manager interface is available in EN / RO / DK.

• Zero page reload switching; switchLang() → applyUiLang() + loadFiles() + renderTabs()
• All DOM elements updated: buttons, modals, placeholders, cheatsheet (fully regenerated), ZIP hints, timeout bar
• Language persisted in a cookie and the private .tyrusmanager/.manager_config
• Animated pill switcher (desktop): cubic-bezier slide, no-transition on init to avoid flash

• Sidebar drawer; slides from left, overlay to close, auto-closes on file open / ZIP / image, stays open on folder navigate
• Long press 500ms; context menu at touch position, haptic feedback (navigator.vibrate(30)), move finger = cancel
• Tab system; max-width 90px, ellipsis, close always visible, horizontal scroll
• Diff/Compare; hidden under 768px (insufficient space for split view)

• PHP 8.0 or newer; the current build is tested through PHP 8.4
• ZipArchive is required for ZIP create, browse and extraction features
• A writable private directory outside the web root is required for manager state. The manager creates .tyrusmanager automatically when possible; TYRUS_MANAGER_STORAGE can define an explicit location.
• No Composer · No npm · No database installation · No third-party runtime CDN

Start with the exact error shown by the manager. The checks below map the most common failures to the component that actually controls them.

• Activation fails: verify the domain shown by the manager, the complete license key and outbound HTTPS access from PHP. A domain-locked key is not interchangeable between unrelated domains.
• Setup cannot save: verify that PHP can create/write the private .tyrusmanager location or configure TYRUS_MANAGER_STORAGE to a writable private path.
• ZIP actions unavailable: enable the PHP ZipArchive extension in the same runtime that serves manager.php. CLI PHP and web-server PHP may load different extensions.
• Unexpected backup location: check Settings → Backups. In Auto mode an exposed or unverified .bak probe intentionally selects private storage.
• Frequent login return: the authenticated session expires after 30 minutes of inactivity. Use the session warning/extend control when you are actively editing.

Short answers to the decisions that most often matter before deployment.