[GH-ISSUE #1327] Recursively Create Directories Failed or Not Supported #846

New issue

Open

opened 2026-03-02 16:01:46 +03:00 by kerem · 1 comment

kerem commented

2026-03-02 16:01:46 +03:00

Owner

Originally created by @marsteel on GitHub (Jun 18, 2025).
Original GitHub issue: https://github.com/prasathmani/tinyfilemanager/issues/1327

To reproduce
Tiny File Manager 2.6

Create New Item
Item Type - Folder
Item Name - /sftpgo/sftpgodata

Folder sftpgosftpgodata is created

Originally created by @marsteel on GitHub (Jun 18, 2025). Original GitHub issue: https://github.com/prasathmani/tinyfilemanager/issues/1327 To reproduce [Tiny File Manager 2.6](https://tinyfilemanager.github.io/) Create New Item Item Type - `Folder` Item Name - `/sftpgo/sftpgodata` Folder `sftpgosftpgodata` is created

kerem commented

2026-03-02 16:01:47 +03:00

Author

Owner

@smalos commented on GitHub (Jun 19, 2025):

In the code, there is a cleaning step for the folder name before creation:

$new = str_replace('/', '', fm_clean_path(strip_tags($_POST['newfilename'])));

This line removes all slashes (/) from the folder name. As a result, the input /sftpgo/sftpgodata becomes sftpgosftpgodata.

The question is whether this behavior is intentional for security reasons, or if nested folder creation should be permitted.

@smalos commented on GitHub (Jun 19, 2025): In the code, there is a cleaning step for the folder name before creation: `$new = str_replace('/', '', fm_clean_path(strip_tags($_POST['newfilename'])));` This line removes all slashes (/) from the folder name. As a result, the input /sftpgo/sftpgodata becomes sftpgosftpgodata. The question is whether this behavior is intentional for security reasons, or if nested folder creation should be permitted.