FAQ
Getting started
Where is it after installing?
Components → Next File Manager. It opens on the file browser, already pointed at your Joomla install through the built-in site place. Super Users need no configuration at all.
Do I need to set up storage before I can use it?
No. One storage and one place ship built in — the site storage, whose base always follows the live Joomla root, and the site place on it. You add storage only when you want to reach a different filesystem.
What is the difference between storage and a place?
Storage is how to reach a filesystem: a driver plus its credentials and a base. A place is a named folder on that storage, and it is the unit profiles grant. The split means one SFTP account can expose several folders under different names and access rules without its password being entered more than once.
How do I give a non-Super-User access?
Create a profile under Configuration → Profiles, tick the operations they may run, add at least one root (a place, an optional subfolder, and a write flag), set any upload limits, then assign it to the user or a user group. Users with no profile get nothing.
Can I put it on the public site?
Yes. The package installs a site component. Create a menu item of type Next File Manager → File Manager and set its access level to something that requires login. Front-end users go through the identical profile and protection checks.
Access control
Can a profiled user get above their granted folder?
No. A root is a place plus an optional subfolder, and every request is resolved by canonicalising the requested path and confirming it still sits inside that root — after symlinks are resolved, and with case folded on filesystems that ignore it. A ../ sequence never escapes.
What happens if a user has no profile?
They get nothing. Access is deny-by-default: no places, no commands, no limits that could be read as permissive.
A user is in two groups with different profiles. Which applies?
A profile assigned to the user directly wins over any assigned to their groups. Between competing group assignments, the lowest profile id wins. That precedence is what lets you put a whole group on a restrictive profile and lift one person out of it.
Is hiding a button in the interface the only enforcement?
No. Interface gating is convenience. The server independently re-checks the acting user's profile, the protected-path rules and the driver's capabilities on every request, so a hand-crafted call gets the same answer as a hidden button.
Can I let someone manage settings without making them a Super User?
Yes — the profile has a Manage settings feature gate. Note that the protection-related settings (the protected-paths list, the allow-editing-protected switch and demo mode) stay Super-User-only regardless, because they are what the rest of the model rests on.
Security
Can configuration.php be downloaded?
Not below Super User, by any route. configuration.php, .env and .env.*, *.key, *.pem and .htpasswd are treated as secret: they cannot be read, previewed, downloaded, copied, or extracted out inside a ZIP archive. This is separate from the protected-paths list, which governs writes.
What is write-protected out of the box?
configuration.php and its backups, index.php, .htaccess, .user.ini, web.config, and the administrator/, cli/, includes/ and libraries/ trees. A matched pattern protects the path and everything beneath it. Super Users can edit the list under Settings.
Can I override protection for one file?
Yes, deliberately awkwardly. Switch on Allow Super Users to unlock & edit protected files in Settings — it is off by default and Super-User-only — then use the right-click Unlock action on that specific path. Evaluation is nearest-ancestor-wins, so the override applies to that item and nothing else. Secret files are not covered by this; they stay unreadable below Super User.
How are remote credentials stored?
Encrypted in the storage row, keyed off your Joomla site secret. The plain-text value is never written to disk and never sent to the browser — the editor receives only a flag saying whether a secret is set. That is also why saving a storage's label cannot wipe its password: a blank secret field means "keep what is stored", and clearing one is a separate, explicit action.
Is extraction safe?
Yes. Every entry in an archive is checked during extraction, so an archive containing ../../configuration.php cannot write outside the target folder. That class of attack is known as Zip-Slip, and it is blocked per entry rather than per archive.
Storage & drives
Which remote protocols are supported?
SFTP over SSH, FTP and FTPS, WebDAV — including Nextcloud and ownCloud — and any S3-compatible object store: Amazon S3, MinIO, Wasabi, Cloudflare R2 and DigitalOcean Spaces.
Why are some operations unavailable on some drives?
Because the protocol genuinely cannot do them. Object stores have no real directories — an "empty folder" there is a zero-byte marker — and several protocols cannot rename in place or read byte ranges. Each driver declares its capabilities up front, the interface hides what will not work, and the server refuses it anyway if a request slips through. The alternative is a protocol-specific error from deep inside an adapter, which helps nobody.
Can I authenticate SFTP with a key?
Yes. Paste an OpenSSH private key, with its passphrase if it has one. You can also pin the host key fingerprint — Test Connection fills it in for you.
Can I move files between two different drives?
Yes. Copy and move work across drives, and the transfer is streamed rather than buffered, so a file bigger than PHP's memory limit still goes through.
Why is a storage type greyed out?
Because this server cannot run it, and the reason is shown next to it. FTP needs PHP's ftp extension; SFTP needs the phpseclib library that ships with Joomla. Saying so up front beats a fatal error at connect time.
Files & operations
Which file types can I edit?
Text and code files, in a CodeMirror editor with syntax modes for PHP, JavaScript, CSS, HTML, JSON, SQL, XML and Markdown. Binary files are not offered an editor.
Can I preview video and audio?
Yes, in the lightbox. Where the driver supports byte-range reads, media is streamed by range so you can scrub without downloading the whole file first.
How do I download several files at once?
Select them and choose the ZIP download action — you receive one archive. Protection still applies inside it: a secret file is not included for a user who could not download it directly.
Is there a size limit on uploads?
Three of them, and the smallest wins: your profile's max file size, the global ceiling in Settings, and PHP's own upload_max_filesize / post_max_size. The component cannot raise PHP's limits.
Technical
Which Joomla and PHP versions are supported?
Joomla 4, 5 and 6 on PHP 8.1 or higher. The component uses namespaced MVC and DI service providers throughout, with no deprecated APIs.
Does it need shell access or exec()?
No. Everything runs inside Joomla's own PHP process — archives use PHP's ZIP support, SFTP uses the phpseclib library bundled with Joomla, and S3 requests are signed in PHP. Only the FTP driver needs a PHP extension (ftp), and it reports its absence rather than failing.
What gets logged?
Every mutation — upload, delete, rename, move, copy, duplicate, edit, archive, extract and lock changes — with the acting user, the action, the place and the path, in the component's own log table. Read it under Activity Log, which is Super-User-only.
What happens when my session expires mid-upload?
You get an in-place re-login dialog rather than being dumped on a login page. Once you re-authenticate, the interrupted request is replayed and you carry on where you were.
What languages ship?
English (en-GB). Add any language with standard Joomla .ini files under administrator/language/<tag>/com_nextfilemanager.ini and com_nextfilemanager.sys.ini.
Is the source available?
Yes. Licensed under GNU GPL v2 or later. Sold commercially on nextsoftware.dev with priority support and update delivery; the source itself is open.