Features
A map of what Next File Manager does, with links to the page that covers each area in depth.
File browser
Everything you expect from a desktop file manager, running inside the Joomla admin.
- A tile grid with large type icons, or a dense sortable list view
- A lazy-loading folder tree covering every place you have access to
- Breadcrumbs showing the place and your path within it
- Multi-select, with a right-click context menu carrying every granted operation
- Drag a selection onto a folder tile or a tree node to move it
- An info panel with type, size, modified date, image dimensions, full path and a writable flag
- Filter chips to narrow the current folder by type
Read more: File browser
Uploads & downloads
Moving files in and out without a separate FTP client.
- Drop files anywhere on the window to queue them
- A progress queue showing each transfer and its result
- Per-profile maximum file size, allowed-extension list and always-blocked denied list
- Rules checked in the browser for fast feedback, then enforced again on the server
- Download a single file, or select several and receive one ZIP
- Copy and move across two different drives, streamed rather than buffered
Read more: Uploads & downloads
Editing & preview
Reading and changing file contents in place.
- A CodeMirror editor with syntax modes for PHP, JavaScript, CSS, HTML, JSON, SQL, XML and Markdown
- A full-screen lightbox for images and media
- Byte-range streaming so video and audio can be scrubbed without a full download
Read more: Editing & preview
Archives
Packing and unpacking without shell access.
- Create a ZIP from any selection, in place
- Extract an archive into its folder
- Zip-Slip path traversal blocked on every entry during extraction
- Archive downloads honour the same protection rules as direct downloads — a secret file cannot be smuggled out inside a ZIP
Read more: Archives
Search
Finding a file across a folder tree.
- Recursive search across the whole place you are in
- Scoped to the roots your profile grants — never wider
- Results are actionable: open, preview, download or reveal in its folder
- Available as a separate grantable command, so it can be withheld
Read more: Search
Activity log
Answering "who changed what, and when".
- Every mutation recorded: upload, delete, rename, move, copy, duplicate, edit, archive, extract and lock changes
- Each entry carries the acting user, the action, the place and the path
- A filterable, searchable data grid
- Visible to Super Users only, never exposed to profiled users
Read more: Activity log
Storage
One interface over every filesystem you use.
- Five drivers: server folder, SFTP (SSH), FTP/FTPS, WebDAV/Nextcloud, S3-compatible object storage
- Credentials encrypted at rest, keyed off the Joomla site secret, never returned to the browser
- A live connection test before saving, which fills in the SFTP host fingerprint for you
- Capability negotiation: each driver declares what it can do, and the interface hides the rest
- Drivers the server cannot run are greyed out with the reason stated
Read more: Storage · S3-compatible storage · Nextcloud & WebDAV · SFTP & FTP
Places
Naming the folders that profiles can grant.
- A place is a folder on a storage, with a label and a stable key
- One storage can carry many places, so an SFTP account exposes several folders under one password
- Profiles reference the stable key, so renaming a place or repointing its storage never breaks a grant
- The built-in
siteplace always follows the live Joomla root
Read more: Places
Profiles & access control
Joomla-native permissions that go well past on and off.
- Sixteen individually grantable commands
- Roots: a place, an optional subfolder within it, and a read-only or writable flag
- Upload limits: maximum file size, allowed extensions, always-denied extensions
- Feature gates, including who may manage component settings
- Assignment to individual Joomla users or to whole user groups, direct beating group
- Deny by default — a user with no profile gets nothing
Read more: Profiles & access control
Protection
Safe defaults a misconfigured profile cannot switch off.
- A protected-path pattern list blocking writes to a path and its whole subtree
- Secret files —
configuration.php,.env,*.key,*.pem,.htpasswd— unreadable below Super User by any route - Per-path locks, and Super-User unlock overrides gated behind a global switch that is off by default
- Every path canonicalised and re-checked against its granted root, through symlinks and on case-insensitive filesystems
Read more: Protection
Site front end
The same app, published to logged-in site users.
- Driven by a standard Joomla menu item
- The front-end dispatcher runs the identical profile checks, protection rules and command allowlist as the admin
- Session-aware: an expired session raises an in-place re-login dialog and replays the interrupted request
Read more: Site front end
Settings
The handful of global switches that apply site-wide.
- A global upload ceiling that caps every profile
- Image thumbnail generation on or off
- Interface theme, following Joomla's own colour scheme by default
- The protected-paths pattern list, and the switch that allows unlock overrides at all
Read more: Settings