Secure administrator file manager for Joomla 5 & 6 · v1.0.0
Overview
Root Explorer is a file manager that runs inside the Joomla administrator. It lets you browse, edit, upload, download and organise your site's files without FTP or a hosting control panel. All activity is restricted to Super Users and confined ("sandboxed") to a configurable root folder.
Requirements
| Joomla | 5.0 or newer (also runs on 6.x) |
|---|---|
| PHP | 8.1 or newer |
| PHP extensions | zip — required for the zip / extract features |
| Access level | Super User (core.admin) |
Installation
- Log in to the Joomla administrator as a Super User.
- Go to System → Install → Extensions.
- On the Upload Package File tab, drop in
com_rootexplorer-1.0.0.zip. - Wait for the success message.
- Open it from Components → Root Explorer.
Updating later uses the same package or the built-in updater — see Updates.
Configuration
Open Components → Root Explorer, then click Options (top right). There is one setting:
| Base Path | The root folder Root Explorer is jailed to. Enter an absolute path (e.g. /var/www/html) or a path relative to your Joomla root (e.g. images). Leave it empty to use the Joomla root — the recommended default. |
|---|
/ to browse the entire server filesystem. Only do this if your host's open_basedir allows it and you understand the exposure. On shared hosting this is usually restricted — keep the default Joomla-root jail.The interface
The screen has four zones:
- Toolbar — actions: Up, Refresh, New Folder, New File, Upload, Copy, Move, Zip, Delete.
- Breadcrumb — your current path; click any segment to jump there.
/ (root)returns to the Base Path. - File table — name, size, permissions and modified date, with per-row actions on the right.
- Status bar — confirmation or error messages after each action.
Browsing
- Click a folder name to open it.
- Click Up to go to the parent folder, or use the breadcrumb.
- Click Refresh to reload the current folder.
- Use the header checkbox to select all items, or the per-row checkboxes for a subset. Copy, Move, Zip and Delete act on the selection.
Create & upload
- New Folder / New File — enter a name; it is created in the current folder.
- Upload — pick one or more files; they are uploaded into the current folder. Multiple files at once are supported.
upload_max_filesize, post_max_size). Adjust those on the host if you need bigger uploads.Editing files
Click a text file name (or its Edit action) to open the built-in editor. Recognised text types include php, html, css, js, json, xml, ini, txt, md, sql, htaccess, yml, conf and more. Save with the Save button or Ctrl/Cmd + S; press Esc to close.
Rename, copy, move, delete
- Rename — per-row action; enter the new name.
- Copy — select items, click Copy, enter a destination folder path (from root).
- Move — same as Copy, but the originals are moved.
- Delete — select items and confirm. Folders are deleted recursively.
Permissions (chmod)
Use the CHMOD row action and enter an octal mode such as 644 (files) or 755 (folders). Some hosts forbid changing permissions; if so you'll see a clear error.
Zip & extract
- Zip — select items, click Zip, name the archive. It is created in the current folder.
- Extract — the Extract action on a
.zipfile unpacks it into a folder beside it. Extraction is protected against "zip-slip" (archives that try to write outside the target).
Downloading
Click a non-text file name, or the Download row action. Files are streamed as a download and never executed on the server.
Security model
Root Explorer is built security-first:
- Super Users only. Both the interface and every action require
core.admin. - CSRF protection. A valid Joomla token is required on every request.
- Sandbox jail. Every path from the browser is normalised and verified to stay inside the Base Path. Directory traversal (
../), absolute paths, Windows drive prefixes, symlink escapes and zip-slip are all rejected. - Safe uploads/downloads. Uploads use
is_uploaded_file/move_uploaded_file; downloads are sent asapplication/octet-stream. - No external calls. No telemetry, no license phone-home — nothing leaves your server.
Updates
Updates are delivered in place. Go to System → Update → Extensions and click Find Updates; if a new version is available it installs like any Joomla extension. A valid subscription is required to receive downloads and updates.
Troubleshooting
| Symptom | Cause & fix |
|---|---|
| "Invalid security token" | The page sat open too long and the session token expired. Reload the page and retry. |
| "You are not authorised" | Your account isn't a Super User. Root Explorer is Super Users only by design. |
| Can't write / save / chmod | Filesystem permissions or ownership on the host. The web server user must be able to write the target. Check with your host. |
| Zip features missing or error | The PHP zip extension isn't installed/enabled. Enable it in your PHP configuration. |
Base Path / shows nothing / errors |
open_basedir restricts PHP to certain paths. Use a Base Path inside the allowed area (e.g. the Joomla root). |
| Upload rejected (too large) | Raise upload_max_filesize and post_max_size in PHP settings. |
Uninstall
Go to System → Manage → Extensions, find Root Explorer, select it and click Uninstall. Files you created with the tool are not removed — only the component itself.
Support
Support is available to customers with an active subscription via saintartdesigns.com. When reporting an issue, include your Joomla and PHP versions and the exact error text from the status bar.
