Next File Manager is a Joomla-native file manager built as a React single-page app inside the admin. Browse and manage the whole Joomla install and any number of additional drives, from a folder elsewhere on the server to an SFTP host, an FTP/FTPS account, a WebDAV or Nextcloud share, or an S3-compatible bucket through one interface, without ever leaving Joomla.

Where an FTP client hands over a shared credential and the run of the account, Next File Manager wraps the browser in a Joomla-native control layer: profiles assign users or user-groups to a permission set naming exactly which folders they see, which of sixteen file operations they may run, how large their uploads may be and which extensions are allowed. Every change is written to an activity log, and Joomla's own configuration files and system trees are protected for everyone. A proper file manager without giving everyone the keys to the server.

🎯 Use cases

• 🗂️ File management without an FTP client — edit a template, unpack a backup, fix a permissions problem, all from inside the Joomla admin with no separate desktop tool and no server credentials handed around.
• 👥 Client and contributor folders — give someone their own folder and nothing else, scoped to the operations they actually need, using the Joomla account they already have.
• ☁️ Reach the drives you already use — attach SFTP, FTP/FTPS, WebDAV, Nextcloud and S3-compatible storage alongside the site itself and move files between them.
• 🌐 Front-end file access — publish the same file manager to logged-in site users through a menu item, with no route into the administrator at all.
• 📋 Accountability — keep a record of who uploaded, renamed, moved, edited or deleted what, and when.
• 🧰 Everyday site maintenance — search a tree for a stray file, ZIP a folder to send it on, extract an archive in place, edit a config file with syntax highlighting.

💡 Benefits

• 🔐 File access without the blast radius — Joomla-native profiles mean a user sees the folders you granted and nothing above them, with every path re-checked on the server.
• 🛡️ Safe by default, not by configuration — configuration.php, .env files and private keys are unreadable below Super User by any route, including inside a ZIP, and Joomla's own trees are write-protected before you configure anything.
• 📜 A real activity log — every upload, deletion, rename, move, copy, edit, archive operation and lock change recorded with the user, the place and the path.
• 🔑 Credentials kept safe — remote passwords and private keys are encrypted at rest, never returned to the browser, and connections are tested before they are saved.
• 🧰 One tool, many filesystems — the local server, SFTP, FTP/FTPS, WebDAV, Nextcloud and S3-compatible object storage through a single browser, with each driver declaring what it can genuinely do rather than failing halfway.
• ⚙️ Configurable without code — storage, places, profiles, limits and protection are all driven from the admin UI.
• 🔄 Upgrade-safe & open source — GPL licensed, namespaced Joomla 4 / 5 / 6 MVC on PHP 8.1+, delivered through Joomla's native update channel.

🧩 Features

🗂️ File Browser

Everything you expect from a desktop file manager, in the Joomla admin.
- Grid & list views — a tile grid with large type icons, or a dense sortable list
- Live folder tree — a lazily-loaded sidebar tree of every folder you have access to, with breadcrumbs
- Drag to move — drag a selection onto a folder tile or a tree node, including across drives
- Right-click menu — a context menu carrying every operation your profile allows, and only those
- Info panel — type, size, modified date, image dimensions, full path and a writable flag
- Filters — narrow a folder by kind, extension, size range or modified date

☁️ Uploads & Downloads

Get files in and out without a separate FTP client.
- Drop-anywhere upload — drop files on the window; a progress queue shows each transfer and its result
- Per-profile rules — maximum file size, an allowed-extension list and an always-blocked denied list
- Checked twice — validated in the browser for fast feedback, then enforced again on the server
- Download & ZIP — a single file, or a whole selection packed into one archive
- Cross-drive transfers — streamed rather than buffered, so a file larger than the memory limit still goes through

✏️ Editing & Preview

Read and change files in place.
- Syntax-highlighting editor — CodeMirror with modes for PHP, JavaScript, CSS, HTML, JSON, SQL, XML and Markdown
- Image & media lightbox — full-screen preview with byte-range streaming, so video scrubs instead of buffering
- Rename, duplicate, new folder — the everyday operations, each individually grantable
- Recursive search — find a file anywhere in a place, with its location shown in the results

📦 Archives

Pack and unpack without shell access.
- Create ZIP — archive any selection in place
- Extract in place — unpack into the containing folder
- Zip-Slip blocked — every entry is checked during extraction, so an archive cannot write outside its target
- Access-checked contents — a protected file cannot be smuggled out inside an archive

💾 Storage & Places

One interface over every filesystem you use.
- Five drivers — server folder, SFTP (SSH), FTP/FTPS, WebDAV/Nextcloud and S3-compatible object storage
- Storage / place split — a storage holds the credentials, places name the folders on it, so one SFTP account exposes several folders under one password
- Encrypted credentials — ciphertext keyed off the Joomla site secret, never sent back to the browser
- Capability negotiation — each driver declares what it can do, and the interface hides what the protocol cannot support
- Test before save — a live connection check that also pins the SFTP host key fingerprint

🔐 Access Control

Joomla-native permissions that go well past on/off.
- Profiles — granted folders, sixteen togglable operations, upload limits and feature gates
- Scoped roots — a place plus an optional subfolder plus a read/write flag; the user sees that subtree and nothing above it
- User & group assignment — assign to individual Joomla users or to whole user-groups, direct beating group
- Deny by default — a user with no profile gets nothing, and every operation is re-checked on the server

🛡️ Protection

Safe defaults a misconfigured profile cannot switch off.
- Protected paths — an editable pattern list shipping with configuration.php, .htaccess, administrator/, libraries/ and more, protecting a path and everything under it
- Secret files — configuration.php, .env, *.key, *.pem and .htpasswd cannot be read, downloaded, previewed or copied below Super User
- Per-path locks — lock an item from the context menu; unlock overrides are Super-User-only and gated behind a switch that is off by default
- Traversal hardening — every path canonicalised and re-checked against its granted root, through symlinks and on case-insensitive filesystems

📜 Activity Log

Answer "who changed what, and when".
- Every mutation recorded — uploads, deletions, renames, moves, copies, edits, archive operations and lock changes
- Full context — the acting user, the action, the place and the path on every entry
- Filterable viewer — a searchable grid with per-column filtering
- Admin-only — never exposed to profiled users

🌐 Site Front End

Put the file manager on the public site, not just the admin.
- Menu-item driven — publish the same app for logged-in front-end users
- Same enforcement — the identical profile checks, protection rules and command allowlist as the admin
- Session-aware — an expired session raises an in-place re-login dialog and replays the interrupted request
- No admin route — front-end users manage files without an administrator login

🛡️ Security

Next File Manager can reach the whole Joomla install, so it is built security-first and follows Joomla's security best practices throughout.

• 🔒 Behind an authenticated session, always — every request requires a valid Joomla session and security token; there is no separately reachable file endpoint.
• 🧱 The interface is not the enforcement — the server independently re-checks the profile, the granted root, the protected-path rules and the driver's capabilities on every request, so a hand-crafted call gets the same answer as a hidden button.
• 🚧 Traversal closed properly — paths are canonicalised and re-validated against their granted root after symlink resolution and with case folded, so ../, a symlink, or a case trick cannot escape.
• 📦 Archives cannot break out — every entry is validated during extraction, blocking the Zip-Slip class of attack, and ZIP downloads are gated exactly as direct downloads are.
• 🔑 Credentials never exposed — remote passwords and private keys are encrypted at rest and never returned to the browser; the editor only learns whether a secret is set.
• 🧯 Secrets unreadable by design — configuration.php, .env files, private keys and .htpasswd are refused to anyone below Super User on every route, and no setting lifts that.
• ✅ Continuously verified — an automated test suite runs on every change, covering path resolution, protection and the storage drivers.

🔗 Resources

📚 Documentation - https://nextsoftware.dev/documentation/next-file-manager
📝 Changelog - https://nextsoftware.dev/changelogs/next-file-manager