Some improvements

[novashdima]

Bug fixes

• Fix premature $zip unset in remote upload (src/main.php): removed an erroneous unset($zip) call before the variable was used in the temporary file path logic, which could cause a PHP notice or unexpected behavior.

• Remove dup: the code block @src/ifm.js:322-354 that was accidentally duplicated during the commit 3325648 has been removed.

• tar overwite: when creating an archive named <archivename>.tar.<gz/bz2>, if a file named <archivename>.tar already exists in the same folder, it will be overwritten with temporary data for the new archive.

• Fix copy files: when copying files via the menu, files with a dot at the beginning of their names (hidden files) were ignored.

Security

• Timing attack: if user not exist. An attacker could determine valid logins based on response times. Add dummy hash verification.

• BCrypt: support for all hashes, not just $2y$.

• htpasswd: proper separation of username and password.

Performance improvements

• Icons: make possible to use load it from CDN.

• Minification: add .css and .js embeded files minification.

• JSON minification: add i18n language files minification.

• Skip recompression for already-compressed formats: createZip now accepts a $noCompressExtensions list (defaulting to video, audio, image, archive, and Office formats) and applies ZipArchive::CM_STORE for those file types instead of CM_DEFLATE. Avoids wasting CPU time and potentially inflating archive size when adding files that are already compressed.

• Use system zip binary when available: for single-source archives, createZip now attempts to call the system zip command first via createZipSystem(). This avoids loading the entire file tree into PHP memory, which matters for large directories. Falls back to ZipArchive if the binary is not available.

• Download files: reading the file via a buffer (which, for some reason, is as large as 64 MB) has been replaced with the built-in readfile function, which reads the file in 8-KB chunks and does not result in increased memory usage regardless of the file size.

• Search: the complexity of the search loop has been reduced from O(n²).

• Cache: language, current rootdir, uid, gid...

• Function calls: have been moved from inside the loop to variables before the loop.

• Dirs & files sort: use usort with direct comparison instead of sorting a temporary array. Reduced memory usage for directories containing a large number of files and subdirectories.

• Mime type detection: detect the MIME type only once for each file extension and cache it.

Icons

• Migrate all icons to original Font Awesome to be possible to use icons from CDN (src/main.php, src/templates/app.html, src/ifm.js): replaced the custom icon-* font classes throughout the codebase — navbar actions, file type icons, context menu entries, and the footer GitHub link — with equivalent Font Awesome classes (fa-folder-o, fa-file-audio-o, fa-file-pdf-o, etc.). Eliminates the dependency on the bundled custom icon font.

• Bundle Font Awesome (src/includes/font-awesome.min.css): added Font Awesome as a local include so the icon set works offline and without a CDN dependency.

• Change copy action icon (src/ifm.js): replaced icon-folder-empty with icon-docs for the copy context menu entry to better reflect the action semantics.

• Icon width: fixed icon width in filetable and bootstrapMenu.

UX improvements

• Remove secondary dropdown from navbar (src/templates/app.html): Remote Upload, AJAX Request, and Logout were previously collapsed into a single overflow dropdown. They are now individual nav items, consistent with the rest of the toolbar. This improves discoverability and touch target size on mobile.

• Autofocus on first text input in all modals: showModal now respects the autofocus attribute — focuses the marked element if present, otherwise falls back to the first non-radio/checkbox input. Added autofocus to all relevant modal inputs (create dir, rename, create archive, remote upload, AJAX request, search).

• autocomplete="off" on URL inputs: prevents browsers from polluting URL fields with browsing history.

• AJAX Request modal (modal.ajaxrequest.html, src/ifm.js): restructured layout — method selector moved under the URL field; the Data textarea is now hidden when GET is selected and shown only for POST; HTTP status code is displayed as a colour-coded badge next to the Response label (green for 2xx, red for errors); error responses are shown in the response textarea instead of a generic toast; Cancel button moved to modal-footer for consistency with all other modals.

• Remote Upload modal (modal.remoteupload.html, src/ifm.js): filename field is now auto-populated from the URL (query string and fragment stripped); if the extracted name already exists in the current directory it is suffixed with (1), (2), etc. Added URL placeholder.

• Extract File modal (modal.extractfile.html, src/style.css): clicking a readonly path option now selects its radio button; the currently selected option is highlighted with a blue outline using CSS :has(input[type="radio"]:checked).

• Search modal (modal.search.html, src/ifm.js): added a search button inside the input group so the search can be triggered without a keyboard (useful on mobile); search results container gains max-height: 60vh with scroll to prevent the modal from overflowing the viewport.

• Duplicate name validation (modal.createdir.html, modal.file.html, src/ifm.js): clicking Create/Save now checks the name against the current file list and shows an inline invalid-feedback error if the name is taken. For the file editor, the check is skipped when saving under the original filename (i.e. overwriting the file being edited is allowed). New i18n key name_already_exists added to all 10 language files.

• Lang param: add lang to <html>. This improves accessibility and aligns with best practices.

• Permissions: removed empty space right of the Permissions.

Developer tooling

• Add Makefile: targets — make lint (PHPMD), make syntax-check (PHP -l on all tracked files), make build / build-cdn / build-all, make clean.

• Add composer.json with PHPMD: dev dependency so make lint works after composer install without a globally installed tool.

• Update .gitignore: excludes composer.lock.

• Add docker-compose.yml: to simplify the build and testing process. To build CDN version set CDN=true env.

• Update ACE editor to latest version.

• Version link: The version link in the footer now leads to the corresponding release instead of the branch.

• Project page: Now github icon with title.

• Dockerfile: Multistage build.

• Github Actions: Remove IFM build from PHPMD pipeline. Update dependencies.

[misterunknown]

Hi,
thanks for your work! Unfortunately I didn't come around to take a look yet,maybe I have some time on the weekend.
Cheers

[misterunknown]

Hi,

I reviewed the changes, looks good to me.

Two things before I merge:

• README: the build now needs composer install first. Please add a short "Building from source" section (composer install, php ./compiler.php / make build, Makefile targets).
• Squash commits: 43 is a lot, with several "fix" / "space" / "typo". Please rebase into a handful of focused commits with clear messages, e.g.:
  • security: timing attack mitigation + bcrypt variants
  • fix: PHP 8.1+ warnings and archive edge cases
  • perf: cache uid/gid/mime lookups
  • feat(archive): system zip + no-compress list + atomic tar
  • ui: Font Awesome migration and template cleanup
  • build: composer minify, multi-stage Dockerfile, Makefile, CI

Thanks!