Getting Started

Roxy Fileman is a standalone PHP file manager/browser; this bundle's job is to embed it in a Symfony app, let Symfony config supply the Roxy conf.json values, and let you swap the storage backend. You are effectively getting "upload + browse + insert into CKEditor" for free instead of building a media library.

Minimal steps:

composer require elendev/roxyfileman-bundle:~1.0

// app/AppKernel.php
new Elendev\RoxyFilemanBundle\ElendevRoxyFilemanBundle(),

Import the routes with a prefix:

# app/config/routing.yml
ElendevRoxyFilemanBundle:
    resource: "@ElendevRoxyFilemanBundle/Resources/config/routing.yml"
    prefix:   /elendev-roxyfileman

Then configure a profile that points at an upload directory, and wire CKEditor to the resulting URL:

CKEDITOR.replace('body', {
    filebrowserBrowseUrl:      '/elendev-roxyfileman/',
    filebrowserImageBrowseUrl: '/elendev-roxyfileman/?type=image',
    filebrowserUploadUrl:      '/elendev-roxyfileman/',
    filebrowserImageUploadUrl: '/elendev-roxyfileman/?type=image'
});

First use case to validate end-to-end: an admin-only article editor where a non-technical author clicks "Browse server", uploads a JPEG, sees a thumbnail, inserts it, and the resulting <img src> resolves on the front end. If that loop works, the rest is configuration.

Where to look first, in order: DependencyInjection/Configuration.php (the real config schema — trust this over the README), Resources/config/routing.yml (which URLs actually exist), and the bundled Roxy conf.json (the pass-through keys you can override).

Implementation Patterns

Profile-per-context. The natural pattern is one profile per content bucket rather than one global uploads folder:

elendev_roxyfileman:
    profiles:
        articles:
            filesystem: elendev_roxyfileman.filesystem.local
            # upload root the file manager is allowed to browse
            directory: "%kernel.root_dir%/../web/uploads/articles"
        documents:
            filesystem: elendev_roxyfileman.filesystem.local
            directory: "%kernel.root_dir%/../web/uploads/documents"

Expose each profile at its own prefix (or behind a type/profile query parameter, depending on how this version resolves profiles — verify in the controller). This is the cheapest way to stop authors dropping a 40 MB PDF into the article image folder.

Pass-through Roxy config. Treat the bundle's config as a wrapper around Roxy's own conf.json: allowed/forbidden extensions, max upload size, thumbnail dimensions, default view. Set these explicitly in YAML rather than hand-editing files under the bundle — otherwise your tuning vanishes on the next composer update.

Custom filesystem service. This is the main extension seam and the reason to use the bundle at all. Implement the bundle's filesystem interface, register the service, and reference it from a profile:

services:
    app.roxy.s3_filesystem:
        class: App\Roxy\S3Filesystem
        arguments: ['@app.s3.client', '%uploads_bucket%']

elendev_roxyfileman:
    profiles:
        articles:
            filesystem: app.roxy.s3_filesystem

Use it for S3/Gaufrette/Flysystem storage, per-tenant path prefixing (tenants/{id}/uploads), or to hook image resizing on write. In Symfony 4+ you lose autowiring for the bundle's own services, so define these manually and make them public if the bundle fetches them by id.

IvoryCKEditorBundle integration. If you use IvoryCKEditorBundle, push the browse/upload URLs into its config once instead of repeating them in every CKEDITOR.replace() call. That keeps the file manager URL in one place alongside the editor toolbar config.

Protect the route, not just the page. Everything Roxy exposes under the prefix — UI, listing endpoints, upload handler — sits behind that route import. Add it to access_control:

access_control:
    - { path: ^/elendev-roxyfileman, roles: ROLE_ADMIN }

Custom Roxy version. The bundle ships a bundled copy of Roxy. When you need to patch it or upgrade to a newer Roxy release than the bundle vendors, point the config at your own directory (copy it into web/ or a bundle resource) and keep the override in version control. Plan for this: the vendored copy is frozen at the 2018 era.

Gotchas and Tips

Symfony compatibility is the first hurdle, not configuration. Last release 2018, built for Symfony 2/3 (AppKernel, %kernel.root_dir%). kernel.root_dir was deprecated in 4.1 and removed in 5.1. On a modern Symfony you will likely need --ignore-platform-reqs to install and a small fork or a kernel.root_dir-shim parameter to run. Decide this up front; if you need long-term support, evaluate elFinder/CKFinder or a plain Flysystem-backed upload endpoint instead.
404s are almost always routing, not Roxy. Roxy loads its own JS/CSS and hits its own PHP endpoints relative to the entry URL. A prefix mismatch, wrong trailing slash, or an assets path not matching the route prefix produces a half-loaded UI. Check the browser network tab before touching config.
Keep the upload root out of the executable path. Roxy writes into a web-served directory. If uploads land under web/, anyone who uploads evil.php (or .phtml, .svg, .html) has a stored-XSS or worse vector. Restrict extensions and add a server rule disabling script execution in that directory:
```
location ^~ /uploads/ {
    location ~ \.(php|phtml|phar)$ { deny all; }
    add_header Content-Disposition "attachment";
}
```
Never rely on Roxy's extension list as your only control.
Firewall the prefix. The connector endpoints are not CSRF-protected; they authenticate via the session. Exposing them anonymously means anonymous writes. Also decide whether ROLE_USER is enough or editors only.
Config changes require a cache clear. The bundle materializes Roxy configuration; stale caches produce "I changed the upload limit and nothing happened" bugs. bin/console cache:clear (and check the generated file if you're stuck).
Deployment: persist the upload directory. With symlink-based deploys, put uploads in a shared directory outside the release and symlink it in — otherwise every deploy silently drops every image authors have uploaded since the last one.
Multiple profiles: verify the resolution mechanism. Confirm how the bundle picks a profile per request (route attribute vs. query param) before you hard-code URLs in JS; the README's profile section and the controller are the source of truth.
Debugging order: var/logs/dev.log for the Symfony side → generated Roxy config → browser network tab for the /elendev-roxyfileman/... calls. 403 = firewall or file permissions; 404 = routes or prefix; 500 = writable-directory or missing PHP extension (GD for thumbnails).
Pin and document. With 3 stars, 0 dependents, and no release since 2018, treat this as vendored infrastructure: pin the exact version, commit any fork you make, and write down the upgrade/exit plan. The custom filesystem service is your insurance — it keeps application-side storage logic out of the bundle, so a future replacement only needs to re-point the URL.

Roxyfileman Bundle Laravel Package

Getting Started

Implementation Patterns

Gotchas and Tips