- Does FMElfinderBundle work with Laravel?
- No. helios-ag/fm-elfinder-bundle is a Symfony bundle and depends on Symfony's Bundle, DependencyInjection, routing and configuration systems, none of which exist natively in Laravel. Making it work would mean replacing those Symfony-specific components, which is not a realistic maintenance path. For a Laravel application, use a Laravel-native package such as barryvdh/laravel-elfinder, or go headless with spatie/laravel-medialibrary plus your own UI.
- How do I install FMElfinderBundle in a Symfony application?
- Install it with Composer using composer require helios-ag/fm-elfinder-bundle, then enable the bundle in config/bundles.php if Symfony Flex does not do it for you. Next, import the bundle routing file (for example a resource entry pointing at @FMElfinderBundle/Resources/config/routing.yaml) so the elFinder endpoint is reachable. Finally, add the fm_elfinder configuration block to your config file and secure the route before exposing it to users. Pin the constraint to ^13.0.3 so a stale lockfile cannot resolve to a vulnerable version.
- Which version of FMElfinderBundle is safe to install?
- Use 13.0.3 or later. That patch release fixes a homeFolder path traversal issue in the bundle's own configuration surface, and there is no CVE ID or affected-version range published, so the release notes are the only signal you get. Treat 13.0.3 as a security floor rather than a clean bill of health, since elFinder core has its own historical CVEs. If the bundle already runs in production on 13.x or earlier, schedule the upgrade as a security remediation task with an owner and a deadline.
- What PHP and Symfony versions does FMElfinderBundle 13.x require?
- The established baseline is Symfony 5.4+ and PHP 8.0+, and the 13.0.3 patch release does not appear to raise those constraints. Because the release notes are terse, confirm the exact requirements in the package's composer.json at install time rather than trusting documentation or blog posts. If your project is on an older Symfony or PHP version, expect to upgrade the platform before the bundle.
- How do I configure multiple upload folders with FMElfinderBundle?
- The bundle supports named instances, and each instance has its own homeFolder, upload path, driver and route configuration. Define several instances under the fm_elfinder configuration tree and reference the instance you want in the editor or file browser invocation, which keeps media, documents and per-tenant storage separated. Restrict each instance to the right user roles through Symfony security rather than relying on the path configuration alone.
- How do I secure the elFinder route in Symfony?
- Protect the elFinder endpoint with access_control rules in security.yaml and, for finer control, a Symfony voter or event subscriber that checks the current user against the requested path. Do not assume authentication alone is enough; the file manager can read and write, so authorization must cover both operations per instance. The bundle also documents CORS support and event listeners for access control, and you should review your web server logs for encoded traversal attempts against the route.
- What is the Laravel alternative to FMElfinderBundle?
- For a Laravel stack the practical choices are barryvdh/laravel-elfinder, which wraps the same elFinder front end but is Laravel-native, or a headless approach using spatie/laravel-medialibrary with a custom file browser UI. The Laravel-native wrapper is the thinner layer, which reduces the security patch surface you have to track. Either way, budget for ongoing patching of elFinder and jQuery dependencies, because that cost does not disappear with the framework choice.
- How do I connect elFinder to TinyMCE, CKEditor or Summernote?
- Point the editor's file browser callback at the route exposed by the bundle, and the editor will open the elFinder dialog for browsing, uploading and selecting files. The same maintainer publishes FMTinyMCEBundle and FMSummernoteBundle, and FOSCKEditorBundle covers CKEditor, so prebuilt integrations exist for the common editors. Test the resulting JavaScript and CSS bundles, because elFinder requires jQuery and jQuery UI and can collide with existing front-end assets.
- Can FMElfinderBundle store files on S3 or another remote filesystem?
- Yes. File storage goes through Flysystem backends, so local, FTP, SFTP and S3-style drivers are supported, and no ORM schema is involved. Be aware that the 13.0.3 homeFolder fix concerns filesystem-root confinement and does not necessarily scope remote driver paths, so validate remote path restrictions separately. If your target storage is unusual, confirm a driver exists or plan to write one.
- Will upgrading to 13.0.3 break my existing homeFolder configuration?
- It is a patch release and should be low risk, but the fix tightens how homeFolder paths are resolved. Configurations that relied on lax handling, such as symlinked home folders, relative paths or parent-directory segments, may now be rejected or normalized. Treat any breakage as a latent misconfiguration to correct rather than a regression, and verify the file browser after upgrading in staging before rolling out.