security hole found

[wiormax]

you can edit any file even if you have excluded in $exclude_items in fact you can edit index.php if that is the name of your tinyfilemanager file so my solution will avoid this issue

chenge this

// file editor from
if ($file == '' || !is_file($path . '/' . $file)) { fm_set_msg(lng('File not found'), 'error'); fm_redirect(FM_SELF_URL . '?p=' . urlencode(FM_PATH)); }

// file editor to
if ($file == '' || !is_file($path . '/' . $file) || in_array($file, $GLOBALS['exclude_items'])) { fm_set_msg(lng('File not found'), 'error'); fm_redirect(FM_SELF_URL . '?p=' . urlencode(FM_PATH)); }

good luck

[prasathmani]

This issue is addressed in the new release.