fix(actions): creating a backup in FM_ROOT_PATH (prasathmani#418)

tinyfilemanager.php

@@ -452,17 +452,27 @@ function session_error_handling_function($code, $msg, $file, $line) {
     }
 
     // backup files
-    if (isset($_POST['type']) && $_POST['type'] == "backup") {
-        $file = $_POST['file'];
-        $dir = fm_clean_path($_POST['path']);
-        $path = FM_ROOT_PATH.'/'.$dir;
-        if($dir) {
-            $date = date("dMy-His");
-            $newFile = $file . '-' . $date . '.bak';
-            copy($path . '/' . $file, $path . '/' . $newFile) or die("Unable to backup");
-            echo "Backup $newFile Created";
-        } else {
-            echo "Error! Not allowed";
+    if (isset($_POST['type']) && $_POST['type'] == "backup" && !empty($_POST['file'])) {
+        $fileName = $_POST['file'];
+        $fullPath = FM_ROOT_PATH . '/';
+        if (!empty($_POST['path'])) {
+            $relativeDirPath = fm_clean_path($_POST['path']);
+            $fullPath .= "{$relativeDirPath}/";
+        }
+        $date = date("dMy-His");
+        $newFileName = "{$fileName}-{$date}.bak";
+        $fullyQualifiedFileName = $fullPath . $fileName;
+        try {
+            if (!file_exists($fullyQualifiedFileName)) {
+                throw new Exception("File {$fileName} not found");
+            }
+            if (copy($fullyQualifiedFileName, $fullPath . $newFileName)) {
+                echo "Backup {$newFileName} created";
+            } else {
+                throw new Exception("Could not copy file {$fileName}");
+            }
+        } catch (Exception $e) {
+            echo $e->getMessage();
         }
     }