<?php

/**
 * @package     JCE
 * @subpackage  Editor
 *
 * @copyright   Copyright (C) 2005 - 2020 Open Source Matters, Inc. All rights reserved.
 * @copyright   Copyright (c) 2009-2026 Ryan Demmer. All rights reserved
 * @license     GNU General Public License version 2 or later; see LICENSE.txt
 */

\defined('_JEXEC') or die;

use Joomla\CMS\Factory;
use Joomla\CMS\Language\Text;
use Joomla\CMS\Object\CMSObject;
use Joomla\CMS\Session\Session;
use Joomla\CMS\Uri\Uri;
use Joomla\CMS\Component\ComponentHelper;
use Joomla\CMS\Table\Table;
use Joomla\CMS\User\UserHelper;

class WFFileBrowser extends CMSObject
{
    /** @var array */
    private $_buttons = array();

    /** @var array */
    private $_actions = array();

    /** @var array */
    private $_events = array();

    /** @var array */
    private $_result = array('error' => array(), 'files' => array(), 'folders' => array());

    /** @var array */
    public $dir = array();

    /** @var WFFileSystem */
    public $filesystem = null;

    /** @var string */
    public $filetypes = 'jpg,jpeg,png,gif,webp';

    /** @var array */
    public $upload = array(
        'max_size' => 10240,
        'validate_mimetype' => 1,
        'add_random' => 0,
        'total_files' => 0,
        'total_size' => 0,
        'remove_exif' => 0,
    );

    /** @var int */
    public $folder_tree = 1;

    /** @var string */
    public $list_limit = 'all';

    /** @var array */
    public $features = array(
        'help' => 1,
        'upload' => 1,
        'folder' => array(
            'create' => 1,
            'delete' => 1,
            'rename' => 1,
            'move' => 1,
        ),
        'file' => array(
            'rename' => 1,
            'delete' => 1,
            'move' => 1,
        ),
    );

    /** @var string */
    public $date_format = '%d/%m/%Y, %H:%M';

    /** @var string */
    public $websafe_mode = 'utf-8';

    /** @var int */
    public $websafe_spaces = 0;

    /** @var string */
    public $websafe_textcase = '';

    /**
     * @param array $config Configuration array passed from the manager.
     */
    public function __construct($config = array())
    {
        // set file browser config
        $this->setConfig($config);

        // add actions
        $this->addDefaultActions();
        // add buttons
        $this->addDefaultButtons();

        // Setup XHR callback funtions
        $this->setRequest(array($this, 'getItems'));
        $this->setRequest(array($this, 'getFileDetails'));
        $this->setRequest(array($this, 'getFolderDetails'));
        $this->setRequest(array($this, 'getTree'));
        $this->setRequest(array($this, 'getTreeItem'));

        $this->setRequest(array($this, 'searchItems'));

        $this->setRequest(array($this, 'upload'));
    }

    /**
     * @return object The active JCE profile.
     */
    protected function getProfile()
    {
        return WFApplication::getInstance()->getActiveProfile();
    }

    /**
     * Display the browser.
     */
    public function display()
    {
        $filesystem = $this->getFileSystem();
        $buttons    = $filesystem->get('buttons', []);

        if (!empty($buttons)) {
            foreach ($buttons as $type => $items) {
                foreach ($items as $name => $options) {
                    $this->addButton($type, $name, $options);
                }
            }
        }

        $this->setProperties(array(
            'actions' => $this->getActions(),
            'buttons' => $this->getButtons(),
        ));

        // Get the Document instance
        $document = WFDocument::getInstance();

        $document->addScript(array('filebrowser.min'), 'media');
        $document->addStyleSheet(array('filebrowser.min'), 'media');
    }

    /**
     * Render the browser view.
     */
    public function render()
    {
        $session = Factory::getSession();

        $view = new WFView(array(
            'name' => 'filebrowser',
            'layout' => 'default',
        ));

        // assign session data
        $view->session = $session;

        // assign form action
        $view->action = $this->getFormAction();

        $view->list_limit_options = $this->get('list_limit_options', array());
        $view->list_limit = $this->get('list_limit', 25);

        // return view output
        $view->display();
    }

    /**
     * Set a WFRequest item.
     *
     * @param array $request
     */
    public function setRequest($request)
    {
        $xhr = WFRequest::getInstance();
        $xhr->setRequest($request);
    }

    /**
     * Build the form action URL for XHR plugin requests.
     *
     * @return string The absolute action URL.
     */
    protected function getFormAction()
    {
        $wf = WFEditorPlugin::getInstance();

        $context = Factory::getApplication()->input->getInt('context');

        $query = '';

        $args = array(
            'plugin' => $wf->getName(),
            'context' => $context,
        );

        foreach ($args as $k => $v) {
            $query .= '&' . $k . '=' . $v;
        }

        return Uri::base(true) . '/index.php?option=com_jce&task=plugin.xhr' . $query;
    }

    /**
     * @return WFFileSystem The active filesystem instance.
     */
    public function getFileSystem()
    {
        return $this->filesystem;
    }

    /**
     * @return string Comma-separated list of extensions that the browser can preview inline.
     */
    private function getViewable()
    {
        return 'jpeg,jpg,gif,png,webp,apng,svg,avi,wmv,wm,asf,asx,wmx,wvx,mov,qt,mpg,mp3,mp4,m4v,mpeg,ogg,ogv,webm,swf,flv,f4v,xml,dcr,rm,ra,ram,divx,html,htm,txt,rtf,pdf,doc,docx,xls,xlsx,ppt,pptx';
    }

    /**
     * Return a list of allowed file extensions in a specific format.
     *
     * @param string $format The desired format of the output ('map', 'array', 'list', 'json').
     * @param string $list Optional string of file types to use instead of the default.
     * @return mixed Formatted extension list.
     */
    public function getFileTypes($format = 'map', $list = '')
    {
        // If $list is empty, use the default filetypes from the object's property
        if (empty($list)) {
            $list = $this->get('filetypes');
        }

        return WFUtility::formatFileTypesList($format, $list);
    }


    /**
     * Converts the extensions map to a list.
     *
     * @param string $list The extensions map eg: images=jpg,jpeg,gif,png
     *
     * @return string jpg,jpeg,gif,png
     */
    private function listFileTypes($list = '')
    {
        return $this->getFileTypes('list', $list);
    }

    /**
     * Set allowed file types and sync the upload config.
     *
     * @param  string $list Comma-separated extension list, e.g. "jpg,png,gif".
     * @return void
     */
    public function setFileTypes($list = 'jpg,jpeg,png,gif')
    {
        if ($list && $list[0] === '=') {
            $list = substr($list, 1);
        }

        // get existing upload values
        $upload = $this->get('upload', array());

        // set updated filetypes
        $upload['filetypes'] = $list;

        // update filetypes
        $this->setProperties(array(
            'upload' => $upload,
        ));

        $this->set('filetypes', $list);
    }

    /**
     * @return array The current result array with 'error', 'files', and 'folders' keys.
     */
    public function getResult()
    {
        return $this->_result;
    }

    /**
     * Store a value in the result array.
     *
     * @param  mixed       $value The value to store.
     * @param  string|null $key   Result key ('files', 'folders', or 'error'); null replaces the entire result.
     * @return void
     */
    public function setResult($value, $key = null)
    {
        if ($key) {
            $this->_result[$key][] = $value;
        } else {
            $this->_result = $value;
        }
    }

    /**
     * Check whether a feature is enabled in the current profile.
     *
     * @param  string      $action The feature name (e.g. 'upload', 'delete', 'rename', 'move', 'create').
     * @param  string|null $type   Optional sub-type ('file' or 'folder').
     * @return bool True if the feature is enabled, false otherwise.
     */
    public function checkFeature($action, $type = null)
    {
        $features = $this->get('features');

        if ($type) {
            if (isset($features[$type])) {
                $type = $features[$type];

                if (isset($type[$action])) {
                    return (bool) $type[$action];
                }
            }
        } else {
            if (isset($features[$action])) {
                return (bool) $features[$action];
            }
        }

        return false;
    }

    /**
     * Resolve the containing directory of a file or directory path.
     * Returns an empty string for absolute URLs or paths that cannot be resolved.
     *
     * @param  string $path A relative file or directory path, or a URL.
     * @return string The resolved directory path, or an empty string.
     */
    public function getSourceDir($path)
    {
        $path = $this->get('source', $path);

        if (empty($path)) {
            return '';
        }

        // return nothing if absolute $path
        if (preg_match('#^(file|http(s)?):\/\/#', $path)) {
            return '';
        }

        $filesystem = $this->getFileSystem();

        $path = $this->extractPath($path);

        // directory path relative base directory, eg: images/2025
        if ($filesystem->is_dir($path)) {
            return $path;
        }

        // file url relative to site root
        if ($filesystem->is_file($path)) {
            return dirname($path);
        }

        return '';
    }

    /**
     * Determine whether a path is in complex "id:relative" form.
     *
     * A complex path begins with a 32-character hexadecimal MD5 prefix,
     * followed by a colon, and an optional relative path.
     *
     * @param   string  $path  The path string to test.
     *
     * @return  bool  True if the path has a valid MD5 prefix, false otherwise.
     */
    private function isComplexPath($path)
    {
        // Fast fail: no colon at all
        $pos = strpos($path, ':');

        // No colon found, so not a complex path
        if ($pos === false) {
            return false;
        }

        // Ignore protocols like "http://", "ftp://", "file://"
        if (strpos($path, '://') !== false) {
            return false;
        }

        // Candidate prefix before the colon
        $candidate = substr($path, 0, $pos);

        // Must be exactly 32 hex characters (MD5 hex)
        if (strlen($candidate) !== 32 || !ctype_xdigit($candidate)) {
            return false;
        }

        return true;
    }

    /**
     * Split a complex path "id:relative" into prefix and relative components.
     *
     * Returns true if split occurred, false otherwise. When false, $id will be empty
     * and $relative will contain the original $path value.
     *
     * Examples:
     *   abcdef...1234:images/foo.jpg → $id="abcdef...1234", $relative="images/foo.jpg"
     *   abcdef...1234:               → $id="abcdef...1234", $relative=""
     *   images/foo.jpg               → no split (false)
     *
     * @param   string  $path       The full path to parse.
     * @param   string  &$id        Output parameter for the 32-character prefix.
     * @param   string  &$relative  Output parameter for the relative path.
     *
     * @return  bool  True if the path was successfully split, false otherwise.
     */
    private function splitComplexPath($path, &$id, &$relative)
    {
        $id         = '';
        $relative   = $path;

        if (!$this->isComplexPath($path)) {
            // Not a complex path, so return false
            return false;
        }

        $pos = strpos($path, ':');

        // Candidate prefix before the colon
        $candidate = substr($path, 0, $pos);

        $id = strtolower($candidate);
        $relative = substr($path, $pos + 1);

        return true;
    }

    /**
     * Extract the simple relative path from a possibly complex "id:relative" value.
     * Returns the portion after the colon, or the original path if not complex.
     *
     * @param   string  $path  The path value to process.
     *
     * @return  string  The extracted relative path, or the original value.
     */
    private function extractPath($path)
    {
        if ($this->splitComplexPath($path, $id, $relative)) {
            return $relative;
        }

        return $path;
    }

    /**
     * Parse a path value to extract its prefix.
     *
     * Updates the input $path by reference to remove the prefix,
     * leaving only the relative portion (or empty string for root).
     *
     * @param   string  &$path  The path value to modify.
     *
     * @return  string  The extracted prefix, or an empty string if not complex.
     */
    private function parsePath(&$path)
    {
        $id = '';

        if ($this->splitComplexPath($path, $id, $relative)) {
            $path = $relative;
            return $id;
        }

        return '';
    }

    /**
     * Get the prefix from a complex path without modifying it.
     *
     * @param   string  $path  The path value to parse.
     *
     * @return  string  The prefix if complex, or an empty string otherwise.
     */
    private function getPathPrefix($path)
    {
        if ($this->splitComplexPath($path, $id, $relative)) {
            return $id;
        }

        return '';
    }

    /**
     * Resolve a path into its absolute filesystem location.
     *
     * If the path is in "id:relative" form, it resolves the prefix to its
     * corresponding directory store root and appends the relative portion.
     * If the path is simple, it is returned unchanged.
     *
     * Examples:
     *   abcdef...1234:foo/bar → images/foo/bar
     *   abcdef...1234:        → images
     *   foo/bar               → foo/bar (no change)
     *
     * @param   string  $path  The path to resolve.
     *
     * @return  string  The resolved absolute path or the input if simple.
     */
    public function resolvePath($path)
    {
        if (empty($path)) {
            return '';
        }

        // check for complex path
        if ($this->isComplexPath($path) === false) {
            // no prefix so return the path as is
            return $path;
        }

        // get the store array from the complex source path, eg: prefix:path
        $store = $this->getDirectoryStoreFromPath($path);

        if ($store) {
            // extract the path from the complex source path, eg: prefix:path
            $path = $this->extractPath($path);

            // make the source relative to the store path, eg: stories => images/stories
            $path = WFUtility::makePath($store['path'], $path);
        }

        return $path;
    }

    /**
     * Return the default upload/browse path (first store entry, in "prefix:" form).
     *
     * @return string Path prefix with trailing colon.
     */
    public function getDefaultPath()
    {
        $store = $this->getDirectoryStore();
        $values = reset($store); // get the first element

        return $values['prefix'] . ':';
    }

    /**
     * Build the canonical directory store from configured paths.
     * Missing directories are created on the fly; invalid entries are skipped.
     *
     * @return array Keyed by MD5 hash of each path; each entry has 'path', 'label', and 'prefix'.
     */
    private function getDirectoryStore()
    {
        $filesystem = $this->getFileSystem();

        // If Allow Root is enabled, return a single blank/root entry
        if (empty($filesystem->getRootDir())) {
            $hash = md5('__allow_root_access__');

            return array(
                $hash => array(
                    'path'   => '',
                    'label'  => '',
                    'prefix' => $hash,
                )
            );
        }

        $dir = (array) $this->get('dir');

        // Fallback to a single default directory if none set
        if (empty($dir)) {
            $path  = 'images';
            $label = '';

            Factory::getApplication()->triggerEvent('onWfFileSystemGetRootDir', array(&$path, &$label));

            $hash = md5($path);

            return array(
                $hash => array(
                    'path'   => $path,
                    'label'  => '',
                    'prefix' => $hash,
                )
            );
        }

        $newDir = array();

        foreach ($dir as $origKey => $item) {
            $item['path'] = isset($item['path']) ? trim($item['path']) : '';

            if ($item['path'] === '') {
                $item['path'] = 'images';
            }

            $processedPath = $this->processPath($item['path']);
            $label         = isset($item['label']) ? $item['label'] : '';

            if (count($dir) > 1 && $label === '') {
                $label = basename($processedPath);
            }

            // Process both path and label via the event
            Factory::getApplication()->triggerEvent('onWfFileSystemGetRootDir', array(&$processedPath, &$label));

            // Ensure the folder exists (create if missing)
            if ($filesystem->is_dir($processedPath) === false) {
                $name    = WFUtility::mb_basename($processedPath);
                $pathDir = WFUtility::mb_dirname($processedPath);

                if ($filesystem->createFolder($pathDir, $name) === false) {
                    // Skip this entry if it can't be created
                    continue;
                }
            }

            // New associative key from the (possibly changed) path
            $newKey = md5($processedPath);

            // Finalize fields
            $item['path']   = $processedPath;
            $item['label']  = htmlspecialchars((string) $label, ENT_QUOTES, 'UTF-8');
            $item['prefix'] = $newKey;

            // Write into rebuilt array (last one wins on key collision)
            $newDir[$newKey] = $item;
        }

        return $newDir;
    }

    /**
     * Return the store entry that corresponds to a given path.
     *
     * @param  string $path    The path to look up (may be in "prefix:relative" form).
     * @param  bool   $withKey If true, return the full store array instead of just the matching entry.
     * @return array  The matching store entry, the full store if $withKey is true, or an empty array.
     */
    public function getDirectoryStoreFromPath($path, $withKey = false)
    {
        $prefix = $this->parsePath($path); // get the prefix and remove it from the path value

        $store = $this->getDirectoryStore();

        if (empty($prefix)) {
            // no prefix, so return the default store
            foreach ($store as $key => $value) {
                // is this path with the default store?
                if (WFUtility::safe_strpos($path, $value['path']) === 0) {
                    // set the prefix to the store key
                    $prefix = $key;
                    break;
                }
            }
        }

        if (isset($store[$prefix])) {
            if ($withKey) {
                return $store;
            }

            // return the store entry for the prefix
            return $store[$prefix];
        }

        return array();
    }

    /**
     * Resolve a path to its store entry without modifying the path variable.
     *
     * @param  string       $path The path to resolve (may contain a prefix).
     * @return array|string The store entry array, an array of all entries for an empty path, or the original path if unresolved.
     */
    private function getPathFromDirectoryStore($path)
    {
        $path = trim($path, '/');

        // find the correct entry in the directory store
        $store = $this->getDirectoryStore();

        if (empty($path)) {
            return array_values($store);
        }

        // get the path prefix
        $prefix = $this->getPathPrefix($path);

        // no prefix?
        if (empty($prefix)) {
            $values  = array_values($store);
            $default = array_shift($values);
            return $default;
        }

        if (isset($store[$prefix])) {
            return $store[$prefix];
        }

        // no prefix found, return the path
        return $path;
    }

    /**
     * Build the path variable substitution tables (patterns and replacements).
     * Results are statically cached per request; the onWfFileSystemGetPathVariables event
     * fires on every call to allow plugins to inject dynamic values.
     *
     * @return array Keys: path_pattern, path_replacement, websafe_textcase, websafe_mode, websafe_allow_spaces.
     */
    private function getPathVariables()
    {
        static $variables;

        if (!isset($variables)) {
            $app = Factory::getApplication();
            $user = Factory::getUser();
            $wf = WFApplication::getInstance();
            $profile = $wf->getProfile();

            $groups = UserHelper::getUserGroups($user->id);

            // get keys only
            $groups = array_keys($groups);

            // get the first group
            $group_id = array_shift($groups);

            if (is_int($group_id)) {
                // usergroup table
                $group = Table::getInstance('Usergroup');
                $group->load($group_id);
                // usertype
                $usertype = $group->title;
            } else {
                $usertype = $group_id;
            }

            $context = $app->input->getInt('context', null);

            $contextName = '';

            if (is_int($context)) {
                foreach (ComponentHelper::getComponents() as $component) {
                    if ($context == $component->id) {
                        $contextName = $component->option;
                        break;
                    }
                }
            }

            // Replace any path variables
            $path_pattern = array(
                '/\$id/',
                '/\$username/',
                '/\$name/',
                '/\$user(group|type)/',
                '/\$(group|profile)/',
                '/\$context/',
                '/\$hour/',
                '/\$day/',
                '/\$month/',
                '/\$year/',
            );

            $path_replacement = array(
                'id' => $user->id,
                'username' => $user->username,
                'name' => $user->name,
                'usertype' => $usertype,
                'profile' => $profile->name,
                'context' => $contextName,
                'hour' => date('H'),
                'day' => date('d'),
                'month' => date('m'),
                'year' => date('Y')
            );

            // expose variables
            $variables = compact('path_pattern', 'path_replacement');

            Factory::getApplication()->triggerEvent('onWfFileSystemBeforeGetPathVariables', array(&$variables));

            // convert to array values
            $path_replacement = array_values($variables['path_replacement']);
            $path_pattern = array_values($variables['path_pattern']);

            // get websafe options
            $websafe_textcase = $wf->getParam('editor.websafe_textcase', '');
            $websafe_mode = $wf->getParam('editor.websafe_mode', 'utf-8');
            $websafe_allow_spaces = $wf->getParam('editor.websafe_allow_spaces', '_');

            // implode textcase array to create string
            if (is_array($websafe_textcase)) {
                $websafe_textcase = implode(',', $websafe_textcase);
            }

            // expose variables
            $variables = compact('path_pattern', 'path_replacement', 'websafe_textcase', 'websafe_mode', 'websafe_allow_spaces');
        }

        Factory::getApplication()->triggerEvent('onWfFileSystemGetPathVariables', array(&$variables));

        return $variables;
    }

    /**
     * Apply path variable substitution and websafe normalisation to a path in place.
     *
     * @param  string &$path The path to transform.
     * @return string        The normalised path (also updated via the reference).
     */
    public function processPath(&$path)
    {
        $path = preg_replace($this->get('path_pattern', array()), $this->get('path_replacement', array()), $path);

        // split into path parts to preserve /
        $parts = explode('/', $path);

        // clean path parts
        $parts = WFUtility::makeSafe($parts, $this->get('websafe_mode', 'utf-8'), $this->get('websafe_allow_spaces', '_'), $this->get('websafe_textcase', ''));

        // join path parts
        $path = implode('/', $parts);

        $path = trim($path, '/');

        return $path;
    }

    /**
     * Resolve a filter path relative to the store's base path.
     *
     * @param array  $store  The store array containing 'path' and 'prefix'.
     * @param string $filter The filter path to resolve.
     *
     * @return string The resolved filter path.
     */
    private function resolveFilterPath($store, $filter)
    {
        // remove leading and trailing slash
        $filter = trim($filter, '/');

        // make the source relative to the store path, eg: stories => images/stories
        $filterPath = WFUtility::makePath($store['path'], $filter);

        // trim leading and trailing slash
        return trim($filterPath, '/');
    }

    /**
     * Check if a path is accessible based on the defined filters.
     *
     * @param string $path The path to check.
     *
     * @return bool True if access is allowed, false otherwise.
     */
    public function checkPathAccess($path)
    {
        $path = trim($path, '/');

        $filters = $this->get('filter');

        // no filters set, allow all
        if (empty($filters)) {
            return true;
        }

        $allowFilters = [];
        $denyFilters = [];

        $store = $this->getPathFromDirectoryStore($path);

        // Categorize filters into allow and deny lists
        foreach ($filters as $filter) {
            // remove leading and trailing slash    
            $filter = trim($filter, '/');

            if (strpos($filter, '+') === 0) {
                $filter = substr($filter, 1);

                $filterPath = $this->resolveFilterPath($store, $filter);

                $allowFilters[] = $filterPath;
            } else if (strpos($filter, '-') === 0) {
                $filter = ltrim($filter, '-');

                $filterPath = $this->resolveFilterPath($store, $filter);

                $denyFilters[] = $filterPath;
            } else {
                $filterPath = $this->resolveFilterPath($store, $filter);

                $denyFilters[] = $filterPath;
            }
        }

        $access = true; // Default deny policy

        // Check allow filters
        foreach ($allowFilters as $filter) {
            $access = false;

            // process path for variables, text case etc.
            $this->processPath($filter);

            // Allow if path is empty (root ancestor), exact match, an ancestor of the
            // filter (so the user can navigate into it), or a descendant of the filter.
            if (
                empty($path) ||
                $path === $filter ||
                strpos($filter, $path . '/') === 0 ||
                strpos($path, $filter . '/') === 0
            ) {
                $access = true;
                break;
            }
        }

        if ($access === false) {
            return false;
        }

        // path is empty so no deny filters applied
        if (empty($path)) {
            return true;
        }

        // explode path to array for deny filter matching
        $path_parts = explode('/', $path);

        // Check deny filters
        foreach ($denyFilters as $filter) {
            if (strpos($filter, '*') === 0) {
                $filter = substr($filter, 1);

                // process path for variables, text case etc.
                $this->processPath($filter);

                // explode to array
                $filter_parts = explode('/', $filter);

                // filter match
                if (false === empty(array_intersect($filter_parts, $path_parts))) {
                    $access = false;
                    break;
                }
            } else {
                // process path for variables, text case etc.
                $this->processPath($filter);

                if ($path === $filter) {
                    $access = false;
                    break;
                }
            }
        }

        return $access;
    }

    /**
     * @return string The filesystem base directory.
     */
    public function getBaseDir()
    {
        $filesystem = $this->getFileSystem();

        return $filesystem->getBaseDir();
    }

    /**
     * Get the list of files in a folder, filtered by path access rules.
     *
     * @param  string $relative The relative path of the folder.
     * @param  string $filter   A regex filter applied to file names.
     * @param  string $sort     Sort order string passed to the filesystem.
     * @param  int    $limit    Maximum results to return (0 = unlimited).
     * @param  int    $start    Result offset for pagination.
     * @return array  List of file items that pass the access check.
     */
    private function getFiles($relative, $filter = '.', $sort = '', $limit = 0, $start = 0)
    {
        $filesystem = $this->getFileSystem();
        $list = $filesystem->getFiles($relative, $filter, $sort, $limit, $start);

        // profile's allowed file types, used as a hard executable floor below
        $allowed = (array) $this->getFileTypes('array');

        $list = array_filter($list, function ($item) use ($allowed) {
            // must have an id set
            if (empty($item['id'])) {
                return true;
            }

            // skip files with unsafe names (traversal/null/backslash); charset is not
            // restricted here so legitimately-named files remain visible (output is
            // HTML-encoded on the client)
            try {
                WFUtility::checkName($item['name']);
            } catch (\InvalidArgumentException $e) {
                return false;
            }

            // never list files with a dangerous/executable extension, even if the profile's
            // allowed types include it. php, js, exe, etc. are blocked unconditionally;
            // svg/html/htm remain conditional on the profile (matches upload/rename/copy/move).
            if (WFUtility::validateFileName($item['name'], $allowed) === false) {
                return false;
            }

            $path = dirname($item['id']);

            return $this->checkPathAccess($path);
        });

        return $list;
    }

    /**
     * Get the list of folders in a folder, filtered by path access rules.
     *
     * @param  string $relative The relative path of the folder.
     * @param  string $filter   A regex filter applied to folder names.
     * @param  string $sort     Sort order string passed to the filesystem.
     * @param  int    $limit    Maximum results to return (0 = unlimited).
     * @param  int    $start    Result offset for pagination.
     * @return array  List of folder items that pass the access check.
     */
    private function getFolders($relative, $filter = '', $sort = '', $limit = 0, $start = 0)
    {
        $filesystem = $this->getFileSystem();
        $list = $filesystem->getFolders($relative, $filter, $sort, $limit, $start);

        $list = array_filter($list, function ($item) {
            if (empty($item['id'])) {
                return true;
            }

            // skip folders with unsafe names (traversal/null/backslash); charset is not
            // restricted here so legitimately-named folders remain visible (output is
            // HTML-encoded on the client)
            try {
                WFUtility::checkName($item['name']);
            } catch (\InvalidArgumentException $e) {
                return false;
            }

            return $this->checkPathAccess($item['id']);
        });

        return $list;
    }

    /**
     * Sanitize a search term for safe use in a regex pattern.
     * Strips characters outside a known-safe set, preg_quote's the result,
     * then restores wildcard '*' as the regex '.*'.
     *
     * @param  string $term The raw search term.
     * @return string The sanitized, regex-safe search term.
     */
    private static function sanitizeSearchTerm($term)
    {
        try {
            $query = preg_replace('#[^a-zA-Z0-9_\.\-\:~\pL\pM\pN\s\* ]#u', '', $term);
        } catch (\Exception $e) {
            $query = preg_replace('#[^a-zA-Z0-9_\.\-\:~\s\* ]#', '', $term);
        }

        if (is_null($query) || $query === false) {
            $query = preg_replace('#[^a-zA-Z0-9_\.\-\:~\s\* ]#', '', $term);
        }

        $query = trim($query);

        // quote first
        $query = preg_quote($query, '/');

        // then restore wildcards (escaped \* becomes real regex .*)
        $query = str_replace('\*', '.*', $query);

        return $query;
    }

    /**
     * Search files and folders by keyword or extension query.
     *
     * @param  string $path  Directory path to search within (empty = all configured roots).
     * @param  int    $limit Maximum results per type; 0 = unlimited.
     * @param  int    $start Result offset for pagination.
     * @param  string $query Search query — keywords and/or extension filters (e.g. "cat *.jpg").
     * @param  string $sort  Sort order passed to the filesystem.
     * @return array  Result array with 'files', 'folders', 'total', 'path', and 'search' keys.
     */
    public function searchItems($path, $limit = 25, $start = 0, $query = '', $sort = '')
    {
        $path = rawurldecode($path);
        WFUtility::checkPath($path);

        $result = array(
            'folders' => array(),
            'files' => array(),
            'total' => array(
                'folders' => 0,
                'files' => 0,
            ),
            'path' => '',
            'search' => true
        );

        // no query value? bail...
        if ($query == '') {
            return $result;
        }

        $filesystem = $this->getFileSystem();

        if (method_exists($filesystem, 'searchItems') === false) {
            return $this->getItems($path, $limit, $start, $query, $sort);
        }

        // define and configure seach parameters
        $filetypes = (array) $this->getFileTypes('array');

        // Split query by "OR" or "|" operators
        $terms = array_map('trim', preg_split('/\s*(?:\bOR\b|\|)\s*/i', $query, -1, PREG_SPLIT_NO_EMPTY));

        $extensions = [];
        $keywords = [];

        foreach ($terms as $term) {
            if (
                strpos($term, '.') === 0 ||                            // ".jpg"
                (strpos($term, '*.') === 0 && strlen($term) > 2)       // "*.jpg"
            ) {
                // It's an extension
                $extensions[] = WFUtility::makeSafe($term);
            } elseif ($term !== '') {
                // It's a keyword, clean and convert wildcards
                foreach (preg_split('/\s+/', $term, -1, PREG_SPLIT_NO_EMPTY) as $subterm) {
                    $keywords[] = self::sanitizeSearchTerm($subterm);
                }
            }
        }

        // Filter filetypes
        if (!empty($extensions)) {
            $filetypes = array_filter($filetypes, function ($value) use ($extensions) {
                return in_array($value, $extensions, true);
            });
        }

        // Build keyword regex (match any of the keywords, case-insensitive)
        $filter = '';

        if (!empty($keywords)) {
            $filter = '^(?i).*(' . implode('|', $keywords) . ').*';
        }

        // query filter
        /*$keyword = '^(?i).*' . $keyword . '.*';

        if ($query[0] === '.') {
            // clean query removing leading .
            $extension = WFUtility::makeSafe($query);

            $filetypes = array_filter($filetypes, function ($value) use ($extension) {
                return $value === $extension;
            });

            $filter = '';
        }*/

        // get search depth
        $depth = $this->get('search_depth', 3);

        // trim the passed in path if any
        $path = trim($path, '/');

        // default to an empty store so the search loop below is always safe,
        // even when no directories are configured/accessible
        $storeArray = array();

        // no path value or root folder so get the default directories
        if (empty($path)) {
            $store = $this->getDirectoryStore();

            if (!empty($store)) {
                // case to array values as we don't need the keys
                $storeArray = array_values($store);
            }
        } else {
            // get the store array from the complex source path, eg: prefix:path
            $store = $this->getPathFromDirectoryStore($path);

            // extract the path from the complex source path, eg: prefix:path
            $path = $this->extractPath($path);

            $storeArray = array($store);
        }

        // search each store item
        foreach ($storeArray as $storeItem) {
            // define the prefix from the store array
            $prefix = $storeItem['prefix'];

            // make the source relative to the store path, eg: stories => images/stories
            $source = WFUtility::makePath($storeItem['path'], $path);

            // trim leading and trailing slash
            $source = trim($source, '/');

            $list = $filesystem->searchItems($source, $filter, $filetypes, $sort, $depth);

            $items = array_merge($list['folders'], $list['files']);

            // get properties for found items by type
            foreach ($items as $item) {
                $type = $item['type'];

                // remove the $store['path'] value from the beginning of the id, must be multibyte safe
                if (WFUtility::safe_strpos($item['id'], $storeItem['path']) === 0) {
                    $item['id'] = WFUtility::safe_substr($item['id'], WFUtility::safe_strlen($storeItem['path']));

                    // trim leading and trailing slash
                    $item['id'] = trim($item['id'], '/');
                }

                if ($type === 'files') {
                    $item['classes'] = '';

                    $item['path'] = WFUtility::makePath($storeItem['path'], $item['id']);

                    if (empty($item['properties'])) {
                        $item['properties'] = $filesystem->getFileDetails($item);
                    }
                }

                if ($type === 'folders') {
                    $item['path'] = WFUtility::makePath($storeItem['path'], $item['id']);

                    if (empty($item['properties'])) {
                        $item['properties'] = $filesystem->getFolderDetails($item);
                    }
                }

                // Keep id and name raw: this is JSON data used for file operations and to build
                // paths/urls. The client HTML-encodes on markup injection (see filebrowser.js).
                $item['id'] = $prefix . ':' . $item['id'];

                $item['name'] = WFUtility::mb_basename($item['name']);

                $result[$type][] = $item;
            }
        }

        // walk through the folders and files, reducing the result by the limit value if > 0
        if ($limit > 0) {
            $result['folders']  = array_slice($result['folders'], $start, $limit);
            $result['files']    = array_slice($result['files'], $start, $limit);
        }

        $result['total']['folder'] = count($result['folders']);
        $result['total']['files'] = count($result['files']);

        // Fire Event passing result as reference
        $this->fireEvent('onSearchItems', array(&$result));

        return $result;
    }

    /**
     * @param  string $source A source path.
     * @return string         The source path unchanged (hook for subclasses).
     */
    public function getRootDir($source)
    {
        return $source;
    }

    /**
     * Get file and folder listings for a directory.
     *
     * @param  string $source The current directory path (relative, or "prefix:relative" form).
     * @param  int    $limit  Maximum items to return per type (0 = unlimited).
     * @param  int    $start  Result offset for pagination.
     * @param  string $filter Optional name filter; prefix with '.' to filter by extension.
     * @param  string $sort   Sort order passed to the filesystem.
     * @return array  Result array with 'folders', 'files', 'total', and 'path' keys.
     */
    public function getItems($source, $limit = 25, $start = 0, $filter = '', $sort = '')
    {
        // decode path
        $source = rawurldecode($source);

        // check if source is a valid path;
        WFUtility::checkPath($source);

        $filesystem = $this->getFileSystem();

        $files = array();
        $folders = array();

        clearstatcache();

        // trim source to path variable
        $path = trim($source, '/');

        $prefix = '';

        // if a value is set process as possible return file, ie: check for prefix
        if ($path) {
            $prefix = $this->getPathPrefix($path);

            // may be a passed in value, eg: images/stories/fruit.jpg
            if (!$prefix) {
                // get source dir from path eg: images/stories/fruit.jpg = images/stories
                $path = $this->getSourceDir($path);
            }
        }

        // get the store array from the complex path path, eg: prefix:path
        $store = $this->getDirectoryStoreFromPath($path);

        // no path so get the default directories
        if (empty($path) || empty($store)) {
            $store = $this->getDirectoryStore();

            if (!empty($store)) {
                $storeArray = array_values($store);

                // defined list of directories
                if (count($storeArray) > 1) {
                    $folders = [];

                    foreach ($storeArray as $items) {
                        $folders[] = array(
                            'id'            => $items['prefix'] . ':',
                            'name'          => $items['label'],
                            'type'          => 'folders',
                            'properties'    => array(),
                        );
                    }

                    // return an array of root folder items
                    return array(
                        'folders' => $folders,
                        'files' => array(),
                        'total' => array(
                            'folders' => count($folders),
                            'files' => 0,
                        ),
                    );
                }

                // no defined directories, so use the first one for backward compatibility
                $store = $storeArray[0];
            }
        } else {
            // get the store array from the complex path path, eg: prefix:path
            if (!$prefix) {
                // make relative to the store path, eg: images/stories => stories
                if (WFUtility::safe_strpos($path, $store['path']) === 0) {
                    $path = WFUtility::safe_substr($path, WFUtility::safe_strlen($store['path']));
                    // trim
                    $path = trim($path, '/');
                }
            } else {
                // extract the path from the complex source path, eg: prefix:path
                $path = $this->extractPath($path);
            }
        }

        // define the prefix from the store array
        $prefix = $store['prefix'];

        // make the source relative to the store path, eg: stories => images/stories
        $fullpath = WFUtility::makePath($store['path'], $path);

        // revert to store path if the path is not a directory
        if (!$filesystem->is_dir($fullpath)) {
            $fullpath = $store['path'];
            $path = ''; // reset path to empty
        }

        // trim leading and trailing slash
        $fullpath = trim($fullpath, '/');

        $filetypes = (array) $this->getFileTypes('array');

        $name = '';

        if ($filter) {
            if ($filter[0] == '.') {
                $ext = WFUtility::makeSafe($filter);

                for ($i = 0; $i < count($filetypes); ++$i) {
                    if (preg_match('#^' . $ext . '#', $filetypes[$i]) === false) {
                        unset($filetypes[$i]);
                    }
                }
            } else {
                $name = '^(?i).*' . WFUtility::makeSafe($filter) . '.*';
            }
        }

        // get file list by filter
        $files = $this->getFiles($fullpath, $name . '\.(?i)(' . implode('|', $filetypes) . ')$', $sort, $limit, $start);

        if (empty($filter) || $filter[0] != '.') {
            // get folder list
            $folders = $this->getFolders($fullpath, '^(?i).*' . WFUtility::makeSafe($filter) . '.*', $sort, $limit, $start);
        }

        $folderArray = array();
        $fileArray = array();

        $items = array_merge($folders, $files);

        if (count($items)) {
            if (intval($limit) > 0) {
                $items = array_slice($items, $start, $limit);
            }

            foreach ($items as $item) {
                $item['classes'] = '';

                // remove the $store['path'] value from the beginning of the id, must be multibyte safe
                if (WFUtility::safe_strpos($item['id'], $store['path']) === 0) {
                    $item['id'] = WFUtility::safe_substr($item['id'], WFUtility::safe_strlen($store['path']));
                }

                // trim $id removing leading and trailing slashes. Keep the id raw: this is JSON
                // data that round-trips back to the server for file operations and is used to build
                // paths/urls, so HTML-encoding here would corrupt it. The client HTML-encodes every
                // value at the point of markup injection (see filebrowser.js), so encoding here would
                // also double-encode on display.
                $item['id'] = trim($item['id'], '/');

                // ensure name is relative. Keep raw for the same reasons as the id above.
                $item['name'] = WFUtility::mb_basename($item['name']);

                // create path
                $item['path'] = WFUtility::makePath($store['path'], $item['id']);

                // add the path prefix to the id
                $item['id'] = $prefix . ':' . $item['id'];

                if ($item['type'] == 'folders') {
                    if (empty($item['properties'])) {
                        $item['properties'] = $filesystem->getFolderDetails($item);
                    }

                    $folderArray[] = $item;
                } else {
                    // check for selected item
                    $item['selected'] = $filesystem->isMatch($item['url'], $source);

                    if (empty($item['properties'])) {
                        $item['properties'] = $filesystem->getFileDetails($item);
                    }

                    $fileArray[] = $item;
                }
            }
        }

        $result = array(
            'folders' => $folderArray,
            'files' => $fileArray,
            'total' => array(
                'folders' => count($folders),
                'files' => count($files),
            ),
            'path' => $prefix . ':' . $path,
        );

        // Fire Event passing result as reference
        $this->fireEvent('onGetItems', array(&$result));

        return $result;
    }

    /**
     * Get the immediate child folders for a tree node.
     *
     * @param  string $path The directory path (empty = root).
     * @return array  Array with 'label' and 'folders' keys.
     */
    public function getTreeItem($path = "")
    {
        $path = rawurldecode($path);

        WFUtility::checkPath($path);

        $path = trim($path, '/');

        $folders = array();

        $label = '';

        if (empty($path)) {
            $store = $this->getDirectoryStore();
            $storeArray = array_values($store);

            if (count($storeArray) > 1) {
                foreach ($storeArray as $item) {
                    $folders[] = array(
                        'id'    => $item['prefix'] . ':',
                        'name'  => $item['label'],
                        'path'  => $item['path'],
                        'class' => 'folder'
                    );
                }
            } else {
                $store = $storeArray[0];
                $folders = $this->getFolders($store['path']);

                $label = isset($store['label']) ? $store['label'] : '';

                array_walk($folders, function (&$item) use ($store) {
                    $path = $item['id'];

                    // remove the $store['path'] value from the beginning of the id, must be multibyte safe
                    if (WFUtility::safe_strpos($item['id'], $store['path']) === 0) {
                        $item['id'] = WFUtility::safe_substr($item['id'], WFUtility::safe_strlen($store['path']));
                    }

                    $item['id'] = trim($item['id'], '/');
                    $path = trim($path, '/');

                    $item['id']     = $store['prefix'] . ':' . $item['id'];
                    $item['path']   = $path;
                    $item['class']  = 'folder';
                });
            }
        } else {
            // get the store array from the complex source path, eg: prefix:path
            $store = $this->getDirectoryStoreFromPath($path);

            // extract the path from the complex source path, eg: prefix:path
            $path = $this->extractPath($path);

            // make the source relative to the store path, eg: stories => images/stories
            $path = WFUtility::makePath($store['path'], $path);

            // get source dir from path eg: images/stories/fruit.jpg = images/stories
            $source = $this->getSourceDir($path);

            // get folder list
            $folders = $this->getFolders($source);

            array_walk($folders, function (&$item) use ($store, $path) {
                // remove the $store['path'] value from the beginning of the id, must be multibyte safe
                if (WFUtility::safe_strpos($item['id'], $store['path']) === 0) {
                    $item['id'] = WFUtility::safe_substr($item['id'], WFUtility::safe_strlen($store['path']));
                }

                $item['id'] = trim($item['id'], '/');

                $item['id']     = $store['prefix'] . ':' . $item['id'];
                $item['path']   = WFUtility::makePath($path, $item['name']);
                $item['class']  = 'folder';
            });
        }

        $result = array(
            'label'     => $label,
            'folders'   => $folders
        );

        return $result;
    }

    /**
     * Build a full folder tree as an HTML string.
     *
     * @param  string $path The starting directory path (empty = root).
     * @return string The rendered HTML tree.
     */
    public function getTree($path = '')
    {
        // decode path
        $path = rawurldecode($path);

        WFUtility::checkPath($path);

        $result = $this->getTreeItems($path);

        return $result;
    }

    /**
     * Recursively render folder tree nodes as an HTML list.
     *
     * @param  string $path The current directory path.
     * @param  bool   $root Whether this is the outermost call (wraps output in a root list item).
     * @param  bool   $init Whether this is the initial call (loads root node data).
     * @return string The rendered HTML fragment.
     */
    public function getTreeItems($path, $root = true, $init = true)
    {
        $result = '';

        static $treedir = null;

        $folders = [];

        if ($init) {
            $treedir = $path;

            $items = $this->getTreeItem();
            $folders = $items['folders'];

            $label = $items['label'] ? $items['label'] :  Text::_('WF_LABEL_HOME', 'Home');

            if ($root) {
                $result .= '
                <ul>
                    <li data-id="/" class="uk-tree-open uk-tree-root uk-padding-remove">
                        <div class="uk-tree-row">
                            <a href="#">
                                <span class="uk-tree-icon" role="presentation">
                                    <i class="uk-icon uk-icon-home"></i>
                                </span>
                                <span class="uk-tree-text">' . htmlspecialchars($label, ENT_QUOTES, 'UTF-8') . '</span>
                            </a>
                        </div>
                ';
            }
        } else {
            $items = $this->getTreeItem($path);
            $folders = $items['folders'];
        }

        if (count($folders)) {
            $result .= '<ul class="uk-tree-node">';

            $open = false;

            foreach ($folders as $folder) {
                $id = trim($folder['id'], '/');

                if ($treedir) {
                    // resolve $treedir
                    $resolved = $this->resolvePath($treedir);

                    // check if the folder is open, ie: the path matches the current directory
                    $open = (bool) preg_match('#' . preg_quote($folder['path']) . '\b#', $resolved);
                }

                $result .= '
                <li data-id="' . htmlspecialchars($id, ENT_QUOTES, 'UTF-8') . '" class="' . ($open ? 'uk-tree-open' : '') . '">
                    <div class="uk-tree-row">
                        <a href="#">
                            <span class="uk-tree-icon" role="presentation"></span>
                            <span class="uk-tree-text uk-text-truncate" title="' . $folder['name'] . '">' . $folder['name'] . '</span>
                        </a>
                    </div>';

                if ($open) {
                    $result .= $this->getTreeItems($id, false, false);
                }

                $result .= '</li>';
            }

            $result .= '</ul>';
        }

        if ($init && $root) {
            $result .= '</li></ul>';
        }

        $init = false;

        return $result;
    }

    /**
     * Get a folder's properties (date, file count, etc.).
     *
     * @param  string $dir Relative folder path.
     * @return array  Folder properties array.
     */
    public function getFolderDetails($dir)
    {
        WFUtility::checkPath($dir);

        $filesystem = $this->getFileSystem();

        // get array with folder date and content count eg: array('date'=>'00-00-000', 'folders'=>1, 'files'=>2);
        return $filesystem->getFolderDetails($dir);
    }

    /**
     * Get a file's properties (size, date, dimensions, etc.).
     *
     * @param  string $file Relative file path.
     * @return array  File properties array.
     */
    public function getFileDetails($file)
    {
        WFUtility::checkPath($file);

        $filesystem = $this->getFileSystem();

        // get array with folder date and content count eg: array('date'=>'00-00-000', 'folders'=>1, 'files'=>2);
        return $filesystem->getFileDetails($file);
    }

    /**
     * Create default actions based on access.
     */
    private function addDefaultActions()
    {
        if ($this->checkFeature('help')) {
            $this->addAction('help', array('title' => Text::_('WF_BUTTON_HELP')));
        }

        if ($this->checkFeature('upload')) {
            $this->addAction('upload');
            $this->setRequest(array($this, 'upload'));
        }

        if ($this->checkFeature('create', 'folder')) {
            $this->addAction('folder_new');
            $this->setRequest(array($this, 'folderNew'));
        }
    }

    /**
     * Add an action to the list.
     *
     * @param string $name    Action name
     * @param array  $options Array of options
     */
    public function addAction($name, $options = array())
    {
        if (!is_array($options)) {
            list($name, $options['icon'], $options['action'], $options['title']) = func_get_args();
        }

        $options = array_merge(array('name' => $name), $options);

        // set some defaults
        if (!array_key_exists('icon', $options)) {
            $options['icon'] = '';
        }

        if (!array_key_exists('action', $options)) {
            $options['action'] = '';
        }

        if (!array_key_exists('title', $options)) {
            $options['title'] = Text::_('WF_BUTTON_' . strtoupper($name));
        }

        $this->_actions[$name] = $options;
    }

    /**
     * Get all actions.
     *
     * @return object
     */
    private function getActions()
    {
        return array_reverse($this->_actions);
    }

    /**
     * Remove an action from the list by name.
     *
     * @param string $name Action name to remove
     */
    public function removeAction($name)
    {
        if (isset($this->_actions[$name])) {
            unset($this->_actions[$name]);
        }
    }

    /**
     * Create all standard buttons based on access.
     */
    private function addDefaultButtons()
    {
        if ($this->checkFeature('delete', 'folder')) {
            $this->addButton('folder', 'delete', array('multiple' => true));

            $this->setRequest(array($this, 'deleteItem'));
        }
        if ($this->checkFeature('rename', 'folder')) {
            $this->addButton('folder', 'rename');

            $this->setRequest(array($this, 'renameItem'));
        }
        if ($this->checkFeature('move', 'folder')) {
            $this->addButton('folder', 'copy', array('multiple' => true));
            $this->addButton('folder', 'cut', array('multiple' => true));

            $this->addButton('folder', 'paste', array('multiple' => true, 'trigger' => true));

            $this->setRequest(array($this, 'copyItem'));
            $this->setRequest(array($this, 'moveItem'));
        }
        if ($this->checkFeature('rename', 'file')) {
            $this->addButton('file', 'rename');

            $this->setRequest(array($this, 'renameItem'));
        }
        if ($this->checkFeature('delete', 'file')) {
            $this->addButton('file', 'delete', array('multiple' => true));

            $this->setRequest(array($this, 'deleteItem'));
        }
        if ($this->checkFeature('move', 'file')) {
            $this->addButton('file', 'copy', array('multiple' => true));
            $this->addButton('file', 'cut', array('multiple' => true));

            $this->addButton('file', 'paste', array('multiple' => true, 'trigger' => true));

            $this->setRequest(array($this, 'copyItem'));
            $this->setRequest(array($this, 'moveItem'));
        }
        $this->addButton('file', 'view', array('restrict' => $this->getViewable()));
    }

    /**
     * Add a button to the button bar.
     *
     * @param  string $type    Button type: 'file' or 'folder'.
     * @param  string $name    Button name (used to derive the default title and icon).
     * @param  array  $options Optional overrides: icon, action, title, multiple, trigger, restrict.
     * @return void
     */
    public function addButton($type, $name, $options = array())
    {
        $options = array_merge(array('name' => $name), $options);

        // set some defaults
        if (!array_key_exists('icon', $options)) {
            $options['icon'] = '';
        }

        if (!array_key_exists('action', $options)) {
            $options['action'] = '';
        }

        if (!array_key_exists('title', $options)) {
            $options['title'] = Text::_('WF_BUTTON_' . strtoupper($name));
        }

        if (!array_key_exists('multiple', $options)) {
            $options['multiple'] = false;
        }

        if (!array_key_exists('trigger', $options)) {
            $options['trigger'] = false;
        }

        if (!array_key_exists('restrict', $options)) {
            $options['restrict'] = '';
        }

        $this->_buttons[$type][$name] = $options;
    }

    /**
     * Return an object list of all buttons.
     *
     * @return object
     */
    private function getButtons()
    {
        return $this->_buttons;
    }

    /**
     * Remove a button.
     *
     * @param string $type Button type
     * @param string $name Button name
     */
    public function removeButton($type, $name)
    {
        if (array_key_exists($name, $this->_buttons[$type])) {
            unset($this->_buttons[$type][$name]);
        }
    }

    /**
     * Change a buttons properties.
     *
     * @param string $type Button type
     * @param string $name Button name
     * @param array $keys Button keys
     */
    public function changeButton($type, $name, $keys)
    {
        foreach ($keys as $key => $value) {
            if (isset($this->_buttons[$type][$name][$key])) {
                $this->_buttons[$type][$name][$key] = $value;
            }
        }
    }

    /**
     * Add an event.
     *
     * @param string $name     Event name
     * @param string $function Event function name
     */
    public function addEvent($name, $function)
    {
        $this->_events[$name] = $function;
    }

    /**
     * Execute a registered event handler.
     *
     * @param  string     $name Event name.
     * @param  array|null $args Arguments to pass to the handler.
     * @return mixed      The handler's return value, or an empty array if no handler is registered.
     */
    protected function fireEvent($name, $args = null)
    {
        if (array_key_exists($name, $this->_events)) {
            $event = $this->_events[$name];

            if (is_array($event)) {
                return call_user_func_array($event, $args);
            } else {
                return call_user_func($event, $args);
            }
        }

        return array();
    }

    /**
     * Validate an uploaded file: presence, upload integrity, name safety, content safety,
     * size, and MIME type. Deletes the temp file and throws on any failure.
     *
     * @param  array $file $_FILES entry for the uploaded file.
     * @return true  Always returns true on success.
     * @throws InvalidArgumentException On any validation failure.
     */
    private function validateUploadedFile($file)
    {
        // check the POST data array
        if (empty($file) || empty($file['tmp_name'])) {
            throw new InvalidArgumentException('Upload Failed: No data');
        }

        // check for tmp_name and is valid uploaded file
        if (!is_uploaded_file($file['tmp_name'])) {
            throw new InvalidArgumentException('Upload Failed: Not an uploaded file');
        }

        $upload = $this->get('upload');

        // reject null bytes in the filename before any further processing
        if (strpos($file['name'], "\x00") !== false) {
            @unlink($file['tmp_name']);
            throw new InvalidArgumentException('Upload Failed: The file name contains a null byte.');
        }

        // fetch profile-allowed extensions first so they can inform filename validation
        $allowed = (array) $this->getFileTypes('array');

        // validate the full filename, passing profile-allowed extensions so explicitly permitted
        // types (e.g. svg) are not blocked on the final extension
        if (WFUtility::validateFileName($file['name'], $allowed) === false) {
            @unlink($file['tmp_name']);
            throw new InvalidArgumentException(Text::_('WF_MANAGER_UPLOAD_INVALID_EXT_ERROR'));
        }

        // now safe to extract the extension from the validated filename
        $ext = WFUtility::getExtension($file['name'], true);

        // check file content for PHP tags, phar stubs, invalid images, etc.
        WFUtility::isSafeFile($file, $allowed);

        if (is_array($allowed) && !empty($allowed) && in_array($ext, $allowed) === false) {
            @unlink($file['tmp_name']);
            throw new InvalidArgumentException(Text::_('WF_MANAGER_UPLOAD_INVALID_EXT_ERROR'));
        }

        $size = round(filesize($file['tmp_name']) / 1024);

        if (empty($upload['max_size'])) {
            $upload['max_size'] = 10240;
        }

        // validate size
        if ($size > (int) $upload['max_size']) {
            @unlink($file['tmp_name']);

            throw new InvalidArgumentException(Text::sprintf('WF_MANAGER_UPLOAD_SIZE_ERROR', $file['name'], $size, $upload['max_size']));
        }

        // validate mimetype
        if ($upload['validate_mimetype']) {
            if (WFMimeType::check($file['name'], $file['tmp_name']) === false) {
                @unlink($file['tmp_name']);
                throw new InvalidArgumentException(Text::_('WF_MANAGER_UPLOAD_MIME_ERROR'));
            }
        }

        return true;
    }

    /**
     * Validate the upload destination directory and quota limits.
     * Returns the resolved directory path on success; throws on any failure.
     *
     * @param  string $dir    Raw destination path (post-event)
     * @param  array  $upload Upload settings from profile config
     * @return string         Resolved, validated directory path
     */
    private function validateUploadDirectory($dir, $upload)
    {
        WFUtility::checkPath($dir);

        if (empty($dir)) {
            $dir = $this->getDefaultPath();
        }

        $dir = $this->resolvePath($dir);

        if (empty($dir)) {
            throw new InvalidArgumentException('Upload Failed: Invalid target directory');
        }

        $filesystem = $this->getFileSystem();

        if (!$filesystem->is_dir($dir)) {
            throw new InvalidArgumentException('Upload Failed: The target directory does not exist');
        }

        if (!$this->checkPathAccess($dir)) {
            throw new InvalidArgumentException('Upload Failed: Access to the target directory is restricted');
        }

        if (!empty($upload['total_files'])) {
            if ($filesystem->countFiles($dir, true) > $upload['total_files']) {
                throw new InvalidArgumentException(Text::_('WF_MANAGER_FILE_LIMIT_ERROR'));
            }
        }

        if (!empty($upload['total_size'])) {
            $size = $filesystem->getTotalSize($dir);

            if (($size / 1024 / 1024) > $upload['total_size']) {
                throw new InvalidArgumentException(Text::_('WF_MANAGER_FILE_SIZE_LIMIT_ERROR'));
            }
        }

        return $dir;
    }

    /**
     * Handle a file upload request.
     *
     * @return array Result array with 'files' on success or 'error' on failure.
     * @throws Exception              If the upload feature is not permitted.
     * @throws InvalidArgumentException On validation or filesystem failure.
     */
    public function upload()
    {
        // Check for request forgeries
        Session::checkToken('request') or jexit(Text::_('JINVALID_TOKEN'));

        // check for feature access
        if (!$this->checkFeature('upload')) {
            throw new Exception(Text::_('JERROR_ALERTNOAUTHOR'));
        }

        $app = Factory::getApplication();

        $filesystem = $this->getFileSystem();

        // get uploaded file
        $file = $app->input->files->get('file', array(), 'raw');

        // validate file
        $this->validateUploadedFile($file);

        $allowed = (array) $this->getFileTypes('array');

        // derive and normalise the extension from the actual uploaded file
        $ext = WFUtility::getExtension($file['name'], true);
        $ext = trim($ext);
        $ext = WFUtility::makeSafe($ext, $this->get('websafe_mode', 'utf-8'), $this->get('websafe_spaces'), $this->get('websafe_textcase'));

        if (empty($ext) || $ext === $file['name']) {
            @unlink($file['tmp_name']);
            throw new InvalidArgumentException('Upload Failed: The file name does not contain a valid extension.');
        }

        // validate and process the user-supplied destination name
        $name = (string) $app->input->get('name', $file['name'], 'STRING');
        $name = rawurldecode($name);

        if (WFUtility::validateFileName($name, $allowed) === false) {
            @unlink($file['tmp_name']);
            throw new InvalidArgumentException('Upload Failed: The file name is invalid.');
        }

        try {
            WFUtility::checkPath($name);
        } catch (InvalidArgumentException $e) {
            @unlink($file['tmp_name']);
            throw $e;
        }

        $name = WFUtility::stripExtension($name);
        $name = WFUtility::makeSafe($name, $this->get('websafe_mode', 'utf-8'), $this->get('websafe_spaces'), $this->get('websafe_textcase'));

        if (WFUtility::validateFileName($name, $allowed) === false) {
            @unlink($file['tmp_name']);
            throw new InvalidArgumentException('Upload Failed: The file name is invalid.');
        }

        $upload = $this->get('upload');

        if ($upload['add_random']) {
            $random = bin2hex(random_bytes(8));

            // append a 16 character random string to the file name
            if ((int) $upload['add_random'] === 1) {
                $name = $name . '_' . $random;

            // randomize the entire file name
            } elseif ((int) $upload['add_random'] === 2) {
                $name = $random;
            }
        }

        $name = $name . '.' . $ext;

        $dir = (string) $app->input->get('upload-dir', '', 'STRING');
        $dir = rawurldecode($dir);

        $this->fireEvent('onBeforeUpload', array(&$file, &$dir, &$name));

        // re-validate name in case an event handler modified it
        if (WFUtility::validateFileName($name, $allowed) === false) {
            @unlink($file['tmp_name']);
            throw new InvalidArgumentException('Upload Failed: The file name is invalid.');
        }

        try {
            WFUtility::checkPath($name);
        } catch (InvalidArgumentException $e) {
            @unlink($file['tmp_name']);
            throw $e;
        }

        try {
            $dir = $this->validateUploadDirectory($dir, $upload);
        } catch (InvalidArgumentException $e) {
            @unlink($file['tmp_name']);
            throw $e;
        }

        $result = $filesystem->upload('multipart', trim($file['tmp_name']), $dir, $name);

        @unlink($file['tmp_name']);

        // upload finished
        if ($result instanceof WFFileSystemResult) {
            if (!$result->state) {
                if (empty($result->message)) {
                    $result->message = Text::_('WF_MANAGER_UPLOAD_ERROR');
                }

                $result->code = 103;
            }

            if ($result->state === true) {
                $name = WFUtility::mb_basename($result->path);

                if (empty($result->url)) {
                    /*$relative = WFUtility::makePath($dir, $name);
                    $result->url = WFUtility::makePath($filesystem->getBaseURL(), $relative);*/

                    $result->url = WFUtility::makePath($dir, $name);
                }

                // trim slashes
                $result->url = trim($result->url, '/');

                // run events
                $data = $this->fireEvent('onUpload', array($result->path, $result->url));

                $data['name'] = $name;

                $this->setResult($data, 'files');
            } else {
                $this->setResult($result->message, 'error');
            }
        }

        return $this->getResult();
    }

    /**
     * Delete one or more files or folders.
     *
     * @param  string $items Comma-separated list of relative paths to delete.
     * @return array  Result array with deleted items or error messages.
     * @throws Exception              If the delete feature is not permitted.
     * @throws InvalidArgumentException On path or access validation failure.
     */
    public function deleteItem($items)
    {
        // check for feature access
        if (!$this->checkFeature('delete', 'folder') && !$this->checkFeature('delete', 'file')) {
            throw new Exception(Text::_('JERROR_ALERTNOAUTHOR'));
        }

        $filesystem = $this->getFileSystem();
        $items = explode(',', rawurldecode((string) $items));

        foreach ($items as $item) {
            // decode and cast as string
            $item = (string) rawurldecode($item);

            // check path
            WFUtility::checkPath($item);

            $item = $this->resolvePath($item);

            if ($filesystem->is_file($item)) {
                if ($this->checkFeature('delete', 'file') === false) {
                    throw new Exception(Text::_('JERROR_ALERTNOAUTHOR'));
                }

                // check extension is allowed and the name is not blocked (executable extensions etc.).
                // Pass the profile's allowed types so svg/html/htm stay operable when the profile
                // permits them (matches the listing gate in getFiles()).
                $ext     = WFUtility::getExtension($item, true);
                $allowed = (array) $this->getFileTypes('array');

                if (WFUtility::validateFileName(WFUtility::mb_basename($item), $allowed) === false) {
                    throw new InvalidArgumentException('Delete Failed: The file name is invalid.');
                }

                if (is_array($allowed) && !empty($allowed) && in_array($ext, $allowed) === false) {
                    throw new InvalidArgumentException('Delete Failed: Invalid file extension.');
                }

                $path = $item;
            } elseif ($filesystem->is_dir($item)) {
                if ($this->checkFeature('delete', 'folder') === false) {
                    throw new Exception(Text::_('JERROR_ALERTNOAUTHOR'));
                }

                $path = dirname($item);
            } else {
                throw new InvalidArgumentException('Delete Failed: Item does not exist.');
            }

            // check access
            if (!$this->checkPathAccess($path)) {
                throw new InvalidArgumentException('Delete Failed: Access to the target directory is restricted');
            }

            $result = $filesystem->delete($item);

            if ($result instanceof WFFileSystemResult) {
                if (!$result->state) {
                    if ($result->message) {
                        $this->setResult($result->message, 'error');
                    } else {
                        $this->setResult(Text::sprintf('WF_MANAGER_DELETE_' . strtoupper($result->type) . '_ERROR', WFUtility::mb_basename($item)), 'error');
                    }
                } else {
                    $this->fireEvent('on' . ucfirst($result->type) . 'Delete', array($item));
                    $this->setResult($item, $result->type);
                }
            }
        }

        return $this->getResult();
    }

    /**
     * Rename a file or folder.
     * Source and destination are read via func_get_args() for legacy compatibility.
     *
     * @return array Result array with renamed item data or error messages.
     * @throws Exception              If the rename feature is not permitted.
     * @throws InvalidArgumentException On path or access validation failure.
     */
    public function renameItem()
    {
        // check for feature access
        if (!$this->checkFeature('rename', 'folder') && !$this->checkFeature('rename', 'file')) {
            throw new Exception(Text::_('JERROR_ALERTNOAUTHOR'));
        }

        $args = func_get_args();

        $source = array_shift($args);
        $destination = array_shift($args);

        // decode and cast as string
        $source = (string) rawurldecode($source);

        // decode and cast as string
        $destination = (string) rawurldecode($destination);

        WFUtility::checkPath($source);
        WFUtility::checkPath($destination);

        $allowed = (array) $this->getFileTypes('array');

        // check source file name is not blocked
        if (WFUtility::validateFileName(WFUtility::mb_basename($source), $allowed) === false) {
            throw new InvalidArgumentException('Rename Failed: The source file name is invalid.');
        }

        // sanitize destination
        $destination = WFUtility::makeSafe($destination, $this->get('websafe_mode'), $this->get('websafe_spaces'), $this->get('websafe_textcase'));

        // check for extension in destination name
        if (WFUtility::validateFileName($destination, $allowed) === false) {
            throw new InvalidArgumentException('Rename Failed: The file name is invalid.');
        }

        // extract the path from the complex path, removing the prefix
        $source = $this->resolvePath($source);

        $filesystem = $this->getFileSystem();

        if ($filesystem->is_file($source)) {
            if ($this->checkFeature('rename', 'file') === false) {
                throw new Exception(Text::_('JERROR_ALERTNOAUTHOR'));
            }

            // validate extension against allowed list
            $ext = WFUtility::getExtension($source, true);

            if (!empty($allowed) && in_array($ext, $allowed) === false) {
                throw new InvalidArgumentException('Rename Failed: Invalid file extension.');
            }

            $path = dirname($source);
        } elseif ($filesystem->is_dir($source)) {
            if ($this->checkFeature('rename', 'folder') === false) {
                throw new Exception(Text::_('JERROR_ALERTNOAUTHOR'));
            }

            $path = $source;
        } else {
            throw new InvalidArgumentException('Rename Failed: Item does not exist.');
        }

        // check access
        if (!$this->checkPathAccess($path)) {
            throw new InvalidArgumentException('Rename Failed: Access to the target directory is restricted');
        }

        $result = $filesystem->rename($source, $destination);

        if ($result instanceof WFFileSystemResult) {
            if (!$result->state) {
                $this->setResult(Text::sprintf('WF_MANAGER_RENAME_' . strtoupper($result->type) . '_ERROR', WFUtility::mb_basename($source)), 'error');
                if ($result->message) {
                    $this->setResult($result->message, 'error');
                }
            } else {
                $data = array(
                    'name' => WFUtility::mb_basename($result->path),
                );

                $event = $this->fireEvent('on' . ucfirst($result->type) . 'Rename', array($destination));

                // merge event data with default values
                $data = array_merge($data, $event);

                $this->setResult($data, $result->type);
            }
        }

        return $this->getResult();
    }

    /**
     * Copy one or more files or folders to a destination directory.
     *
     * @param  string $items       Comma-separated list of relative paths to copy.
     * @param  string $destination Relative path of the destination directory.
     * @param  string $conflict    Conflict resolution: 'copy', 'replace', or empty to prompt.
     * @return array  Result array with copied item data or error messages.
     * @throws Exception              If the move feature is not permitted.
     * @throws InvalidArgumentException On path or access validation failure.
     */
    public function copyItem($items, $destination, $conflict = '')
    {
        // check for feature access
        if (!$this->checkFeature('move', 'folder') && !$this->checkFeature('move', 'file')) {
            throw new Exception(Text::_('JERROR_ALERTNOAUTHOR'));
        }

        $filesystem = $this->getFileSystem();

        $items = explode(',', rawurldecode((string) $items));

        // decode and cast as string
        $destination = (string) rawurldecode($destination);

        // check destination path
        WFUtility::checkPath($destination);

        // extract the path from the complex path, removing the prefix
        $destination = $this->resolvePath($destination);

        if (empty($destination)) {
            throw new InvalidArgumentException('Copy Failed:Invalid destination path.');
        }

        $allowed = (array) $this->getFileTypes('array');

        // check for extension in destination name
        if (WFUtility::validateFileName($destination, $allowed) === false) {
            throw new InvalidArgumentException('Copy Failed: The file name is invalid.');
        }

        // check path exists
        if (!$filesystem->is_dir($destination)) {
            throw new InvalidArgumentException('Copy Failed: The target directory does not exist');
        }

        // check access
        if (!$this->checkPathAccess($destination)) {
            throw new InvalidArgumentException('Copy Failed: Access to the target directory is restricted');
        }

        foreach ($items as $item) {
            // decode and cast as string
            $item = (string) rawurldecode($item);

            // check source path
            WFUtility::checkPath($item);

            if (WFUtility::validateFileName($item, $allowed) === false) {
                throw new InvalidArgumentException('Copy Failed: The file name is invalid.');
            }

            $item = $this->resolvePath($item);

            if ($filesystem->is_file($item)) {
                if ($this->checkFeature('move', 'file') === false) {
                    throw new Exception(Text::_('JERROR_ALERTNOAUTHOR'));
                }

                // validate extension against allowed list
                $ext = WFUtility::getExtension($item, true);

                if (!empty($allowed) && in_array($ext, $allowed) === false) {
                    throw new InvalidArgumentException('Copy Failed: Invalid file extension.');
                }

                $path = dirname($item);
            } elseif ($filesystem->is_dir($item)) {
                if ($this->checkFeature('move', 'folder') === false) {
                    throw new Exception(Text::_('JERROR_ALERTNOAUTHOR'));
                }

                $path = $item;
            } else {
                throw new InvalidArgumentException('Copy Failed: Item does not exist.');
            }

            $target = WFUtility::makePath($destination, WFUtility::mb_basename($item));

            if ($filesystem->is_file($target)) {
                // target is the same as the source so paste as copy
                if ($target === $item) {
                    $conflict = 'copy';
                    // file exists and is being copied into a new folder
                } else {
                    // conflict action not set so confirm
                    if (!$conflict) {
                        $this->setResult($item, 'confirm');
                        return $this->getResult();
                    }
                }
            }

            // check access
            if (!$this->checkPathAccess($path)) {
                throw new InvalidArgumentException('Copy Failed: Access to the target directory is restricted');
            }

            $result = $filesystem->copy($item, $destination, $conflict);

            if ($result instanceof WFFileSystemResult) {
                if (!$result->state) {
                    if ($result->message) {
                        $this->setResult($result->message, 'error');
                    } else {
                        $this->setResult(Text::sprintf('WF_MANAGER_COPY_' . strtoupper($result->type) . '_ERROR', WFUtility::mb_basename($item)), 'error');
                    }
                } else {
                    $data = array(
                        'name' => $filesystem->toRelative($result->path),
                    );

                    $event = $this->fireEvent('on' . ucfirst($result->type) . 'Copy', array($item));

                    // merge event data with default values
                    $data = array_merge($data, $event);

                    $this->setResult($data, $result->type);
                }
            }
        }

        return $this->getResult();
    }

    /**
     * Move one or more files or folders to a destination directory.
     *
     * @param  string $items       Comma-separated list of relative paths to move.
     * @param  string $destination Relative path of the destination directory.
     * @param  bool   $overwrite   Whether to overwrite existing items at the destination.
     * @return array  Result array with moved item data or error messages.
     * @throws Exception              If the move feature is not permitted.
     * @throws InvalidArgumentException On path or access validation failure.
     */
    public function moveItem($items, $destination, $overwrite = false)
    {
        // check for feature access
        if (!$this->checkFeature('move', 'folder') && !$this->checkFeature('move', 'file')) {
            throw new Exception(Text::_('JERROR_ALERTNOAUTHOR'));
        }

        $filesystem = $this->getFileSystem();

        $items = explode(',', rawurldecode((string) $items));

        // decode and cast as string
        $destination = (string) rawurldecode($destination);

        // check destination path
        WFUtility::checkPath($destination);

        // resolve the path to the directory store, eg: files/foo.pdf => images/files/foo.pdf
        $destination = $this->resolvePath($destination);

        if (empty($destination)) {
            throw new InvalidArgumentException('Move Failed: The destination path is invalid.');
        }

        $allowed = (array) $this->getFileTypes('array');

        // check for extension in destination name
        if (WFUtility::validateFileName($destination, $allowed) === false) {
            throw new InvalidArgumentException('Move Failed: The file name is invalid.');
        }

        // check path exists
        if (!$filesystem->is_dir($destination)) {
            throw new InvalidArgumentException('Move Failed: The target directory does not exist');
        }

        // check access
        if (!$this->checkPathAccess($destination)) {
            throw new InvalidArgumentException('Move Failed: Access to the target directory is restricted');
        }

        foreach ($items as $item) {
            // decode and cast as string
            $item = (string) rawurldecode($item);

            // check source path
            WFUtility::checkPath($item);

            // extract the path from the complex path, removing the prefix
            $item = $this->resolvePath($item);

            if (WFUtility::validateFileName($item, $allowed) === false) {
                throw new InvalidArgumentException('Move Failed: The file name is invalid.');
            }

            if ($filesystem->is_file($item)) {
                if ($this->checkFeature('move', 'file') === false) {
                    throw new Exception(Text::_('JERROR_ALERTNOAUTHOR'));
                }

                // validate extension against allowed list
                $ext = WFUtility::getExtension($item, true);

                if (!empty($allowed) && in_array($ext, $allowed) === false) {
                    throw new InvalidArgumentException('Move Failed: Invalid file extension.');
                }
            } elseif ($filesystem->is_dir($item)) {
                if ($this->checkFeature('move', 'folder') === false) {
                    throw new Exception(Text::_('JERROR_ALERTNOAUTHOR'));
                }
            }

            if ($filesystem->is_file(WFUtility::makePath($destination, WFUtility::mb_basename($item))) && $overwrite === false) {
                $this->setResult($item, 'confirm');

                return $this->getResult();
            }

            $result = $filesystem->move($item, $destination);

            if ($result instanceof WFFileSystemResult) {
                if (!$result->state) {
                    if ($result->message) {
                        $this->setResult($result->message, 'error');
                    } else {
                        $this->setResult(Text::sprintf('WF_MANAGER_MOVE_' . strtoupper($result->type) . '_ERROR', WFUtility::mb_basename($item)), 'error');
                    }
                } else {
                    $data = array(
                        'name' => $filesystem->toRelative($result->path),
                    );

                    $event = $this->fireEvent('on' . ucfirst($result->type) . 'Move', array($item));

                    // merge event data with default values
                    $data = array_merge($data, $event);

                    $this->setResult($data, $result->type);
                }
            }
        }

        return $this->getResult();
    }

    /**
     * Create a new folder in a target directory.
     * Target path and folder name are read via func_get_args() for legacy compatibility.
     *
     * @return array Result array with new folder data or error messages.
     * @throws Exception              If the folder create feature is not permitted.
     * @throws InvalidArgumentException On path or access validation failure.
     */
    public function folderNew()
    {
        // check if the user has access to create a folder
        if ($this->checkFeature('create', 'folder') === false) {
            throw new Exception(Text::_('JERROR_ALERTNOAUTHOR'));
        }

        $args = func_get_args();

        // path where the new folder will be created
        $target = array_shift($args);

        // a folder cannot be created in the primary directory tree
        if (empty($target)) {
            throw new InvalidArgumentException('Action Failed: Invalid target directory');
        }

        // the name of the new folder
        $new = array_shift($args);

        // decode and cast as string
        $target = (string) rawurldecode($target);
        $new = (string) rawurldecode($new);

        $target = $this->resolvePath($target);

        // check access
        if (!$this->checkPathAccess($target)) {
            throw new InvalidArgumentException('Action Failed: Access to the target directory is restricted');
        }

        $filesystem = $this->getFileSystem();

        $name = WFUtility::makeSafe($new, $this->get('websafe_mode'), $this->get('websafe_spaces'), $this->get('websafe_textcase'));

        // check for extension in destination name
        if (WFUtility::validateFileName($name) === false) {
            throw new InvalidArgumentException('Action Failed: The file name is invalid.');
        }

        $result = $filesystem->createFolder($target, $name, $args);

        if ($result instanceof WFFileSystemResult) {
            if (!$result->state) {
                if ($result->message) {
                    $this->setResult($result->message, 'error');
                } else {
                    $this->setResult(Text::sprintf('WF_MANAGER_NEW_FOLDER_ERROR', WFUtility::mb_basename($new)), 'error');
                }
            } else {
                $data = array(
                    'name'  => WFUtility::mb_basename($new),
                    'id'    => WFUtility::mb_basename($new),
                );

                $event = $this->fireEvent('onFolderNew', array($new));

                // merge event data with default values
                $data = array_merge($data, $event);

                $this->setResult($data, $result->type);
            }
        }

        return $this->getResult();
    }

    /**
     * Get the dimensions of a file.
     *
     * @param string $file The file to get dimensions for
     * @return array The dimensions of the file
     */
    public function getDimensions($file)
    {
        return $this->getFileSystem()->getDimensions($file);
    }

    /**
     * Convert a file to an absolute path.
     *
     * @param string $file The file to convert
     * @return string The absolute path
     */
    public function toAbsolute($file)
    {
        $path = $this->resolvePath($file);

        return $this->getFileSystem()->toAbsolute($path);
    }

    /**
     * Convert a file to a relative path.
     *
     * @param string $file The file to convert
     * @return string The relative path
     */
    public function toRelative($file)
    {
        $path = $this->resolvePath($file);

        return $this->getFileSystem()->toRelative($path);
    }

    /**
     * Proxy for the filesystem read method.
     *
     * @param string $file The file to read
     * @return string The file contents
     */
    public function readFile($file)
    {
        $path = $this->resolvePath($file);

        return $this->getFileSystem()->read($path);
    }

    /**
     * Write data to a file via the filesystem proxy.
     *
     * @param  string $file The relative file path.
     * @param  string $data The data to write.
     * @return mixed        Result from the filesystem write method.
     */
    public function writeFile($file, $data)
    {
        $path = $this->resolvePath($file);

        return $this->getFileSystem()->write($path, $data);
    }

    /**
     * Proxy for the filesystem is_file method.
     * @param string $file The file to check
     * @return bool True if the file exists
     */
    public function is_file($file)
    {
        $path = $this->resolvePath($file);

        return $this->getFileSystem()->is_file($path);
    }

    /**
     * Proxy for the filesystem is_dir method.
     *
     * @param string $path The path to check
     * @return boolean True if the path is a directory
     */
    public function is_dir($path)
    {
        $path = $this->resolvePath($path);

        return $this->getFileSystem()->is_dir($path);
    }

    /**
     * Get the effective PHP upload size limit in bytes (lower of upload_max_filesize and post_max_size).
     *
     * @return int The upload size limit in bytes.
     */
    private function getUploadValue()
    {
        $upload = trim(ini_get('upload_max_filesize'));
        $post = trim(ini_get('post_max_size'));

        $upload = WFUtility::convertSize($upload);
        $post = WFUtility::convertSize($post);

        if (intval($upload) <= intval($post)) {
            return $upload;
        }

        return $post;
    }

    /**
     * Build the default upload config array, capping max_size against PHP ini limits.
     *
     * @return array Upload settings including max_size, filetypes, and any filesystem overrides.
     */
    private function getUploadDefaults()
    {
        $filesystem = $this->getFileSystem();
        $features = $filesystem->get('upload');

        $upload_max = $this->getUploadValue();

        $upload = $this->get('upload');

        // get max size as kilobytes
        if (empty($upload['max_size'])) {
            $upload['max_size'] = 10240;
        }

        // get upload size as integer
        $size = intval(preg_replace('/[^0-9]/', '', $upload['max_size']));

        // must not exceed server maximum if > 0
        if (!empty($upload_max)) {
            if ((int) $size * 1024 > (int) $upload_max) {
                $size = $upload_max / 1024;
            }
        }

        $upload = array_merge($upload, array(
            'max_size' => $size,
            'filetypes' => $this->listFileTypes(),
        ));

        if (isset($features['elements'])) {
            $upload['elements'] = $features['elements'];
        }

        if (isset($features['dialog'])) {
            $upload['dialog'] = $features['dialog'];
        }

        return $upload;
    }

    /**
     * Initialise browser configuration from the passed config array, filesystem settings,
     * and computed path variables.
     *
     * @param  array $config Configuration array from the manager (features, dir store, upload, etc.).
     * @return void
     */
    private function setConfig($config = array())
    {
        // apply passed in properties (this must be done before initialising filesystem!)
        if (!empty($config)) {
            $this->setProperties($config);
        }

        $filesystem = $this->getFileSystem();

        $default = array(
            'upload' => $this->getUploadDefaults(),
        );

        $properties = array('base', 'delete', 'rename', 'folder_new', 'copy', 'move', 'list_limit');

        foreach ($properties as $property) {
            if ($filesystem->get($property)) {
                $default[$property] = $filesystem->get($property);
            }
        }

        $pathVariables = $this->getPathVariables();

        foreach ($pathVariables as $key => $value) {
            $default[$key] = $value;
        }

        // apply default properties
        $this->setProperties($default);
    }
}
