Flex Explorer

Flex Explorer adds a simple, read-only file browser to the WordPress admin. It
lets administrators look through the contents of the wp-content directory and
preview text files and images without leaving wp-admin or opening an FTP client.

It never modifies your site: it cannot create, edit, upload, rename, move or
delete files. You can download an individual file, or a whole folder as a ZIP,
for offline viewing, and the originals are always left untouched. Every request is
restricted to the wp-content directory, is limited to administrators, and is
verified with a nonce.

Features

• Browse folders inside wp-content with a breadcrumb path.
• List files and folders with size and last-modified date.
• Search filenames in the current folder and everything below it.
• Preview text and code files inline (up to 2 MB).
• Preview common images (JPEG, PNG, GIF, WebP, BMP, ICO) inline (up to 5 MB).
• Download any single file, or the current folder packaged as a ZIP.
• Uses the jQuery bundled with WordPress and plain CSS – no build step, no external libraries.

Security

• Access is limited to users with the manage_options capability.
• On multisite, access is further restricted to network super admins, since a
  per-site administrator should not be able to read the shared wp-content
  tree.
• If the site defines DISALLOW_FILE_EDIT as true, Flex Explorer disables
  itself (including its admin menu) to respect that lockdown.
• All AJAX requests are nonce-verified.
• Every path is resolved with realpath() and confined to the wp-content
  directory; path traversal and symlink escapes are rejected.
• wp-config.php, .htaccess and .htpasswd, plus private keys and
  certificates (.key, .pem), can never be viewed or downloaded, and are
  skipped when building a ZIP.
• Downloads are always sent as attachments (application/octet-stream) so the
  browser never renders file contents inline.
• ZIP archives are bounded (file count and total size) and skip symlinks so a
  large or looping tree cannot exhaust server resources.