No override warning when archive extraction overwrites existing files
Description
When extracting an archive via the File Manager or the decompression API endpoint, existing files and directories at the extraction path are silently overwritten with no warning or confirmation prompt. This can lead to accidental and irreversible data loss.
Steps to Reproduce
- Navigate to the File Manager for any server
- Upload an archive (e.g.
world.tar.gz) that contains a directory matching an existing directory on the server - Right-click the archive and select Unarchive
- The archive is extracted immediately — existing files/directories are overwritten without any confirmation
Expected Behavior
The panel should warn the user before extraction if the archive contains files or directories that would overwrite existing content. At minimum, a confirmation dialog like:
Warning: The archive contains a directory
world/which already exists. Extracting will overwrite existing files. Continue?
A more advanced solution could show a list of conflicting files/directories.
Actual Behavior
No warning, no confirmation. Files are overwritten silently.
Impact
This is particularly dangerous for Minecraft servers where a world.tar.gz backup can silently replace the active ./world directory. In my case, I uploaded an archive named world.tar.gz and it would have replaced my live world directory had I not noticed in time.
Related
- #4921 — Add a target directory field for the archive decompress endpoint (related but separate concern)
Environment
- Pterodactyl Panel: latest
- Browser: N/A (applies to both UI and API)
Source: pterodactyl/panel