elFinder connector.php -> path in Internet Explorer

Question

I am setting path dynamically in connector.php and it works as it should in All the browsers apart from Internet Explorer. Here is my connector.php code:

function access($attr, $path, $data, $volume) {
    return strpos(basename($path), '.') === 0       // if file/folder begins with '.' (dot)
        ? !($attr == 'read' || $attr == 'write')    // set read+write to false, other (locked+hidden) set to true
        :  null;                                    // else elFinder decide it itself
}


// Documentation for connector options:
// https://github.com/Studio-42/elFinder/wiki/Connector-configuration-options
$opts = array(
    'debug' => true,
    'roots' => array(
        array(
            'driver'        => 'LocalFileSystem',          
            'path'          => '../../pages/path/to/files/'.($_GET['mypath']).'/', 
            'URL'           => '../../pages/path/to/files/'.($_GET['mypath']).'/', 
            'uploadDeny'    => array('all'),               
            'uploadAllow'   => array('image', 'text/plain'),
            'uploadOrder'   => array('deny', 'allow'),      
            'accessControl' => 'access'

        )
    )
);

// run elFinder
$connector = new elFinderConnector(new elFinder($opts));
$connector->run();

Basically what is happening is that if you are using any browser (other than IE) your root directory is correctly set to $_GET['mypath'], but if you are in IE then root directory is set to /files/ (the directory just one level up from the one needed) and as a result user can see folders which he should not be accessing.

Any ideas as to why this is happening?

P.S. The only theory I have is that maybe IE JavaScript Engine is sending incorrect mypath variable?

elFinder Code Below:

<script type="text/javascript" charset="utf-8">
    $().ready(function() {
        var elf = $('#elfinder').elfinder({
            // lang: 'ru',             
            url : 'libraries/elFinder/connector.php', 
            rememberLastDir : false,
            useBrowserHistory : false,
            customData : {mypath : <?php echo json_encode($_GET['CIF']); ?>}
        }).elfinder('instance');            
    });
</script>

And the Actual Source of the page looks like this:

<script type="text/javascript" charset="utf-8">
    $().ready(function() {
        var elf = $('#elfinder').elfinder({
            // lang: 'ru',             
            url : 'libraries/elFinder/connector.php', 
            rememberLastDir : false,
            useBrowserHistory : false,
            customData : {mypath : "mypath_folder"}
        }).elfinder('instance');            
    });
</script>

P.S.S > I have just confirmed that IE doesn't send mypath variable.

Does anyone has any ideas?

UPDATE: 09/02/16

Today after further investigation I found out a very strange behaviour of this script:

If it's any browser (Except IE) then $_GET['mypath'] works as it should, but in IE $_GET['mypath'] is not set, BUT, if it is IE then $_POST['mypath'] is set instead of $_GET['mypath'], BUT, in all other browsers $_POST['mypath'] is not set.

I would like to avoid checking if the browser is IE family then use $_POST and if any other then $_GET.

Does anyone has any suggestions?

ANSWER:

$().ready(function() {
    var elf = $('#elfinder').elfinder({
        // lang: 'ru',             
        url : 'libraries/elFinder/connector.php',
        requestType : 'post',
        rememberLastDir : false,
        useBrowserHistory : false,
        customData : {mypath : <?php echo json_encode($_GET['CIF']); ?>}
    }).elfinder('instance');            
});

If you force requestType to post then it will always be post in all browsers, so you dont't have to worry about checking if browser posts or gets.

Answer 1

$().ready(function() {
    var elf = $('#elfinder').elfinder({
        // lang: 'ru',             
        url : 'libraries/elFinder/connector.php',
        requestType : 'post',
        rememberLastDir : false,
        useBrowserHistory : false,
        customData : {mypath : <?php echo json_encode($_GET['CIF']); ?>}
    }).elfinder('instance');            
});

If you force requestType to post then it will always be post in all browsers, so you dont't have to worry about checking if browser posts or gets.