AnonymousFox

//var/softaculous/xoops/mainfile.php

<?php
/**
 * XOOPS main configuration file
 *
 * You may not change or alter any portion of this comment or credits
 * of supporting developers from this source code or any supporting source code
 * which is considered copyrighted (c) material of the original comment or credit authors.
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
 *
 * @copyright       (c) 2000-2026 XOOPS Project (https://xoops.org)
 * @license             GNU GPL 2 (https://www.gnu.org/licenses/gpl-2.0.html)
 */

if (!defined('XOOPS_MAINFILE_INCLUDED')) {
    define('XOOPS_MAINFILE_INCLUDED', 1);

// XOOPS Physical Paths

// Physical path to the XOOPS documents (served) directory WITHOUT trailing slash
    define('XOOPS_ROOT_PATH', '[[softpath]]');

// For forward compatibility
    // Physical path to the XOOPS library directory WITHOUT trailing slash
    define('XOOPS_PATH', '[[softdatadir]]/xoops_lib');
    // Physical path to the XOOPS datafiles (writable) directory WITHOUT trailing slash
    define('XOOPS_VAR_PATH', '[[softdatadir]]/xoops_data');
    // Alias of XOOPS_PATH, for compatibility, temporary solution
    define('XOOPS_TRUST_PATH', XOOPS_PATH);

// Protocol detection for SSL and proxy compatibility
    $IS_HTTPS = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on')
        || (isset($_SERVER['SERVER_PORT']) && (int)$_SERVER['SERVER_PORT'] === 443)
        || (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https')
        || (isset($_SERVER['HTTP_X_FORWARDED_SSL']) && $_SERVER['HTTP_X_FORWARDED_SSL'] === 'on')
        || (isset($_SERVER['HTTP_X_FORWARDED_PORT']) && (int)$_SERVER['HTTP_X_FORWARDED_PORT'] === 443)
        || (isset($_SERVER['REDIRECT_HTTPS']) && $_SERVER['REDIRECT_HTTPS'] === 'on');
    
    define('XOOPS_PROT', $IS_HTTPS ? 'https://' : 'http://');
    unset($IS_HTTPS);

// XOOPS Virtual Path (URL)
    // Virtual path to your main XOOPS directory WITHOUT trailing slash
    // Example: define('XOOPS_URL', '[[softurl]]');
    define('XOOPS_URL', '[[softurl]]');

// in mainfile.php - add this if it doesn't exist
    if (!defined('XOOPS_COOKIE_DOMAIN_USE_PSL')) {
        define('XOOPS_COOKIE_DOMAIN_USE_PSL', true);
    }

// XOOPS Cookie Domain to specify when creating cookies. May be blank (i.e. for IP address host),
    // full host from XOOPS_URL (i.e. www.example.com) or just the registered domain (i.e. example.com)
    // to share cookies across multiple subdomains (i.e. www.example.com and blog.example.com)
    define('XOOPS_COOKIE_DOMAIN', '[[domhost]]');

// Shall be handled later, don't forget!
    define('XOOPS_CHECK_PATH', 0);
    // Protect against external scripts execution if safe mode is not enabled
    if (XOOPS_CHECK_PATH) {
        if (function_exists('debug_backtrace')) {
            $xoopsScriptPath = debug_backtrace();
            if (!count($xoopsScriptPath)) {
                die('XOOPS path check: this file cannot be requested directly');
            }
            $xoopsScriptPath = $xoopsScriptPath[0]['file'];
        } else {
            $xoopsScriptPath = $_SERVER['PATH_TRANSLATED'] ?? $_SERVER['SCRIPT_FILENAME'];
        }
        if (DIRECTORY_SEPARATOR !== '/') {
            // IIS6 may double the \ chars
            $xoopsScriptPath = str_replace(strpos($xoopsScriptPath, "\\\\", 2) ? "\\\\" : DIRECTORY_SEPARATOR, '/', $xoopsScriptPath);
        }
        if (strcasecmp(substr($xoopsScriptPath, 0, strlen(XOOPS_ROOT_PATH)), str_replace(DIRECTORY_SEPARATOR, '/', XOOPS_ROOT_PATH))) {
            exit('XOOPS path check: Script is not inside XOOPS_ROOT_PATH and cannot run.');
        }
    }

// Debug settings are read from xoops_data/data/debug.php when that file exists.
    // Copy debug.dist.php beside it to switch debugging on, instead of editing this
    // file -- mainfile.php also holds your database credentials and is never replaced
    // on upgrade, which is what made the old approach awkward.
    //
    // No debug.php present means production behaviour, exactly as before.
    // Guarded: include_once only WARNS on a missing file, and calling the function would
    // then be a fatal "Call to undefined function" -- taking the whole site down before
    // secure.php is even read. mainfile.php survives upgrades while include/ is replaced,
    // so a partial or interrupted upgrade can genuinely produce this pairing.
    $xoopsDebugConfig  = [];
    $xoopsDebugLoader  = XOOPS_ROOT_PATH . '/include/debugconfig.php';

if (is_readable($xoopsDebugLoader)) {
        // try/catch, not just is_readable(). The realistic failure here is not a MISSING
        // file -- is_readable() covers that -- but a TRUNCATED one, left by an upload or
        // a write that died halfway. That is a ParseError, and a ParseError raised by an
        // include IS catchable, unlike one in this file. Fail closed to production.
        try {
            require_once $xoopsDebugLoader;
        } catch (\Throwable $e) {
            // Deliberately silent. Nothing has configured error display yet, so anything
            // said here is said under php.ini's rules -- which on a misconfigured host
            // means a path printed to whoever loaded the page.
            //
            // Nothing is recorded either: xoops_setDebugConfigError() lives in the file
            // that just failed to parse. It records a broken debug.php, not a broken
            // debugconfig.php, and an earlier comment here claimed otherwise.
        }
    }
    unset($xoopsDebugLoader);

// BOTH functions, not just the first. They live in one file, so a half-written copy
    // of it is exactly the state that defines one and not the other -- and calling the
    // missing one is a fatal before secure.php is even read.
    if (function_exists('xoops_getDebugConfig') && function_exists('xoops_applyDebugConfig')) {
        $xoopsDebugConfig = xoops_getDebugConfig();

// Unconditionally: it publishes XOOPS_ENVIRONMENT and XOOPS_ENV before it looks
        // at the config at all, and those are documented as existing on every request.
        // With no debug.php it defines them and returns.
        xoops_applyDebugConfig();
    }

define('XOOPS_DB_LEGACY_LOG', !empty($xoopsDebugConfig['database']['legacy_log']));
    define('XOOPS_DEBUG', [] !== $xoopsDebugConfig); // Also shows E_USER_DEPRECATED notices
    unset($xoopsDebugConfig);

// Secure file
    require XOOPS_VAR_PATH . '/data/secure.php';

define('XOOPS_GROUP_ADMIN', '1');
    define('XOOPS_GROUP_USERS', '2');
    define('XOOPS_GROUP_ANONYMOUS', '3');

if (!isset($xoopsOption['nocommon']) && XOOPS_ROOT_PATH != '') {
        include XOOPS_ROOT_PATH . '/include/common.php';
    }
}