From a8830c9137329e3b3db015aa6ae4489fbf4120ca Mon Sep 17 00:00:00 2001 From: Joel Mattison Date: Thu, 25 Jun 2026 21:22:05 -0400 Subject: [PATCH] Remove IonCube section (out of scope for the installer README) Co-Authored-By: Claude Opus 4.8 (1M context) --- README.md | 23 ----------------------- 1 file changed, 23 deletions(-) diff --git a/README.md b/README.md index 8c81cf0..2bc820f 100644 --- a/README.md +++ b/README.md @@ -156,29 +156,6 @@ XUI's bundled `my.cnf` sets `bind-address = *`, so MariaDB listens on socket auth, but consider firewalling 3306 to localhost if the box is on a public IP. -## How the panel code is protected (IonCube) - -XUI's application code is **IonCube-encoded**, not editable source: - -- ~294 of 308 `.php` files are encoded binary (a handful, e.g. the Ministra - portal, are obfuscated plaintext instead). -- It uses a **custom IonCube loader** keyed via `ioncube.loader.key.xui` in the - bundled `php.ini`. The encoded files are headerless binary and only run under - that keyed loader — a stock IonCube loader can't decode them. -- The community "patch" is exactly this loader: a custom-built `ioncube.so` - (shipped for **PHP 7.2 and 7.4**) that runs the still-encrypted code without - the original license/phone-home enforcement. - -**Consequences:** - -- You can't read or modify XUI's PHP source — customization is limited to config, - templates, and the database. -- **PHP is locked to 7.2 / 7.4.** There is no loader here for PHP 8.x and the - encoded files won't run on it — which is why XUI ships its own bundled PHP - 7.4.10. Don't repoint it at system PHP 8. -- The load-bearing piece is that bundled `ioncube.so` + key (inside `xui.tar.gz`, - already in the mirror). Keep the mirror intact. - ## System requirements - Ubuntu 20.04 / 22.04 / 24.04 LTS, clean install, x86_64