From d9c774cec75c6e9957cd756456219c57cb90ab28 Mon Sep 17 00:00:00 2001 From: Joel Mattison Date: Thu, 25 Jun 2026 21:16:00 -0400 Subject: [PATCH] Document IonCube protection and PHP 7.2/7.4 lock Co-Authored-By: Claude Opus 4.8 (1M context) --- README.md | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/README.md b/README.md index 2bc820f..8c81cf0 100644 --- a/README.md +++ b/README.md @@ -156,6 +156,29 @@ XUI's bundled `my.cnf` sets `bind-address = *`, so MariaDB listens on socket auth, but consider firewalling 3306 to localhost if the box is on a public IP. +## How the panel code is protected (IonCube) + +XUI's application code is **IonCube-encoded**, not editable source: + +- ~294 of 308 `.php` files are encoded binary (a handful, e.g. the Ministra + portal, are obfuscated plaintext instead). +- It uses a **custom IonCube loader** keyed via `ioncube.loader.key.xui` in the + bundled `php.ini`. The encoded files are headerless binary and only run under + that keyed loader — a stock IonCube loader can't decode them. +- The community "patch" is exactly this loader: a custom-built `ioncube.so` + (shipped for **PHP 7.2 and 7.4**) that runs the still-encrypted code without + the original license/phone-home enforcement. + +**Consequences:** + +- You can't read or modify XUI's PHP source — customization is limited to config, + templates, and the database. +- **PHP is locked to 7.2 / 7.4.** There is no loader here for PHP 8.x and the + encoded files won't run on it — which is why XUI ships its own bundled PHP + 7.4.10. Don't repoint it at system PHP 8. +- The load-bearing piece is that bundled `ioncube.so` + key (inside `xui.tar.gz`, + already in the mirror). Keep the mirror intact. + ## System requirements - Ubuntu 20.04 / 22.04 / 24.04 LTS, clean install, x86_64