Harwinder Sekhon
eb93303c09
Behind a proxy REMOTE_ADDR is the proxy, so the per-IP limit would lump every visitor together. New optional CLIENT_IP_HEADER in config.php (e.g. 'CF-Connecting-IP') tells the throttle which header carries the real address; invalid or absent values fall back to REMOTE_ADDR, and configs that predate the setting behave as before. Only for origins unreachable except through the proxy — documented in the README, which also covers the mod_remoteip/real_ip alternative. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SePf61iazhCLJBefdRLBDm
34 lines
1.3 KiB
PHP
34 lines
1.3 KiB
PHP
<?php
|
|
// ---- CourseHub configuration ----
|
|
|
|
// Absolute path to the directory that contains your course folders, e.g.
|
|
// /srv/media/courses/
|
|
// Course 1/Intro/Video1.mp4
|
|
// Course 2/Module 3/Advanced/lesson.mp4
|
|
define('VIDEOS_ROOT', '/srv/courses');
|
|
|
|
define('DB_HOST', '127.0.0.1');
|
|
define('DB_PORT', 3306);
|
|
define('DB_NAME', 'coursehub');
|
|
define('DB_USER', 'coursehub');
|
|
define('DB_PASS', 'change-me');
|
|
|
|
// A video counts as "completed" once the user has watched this fraction of it.
|
|
define('COMPLETE_THRESHOLD', 0.95);
|
|
|
|
// Allow new users to self-register from the login page.
|
|
define('ALLOW_REGISTRATION', true);
|
|
|
|
// Only when the app sits behind a proxy that hides the visitor's address
|
|
// (Cloudflare): the header carrying the real client IP, used by the login
|
|
// brute-force throttle. Set this ONLY if the origin cannot be reached except
|
|
// through that proxy — a directly reachable origin lets anyone spoof the
|
|
// header and dodge the per-IP limit. Leave '' to use the connection address.
|
|
// define('CLIENT_IP_HEADER', 'CF-Connecting-IP');
|
|
define('CLIENT_IP_HEADER', '');
|
|
|
|
// Return the exception type, file:line and stack trace in API error responses.
|
|
// Errors are written to the PHP error log either way — this only controls what
|
|
// the browser is told, so leave it false on anything publicly reachable.
|
|
define('DEBUG', false);
|