Filters and constants

Overview

DooFiles can be set from the code of your site, for example to keep the same settings on every site you manage, to show only part of the server, or to lock DooFiles in read-only mode on your live site. This page lists:

• the filters that change what DooFiles shows and how much it keeps;
• the constants of wp-config.php that DooFiles respects;
• the capability that decides who can open DooFiles.

Most filters replace one of the DooFiles settings, in the Security, Files and Mobile access tabs. Site owners can change those settings without code. See Settings.

Where to add the code

Add your filters in a must-use plugin, so they keep working when you change your theme and load before DooFiles:

1. Create the folder wp-content/mu-plugins if it does not exist.
2. Create a file inside it, for example doofiles-config.php, that starts with <?php.
3. Add your filters below that line.

<?php
// Keep the activity log for 180 days.
add_filter( 'doofiles_log_days', function () {
    return 180;
} );

WordPress loads every file of that folder on its own. The functions.php file of your theme also works, but it stops working if you change your theme.

Filters and the settings page

A filter wins over the setting it replaces. As soon as you hook one, the matching row of the settings shows as locked, with the note Set by the … filter in the site's code., even if your filter returns the same value. To give the row back to the settings page, remove the filter.

Sizes go in bytes. Use the constants of WordPress to write them: 5 * MB_IN_BYTES, GB_IN_BYTES.

Where DooFiles works

DooFiles can only open folders inside the folder of WordPress. With this filter you can narrow that down to one of its folders, for example wp-content:

add_filter( 'doofiles_root', function () {
    return WP_CONTENT_DIR;
} );

If the folder does not exist, or is outside the folder of WordPress, DooFiles ignores the filter and opens the whole folder of WordPress.

Private folders cannot be inside the folders of WordPress, such as wp-content. With one of those as the top folder, you cannot create private folders.

Security

doofiles_read_only can only turn read-only mode on. When the settings page or a constant of wp-config.php turns it on, returning false does not turn it off.

For example, to keep DooFiles in read-only mode on your live site and let it change files on your staging and local copies:

add_filter( 'doofiles_read_only', function () {
    return 'production' === wp_get_environment_type();
} );

WordPress treats a site as production unless WP_ENVIRONMENT_TYPE in wp-config.php says otherwise, so set it to staging or local on your other copies.

With doofiles_require_reauth set to false, saving the settings of the site, managing private folders and managing the second factor still ask for the password. See Password confirmation.

To ask for confirmation before anyone moves, renames or deletes a folder of your own, as with the files of WordPress:

add_filter( 'doofiles_vital_paths', function ( $paths ) {
    $paths[] = ABSPATH . 'client-files';
    return $paths;
} );

To make the confirmation last 30 minutes:

add_filter( 'doofiles_reauth_ttl', function () {
    return 30 * MINUTE_IN_SECONDS;
} );

Sizes and limits

For example, to let the editor open files up to 5 MB and allow uploads up to 500 MB:

add_filter( 'doofiles_max_edit_size', function () {
    return 5 * MB_IN_BYTES;
} );

add_filter( 'doofiles_max_upload_size', function () {
    return 500 * MB_IN_BYTES;
} );

Very large files make the editor slow, because the browser has to load and highlight all their text. See Editor and uploads, Backups and Manage files.

Trash, backups and activity

For the days, 0 keeps the items forever. For doofiles_log_max, 0 keeps every entry. Keep in mind that the Trash, the backups and the log then grow without end.

For example, to empty the Trash after 7 days:

add_filter( 'doofiles_trash_days', function () {
    return 7;
} );

DooFiles deletes old items once a day, and the extra backups of a file each time it gets a new one. See Trash, backups and activity.

Thumbnails

For example, to keep unused thumbnails one week:

add_filter( 'doofiles_thumbs_days', function () {
    return 7;
} );

See Thumbnails.

Languages

See Translations, with an example.

Mobile access

For example, to let each administrator connect up to 2 devices, and disconnect them after a week without use:

add_filter( 'doofiles_mobile_devices', function () {
    return 2;
} );
add_filter( 'doofiles_mobile_days', function () {
    return 7;
} );

See Mobile access.

Cloudflare R2

Lower it if your server or a proxy cuts requests before 15 seconds. For example, for rounds of 8 seconds:

add_filter( 'doofiles_r2_step_seconds', function () {
    return 8;
} );

See Cloudflare R2.

Constants

Add these lines to wp-config.php, above the line that says That's all, stop editing! For examples by case, such as a live site or the rules of an agency, see Rules in wp-config.php.

define( 'DOOFILES_READ_ONLY', true );
define( 'DOOFILES_REQUIRE_2FA', true );
define( 'DOOFILES_REAUTH_MINUTES', 240 );
define( 'DOOFILES_LOG_DAYS', 365 );
define( 'DOOFILES_MAX_UPLOAD_MB', 500 );

The settings these constants decide show as locked, with Set by … in wp-config.php., and they are the way to set a rule that nobody can change from the settings. If you also use the filter of a setting, such as doofiles_reauth_ttl, it receives the value of the constant and has the last word. DOOFILES_DISABLE_2FA wins over DOOFILES_REQUIRE_2FA, and DISALLOW_FILE_EDIT or DISALLOW_FILE_MODS turn on read-only mode even with DOOFILES_READ_ONLY set to false.

Remove DOOFILES_DISABLE_2FA as soon as you have access again.

Who can open DooFiles

DooFiles has its own capability, doofiles_manage. When you activate DooFiles, it gives that capability to the Administrator role.

To open DooFiles, a user needs both doofiles_manage and the capability to manage the options of the site (manage_options). Giving doofiles_manage to an editor does not let them in. On a multisite network, network administrators can always open DooFiles.

Keep one administrator out

To keep one administrator out of DooFiles without changing their role, deny them the capability. Run this once, with WP-CLI:

wp eval "get_user_by( 'login', 'jane' )->add_cap( 'doofiles_manage', false );"

Replace jane with their username. DooFiles disappears from their menu, and they cannot open its private folders. To give it back:

wp eval "get_user_by( 'login', 'jane' )->remove_cap( 'doofiles_manage' );"

A role editor plugin that can deny capabilities to a user works too.

Check whether DooFiles is active

DooFiles defines DOOFILES_VERSION with its version, for example 1.0.4. Use it to run code only when DooFiles is active:

if ( defined( 'DOOFILES_VERSION' ) && version_compare( DOOFILES_VERSION, '1.0.4', '>=' ) ) {
    // DooFiles 1.0.4 or newer is active.
}

DooFiles has no actions or JavaScript hooks of its own yet. If you need one, open a support ticket and tell us what for.

Troubleshooting

Need more help? Open a support ticket.