# Filters and constants

> For developers: the filters that change what DooFiles shows and how much it keeps, the constants of wp-config.php it respects, and the capability that decides who can open it, with examples.

Source: https://doothemes.com/docs/doofiles/developers/filters-and-constants

---

## Overview

DooFiles can be set from the code of your site, for example to keep the same settings on every site you manage, to show only part of the server, or to lock DooFiles in read-only mode on your live site. This page lists:

- the **filters** that change what DooFiles shows and how much it keeps;
- the **constants** of `wp-config.php` that DooFiles respects;
- the **capability** that decides who can open DooFiles.

Most filters replace a setting of **DooFiles › Settings**. Site owners can change those settings without code. See [Settings](https://doothemes.com/docs/doofiles/settings).

## Where to add the code

Add your filters in a must-use plugin, so they keep working when you change your theme and load before DooFiles:

1. Create the folder `wp-content/mu-plugins` if it does not exist.
2. Create a file inside it, for example `doofiles-config.php`, that starts with `<?php`.
3. Add your filters below that line.

```php
<?php
// Keep the activity log for 180 days.
add_filter( 'doofiles_log_days', function () {
    return 180;
} );
```

WordPress loads every file of that folder on its own. The `functions.php` file of your theme also works, but it stops working if you change your theme.

## Filters and the settings page

A filter wins over the setting it replaces. As soon as you hook one, the matching row of **DooFiles › Settings** shows as locked, with the note *Set by the … filter in the site's code.*, even if your filter returns the same value. To give the row back to the settings page, remove the filter.

Sizes go in bytes. Use the constants of WordPress to write them: `5 * MB_IN_BYTES`, `GB_IN_BYTES`.

## Where DooFiles works

| Filter | Value | Default | Settings row |
|---|---|---|---|
| `doofiles_root` | The full path of the folder that DooFiles opens as its top folder | The folder of WordPress | — |

DooFiles can only open folders inside the folder of WordPress. With this filter you can narrow that down to one of its folders, for example `wp-content`:

```php
add_filter( 'doofiles_root', function () {
    return WP_CONTENT_DIR;
} );
```

If the folder does not exist, or is outside the folder of WordPress, DooFiles ignores the filter and opens the whole folder of WordPress.

[Private folders](https://doothemes.com/docs/doofiles/security/private-folders) cannot be inside the folders of WordPress, such as `wp-content`. With one of those as the top folder, you cannot create private folders.

## Security

| Filter | Value | Default | Settings row |
|---|---|---|---|
| `doofiles_read_only` | `true` to turn on read-only mode | `false` | **Read-only mode** |
| `doofiles_require_reauth` | `true` or `false`: ask for the password before changing code | The setting (`true`) | **Ask for the password before changing code** |
| `doofiles_reauth_ttl` | Seconds that the password confirmation lasts. At least 60 | The setting (10 minutes) | **Minutes the confirmation lasts** |

`doofiles_read_only` can only turn [read-only mode](https://doothemes.com/docs/doofiles/security/read-only-mode) on. When the settings page or a constant of `wp-config.php` turns it on, returning `false` does not turn it off.

For example, to keep DooFiles in read-only mode on your live site and let it change files on your staging and local copies:

```php
add_filter( 'doofiles_read_only', function () {
    return 'production' === wp_get_environment_type();
} );
```

WordPress treats a site as `production` unless `WP_ENVIRONMENT_TYPE` in `wp-config.php` says otherwise, so set it to `staging` or `local` on your other copies.

With `doofiles_require_reauth` set to `false`, saving the settings of the site, managing private folders and managing the second factor still ask for the password. See [Password confirmation](https://doothemes.com/docs/doofiles/security/password-confirmation).

To make the confirmation last 30 minutes:

```php
add_filter( 'doofiles_reauth_ttl', function () {
    return 30 * MINUTE_IN_SECONDS;
} );
```

## Sizes and limits

| Filter | Value | Default | Settings row |
|---|---|---|---|
| `doofiles_max_edit_size` | Largest file the editor opens, in bytes | The setting (2 MB) | **Largest file the editor opens** |
| `doofiles_max_upload_size` | Largest upload, in bytes. At least 1 MB | The setting (2 GB) | **Largest upload** |
| `doofiles_backup_max_size` | Largest file that is backed up when it is saved or replaced, in bytes | 50 MB | — |
| `doofiles_unzip_max_entries` | Most files and folders in a zip archive that DooFiles extracts | 20,000 | — |
| `doofiles_unzip_max_size` | Most space the extracted files of one archive can take, in bytes | 1 GB | — |

For example, to let the editor open files up to 5 MB and allow uploads up to 500 MB:

```php
add_filter( 'doofiles_max_edit_size', function () {
    return 5 * MB_IN_BYTES;
} );

add_filter( 'doofiles_max_upload_size', function () {
    return 500 * MB_IN_BYTES;
} );
```

Very large files make the editor slow, because the browser has to load and highlight all their text. See [Editor and uploads](https://doothemes.com/docs/doofiles/settings/limits), [Backups](https://doothemes.com/docs/doofiles/files/backups) and [Manage files](https://doothemes.com/docs/doofiles/files/manage-files).

## Trash, backups and activity

| Filter | Value | Default | Settings row |
|---|---|---|---|
| `doofiles_trash_days` | Days that deleted items stay in the Trash | The setting (30) | **Days in the trash** |
| `doofiles_backup_days` | Days that backups are kept | The setting (30) | **Days to keep backups** |
| `doofiles_backup_keep` | Backups kept for each file. At least 1 | The setting (10) | **Backups per file** |
| `doofiles_log_days` | Days that entries of the activity log are kept | The setting (90) | **Days of activity** |
| `doofiles_log_max` | Most entries the activity log keeps | The setting (50,000) | **Most activity entries** |

For the days, `0` keeps the items forever. For `doofiles_log_max`, `0` keeps every entry. Keep in mind that the Trash, the backups and the log then grow without end.

For example, to empty the Trash after 7 days:

```php
add_filter( 'doofiles_trash_days', function () {
    return 7;
} );
```

DooFiles deletes old items once a day, and the extra backups of a file each time it gets a new one. See [Trash, backups and activity](https://doothemes.com/docs/doofiles/settings/retention).

## Constants

Add these lines to `wp-config.php`, above the line that says *That's all, stop editing!*

| Constant | What it does | See |
|---|---|---|
| `DISALLOW_FILE_EDIT` | A constant of WordPress. DooFiles works in read-only mode | [Read-only mode](https://doothemes.com/docs/doofiles/security/read-only-mode) |
| `DISALLOW_FILE_MODS` | A constant of WordPress. DooFiles works in read-only mode | [Read-only mode](https://doothemes.com/docs/doofiles/security/read-only-mode) |
| `DOOFILES_DISABLE_2FA` | Turns off the second factor of DooFiles for everyone. Only for emergencies, such as a lost phone without recovery codes | [Second factor](https://doothemes.com/docs/doofiles/security/second-factor) |

```php
define( 'DOOFILES_DISABLE_2FA', true );
```

Remove `DOOFILES_DISABLE_2FA` as soon as you have access again.

## Who can open DooFiles

DooFiles has its own capability, `doofiles_manage`. When you activate DooFiles, it gives that capability to the Administrator role.

To open DooFiles, a user needs both `doofiles_manage` and the capability to manage the options of the site (`manage_options`). Giving `doofiles_manage` to an editor does not let them in. On a multisite network, network administrators can always open DooFiles.

### Keep one administrator out

To keep one administrator out of DooFiles without changing their role, deny them the capability. Run this once, with WP-CLI:

```bash
wp eval "get_user_by( 'login', 'jane' )->add_cap( 'doofiles_manage', false );"
```

Replace `jane` with their username. DooFiles disappears from their menu, and they cannot open its private folders. To give it back:

```bash
wp eval "get_user_by( 'login', 'jane' )->remove_cap( 'doofiles_manage' );"
```

A role editor plugin that can deny capabilities to a user works too.

## Check whether DooFiles is active

DooFiles defines `DOOFILES_VERSION` with its version, for example `1.0.4`. Use it to run code only when DooFiles is active:

```php
if ( defined( 'DOOFILES_VERSION' ) && version_compare( DOOFILES_VERSION, '1.0.4', '>=' ) ) {
    // DooFiles 1.0.4 or newer is active.
}
```

DooFiles has no actions or JavaScript hooks of its own yet. If you need one, [open a support ticket](https://doothemes.com/account/tickets/new) and tell us what for.

## Troubleshooting

| Problem | What to do |
|---|---|
| My filter does nothing | Check that the file is in `wp-content/mu-plugins`, not in a subfolder, and starts with `<?php`. The matching row of the settings page shows as locked when the filter works |
| A row of the settings page is locked and I did not add a filter | Another plugin or your theme hooks that filter. The note under the row says which one |
| `doofiles_root` does nothing | The folder does not exist, or is outside the folder of WordPress. Use a full path, such as `WP_CONTENT_DIR` |
| Read-only mode does not turn off with `doofiles_read_only` | The filter can only turn it on. Check the settings page and `wp-config.php` |
| An administrator cannot open DooFiles | Their role or their user lacks the `doofiles_manage` capability. If you denied it with `add_cap`, give it back with `remove_cap`, as shown above. Deactivating and activating DooFiles gives it back to the Administrator role |

Need more help? [Open a support ticket](https://doothemes.com/account/tickets/new).