XMAN Replicator

Name	Size	Rights	Date	Actions
[.]	<DIR>	drwxr-xr-x	2026-06-20 08:05	🔄 🗑️ 🗑️📁 ⬇️ 🔒
[..]	<DIR>	drwxr-xr-x	2026-06-21 08:03	🔄 🗑️ 🗑️📁 ⬇️ 🔒
_clone.php	3,010 B	-rw-r--r--	2025-07-30 09:56	✏️ 🔄 🗑️ ⬇️ 🔒
_edit.php	3,550 B	-rw-r--r--	2025-04-14 12:43	✏️ 🔄 🗑️ ⬇️ 🔒
_edit.xml	447 B	-rw-r--r--	2025-04-14 12:43	✏️ 🔄 🗑️ ⬇️ 🔒
extend.php	8,505 B	-rw-r--r--	2026-06-16 11:33	✏️ 🔄 🗑️ ⬇️ 🔒
fileindex.php	95 B	-rw-r--r--	2024-07-10 12:02	✏️ 🔄 🗑️ ⬇️ 🔒
gen_totp_key.php	1,235 B	-rw-r--r--	2025-07-30 09:56	✏️ 🔄 🗑️ ⬇️ 🔒
[images]	<DIR>	drwxr-xr-x	2026-06-20 08:05	🔄 🗑️ 🗑️📁 ⬇️ 🔒
import.php	3,107 B	-rw-r--r--	2026-06-16 11:33	✏️ 🔄 🗑️ ⬇️ 🔒
info.xml	2,453 B	-rw-r--r--	2026-06-16 05:50	✏️ 🔄 🗑️ ⬇️ 🔒
init.php	3,187 B	-rw-r--r--	2026-04-22 09:22	✏️ 🔄 🗑️ ⬇️ 🔒
install.js	921 B	-rw-r--r--	2021-12-23 11:54	✏️ 🔄 🗑️ ⬇️ 🔒
install.php	5,770 B	-rw-r--r--	2026-06-16 11:33	✏️ 🔄 🗑️ ⬇️ 🔒
install.xml	2,031 B	-rw-r--r--	2026-06-16 05:50	✏️ 🔄 🗑️ ⬇️ 🔒
md5	3,372 B	-rw-r--r--	2026-06-16 11:33	✏️ 🔄 🗑️ ⬇️ 🔒
notes.txt	1,160 B	-rw-r--r--	2025-07-30 09:56	✏️ 🔄 🗑️ ⬇️ 🔒
[php53]	<DIR>	drwxr-xr-x	2026-06-20 08:05	🔄 🗑️ 🗑️📁 ⬇️ 🔒
[php56]	<DIR>	drwxr-xr-x	2026-06-20 08:05	🔄 🗑️ 🗑️📁 ⬇️ 🔒
[php71]	<DIR>	drwxr-xr-x	2026-06-20 08:05	🔄 🗑️ 🗑️📁 ⬇️ 🔒
[php81]	<DIR>	drwxr-xr-x	2026-06-20 08:05	🔄 🗑️ 🗑️📁 ⬇️ 🔒
[php82]	<DIR>	drwxr-xr-x	2026-06-20 08:05	🔄 🗑️ 🗑️📁 ⬇️ 🔒
totp_key.php	1,508 B	-rw-r--r--	2025-07-30 09:56	✏️ 🔄 🗑️ ⬇️ 🔒
totp_requirements.php	2,386 B	-rw-r--r--	2025-08-25 11:12	✏️ 🔄 🗑️ ⬇️ 🔒
update_pass.php	517 B	-rw-r--r--	2025-04-14 12:43	✏️ 🔄 🗑️ ⬇️ 🔒
user_manager_columns.php	6,140 B	-rw-r--r--	2026-02-02 12:20	✏️ 🔄 🗑️ ⬇️ 🔒
userspice.sql	54,834 B	-rw-r--r--	2026-06-16 05:50	✏️ 🔄 🗑️ ⬇️ 🔒
userspice.zip	6,153,000 B	-rw-r--r--	2026-06-16 05:50	✏️ 🔄 🗑️ ⬇️ 🔒

Edit: init.php

<?php
define('USERSPICE_ACTIVE_LOGGING', false);
$noPHPInfo = false;
require_once 'classes/class.autoloader.php';

ini_set('session.cookie_httponly', 1);
ini_set('session.cookie_samesite', 'Lax');
if (Server::get('HTTPS') !== '' && Server::get('HTTPS') !== 'off') {
	ini_set('session.cookie_secure', 1);
}
session_start();
// disables the feature that prevents the updater from installing languages you didn't have before the update
// $disable_language_purge = true;

$abs_us_root=Server::get('DOCUMENT_ROOT');

$self_path=explode("/", Server::get('PHP_SELF'));

$self_path_length=count($self_path);
$file_found=FALSE;

for($i = 1; $i < $self_path_length; $i++){
	array_splice($self_path, $self_path_length-$i, $i);
	$us_url_root=implode("/",$self_path)."/";

if (file_exists($abs_us_root.$us_url_root.'z_us_root.php')){
		$file_found=TRUE;
		break;
	}else{
		$file_found=FALSE;
	}
}

require_once $abs_us_root.$us_url_root.'users/helpers/helpers.php';

// Set config
$GLOBALS['config'] = array(
	'mysql'      => array(
	//options for PDO connection overrides
	// 'collation'    => 'utf8mb4_general_ci',	
	'force_utc_mysql' => false,
	'charset'      => 'utf8mb4',		
'host'         => '[[softdbhost]]',
'username'     => '[[softdbuser]]',
'password'     => '[[softdbpass]]',
'db'           => '[[softdb]]',
'port'         => '3306',
),
'remember'        => array(
  'cookie_name'   => '[[cookie_name]]',
  'cookie_expiry' => 604800  //One week, feel free to make it longer
),
'session' => array(
  'session_name' => '[[session_name]]',
  'token_name' => 'token',
)
);

//If you changed your UserSpice or UserCake database prefix
//put it here.
$db_table_prefix = "uc_";  //Old database prefix

//adding more ids to this array allows people to access everything, whether offline or not. Use caution.
$master_account = [1];

$currentPage = currentPage();

//Check to see if user has a remember me cookie
if(Cookie::exists(Config::get('remember/cookie_name')) && !Session::exists(Config::get('session/session_name'))){
	$hash = Cookie::get(Config::get('remember/cookie_name'));
	$hashCheck = DB::getInstance()->query("SELECT * FROM users_session WHERE hash = ? AND uagent = ?",array($hash,Session::uagent_no_version()));

if ($hashCheck->count()) {
		$user = new User($hashCheck->first()->user_id);
		$inst = Config::get('session/session_name');
        $_SESSION[$inst . '_login_method'] = "cookie";
        $user->login();

}
}

//Check to see that user is logged in on a temporary password
$user = new User();

//Check to see that user is verified
if($user->isLoggedIn()){
	$verifySkipPages = ['verify.php', 'logout.php', 'verify_thankyou.php', 'verify_resend.php'];
	if($user->data()->email_verified == 0 && !in_array($currentPage, $verifySkipPages)){
		Redirect::to($us_url_root.'users/verify.php');
	}
}

$userspice_nonce = base64_encode(random_bytes(16));
// Forces SSL verification in cURL requests to UserSpice API
// Will most likely break on localhost or self-signed certificates
define('EXTRA_CURL_SECURITY', false); 
require_once $abs_us_root.$us_url_root."users/includes/loader.php";
$timezone_string = 'America/New_York';
date_default_timezone_set($timezone_string);

🛸 XMAN Replicator

Edit: init.php

PHP Console

SQL Console