# Project Structure — InfixLMS (rk-backup) ## 1. Overview | Item | Value | |---|---| | Product | **InfixLMS** (by SpondonIt / Aora Soft) — a full-featured Learning Management System | | Version | **9.5.0** (min upgrade-from 9.3.0, release 08/04/2026) — see `config.json` | | Framework | **Laravel 13** (PHP ^8.3), `laravel/octane` + RoadRunner supported | | Architecture | Monolith core (`app/`) + **39 pluggable modules** (`Modules/`, `nwidart/laravel-modules`) | | Frontend | Blade + Livewire 3 + jQuery/Bootstrap 5; Laravel Mix 5 (Vue 2 / React 17 for a few widgets) | | Auth | Laravel UI, Passport (API OAuth), Socialite, Google 2FA | | Realtime | Pusher / Laravel Echo, Agora RTM (chat, live classes) | | Deployment style | Shared hosting friendly (`__index.php`, `.htaccess`, `.user.ini`, `php.ini`) + nginx sample | --- ## 2. Top-level layout ``` rk-backup/ ├── app/ Core application code (see §3) ├── Modules/ 39 feature modules (see §4) ├── bootstrap/ app.php + cache/ ├── config/ Laravel + package config (payments, zoom, vimeo, octane, pwa …) ├── database/ migrations (96), seeders, factories, infixlms.sql (base dump) ├── public/ Web root (see §6) ├── resources/ views, lang, fonts (see §5) ├── routes/ web, api, api2, tenant, channels, console, table ├── storage/ logs, framework cache, app data, Passport keys ├── vendor/ Composer dependencies ├── .env Environment config (secrets — do NOT share/commit) ├── composer.json / .lock PHP dependencies ├── package.json / webpack.mix.js JS/CSS build (Laravel Mix) ├── modules_statuses.json Enabled/disabled flag for every module ├── config.json Product version + update manifest + pending migrations ├── general_settings.json Seed/default general settings ├── version.php Prints installed version (reads storage/app/.version) ├── __index.php Shared-hosting entry → requires public/index.php ├── __serviceworker.js PWA service worker (root copy) ├── artisan, server.php CLI / PHP built-in server entry ├── phpunit.xml Test config ├── .htaccess / .user.ini / php.ini / nginx-root-index-security.conf Server config └── update.html Updater UI page ``` --- ## 3. `app/` — core application ``` app/ ├── Console/ │ ├── Kernel.php Scheduler │ └── Commands/ AppReset, BackupDatabase/File, CheckSubscription, │ CommissionApply, DbDumb, DeleteOldestForum, │ GeneratePwaManifest, GetZoomMeetingRecord, │ OrgSubscriptionAlert, SendExpireSoonCourseMail, │ SendProgressReportEmails, SendStreakReminderEmails, │ UpdateOrgLeaderbaord ├── Events/ ChatEvent, GroupChatEvent, OneToOneConnection, │ NewNotification, QuestionAnswerEvent, LastActivityEvent … ├── Listeners/ LastActivityListener, ListenOneToOneConnection ├── Exceptions/Handler.php ├── Exports/ Maatwebsite Excel exports (reports, sample/guideline sheets, │ org students/branches, quiz & course statistics, CPD …) ├── Imports/ Excel imports (students, question banks, org branches, │ coupons, quiz groups, attendance, survey questions …) ├── Helpers/ Autoloaded globals: Helper.php, Constant.php, SaasHelper.php │ (+ helper1–5.php, SchemaCollector.php) ├── Http/ │ ├── Kernel.php │ ├── Controllers/ │ │ ├── Admin/ Admin, Communication, Course, Refund │ │ ├── Api/ v1 API (Auth, Blog, Course, Affiliate, MobileMenu, Website…) │ │ │ └── V2/ v2 API grouped by domain: Admin, Assignment, Communication, │ │ │ Course (Chapter/Lesson/Quiz/Drip/PricePlan/Exercise), │ │ │ CustomMeeting, Filepond, GeneralSetting, Membership, │ │ │ Payment, Quiz, User, VirtualClass (+Zoom) … │ │ ├── Auth/ Login, Register, Reset/Forgot/Confirm password, Verification │ │ ├── Frontend/ Public site: Home, Course, Class, Cart, Blog, Instructor, │ │ │ Student, Quiz, Referral, StudyMaterial, SaaS, Store, themes │ │ └── *.php Home, Profile, User, Payment, Subscription/SaaS payment, │ │ Deposit, Notification, Search, Pwa, UploadFile, MyPanel … │ ├── Livewire/ Org/enrollment UI components (ShowBranch, ShowStudents, │ │ ShowMaterial, ShowOrgAttandance …) │ ├── Middleware/ Admin/Student/SaaS guards, ApiKey, CheckApi2Fa, IpCheck, │ │ Impersonate, RoutePermissionCheck, SecureHeaders, XSS, │ │ SetLocale, Maintenance, HttpsProtocol, CachePublicPages … │ ├── Resources/api/v1, api/v2 API JSON resources (Course, Quiz, Chapter, Membership, │ │ Notification, VirtualClass, Withdraw, Zoom …) │ └── View/Composers/ Chat, Frontend, Leaderboard, Menu, Sidebar composers ├── Jobs/ Queue jobs (emails, push/blog/event/survey notifications, │ invitations, org enrollment/signup notifications) ├── Library/SslCommerz/ Vendored SSLCommerz payment lib ├── Models/ User-related models (UserInfo, Education, Experience, Skill, │ Document, Follower, LmsBadge, LmsInstitute, Language …) ├── Notifications/, Observers/ CheckoutObserver, UserObserver ├── OAuth/, Scopes/ OAuth helpers, global query scopes (multi-tenant/LMS id) ├── Providers/ App, Auth, Backend, Broadcast, CustomValidation, Event, │ GeneralSettings, MailConfig, Module, Repository, Route, │ Telescope, Translation, ViewComposer providers ├── Repositories/ Repository pattern: Interfaces/, Eloquents/ + User, Payment, │ Country, Common, MyEnrollment repositories ├── Services/ GoogleFCMTokenService, PageCacheManager ├── Traits/ FileStore, ImageStore, UploadMedia, SendMail/SendSMS/ │ SendNotification, Tenantable, Gdrive, DropBox, BunnySettings, │ GoogleAnalytics4, PdfGenerate, UserChatMethods … ├── View/ Blade view components └── *.php (root models) User, Order, Subscription, Country/State/City, BillingDetails, DepositRecord, LessonComplete, LmsFile, GoogleToken, RecentviewCourse, TopicReport, UserLogin, AboutPage … ``` --- ## 4. `Modules/` — pluggable features (39 present) Each module follows the standard `nwidart/laravel-modules` layout: ``` Modules// ├── Config/ Console/ Database/{Migrations,Seeders,factories}/ ├── Entities/ Eloquent models ├── Http/{Controllers,Middleware,Requests}/ ├── Providers/ ServiceProvider, RouteServiceProvider ├── Repositories/ (some modules) ├── Resources/{views,lang,assets}/ ├── Routes/ web.php / api.php ├── Tests/ └── module.json composer.json package.json webpack.mix.js ``` Enable/disable state lives in `modules_statuses.json`. | Group | Modules (present in folder) | |---|---| | **Core / system** | Setting, SystemSetting, ModuleManager, Localization, RolePermission, Appearance, SidebarManager, NotificationSetup, Backup | | **Learning** | CourseSetting, Quiz, VirtualClass, Zoom, Certificate, StudentSetting, Coupons, VimeoSetting, VdoCipher | | **Site / content** | FrontendManage, FooterSetting, Blog, Newsletter, PopupContent, AoraPageBuilder, PageBuilder | | **Payments** | Payment, PaymentMethodSetting, Wallet, BankPayment, OfflinePayment, Razorpay, Paytm, PayStack, Instamojo, Midtrans, Payeer, Pesapal, Mobilpay, Bkash | Currently **enabled** (`true`): Setting, ModuleManager, Localization, RolePermission, Permission, Appearance, CourseSetting, Payment, StudentSetting, SystemSetting, Coupons, FrontendManage, Quiz, PaymentMethodSetting, VimeoSetting, VirtualClass, Zoom, Blog, FooterSetting, Razorpay, Paytm, PayStack, Wallet, Certificate, BankPayment, OfflinePayment, Instamojo, Midtrans, Payeer, Newsletter, Pesapal, Backup, Mobilpay, VdoCipher, Bkash, PopupContent, NotificationSetup, AoraPageBuilder, SidebarManager. `modules_statuses.json` also lists many **not installed / disabled** add-ons (Org, Subscription, SCORM, Chat, Forum, Membership, Affiliate, Store, H5P, GoogleMeet, AIContent, LmsSaas, CPD, …) — their code is not in `Modules/`. --- ## 5. `resources/`, `routes/`, `database/`, `config/` **resources/** - `views/backend/` — admin/instructor/student panel (categories, communication, instructor, my_panel, profile, refund, report, student, partials, components, `master.blade.php`) - `views/frontend/infixlmstheme/` — public theme (auth, components, layouts, pages, partials, profile, snippets) - `views/{api,layouts,livewire,partials,errors,products,pwa,vendor,vendors}/` + players (`scorm_player`, `vimeo_player`, `document_player`) - `lang/` — ar, bn, de, en, es, fr, it, lm, pt, ru, tr, vi (+ `default`, `vendor`, `en.json`) **routes/** | File | Purpose | |---|---| | `web.php` | Minimal; real web routes come from modules / tenant file | | `tenant.php` (543 lines) | Main web routes (frontend, student, admin) | | `api.php` | API v1 | | `api2.php` | API v2 (mobile app) | | `channels.php`, `console.php`, `table.php` | Broadcast channels, closures, datatable routes | **database/** — 96 core migrations (users, Passport/OAuth, orders, subscriptions, lesson progress, user profile tables, module-enable migrations…), seeders (`DatabaseSeeder`, `GeneralSettingSeeder`, `UserSeeder`, `EdumeThemeSeeder`), and `infixlms.sql` (base schema/data dump). Module migrations live inside each module. **config/** — Laravel defaults plus: payments (`paystack`, `pesapal`, `mobilpay`, `mollie`, `flutterwave`, `sslcommerz`, `coinbase`), meetings (`zoom`, `bigbluebutton`, `vimeo`), `octane`, `livewire`, `laravelpwa`, `modules`, `backup`, `purifier`, `laravel-ffmpeg`, `social`, analytics, etc. --- ## 6. `public/` — web root ``` public/ ├── index.php, _index.php Laravel front controller ├── assets/ backend/ frontend/ css/ js/ fonts/ images/ img/ plugins/ vendor/ Static assets ├── modules/ Published module assets ├── uploads/ temp/ tmpfile/ profile/ badges/ certificate/ level/ events/ User & generated files ├── database-backup/ DB backup output (web-accessible!) ├── chat/ whatsapp-support/ mobilpay/ header-footer/ demo/ Feature assets ├── manifest.json, serviceworker.js, offline.html PWA ├── mix-manifest.json, robots.txt, favicon.ico, validation.blade.php └── (hash/odd *.php files — see §8) ``` `storage/` holds `app/` (settings json: `settings.json`, `payment.json`, `saas_env.json`, theme json, `filepond`, `modules`, `purifier`), `framework/` caches, `logs/`, Passport keys (`oauth-*.key`), `last_update.zip`. --- ## 7. How a request flows 1. Web server → `public/index.php` (or root `__index.php` on shared hosting) → `bootstrap/app.php` 2. Providers boot (`ModuleServiceProvider`, `GeneralSettingsServiceProvider`, `MailConfigServiceProvider` load DB-driven settings and enabled modules from `modules_statuses.json`) 3. Routes: `routes/tenant.php` / `api.php` / `api2.php` + each enabled module's `Routes/` 4. Middleware (locale, XSS, permission check, active-status, etc.) → Controller → Repository/Service → Eloquent model 5. Output: Blade view (backend / frontend theme), Livewire component, or API Resource JSON 6. Background: queue jobs (`app/Jobs`), scheduler (`app/Console/Kernel.php`), broadcast events via Pusher --- ## 8. ⚠️ Security findings (please read) During the review I found items that are **not normal InfixLMS files**: 1. **Likely backdoors / webshells in `public/` and `storage/`** - `public/3b69469fdc.php`, `51ee5ea265.php`, `527ecabdd4.php`, `57c98973b4.php`, `6401ace2b9.php`, `77d9210bb8.php`, `8225c7f6db.php`, `91a1d6e120.php`, `9fb35b187c.php`, `b214d67464.php`, `c3602a37ba.php`, `cad39e91af.php`, `f72a6aa894.php` - `storage/3b69469fdc.php`, `51ee5ea265.php`, `8225c7f6db.php`, `b214d67464.php`, `cad39e91af.php`, `f72a6aa894.php` - `public/nx_*.php` (10 files) — one is a known "WAF/Imunify bypass test" shell header with hex-encoded strings. - The sampled hash-named file returns a fake nginx 404 unless a secret header (`X-Accel-Version: 9.4.1`) is sent, then processes `$_POST['x']` — classic hidden remote-code-execution behavior. 2. `public/assets/themes/app/kod/` looks like an embedded **KodExplorer** file manager — also a web-accessible file-management tool; verify it's intended. 3. `public/database-backup/` is inside the web root — backups may be downloadable. 4. `.env` contains live secrets and sits in the project folder; rotate keys/passwords if this copy was ever exposed. **Recommendation:** treat the server this came from as potentially compromised. Don't deploy these files; compare against a clean InfixLMS 9.5.0 package, delete the unknown PHP files, rotate DB/mail/payment/APP keys and admin passwords, and review access logs. I did not modify or delete anything. --- ## 9. Quick reference — common commands ```bash composer install php artisan key:generate php artisan migrate php artisan storage:link php artisan queue:work php artisan schedule:run # via cron every minute npm install && npm run production # build assets (Laravel Mix) ```