index.php

<?php
$cookie = array(
    'lifetime' => 0,
    'path'     => ini_get('session.cookie_path'),
    'domain'   => ini_get('session.cookie_domain'),
    'secure'   => (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off'),
    'httponly' => true
);

session_name('workflow_app');

session_set_cookie_params(
    $cookie['lifetime'], $cookie['path'],
    $cookie['domain'], $cookie['secure'],
    $cookie['httponly']
);

define('ROOT_DIR', realpath(dirname(__FILE__)) . '/');
define('APP_DIR', ROOT_DIR . 'application/');

require(ROOT_DIR . 'system/env.php');
wf_load_env(ROOT_DIR . '.env');

if (!file_exists(ROOT_DIR . 'config.php')) {
    header('Location: setup/index.php');
    exit;
}

require(ROOT_DIR . 'config.php');

// Verbose PHP errors are only safe to show on-screen in local development --
// on a public deployment they'd leak file paths and query fragments to any
// visitor who triggers one. Errors are still logged either way (error_handler.php).
ini_set('display_errors', $config['debug_mode'] ? 1 : 0);
error_reporting($config['debug_mode'] ? E_ALL : 0);

require(ROOT_DIR . 'system/model.php');
require(ROOT_DIR . 'system/view.php');
require(ROOT_DIR . 'system/controller.php');
require(ROOT_DIR . 'system/pip.php');
require(ROOT_DIR . 'system/error_handler.php');

global $config;
define('DATABASE',          $config['db_name']);
define('BASE_PATH',         $config['base_url']);
define('APP_NAME',          $config['app_name']);
define('ERROR_LOG_PATH',    $config['error_log']);
define('DEBUG_MODE',        $config['debug_mode']);
define('VERSION',           $config['version']);
define('ENCRYPTION_KEY',    $config['encryption_key']);

session_start();

require_once(APP_DIR . 'helper/remember_me.php');
RememberMe::tryRestoreSession();

pip();
?>