Skip to main content

phpVMS 5 Legacy Patch 1.2.0

phpVMS 5 uses the legacy dotACARS server patch. Use this only for older VAs that cannot move to phpVMS 7.

Server Package Folder​

Use:

Server/phpVMS5/upload/acars

Upload the acars folder into the public phpVMS 5 crew center:

public_html/phpvms5-root/acars

The final URLs should include:

https://exampleva.com/acars/bootstrap.php
https://exampleva.com/acars/login.php
https://exampleva.com/acars/get_bid.php
https://exampleva.com/acars/position.php
https://exampleva.com/acars/submit_log.php

Configure​

Edit:

public_html/phpvms5-root/acars/va_config.php

Set your VA name, phpVMS URL, website URL and branding URLs.

VA_CLIENT_TOKEN is optional. The patch authenticates pilots and then requires a per-session token for bid, position and PIREP submission.

Keep these secure defaults unless the hosting environment specifically requires a change:

define('DOTACARS_DB_PREFIX', 'AUTO');
define('DOTACARS_PRIVATE_STORAGE_PATH', 'AUTO');
define('DOTACARS_REQUIRE_HTTPS', true);
define('DOTACARS_REQUIRE_BID', true);
define('DOTACARS_TRUST_PROXY_HEADERS', false);

AUTO discovers the actual phpVMS table prefix. Runtime data is placed above the webroot when the host permits it. An explicit storage path must be absolute and outside public_html, www or any other public directory.

BID Import​

The endpoint authenticates the pilot session and requests the pilot's latest BID through phpVMS 5 SchedulesData::getLatestBid(), the native flow used by established legacy ACARS clients.

For forks where that method is unavailable, dotACARS uses prepared SQL and discovers compatible table names, prefixes and columns. Standard and Free receive the same response containing flight number, airports, aircraft, route, distance, schedule ID and registration.

Update An Existing Patch​

  1. Record the VA-specific values from the installed acars/va_config.php.
  2. Replace the complete installed /acars folder with the new package.
  3. Reapply only the VA-specific values to the new va_config.php.
  4. Remove obsolete cleanup_live.php if it remains on the server.
  5. Delete old runtime .json, .log and report files from public fallback folders.
  6. Log out of dotACARS and log in again.

Do not restore old _dotacars_common.php, get_bid.php, position.php or submit_log.php. These files are one versioned unit.

Security Checks​

  • va_config.php and _dotacars_common.php must not download in a browser.
  • /acars/sessions/, /acars/reports/, /acars/logs/ and /acars/cache/ must return 403 Forbidden or equivalent.
  • Directory listing must be disabled.
  • Do not upload debug, test, backup, SQL, log, JSON, zip or session files.
  • Sensitive endpoints must be called with POST.
  • HTTPS is required by default.
  • Leave proxy-header trust disabled unless requests pass through a trusted proxy.

Suggested browser checks:

GET /acars/status.php             -> 200, version 1.2.0
GET /acars/va_config.php          -> 403
GET /acars/_dotacars_common.php   -> 403
GET /acars/sessions/              -> 403
GET /acars/logs/                  -> 403
GET /acars/cache/                 -> 403
GET /acars/reports/               -> 403
GET /acars/get_bid.php            -> 405

Test Checklist​

  • /acars/bootstrap.php responds with JSON.
  • /acars/status.php reports 1.2.0.
  • Login works with a valid pilot.
  • Repeated invalid login attempts are rate limited.
  • A pilot with an active BID imports it with a schedule ID.
  • Invalid tokens and expired sessions are rejected.
  • Invalid latitude/longitude is rejected.
  • Position updates reach phpVMS 5 live ACARS data.
  • PIREP submission creates a legacy phpVMS 5 PIREP/log.
  • Direct browser access to sessions, reports, logs and cache is blocked.

The desktop app needs only the crew center base URL, such as https://exampleva.com. It discovers /acars/bootstrap.php automatically. Do not enter an endpoint URL in the VA URL field.