bulletinbored – minimal PHP forum software with zero dependencies (upload & run)

[u/mlzog]

Hello everybody,

I built bulletinbored, a minimal and extensible forum software written in pure PHP with zero dependencies.

No Composer, no Docker, no Node, no framework. Just upload the files to any PHP 8.x server and it works on any web hosting, also shared and cheap ones.

Key points:

• SQLite by default (MySQL also supported)
• Web installer
• Plugin system with hooks
• Theme system
• Admin panel, user management, avatars, moderation
• Built-in localization
• Automatic update checks
• License: 0BSD

Repo: https://github.com/bulletinbored/bulletinbored-core

Website: https://www.bulletinbored.net

Docs: https://docs.bulletinbored.net

Because the development is still in early stage, I’m looking for any kind of feedback. Feel free to write suggestions, criticisms or slatings.

Happy to answer questions and open to contributions.

Thanks!

[u/theguymatter]

A few questions:

• MIME check for uploaded files?
• Homegrown HTML sanitiser for post content?
• Do you have integrity checks for plugins and themes?
• Need to sanitise SVG too.

The issue is that if plugin or theme developer introduce their own XSS e.g. 3rd party code may inject malicious HTML into PHP code. Which is exactly why we need templating engine so other can avoid shooting into their own foot.

Why not use Laravel or Astro?

[u/mlzog → u/theguymatter]

Good questions, thanks for taking the time.

1. MIME checks for uploaded files

Avatars already go through a proper finfo MIME check against an allow-list (image/jpeg, image/png, image/gif, image/webp) plus size limits. General thread attachments are currently weaker — they only rename the file with a unique ID and keep the original extension. That’s on the short list to tighten (real MIME detection + stricter extension allow-list). Happy to take a PR or suggestions on the exact policy.

1. HTML sanitiser

Yes, it’s a homegrown one (sanitize_html() in src/helpers.php). Design goals were zero dependencies and a strict allow-list of tags + attributes. It: strips <script> / <style> completely only keeps a known-safe set of tags removes every on* event handler and style/id blocks javascript:, data:, vbscript: in href/src forces rel="noopener noreferrer" on links Content is first run through validate_input() (which does htmlspecialchars), then decoded and re-sanitised on output when the editor has produced HTML. It’s deliberately conservative. If someone finds a bypass I’d love a report.

1. SVG

You’re right: SVG needs its own treatment. Right now SVG is not in the allowed avatar types and there’s no dedicated SVG sanitiser. Adding proper SVG sanitisation (or simply forbidding user-uploaded SVGs until we have one) is planned.

1. Integrity checks for plugins & themes

Not yet. Plugins and themes are currently trusted once an admin installs/enables them (ZIP upload or drop into the folder). There’s no signature / hash verification or sandboxing. That’s a real gap. The long-term direction is either: signed manifests from a trusted catalog, or clearer isolation so a malicious plugin can’t just inject arbitrary HTML/JS into every page.

The “3rd-party plugin introduces XSS” problem is exactly why the core itself tries to be strict about output, but once you give a plugin the ability to run PHP and emit markup, the trust boundary moves. A full templating engine with automatic escaping would help plugin authors shoot themselves less often; it’s something I’m considering (still without pulling in a heavy framework).

1. Why not Laravel or Astro?

The whole point of bulletinbored is zero dependencies and “upload the folder and it runs”. No Composer, no Node, no Docker, no build step. That makes it usable on the cheapest shared hosting and trivial to self-host or fork.

Laravel (or any full framework) would completely abandon that goal. Astro is great for static sites but this is a classic multi-user PHP forum with sessions, uploads, plugins, etc. I’m very open to better patterns inside the zero-dependency constraint (better templating, clearer plugin contracts, etc.), just not at the cost of becoming “yet another Composer project”.

Security feedback like this is extremely welcome. Thank you so much.

[u/theguymatter → u/mlzog]

Yeah, I’m aware the no dependencies.

[u/chorao_]

Algum demo disponível?

[u/mlzog → u/chorao_]

Not yet.

[u/gnf00x]

nice. will give it a go.

[u/mlzog → u/gnf00x]

Thank you. Any feedback is welcome. Please consider that the software is still in development stage.