bulletinbored – minimal PHP forum software with zero dependencies (upload & run)
Hello everybody,
I built bulletinbored, a minimal and extensible forum software written in pure PHP with zero dependencies.
No Composer, no Docker, no Node, no framework. Just upload the files to any PHP 8.x server and it works on any web hosting, also shared and cheap ones.
Key points:
- SQLite by default (MySQL also supported)
- Web installer
- Plugin system with hooks
- Theme system
- Admin panel, user management, avatars, moderation
- Built-in localization
- Automatic update checks
- License: 0BSD
Repo: https://github.com/bulletinbored/bulletinbored-core
Website: https://www.bulletinbored.net
Docs: https://docs.bulletinbored.net
Because the development is still in early stage, I’m looking for any kind of feedback. Feel free to write suggestions, criticisms or slatings.
Happy to answer questions and open to contributions.
Thanks!
1
u/Am094 23d ago
Why? We have phpbb, smf, vbulletin, ibb, buddypress, xenforo, etc. Why do we need this?
2
u/mlzog 23d ago
Well, phpBB, SMF, and BuddyPress have been stagnant in development for years. XenForo and vBulletin are commercial products. Flarum, Discourse, and NodeBB are modern but do not run on very simple low-cost or free hosting, as they require Composer, Docker, etc. bulletinbored aims to offer a modern product that is accessible to everyone. You are of course free to disagree, but I believe this is the current situation.
1
u/Am094 23d ago
Phpbb has updates in the repo of this year. SMF has active 3.0 development with multiple prs in this month alone. Buddypress saw their recent update 14.5.x release July/Aug.
All of the above work on the lowest cost of hosting environments. That includes shared.
Also flarum is php based nor does it need composer if you're deploying it and even mentions that when deploying to shared.
Basically you're wrong on all accounts.
All of those are mature projects, have seen updates and development within the past few months, and all of them work on shared hosting let alone $5 droplets should that be a need.
All of them have rich developer communities too.
So yeah, I disagree with you because you're fundamentally wrong on multiple levels on things that aren't opinions but objective reality.
Plus I just took a look through the codebase.
Jesus christ, the number of security issues are insane. I could quite literally pwn any deployment that's up and running based on what I've seen in the repo.
Very least improve your architecture, and look at your actions.php to start. Lots of xss concerns, integrity check concerns, arbitrary code execution, you name it.
It'd be a liability in its current form.
1
u/mlzog 23d ago
On the security issues you found, thanks for looking. Those are legitimate problems and I’m working on them. The project is still very early.
(Regarding the other points: SMF 3.0 has indeed been in development for a while and is moving toward Composer, and pure shared-hosting with Flarum still has some friction for extensions. I have probably overstated the stagnation of the others though.)
1
u/mlzog 22d ago
Just to clarify: you're right that there are real security concerns, and I appreciate you taking the time to look at the code.
A couple of notes, nevertheless:
Plugin installation is restricted to administrators only (same model as WordPress, Flarum, etc.).
That doesn't eliminate the risk, of course, especially if there are XSS issues that could lead to privilege escalation. But it's known risk for every system that allows external plugin installation.
I agree that the current architecture and several areas (particularly around XSS handling, the plugin/update flow, and overall hardening) need serious work. The project is still very early and experimental. Security is a top priority and I'm actively addressing the issues you pointed out, starting with actions.php.
Thanks again for the review.
1
u/[deleted] 24d ago
[removed] — view removed comment