PHP-Fusion: a PHP CMS and content platform

Sources and evidence limits

It relies only on the supplied PHP-Fusion repository page. Where that page is silent, this guide says the answer is unknown.

What PHP-Fusion is

The repository describes itself as the PHPFusion official development repository, and the README calls the project a CMS (content management system). It says the CMS is versatile and very scalable, but that is the project's own wording and this guide does not verify it. The repository lists the AGPL-3.0 license, a code of conduct and a security policy. The project website is phpfusion.com.

PHP-Fusion is an application product that you install and administer. It is not any of the following:

• PHP core. PHP is the language and engine. PHP-Fusion is PHP code that runs on top of it.
• A standalone runtime. It does not replace PHP and it is not an async library or an alternative interpreter.
• A framework component set. A framework such as Symfony ships reusable libraries, and a CMS ships a complete site with administration screens. PHP-Fusion belongs in the second group.
• Drupal. Drupal is a different CMS. Do not mix up their setup guides, modules, themes or upgrade paths.

Architecture, from the file layout

The repository root holds many page-level PHP scripts, including index.php, login.php, register.php, search.php, members.php, profile.php, contact.php, feeds.php, viewpage.php and install.php. It also holds maincore.php, administration, api, apps, assets, documentation, includes, infusions, locale, test, themes, upgrade and widgets directories, plus composer.json and package.json.

The packet does not explain how these pieces connect. Some reasonable reading, to verify in the code:

• The name maincore.php suggests a shared bootstrap, but the packet does not document it.
• The topics list "infusions" and "addons", so infusions are likely the add-on mechanism. Their exact contract is unknown here.
• The themes and locale directories suggest separate presentation and translation layers.
• The README's change log says Twig was added as plugins. It also says Bootstrap moved to plugins and that Twig is required for the Bootstrap plugin to work.

Execution and content model

The packet describes a web server with PHP and a MySQL database, with the backend reached through a supported browser. That is the classic request lifetime: the web server starts a PHP request, PHP loads the application, queries the database, sends a response, and releases per-request memory. Content lives in the database and in the files of the installation.

The packet does not document PHP-Fusion running in a persistent worker. Do not assume it is safe to run there.

Persistent workers are a different model. Swoole and Open Swoole are separate projects, so never assume they are interchangeable. In a persistent worker, one PHP process handles many requests, so ordinary state survives between them. That causes state leakage:

• static properties and global variables
• singletons and caches
• open database connections
• session or user data and request-specific configuration

One user's data could then appear in another user's response. Persistent workers therefore need explicit cleanup between requests, such as resetting globals and singletons, and a policy for restarting workers. A CMS written for the classic model needs an audit before it goes anywhere near that model, and the packet gives no evidence for one.

Practical use cases

The README presents PHP-Fusion as a CMS for managing a website, and the page does not list specific features. The file names suggest registration, login, member lists, profiles, messages, search, a contact form and feeds. Treat that as a hint to check against a real installation. It could suit a learning exercise in how a PHP CMS organizes pages, themes, locales and add-ons.

Installation approach

The README documents these requirements for PHPFusion 9:

• PHP 7.2.5 or greater
• MySQL 5.6 or greater, or MariaDB 10.1 or greater
• an HTTP server, with Apache 2.4 or greater recommended
• mod_rewrite or an equivalent, for SEO

It links a stable release download, an installation guide and an upgrade guide. The packet does not include the text of those guides, so the exact installer steps are unknown here. The repository also shows a 10.00.00-dev label, and the packet does not state which release is current or what a 10.x release requires. Read the linked guides before you install.

A sensible approach:

1. Download the stable release, or inspect the development repository if you only want to read the code.
2. Create an empty MySQL or MariaDB database, and keep credentials out of version control.
3. Place the files under a web server document root, with Apache as the documented recommendation.
4. Open install.php through the web server and follow the official installation guide.

The example below does not install anything. It checks a checkout against the documented minimum PHP version and confirms that expected files exist.

PHP 8.4 and 8.5

The learning track uses PHP 8.4, with PHP 8.5 planned. The packet documents a minimum of PHP 7.2.5 for PHPFusion 9 and gives no maximum. Whether PHP-Fusion works on PHP 8.4 or 8.5 is unknown. Test it in an isolated environment before relying on it, and do not copy PHP 8.4 code into the CMS on the assumption that it is supported.

Strengths

• It is a complete CMS with administration, locale, theme and add-on directories.
• It has an open AGPL-3.0 license, a security policy and a code of conduct.
• It has public issues, discussions, forum and Discord support pointers.
• It runs in the classic request model, with documented minimum requirements.

Limitations and unknowns

• Lifecycle is unknown. The packet states no support policy, release dates or deprecations.
• PHP 8.4 and 8.5 support is unknown.
• Performance and scalability claims are not verified.
• The installer steps and the infusion API are not in the packet.
• Migrating from version 9 to a 10.x line is unknown.
• The AGPL-3.0 license has conditions that matter for network services. Read the LICENSE file; this guide is not legal advice.

Deployment notes

Use a web server with PHP and a MySQL or MariaDB database as documented. Keep the database off the public internet. If you run PHP through FastCGI or PHP-FPM, bind it to a private socket or loopback and never expose it publicly. For local experiments, bind any development port to 127.0.0.1. Read SECURITY guidance in the repository before you operate a public site, and treat uploaded files and add-ons as untrusted until reviewed.

Links

The only official source supplied is the GitHub repository. Use it to find the documentation, demos, release download, installation guide, upgrade guide and security policy.

<?php
declare(strict_types=1);

const DOCUMENTED_MINIMUM_PHP = '7.2.5';

$root = $argv[1] ?? dirname(__DIR__) . '/PHPFusion';
$root = rtrim($root, '/');

$failures = 0;

echo 'PHP version: ' . PHP_VERSION . PHP_EOL;

if (version_compare(PHP_VERSION, DOCUMENTED_MINIMUM_PHP, '>=')) {
    echo 'OK   PHP meets the documented PHPFusion 9 minimum (' . DOCUMENTED_MINIMUM_PHP . ')' . PHP_EOL;
} else {
    echo 'FAIL PHP is below the documented minimum (' . DOCUMENTED_MINIMUM_PHP . ')' . PHP_EOL;
    $failures++;
}

echo 'NOTE PHP 8.4 / 8.5 support for PHP-Fusion is unknown from the supplied source.' . PHP_EOL;

if (!is_dir($root)) {
    fwrite(STDERR, 'FAIL directory not found: ' . $root . PHP_EOL);
    exit(1);
}

$expected = [
    'install.php',
    'maincore.php',
    'index.php',
    'composer.json',
    'infusions',
    'themes',
    'locale',
    'administration',
];

foreach ($expected as $name) {
    $path = $root . '/' . $name;
    if (file_exists($path)) {
        echo 'OK   found ' . $name . PHP_EOL;
    } else {
        echo 'FAIL missing ' . $name . PHP_EOL;
        $failures++;
    }
}

exit($failures === 0 ? 0 : 1);

git clone https://github.com/PHPFusion/PHPFusion.git PHPFusion
php preflight/check.php PHPFusion