[RFC|Accepted] Symfony 2

[naderman]

Using the Symfony 2 PHP framework
I propose to build phpBB4 using the Symfony 2 full-stack web framework.

Information about Symfony 2 can be found at: http://symfony-reloaded.org
The code is available at http://github.com/symfony

You can find the RFC at http://wiki.phpbb.com/display/DEV/PhpBB4+RFC+Symfony+2. Please inform people in this topic about any major changes you make.

Let me know what you think. I think this is would be a great step for phpBB and based on my experience at Symfony Live I believe the Symfony community would appreciate this a lot as well. Discuss!

[EXreaction]

http://symfony-reloaded.org/

[tux.]

I don't think it is a good idea to use an existing framework. Although it might help developing new features, it is quite hard to find (and squash) any bugs there and to diversify your bugs from their bugs. Maybe you'd better consider using your own code as a "framework".

[bantu]

I don't think it is a good idea to use an existing framework. Although it might help developing new features, it is quite hard to find (and squash) any bugs there and to diversify your bugs from their bugs. Maybe you'd better consider using your own code as a "framework".

Generally, there is no point in reinventing the wheel over and over again. Using preexisting code will speed up the development process a lot.

If we would build our own framework to have the functionality, extensibility etc. we need to build the very modular system the community wants (no more code changes when adding functionality), we would probably end up with something that is pretty close to Symfony 2. So I do not see why we shouldn't be using a framework like Symfony.

As for bugs it's actually better to use an existing framework that pretty much fits our needs, because at the end of the day the community using the framework will be much bigger and bugs can be fixed faster.

If there is something missing we need, we can still do it on our own since the framework is very extensible ... and we can also contribute back to the framework itself.

[ameeck]

How will we manage distribution? Will Symfony be packed together with phpBB when distributing or will it be listed as a requirement for installation which must be acquired manually?

[ToonArmy]

How will we manage distribution? Will Symfony be packed together with phpBB when distributing or will it be listed as a requirement for installation which must be acquired manually?

Not really an issue right now, either method have their pros and cons. Personally we should perhaps provide both packages.

[code reader]

Let me know what you think. I think this is would be a great step for phpBB and based on my experience at Symfony Live I believe the Symfony community would appreciate this a lot as well. Discuss!

in principle i think it's a good thing. we should do as little as possible that does not relate *directly* to bbs. using a generic framework is a great way to progress towards the goal. the world does not need yet another database abstraction layer that was developed inside phpbb, same thing with templates and every other generic tool.

in practice, it depends on the details. i did not yet have a chance to look at symphony.
will come back when (or rather if and when) i'll find time to go over it.


peace.

[EXreaction]

I like the idea, but a few things worry me:

1. Security - Security is a big issue, we don't want more security problems in 4.x than 3.x.
2. Complexity - If the code is too difficult to follow for existing mod authors it will make it more difficult for them to develop plugins. Many mod authors are not professional php developers or have the time or patience required to learn a framework.
3. Updates - What are the plans for keeping boards updated with framework updates? What about support from boards running newer or older versions of a framework?

[rschumacher]

Before I respond to the above questions, who am I: I'm a user of phpBB but not a phpBB developer nor contributor. I am however developing with symfony since about two years for web-based software. So the purpose of my post is to give some information about Symfony. I'm very pleased to see phpBB devs seriously considering Symfony 2 for their next majors version; however I am not the sort of guy that tries to urge you to actually do so.

1. Security - Security is a big issue, we don't want more security problems in 4.x than 3.x.

While I don't know in detail the specific security issues experienced in phpBB versions up to now, I can say that Symfony has implemented a comprehensive security-aware construction in many ways, and that the needed functionalities are included while not bothering you directly in your task to develop your application. Just two examples which do not need really much ado by the developer (you may still care more about it according to your situation): user authentication and credentials on modules and actions level, detailed parameter filtering and checking in form submissions, and much more. As this is a critical part you may need to get more sophisticated support by the Symfony core team on that. But I feel confident about Symfony's reliance on this respect.

2. Complexity - If the code is too difficult to follow for existing mod authors it will make it more difficult for them to develop plugins. Many mod authors are not professional php developers or have the time or patience required to learn a framework.

First of all phpBB devs are free to choose whatever plugin API they wish to offer; be it Symfony's bundle (= name used for plugins in Symfony2) or a custom API, or something in-between. I would assume you will in any case provide a custom API specialised on forum aspects, no matter which frameworks and/or libraries phpBB4 will be based on.
Even if Symfony2's bundle system shall be the platform for phpBB4 plugins, one could argue whether this be an advantage or disadvantage, considering the growing base of Symfony developers (350 paying attendees were in Paris this week...).
It's correct that developing with Symfony requires sound programming knowledge and the use of advanced programming concepts. E.g. having heard about OOP is not enough. But I think programming excellence is needed for serious development of complex and robust software products like phpBB, anyway. Especially when thinking about security problems that reportedly appeared repeatedly in phpBB3 (if I didn't misunderstand).

3. Updates - What are the plans for keeping boards updated with framework updates? What about support from boards running newer or older versions of a framework?

There is as such no requirement to always migrate phpBB along with the latest Symfony version. Symfony declares their support time for each version regarding fixing bugs etc, it's one year as a minimum, and 3 years for so-called LTS (long-term support) versions. So whenever security issues are detected in a (previously released) Symfony version, they will be fixed without compromising compatibility. This reduces the "pressure" to make migrations to newer Symfony versions. Automated tools are also provided to assist in upgrading from one version to another.
For how such support declarations and possible migrations paths do look like in Symfony, see http://www.symfony-project.org/installation.

Hope this helps a bit for your evaluation.
Cheers, RAPHAEL

[ameeck]

EXReaction: We have already defined an update mechanism for necessary security updates which could be present in phpBB or in third party products. Besides Symfony 2 is a mature product which has learned a lot from previous version and I believe security concerns in the basic low-level functions it's provide is covered.

As for the complexity of the code, I think it will actually be a step in the other way. At this moment, 95% of the available phpBB MODs need to hack into the system and manually hook into the code. The code suffers from worse legibility and is often prone to overlooking errors.

The new framework will allow MOD authors and developers to create small and large features and packages, which they can thoroughly test (I mean unit testing), which are much more effective and which result in less conflict areas than the current set up.

OOP programming for PHP should be a must-know in the time when phpBB4 comes out. Honestly I think we can do without many of the three line MODs that so-called developers release, it certainly won't hurt the extensibility or customization abilities of phpBB. Learning how things go and are named is a matter of a few hours if you've had experience with at least one MVC(P) framework. The positive side of this is that you can encounter Symfony in other places, so:

• People will be able to navigate themselves in other applications which are based on Symfony
• We will allow many developers which already now work with Symfony (this also applies to the potential use of Doctrine) or another MVC framework to participate in phpBB and not burden them with learning custom phpBB templating/DBAL etc.