stonedz/pff2

A simple yet robust PHP MVC framework

v4.1.5 2026-02-20 10:31 UTC

Requires

• php: >=8.1
• ezyang/htmlpurifier: *
• mobiledetect/mobiledetectlib: 4.8.*
• pimple/pimple: ~3.5
• symfony/console: ~7
• symfony/mailer: ~7
• symfony/yaml: ~5.3

Requires (Dev)

• codeception/codeception: ^5.3
• phpstan/phpstan: ^1.12
• phpunit/phpunit: ^11.5
• rector/rector: ^1.2
• stonedz/pff2-doctrine: 4.0.x-dev

MIT

• Paolo Fagni

• framework

README

Pff2 is a lightweight MVC framework for PHP 8.1+.

Quick start (Composer)

1. Create a new project directory and add stonedz/pff2 to composer.json.
2. Install dependencies:

composer install

1. Scaffold app files:

vendor/bin/init

1. Your project entry point is generated from resources/site_skeleton/index.php.

Generated development files include:

• development/compose.yaml
• development/nginx.conf
• development/PHP.Dockerfile

Quick start (Docker)

The canonical development compose file is:

development/compose.yaml

Run:

docker compose -f development/compose.yaml up --build

Default service endpoints from this setup:

• Web: http://localhost:8081
• Mailcatcher UI: http://localhost:1080
• MariaDB: localhost:33061

Installation notes

• Composer install no longer auto-creates app symlinks; run vendor/bin/init explicitly.
• vendor/bin/update refreshes framework-controlled generated files (for existing projects), including Docker dev files in development/.
• Generated writable folders now default to 775 permissions (instead of 777).
• vendor/bin/init and vendor/bin/update skip optional copies when source files are not present, avoiding noisy cp: cannot stat errors.

Security defaults

Pff2 now uses safer defaults in the app skeleton:

• Exception details are configurable via show_exception_details and should be disabled in production.
• Session/cookie hardening options are available in app/config/config.user.php:
  • security_cookie_httponly
  • security_cookie_samesite
  • security_cookie_secure
  • security_session_strict_mode
• Auth module default hashing is password_hash / password_verify (legacy md5/sha256 remain deprecated compatibility paths).

Upgrade notes

• Mail module has migrated from SwiftMailer to Symfony Mailer.
  • swiftmailer/swiftmailer is removed from dependencies.
  • Existing mail/module.conf.yaml keys (Type, Host, Port, Username, Password, Encryption) continue to work.
  • sendMail(...) API remains available and returns true on success, false on transport failure.
• If your app still uses auth passwordType: md5 or sha256, plan migration to password_hash.

Notes on templates

PHP views are the recommended template path for new apps. Smarty templates are considered legacy/best-effort support.

Documentation

• Installation guide
• Smoke app guide
• Security baseline
• Architecture overview
• Upgrade guide

Additional details: Wiki