Download the PHP package ci4-cms-erp/ci4ms without Composer

CI4MS

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. It combines CMS workflows, developer-focused CLI commands, an extensible module system, and customizable front-end themes in a single package.

Key Features

• Authentication & RBAC: Modules\Auth handles user login, lockouts, and password resets via CodeIgniter Shield. Permissions map to auth_permissions_pages records.
• Modular backend: Each feature ships as an independent module (Blog, Pages, Menu, Media, Users, Settings, Theme, etc.) under modules/*.
• Flexible content management: Page and blog entries include SEO metadata, categories, tags, and full comment workflows.
• Media & files: Includes elFinder-powered media management, a built-in file editor, and an in-panel log viewer.
• Automatic Updates: Modernized UpdateService provides a "One-Click Update" system with atomic file operations, automated GitHub version discovery (bypassing 300-file limits), and secure rollback management.
• Security Architecture: Global CSRF protection across all AJAX endpoints, strict HTTP security headers (CSP, HSTS, X-Frame-Options), executable file upload blacklists, and HTMLPurifier sanitization to prevent XSS and RCE attacks.
• Backup Support: Updates automatically trigger a full backup of modified files before applying patches, with a dedicated management interface for restores.
• Theme system: The public/templates/* structure and the Modules\Theme module enable installing or upgrading themes from ZIP packages.
• Setup & automation: Offers a web-based installer (/install) plus a single CLI command (php spark ci4ms:setup) for automated installation, default data seeding, and route generation. Module scaffolding is available via php spark make:module.
• Docker support: Ships with a production-ready Dockerfile, docker-compose.yml, and a GitHub Actions CI workflow out of the box.
• SEO helpers: ci4seopro builds meta tags and JSON-LD, while CommonLibrary centralizes email, breadcrumbs, and inline shortcode utilities.

Requirements

• PHP 8.2 or newer (intl, json, mbstring, gd, curl, openssl extensions required)
• Composer 2.5+
• MySQL / MariaDB (or any CodeIgniter 4-supported driver)
• Writable directories: writable/, public/uploads/, optionally public/templates/

See composer.json for the full dependency list (e.g. bertugfahriozer/ci4commonmodel, bertugfahriozer/sql2migration, ci4-cms-erp/ext_module_generator, claviska/simpleimage, gregwar/captcha, studio-42/elfinder).

🪴 Project Activity

Installation

Fresh Project (recommended)

Clone Existing Repository

Docker (recommended for development & CI)

Refer to DOCKER_SETUP.md for full Docker configuration details.

Environment & Configuration

1. Create your .env from the template:

2. Update these core settings in .env:

   • app.baseURL
   • database.default.*
   • Optional: cookie.*, honeypot.*, security.*

3. Prepare the routes file:

4. If you prefer the web installer, open /install in the browser and follow the wizard. Use the CLI step below to skip the wizard.

One-Command Setup (CLI)

This single command runs all migrations, seeds default data (modules, permissions, sample content), and creates the initial administrator account. No separate migrate or seed commands are needed.

Run the Dev Server

Access the backend via: https://<domain>/backend

Directory Layout

Key files:

• app/Commands/ — CLI tooling (make:a*, create:route, ci4ms:setup).
• app/Filters/Ci4ms.php — Install guard, maintenance mode redirect, menu cache.
• app/Config/DefaultRoutes.php — Routes template; copy to Routes.php on setup.
• modules/* — Each module includes its own Config/Routes.php, Controllers, Models, Views, Language, Libraries, Filters.
• public/templates/ — Theme assets; each theme requires info.xml and screenshot.png.
• writable/ — Cache, logs, temporary files.

Modules

See docs/architecture.md for deeper architectural notes.

CLI Commands

Standard CodeIgniter commands (php spark db:seed, php spark key:generate, etc.) are also available.

Developer Notes

• Cache keys: settings (24h), menus_{locale} (per-locale, 24h), {userId}_permissions. Clear with php spark cache:clear or cache()->delete().
• Base controller: Extend Modules\Backend\Controllers\BaseController for new backend controllers; it prepares session user, navigation, mail settings, and shared data.
• Permissions: Register new secured routes in Modules\Methods (or via the database) so the permission filter recognizes them.
• Slug generation: seflink() handles transliteration (including Turkish characters).
• Form security: Global CSRF is enabled; backend AJAX endpoints opt out via BackendConfig::$csrfExcept.
• Comment moderation: CommonLibrary::commentBadwordFiltering handles bad word filtering and moderation rules.
• Theme uploads: Each theme must include info.xml and screenshot.png; missing files trigger a backend warning.

Testing & Maintenance

• composer test — runs PHPUnit.
• The GitHub Actions workflow (.github/workflows/docker-test.yaml) automatically builds the Docker image and runs migrations on every push to master.
• Maintenance mode: When settings.maintenanceMode.scalar == 1, the Ci4ms filter redirects visitors to maintenance-mode.
• Security: Fileeditor enforces realpath guards and a dangerous extension blacklist (.php, .phtml, .phar, .htaccess) to prevent RCE; destructive operations (deleteFileOrFolder, renameFile) additionally validate against an extension allowlist to block renaming or deleting critical application files. Backup restore uses SQL statement whitelist to block malicious queries (LOAD_FILE, GRANT, etc.). HTMLPurifier config is hardened against XSS bypass (data: URIs blocked, CSS.Trusted disabled) and CustomRules::getClean() output is persisted on every create and update flow in Blog and Pages controllers to prevent Stored XSS. All $_SERVER reads replaced with CI4 base_url()/site_url() helpers. Configure App.php::$proxyIPs if behind Cloudflare/Nginx.

Additional Docs

• docs/architecture.md — Architecture, flow, permissions, and extension guidance.
• docs/developer-handbook.md — Environment setup, coding standards, deployment checklist.
• docs/theme_development.md — Theme folder structure, routing, and base.php variables.
• DOCKER_SETUP.md — Docker environment configuration and usage.
• CHANGELOG.md — Full release history.

Questions or contributions? Open an issue or pull request.

🏆 Security Hall of Fame

A huge thank you to the security researchers who have helped make ci4ms more secure by finding and reporting vulnerabilities.

If you find a security vulnerability, please report it via Security Policy.

🐞 Bug Reporters

Thanks to the community members who report functional bugs and help us catch regressions before they hit more users.

Found a non-security bug? Please open an issue with reproduction steps.