XOOPS Support Plugin for PhpStorm: Alpha 3 is here

PhpStorm finally speaks XOOPS. XOOPS Support 1.0.0 Alpha 3 teaches the IDE the conventions that used to live only in our heads: language constants, xoops_version.php, the <{ }> Smarty delimiters, the isResultSet guard, the direct-access guard. The result is fewer round trips to the browser, fewer "why is this blank" moments, and cleaner modules on the first commit.

DOWNLOAD / INSTALLATION: Install it from the JetBrains Marketplace: plugins.jetbrains.com/plugin/33478

What you get

Ctrl+B on language constants. Put the cursor on _MI_, _AM_, _MD_, _CO_ or _MB_ and jump straight to its define(), with language/english/ preferred. Find Usages works the other way round. Completion now reads every file under language/, not a fixed list, so your own catalogs are covered.

Templates that match the manifest. Two inspections keep xoops_version.php and the templates/ folder in sync. A registered template that is missing on disk is flagged, and so is a .tpl on disk that was never registered. Both come with a one-click fix: create the file, or append the manifest entry.





Ten inspections with Alt+Enter fixes. Missing defined('XOOPS_ROOT_PATH') || exit guard, fetchArray() without isResultSet(), query() used for a write, the deprecated queryF() / quoteString(), XOBJ_DTYPE_UNICODE_* (deprecated since 2.7.3), raw $_GET / $_POST / $_REQUEST, bare {if} instead of <{if}>, and include where include_once belongs. Each one explains why in its description and fixes itself with a keystroke.




A site-wide Overview. The XOOPS Support tool window scans the whole install in the background, lists every module with its template, language, preload and class counts, and turns every finding into a clickable file:line. Cancel works, and it stays idle until you press Refresh.





Core-version aware. Tell the plugin whether the project targets 2.5, 2.7 or 4.0 and the inspections adjust. The UNICODE deprecation, for example, stays quiet on a 2.5 LTS project.

What changed in Alpha 3

This release grew out of real field reports on production modules, and every fix has a test behind it.


* Findings are no longer reported twice per file.
* The isResultSet quick-fix applies cleanly in an Inspect Code batch, and an early-exit guard now covers while (list(...) = $db->fetchRow($result)).
* The direct-access guard understands namespaced files, die as well as exit, short <? tags and multiple declare statements, and inserts after namespace where PHP requires it. Entry points, admin/ scripts and 404 stubs are left alone.
* Block templates in templates/blocks/ registered by bare name, the ['template'] = '…' assignment style, and manifests with URLs in descriptions all parse correctly, so the Overview no longer shows phantom template findings.
* Commented-out define() calls stay out of completion and navigation.
* Your Core Version setting from Alpha 2 carries over.


Try it


* Install the plugin and open your XOOPS webroot in PhpStorm.
* Open View → Tool Windows → XOOPS Support and press Refresh.
* Open any module file and press Alt+Enter on a highlight.


The full walkthrough is in the tutorial that ships with the plugin. Feedback and bug reports are welcome at github.com/XOOPS/phpstorm-plugin.

1. Install

./gradlew buildPlugin

# Windows: gradlew.bat buildPlugin

Then Install Plugin from Disk… → build/distributions/xoops-support-*.zip → restart.

2. Project detection

1. Open a real XOOPS install (with mainfile.php or htdocs/mainfile.php). This plugin repository alone is not a XOOPS site root.
2. Optional balloon: “XOOPS Support active”.
3. Tools → XOOPS Support → Show XOOPS Project Info (runs in the background).
4. Settings (search “XOOPS Support”): enable/disable, Core Version, suppress notification.

3. Tool window / scanner

1. View → Tool Windows → XOOPS Support
2. Refresh (or Tools → XOOPS Support → Refresh XOOPS Overview)
3. Click findings to open files.

Reading the Overview. The header line gives the totals (here 22 modules, 316 findings) and the detected core line (XOOPS 2.7.x, from the Core Version setting or auto-detection) with the web root the scan used.

The Modules table lists every directory under modules/ that has a manifest, one row per module:

Column	Meaning
Manifest	xoops_version.php (legacy), module.json (4.0), or hybrid when both exist
TPL	.tpl files under templates/
Lang	.php files under language/ (all locales)
Pre	.php files under preloads/
Cls	.php files under class/ and src/ together

The counts are a quick health read: TPL 0 means the module renders nothing of its own (fine for a library module such as protector or xwhoops), Lang grows with every shipped locale (each adds its own set of files), and an unexpectedly large Cls usually means a vendored library sits under class/ or src/.

Findings are listed per module in the same order as the table. Each line is a kind, a message and a file:line link that opens the editor at that spot. The kinds map onto the section 4 inspections:

Finding	Inspection
MUTATING_QUERY	4.6 XoopsQueryExec
DEPRECATED_QUERY_F, DEPRECATED_QUOTE_STRING	4.1 XoopsDeprecatedDbApi
RAW_REQUEST	4.7 XoopsSuperglobal, $_REQUEST only; keyed $_GET / $_POST are left to the editor
MISSING_REGISTERED_TEMPLATE	4.8 XoopsMissingRegisteredTemplate
TEMPLATE_CASE_MISMATCH	4.8 XoopsMissingRegisteredTemplate: filename/directory spelling differs from disk
UNREGISTERED_TEMPLATE	4.9 XoopsUnregisteredTemplate
WRONG_SMARTY_DELIMITER	4.10 XoopsWrongSmartyDelimiter
SCAN_ERROR	a file or directory the scanner could not read

The scanner reports the first occurrence per file for the code-pattern kinds, so one RAW_REQUEST line can stand for several uses in that file; the editor inspection marks each one. The guard and isResultSet rules run only in the editor, where they have the PSI they need.

Use the Overview as the whole-site view: triage a large install or a module you have just imported, then open a file and let Alt+Enter do the individual fixes. The scan runs as a background task and honours Cancel.

4. Inspections + Alt+Enter

1. Copy test-fixtures/bad_module_sample.php under htdocs/modules/_xoops_demo/.
2. Open it — highlights for guards, query/exec, Request, etc.
3. Alt+Enter on each highlight and apply the fix.
4. For Smarty: a .tpl with bare {if …} should offer delimiter conversion.
5. Goffy / wgSimpleAcc shapes: test-fixtures/wgsimpleacc_shapes.php (namespaced die guard + while (list = fetchRow)) and test-fixtures/index_404_stub.php (must not warn).

All inspections live under Settings → Editor → Inspections → XOOPS. Each can be switched off or downgraded there, and the Inspection ID below is what you put in a @noinspection comment or an .idea/inspectionProfiles file. Every inspection is silent in vendor/, templates_c/, cache/ and node_modules/.

4.1 Deprecated database API — XoopsDeprecatedDbApi

Flags queryF() and quoteString(). Use query() / exec() and quote() instead.

Why. queryF() was the "force" variant that skipped the write block on query(). Since XOOPS 2.5.12 the split is explicit: query() refuses mutating SQL and exec() is the only sanctioned write path, so queryF() no longer has a job. quoteString() is a plain alias of quote() kept for backward compatibility and scheduled for removal.

// before
$db->queryF('UPDATE ' . $db->prefix('news') . ' SET hits = hits + 1');
$name = $db->quoteString($name);

// after
$db->exec('UPDATE ' . $db->prefix('news') . ' SET hits = hits + 1');
$name = $db->quote($name);

Quick-fixes. quoteString() is renamed to quote(). For queryF() the inspection reads the first string argument to decide what to offer:

• SQL starting with SELECT / SHOW / DESCRIBE / EXPLAIN: rename to query() only.
• SQL starting with INSERT / UPDATE / DELETE / REPLACE / TRUNCATE / ALTER / DROP / CREATE: exec() is offered first, query() second.
• SQL that cannot be read (a variable, a concatenation): both renames are offered; pick by intent.

exec() takes one argument, so the exec() rename is withheld while the call still passes $limit / $start. Drop those first, then re-run the fix.