The Problem

Small and mid-sized hotels need an online booking presence but face either expensive SaaS booking platforms with per-booking fees or generic CMS plugins that lack property-management features. QloApps addresses this by providing a free, self-hosted reservation system with a booking engine, property management, and a hotel website in one PHP application.

What This Does

QloApps is a fork of PrestaShop re-purposed for hospitality. It runs a hotel website, accepts and manages reservations, and handles property-management tasks (room inventory, rates, guest records). The README documents PHP 8.1–8.4 and MySQL 5.7–8.4 as the supported runtime.

Per static analysis, this repository is a collection of six self-contained projects rather than one unified codebase: js/ (879 files, 508 code files), admin/ (1237 files, 56 code files), modules/ (1297 files, 44 code files), themes/ (432 files), install/ (1579 files), and tools/ (1706 files, mostly vendored third-party libraries like tools/defuse, tools/tcpdf, tools/mobile_detect). The actual application logic lives in classes/ (248 files) and controllers/ (141 files), with the Adapter/ and Core/ directories providing a service-locator and entity-manager layer on top of PrestaShop's legacy architecture.

How It Is Wired

The full call graph has not been mapped for this repository, so the wiring between these components is inferred from structure rather than traced. Execution begins either through the web installer in install/ or through admin/ entry scripts such as admin/ajax.php and admin/index.php. The front-end entry points are themes/hotel-reservation-theme/js/index.js and js/fullcalendar/main.js (calendar-based booking UI). Controllers in controllers/ route HTTP requests to the classes/ domain layer, which persists through the Core/Foundation/Database/ entity manager and the Adapter/ layer's Adapter_Database and Adapter_EntityMapper classes.

The Adapter/ directory (16 files) is the integration seam: Adapter_ServiceLocator, Adapter_HookManager, and Adapter_Configuration wrap PrestaShop's static service access so the newer Core/ code can use dependency injection. Anyone changing this code will touch both the legacy static-style classes and the Core/ interfaces; the two-layer split is the main source of complexity.

How To Use It

Setup. No lockfile is present, so dependencies are not reproducibly pinned. The composer.json manifest declares PHP dependencies; run composer install after cloning. A Docker image is referenced in the README (webkul/qloapps_docker on Docker Hub), and tools/mobile_detect/.../docker/Dockerfile.setup exists but is a vendored artifact, not the app container.

Configuration. PHP extensions required: PDO_MySQL, cURL, OpenSSL, SOAP, GD, SimpleXML, DOM, Zip, Phar. PHP memory_limit of 128M and max_execution_time of 500 are documented. Database credentials are configured during the web installer at install/, which also verifies server compatibility.

Running it. Point a web server (Apache, Nginx, IIS) at the repo root and visit the installer path:

composer install
# serve the repo root with Apache/Nginx, then open /install in a browser

Real-World Use

A 30-room boutique hotel deploys QloApps on a $10/month VPS. Guests book through the hotel-reservation-theme front-end; the booking engine writes reservations via the Core/Foundation/Database entity manager to MySQL. Staff manage inventory and rates through admin/; the fullcalendar integration shows occupancy. The hotel avoids per-booking SaaS fees, paying only hosting costs.

Code Health & Issues

From static analysis (measured, not opinion):

  • High — No lockfile beside composer.json. Unpinned transitive dependencies mean the tested artifact and shipped artifact can differ. Fix: commit the generated lockfile.
  • High — No build gate for deployment artifacts. tools/mobile_detect/mobiledetect/mobiledetectlib/docker-compose.yml defines deployables with no workflow validating them. Fix: add a CI job that builds and validates.
  • Medium — No Dependabot/Renovate configured despite 27 manifests. Advisories go unpatched until manual review. Fix: commit .github/dependabot.yml.
  • Medium — Mutable base image composer:latest in tools/mobile_detect/.../Dockerfile.setup. Fix: pin by digest.
  • Medium — Test coverage is negligible: 15 test files against 3867 source files (ratio 0.004). Fix: add tests to highest fan-in modules first.
  • Low — Missing .editorconfig, .gitattributes, and formatter config; cross-platform line-ending and style drift is likely.

SDLC observation from structure: CI exists (.travis.yml) but Travis CI is deprecated; the project should migrate to GitHub Actions. Committed secrets were flagged by the audit and should be verified against cache/cacert.pem and tools/tcpdf/examples/data/cert/tcpdf.p12.

The Bottom Line

QloApps is a functional, feature-complete hotel booking platform with a real PMS and booking engine, but it carries PrestaShop's legacy architecture and a thin test suite. It suits hotels wanting self-hosted booking software with an active upstream community (14k stars on the parent repo). Teams adopting it should budget for dependency pinning, CI migration, and test coverage before production use.