Powered by You! - XOOPS Web Application System

Recent Articles

Articles	Category	Published date	Published by
XOOPS 2.7.3 FINAL (ready for PHP 8.6) XOOPS 2.7.3 Final Released: PHP 8.6 readiness The XOOPS Development Team is pleased to announce XOOPS 2.7.3 Final. This release hardens security across the core, prepares XOOPS for PHP 8.6 while remaining fully supported on PHP 8.2 through 8.5, adds SCEditor as an optional BBCode editor, introduces file-based debug configuration with a rotating file logger, and folds in a series of reliability fixes proven in production on xoops.org. DOWNLOAD: You can download the release from here: https://github.com/XOOPS/XoopsCore27/releases Ready for PHP 8.6 * Complete session save-handler contract: create_sid() ahead of its PHP 9.0 requirement, new sessions survive 8.6's updateTimestamp() routing, session.use_strict_mode pinned to the 8.6 default today * Deprecations cleared ahead of time: constructor value-returns (guarded by a repository-wide test), is_long(), curl_close(), imagedestroy() Security hardening * Element values escaped in all five form renderers, with JavaScript arguments built via json_encode() * Template-set browser and editor contained by the new shared PathGuard class — double-decode removed, NUL bytes rejected, symlink escapes refused, atomic backups — pinned by a truth-table test suite * Logout now requires a session token: a bare GET renders a POST confirmation instead of ending the session (forced-logout CSRF closed); every existing logout link keeps working * Redirect query strings are rebuilt through a shared, unit-tested helper instead of being reflected verbatim into Location headers (eight sites) * image.php's never-functional remote-image branch (an SSRF and phar-deserialization surface) is closed and fails closed * Module-manifest values escaped on the module admin pages; image category handlers now enforce authorization, not just CSRF Editors * SCEditor 3.2.1 ships bundled as an optional BBCode editor, deliberately locked to source mode so existing content never passes through a WYSIWYG round-trip * One shared dhtml toolbar for all five renderers — no more different toolbars in the control panel and the front end Debugging and logging * File-based debug configuration in xoops_data/data/debug.php — error display, error_reporting, and query logging in one place, no mainfile.php edits; nothing changes until an administrator creates the file * A rotating, redacting file logger records notices, warnings, errors and SQL with backtraces — server paths, session ids and session rows are redacted * The error screen has one declared owner, so providers such as Whoops or Tracy no longer compete for the seat Reliability fixes from production * A failing module no longer takes global search down for every visitor; the "Show all" search pages render results again; search.php validates the request and respects module_read; browse.php sends a well-formed Cache-Control header * xoops_getrank() no longer fatals when no rank row matches; a failed query returns the documented failure value instead of blanking the page * Criteria renders an empty IN () list as a constant predicate instead of invalid SQL * The group list is memoised per request (~48 identical queries removed per page) and a new comments index took a listing query from 541ms to 0.5ms Deprecations The XOBJ_DTYPE_UNICODE_* object datatypes are deprecated (notice only, behavior unchanged): they url-encode on write and url-decode on read, which bloats storage and breaks LIKE/FULLTEXT search on utf8mb4. Data migration is planned for 2.8, constant removal for 4.0. Upgrading from 2.7.2 XOOPS 2.7.3 includes schema changes, so after copying the new htdocs/ files over the web root, run the upgrade wizard. No mainfile.php changes are needed. Full documentation: https://xoops.github.io/xoops-docs/ System requirements * PHP >= 8.2.0 (PHP 8.4 or 8.5 recommended, prepared for 8.6) * MySQL >= 5.7.8 or MariaDB >= 10.5 (a supported MySQL 8.x or MariaDB LTS recommended) * Apache 2.4+ or nginx Translations XOOPS 2.7.3 adds new English language constants: the SCEditor editor strings introduced in RC 1 and one logout-confirmation string added in Final — see docs/lang_diff.txt. XOOPS remains maintained in 37 community translations: https://github.com/XoopsLanguages Thank you Thank you to everyone who submitted pull requests, reported issues, tested the beta and RC packages, translated strings, and reviewed security findings throughout the 2.7.3 cycle. A special thank-you to CHCCD for testing the release candidates and reporting the search and browse bugs fixed in this release (issues #161, #162, #163). Bug reports like these make XOOPS better for everyone. We also thank JetBrains ( https://www.jetbrains.com/ ) for supporting the project with PhpStorm licenses. Bug reports: https://github.com/XOOPS/XoopsCore27/issues Support forums: https://xoops.org/modules/newbb/ The XOOPS Development Team 105 reads	XOOPS	Mamba	24 Aug 2026 1:10 PM
XOOPS Plugin for PhpStorm Released XOOPS Plugin for PhpStorm Released Highlights * Inspections + Alt+Enter fixes (guards, isResultSet / fetch, query vs exec, Request, Smarty, templates) Live templates, language-constant completion, project scanner tool window * Module scaffold (legacy or hybrid PSR-4) * Dynamic plugin where the IDE allows (often no restart after updates) Early preview — APIs and inspections may change. Feedback welcome via Issues. DOWNLOAD: You can download the Zip file from here: https://github.com/XOOPS/phpstorm-plugin/releases 167 reads	XOOPS	Mamba	12 Aug 2026 1:50 AM
XOOPS 2.7.3 RC-1 is here — and it ... XOOPS 2.7.3 RC-1 is here — and it brings a new editor The first release candidate for XOOPS 2.7.3 is out. Thirty-six changes since Beta 1, and three of them you will notice the day you install it. A new editor, and one that finally looks the same everywhere SCEditor joins the editor dropdown as a lightweight BBCode option. It ships bundled, so there is nothing extra to download. It stays in source mode on purpose, and that is a feature rather than a limitation: a WYSIWYG round-trip is exactly how [siteurl], [d], named [size=] values and custom smilie codes quietly get rewritten or dropped. SCEditor inserts at the caret and leaves the rest of your post alone. While we were in there, we fixed something long-standing: the same editor now shows the same toolbar everywhere. Until now the control panel and the front end disagreed, and front-end themes disagreed with each other. The cause was five separate hand-written copies of the same markup. There is now one, and every renderer uses it. Code blocks work again on modern PHP If you post code on PHP 8.3 or newer, you may have seen blocks that began with the mysterious text le="color: #000000">. PHP changed how it highlights code in 8.3; XOOPS was still cutting fourteen characters off the front, assuming the old format. Fixed — along with the whitespace inside code blocks. Your error screen, under your control The headline feature. When a site throws an uncaught error, the module that draws the screen is now one owner you declare, rather than whoever happened to register last. XOOPS publishes who owns it, where that came from, and whether anything is wrong. Choose your screen: xWhoops 2.0.0-Beta2 or the brand-new xTracy 1.0.0-Beta1. Watch it from DebugBar 1.4.1, which now reports the real owner instead of guessing. Full details in the companion post. And quietly, in the background A round of security work on form output, module administration and the image manager. A database fix for searches that produced invalid SQL when a user's permission list was empty. And a Windows bug so old that the file cache had never worked there. Try it This is a release candidate: please install it on a test site, put it through its paces, and tell us what breaks. That is what an RC is for, and it is the most useful thing you can do for 2.7.3 right now. Bug reports and feedback: XOOPS on GitHub. 255 reads	XOOPS	Mamba	11 Aug 2026 7:30 AM
XOOPS ModuleInstaller 1.7.0 Alpha 1 ... XOOPS ModuleInstaller 1.7.0 Alpha 1 Speeds Multi-Module Testing and Development ModuleInstaller 1.7.0 Alpha 1 is now available for XOOPS 2.7, delivering safer module operations, structured reporting, and a more polished multilingual admin experience.. New Features - Secure, escape-once rendering of module installation logs - Structured reports for HTML, plain text, CLI, logging, and JSON - New ModuleOperationResult API with full backward compatibility - 30 new translatable admin strings with reliable English fallbacks - Improved RTL display for counters, versions, statuses, and summaries - Safer module-logo and manifest handling - Better accessibility and long-report navigation - Test suite expanded from 18 to 124 tests Requirements: XOOPS 2.7.0+, PHP 8.2+, mtools 1.2.0+ (installed; need not be active). Download ModuleInstaller: https://github.com/XoopsModules27x/moduleinstaller/releases/ mTools: https://github.com/XoopsModules27x/mtools/releases A full walkthrough is in the module’s docs/TUTORIAL.md 212 reads	Modules	Mamba	03 Aug 2026 4:40 PM
XOOPS Debugbar 1.4.0 released XOOPS DebugBar 1.4.0 Is Here: Smarter Diagnostics, Safer Debugging, Faster Development XOOPS DebugBar 1.4.0 delivers administrator-only diagnostics, performance analytics, query and N+1 detection, protected logs, system checks, and optional profiling integrations for XOOPS 2.7.1+ The release strengthens security with bounded sanitization, CSRF protection, signed read-only EXPLAIN requests, and safer diagnostic rendering, while adding numerous usability and reliability improvements. Existing installations should run the XOOPS module update after upgrading. DebugBar 1.4.0 turns the module from a request inspector into a diagnostics toolkit: it now tells you not just what happened, but where in your code it happened. Highlights * Call-site attribution. N+1 and duplicate-query detection could report that sixty-two identical statements ran, but not what ran them. Findings now name the file and line — on the first real page it saw, a genuine N+1 in Publisher: sixty-two executions from ItemHandler.php:255. * Where the time actually went. A Boot / SQL / App split names whichever segment dominated the request, so you know whether query tuning would help before you start. The Server-Timing header reports the same breakdown. * Real-user web vitals. LCP, INP and CLS collected from actual visitors and attached to the matching profile, with per-URL averages on the Analytics page. * Xdebug profiling from the toolbar. Arm a one-shot profile with a button, then read the cachegrind output in the admin — top functions by inclusive and self cost, no external viewer needed. * Block cache visibility. A front page rendering nineteen uncached blocks pays nineteen block renders on every view. Cached and uncached counts are now stored per request and averaged per module. * Three features that had shipped without working now do: a) the collect_events preference (every dispatch is observable, including events nothing listens to), b) SQL syntax highlighting in the Queries panel, and c) the per-profile Delete button in the Xdebug viewer. DOWNLOAD: https://github.com/XoopsModules27x/debugbar/releases/ TUTORIAL: https://github.com/XoopsModules27x/debugbar/blob/main/docs/using-debugbar.md 188 reads	Modules	Mamba	03 Aug 2026 4:40 PM