XOOPS Web Application System :: Forum

XOOPS 2.7.4 Final Released (ready for PHP 8.6) [by Mamba]

Sat, 17 Oct 2026 04:43:13 +0000

Xoops Development::XOOPS 2.7.4 Final Released (ready for PHP 8.6)
800) this.width=800" />

More info: https://xoops.org/modules/publisher/item.php?itemid=6140

XOOPS 2.5.11.2 - maintenance update for XOOPS 2.5.11 [by Mamba]

Sat, 17 Oct 2026 04:42:43 +0000

Xoops Development::XOOPS 2.5.11.2 - maintenance update for XOOPS 2.5.11
800) this.width=800" />

More info: https://xoops.org/modules/publisher/item.php?itemid=6139

XOOPS 2.6.0 Alpha 2 released [by Mamba]

Sat, 17 Oct 2026 04:42:06 +0000

Xoops Development::XOOPS 2.6.0 Alpha 2 released
800) this.width=800" />

More info: https://xoops.org/modules/publisher/item.php?itemid=6141

XOOPS 2.5.11.1 - security update for XOOPS 2.5.11 [by Mamba]

Fri, 09 Oct 2026 03:51:23 +0000

Xoops Development::XOOPS 2.5.11.1 - security update for XOOPS 2.5.11
800) this.width=800" />

XOOPS 2.5.11.1 — security update for XOOPS 2.5.11

The XOOPS Development Team has released XOOPS 2.5.11.1, a security update for XOOPS 2.5.11. It changes only the input filter that XOOPS uses on request data. If your site runs XOOPS 2.5.11, please apply it.

DOWNLOAD: https://github.com/XOOPS/XoopsCore25/releases/tag/v2.5.11.1

What's fixed

XOOPS 2.5.11 bundles the XMF library, and its input filter (Xmf\FilterInput, which XoopsFilterInput builds on) now includes the fixes from XMF 1.2.32.1:

* Filtering always finishes: some input made the filter run until PHP hit its memory limit, so one request could take a page down. A value that does not settle after a fixed number of passes is now dropped. (GHSA-8j4x-8r8r-5jgw)
* Stricter tag and attribute checks: some tag and attribute patterns got through the filter. Tag and attribute names are now checked strictly, event-handler attributes are matched whatever their case, link schemes are checked after HTML entities are decoded, and stripped text keeps no partial tag. (GHSA-pf53-59r5-mhjv)

There are no database, template or language changes, and no new features. The fix keeps PHP 5.6 compatibility, so 2.5.11.1 runs on the same servers as 2.5.11.

How to update

From XOOPS 2.5.11 (recommended: the patch)
1. Download xoops-2.5.11-to-2.5.11.1-patch.zip from the release page
2. Back up your site files
3. Copy the contents of the zip's htdocs folder over your XOOPS root folder (the one that holds mainfile.php), keeping the folder paths. Two files are replaced:

class/libraries/vendor/xoops/xmf/src/FilterInput.php
include/version.php

4. That's it. You don't need to run the upgrade wizard. System Admin now shows XOOPS 2.5.11.1-Stable

New install, or a version older than 2.5.11
Use the full package (the source code zip on the release page) and follow the usual install or upgrade steps.

XOOPS 2.7
XOOPS 2.7.4 RC 2 already includes the same fixes through XMF 1.3.2. If you are planning a move to the 2.7 line, see github.com/XOOPS/XoopsCore27/releases.

...

XOOPS 2.7.4-RC2 Released [by Mamba]

Tue, 06 Oct 2026 15:18:34 +0000
Xoops Development::XOOPS 2.7.4-RC2 Released
800) this.width=800" />

XOOPS 2.7.4 RC 2 — security hardening ahead of the final release

The XOOPS Development Team is pleased to announce XOOPS 2.7.4 RC 2, the second release candidate for XOOPS 2.7.4. RC 2 adds no new features. It collects the security hardening and bug fixes made since RC 1, after a review of the core with CodeQL, Snyk, SonarCloud, Scrutinizer and manual audits.

XOOPS 2.7.4 brings two-factor authentication into the core, makes SCEditor a full visual editor and the default for new sites, and adds Markdown support through EasyMDE. It runs on PHP 8.2 through 8.5.

Please test RC 2 on a staging copy of your site and report anything you find. Unless something serious turns up, the next release is 2.7.4 Final.

DOWNLOAD: https://github.com/XOOPS/XoopsCore27/releases

What's new since RC 1

Forms and redirects

* Form security tokens no longer depend on the browser's User-Agent: a token is now a random value compared in constant time. A browser update, a privacy extension or a "desktop site" toggle between opening and submitting a form no longer rejects it. Forms opened before the upgrade still submit
* Protector uses the core form token: its admin pages check the same token as the rest of XOOPS. XoopsGTicket is deprecated and now wraps the core token, so modules that still call it keep working
* One same-site check for redirects: login, post-login and theme-switch return addresses share one check. It refuses targets written with backslashes, encoded slashes, HTML entities or embedded line breaks, and sends them to the home page instead
* Escaped confirmation pages and error lists: xoops_confirm() escapes every field, value and label, and the object and login error lists are escaped too

Files and storage

* Uploads are deleted only inside the upload directory: the image manager and the smilies, user-rank and avatar admin pages resolve a stored file name before they delete it
* Protected database dumps: a dump is written only under XOOPS_VAR_PATH, into a directory guarded by a deny-all .htaccess and private to the PHP user
* Cache ids use a site key: the group part of theme and block cache ids is keyed with a random site key in xoops_data/data instead of the database credentials
* Random installer names: the installer renames itself and names its cleanup script with random_bytes(). Only the installing session can finish the clean-up
* Protector writes its ban files atomically and rejects an uploaded image it cannot inspect instead of staging it in uploads/

Server configuration

* xoops_lib/.htaccess works on Apache 2.4 without mod_access_compat, where the old rules returned a 500 error instead of denying access
* PHPMailer's unused OAuth helper is removed from the bundled vendor tree, and a Composer script removes it again after every vendor refresh
* reCAPTCHA v2 verifies over POST, so the secret key no longer appears in proxy or server logs
* The bundled XMF library is updated to 1.3.2, which tightens the tag and attribute filtering used for request input

Fixes

* The optional confirmation step for deleting notifications works again
* Deleting a user rank or avatar that no long...

Re: XOOPS 2.7.4-RC1 Released [by Mamba]

Mon, 28 Sep 2026 05:41:57 +0000
Xoops Development::XOOPS 2.7.4-RC1 Released
Thank you for your kind words!

It's nice that some people see and appreciate the progress!

Re: XOOPS Plugin for PhpStorm 1.0 Alpha 3 Released [by Mamba]

Wed, 23 Sep 2026 04:23:08 +0000
Xoops Development::XOOPS Plugin for PhpStorm 1.0 Alpha 3 Released

4. Inspections + Alt+Enter

Copy test-fixtures/bad_module_sample.php under htdocs/modules/_xoops_demo/.

Open it — highlights for guards, query/exec, Request, etc.

Alt+Enter on each highlight and apply the fix.

For Smarty: a .tpl with bare {if …} should offer delimiter conversion.

Goffy / wgSimpleAcc shapes: test-fixtures/wgsimpleacc_shapes.php (namespaced die guard + while (list = fetchRow)) and test-fixtures/index_404_stub.php (must not warn).

All inspections live under Settings → Editor → Inspections → XOOPS. Each can be switched off or downgraded there, and the Inspection ID below is what you put in a @noinspection comment or an .idea/inspectionProfiles file. Every inspection is silent in vendor/, templates_c/, cache/ and node_modules/.

4.1 Deprecated database API — XoopsDeprecatedDbApi

Flags queryF() and quoteString(). Use query() ...

ModuleTools 1.5 for XOOPS 2.8.0 [by Mamba]

Tue, 22 Sep 2026 06:26:12 +0000
Xoops Development::ModuleTools 1.5 for XOOPS 2.8.0
800) this.width=800" />

ModuleTools: the shared toolbox every XOOPS 2.8.0 module now gets for free

If you have ever built a XOOPS module, you know the ritual. Copy a class/Common/ folder from the last module. Paste in the install helpers, the version checks, the admin table code, the confirmation dialog, the breadcrumb builder. Fix the namespace. Hope nothing drifted since the last copy.

With XOOPS 2.8, that ritual is over. ModuleTools ships inside XOOPS 2.8.0 Core as Xoops\ModuleTools\*, autoloaded on every request. There is nothing to install, nothing to activate, and no helper module to keep in sync. Your module just calls it.

What is in the box

ModuleTools is the successor to the mTools helper module, rebuilt as a proper library. It gathers the services modules used to carry as copied files:

* Install and update hooks. Directory checks, file checks, dependency and version guards, sample-data buttons, and an update checker that reads your GitHub releases.
* Admin pages in minutes. Object tables, tree tables, single-record views, CSV export, and a controller that handles create, edit, delete and uploads from one form definition.
* Objects and forms. A dynamic object base with SEO fields and a form builder that turns your handler's metadata into a ready XoopsThemeForm.
* Front-end helpers. Breadcrumbs, letter navigation, pagination, text truncation with intact HTML, social bookmarks, syntax highlighting, image resizing.
* Permissions. Per-item group permissions with a clean gateway, so your module never writes to the permission table by hand.
* Module lifecycle. A ModuleContext value object for paths, URLs and constants, a namespace autoloader that also understands legacy filenames, and a cloner that turns one module into the starting point for the next.

Why it matters

Less code to own. A typical converted module drops dozens of copied files. Fewer files means fewer places for a bug to hide and fewer places to patch when one is found.

Security fixes land once. When the confirmation dialog or the CSV export is hardened, every module on the site gets the fix on the next Core update. No module release required.

Modern PHP, tested. The library targets PHP 8.4, passes PHPStan at level 6, and ships a growing PHPUnit suite that includes consumer tests run against real modules inside a XOOPS tree.

No migration cliff. Existing modules keep working. ModuleTools registers lazy aliases for the stable XoopsModules\Mtools\* names, so a module written for the mTools module runs on 2.8 unchanged. When you are ready, the migration guide walks through swapping copied classes for library calls, and a Rector rule set does most of the typing.

Still there for 2.7. Sites on XOOPS 2.7.x keep the separately distributed mTools module with the same class names. Write against the API once and it runs on both.

Getting started

On XOOPS 2.8 the library is already loaded. In a module, grab your XMF helper and go:

use XmfModuleHelper...
XOOPS 2.7.4-Beta2 with 2FA Released for Testing [by Mamba] Sun, 13 Sep 2026 10:20:06 +0000 Xoops Development::XOOPS 2.7.4-Beta2 with 2FA Released for Testing 800) this.width=800" /> XOOPS 2.7.4 Beta 2 — Two-Factor Authentication (2FA) comes to the Core The XOOPS Development Team is pleased to announce XOOPS 2.7.4 Beta 2. The headline feature is two-factor authentication (2FA) built into the core: every member can protect their account with a second step at login, using an authenticator app or a code sent by e-mail. This is a beta for testing; please try it on a staging copy of your site and report what you find. Two-factor authentication * Two methods: a time-based authenticator app (Google Authenticator, Microsoft Authenticator, Aegis, FreeOTP, or any password manager that generates TOTP codes), or a six-digit code mailed to the member's address * Ten one-time recovery codes at enrolment, for the day the phone or the mailbox is out of reach * Five wrong codes lock the second step for fifteen minutes; the member is notified by e-mail * Remember-me cookies are bound to the enrolled factor, so a reset invalidates them * Members manage everything themselves from Edit Account, including disabling and replacing recovery codes * Administrators reset a member's factor from Users, and an operator locked out of the site has a documented escape hatch * Off by default. Switch it to "Optional" in System Preferences and every member may enrol; nobody is forced * Secrets are encrypted at rest with a site key; mailed codes are stored hashed and expire after ten minutes Also in this beta * The login flow was split into reusable pieces, and every login path that cannot show a challenge (the upgrade wizard, XML-RPC, the SSL popup) refuses an account that must present its factor * Account deletion removes the member's tokens and factor row, and no longer fails half-way * A MySQL integration job now runs the concurrency and installed-site tests on PHP 8.2 through 8.5 on every change Upgrading from 2.7.3 Copy the new htdocs/ files over the web root and run the upgrade wizard; it creates the user_2fa table and the new preference. Two-factor needs the PHP sodium extension, which the wizard checks for. No mainfile.php changes are needed. Operations notes: docs/2fa-operations.md in the package. System requirements * PHP >= 8.2.0 (PHP 8.4 or 8.5 recommended, prepared for 8.6) * MySQL >= 5.7.8 or MariaDB >= 10.5 (a supported MySQL 8.x or MariaDB LTS recommended) * Apache 2.4+ or nginx MORE INFO: Read our News Release DOWNLOAD: You can download the release from here: https://github.com/XOOPS/XoopsCore27/releases Thank you to everyone testing the betas. Report issues at https://github.com/XOOPS/XoopsCore27/issues XOOPS 2.7.4-Beta1 (ready for PHP 8.6) [by Mamba] Thu, 10 Sep 2026 05:11:37 +0000 Xoops Development::XOOPS 2.7.4-Beta1 (ready for PHP 8.6) 800) this.width=800" /> XOOPS 2.7.4 Beta 1 — session and comment hardening The XOOPS Development Team announces XOOPS 2.7.4 Beta 1, a security-focused update to the 2.7 line. It closes seven authorisation and session gaps found in a review of the 2.7.3 core, updates the bundled TinyMCE 7 to a release with content-sanitisation fixes, and repairs an upgrade-wizard fault that could stall a site on an old patch. XOOPS 2.7.4 runs on PHP 8.2 through 8.5. Ready for PHP 8.6 * Complete session save-handler contract: create_sid() ahead of its PHP 9.0 requirement, new sessions survive 8.6's updateTimestamp() routing, session.use_strict_mode pinned to the 8.6 default today * Deprecations cleared ahead of time: constructor value-returns (guarded by a repository-wide test), is_long(), curl_close(), imagedestroy() System requirements * PHP >= 8.2.0 (PHP 8.4 or 8.5 recommended, prepared for 8.6) * MySQL >= 5.7.8 or MariaDB >= 10.5 (a supported MySQL 8.x or MariaDB LTS recommended) * Apache 2.4+ or nginx MORE INFO: Read our News Release DOWNLOAD: You can download the release from here: https://github.com/XOOPS/XoopsCore27/releases

XOOPS Web Application System :: Forum

XOOPS 2.7.4 Final Released (ready for PHP 8.6) [by Mamba]

XOOPS 2.5.11.2 - maintenance update for XOOPS 2.5.11 [by Mamba]

XOOPS 2.6.0 Alpha 2 released [by Mamba]

XOOPS 2.5.11.1 - security update for XOOPS 2.5.11 [by Mamba]

XOOPS 2.7.4-RC2 Released [by Mamba]

Re: XOOPS 2.7.4-RC1 Released [by Mamba]

Re: XOOPS Plugin for PhpStorm 1.0 Alpha 3 Released [by Mamba]

4. Inspections + Alt+Enter

4.1 Deprecated database API — XoopsDeprecatedDbApi

ModuleTools 1.5 for XOOPS 2.8.0 [by Mamba]

XOOPS 2.7.4-Beta2 with 2FA Released for Testing [by Mamba]

XOOPS 2.7.4-Beta1 (ready for PHP 8.6) [by Mamba]

4.1 Deprecated database API — `XoopsDeprecatedDbApi`