The XOOPS DebugBar has matured into a comprehensive diagnostics suite that respects both developer efficiency and system security. By naming the "interesting caller," clarifying error-handler ownership, and providing real-user performance metrics, it removes the guesswork from modern web development.

The XOOPS DebugBar module is a comprehensive diagnostics and performance toolkit designed for the XOOPS CMS 2.7+ ecosystem. It functions as a "fail-closed" utility, ensuring that diagnostic output is restricted to authenticated administrators and that optional integrations are capability-detected without breaking the core functionality.

Recent updates, specifically versions 1.4.0 and 1.4.1, have transitioned the module from a simple request inspector into a robust developer toolkit. Key advancements include call-site attribution for SQL queries, a granular performance breakdown (Boot/SQL/App time), and real-user monitoring of Web Vitals. Security has been significantly hardened through server-side stashing of SQL for EXPLAIN actions and rigorous literal redaction. The module aims to provide transparency into the XOOPS runtime, identifying bottlenecks such as N+1 query patterns, uncached blocks, and asset duplication.

XOOPS Plugin for PhpStorm Released

Highlights

* Inspections + Alt+Enter fixes (guards, isResultSet / fetch*, query vs exec, Request, Smarty, templates)
* Live templates, language-constant completion, project scanner tool window
* Module scaffold (legacy or hybrid PSR-4)
* Dynamic plugin where the IDE allows (often no restart after updates)

Early preview — APIs and inspections may change. Feedback welcome via Issues.

DOWNLOAD: You can download the Zip file from here: https://github.com/XOOPS/phpstorm-plugin/releases

MORE INFO: https://xoops.org/modules/publisher/item.php?itemid=6129

XOOPS 2.7.3 RC-1 is here — and it brings a new editor.

The first release candidate for XOOPS 2.7.3 is out. Thirty-six changes since Beta 1, and three of them you will notice the day you install it.

A new editor, and one that finally looks the same everywhere
SCEditor joins the editor dropdown as a lightweight BBCode option. It ships bundled, so there is nothing extra to download.

It stays in source mode on purpose, and that is a feature rather than a limitation: a WYSIWYG round-trip is exactly how [siteurl], [d], named [size=] values and custom smilie codes quietly get rewritten or dropped. SCEditor inserts at the caret and leaves the rest of your post alone.

While we were in there, we fixed something long-standing: the same editor now shows the same toolbar everywhere. Until now the control panel and the front end disagreed, and front-end themes disagreed with each other. The cause was five separate hand-written copies of the same markup. There is now one, and every renderer uses it.

Requirements: PHP 8.2+.

More info: https://xoops.org/modules/publisher/item.php?itemid=6128

Download

XOOPS 2.7.3 RC-1: https://github.com/XOOPS/XoopsCore27/releases/

The Diagnostics page now tells you the truth about your error screen..

The error-screen row used to answer "is Tracy installed?" — so a site running xWhoops was told "Not installed" while Whoops was holding the handlers. It now reads what XOOPS 2.7.3 publishes: who owns the screen, where that ownership came from, and whether anything needs looking at. Two modules fighting over it, or one claiming it and quietly failing, is now visible instead of silent.

Also fixes a false "handler drift" warning that appeared on every healthy install, and a toolbar toggle that could erase your recorded error-screen owner.

Requirements: XOOPS 2.7.0+ and PHP 8.2+. First beta; feedback welcome.

Download

Debugbar: https://github.com/XoopsModules27x/debugbar/releases/

Whoops error pages, now only when your site says so.

xWhoops takes PHP's handlers only when XOOPS 2.7.3 has declared it the error-screen owner — not whenever it happens to load. It claims the screen at install, releases it at uninstall, and reports what it did in every branch, including the ones where it declines.

Fixes a long-standing annoyance: Whoops was quietly taking PHP's error handler too, so one harmless notice during boot could replace the page you asked for. It now takes only the exception and shutdown handlers, exactly as the documentation always claimed.

Shows only to an authenticated administrator with the use_xwhoops permission. For development, not production.

Prefer Tracy? xTracy does the same job.

Requirements: XOOPS 2.7.0+ and PHP 8.2+. First beta; feedback welcome.

Download

xWhoops: https://github.com/XoopsModules27x/xwhoops/releases/

A Tracy error screen for XOOPS — new module.


xTracy renders uncaught errors through Tracy for developers who prefer it to Whoops. It is a full provider for the XOOPS 2.7.3 error-screen seam: it answers only when the site has named it the owner, refuses for anyone who is not a developer, and reports its outcome to core whether or not it registers.

It exists alongside xWhoops on purpose. Two independent implementations keep the seam an honest contract rather than one module's implementation detail — and they give you a real choice.

Requirements: XOOPS 2.7.0+ and PHP 8.2+. First beta; feedback welcome.

Download

xTracy: https://github.com/XoopsModules27x/xtracy/releases/

Good progress on adding Language Selection to Admin and making it fully LTR and RTL (e.g. Arabic, Farsi, Hebrew, Urdu)

Coming soon... 😀

XOOPS ModuleInstaller 1.7.0 Alpha 1 Speeds Multi-Module Testing and Development

ModuleInstaller 1.7.0 Alpha 1 is now available for XOOPS 2.7, delivering safer module operations, structured reporting, and a more polished multilingual admin experience..

New Features

- Secure, escape-once rendering of module installation logs
- Structured reports for HTML, plain text, CLI, logging, and JSON
- New ModuleOperationResult API with full backward compatibility
- 30 new translatable admin strings with reliable English fallbacks
- Improved RTL display for counters, versions, statuses, and summaries
- Safer module-logo and manifest handling
- Better accessibility and long-report navigation
- Test suite expanded from 18 to 124 tests

More info: https://xoops.org/modules/publisher/item.php?itemid=6126

Requirements: XOOPS 2.7.0+, PHP 8.2+, mtools 1.2.0+ (installed; need not be active).

Download

ModuleInstaller: https://github.com/XoopsModules27x/moduleinstaller/releases/

mTools: https://github.com/XoopsModules27x/mtools/releases

A full walkthrough is in the module’s docs/TUTORIAL.md

XOOPS DebugBar 1.4.0 Is Here: Smarter Diagnostics, Safer Debugging, Faster Development

XOOPS DebugBar 1.4.0 delivers administrator-only diagnostics, performance analytics, query and N+1 detection, protected logs, system checks, and optional profiling integrations for XOOPS 2.7.1+ The release strengthens security with bounded sanitization, CSRF protection, signed read-only EXPLAIN requests, and safer diagnostic rendering, while adding numerous usability and reliability improvements. Existing installations should run the XOOPS module update after upgrading.

DebugBar 1.4.0 turns the module from a request inspector into a diagnostics toolkit: it now tells you not just what happened, but where in your code it happened.

Highlights

* Call-site attribution. N+1 and duplicate-query detection could report that sixty-two identical statements ran, but not what ran them. Findings now name the file and line — on the first real page it saw, a genuine N+1 in Publisher: sixty-two executions from ItemHandler.php:255.

* Where the time actually went. A Boot / SQL / App split names whichever segment dominated the request, so you know whether query tuning would help before you start. The Server-Timing header reports the same breakdown.

* Real-user web vitals. LCP, INP and CLS collected from actual visitors and attached to the matching profile, with per-URL averages on the Analytics page.

* Xdebug profiling from the toolbar. Arm a one-shot profile with a button, then read the cachegrind output in the admin — top functions by inclusive and self cost, no external viewer needed.

* Block cache visibility. A front page rendering nineteen uncached blocks pays nineteen block renders on every view. Cached and uncached counts are now stored per request and averaged per module.

* Three features that had shipped without working now do:

a) the collect_events preference (every dispatch is observable, including events nothing listens to),
b) SQL syntax highlighting in the Queries panel, and
c) the per-profile Delete button in the Xdebug viewer.


DOWNLOAD: https://github.com/XoopsModules27x/debugbar/releases/

TUTORIAL: https://github.com/XoopsModules27x/debugbar/blob/main/docs/using-debugbar.md