XOOPS DebugBar 1.3.0 Is Here: Smarter Diagnostics, Safer Debugging, Faster Development

The XOOPS development experience just took another big step forward. XOOPS DebugBar 1.3.0 is now available for XOOPS 2.7, bringing developers and site administrators a more powerful, polished, and security-conscious way to understand what is happening inside their websites.

Built for PHP 8.2 and newer, XOOPS DebugBar adds an administrator-only diagnostics toolbar to rendered pages and pairs it with protected administration screens for performance analytics, logs, system diagnostics, and Xdebug profiles. The result is a practical command center that helps developers spot slow requests, repeated queries, configuration issues, and application errors without losing sight of security or usability.

Turn performance data into action

DebugBar 1.3.0 makes it easier to move from “this page feels slow” to a useful diagnosis. Its Analytics area brings together stored request profiles, slow URLs, repeated-query and N+1 candidates, per-module comparisons, performance-budget violations, flight-recorder snapshots, OPcache health, and available Xdebug profiles.

Teams can define budgets for slow requests, queries, resource use, and XOOPS bootstrap time, then use the collected evidence to focus optimization work where it matters most. Query logging modes and slow-query highlighting keep database investigations targeted, while the signed, read-only EXPLAIN workflow helps administrators inspect supported SELECT queries safely.

A clearer view of the whole XOOPS request

The browser toolbar puts essential request information close at hand, including database queries, timers, blocks, errors, Smarty data, and included files. A new practical guide helps developers and webmasters get productive quickly, while extension documentation explains how module authors can add their own instrumentation and collectors.

Optional integrations expand the toolkit without turning them into requirements. Monolog can provide structured file logging, Ray can receive forwarded diagnostics when available, Xdebug can create one-shot profiles, and OPcache statistics can reveal server health. xWhoops and Tracy remain capability-detected and optional, so their absence will not prevent DebugBar from loading.

Improved Security

Powerful diagnostics must be handled carefully, and security is a central theme of the 1.3.0 release. Toolbar output is restricted to authenticated administrators, administrative changes use XOOPS CSRF protection, and diagnostic values pass through bounded sanitization and redaction.

The release also introduces a dedicated protected signing key for EXPLAIN requests, stricter validation that accepts only a single read-only SELECT statement, safer rendering for dumped values and email previews, and allowlisted access to logs, profiles, and flight-recorder files. If an optional capability or required security resource is unavailable, DebugBar is designed to fail safely.

More dependable, more polished

Version 1.3.0 includes a wide range of fixes and refinements across AJAX behavior, editor links, mail previews, Server-Timing headers, dark-mode syntax highlighting, profile-table detection, Monolog storage fallback, and browser widgets. It also improves the accuracy of bootstrap measurements and repeated-query thresholds, while keeping collection-heavy features disabled or bounded by sensible defaults.

The module supports XOOPS 2.7.0 or newer and PHP 8.2 or newer, with compatibility coverage through PHP 8.5. Existing users should run the XOOPS module update after installing version 1.3.0 so the new preferences, protected EXPLAIN key, and refreshed browser assets are applied.

Whether you are building a module, tracking down an elusive error, or tuning a busy XOOPS site, DebugBar 1.3.0 gives you better evidence, faster answers, and greater confidence. Install or update the module, enable XOOPS Debug and the DebugBar toolbar for an administrator account, and start exploring what your site has been trying to tell you.

Thanks for testing and for the feedback!

Coming soon: fully rewritten PEDIGREE

This module will require mTools: https://github.com/mambax7/mtools to be installed

Download: https://github.com/mambax7/cocktails/

This module requires mTools: https://github.com/mambax7/mtools to be installed

Download: https://github.com/mambax7/quotes/

This module requires mTools: https://github.com/mambax7/mtools to be installed

https://github.com/mambax7/mtools/

This module will be utilized in many new modules for XOOPS 2.7.x, as it will include many common functionalities, thus promoting code reuse .

It was inspired by TadTools

XOOPS 2.7.1-RC1 Released for Testing

First release candidate for XOOPS 2.7.1. The 2.7.1 line is now feature-complete; from here only blocker fixes are expected before the final release. Please test upgrades and report anything unexpected.

DOWNLOAD: https://github.com/XOOPS/XoopsCore27/releases

What's Changed

Security hardening

• Tightened SQL identifier and ORDER BY handling across Criteria, kernel/block, and the system admin pages.
• Required a security token on the upgrade apply-patch path; SQL dumps now live outside the web root and the download is gated.
• Protector now inspects queryF() in its database-layer wrapper; the ModuleAdmin index menu output is escaped; module language files are loaded by basename only.
• Added CAPTCHA and a persistent per-IP rate limit to the tell-a-friend form.
• The upgrade wizard login now requires administrator-group membership.

Dependency refresh

• xoops/xmf updated to v1.3.1-RC1 (write paths migrated from queryF() to exec()).
• Bundled xoops/helpers ^1.0, xoops/smartyextensions ^1.3 (adds QR support), tecnickcom/tcpdf ^6.10.
• composer update sweep: php-debugbar 3.8.0, Smarty 4.5.7, symfony/var-dumper and symfony/yaml 7.4.14, webmozart/assert 2.4.1.


What's Changed in 2.7.1 Beta

• fix: preserve TinyMCE 7 language locale casing by @masskrdjn in #72
• docs(changelog): regenerate CHANGELOG.md by @github-actions[bot] in #70
• chore(sonar): scope S115/S3011 out of test sources by @mambax7 in #74
• test(editor): isolate the TinyMCE7 language test by @mambax7 in #75
• fix(system): hydrate module fields when cloning a block (#73) by @mambax7 in #77
• fix(editor): map XOOPS locale to TinyMCE 7 pack code (#76) by @mambax7 in #78
• chore(deps): bump SonarSource/sonarqube-scan-action from 8.0.0 to 8.1.0 by @dependabot[bot] in #79
• chore(deps): bump codecov/codecov-action from 6.0.0 to 6.0.1 by @dependabot[bot] in #80
• improve(core): consolidate theme-config normalisation across runtime readers by @mambax7 in #81
• 2.7.1 updates by @mambax7 in #82
• chore(deps): bump postcss from 8.5.8 to 8.5.15 in /htdocs/themes/xtailwind2 by @dependabot[bot] in #83
• fix(theme/default): keep inline rich text baseline aligned by @mambax7 in #84
• chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @dependabot[bot] in #85
• chore(deps): bump postcss from 8.5.8 to 8.5.15 in /htdocs/themes/xtailwind by @dependabot[bot] in #86
• feat(form): add XoopsFormTabTray tabbed widget + themed renderers by @mambax7 in #87
• refactor(form): introduce XoopsFormContainerInterface for container contract by @mambax7 in #90
• refactor(form): adopt XoopsFormContainerInterface in XoopsForm + foreach-by-ref container iteration by @mambax7 in #91
• Security/hardening pass by @mambax7 in #92
• chore(deps): bump codecov/codecov-action from 6.0.1 to 7.0.0 by @dependabot[bot] in #93
• chore(deps): bump SonarSource/sonarqube-scan-action from 8.1.0 to 8.2.0 by @dependabot[bot] in #94
• chore(deps): bump shivammathur/setup-php from 2.37.1 to 2.37.2 by @dependabot[bot] in #95
• Upgrade tool: Smarty 4→5 readiness gate, 2.7.0→2.7.1 step, and hardening by @mambax7 in #96
• add SmartyExtensions by @mambax7 in #97
• ci(codecov): make patch coverage informational by @mambax7 in #99
• Fix/profile search active filter by @mambax7 in #98
• dark-mode for xbootstrap5/xswatch5/xtailwind2 + register smartyextensions by @mambax7 in #100
• Chore/security tooling by @mambax7 in #101
• chore(phpstan): mark gitignored vendor excludePaths as optional by @mambax7 in #103
• chore(coderabbit): align test review instruction with PHPUnit ^11.2 by @mambax7 in #104
• Security: medium-tier hardening pass (pass 2) by @mambax7 in #102
• Security: medium/low defence-in-depth hardening (pass 3) by @mambax7 in #105

New Contributors

• @masskrdjn made their first contribution in #72

Thank you!!!!

New translations have been added to XOOP_ 2.7.0 Documentation (https://xoops.github.io/xoops-docs/):

• Chinese Simplified
• Croatian
• Czech
• Danish
• Dutch
• Greek
• Hebrew
• Hindi
• Hungarian
• Indonesian
• Japanese
• Malaysian
• Persian
• Slovenian
• Thai
• Turkish
• Ukrainian
• Vietnamese

Previous languages:

• English
• Arabic
• Chinese Traditional
• French
• German
• Italian
• Polish
• Portuguese
• Russian
• Spanish

We need help from native speakers to help us with reviewing and fixing any translation errors.

We started developing new XOOPS 2.7.0 documentation:

https://xoops.github.io/xoops-docs/

Currently following languages are available:

• English,
• Arabic,
• French,
• German,
• Italian,
• Polish,
• Portuguese,
• Russian,
• Spanish, and
• Traditional Chinese

I'm sure that there are tons of translation errors, so please help us in fixing them!

You can help us by:

a) fixing the translations,
b) adding new languages
c) improving the flow of the documentation

You can fork the documentation from here:

https://github.com/XOOPS/xoops-docs