XOOPS 2.7.4 Beta 2 — Two-Factor Authentication (2FA) comes to the Core

The XOOPS Development Team is pleased to announce XOOPS 2.7.4 Beta 2. The headline feature is two-factor authentication (2FA) built into the core: every member can protect their account with a second step at login, using an authenticator app or a code sent by e-mail. This is a beta for testing; please try it on a staging copy of your site and report what you find.

Two-factor authentication

* Two methods: a time-based authenticator app (Google Authenticator, Microsoft Authenticator, Aegis, FreeOTP, or any password manager that generates TOTP codes), or a six-digit code mailed to the member's address
* Ten one-time recovery codes at enrolment, for the day the phone or the mailbox is out of reach
* Five wrong codes lock the second step for fifteen minutes; the member is notified by e-mail
* Remember-me cookies are bound to the enrolled factor, so a reset invalidates them
* Members manage everything themselves from Edit Account, including disabling and replacing recovery codes
* Administrators reset a member's factor from Users, and an operator locked out of the site has a documented escape hatch
* Off by default. Switch it to "Optional" in System Preferences and every member may enrol; nobody is forced
* Secrets are encrypted at rest with a site key; mailed codes are stored hashed and expire after ten minutes

Also in this beta

* The login flow was split into reusable pieces, and every login path that cannot show a challenge (the upgrade wizard, XML-RPC, the SSL popup) refuses an account that must present its factor
* Account deletion removes the member's tokens and factor row, and no longer fails half-way
* A MySQL integration job now runs the concurrency and installed-site tests on PHP 8.2 through 8.5 on every change

Upgrading from 2.7.3

Copy the new htdocs/ files over the web root and run the upgrade wizard; it creates the user_2fa table and the new preference. Two-factor needs the PHP sodium extension, which the wizard checks for. No mainfile.php changes are needed. Operations notes: docs/2fa-operations.md in the package.

System requirements

* PHP >= 8.2.0 (PHP 8.4 or 8.5 recommended, prepared for 8.6)
* MySQL >= 5.7.8 or MariaDB >= 10.5 (a supported MySQL 8.x or MariaDB LTS recommended)
* Apache 2.4+ or nginx

MORE INFO: Read our News Release

DOWNLOAD: You can download the release from here: https://github.com/XOOPS/XoopsCore27/releases

Thank you to everyone testing the betas. Report issues at https://github.com/XOOPS/XoopsCore27/issues

XOOPS 2.7.4 Beta 1 — session and comment hardening

The XOOPS Development Team announces XOOPS 2.7.4 Beta 1, a security-focused update to the 2.7 line. It closes seven authorisation and session gaps found in a review of the 2.7.3 core, updates the bundled TinyMCE 7 to a release with content-sanitisation fixes, and repairs an upgrade-wizard fault that could stall a site on an old patch. XOOPS 2.7.4 runs on PHP 8.2 through 8.5.

Ready for PHP 8.6

* Complete session save-handler contract: create_sid() ahead of its PHP 9.0 requirement, new sessions survive 8.6's updateTimestamp() routing, session.use_strict_mode pinned to the 8.6 default today
* Deprecations cleared ahead of time: constructor value-returns (guarded by a repository-wide test), is_long(), curl_close(), imagedestroy()


System requirements

* PHP >= 8.2.0 (PHP 8.4 or 8.5 recommended, prepared for 8.6)
* MySQL >= 5.7.8 or MariaDB >= 10.5 (a supported MySQL 8.x or MariaDB LTS recommended)
* Apache 2.4+ or nginx

MORE INFO: Read our News Release

DOWNLOAD: You can download the release from here: https://github.com/XOOPS/XoopsCore27/releases

That's excellent!

I'm happy that it's useful for you!

If you find any bugs, you can report them on GitHub, and please post it here with the link to GitHub as well.
Of course, if you have fixes for any bugs, please submit them as well.

hi, thank you for shasring this tool
started to test it, look great, found already parts of my code where I should invest ;)

XOOPS 2.7.3 Final Released: PHP 8.6 readiness

The XOOPS Development Team is pleased to announce XOOPS 2.7.3 Final. This release hardens security across the core, prepares XOOPS for PHP 8.6 while remaining fully supported on PHP 8.2 through 8.5, adds SCEditor as an optional BBCode editor, introduces file-based debug configuration with a rotating file logger, and folds in a series of reliability fixes proven in production on xoops.org.

Ready for PHP 8.6
* Complete session save-handler contract: create_sid() ahead of its PHP 9.0 requirement, new sessions survive 8.6's updateTimestamp() routing, session.use_strict_mode pinned to the 8.6 default today
* Deprecations cleared ahead of time: constructor value-returns (guarded by a repository-wide test), is_long(), curl_close(), imagedestroy()

MORE INFO: Read our News Release

DOWNLOAD: You can download the release from here: https://github.com/XOOPS/XoopsCore27/releases

The XOOPS DebugBar has matured into a comprehensive diagnostics suite that respects both developer efficiency and system security. By naming the "interesting caller," clarifying error-handler ownership, and providing real-user performance metrics, it removes the guesswork from modern web development.

The XOOPS DebugBar module is a comprehensive diagnostics and performance toolkit designed for the XOOPS CMS 2.7+ ecosystem. It functions as a "fail-closed" utility, ensuring that diagnostic output is restricted to authenticated administrators and that optional integrations are capability-detected without breaking the core functionality.

Recent updates, specifically versions 1.4.0 and 1.4.1, have transitioned the module from a simple request inspector into a robust developer toolkit. Key advancements include call-site attribution for SQL queries, a granular performance breakdown (Boot/SQL/App time), and real-user monitoring of Web Vitals. Security has been significantly hardened through server-side stashing of SQL for EXPLAIN actions and rigorous literal redaction. The module aims to provide transparency into the XOOPS runtime, identifying bottlenecks such as N+1 query patterns, uncached blocks, and asset duplication.

XOOPS Plugin for PhpStorm Released

Highlights

* Inspections + Alt+Enter fixes (guards, isResultSet / fetch*, query vs exec, Request, Smarty, templates)
* Live templates, language-constant completion, project scanner tool window
* Module scaffold (legacy or hybrid PSR-4)
* Dynamic plugin where the IDE allows (often no restart after updates)

Early preview — APIs and inspections may change. Feedback welcome via Issues.

DOWNLOAD: You can download the Zip file from here: https://github.com/XOOPS/phpstorm-plugin/releases

MORE INFO: https://xoops.org/modules/publisher/item.php?itemid=6129

XOOPS 2.7.3 RC-1 is here — and it brings a new editor.

The first release candidate for XOOPS 2.7.3 is out. Thirty-six changes since Beta 1, and three of them you will notice the day you install it.

A new editor, and one that finally looks the same everywhere
SCEditor joins the editor dropdown as a lightweight BBCode option. It ships bundled, so there is nothing extra to download.

It stays in source mode on purpose, and that is a feature rather than a limitation: a WYSIWYG round-trip is exactly how [siteurl], [d], named [size=] values and custom smilie codes quietly get rewritten or dropped. SCEditor inserts at the caret and leaves the rest of your post alone.

While we were in there, we fixed something long-standing: the same editor now shows the same toolbar everywhere. Until now the control panel and the front end disagreed, and front-end themes disagreed with each other. The cause was five separate hand-written copies of the same markup. There is now one, and every renderer uses it.

Requirements: PHP 8.2+.

More info: https://xoops.org/modules/publisher/item.php?itemid=6128

Download

XOOPS 2.7.3 RC-1: https://github.com/XOOPS/XoopsCore27/releases/

The Diagnostics page now tells you the truth about your error screen..

The error-screen row used to answer "is Tracy installed?" — so a site running xWhoops was told "Not installed" while Whoops was holding the handlers. It now reads what XOOPS 2.7.3 publishes: who owns the screen, where that ownership came from, and whether anything needs looking at. Two modules fighting over it, or one claiming it and quietly failing, is now visible instead of silent.

Also fixes a false "handler drift" warning that appeared on every healthy install, and a toolbar toggle that could erase your recorded error-screen owner.

Requirements: XOOPS 2.7.0+ and PHP 8.2+. First beta; feedback welcome.

Download

Debugbar: https://github.com/XoopsModules27x/debugbar/releases/