XOOPS 2.7.4 Beta 1 — session and comment hardening

The XOOPS Development Team announces XOOPS 2.7.4 Beta 1, a security-focused update to the 2.7 line. It closes seven authorisation and session gaps found in a review of the 2.7.3 core, updates the bundled TinyMCE 7 to a release with content-sanitisation fixes, and repairs an upgrade-wizard fault that could stall a site on an old patch. XOOPS 2.7.4 runs on PHP 8.2 through 8.5.

Ready for PHP 8.6

* Complete session save-handler contract: create_sid() ahead of its PHP 9.0 requirement, new sessions survive 8.6's updateTimestamp() routing, session.use_strict_mode pinned to the 8.6 default today
* Deprecations cleared ahead of time: constructor value-returns (guarded by a repository-wide test), is_long(), curl_close(), imagedestroy()


System requirements

* PHP >= 8.2.0 (PHP 8.4 or 8.5 recommended, prepared for 8.6)
* MySQL >= 5.7.8 or MariaDB >= 10.5 (a supported MySQL 8.x or MariaDB LTS recommended)
* Apache 2.4+ or nginx

MORE INFO: Read our News Release

DOWNLOAD: You can download the release from here: https://github.com/XOOPS/XoopsCore27/releases