XOOPS 2.7.4 Beta 2 — Two-Factor Authentication (2FA) comes to the Core

The XOOPS Development Team is pleased to announce XOOPS 2.7.4 Beta 2. The headline feature is two-factor authentication (2FA) built into the core: every member can protect their account with a second step at login, using an authenticator app or a code sent by e-mail. This is a beta for testing; please try it on a staging copy of your site and report what you find.

Two-factor authentication

* Two methods: a time-based authenticator app (Google Authenticator, Microsoft Authenticator, Aegis, FreeOTP, or any password manager that generates TOTP codes), or a six-digit code mailed to the member's address
* Ten one-time recovery codes at enrolment, for the day the phone or the mailbox is out of reach
* Five wrong codes lock the second step for fifteen minutes; the member is notified by e-mail
* Remember-me cookies are bound to the enrolled factor, so a reset invalidates them
* Members manage everything themselves from Edit Account, including disabling and replacing recovery codes
* Administrators reset a member's factor from Users, and an operator locked out of the site has a documented escape hatch
* Off by default. Switch it to "Optional" in System Preferences and every member may enrol; nobody is forced
* Secrets are encrypted at rest with a site key; mailed codes are stored hashed and expire after ten minutes

Also in this beta

* The login flow was split into reusable pieces, and every login path that cannot show a challenge (the upgrade wizard, XML-RPC, the SSL popup) refuses an account that must present its factor
* Account deletion removes the member's tokens and factor row, and no longer fails half-way
* A MySQL integration job now runs the concurrency and installed-site tests on PHP 8.2 through 8.5 on every change

Upgrading from 2.7.3

Copy the new htdocs/ files over the web root and run the upgrade wizard; it creates the user_2fa table and the new preference. Two-factor needs the PHP sodium extension, which the wizard checks for. No mainfile.php changes are needed. Operations notes: docs/2fa-operations.md in the package.

System requirements

* PHP >= 8.2.0 (PHP 8.4 or 8.5 recommended, prepared for 8.6)
* MySQL >= 5.7.8 or MariaDB >= 10.5 (a supported MySQL 8.x or MariaDB LTS recommended)
* Apache 2.4+ or nginx

MORE INFO: Read our News Release

DOWNLOAD: You can download the release from here: https://github.com/XOOPS/XoopsCore27/releases

Thank you to everyone testing the betas. Report issues at https://github.com/XOOPS/XoopsCore27/issues