XOOPS Web Application System

XOOPS 2.7.4-RC1 Released

Sat, 26 Sep 2026 04:50:00 +0000

XOOPS 2.7.4 RC 1 — two-factor authentication and a new editor experience

The XOOPS Development Team is pleased to announce XOOPS 2.7.4 RC 1, the release candidate for XOOPS 2.7.4. This release brings two-factor authentication into the core, makes SCEditor a full visual editor and the default for new sites, adds Markdown support through EasyMDE, and continues the security hardening of the 2.7 line.

The feature set is final. Please test this release candidate on a staging copy of your site and report anything you find before the final release.

DOWNLOAD: https://github.com/XOOPS/XoopsCore27/releases

Two-factor authentication

* Two methods: a time-based authenticator app (Google Authenticator, Microsoft Authenticator, Aegis, FreeOTP, or any password manager that generates TOTP codes), or a six-digit code mailed to the member's address
* Recovery codes: ten one-time codes at enrolment, for the day the phone or the mailbox is out of reach
* Lockout: five wrong codes lock the second step for fifteen minutes, and the member is notified by e-mail
* Self-service: members enrol, disable and replace their recovery codes from Edit Account; administrators can reset a member's factor from Users, and an operator locked out of the site has a documented recovery procedure
* Off by default: switch it to "Optional" in System Preferences and every member may enrol; nobody is forced
* Protected at rest: authenticator secrets are encrypted with a site key; mailed codes are stored hashed and expire after ten minutes

Editors

* SCEditor edits visually with its full toolbar and keeps XOOPS BBCode intact across visual and source modes. Its emoticons are registered as XOOPS smileys, and new installs use it as the default editor
* System > Preferences > Editors configures SCEditor's toolbar buttons, plugins, emoticons, resizing, auto-expand, spellcheck, size and the image category for dropped images
* Markdown through EasyMDE: Markdown is stored in the existing text columns and rendered with Parsedown in safe mode; the editor preview uses the same renderer
* More BBCode: MyTextSanitizer renders the tags SCEditor writes: sub, sup, s (strikethrough), justify, hr, ol and table
* TinyMCE 7.9.3: the bundled TinyMCE 7 is updated to the current 7.x release, which carries three content-sanitisation fixes

Security hardening

* Remember-me tokens are revoked when the password changes, including a lost-password reset
* A restored session ends for a deactivated account, and group membership is read from the database on every request, so a removed group right takes effect immediately
* Registration validates the account again at the save step, not only at the first step
* Comment editing and deletion check that the comment belongs to the module handling the request
* The TinyMCE image manager checks category permissions for upload, delete and listing, as the core image manager does
* The upgrade wizard admits webmasters only
* The LDAP and Active Directory adapters stop when a requested StartTLS connection fails, instead of continuing without it
* Editor output is tightened: BBCode attributes and rendered Markdown are restored only where they belong, and SCEditor's visual view checks link schemes

Fixes
* The upgrade wizard reports a patch task that cannot complete, instead of re-queuing it silently, and no longer re-queues the 2.5.10-to-2.5.11 patch on every run
* The Modern admin theme shows its redirect notifications again, in light, dark and right-to-left layouts
* The Administration Menu link in the user block is shown only to administrators
* Several legacy classes load again on PHP 8: the tar and zip downloaders, the XML-RPC parser, and XoopsTpl::fetchFromData()
* An unknown user ID in the users admin shows a message instead of an error page, and logout works on sites with remember-me turned off

Changed since Beta 2:

* the editor work (SCEditor, the Editors preferences, Markdown),
* the upgrade wizard fix,
* the Modern theme notifications,
* the user-block fix,
* the PHP 8 legacy-class fixes,
* translatable upgrade-wizard messages are new in RC 1.
* the System module moves to 2.1.13; the upgrade wizard applies it.

Upgrading from 2.7.3

Copy the new files over the web root and run the upgrade wizard. It creates the user_2fa table and the two-factor preference, registers the SCEditor emoticons as smileys, and adds the Editors preferences. No mainfile.php changes are needed.
* Two-factor authentication needs the PHP sodium extension; the wizard reports whether it is available. Operations notes are in docs/2fa-operations.md
* Every remembered device logs in once more after the upgrade
* An upgraded site keeps its current editor settings; SCEditor becomes the default only on a fresh install. For SCEditor's MP3 button, set 'mp3' => 1 in xoops_data/configs/textsanitizer/config.php
* If you copied extras/login.php (the SSL popup login) elsewhere on your site, replace or remove that copy: updating the core does not patch it
* A site running a custom template set should re-import it

From a 2.7.4 beta: copy the new files and run the upgrade wizard again; it applies the RC 1 changes and updates the System module.

System requirements

PHP 8.2 to 8.5, MySQL 5.7+ or MariaDB 10.3+, and the PHP sodium extension for two-factor authentication.

Translations

XOOPS is available in 37 community translations at https://github.com/XoopsLanguages. XOOPS 2.7.4 adds English strings for two-factor authentication, the Editors preferences, SCEditor and the upgrade wizard; docs/lang_diff.txt lists every new constant. Translators, thank you: updated packs are very welcome before the final release.

Reporting issues

Please report bugs at https://github.com/XOOPS/XoopsCore27/issues with your PHP and MySQL versions and the steps to reproduce. Questions are welcome in the support forums.

Thank you to everyone who tested the betas, reported issues, submitted pull requests, translated strings and reviewed security findings during the 2.7.4 cycle. And a standing thank-you to JetBrains for the complimentary PhpStorm licenses that power the core team's development.

The XOOPS Development Team

ModuleTools 1.5 for XOOPS 2.8.0

Tue, 22 Sep 2026 05:30:00 +0000

ModuleTools: the shared toolbox every XOOPS 2.8.0 module now gets for free

If you have ever built a XOOPS module, you know the ritual. Copy a class/Common/ folder from the last module. Paste in the install helpers, the version checks, the admin table code, the confirmation dialog, the breadcrumb builder. Fix the namespace. Hope nothing drifted since the last copy.

With XOOPS 2.8, that ritual is over. ModuleTools ships inside XOOPS 2.8.0 Core as Xoops\ModuleTools\*, autoloaded on every request. There is nothing to install, nothing to activate, and no helper module to keep in sync. Your module just calls it.

What is in the box

ModuleTools is the successor to the mTools helper module, rebuilt as a proper library. It gathers the services modules used to carry as copied files:

* Install and update hooks. Directory checks, file checks, dependency and version guards, sample-data buttons, and an update checker that reads your GitHub releases.
* Admin pages in minutes. Object tables, tree tables, single-record views, CSV export, and a controller that handles create, edit, delete and uploads from one form definition.
* Objects and forms. A dynamic object base with SEO fields and a form builder that turns your handler's metadata into a ready XoopsThemeForm.
* Front-end helpers. Breadcrumbs, letter navigation, pagination, text truncation with intact HTML, social bookmarks, syntax highlighting, image resizing.
* Permissions. Per-item group permissions with a clean gateway, so your module never writes to the permission table by hand.
* Module lifecycle. A ModuleContext value object for paths, URLs and constants, a namespace autoloader that also understands legacy filenames, and a cloner that turns one module into the starting point for the next.

Why it matters

Less code to own. A typical converted module drops dozens of copied files. Fewer files means fewer places for a bug to hide and fewer places to patch when one is found.

Security fixes land once. When the confirmation dialog or the CSV export is hardened, every module on the site gets the fix on the next Core update. No module release required.

Modern PHP, tested. The library targets PHP 8.4, passes PHPStan at level 6, and ships a growing PHPUnit suite that includes consumer tests run against real modules inside a XOOPS tree.

No migration cliff. Existing modules keep working. ModuleTools registers lazy aliases for the stable XoopsModules\Mtools\* names, so a module written for the mTools module runs on 2.8 unchanged. When you are ready, the migration guide walks through swapping copied classes for library calls, and a Rector rule set does most of the typing.

Still there for 2.7. Sites on XOOPS 2.7.x keep the separately distributed mTools module with the same class names. Write against the API once and it runs on both.

Getting started

On XOOPS 2.8 the library is already loaded. In a module, grab your XMF helper and go:

use XmfModuleHelper;
use XoopsModuleToolsModuleModuleContext;

$helper = Helper::getHelper('mymodule');
$ctx = ModuleContext::fromHelper($helper);
$ctx->uploadPath('images');
For standalone development, composer require xoops/moduletools brings in the same package with its stubs and test suite.

The full walkthrough lives in docs/getting-started.md, and docs/migrating-a-module.md covers converting an existing module. Try it on your next module, or on the one you have been meaning to clean up, and let us know what you build.

PACKAGIST: https://packagist.org/packages/xoops/moduletools

INSTALLATION: composer require xoops/moduletools

XOOPS Plugin for PhpStorm 1.0 Alpha 3 Released

Tue, 22 Sep 2026 05:30:00 +0000

XOOPS Support Plugin for PhpStorm: Alpha 3 is here

PhpStorm finally speaks XOOPS. XOOPS Support 1.0.0 Alpha 3 teaches the IDE the conventions that used to live only in our heads: language constants, xoops_version.php, the <{ }> Smarty delimiters, the isResultSet guard, the direct-access guard. The result is fewer round trips to the browser, fewer "why is this blank" moments, and cleaner modules on the first commit.

DOWNLOAD / INSTALLATION: Install it from the JetBrains Marketplace: plugins.jetbrains.com/plugin/33478

What you get

Ctrl+B on language constants. Put the cursor on _MI_, _AM_, _MD_, _CO_ or _MB_ and jump straight to its define(), with language/english/ preferred. Find Usages works the other way round. Completion now reads every file under language/, not a fixed list, so your own catalogs are covered.

Templates that match the manifest. Two inspections keep xoops_version.php and the templates/ folder in sync. A registered template that is missing on disk is flagged, and so is a .tpl on disk that was never registered. Both come with a one-click fix: create the file, or append the manifest entry.

Ten inspections with Alt+Enter fixes. Missing defined('XOOPS_ROOT_PATH') || exit guard, fetchArray() without isResultSet(), query() used for a write, the deprecated queryF() / quoteString(), XOBJ_DTYPE_UNICODE_* (deprecated since 2.7.3), raw $_GET / $_POST / $_REQUEST, bare {if} instead of <{if}>, and include where include_once belongs. Each one explains why in its description and fixes itself with a keystroke.

A site-wide Overview. The XOOPS Support tool window scans the whole install in the background, lists every module with its template, language, preload and class counts, and turns every finding into a clickable file:line. Cancel works, and it stays idle until you press Refresh.

Core-version aware. Tell the plugin whether the project targets 2.5, 2.7 or 4.0 and the inspections adjust. The UNICODE deprecation, for example, stays quiet on a 2.5 LTS project.

What changed in Alpha 3

This release grew out of real field reports on production modules, and every fix has a test behind it.

* Findings are no longer reported twice per file.
* The isResultSet quick-fix applies cleanly in an Inspect Code batch, and an early-exit guard now covers while (list(...) = $db->fetchRow($result)).
* The direct-access guard understands namespaced files, die as well as exit, short <? tags and multiple declare statements, and inserts after namespace where PHP requires it. Entry points, admin/ scripts and 404 stubs are left alone.
* Block templates in templates/blocks/ registered by bare name, the ['template'] = '…' assignment style, and manifests with URLs in descriptions all parse correctly, so the Overview no longer shows phantom template findings.
* Commented-out define() calls stay out of completion and navigation.
* Your Core Version setting from Alpha 2 carries over.

Try it

* Install the plugin and open your XOOPS webroot in PhpStorm.
* Open View → Tool Windows → XOOPS Support and press Refresh.
* Open any module file and press Alt+Enter on a highlight.

The full walkthrough is in the tutorial that ships with the plugin. Feedback and bug reports are welcome at github.com/XOOPS/phpstorm-plugin.

XOOPS 2.7.4-Beta2 with Two-Factor Authentication (2FA)

Sun, 13 Sep 2026 05:40:00 +0000

XOOPS 2.7.4 Beta 2 — Two-Factor Authentication (2FA) comes to the core

The XOOPS Development Team is pleased to announce XOOPS 2.7.4 Beta 2. The headline feature is two-factor authentication (2FA) built into the core: every member can protect their account with a second step at login, using an authenticator app or a code sent by e-mail. This is a beta for testing; please try it on a staging copy of your site and report what you find.

DOWNLOAD: https://github.com/XOOPS/XoopsCore27/releases

Two-factor authentication

* Two methods: a time-based authenticator app (Google Authenticator, Microsoft Authenticator, Aegis, FreeOTP, or any password manager that generates TOTP codes), or a six-digit code mailed to the member's address
* Ten one-time recovery codes at enrolment, for the day the phone or the mailbox is out of reach
* Five wrong codes lock the second step for fifteen minutes; the member is notified by e-mail
* Remember-me cookies are bound to the enrolled factor, so a reset invalidates them
* Members manage everything themselves from Edit Account, including disabling and replacing recovery codes
* Administrators reset a member's factor from Users, and an operator locked out of the site has a documented escape hatch
* Off by default. Switch it to "Optional" in System Preferences and every member may enrol; nobody is forced
* Secrets are encrypted at rest with a site key; mailed codes are stored hashed and expire after ten minutes

Also in this beta

* The login flow was split into reusable pieces, and every login path that cannot show a challenge (the upgrade wizard, XML-RPC, the SSL popup) refuses an account that must present its factor
* Account deletion removes the member's tokens and factor row, and no longer fails half-way
* A MySQL integration job now runs the concurrency and installed-site tests on PHP 8.2 through 8.5 on every change

Upgrading from 2.7.3

Copy the new htdocs/ files over the web root and run the upgrade wizard; it creates the user_2fa table and the new preference. Two-factor needs the PHP sodium extension, which the wizard checks for. No mainfile.php changes are needed. Operations notes: docs/2fa-operations.md in the package.

System requirements

PHP 8.2 to 8.5, MySQL 5.7+ or MariaDB 10.3+, and the sodium extension for two-factor authentication.

Thank you to everyone testing the betas. Report issues at https://github.com/XOOPS/XoopsCore27/issues

---------------------------------------------------------------------

Using two-factor authentication for the first time

Two-factor authentication (2FA) adds a second step to your login: after your password, you enter a short code that only you can produce. Someone who learns your password still cannot get in. Setting it up takes about two minutes.

Before you start

Decide how you want to receive the second step:
* Authenticator app (recommended): an app on your phone or computer shows a new six-digit code every 30 seconds, even offline. If you have none yet, install one first, for example Google Authenticator, Microsoft Authenticator, Aegis or FreeOTP. Most password managers can do this too.
* E-mail codes: the site mails you a six-digit code each time you sign in. Easiest to start with, but anyone who can read your mailbox can pass this step.

Step 1 — open the setup page

Sign in, open Edit Account and click Two-factor authentication. You can also go straight to user.php?op=2fa_manage.

Step 2 — choose your method

Enter your current password, then click either Set up an authenticator or Use e-mail codes.

Step 3a — authenticator app

1. In your app, add an account: scan the QR code shown on the page, or choose manual entry and type the setup key printed under it.
2. The app now shows a six-digit code. Type the code it shows right now into the field and click Confirm authenticator.

Step 3b — e-mail codes

1. Check your inbox (and the spam folder) for a message from the site with a six-digit code. It is valid for ten minutes; Send me a code requests a fresh one.
2. Type the code into the field and click Confirm e-mail codes.

Step 4 — save your recovery codes

The page now shows ten recovery codes. Save them somewhere safe, separate from this account: a password manager or a printed sheet. Each code works once, and they are shown only this one time. They are your way in if your phone is lost or your mailbox is unreachable.

Signing in from now on

Enter your username and password as usual. On the next page, enter the current code from your app, or the code the site just mailed you. If you cannot produce a code, open Use a recovery code instead and enter one of your saved codes; the site e-mails you when a recovery code is used.

Good to know

* Five wrong codes lock the second step for fifteen minutes. A recovery code still works during the lock.
* "Remember me" is not available for accounts with two-factor authentication.
* To turn it off or to replace your recovery codes, return to the setup page: it asks for your password and a code.
* Lost everything, phone and recovery codes? Ask a site administrator, who can reset your two-factor authentication from the users admin. You will need to set it up again afterwards.

XOOPS 2.7.4-Beta1 (ready for PHP 8.6)

Thu, 10 Sep 2026 04:30:00 +0000

XOOPS 2.7.4 Beta 1 — session and comment hardening

The XOOPS Development Team announces XOOPS 2.7.4 Beta 1, a security-focused update to the 2.7 line. It closes seven authorisation and session gaps found in a review of the 2.7.3 core, updates the bundled TinyMCE 7 to a release with content-sanitisation fixes, and repairs an upgrade-wizard fault that could stall a site on an old patch. XOOPS 2.7.4 runs on PHP 8.2 through 8.5.

DOWNLOAD: You can download the release from here: https://github.com/XOOPS/XoopsCore27/releases

Ready for PHP 8.6

* Complete session save-handler contract: create_sid() ahead of its PHP 9.0 requirement, new sessions survive 8.6's updateTimestamp() routing, session.use_strict_mode pinned to the 8.6 default today
* Deprecations cleared ahead of time: constructor value-returns (guarded by a repository-wide test), is_long(), curl_close(), imagedestroy()

Security hardening

- Remember-me tokens are revoked when the password changes. The token now carries a keyed fingerprint of the stored password hash. A password change through any path, a lost-password reset included, invalidates every earlier token. Sessions restored from the session store are unaffected. (#194)
- Deactivated accounts lose their sessions. A restored session ends when the account is inactive, whether it came from the session store or the remember-me cookie, and group membership is resolved from the database on every request, so a demotion applies on the next request. (#188)
- Registration is validated at the save step. The step number is supplied by the client; the save step now requires that step 1 passed in this session and re-validates the identity values it is about to insert. (#187)
- Comments belong to their module. Editing, saving and deleting a comment now require it to belong to the module whose endpoint received the request, so an administrator of one module cannot act on another module's comments. (#189, #196)
- The TinyMCE image manager checks category permissions. Upload requires write access to the selected category, delete requires write access to the image's own category, and listing requires read access, as the core image manager already required. (#186)
- The upgrade wizard is gated on webmaster membership at every entry point; two of them had accepted a module-level admin right that can be delegated. (#189)
- LDAP and Active Directory fail closed on a failed StartTLS instead of continuing to bind over the plain connection. (#189)

Editors

- TinyMCE 7 is updated from 7.9.2 to 7.9.3, which carries three content sanitisation fixes, one of them in the media plugin that the XOOPS settings enable. The bundled TinyMCE 5 stays at 5.10.9: its corresponding fix is not publicly distributed, so treat TinyMCE 5 as unpatched and prefer TinyMCE 7. (#193)

Fixes

- The upgrade wizard reports a stalled patch task instead of re-queuing it silently on every click, and shows no server paths while doing so. Sites stuck on the 2.5.11 patch with an undeletable index.html now see which files are affected. (#184)
- The users admin no longer fails with an undefined constant on an unknown user id. (#190)
- Logging out, or restoring a deactivated account, no longer fails on sites where remember-me is disabled. (#188, #195, #198)
- A registration flow that finished and then received a further request no longer fails in the step merge. (#187)

Language

- The ten front-end labels of the default system menu move from the admin language file to language/<lang>/menus/menus.php, the file the resolver tries first. Names and values are unchanged, so existing translations and seeded menu rows keep working. (#185)
- One constant is added; see docs/lang_diff.txt. (#190)

Upgrading

- No database changes. The upgrade wizard has nothing to apply for 2.7.3 to 2.7.4; replace the files and clear the cache as usual.
- Remembered logins issued before this release are rejected once: each remembered device signs in again one time and receives a token with the new claim.
- Translation packs need the moved menu labels only if they override them; the English values apply otherwise.

Upgrading from 2.7.2

XOOPS 2.7.3 includes schema changes, so after copying the new htdocs/ files over the web root, run the upgrade wizard. No mainfile.php changes are needed. Full documentation: https://xoops.github.io/xoops-docs/

System requirements

* PHP >= 8.2.0 (PHP 8.4 or 8.5 recommended, prepared for 8.6)
* MySQL >= 5.7.8 or MariaDB >= 10.5 (a supported MySQL 8.x or MariaDB LTS recommended)
* Apache 2.4+ or nginx

Translations

XOOPS 2.7.3 adds new English language constants: the SCEditor editor strings introduced in RC 1 and one logout-confirmation string added in Final — see docs/lang_diff.txt. XOOPS remains maintained in 37 community translations: https://github.com/XoopsLanguages

Thank you

Thank you to everyone who submitted pull requests, reported issues, tested the beta and RC packages, translated strings, and reviewed security findings throughout the 2.7.3 cycle.

A special thank-you to darkglobe-project and nikitakothari06 for testing the release candidates and reporting issues and bugs). Bug reports like these make XOOPS better for everyone.

We also thank JetBrains ( https://www.jetbrains.com/ ) for supporting the project with PhpStorm licenses.

Bug reports: https://github.com/XOOPS/XoopsCore27/issues
Support forums: https://xoops.org/modules/newbb/

The XOOPS Development Team

XOOPS 2.7.3 FINAL (ready for PHP 8.6)

Mon, 24 Aug 2026 13:10:00 +0000

XOOPS 2.7.3 Final Released: PHP 8.6 readiness

The XOOPS Development Team is pleased to announce XOOPS 2.7.3 Final. This release hardens security across the core, prepares XOOPS for PHP 8.6 while remaining fully supported on PHP 8.2 through 8.5, adds SCEditor as an optional BBCode editor, introduces file-based debug configuration with a rotating file logger, and folds in a series of reliability fixes proven in production on xoops.org.

DOWNLOAD: You can download the release from here: https://github.com/XOOPS/XoopsCore27/releases

Ready for PHP 8.6
* Complete session save-handler contract: create_sid() ahead of its PHP 9.0 requirement, new sessions survive 8.6's updateTimestamp() routing, session.use_strict_mode pinned to the 8.6 default today
* Deprecations cleared ahead of time: constructor value-returns (guarded by a repository-wide test), is_long(), curl_close(), imagedestroy()

Security hardening
* Element values escaped in all five form renderers, with JavaScript arguments built via json_encode()
* Template-set browser and editor contained by the new shared PathGuard class — double-decode removed, NUL bytes rejected, symlink escapes refused, atomic backups — pinned by a truth-table test suite
* Logout now requires a session token: a bare GET renders a POST confirmation instead of ending the session (forced-logout CSRF closed); every existing logout link keeps working
* Redirect query strings are rebuilt through a shared, unit-tested helper instead of being reflected verbatim into Location headers (eight sites)
* image.php's never-functional remote-image branch (an SSRF and phar-deserialization surface) is closed and fails closed
* Module-manifest values escaped on the module admin pages; image category handlers now enforce authorization, not just CSRF

Editors
* SCEditor 3.2.1 ships bundled as an optional BBCode editor, deliberately locked to source mode so existing content never passes through a WYSIWYG round-trip
* One shared dhtml toolbar for all five renderers — no more different toolbars in the control panel and the front end

Debugging and logging
* File-based debug configuration in xoops_data/data/debug.php — error display, error_reporting, and query logging in one place, no mainfile.php edits; nothing changes until an administrator creates the file
* A rotating, redacting file logger records notices, warnings, errors and SQL with backtraces — server paths, session ids and session rows are redacted
* The error screen has one declared owner, so providers such as Whoops or Tracy no longer compete for the seat

Reliability fixes from production
* A failing module no longer takes global search down for every visitor; the "Show all" search pages render results again; search.php validates the request and respects module_read; browse.php sends a well-formed Cache-Control header
* xoops_getrank() no longer fatals when no rank row matches; a failed query returns the documented failure value instead of blanking the page
* Criteria renders an empty IN () list as a constant predicate instead of invalid SQL
* The group list is memoised per request (~48 identical queries removed per page) and a new comments index took a listing query from 541ms to 0.5ms

Deprecations
The XOBJ_DTYPE_UNICODE_* object datatypes are deprecated (notice only, behavior unchanged): they url-encode on write and url-decode on read, which bloats storage and breaks LIKE/FULLTEXT search on utf8mb4. Data migration is planned for 2.8, constant removal for 4.0.

Upgrading from 2.7.2
XOOPS 2.7.3 includes schema changes, so after copying the new htdocs/ files over the web root, run the upgrade wizard. No mainfile.php changes are needed. Full documentation: https://xoops.github.io/xoops-docs/

System requirements
* PHP >= 8.2.0 (PHP 8.4 or 8.5 recommended, prepared for 8.6)
* MySQL >= 5.7.8 or MariaDB >= 10.5 (a supported MySQL 8.x or MariaDB LTS recommended)
* Apache 2.4+ or nginx

Translations
XOOPS 2.7.3 adds new English language constants: the SCEditor editor strings introduced in RC 1 and one logout-confirmation string added in Final — see docs/lang_diff.txt. XOOPS remains maintained in 37 community translations: https://github.com/XoopsLanguages

Thank you
Thank you to everyone who submitted pull requests, reported issues, tested the beta and RC packages, translated strings, and reviewed security findings throughout the 2.7.3 cycle.

A special thank-you to CHCCD for testing the release candidates and reporting the search and browse bugs fixed in this release (issues #161, #162, #163). Bug reports like these make XOOPS better for everyone.

We also thank JetBrains ( https://www.jetbrains.com/ ) for supporting the project with PhpStorm licenses.

Bug reports: https://github.com/XOOPS/XoopsCore27/issues
Support forums: https://xoops.org/modules/newbb/

The XOOPS Development Team

XOOPS Plugin for PhpStorm Released

Wed, 12 Aug 2026 01:50:00 +0000

XOOPS Plugin for PhpStorm Released

Highlights

* Inspections + Alt+Enter fixes (guards, isResultSet / fetch*, query vs exec, Request, Smarty, templates)
* Live templates, language-constant completion, project scanner tool window
* Module scaffold (legacy or hybrid PSR-4)
* Dynamic plugin where the IDE allows (often no restart after updates)

Early preview — APIs and inspections may change. Feedback welcome via Issues.

DOWNLOAD: You can download the Zip file from here: https://github.com/XOOPS/phpstorm-plugin/releases

XOOPS 2.7.3 RC-1 is here — and it brings a new editor

Tue, 11 Aug 2026 07:30:00 +0000

XOOPS 2.7.3 RC-1 is here — and it brings a new editor The first release candidate for XOOPS 2.7.3 is out. Thirty-six changes since Beta 1, and three of them you will notice the day you install it. A new editor, and one that finally looks the same everywhere SCEditor joins the editor dropdown as a lightweight BBCode option. It ships bundled, so there is nothing extra to download. It stays in source mode on purpose, and that is a feature rather than a limitation: a WYSIWYG round-trip is exactly how [siteurl], [d], named [size=] values and custom smilie codes quietly get rewritten or dropped. SCEditor inserts at the caret and leaves the rest of your post alone. While we were in there, we fixed something long-standing: the same editor now shows the same toolbar everywhere. Until now the control panel and the front end disagreed, and front-end themes disagreed with each other. The cause was five separate hand-written copies of the same markup. There is now one, and every renderer uses it. Code blocks work again on modern PHP If you post code on PHP 8.3 or newer, you may have seen blocks that began with the mysterious text le="color: #000000">. PHP changed how it highlights code in 8.3; XOOPS was still cutting fourteen characters off the front, assuming the old format. Fixed — along with the whitespace inside code blocks. Your error screen, under your control The headline feature. When a site throws an uncaught error, the module that draws the screen is now one owner you declare, rather than whoever happened to register last. XOOPS publishes who owns it, where that came from, and whether anything is wrong. Choose your screen: xWhoops 2.0.0-Beta2 or the brand-new xTracy 1.0.0-Beta1. Watch it from DebugBar 1.4.1, which now reports the real owner instead of guessing. Full details in the companion post. And quietly, in the background A round of security work on form output, module administration and the image manager. A database fix for searches that produced invalid SQL when a user's permission list was empty. And a Windows bug so old that the file cache had never worked there. Try it This is a release candidate: please install it on a test site, put it through its paces, and tell us what breaks. That is what an RC is for, and it is the most useful thing you can do for 2.7.3 right now. Bug reports and feedback: XOOPS on GitHub.

XOOPS ModuleInstaller 1.7.0 Alpha 1 Released

Mon, 03 Aug 2026 16:40:00 +0000

XOOPS ModuleInstaller 1.7.0 Alpha 1 Speeds Multi-Module Testing and Development

ModuleInstaller 1.7.0 Alpha 1 is now available for XOOPS 2.7, delivering safer module operations, structured reporting, and a more polished multilingual admin experience..

New Features

- Secure, escape-once rendering of module installation logs
- Structured reports for HTML, plain text, CLI, logging, and JSON
- New ModuleOperationResult API with full backward compatibility
- 30 new translatable admin strings with reliable English fallbacks
- Improved RTL display for counters, versions, statuses, and summaries
- Safer module-logo and manifest handling
- Better accessibility and long-report navigation
- Test suite expanded from 18 to 124 tests

Requirements: XOOPS 2.7.0+, PHP 8.2+, mtools 1.2.0+ (installed; need not be active).

Download

ModuleInstaller: https://github.com/XoopsModules27x/moduleinstaller/releases/

mTools: https://github.com/XoopsModules27x/mtools/releases

A full walkthrough is in the module’s docs/TUTORIAL.md

XOOPS Debugbar 1.4.0 released

Mon, 03 Aug 2026 16:40:00 +0000

XOOPS DebugBar 1.4.0 Is Here: Smarter Diagnostics, Safer Debugging, Faster Development

XOOPS DebugBar 1.4.0 delivers administrator-only diagnostics, performance analytics, query and N+1 detection, protected logs, system checks, and optional profiling integrations for XOOPS 2.7.1+ The release strengthens security with bounded sanitization, CSRF protection, signed read-only EXPLAIN requests, and safer diagnostic rendering, while adding numerous usability and reliability improvements. Existing installations should run the XOOPS module update after upgrading.

DebugBar 1.4.0 turns the module from a request inspector into a diagnostics toolkit: it now tells you not just what happened, but where in your code it happened.

Highlights

* Call-site attribution. N+1 and duplicate-query detection could report that sixty-two identical statements ran, but not what ran them. Findings now name the file and line — on the first real page it saw, a genuine N+1 in Publisher: sixty-two executions from ItemHandler.php:255.

* Where the time actually went. A Boot / SQL / App split names whichever segment dominated the request, so you know whether query tuning would help before you start. The Server-Timing header reports the same breakdown.

* Real-user web vitals. LCP, INP and CLS collected from actual visitors and attached to the matching profile, with per-URL averages on the Analytics page.

* Xdebug profiling from the toolbar. Arm a one-shot profile with a button, then read the cachegrind output in the admin — top functions by inclusive and self cost, no external viewer needed.

* Block cache visibility. A front page rendering nineteen uncached blocks pays nineteen block renders on every view. Cached and uncached counts are now stored per request and averaged per module.

* Three features that had shipped without working now do:

a) the collect_events preference (every dispatch is observable, including events nothing listens to),
b) SQL syntax highlighting in the Queries panel, and
c) the per-profile Delete button in the Xdebug viewer.

DOWNLOAD: https://github.com/XoopsModules27x/debugbar/releases/

TUTORIAL: https://github.com/XoopsModules27x/debugbar/blob/main/docs/using-debugbar.md