XOOPS Web Application System

XOOPS 2.7.3 FINAL (ready for PHP 8.6)

Mon, 24 Aug 2026 13:10:00 +0000

XOOPS 2.7.3 Final Released: PHP 8.6 readiness

The XOOPS Development Team is pleased to announce XOOPS 2.7.3 Final. This release hardens security across the core, prepares XOOPS for PHP 8.6 while remaining fully supported on PHP 8.2 through 8.5, adds SCEditor as an optional BBCode editor, introduces file-based debug configuration with a rotating file logger, and folds in a series of reliability fixes proven in production on xoops.org.

DOWNLOAD: You can download the release from here: https://github.com/XOOPS/XoopsCore27/releases

Ready for PHP 8.6
* Complete session save-handler contract: create_sid() ahead of its PHP 9.0 requirement, new sessions survive 8.6's updateTimestamp() routing, session.use_strict_mode pinned to the 8.6 default today
* Deprecations cleared ahead of time: constructor value-returns (guarded by a repository-wide test), is_long(), curl_close(), imagedestroy()

Security hardening
* Element values escaped in all five form renderers, with JavaScript arguments built via json_encode()
* Template-set browser and editor contained by the new shared PathGuard class — double-decode removed, NUL bytes rejected, symlink escapes refused, atomic backups — pinned by a truth-table test suite
* Logout now requires a session token: a bare GET renders a POST confirmation instead of ending the session (forced-logout CSRF closed); every existing logout link keeps working
* Redirect query strings are rebuilt through a shared, unit-tested helper instead of being reflected verbatim into Location headers (eight sites)
* image.php's never-functional remote-image branch (an SSRF and phar-deserialization surface) is closed and fails closed
* Module-manifest values escaped on the module admin pages; image category handlers now enforce authorization, not just CSRF

Editors
* SCEditor 3.2.1 ships bundled as an optional BBCode editor, deliberately locked to source mode so existing content never passes through a WYSIWYG round-trip
* One shared dhtml toolbar for all five renderers — no more different toolbars in the control panel and the front end

Debugging and logging
* File-based debug configuration in xoops_data/data/debug.php — error display, error_reporting, and query logging in one place, no mainfile.php edits; nothing changes until an administrator creates the file
* A rotating, redacting file logger records notices, warnings, errors and SQL with backtraces — server paths, session ids and session rows are redacted
* The error screen has one declared owner, so providers such as Whoops or Tracy no longer compete for the seat

Reliability fixes from production
* A failing module no longer takes global search down for every visitor; the "Show all" search pages render results again; search.php validates the request and respects module_read; browse.php sends a well-formed Cache-Control header
* xoops_getrank() no longer fatals when no rank row matches; a failed query returns the documented failure value instead of blanking the page
* Criteria renders an empty IN () list as a constant predicate instead of invalid SQL
* The group list is memoised per request (~48 identical queries removed per page) and a new comments index took a listing query from 541ms to 0.5ms

Deprecations
The XOBJ_DTYPE_UNICODE_* object datatypes are deprecated (notice only, behavior unchanged): they url-encode on write and url-decode on read, which bloats storage and breaks LIKE/FULLTEXT search on utf8mb4. Data migration is planned for 2.8, constant removal for 4.0.

Upgrading from 2.7.2
XOOPS 2.7.3 includes schema changes, so after copying the new htdocs/ files over the web root, run the upgrade wizard. No mainfile.php changes are needed. Full documentation: https://xoops.github.io/xoops-docs/

System requirements
* PHP >= 8.2.0 (PHP 8.4 or 8.5 recommended, prepared for 8.6)
* MySQL >= 5.7.8 or MariaDB >= 10.5 (a supported MySQL 8.x or MariaDB LTS recommended)
* Apache 2.4+ or nginx

Translations
XOOPS 2.7.3 adds new English language constants: the SCEditor editor strings introduced in RC 1 and one logout-confirmation string added in Final — see docs/lang_diff.txt. XOOPS remains maintained in 37 community translations: https://github.com/XoopsLanguages

Thank you
Thank you to everyone who submitted pull requests, reported issues, tested the beta and RC packages, translated strings, and reviewed security findings throughout the 2.7.3 cycle.

A special thank-you to CHCCD for testing the release candidates and reporting the search and browse bugs fixed in this release (issues #161, #162, #163). Bug reports like these make XOOPS better for everyone.

We also thank JetBrains ( https://www.jetbrains.com/ ) for supporting the project with PhpStorm licenses.

Bug reports: https://github.com/XOOPS/XoopsCore27/issues
Support forums: https://xoops.org/modules/newbb/

The XOOPS Development Team

XOOPS Plugin for PhpStorm Released

Wed, 12 Aug 2026 01:50:00 +0000

XOOPS Plugin for PhpStorm Released

Highlights

* Inspections + Alt+Enter fixes (guards, isResultSet / fetch*, query vs exec, Request, Smarty, templates)
* Live templates, language-constant completion, project scanner tool window
* Module scaffold (legacy or hybrid PSR-4)
* Dynamic plugin where the IDE allows (often no restart after updates)

Early preview — APIs and inspections may change. Feedback welcome via Issues.

DOWNLOAD: You can download the Zip file from here: https://github.com/XOOPS/phpstorm-plugin/releases

XOOPS 2.7.3 RC-1 is here — and it brings a new editor

Tue, 11 Aug 2026 07:30:00 +0000

XOOPS 2.7.3 RC-1 is here — and it brings a new editor The first release candidate for XOOPS 2.7.3 is out. Thirty-six changes since Beta 1, and three of them you will notice the day you install it. A new editor, and one that finally looks the same everywhere SCEditor joins the editor dropdown as a lightweight BBCode option. It ships bundled, so there is nothing extra to download. It stays in source mode on purpose, and that is a feature rather than a limitation: a WYSIWYG round-trip is exactly how [siteurl], [d], named [size=] values and custom smilie codes quietly get rewritten or dropped. SCEditor inserts at the caret and leaves the rest of your post alone. While we were in there, we fixed something long-standing: the same editor now shows the same toolbar everywhere. Until now the control panel and the front end disagreed, and front-end themes disagreed with each other. The cause was five separate hand-written copies of the same markup. There is now one, and every renderer uses it. Code blocks work again on modern PHP If you post code on PHP 8.3 or newer, you may have seen blocks that began with the mysterious text le="color: #000000">. PHP changed how it highlights code in 8.3; XOOPS was still cutting fourteen characters off the front, assuming the old format. Fixed — along with the whitespace inside code blocks. Your error screen, under your control The headline feature. When a site throws an uncaught error, the module that draws the screen is now one owner you declare, rather than whoever happened to register last. XOOPS publishes who owns it, where that came from, and whether anything is wrong. Choose your screen: xWhoops 2.0.0-Beta2 or the brand-new xTracy 1.0.0-Beta1. Watch it from DebugBar 1.4.1, which now reports the real owner instead of guessing. Full details in the companion post. And quietly, in the background A round of security work on form output, module administration and the image manager. A database fix for searches that produced invalid SQL when a user's permission list was empty. And a Windows bug so old that the file cache had never worked there. Try it This is a release candidate: please install it on a test site, put it through its paces, and tell us what breaks. That is what an RC is for, and it is the most useful thing you can do for 2.7.3 right now. Bug reports and feedback: XOOPS on GitHub.

XOOPS ModuleInstaller 1.7.0 Alpha 1 Released

Mon, 03 Aug 2026 16:40:00 +0000

XOOPS ModuleInstaller 1.7.0 Alpha 1 Speeds Multi-Module Testing and Development

ModuleInstaller 1.7.0 Alpha 1 is now available for XOOPS 2.7, delivering safer module operations, structured reporting, and a more polished multilingual admin experience..

New Features

- Secure, escape-once rendering of module installation logs
- Structured reports for HTML, plain text, CLI, logging, and JSON
- New ModuleOperationResult API with full backward compatibility
- 30 new translatable admin strings with reliable English fallbacks
- Improved RTL display for counters, versions, statuses, and summaries
- Safer module-logo and manifest handling
- Better accessibility and long-report navigation
- Test suite expanded from 18 to 124 tests

Requirements: XOOPS 2.7.0+, PHP 8.2+, mtools 1.2.0+ (installed; need not be active).

Download

ModuleInstaller: https://github.com/XoopsModules27x/moduleinstaller/releases/

mTools: https://github.com/XoopsModules27x/mtools/releases

A full walkthrough is in the module’s docs/TUTORIAL.md

XOOPS Debugbar 1.4.0 released

Mon, 03 Aug 2026 16:40:00 +0000

XOOPS DebugBar 1.4.0 Is Here: Smarter Diagnostics, Safer Debugging, Faster Development

XOOPS DebugBar 1.4.0 delivers administrator-only diagnostics, performance analytics, query and N+1 detection, protected logs, system checks, and optional profiling integrations for XOOPS 2.7.1+ The release strengthens security with bounded sanitization, CSRF protection, signed read-only EXPLAIN requests, and safer diagnostic rendering, while adding numerous usability and reliability improvements. Existing installations should run the XOOPS module update after upgrading.

DebugBar 1.4.0 turns the module from a request inspector into a diagnostics toolkit: it now tells you not just what happened, but where in your code it happened.

Highlights

* Call-site attribution. N+1 and duplicate-query detection could report that sixty-two identical statements ran, but not what ran them. Findings now name the file and line — on the first real page it saw, a genuine N+1 in Publisher: sixty-two executions from ItemHandler.php:255.

* Where the time actually went. A Boot / SQL / App split names whichever segment dominated the request, so you know whether query tuning would help before you start. The Server-Timing header reports the same breakdown.

* Real-user web vitals. LCP, INP and CLS collected from actual visitors and attached to the matching profile, with per-URL averages on the Analytics page.

* Xdebug profiling from the toolbar. Arm a one-shot profile with a button, then read the cachegrind output in the admin — top functions by inclusive and self cost, no external viewer needed.

* Block cache visibility. A front page rendering nineteen uncached blocks pays nineteen block renders on every view. Cached and uncached counts are now stored per request and averaged per module.

* Three features that had shipped without working now do:

a) the collect_events preference (every dispatch is observable, including events nothing listens to),
b) SQL syntax highlighting in the Queries panel, and
c) the per-profile Delete button in the Xdebug viewer.

DOWNLOAD: https://github.com/XoopsModules27x/debugbar/releases/

TUTORIAL: https://github.com/XoopsModules27x/debugbar/blob/main/docs/using-debugbar.md

XOOPS 2.7.3 Beta 1 Released

Tue, 28 Jul 2026 11:30:00 +0000

XOOPS 2.7.3 Beta 1 is available

XOOPS 2.7.3 Beta 1 is ready for testing. It pairs a set of stability and security fixes with new diagnostic tooling — a persistent, opt-in log that records what the in-page debug panel cannot.

Download: https://github.com/XOOPS/XoopsCore27/releases/tag/v2.7.3-Beta1

XOOPS 2.7.1 & 2.7.2 Language Packs Are Here — 38 Languages Ready to Download

Sat, 25 Jul 2026 23:10:00 +0000

XOOPS 2.7.1 & 2.7.2 Language Packs Are Here — 38 Languages Ready to Download

Great news for the XOOPS community: the official language packs for XOOPS 2.7.1 (work for XOOPS 2.7.2 too) are now available, refreshed and ready across 38 languages — from Arabic and Bosnian to Ukrainian, Urdu, and Vietnamese.

This release brings every core language pack in line with 2.7.1+, so no matter where your site lives, your admins and members can work in a language that feels like home. We're also thrilled to welcome a newly completed Gujarati (ગુજરાતી) translation — a full 100% core coverage, joining the family for the first time at this level.

Each pack is a drop-in match for the 2.7.1+ Core: consistent constants, clean UTF‑8, and validated against the English reference so you get a smooth, blank-screen-free experience out of the box.

Grab your language: Every pack lives in its own repository under the XoopsLanguages organization on GitHub, with a direct download for 2.7.1::

- Arabic
- Bosnian
- Brazilian
- Bulgarian
- Catalan
- Croatian
- Czech
- Danish
- Dutch
- English-Reference
- Finnish
- French
- Galician
- German
- Greek
- Gujarati
- Hebrew
- Hungarian
- Italian
- Japanese
- Korean
- Malaysian
- Norwegian
- Persian
- Polish
- Portuguese
- Romanian
- Russian
- Schinese
- Slovenian
- Spanish
- Swedish
- Tchinese
- Thai
- Turkish
- Ukrainian
- Urdu
- Vietnamese

Want to help? XOOPS is powered by its community, and translations are one of the best ways to give back. Spot something to improve, or want to bring your language to 100%? Head to the XoopsLanguages repositories and open a pull request — every string counts.

A huge thank-you to the XOOPS Translation Team and every contributor who made this release possible. Here's to making XOOPS the most welcoming CMS in the world — in every language. 🌍

XOOPS 2.7.2 Final Releaesed

Sat, 25 Jul 2026 11:30:00 +0000

XOOPS 2.7.2 FINAL RELEASE

The XOOPS Development Team is pleased to announce the release of XOOPS 2.7.2.

This maintenance release strengthens security and upgrade handling, adds form and theme improvements, refreshes bundled dependencies, and supports PHP 8.2 through PHP 8.5.

Download XOOPS 2.7.2: https://github.com/XOOPS/XoopsCore27/releases

For full documentation on installing or upgrading XOOPS please see: https://xoops.github.io/xoops-docs/

XOOPS ModuleInstaller 1.6.0 Speeds Multi-Module Testing and Development

Fri, 24 Jul 2026 15:30:00 +0000

ModuleInstaller 1.6.0 is the bulk admin tool that keeps multi-module XOOPS work practical—especially when you are building features, debugging integrations, or spinning up throwaway test setups.

Why it helps testers and developers

• Bulk install, update, activate, and deactivate — stop clicking through modules one by one when a stack changes.
• Module Sets + Focus — define a named subset (e.g. “billing stack”), activate only those modules, and park the rest without uninstalling. Snapshot first, restore when the test is done.
• Safer batch runs — missing folders and protected modules (system, ModuleInstaller) are skipped with clear reports instead of killing the whole job.
• Less friction on large sites — filter, select-all, sticky selection count, and “apply set” on bulk lists keep long module catalogs usable.
• Sample set included — load a ready PM + Profile + Protector set and start from a common baseline instead of rebuilding it by hand.

Requirements: XOOPS 2.7.0+, PHP 8.2+, mtools 1.2.0+ (installed; need not be active).

Ship fewer “which modules were on?” mysteries. Spend the time on the bug, not the admin clicks.

Download

ModuleInstaller: https://github.com/XoopsModules27x/moduleinstaller/

mTools: https://github.com/XoopsModules27x/mtools/

A full walkthrough is in the module’s docs/TUTORIAL.md and the project changelog.

XOOPS 2.7.1 Final Releaesed

Wed, 22 Jul 2026 22:40:00 +0000

XOOPS 2.7.1 FINAL RELEASE

The XOOPS Development Team is pleased to announce the release of XOOPS 2.7.1.

This maintenance release strengthens security and upgrade handling, adds form and theme improvements, refreshes bundled dependencies, and supports PHP 8.2 through PHP 8.5.

Download XOOPS 2.7.1: https://github.com/XOOPS/XoopsCore27/releases

For full documentation on installing or upgrading XOOPS please see: https://xoops.github.io/xoops-docs/