XOOPS Web Application System

cssHolmes 3.3.0 Alpha 1

Tue, 27 Oct 2026 04:10:00 +0000

Meet cssHolmes 3.3.0 Alpha 1: See it. Style it. Compare it.

Improving a XOOPS theme often means finding the right page, locating an element, changing CSS and checking the result again. cssHolmes 3.3.0 Alpha 1 brings inspection, visual editing and comparison into one workflow, helping you spend more time improving your theme and less time switching between tools.

From inspection to improvement

Select an element and explore its styles, design tokens and estimated text contrast. Adjust colors, typography, spacing and supported layout properties with live preview. Undo and redo make it easy to explore alternatives. Your draft stays private until you choose Save to theme; published overrides are stored separately from the theme's original stylesheets.

Better together with xStyles

With the matching xStyles integration update, common headings, tables, forms and other elements become your theme-testing workspace:

- Find inconsistencies faster: inspect and edit examples directly from the gallery.
- Compare before publishing: view the published appearance beside your draft.
- Check responsive designs: preview your draft at 360, 768 and 1280 pixels together.
- Reuse good ideas: save named style sets and import or export alternatives without publishing them.

Theme and template diagnostics help you investigate problems, while previous-save restoration provides a way back after publishing.

Try the workflow on a staging site and help shape the next release. This is an alpha for testing and feedback, requiring PHP 8.4 or newer. Start with the included illustrated cssHolmes + xStyles tutorial, then check your changes on representative site pages before publishing.

DOWNLOAD: https://github.com/XoopsModules27x/cssholmes/releases

Source and issues:XoopsModules27x/cssholmes.

XOOPS Plugin for PhpStorm 1.0 Alpha 5 Released

Tue, 27 Oct 2026 00:30:00 +0000

XOOPS Support Plugin for PhpStorm: Alpha 5 is here

XOOPS Support Plugin brings XOOPS CMS knowledge into PhpStorm and IntelliJ IDEA: it finds the mistakes that break XOOPS modules and fixes most of them with one Alt+Enter. It covers XOOPS 2.5, 2.7, and the upcoming XOOPS 2.8 and 4.0, for Core and module development.

Fewer false positives, found on three newbb trees, each checked against the module source and pinned with a fixture.

InstallSql and SqlFileComment check only the file the installer runs: the one an active $modversion['sqlfile'] entry names, or sql/mysql.sql when none is named. Database dumps and old upgrade scripts beside it are no longer reported, and an entry set to false switches the check off.DeprecatedCoreApi no longer reports a module handler's own synchronization().Unlink accepts an SplFileInfo check (isFile() before getRealPath() / getPathname(), isLink() before getPathname()).UnregisteredTemplate and MissingRegisteredTemplate skip test trees.MenuAutoload inserts the require above declare(strict_types=1) and leaves a bootstrap.php that already loads the autoloader alone.New INSPECTIONS.md lists all 52 inspections with default level, quick-fix and when each stays silent. The UpdateCreatesTable description is rewritten in plain words.

Getting started

Install the plugin and open a XOOPS project. Detection is automatic. You can set the Core Version and other options under Settings → Languages & Frameworks → XOOPS Support, and the inspections are listed under Settings → Editor → Inspections → XOOPS. The plugin installs and updates without an IDE restart.

Source, documentation and issues on GitHub

XOOPS Plugin for PhpStorm 1.0 Alpha 4 Released

Mon, 26 Oct 2026 06:20:00 +0000

XOOPS Support Plugin for PhpStorm: Alpha 4 is here

XOOPS Support Plugin brings XOOPS CMS knowledge into PhpStorm and IntelliJ IDEA: it finds the mistakes that break XOOPS modules and fixes most of them with one Alt+Enter. It covers XOOPS 2.5, 2.7, and the upcoming XOOPS 2.8 and 4.0, for Core and module development.

Every quick-fix is tested against whole-file fixtures and applied twice to prove it is idempotent. Before release the full set was run on 224 real modules: 46,000 findings and 10,000 files rewritten, with no entry point blocked and no parse error.

52 inspections with quick-fixes

Database: migrates queryF() and quoteString(), picks query() or exec() from the SQL, adds result-set guards that keep the function's failure contract, and flags ORDER BY or request-in-SQL injection.Security: Xmf\Request instead of raw superglobals, missing CSRF checks, unserialize() without allowed_classes, dynamic code, weak tokens, path containment and attribute escaping.Bootstrap and structure: direct-access guards that never block an entry point, double xoops_cp_header(), form loader, admin menu autoload and file headers.Templates and Smarty: template registration in both directions, <{ }> delimiters, $smarty.get escaping and the Smarty 5 API.Language files, installer SQL and deprecated core API (the 2.7.4 deprecation list).

Version-aware fixes

The plugin reads your tree's include/version.php and only offers rewrites your core supports. Older cores get compatible code instead of an API they don't have.

Productivity

New → XOOPS Module… scaffolds a legacy or hybrid module (Helper, PSR-4 autoloader, Xmf admin) whose output passes every inspection.Completion, Ctrl+B and Find Usages for language constants (_MD_*, _MI_*, _AM_*…), including in Smarty templates.Live templates for common XOOPS code.A project tool window that gives an overview of your modules.

Getting started

Install the plugin and open a XOOPS project. Detection is automatic. You can set the Core Version and other options under Settings → Languages & Frameworks → XOOPS Support, and the inspections are listed under Settings → Editor → Inspections → XOOPS. The plugin installs and updates without an IDE restart.

Source, documentation and issues on GitHub

Meet xStyles: see your XOOPS theme in action

Mon, 26 Oct 2026 02:00:00 +0000

Meet xStyles: see your XOOPS theme in action

A living style guide for XOOPS themes.

Introducing xStyles 1.5 Beta 2

How well does your theme handle a long table heading, a required form field, or a narrow screen? With xStyles, you can explore those details in one place—and make better design decisions before your next theme change.

xStyles brings together 40 built-in examples of typography, content, tables, forms, comments, menus, and more. Each example uses your theme's actual styles. The content stays the same, so you can concentrate on what changes: readability, spacing, colours, and layout.

Spend less time hunting for examples

See the whole picture. Browse common page elements in one organised gallery. Check whether headings, buttons, tables, and forms feel like parts of the same website.Find trouble spots sooner. Try long text, disabled controls, and different block layouts. Check the frontend at 360, 768, and 1280 pixels to spot wrapping and overflow problems.Choose admin themes with confidence. Preview installed administration themes and compare two side by side, using the same examples at the same width. Your normal admin theme stays active.Explore the details quickly. Select a category, search for an example, and focus on one element at a time. Expand its rendered HTML when you want to see how it is built.Give designers a repeatable review process. Return to the same examples after a stylesheet change. Theme authors can add their own components to the gallery; the optional cssHolmes module provides separate tools for editing and publishing styles.

Useful from your first visit

You do not need to write CSS to start. Open the gallery, choose Typography, Tables, or Forms, and explore. The illustrated tutorial guides you from your first preview to comparisons and theme development.

The examples are demonstrations: forms do not save submissions or upload files, and the gallery creates no sample articles to clean up afterward.

Compatibility: xStyles requires XOOPS 2.7+ with XMF and the core form-renderer API, and PHP 8.2+. Admin theme comparison works on the tested XOOPS 2.7.4 and 2.8 cores. Frontend theme selection and comparison require the compatible preview support in XOOPS 2.8; on 2.7.4, you can inspect the current frontend theme and use responsive previews.

Put your theme through its paces. Explore xStyles on GitHub, try the beta on a test site, and open Help for the tutorial. Share what you discover with the XOOPS community.

Preview. Compare. Refine.

XOOPS 2.5.11.2 - maintenance update for XOOPS 2.5.11

Sat, 17 Oct 2026 03:30:00 +0000

XOOPS 2.5.11.2

2.5.11.2 is a maintenance update for the 2.5 line, which many sites still run on older hosting. It contains no new features.

* PHP 7.4 is now the minimum version: PHP 5.6 to 7.3 are no longer supported. The installer, the module manifests and the documentation reflect this

* The bundled XMF library is updated to 1.2.33: the proxy_env header is honoured only when the direct peer is listed in the new proxy_trusted setting, documented in xoops_data/configs/xoopsconfig.dist.php. Sites that set proxy_env must add proxy_trusted; until then the peer address is used. Forwarded headers are parsed per RFC 7239, and Xmf\Database\Tables and Migrate handle CURRENT_TIMESTAMP defaults and unreadable tables correctly

* XMF's own dependencies follow: firebase/php-jwt 6.10, Kint 6.1, symfony/yaml 5.4, webmozart/assert 1.12. Smarty, HTML Purifier and the rest of the 2.5.11 set are unchanged

* No database, template or language changes

Upgrading to 2.5.11.2
Copy the new files over the web root. The upgrade wizard is not needed. Check that your server runs PHP 7.4 or later before you copy the files.

If you are still on 2.5.x, this is a good moment to plan the move to 2.7.4: the 2.5 line receives security updates only.

DOWNLOAD: https://github.com/XOOPS/XoopsCore25/releases/

XOOPS 2.7
XOOPS 2.7.4 already includes the same fixes through XMF 1.3.2. If you are planning a move to the 2.7 line, see github.com/XOOPS/XoopsCore27/releases.

Reporting issues
Please report problems at github.com/XOOPS/XoopsCore25/issues, with your PHP and MySQL versions. Security issues should be reported privately, as described in the repository's SECURITY.md, not in a public issue. Questions are welcome in the support forums.

Thank you
Thank you to the researchers who reported these issues responsibly and to everyone who reviewed and tested the fixes. And a standing thank-you to JetBrains for the complimentary PhpStorm licenses that power the core team's development.

The XOOPS Development Team

XOOPS 2.7.4 Final Released (ready for PHP 8.6.0)

Sat, 17 Oct 2026 03:30:00 +0000

XOOPS 2.7.4 Final

2.7.4 went through Beta 1, Beta 2, RC 1 and RC 2 between September and October. Final collects everything from that cycle plus the fixes made since RC 2. There are no new features since RC 2.

Two-factor authentication in the core
Every member can protect their account with a second step at login.
* Two methods: a time-based authenticator app (Google Authenticator, Microsoft Authenticator, Aegis, FreeOTP, or any password manager that generates TOTP codes), or a six-digit code mailed to the member's address
* Recovery codes: ten one-time codes at enrolment, for the day the phone or the mailbox is out of reach. Members can replace them from Edit Account
* Lock-out protection: five wrong codes lock the second step for fifteen minutes and the member is notified by e-mail
* Administrators can reset a member's factor from the Users page, and an operator locked out of the site has a documented escape hatch in docs/2fa-operations.md
* Off by default: switch it to "Optional" in System Preferences and every member may enrol. Nobody is forced
* Secrets are encrypted at rest with a site key. Mailed codes are stored hashed and expire after ten minutes. Remember-me cookies are bound to the enrolled factor, so a reset invalidates them
* Every login path that cannot show a challenge (the upgrade wizard, XML-RPC, the SSL popup) refuses an account that must present its factor

Editors
* SCEditor is now a full visual editor: it edits with its complete toolbar and keeps XOOPS BBCode intact across visual and source modes. Its emoticons are registered as XOOPS smileys. It is the default editor for new installs; an upgraded site keeps its current editor settings
* Markdown support: EasyMDE stores Markdown in the existing text columns and MyTextSanitizer renders it with Parsedown in safe mode, so modules get Markdown without a schema change
* New Editors preference category in System Preferences for toolbar and editor settings
* MyTextSanitizer renders the tags SCEditor's toolbar writes: [sub], [sup], [s], [justify], [ol] and tables
* TinyMCE 7 is updated to 7.9.3

Security hardening
The cycle included a review of the core with CodeQL, Snyk, SonarCloud, Scrutinizer and manual audits. The main results:
* Form security tokens no longer depend on the browser's User-Agent: a token is a random value compared in constant time, so a browser update or a privacy extension between opening and submitting a form no longer rejects it. Protector's admin pages use the same core token
* One same-site check for every redirect: login, post-login and theme-switch return addresses refuse targets written with backslashes, encoded slashes, HTML entities or embedded line breaks
* Remember-me tokens are revoked when the password changes, and a restored session ends for a deactivated account
* Registration is validated at the save step, not only at step 1, and a comment must belong to the requesting module on edit, save and delete
* Uploads are deleted only inside the upload directory: the image manager and the smilies, rank and avatar admin pages resolve a stored file name before they delete it. The TinyMCE image manager checks category permissions on upload and delete
* Protected database dumps are written only under XOOPS_VAR_PATH, into a directory guarded by a deny-all .htaccess
* Cache ids use a random site key instead of the database credentials, and the installer renames itself and its cleanup script with random names
* LDAP and Active Directory fail closed when StartTLS was requested and failed
* Server configuration: xoops_lib/.htaccess works on Apache 2.4 without mod_access_compat, PHPMailer's unused OAuth helper is removed from the vendor tree, and reCAPTCHA v2 verifies over POST so the secret key stays out of server logs
* Confirmation pages, error lists and the SQL built by the legacy XoopsTopic and XoopsTree helpers are escaped and quoted

Since RC 2
* XMF 1.3.3: proxy headers (proxy_env) are honoured only when the direct peer is listed in the new proxy_trusted setting, as addresses or CIDR ranges. Sites that set proxy_env must add proxy_trusted in xoops_data/configs/xoopsconfig.php; until then the peer address is used. Forwarded headers are parsed per RFC 7239
* image.php no longer crashes on PHP 8.3+ when an angle is requested
* LDAP and Active Directory logins on PHP 8.3+ no longer emit a deprecation, and a bare IPv6 server address is handled
* Values stored as XOBJ_DTYPE_UNICODE_ARRAY reload as the array that was stored. Values such as café or a+b lost characters before
* The |replace and |escape modifiers no longer emit PHP 8.6 deprecations, and templates can use |sprintf without a Smarty notice
* Library refresh: HTML Purifier 4.19.1, Monolog 3.12.1, Smarty 4.5.8, TCPDF 6.11.4, symfony/var-dumper and symfony/yaml 7.4.21, firebase/php-jwt 7.2.1, Punic 3.8.2, webmozart/assert 2.5.0

The full list is in docs/changelog.270.txt.

Upgrading to 2.7.4
From 2.7.4 RC 2: copy the new files over the web root. There are no database changes since RC 2, so the upgrade wizard is not required. If your site sets proxy_env, add proxy_trusted as described above.

From XOOPS 2.7.3 or a 2.7.4 beta: copy the new files over the web root and run the upgrade wizard. It creates the user_2fa table and the two-factor preference, registers the SCEditor emoticons as smileys, adds the Editors preferences and updates the System module. No mainfile.php changes are needed.
* Two-factor authentication needs the PHP sodium extension; the wizard reports whether it is available
* Every remembered device logs in once more after the upgrade
* If you copied extras/login.php elsewhere on your site, replace or remove that copy
* A site running a custom template set should re-import it

From 2.5.11 or earlier: follow the XOOPS Install and Upgrade Guide: https://xoops.gitbook.io/xoops-install-upgrade/ - run upgrade/preflight.php first; 2.7 moved to Smarty 4 and some older themes need changes.

System requirements
* PHP 8.2 to 8.5
* MySQL 5.7+ or MariaDB 10.3+
* The PHP sodium extension for two-factor authentication

XOOPS 2.6.0 Alpha 2 released

Sat, 17 Oct 2026 03:30:00 +0000

XOOPS 2.6.0 Alpha 2 released

The XOOPS Development Team has published XOOPS 2.6.0 Alpha 2, a new snapshot of the 2.6 line for developers.

First the honest part: 2.6.0 is not actively developed. The 2.6 code base was the original "rewrite" branch (Doctrine DBAL, the central Xoops instance, extensions, Bootstrap admin), and current development effort goes into XOOPS 2.7.x and the upcoming 2.8.0. Alpha 2 exists so that anyone who wants to pick 2.6 up again starts from a tree that installs, runs and passes its test suite on a current PHP, rather than from a 2017 snapshot.

Alpha 2 is for developers and for the curious. Do not run it on a live site.

DOWNLOAD
https://github.com/XOOPS/XoopsCore26/releases/

What changed since Alpha 1

Alpha 1 (February 2026) raised the minimum PHP version to 8.4 and brought the tree back to green. Alpha 2 finishes that work.

PHP 8.4 minimum, now documented everywhere
Composer already required PHP 8.4. The README, the installer's requirements check and the bug-report template still advertised PHP 7.x, so somebody could follow the docs onto a PHP that Composer then refused. All three now say 8.4. The installer check is the same red/green indicator as before and still does not block the installation.

Database: zero-row statements no longer count as failures
The Doctrine-backed Connection::safeQuery() (and query(), which calls it) returned null, the failure value, for any statement that succeeded without changing rows. Every CREATE TABLE and DROP TABLE falls in that category, as does any UPDATE or DELETE that matches nothing. Module installation, profile-field ALTER TABLE and Xmf\Database\Tables::executeQueue() all reported success as failure.
* safeQuery() now returns true for a successful statement that affected no rows. Affected-row counts above zero and SELECT results are unchanged. null still means the statement failed or was refused on a non-safe connection
* XoopsDatabaseManager::deleteTables() listed a table as dropped when the DROP had failed. It now returns the tables that were actually dropped
* The deprecated XoopsMySQLDatabase::getAffectedRows() was fatal after any write. It now returns the row count, or 0
New tests cover CREATE/INSERT/UPDATE/DELETE/SELECT, failing statements and the safe/force handling against in-memory SQLite.

Bundled XMF updated to 1.3.2
xoops_lib/Xmf is synchronised with XMF 1.3.2 while keeping the 2.6-specific integration (Doctrine connection, \Xoops::getInstance(), XoopsBaseConfig).
* Taken as-is from 1.3.2: Request, FilterInput, Random, Uuid, Assert, Jwt, Key, IPAddress, StopWords, Highlighter, Yaml, Metagen, Migrate, Session, GenericHelper, Helper
* New in 2.6: Ulid, ProxyCheck, the I18n, Security and Mail namespaces, and Database\SchemaDefinitionException
* Merged with the 2.6 backend: Tables (DEFAULT-clause escaping, definition validation, MySQL 8 DEFAULT_GENERATED), Language (path containment rooted at the 2.6 root path), Request/FilterInput (keep the 2.6-only getDateTime() and gather()), Permission (plus the new getItemIds()), Admin
* Kept as 2.6: Debug, TableLoad, Module Helper and Cache

Dependencies and CI
* The abandoned xoops/base-requires metapackage is gone; its dependency list is inlined into composer.json.dist. firebase/php-jwt moves to ^7.0 because every 6.x release carries a security advisory
* Locked library versions: Doctrine DBAL 4.4.1, Smarty 4.5.6, Monolog 3.10.0, symfony/yaml 7.4.1, PHPUnit 11.5
* CI runs again on GitHub Actions: the test configuration is generated by console.php ci-bootstrap before the suite, Qodana and SonarCloud use current linter images, and the GitHub Actions used by the workflows were updated (checkout, cache, codecov, SonarQube scan, Qodana)
* README badges and logo point at the XoopsCore26 repository
The full PHPUnit suite passes: 3492 tests, no failures.

Requirements
* PHP 8.4 or 8.5
* MySQL 5.6+ or MariaDB
* Composer, to install the libraries into xoops_lib/vendor

Installing
This is a developer checkout, not a drop-in package:
1. Clone or download the repository
2. Copy composer.json.dist to composer.json and run composer install
3. Point the web server at htdocs/ and open it in a browser to run the installer
Upgrading from any earlier XOOPS release, including 2.6.0 Alpha 1, is not supported.

Modules
Only the system modules and extensions are included. XOOPS 2.5 and 2.7 modules do not work on 2.6 without changes.

Reporting problems and contributing
* Issues: https://github.com/XOOPS/XoopsCore26/issues
* Full changelog since Alpha 1: https://github.com/XOOPS/XoopsCore26/compare/v2.6.0-alpha1...v2.6.0-alpha2

If you would like to take 2.6 further, the tree is now in a state where that is possible. Pull requests are welcome.

XOOPS Development Team

XOOPS 2.5.11.1 - security update for XOOPS 2.5.11

Fri, 09 Oct 2026 03:30:00 +0000

XOOPS 2.5.11.1 — security update for XOOPS 2.5.11

The XOOPS Development Team has released XOOPS 2.5.11.1, a security update for XOOPS 2.5.11. It changes only the input filter that XOOPS uses on request data. If your site runs XOOPS 2.5.11, please apply it.

DOWNLOAD: https://github.com/XOOPS/XoopsCore25/releases/tag/v2.5.11.1

What's fixed

XOOPS 2.5.11 bundles the XMF library, and its input filter (Xmf\FilterInput, which XoopsFilterInput builds on) now includes the fixes from XMF 1.2.32.1:

* Filtering always finishes: some input made the filter run until PHP hit its memory limit, so one request could take a page down. A value that does not settle after a fixed number of passes is now dropped.
* Stricter tag and attribute checks: some tag and attribute patterns got through the filter. Tag and attribute names are now checked strictly, event-handler attributes are matched whatever their case, link schemes are checked after HTML entities are decoded, and stripped text keeps no partial tag.

There are no database, template or language changes, and no new features. The fix keeps PHP 5.6 compatibility, so 2.5.11.1 runs on the same servers as 2.5.11.

How to update

From XOOPS 2.5.11 (recommended: the patch)
1. Download xoops-2.5.11-to-2.5.11.1-patch.zip from the release page
2. Back up your site files
3. Copy the contents of the zip's htdocs folder over your XOOPS root folder (the one that holds mainfile.php), keeping the folder paths. Two files are replaced:
class/libraries/vendor/xoops/xmf/src/FilterInput.php
include/version.php4. That's it. You don't need to run the upgrade wizard. System Admin now shows XOOPS 2.5.11.1-Stable

New install, or a version older than 2.5.11
Use the full package (the source code zip on the release page) and follow the usual install or upgrade steps.

XOOPS 2.7
XOOPS 2.7.4 RC 2 already includes the same fixes through XMF 1.3.2. If you are planning a move to the 2.7 line, see github.com/XOOPS/XoopsCore27/releases.

Reporting issues
Please report problems at github.com/XOOPS/XoopsCore25/issues, with your PHP and MySQL versions. Security issues should be reported privately, as described in the repository's SECURITY.md, not in a public issue. Questions are welcome in the support forums.

Thank you
Thank you to the researchers who reported these issues responsibly and to everyone who reviewed and tested the fixes. And a standing thank-you to JetBrains for the complimentary PhpStorm licenses that power the core team's development.

The XOOPS Development Team

XOOPS 2.7.4-RC2 Released

Tue, 06 Oct 2026 15:00:00 +0000

XOOPS 2.7.4 RC 2 — security hardening ahead of the final release

The XOOPS Development Team is pleased to announce XOOPS 2.7.4 RC 2, the second release candidate for XOOPS 2.7.4. RC 2 adds no new features. It collects the security hardening and bug fixes made since RC 1, after a review of the core with CodeQL, Snyk, SonarCloud, Scrutinizer and manual audits.

XOOPS 2.7.4 brings two-factor authentication into the core, makes SCEditor a full visual editor and the default for new sites, and adds Markdown support through EasyMDE. It runs on PHP 8.2 through 8.5.

Please test RC 2 on a staging copy of your site and report anything you find. Unless something serious turns up, the next release is 2.7.4 Final.

DOWNLOAD: https://github.com/XOOPS/XoopsCore27/releases

What's new since RC 1

Forms and redirects

* Form security tokens no longer depend on the browser's User-Agent: a token is now a random value compared in constant time. A browser update, a privacy extension or a "desktop site" toggle between opening and submitting a form no longer rejects it. Forms opened before the upgrade still submit
* Protector uses the core form token: its admin pages check the same token as the rest of XOOPS. XoopsGTicket is deprecated and now wraps the core token, so modules that still call it keep working
* One same-site check for redirects: login, post-login and theme-switch return addresses share one check. It refuses targets written with backslashes, encoded slashes, HTML entities or embedded line breaks, and sends them to the home page instead
* Escaped confirmation pages and error lists: xoops_confirm() escapes every field, value and label, and the object and login error lists are escaped too

Files and storage

* Uploads are deleted only inside the upload directory: the image manager and the smilies, user-rank and avatar admin pages resolve a stored file name before they delete it
* Protected database dumps: a dump is written only under XOOPS_VAR_PATH, into a directory guarded by a deny-all .htaccess and private to the PHP user
* Cache ids use a site key: the group part of theme and block cache ids is keyed with a random site key in xoops_data/data instead of the database credentials
* Random installer names: the installer renames itself and names its cleanup script with random_bytes(). Only the installing session can finish the clean-up
* Protector writes its ban files atomically and rejects an uploaded image it cannot inspect instead of staging it in uploads/

Server configuration

* xoops_lib/.htaccess works on Apache 2.4 without mod_access_compat, where the old rules returned a 500 error instead of denying access
* PHPMailer's unused OAuth helper is removed from the bundled vendor tree, and a Composer script removes it again after every vendor refresh
* reCAPTCHA v2 verifies over POST, so the secret key no longer appears in proxy or server logs
* The bundled XMF library is updated to 1.3.2, which tightens the tag and attribute filtering used for request input

Fixes

* The optional confirmation step for deleting notifications works again
* Deleting a user rank or avatar that no longer exists shows an error instead of a fatal error
* Uploading an image to a database-stored category reports a failed upload instead of stopping with a fatal error
* The TinyMCE 5 and 7 image managers no longer double-encode their target field
* Errors that were silenced with @ (cache, avatar and debug clean-up, session start-up, upgrade-script clean-up) are now handled or reported

The full list is in docs/changelog.270.txt.

Upgrading

From 2.7.4 RC 1

Copy the new files over the web root. There are no database changes since RC 1, so the upgrade wizard is not required (running it does no harm).
* A Protector admin form that was open during the upgrade must be reloaded once
* xoops_data/data must stay writable: the new cache-id key is created there on first use

From XOOPS 2.7.3 or a 2.7.4 beta

Copy the new files over the web root and run the upgrade wizard. It creates the user_2fa table and the two-factor preference, registers the SCEditor emoticons as smileys, adds the Editors preferences, and updates the System module. No mainfile.php changes are needed.
* Two-factor authentication needs the PHP sodium extension; the wizard reports whether it is available. Operations notes are in docs/2fa-operations.md
* Every remembered device logs in once more after the upgrade
* An upgraded site keeps its current editor settings; SCEditor becomes the default only on a fresh install
* If you copied extras/login.php elsewhere on your site, replace or remove that copy
* A site running a custom template set should re-import it

System requirements

* PHP 8.2 to 8.5
* MySQL 5.7+ or MariaDB 10.3+
* The PHP sodium extension for two-factor authentication

Translations

XOOPS is available in 37 community translations at github.com/XoopsLanguages. RC 2 adds two English strings for the database dump in the System module's maintenance page; docs/lang_diff.txt lists every new constant in 2.7.4. Translators, thank you: updated packs are very welcome before the final release.

Reporting issues

Please report bugs at github.com/XOOPS/XoopsCore27/issues, with your PHP and MySQL versions and the steps to reproduce. Questions are welcome in the support forums.

Thank you
Thank you to everyone who tested RC 1, reported issues, submitted pull requests (including the documentation and typo fixes from peter279k), translated strings and reviewed security findings. And a standing thank-you to JetBrains for the complimentary PhpStorm licenses that power the core team's development.

The XOOPS Development Team

XOOPS 2.7.4-RC1 Released

Sat, 26 Sep 2026 04:50:00 +0000

XOOPS 2.7.4 RC 1 — two-factor authentication and a new editor experience

The XOOPS Development Team is pleased to announce XOOPS 2.7.4 RC 1, the release candidate for XOOPS 2.7.4. This release brings two-factor authentication into the core, makes SCEditor a full visual editor and the default for new sites, adds Markdown support through EasyMDE, and continues the security hardening of the 2.7 line.

The feature set is final. Please test this release candidate on a staging copy of your site and report anything you find before the final release.

DOWNLOAD: https://github.com/XOOPS/XoopsCore27/releases

Two-factor authentication

* Two methods: a time-based authenticator app (Google Authenticator, Microsoft Authenticator, Aegis, FreeOTP, or any password manager that generates TOTP codes), or a six-digit code mailed to the member's address
* Recovery codes: ten one-time codes at enrolment, for the day the phone or the mailbox is out of reach
* Lockout: five wrong codes lock the second step for fifteen minutes, and the member is notified by e-mail
* Self-service: members enrol, disable and replace their recovery codes from Edit Account; administrators can reset a member's factor from Users, and an operator locked out of the site has a documented recovery procedure
* Off by default: switch it to "Optional" in System Preferences and every member may enrol; nobody is forced
* Protected at rest: authenticator secrets are encrypted with a site key; mailed codes are stored hashed and expire after ten minutes

Editors

* SCEditor edits visually with its full toolbar and keeps XOOPS BBCode intact across visual and source modes. Its emoticons are registered as XOOPS smileys, and new installs use it as the default editor
* System > Preferences > Editors configures SCEditor's toolbar buttons, plugins, emoticons, resizing, auto-expand, spellcheck, size and the image category for dropped images
* Markdown through EasyMDE: Markdown is stored in the existing text columns and rendered with Parsedown in safe mode; the editor preview uses the same renderer
* More BBCode: MyTextSanitizer renders the tags SCEditor writes: sub, sup, s (strikethrough), justify, hr, ol and table
* TinyMCE 7.9.3: the bundled TinyMCE 7 is updated to the current 7.x release, which carries three content-sanitisation fixes

Security hardening

* Remember-me tokens are revoked when the password changes, including a lost-password reset
* A restored session ends for a deactivated account, and group membership is read from the database on every request, so a removed group right takes effect immediately
* Registration validates the account again at the save step, not only at the first step
* Comment editing and deletion check that the comment belongs to the module handling the request
* The TinyMCE image manager checks category permissions for upload, delete and listing, as the core image manager does
* The upgrade wizard admits webmasters only
* The LDAP and Active Directory adapters stop when a requested StartTLS connection fails, instead of continuing without it
* Editor output is tightened: BBCode attributes and rendered Markdown are restored only where they belong, and SCEditor's visual view checks link schemes

Fixes
* The upgrade wizard reports a patch task that cannot complete, instead of re-queuing it silently, and no longer re-queues the 2.5.10-to-2.5.11 patch on every run
* The Modern admin theme shows its redirect notifications again, in light, dark and right-to-left layouts
* The Administration Menu link in the user block is shown only to administrators
* Several legacy classes load again on PHP 8: the tar and zip downloaders, the XML-RPC parser, and XoopsTpl::fetchFromData()
* An unknown user ID in the users admin shows a message instead of an error page, and logout works on sites with remember-me turned off

Changed since Beta 2:

* the editor work (SCEditor, the Editors preferences, Markdown),
* the upgrade wizard fix,
* the Modern theme notifications,
* the user-block fix,
* the PHP 8 legacy-class fixes,
* translatable upgrade-wizard messages are new in RC 1.
* the System module moves to 2.1.13; the upgrade wizard applies it.

Upgrading from 2.7.3

Copy the new files over the web root and run the upgrade wizard. It creates the user_2fa table and the two-factor preference, registers the SCEditor emoticons as smileys, and adds the Editors preferences. No mainfile.php changes are needed.
* Two-factor authentication needs the PHP sodium extension; the wizard reports whether it is available. Operations notes are in docs/2fa-operations.md
* Every remembered device logs in once more after the upgrade
* An upgraded site keeps its current editor settings; SCEditor becomes the default only on a fresh install. For SCEditor's MP3 button, set 'mp3' => 1 in xoops_data/configs/textsanitizer/config.php
* If you copied extras/login.php (the SSL popup login) elsewhere on your site, replace or remove that copy: updating the core does not patch it
* A site running a custom template set should re-import it

From a 2.7.4 beta: copy the new files and run the upgrade wizard again; it applies the RC 1 changes and updates the System module.

System requirements

PHP 8.2 to 8.5, MySQL 5.7+ or MariaDB 10.3+, and the PHP sodium extension for two-factor authentication.

Translations

XOOPS is available in 37 community translations at https://github.com/XoopsLanguages. XOOPS 2.7.4 adds English strings for two-factor authentication, the Editors preferences, SCEditor and the upgrade wizard; docs/lang_diff.txt lists every new constant. Translators, thank you: updated packs are very welcome before the final release.

Reporting issues

Please report bugs at https://github.com/XOOPS/XoopsCore27/issues with your PHP and MySQL versions and the steps to reproduce. Questions are welcome in the support forums.

Thank you to everyone who tested the betas, reported issues, submitted pull requests, translated strings and reviewed security findings during the 2.7.4 cycle. And a standing thank-you to JetBrains for the complimentary PhpStorm licenses that power the core team's development.

The XOOPS Development Team