XOOPS Web Application System

XOOPS 2.7.3 Beta 1 Released

Tue, 28 Jul 2026 11:30:00 +0000

XOOPS 2.7.3 Beta 1 is available

XOOPS 2.7.3 Beta 1 is ready for testing. It pairs a set of stability and security fixes with new diagnostic tooling — a persistent, opt-in log that records what the in-page debug panel cannot.

Download: https://github.com/XOOPS/XoopsCore27/releases/tag/v2.7.3-Beta1

XOOPS 2.7.1 & 2.7.2 Language Packs Are Here — 38 Languages Ready to Download

Sat, 25 Jul 2026 23:10:00 +0000

XOOPS 2.7.1 & 2.7.2 Language Packs Are Here — 38 Languages Ready to Download

Great news for the XOOPS community: the official language packs for XOOPS 2.7.1 (work for XOOPS 2.7.2 too) are now available, refreshed and ready across 38 languages — from Arabic and Bosnian to Ukrainian, Urdu, and Vietnamese.

This release brings every core language pack in line with 2.7.1+, so no matter where your site lives, your admins and members can work in a language that feels like home. We're also thrilled to welcome a newly completed Gujarati (ગુજરાતી) translation — a full 100% core coverage, joining the family for the first time at this level.

Each pack is a drop-in match for the 2.7.1+ Core: consistent constants, clean UTF‑8, and validated against the English reference so you get a smooth, blank-screen-free experience out of the box.

Grab your language: Every pack lives in its own repository under the XoopsLanguages organization on GitHub, with a direct download for 2.7.1::

- Arabic
- Bosnian
- Brazilian
- Bulgarian
- Catalan
- Croatian
- Czech
- Danish
- Dutch
- English-Reference
- Finnish
- French
- Galician
- German
- Greek
- Gujarati
- Hebrew
- Hungarian
- Italian
- Japanese
- Korean
- Malaysian
- Norwegian
- Persian
- Polish
- Portuguese
- Romanian
- Russian
- Schinese
- Slovenian
- Spanish
- Swedish
- Tchinese
- Thai
- Turkish
- Ukrainian
- Urdu
- Vietnamese

Want to help? XOOPS is powered by its community, and translations are one of the best ways to give back. Spot something to improve, or want to bring your language to 100%? Head to the XoopsLanguages repositories and open a pull request — every string counts.

A huge thank-you to the XOOPS Translation Team and every contributor who made this release possible. Here's to making XOOPS the most welcoming CMS in the world — in every language. 🌍

XOOPS 2.7.2 Final Releaesed

Sat, 25 Jul 2026 11:30:00 +0000

XOOPS 2.7.2 FINAL RELEASE

The XOOPS Development Team is pleased to announce the release of XOOPS 2.7.2.

This maintenance release strengthens security and upgrade handling, adds form and theme improvements, refreshes bundled dependencies, and supports PHP 8.2 through PHP 8.5.

Download XOOPS 2.7.2: https://github.com/XOOPS/XoopsCore27/releases

For full documentation on installing or upgrading XOOPS please see: https://xoops.github.io/xoops-docs/

XOOPS ModuleInstaller 1.6.0 Speeds Multi-Module Testing and Development

Fri, 24 Jul 2026 15:30:00 +0000

ModuleInstaller 1.6.0 is the bulk admin tool that keeps multi-module XOOPS work practical—especially when you are building features, debugging integrations, or spinning up throwaway test setups.

Why it helps testers and developers

• Bulk install, update, activate, and deactivate — stop clicking through modules one by one when a stack changes.
• Module Sets + Focus — define a named subset (e.g. “billing stack”), activate only those modules, and park the rest without uninstalling. Snapshot first, restore when the test is done.
• Safer batch runs — missing folders and protected modules (system, ModuleInstaller) are skipped with clear reports instead of killing the whole job.
• Less friction on large sites — filter, select-all, sticky selection count, and “apply set” on bulk lists keep long module catalogs usable.
• Sample set included — load a ready PM + Profile + Protector set and start from a common baseline instead of rebuilding it by hand.

Requirements: XOOPS 2.7.0+, PHP 8.2+, mtools 1.2.0+ (installed; need not be active).

Ship fewer “which modules were on?” mysteries. Spend the time on the bug, not the admin clicks.

Download

ModuleInstaller: https://github.com/XoopsModules27x/moduleinstaller/

mTools: https://github.com/XoopsModules27x/mtools/

A full walkthrough is in the module’s docs/TUTORIAL.md and the project changelog.

XOOPS 2.7.1 Final Releaesed

Wed, 22 Jul 2026 22:40:00 +0000

XOOPS 2.7.1 FINAL RELEASE

The XOOPS Development Team is pleased to announce the release of XOOPS 2.7.1.

This maintenance release strengthens security and upgrade handling, adds form and theme improvements, refreshes bundled dependencies, and supports PHP 8.2 through PHP 8.5.

Download XOOPS 2.7.1: https://github.com/XOOPS/XoopsCore27/releases

For full documentation on installing or upgrading XOOPS please see: https://xoops.github.io/xoops-docs/

XOOPS Debugbar 1.3.0 released

Mon, 20 Jul 2026 16:40:00 +0000

XOOPS DebugBar 1.3.0 Is Here: Smarter Diagnostics, Safer Debugging, Faster Development

XOOPS DebugBar 1.3.0 delivers administrator-only diagnostics, performance analytics, query and N+1 detection, protected logs, system checks, and optional profiling integrations for XOOPS 2.7.1+ The release strengthens security with bounded sanitization, CSRF protection, signed read-only EXPLAIN requests, and safer diagnostic rendering, while adding numerous usability and reliability improvements. Existing installations should run the XOOPS module update after upgrading.

DOWNLOAD: https://github.com/XoopsModules27x/debugbar/releases/

XOOPS 2.7.1 RC1 is here

Wed, 08 Jul 2026 14:33:17 +0000

XOOPS 2.7.1-RC1 Released for Testing First release candidate for XOOPS 2.7.1. The 2.7.1 line is now feature-complete; from here only blocker fixes are expected before the final release. Please test upgrades and report anything unexpected. DOWNLOAD: https://github.com/XOOPS/XoopsCore27/releases What's Changed Security hardening • Tightened SQL identifier and ORDER BY handling across Criteria, kernel/block, and the system admin pages. • Required a security token on the upgrade apply-patch path; SQL dumps now live outside the web root and the download is gated. • Protector now inspects queryF() in its database-layer wrapper; the ModuleAdmin index menu output is escaped; module language files are loaded by basename only. • Added CAPTCHA and a persistent per-IP rate limit to the tell-a-friend form. • The upgrade wizard login now requires administrator-group membership. Dependency refresh • xoops/xmf updated to v1.3.1-RC1 (write paths migrated from queryF() to exec()). • Bundled xoops/helpers ^1.0, xoops/smartyextensions ^1.3 (adds QR support), tecnickcom/tcpdf ^6.10. • composer update sweep: php-debugbar 3.8.0, Smarty 4.5.7, symfony/var-dumper and symfony/yaml 7.4.14, webmozart/assert 2.4.1. What's Changed in 2.7.1 Beta • fix: preserve TinyMCE 7 language locale casing by @masskrdjn in #72 • docs(changelog): regenerate CHANGELOG.md by @github-actions[bot] in #70 • chore(sonar): scope S115/S3011 out of test sources by @mambax7 in #74 • test(editor): isolate the TinyMCE7 language test by @mambax7 in #75 • fix(system): hydrate module fields when cloning a block (#73) by @mambax7 in #77 • fix(editor): map XOOPS locale to TinyMCE 7 pack code (#76) by @mambax7 in #78 • chore(deps): bump SonarSource/sonarqube-scan-action from 8.0.0 to 8.1.0 by @dependabot[bot] in #79 • chore(deps): bump codecov/codecov-action from 6.0.0 to 6.0.1 by @dependabot[bot] in #80 • improve(core): consolidate theme-config normalisation across runtime readers by @mambax7 in #81 • 2.7.1 updates by @mambax7 in #82 • chore(deps): bump postcss from 8.5.8 to 8.5.15 in /htdocs/themes/xtailwind2 by @dependabot[bot] in #83 • fix(theme/default): keep inline rich text baseline aligned by @mambax7 in #84 • chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @dependabot[bot] in #85 • chore(deps): bump postcss from 8.5.8 to 8.5.15 in /htdocs/themes/xtailwind by @dependabot[bot] in #86 • feat(form): add XoopsFormTabTray tabbed widget + themed renderers by @mambax7 in #87 • refactor(form): introduce XoopsFormContainerInterface for container contract by @mambax7 in #90 • refactor(form): adopt XoopsFormContainerInterface in XoopsForm + foreach-by-ref container iteration by @mambax7 in #91 • Security/hardening pass by @mambax7 in #92 • chore(deps): bump codecov/codecov-action from 6.0.1 to 7.0.0 by @dependabot[bot] in #93 • chore(deps): bump SonarSource/sonarqube-scan-action from 8.1.0 to 8.2.0 by @dependabot[bot] in #94 • chore(deps): bump shivammathur/setup-php from 2.37.1 to 2.37.2 by @dependabot[bot] in #95 • Upgrade tool: Smarty 4→5 readiness gate, 2.7.0→2.7.1 step, and hardening by @mambax7 in #96 • add SmartyExtensions by @mambax7 in #97 • ci(codecov): make patch coverage informational by @mambax7 in #99 • Fix/profile search active filter by @mambax7 in #98 • dark-mode for xbootstrap5/xswatch5/xtailwind2 + register smartyextensions by @mambax7 in #100 • Chore/security tooling by @mambax7 in #101 • chore(phpstan): mark gitignored vendor excludePaths as optional by @mambax7 in #103 • chore(coderabbit): align test review instruction with PHPUnit ^11.2 by @mambax7 in #104 • Security: medium-tier hardening pass (pass 2) by @mambax7 in #102 • Security: medium/low defence-in-depth hardening (pass 3) by @mambax7 in #105 New Contributors • @masskrdjn made their first contribution in #72 Thank you!!!!

New XOOPS 2.7.0 Documentation in Development

Tue, 28 Apr 2026 16:20:00 +0000

We started developing new XOOPS 2.7.0 documentation:

https://xoops.github.io/xoops-docs/

Currently following languages are available:

• English,
• Arabic,
• French,
• German,
• Italian,
• Polish,
• Portuguese,
• Russian,
• Spanish, and
• Traditional Chinese

I'm sure that there are tons of translation errors, so please help us in fixing them!

EDIT: New translations have been added :

• Chinese Simplified
• Croatian
• Czech
• Danish
• Dutch
• Greek
• Hebrew
• Hindi
• Hungarian
• Indonesian
• Japanese
• Malaysian
• Persian
• Slovenian
• Thai
• Turkish
• Ukrainian
• Vietnamese

You can help us by:

a) fixing the translations,
b) adding new languages
c) improving the flow of the documentation

You can fork the documentation from here:

https://github.com/XOOPS/xoops-docs

xPages

Sat, 18 Apr 2026 05:50:00 +0000

xPages - Advanced Static Page Management Module for XOOPS xPages is a professional static page management module developed for XOOPS 2.7.0 and above. It makes content management easier with its user-friendly interface and powerful features.

XOOPS 2.7.0 RC5 is here

Fri, 10 Apr 2026 16:10:00 +0000

UPDATE: XOOPS 2.7.0-RC5 Released for Testing

DOWNLOAD: https://github.com/XOOPS/XoopsCore27/releases

What's Changed

• chore(deps): bump actions/cache from 5.0.4 to 5.0.5 by @dependabot[bot] in #22
• show section for system services always, after controlpanel by @ggoffy in #21
• normalize profile and session indexes for 2.7.0 by @mambax7 in #23
• TinyMCE default config was not actually loading the full plugin set. by @mambax7 in #24
• the /install folder is deleted after installation, so we can't call d… by @mambax7 in #25
• SonarQube settings update by @mambax7 in #26
• fix(install): add menusitems FK during fresh install for schema parity (#9) by @mambax7 in #27
• RC-scoped 3.6.4 fixes for PHP 8, dblayertrap, and filter loading by @mambax7 in #28
• fix for skipping index normalisation on profile_field.field_name, if … by @mambax7 in #29
• Setting utf8mb4 as a default by @mambax7 in #30
• fix(xbootstrap5): load runtime scripts in the right order by @mambax7 in #31

Full Changelog: v2.7.0-RC4...v2.7.0-RC5

XOOPS 2.7.0 RC1 — A New Chapter

The XOOPS Development Team is pleased to announce XOOPS 2.7.0 Release Candidate 1.

Quote:
Why the version jump? The cumulative changes since 2.5.11 — PHP 8.2 as the new baseline, Smarty 4, a new admin theme, a rewritten system menu, aggressive security hardening, and a rebuilt dependency chain — far exceeded a patch release. Betas 1–8 published as 2.5.12 remain in the changelog under their original numbers for historical accuracy.

Download RC1: https://github.com/XOOPS/XoopsCore27/releases

This is a release candidate intended for testing only. Use in a production system is not without risks.

Headline Changes

Modern PHP

PHP 7.x support is dropped. PHP 8.2 is the new minimum; CI runs against 8.2, 8.3, 8.4, and 8.5 on every commit. Dead code for older PHP versions is removed, session handlers are consolidated, and the installer enforces the 8.2.0 minimum.

Smarty 4

The template engine moves from the ancient forked Smarty 2 to Smarty 4.5.5. Sites with old Smarty 2 syntax need a review before upgrading. The bundled le="color: #000000"><?php upgrade/preflight.php scanner identifies outdated themes and module templates before you begin.

New Admin Theme: Modern

XOOPS 2.7.0 ships Modern, the first major admin UI refresh in years. The existing Transition theme continues to work. System admin themes gain a template overload capability for customisation without patching core files.

System Menu — Rebuilt Clean-Room

Custom site navigation is now a first-class admin feature. Inspired by MyMenus module by Trabis and work done by Mage, the system menu module is fully rewritten with new tables, controller, templates, CSRF protection, permission handling, cycle detection, and depth limits. Manage categories, items, display order, icons, and per-group permissions from System Admin.

Four New Front-End Theme Platforms

• xSwatch5 — Bootstrap 5.3.8, successor to xSwatch4. Drop in, pick a Bootswatch variant, done.
• xBootstrap5 — Pure Bootstrap 5 reference theme, kept in sync with upstream.
• xTailwind — Tailwind CSS + DaisyUI (35 palettes) + Alpine.js, with a new XoopsFormRendererTailwind so forms render natively without overrides.
• xTailwind2 — Art-directed sibling of xTailwind with curated palettes and stronger visual hierarchy.

Security Hardening

• CSRF tokens on all module admin AJAX requests — previously some GET-based toggle handlers had no token validation.
• SameSite + Secure session cookies are now admin-configurable (Lax/Strict/None) with secure-by-default values.
• eval() removed from core. DB-stored PHP blocks are retired; file-based PHP blocks still work. Protector's lifecycle files also purged of eval().
• unserialize() audit — every core call now uses ['allowed_classes' => false], blocking PHP object injection.
• Protector hardened — proper exec() override, input validation on table prefixes, safe badips file handling, failure-aware admin actions.
• XSS sweep — all SonarCloud-flagged reflected-data paths escaped.
• Open redirect fix — URL scheme check decodes HTML entities before matching, checks scheme only, and is whitelist-based.
• Directory traversal — filename allowlists call basename() before the character check.
• Multibyte validation — form length checks use mb_strlen() throughout; CJK/Arabic/emoji no longer over-count.
• Password comparisons use strict === and hash_equals() throughout.
• Request::getInt() Elvis pitfall fixed — 0 no longer silently falls back.

Form & UI Fixes

• XoopsFormTextDateSelect — renders genuinely empty when stored value is 0 instead of defaulting to today's date.
• DHTML editor image width — strict regex replaces permissive parseInt, so real widths are preserved.
• Required-field asterisks (*) now render correctly in module admin forms.
• Breadcrumbs and xoAdminIcons are consistent across all system admin pages.
• PM recipient pickers filter by module access permission.
• PM delete confirmation UX improved with centred popups and xBootstrap5 templates.

Developer Changes

Dependencies Inlined

The external xoops/base-requires25 metapackage is removed. All dependencies are listed directly in le="color: #000000"><?php htdocs/xoops_lib/composer.dist.json.

Updated Libraries

• Bootstrap 5.3.8
• Font Awesome 7.1.0
• Smarty 4.5.5
• HTML Purifier 4.19.0
• PhpMailer 6.12.0 (moved to /xoops_lib/)
• jQuery UI 1.14.1
• TinyMCE 7.9.2 (new default) + 5.10.9 (legacy, retained)
• tablesorter 2.32.0
• jquery.form 4.3.1
• jGrowl 1.4.10

Database Layer

• queryF() deprecated — use exec() for writes/DDL, query() for SELECTs.
• quoteString() deprecated — use quote().
• XoopsDatabase declares error(), errorno(), and query() as abstract methods.
• Criteria IN clauses accept arrays safely.
• All fetch calls require the two-part isResultSet() + instanceof \mysqli_result guard.

Observability

XoopsLogger now supports a composite logger pattern — PSR-3 and Debugbar receive raw messages with context rather than pre-formatted strings, opening the door to structured logging.

Legacy Cleanup

• PSR-12 throughout; legacy @package / @subpackage / @category PHPDoc tags removed.
• pda.php handler deleted.
• Direct-access guards use http_response_code(404) instead of bare exit().
• htmlSpecialChars() wrapper calls replaced with native htmlspecialchars().
• browse.php now serves source maps for JS/CSS files.

Tests & CI

• PHPUnit 11 with #[Test] / #[CoversClass] attribute syntax throughout.
• SonarCloud, Qodana, Scrutinizer, and CodeRabbit integrated into the PR workflow.
• CI now runs the real XOOPS test suite — the silent placeholder test is gone.

RTL Support

XOOPS 2.7.0 adds right-to-left language support at core level. Arabic, Hebrew, Persian, and Urdu sites now get proper directional rendering in admin and theme templates.

System Requirements

• PHP >= 8.2.0 (8.4+ strongly recommended)
• MySQL >= 8.0 (8.4+ strongly recommended)
• Web server: Apache 2.4+ or nginx

Upgrading from 2.5.x

Supported upgrade path from 2.5.11. Sites older than 2.5.11 should upgrade there first.

• Back up site files and database.
• Enable debugging; set site offline via System → Preferences → General.
• Copy le="color: #000000"><?php /upgrade/ into your XOOPS root.
• Run le="color: #000000"><?php /upgrade/preflight.php — fix flagged items, repeat until clean.
• Copy new le="color: #000000"><?php htdocs/ contents over your web root.
• Copy le="color: #000000"><?php htdocs/xoops_lib/ and le="color: #000000"><?php htdocs/xoops_data/ to their configured locations.
• Browse to le="color: #000000"><?php /upgrade/ and step through the prompts.
• Update the system, pm, profile, and protector modules from System → Modules.
• Turn your site back on.

The upgrade script handles: removing legacy HTMLPurifier and PhpMailer locations, creating the le="color: #000000"><?php tokens table, widening le="color: #000000"><?php bannerclient.passwd, and inserting the new session cookie preferences.

After upgrading, install or update the Protector module. It adds intrusion detection, SQL inspection, and request logging, and received material hardening in this release.

This is a Release Candidate

This is a release candidate intended for testing only. Use in a production system is not without risks.

The feature set is complete and is now fixed for 2.7.0. Only bug fixes will be accepted.

• Bug reports: github.com/XOOPS/XoopsCore27/issues
• Support forums: xoops.org/modules/newbb/
• Contributing: CONTRIBUTING.md

Please download from the current master!

If you are downloading this release for testing, please download from the current master instead.

Any bugs that have been found and fixed will be included in your testing that way, so we all won't keep finding and reporting the same bug over and over.

You can grab the current master here: https://github.com/XOOPS/XoopsCore25/archive/master.zip

Full Changelog: v2.7.0-RC1

Thank You

Thank you to everyone who submitted pull requests, reported issues, tested betas, translated strings, reviewed security findings, and kept the conversation going on the forums and GitHub.

Special thanks to new contributors since Beta 8: @koreus, @CHCCD, and عبدالعزيز الجهني.

Standing thanks to JetBrains for complimentary PhpStorm licenses.

For the complete change list see le="color: #000000"><?php docs/changelog.270.txt. For the language-constant diff see le="color: #000000"><?php docs/lang_diff.txt.

Download XOOPS 2.7.0 RC1: https://github.com/XOOPS/XoopsCore27/releases

The XOOPS Development Team
April 2026