XOOPS 2.7.3 Final Released: PHP 8.6 readiness

The XOOPS Development Team is pleased to announce XOOPS 2.7.3 Final. This release hardens security across the core, prepares XOOPS for PHP 8.6 while remaining fully supported on PHP 8.2 through 8.5, adds SCEditor as an optional BBCode editor, introduces file-based debug configuration with a rotating file logger, and folds in a series of reliability fixes proven in production on xoops.org.

DOWNLOAD: You can download the release from here: https://github.com/XOOPS/XoopsCore27/releases


Ready for PHP 8.6
* Complete session save-handler contract: create_sid() ahead of its PHP 9.0 requirement, new sessions survive 8.6's updateTimestamp() routing, session.use_strict_mode pinned to the 8.6 default today
* Deprecations cleared ahead of time: constructor value-returns (guarded by a repository-wide test), is_long(), curl_close(), imagedestroy()

Security hardening
* Element values escaped in all five form renderers, with JavaScript arguments built via json_encode()
* Template-set browser and editor contained by the new shared PathGuard class — double-decode removed, NUL bytes rejected, symlink escapes refused, atomic backups — pinned by a truth-table test suite
* Logout now requires a session token: a bare GET renders a POST confirmation instead of ending the session (forced-logout CSRF closed); every existing logout link keeps working
* Redirect query strings are rebuilt through a shared, unit-tested helper instead of being reflected verbatim into Location headers (eight sites)
* image.php's never-functional remote-image branch (an SSRF and phar-deserialization surface) is closed and fails closed
* Module-manifest values escaped on the module admin pages; image category handlers now enforce authorization, not just CSRF

Editors
* SCEditor 3.2.1 ships bundled as an optional BBCode editor, deliberately locked to source mode so existing content never passes through a WYSIWYG round-trip
* One shared dhtml toolbar for all five renderers — no more different toolbars in the control panel and the front end

Debugging and logging
* File-based debug configuration in xoops_data/data/debug.php — error display, error_reporting, and query logging in one place, no mainfile.php edits; nothing changes until an administrator creates the file
* A rotating, redacting file logger records notices, warnings, errors and SQL with backtraces — server paths, session ids and session rows are redacted
* The error screen has one declared owner, so providers such as Whoops or Tracy no longer compete for the seat

Reliability fixes from production
* A failing module no longer takes global search down for every visitor; the "Show all" search pages render results again; search.php validates the request and respects module_read; browse.php sends a well-formed Cache-Control header
* xoops_getrank() no longer fatals when no rank row matches; a failed query returns the documented failure value instead of blanking the page
* Criteria renders an empty IN () list as a constant predicate instead of invalid SQL
* The group list is memoised per request (~48 identical queries removed per page) and a new comments index took a listing query from 541ms to 0.5ms

Deprecations
The XOBJ_DTYPE_UNICODE_* object datatypes are deprecated (notice only, behavior unchanged): they url-encode on write and url-decode on read, which bloats storage and breaks LIKE/FULLTEXT search on utf8mb4. Data migration is planned for 2.8, constant removal for 4.0.

Upgrading from 2.7.2
XOOPS 2.7.3 includes schema changes, so after copying the new htdocs/ files over the web root, run the upgrade wizard. No mainfile.php changes are needed. Full documentation: https://xoops.github.io/xoops-docs/

System requirements
* PHP >= 8.2.0 (PHP 8.4 or 8.5 recommended, prepared for 8.6)
* MySQL >= 5.7.8 or MariaDB >= 10.5 (a supported MySQL 8.x or MariaDB LTS recommended)
* Apache 2.4+ or nginx

Translations
XOOPS 2.7.3 adds new English language constants: the SCEditor editor strings introduced in RC 1 and one logout-confirmation string added in Final — see docs/lang_diff.txt. XOOPS remains maintained in 37 community translations: https://github.com/XoopsLanguages

Thank you
Thank you to everyone who submitted pull requests, reported issues, tested the beta and RC packages, translated strings, and reviewed security findings throughout the 2.7.3 cycle.

A special thank-you to CHCCD for testing the release candidates and reporting the search and browse bugs fixed in this release (issues #161, #162, #163). Bug reports like these make XOOPS better for everyone.

We also thank JetBrains ( https://www.jetbrains.com/ ) for supporting the project with PhpStorm licenses.

Bug reports: https://github.com/XOOPS/XoopsCore27/issues
Support forums: https://xoops.org/modules/newbb/

The XOOPS Development Team