XOOPS 2.7.4 Beta 1 — session and comment hardening

The XOOPS Development Team announces XOOPS 2.7.4 Beta 1, a security-focused update to the 2.7 line. It closes seven authorisation and session gaps found in a review of the 2.7.3 core, updates the bundled TinyMCE 7 to a release with content-sanitisation fixes, and repairs an upgrade-wizard fault that could stall a site on an old patch. XOOPS 2.7.4 runs on PHP 8.2 through 8.5.

DOWNLOAD: You can download the release from here: https://github.com/XOOPS/XoopsCore27/releases


Ready for PHP 8.6

* Complete session save-handler contract: create_sid() ahead of its PHP 9.0 requirement, new sessions survive 8.6's updateTimestamp() routing, session.use_strict_mode pinned to the 8.6 default today
* Deprecations cleared ahead of time: constructor value-returns (guarded by a repository-wide test), is_long(), curl_close(), imagedestroy()

Security hardening

- Remember-me tokens are revoked when the password changes. The token now carries a keyed fingerprint of the stored password hash. A password change through any path, a lost-password reset included, invalidates every earlier token. Sessions restored from the session store are unaffected. (#194)
- Deactivated accounts lose their sessions. A restored session ends when the account is inactive, whether it came from the session store or the remember-me cookie, and group membership is resolved from the database on every request, so a demotion applies on the next request. (#188)
- Registration is validated at the save step. The step number is supplied by the client; the save step now requires that step 1 passed in this session and re-validates the identity values it is about to insert. (#187)
- Comments belong to their module. Editing, saving and deleting a comment now require it to belong to the module whose endpoint received the request, so an administrator of one module cannot act on another module's comments. (#189, #196)
- The TinyMCE image manager checks category permissions. Upload requires write access to the selected category, delete requires write access to the image's own category, and listing requires read access, as the core image manager already required. (#186)
- The upgrade wizard is gated on webmaster membership at every entry point; two of them had accepted a module-level admin right that can be delegated. (#189)
- LDAP and Active Directory fail closed on a failed StartTLS instead of continuing to bind over the plain connection. (#189)

Editors

- TinyMCE 7 is updated from 7.9.2 to 7.9.3, which carries three content sanitisation fixes, one of them in the media plugin that the XOOPS settings enable. The bundled TinyMCE 5 stays at 5.10.9: its corresponding fix is not publicly distributed, so treat TinyMCE 5 as unpatched and prefer TinyMCE 7. (#193)

Fixes

- The upgrade wizard reports a stalled patch task instead of re-queuing it silently on every click, and shows no server paths while doing so. Sites stuck on the 2.5.11 patch with an undeletable index.html now see which files are affected. (#184)
- The users admin no longer fails with an undefined constant on an unknown user id. (#190)
- Logging out, or restoring a deactivated account, no longer fails on sites where remember-me is disabled. (#188, #195, #198)
- A registration flow that finished and then received a further request no longer fails in the step merge. (#187)

Language

- The ten front-end labels of the default system menu move from the admin language file to language/<lang>/menus/menus.php, the file the resolver tries first. Names and values are unchanged, so existing translations and seeded menu rows keep working. (#185)
- One constant is added; see docs/lang_diff.txt. (#190)

Upgrading

- No database changes. The upgrade wizard has nothing to apply for 2.7.3 to 2.7.4; replace the files and clear the cache as usual.
- Remembered logins issued before this release are rejected once: each remembered device signs in again one time and receives a token with the new claim.
- Translation packs need the moved menu labels only if they override them; the English values apply otherwise.

Upgrading from 2.7.2

XOOPS 2.7.3 includes schema changes, so after copying the new htdocs/ files over the web root, run the upgrade wizard. No mainfile.php changes are needed. Full documentation: https://xoops.github.io/xoops-docs/

System requirements

* PHP >= 8.2.0 (PHP 8.4 or 8.5 recommended, prepared for 8.6)
* MySQL >= 5.7.8 or MariaDB >= 10.5 (a supported MySQL 8.x or MariaDB LTS recommended)
* Apache 2.4+ or nginx

Translations

XOOPS 2.7.3 adds new English language constants: the SCEditor editor strings introduced in RC 1 and one logout-confirmation string added in Final — see docs/lang_diff.txt. XOOPS remains maintained in 37 community translations: https://github.com/XoopsLanguages

Thank you

Thank you to everyone who submitted pull requests, reported issues, tested the beta and RC packages, translated strings, and reviewed security findings throughout the 2.7.3 cycle.

A special thank-you to darkglobe-project and nikitakothari06 for testing the release candidates and reporting issues and bugs). Bug reports like these make XOOPS better for everyone.

We also thank JetBrains ( https://www.jetbrains.com/ ) for supporting the project with PhpStorm licenses.

Bug reports: https://github.com/XOOPS/XoopsCore27/issues
Support forums: https://xoops.org/modules/newbb/

The XOOPS Development Team