XOOPS 2.7.4 RC 1 — two-factor authentication and a new editor experience

The XOOPS Development Team is pleased to announce XOOPS 2.7.4 RC 1, the release candidate for XOOPS 2.7.4. This release brings two-factor authentication into the core, makes SCEditor a full visual editor and the default for new sites, adds Markdown support through EasyMDE, and continues the security hardening of the 2.7 line.

The feature set is final. Please test this release candidate on a staging copy of your site and report anything you find before the final release.

DOWNLOAD: https://github.com/XOOPS/XoopsCore27/releases

Two-factor authentication

* Two methods: a time-based authenticator app (Google Authenticator, Microsoft Authenticator, Aegis, FreeOTP, or any password manager that generates TOTP codes), or a six-digit code mailed to the member's address
* Recovery codes: ten one-time codes at enrolment, for the day the phone or the mailbox is out of reach
* Lockout: five wrong codes lock the second step for fifteen minutes, and the member is notified by e-mail
* Self-service: members enrol, disable and replace their recovery codes from Edit Account; administrators can reset a member's factor from Users, and an operator locked out of the site has a documented recovery procedure
* Off by default: switch it to "Optional" in System Preferences and every member may enrol; nobody is forced
* Protected at rest: authenticator secrets are encrypted with a site key; mailed codes are stored hashed and expire after ten minutes

Editors

* SCEditor edits visually with its full toolbar and keeps XOOPS BBCode intact across visual and source modes. Its emoticons are registered as XOOPS smileys, and new installs use it as the default editor
* System > Preferences > Editors configures SCEditor's toolbar buttons, plugins, emoticons, resizing, auto-expand, spellcheck, size and the image category for dropped images
* Markdown through EasyMDE: Markdown is stored in the existing text columns and rendered with Parsedown in safe mode; the editor preview uses the same renderer
* More BBCode: MyTextSanitizer renders the tags SCEditor writes: sub, sup, s (strikethrough), justify, hr, ol and table
* TinyMCE 7.9.3: the bundled TinyMCE 7 is updated to the current 7.x release, which carries three content-sanitisation fixes

Security hardening

* Remember-me tokens are revoked when the password changes, including a lost-password reset
* A restored session ends for a deactivated account, and group membership is read from the database on every request, so a removed group right takes effect immediately
* Registration validates the account again at the save step, not only at the first step
* Comment editing and deletion check that the comment belongs to the module handling the request
* The TinyMCE image manager checks category permissions for upload, delete and listing, as the core image manager does
* The upgrade wizard admits webmasters only
* The LDAP and Active Directory adapters stop when a requested StartTLS connection fails, instead of continuing without it
* Editor output is tightened: BBCode attributes and rendered Markdown are restored only where they belong, and SCEditor's visual view checks link schemes

Fixes
* The upgrade wizard reports a patch task that cannot complete, instead of re-queuing it silently, and no longer re-queues the 2.5.10-to-2.5.11 patch on every run
* The Modern admin theme shows its redirect notifications again, in light, dark and right-to-left layouts
* The Administration Menu link in the user block is shown only to administrators
* Several legacy classes load again on PHP 8: the tar and zip downloaders, the XML-RPC parser, and XoopsTpl::fetchFromData()
* An unknown user ID in the users admin shows a message instead of an error page, and logout works on sites with remember-me turned off

Changed since Beta 2:

* the editor work (SCEditor, the Editors preferences, Markdown),
* the upgrade wizard fix,
* the Modern theme notifications,
* the user-block fix,
* the PHP 8 legacy-class fixes,
* translatable upgrade-wizard messages are new in RC 1.
* the System module moves to 2.1.13; the upgrade wizard applies it.

Upgrading from 2.7.3

Copy the new files over the web root and run the upgrade wizard. It creates the user_2fa table and the two-factor preference, registers the SCEditor emoticons as smileys, and adds the Editors preferences. No mainfile.php changes are needed.
* Two-factor authentication needs the PHP sodium extension; the wizard reports whether it is available. Operations notes are in docs/2fa-operations.md
* Every remembered device logs in once more after the upgrade
* An upgraded site keeps its current editor settings; SCEditor becomes the default only on a fresh install. For SCEditor's MP3 button, set 'mp3' => 1 in xoops_data/configs/textsanitizer/config.php
* If you copied extras/login.php (the SSL popup login) elsewhere on your site, replace or remove that copy: updating the core does not patch it
* A site running a custom template set should re-import it

From a 2.7.4 beta: copy the new files and run the upgrade wizard again; it applies the RC 1 changes and updates the System module.

System requirements

PHP 8.2 to 8.5, MySQL 5.7+ or MariaDB 10.3+, and the PHP sodium extension for two-factor authentication.

Translations

XOOPS is available in 37 community translations at https://github.com/XoopsLanguages. XOOPS 2.7.4 adds English strings for two-factor authentication, the Editors preferences, SCEditor and the upgrade wizard; docs/lang_diff.txt lists every new constant. Translators, thank you: updated packs are very welcome before the final release.

Reporting issues

Please report bugs at https://github.com/XOOPS/XoopsCore27/issues with your PHP and MySQL versions and the steps to reproduce. Questions are welcome in the support forums.

Thank you to everyone who tested the betas, reported issues, submitted pull requests, translated strings and reviewed security findings during the 2.7.4 cycle. And a standing thank-you to JetBrains for the complimentary PhpStorm licenses that power the core team's development.

The XOOPS Development Team