XOOPS 2.5.11.2

2.5.11.2 is a maintenance update for the 2.5 line, which many sites still run on older hosting. It contains no new features.

* PHP 7.4 is now the minimum version: PHP 5.6 to 7.3 are no longer supported. The installer, the module manifests and the documentation reflect this

* The bundled XMF library is updated to 1.2.33: the proxy_env header is honoured only when the direct peer is listed in the new proxy_trusted setting, documented in xoops_data/configs/xoopsconfig.dist.php. Sites that set proxy_env must add proxy_trusted; until then the peer address is used. Forwarded headers are parsed per RFC 7239, and Xmf\Database\Tables and Migrate handle CURRENT_TIMESTAMP defaults and unreadable tables correctly

* XMF's own dependencies follow: firebase/php-jwt 6.10, Kint 6.1, symfony/yaml 5.4, webmozart/assert 1.12. Smarty, HTML Purifier and the rest of the 2.5.11 set are unchanged

* No database, template or language changes

Upgrading to 2.5.11.2
Copy the new files over the web root. The upgrade wizard is not needed. Check that your server runs PHP 7.4 or later before you copy the files.

If you are still on 2.5.x, this is a good moment to plan the move to 2.7.4: the 2.5 line receives security updates only.

DOWNLOAD: https://github.com/XOOPS/XoopsCore25/releases/


XOOPS 2.7
XOOPS 2.7.4 already includes the same fixes through XMF 1.3.2. If you are planning a move to the 2.7 line, see github.com/XOOPS/XoopsCore27/releases.

Reporting issues
Please report problems at github.com/XOOPS/XoopsCore25/issues, with your PHP and MySQL versions. Security issues should be reported privately, as described in the repository's SECURITY.md, not in a public issue. Questions are welcome in the support forums.

Thank you
Thank you to the researchers who reported these issues responsibly and to everyone who reviewed and tested the fixes. And a standing thank-you to JetBrains for the complimentary PhpStorm licenses that power the core team's development.

The XOOPS Development Team