XOOPS 2.7.4 Final

2.7.4 went through Beta 1, Beta 2, RC 1 and RC 2 between September and October. Final collects everything from that cycle plus the fixes made since RC 2. There are no new features since RC 2.

Two-factor authentication in the core
Every member can protect their account with a second step at login.
* Two methods: a time-based authenticator app (Google Authenticator, Microsoft Authenticator, Aegis, FreeOTP, or any password manager that generates TOTP codes), or a six-digit code mailed to the member's address
* Recovery codes: ten one-time codes at enrolment, for the day the phone or the mailbox is out of reach. Members can replace them from Edit Account
* Lock-out protection: five wrong codes lock the second step for fifteen minutes and the member is notified by e-mail
* Administrators can reset a member's factor from the Users page, and an operator locked out of the site has a documented escape hatch in docs/2fa-operations.md
* Off by default: switch it to "Optional" in System Preferences and every member may enrol. Nobody is forced
* Secrets are encrypted at rest with a site key. Mailed codes are stored hashed and expire after ten minutes. Remember-me cookies are bound to the enrolled factor, so a reset invalidates them
* Every login path that cannot show a challenge (the upgrade wizard, XML-RPC, the SSL popup) refuses an account that must present its factor

Editors
* SCEditor is now a full visual editor: it edits with its complete toolbar and keeps XOOPS BBCode intact across visual and source modes. Its emoticons are registered as XOOPS smileys. It is the default editor for new installs; an upgraded site keeps its current editor settings
* Markdown support: EasyMDE stores Markdown in the existing text columns and MyTextSanitizer renders it with Parsedown in safe mode, so modules get Markdown without a schema change
* New Editors preference category in System Preferences for toolbar and editor settings
* MyTextSanitizer renders the tags SCEditor's toolbar writes: [sub], [sup], [s], [justify], [ol] and tables
* TinyMCE 7 is updated to 7.9.3

Security hardening
The cycle included a review of the core with CodeQL, Snyk, SonarCloud, Scrutinizer and manual audits. The main results:
* Form security tokens no longer depend on the browser's User-Agent: a token is a random value compared in constant time, so a browser update or a privacy extension between opening and submitting a form no longer rejects it. Protector's admin pages use the same core token
* One same-site check for every redirect: login, post-login and theme-switch return addresses refuse targets written with backslashes, encoded slashes, HTML entities or embedded line breaks
* Remember-me tokens are revoked when the password changes, and a restored session ends for a deactivated account
* Registration is validated at the save step, not only at step 1, and a comment must belong to the requesting module on edit, save and delete
* Uploads are deleted only inside the upload directory: the image manager and the smilies, rank and avatar admin pages resolve a stored file name before they delete it. The TinyMCE image manager checks category permissions on upload and delete
* Protected database dumps are written only under XOOPS_VAR_PATH, into a directory guarded by a deny-all .htaccess
* Cache ids use a random site key instead of the database credentials, and the installer renames itself and its cleanup script with random names
* LDAP and Active Directory fail closed when StartTLS was requested and failed
* Server configuration: xoops_lib/.htaccess works on Apache 2.4 without mod_access_compat, PHPMailer's unused OAuth helper is removed from the vendor tree, and reCAPTCHA v2 verifies over POST so the secret key stays out of server logs
* Confirmation pages, error lists and the SQL built by the legacy XoopsTopic and XoopsTree helpers are escaped and quoted

Since RC 2
* XMF 1.3.3: proxy headers (proxy_env) are honoured only when the direct peer is listed in the new proxy_trusted setting, as addresses or CIDR ranges. Sites that set proxy_env must add proxy_trusted in xoops_data/configs/xoopsconfig.php; until then the peer address is used. Forwarded headers are parsed per RFC 7239
* image.php no longer crashes on PHP 8.3+ when an angle is requested
* LDAP and Active Directory logins on PHP 8.3+ no longer emit a deprecation, and a bare IPv6 server address is handled
* Values stored as XOBJ_DTYPE_UNICODE_ARRAY reload as the array that was stored. Values such as café or a+b lost characters before
* The |replace and |escape modifiers no longer emit PHP 8.6 deprecations, and templates can use |sprintf without a Smarty notice
* Library refresh: HTML Purifier 4.19.1, Monolog 3.12.1, Smarty 4.5.8, TCPDF 6.11.4, symfony/var-dumper and symfony/yaml 7.4.21, firebase/php-jwt 7.2.1, Punic 3.8.2, webmozart/assert 2.5.0

The full list is in docs/changelog.270.txt.

Upgrading to 2.7.4
From 2.7.4 RC 2: copy the new files over the web root. There are no database changes since RC 2, so the upgrade wizard is not required. If your site sets proxy_env, add proxy_trusted as described above.

From XOOPS 2.7.3 or a 2.7.4 beta: copy the new files over the web root and run the upgrade wizard. It creates the user_2fa table and the two-factor preference, registers the SCEditor emoticons as smileys, adds the Editors preferences and updates the System module. No mainfile.php changes are needed.
* Two-factor authentication needs the PHP sodium extension; the wizard reports whether it is available
* Every remembered device logs in once more after the upgrade
* If you copied extras/login.php elsewhere on your site, replace or remove that copy
* A site running a custom template set should re-import it

From 2.5.11 or earlier: follow the XOOPS Install and Upgrade Guide: https://xoops.gitbook.io/xoops-install-upgrade/ - run upgrade/preflight.php first; 2.7 moved to Smarty 4 and some older themes need changes.

System requirements
* PHP 8.2 to 8.5
* MySQL 5.7+ or MariaDB 10.3+
* The PHP sodium extension for two-factor authentication