XOOPS 2.7.5 Beta 1 — maintenance release with a dark mode for the admin themes

The XOOPS Development Team is pleased to announce XOOPS 2.7.5 Beta 1, the first test release of XOOPS 2.7.5. It is a maintenance release: it collects the bug fixes and hardening made since XOOPS 2.7.4, adds a light/dark toggle to the Default and Transition admin themes, and updates the bundled XMF library. XOOPS 2.7.5 runs on PHP 8.2 through 8.5. This is a beta for testing: please try it on a copy of your site, not on a production site.

DOWNLOAD: https://github.com/XOOPS/XoopsCore27/releases

Admin themes: light and dark

1. Default and Transition have a light/dark toggle in the header that remembers your choice
2. Default adds dark styling for module panels, permission grids and SCEditor
3. The standalone Dark theme is removed; a site that had selected it loads Transition, where the header toggle switches dark mode on
4. The System section in the Modern theme's sidebar is hidden when the user has no system menu items

Fixes since 2.7.4

1. The media uploader accepts .webp images again, and reports only the current file's errors when a request names several upload fields
2. The theme selector block works again after a theme was chosen through a URL, and the admin redirect page renders in the theme it was built for
3. Editor forms stay within the content column across themes; SCEditor toolbars wrap, restored drafts open visually and image previews fit
4. The upgrade wizard no longer re-applies the 2.3.3-to-2.4.0 patch after 2.7.3, and its Smarty 4 template repair no longer quotes across two adjacent tags; it also restores templates damaged by earlier runs
5. Protector writes its sanitised request values back again, matches reliable IPs exactly or by subnet, counts every password login against the submitted user name, and never drops tables of the working prefix
6. Sign-in and sessions: an expired session is refused on every lookup, a remember-me login starts a fresh session ID, and LDAP and Active Directory sign-in refuses an empty password
7. Administrator permissions are tightened in the System and Profile user admin, the block admin and the module list; registration and profile edits can no longer write rank, post-count or credential columns
8. Text handling: automatic linking works only on text between tags, BBCode arguments cannot rewrite an earlier tag's attribute, and Markdown rendering bounds its work on untrusted text
9. image.php serves a picture with the type its content decodes as, limits the filters applied to an edited image and sends nosniff on every response
10. Uploads strip every inner executable extension, and the file cache refuses keys that contain a path

Bundled libraries
XMF 1.3.4 RC1, which tightens input filtering, safe serialization, search highlighting and database identifier quoting. Release notes: https://github.com/XOOPS/xmf/releases/tag/v1.3.4-RC1
symfony/yaml 7.4.23

For module developers
XMF 1.3.4 rejects some input that 1.3.3 accepted:

1. Xmf\Module\Helper\Session no longer stores or returns objects and enums; store scalars and arrays
2. Xmf\Security\Serializer rejects a stored object or enum unless its class is passed as allowed
3. HTML accepted through Xmf\Request with MASK_ALLOW_HTML keeps link and image addresses only when they are relative or use http, https or mailto; data:, tel: and ftp: addresses are removed
4. Xmf\Database\Tables::executeQueue() needs executeQueue(true) to write from a GET request
5. Xmf\Module\Helper::getHandler() accepts only letters, digits and _ in a handler name

Upgrading from 2.7.4
Copy the new files over the web root. There are no database changes since 2.7.4; running the upgrade wizard is harmless but not required.

1. If your site used the Dark admin theme, it now loads Transition; switch dark mode on with the toggle in the header. The leftover modules/system/themes/dark folder can be deleted
2. If you copied extras/login.php (the SSL popup login) somewhere on your site, replace that copy: updating the core does not patch it
3. A site running a custom template set should re-import it, as for any core template change

Upgrading from 2.7.3 or earlier
Copy the new files over the web root and run the upgrade wizard. From 2.7.3 it creates the user_2fa table and the two-factor preference, registers the SCEditor emoticons as smileys, and adds the Editors preferences. No mainfile.php changes are needed. Replace any copy of extras/login.php, because an older copy skips the two-factor step.

System requirements
PHP 8.2 to 8.5, MySQL 5.7+ or MariaDB 10.3+, and the sodium extension for two-factor authentication.

Thank you to everyone who tested 2.7.4 and reported issues. Report problems with this beta at https://github.com/XOOPS/XoopsCore27/issues