Headlines
| XOOPS Web Application System | ||
|---|---|---|
|
Updated | Fri, 09 Oct 2026 15:44:09 +0000 |
| Description | Powered by You! | |
| Webmaster | webmaster@xoops.org( XOOPS Web Application System ) | |
| Category | Publisher | |
| Generator | Publisher | |
| Language | en | |
| XOOPS 2.5.11.1 - security update for XOOPS 2.5.11 | ||
| Published: | Fri, 09 Oct 2026 03:30:00 +0000 | |
| Description: | XOOPS 2.5.11.1 — security update for XOOPS 2.5.11 The XOOPS Development Team has released XOOPS 2.5.11.1, a security update for XOOPS 2.5.11. It changes only the input filter that XOOPS uses on request data. If your site runs XOOPS 2.5.11, please apply it. DOWNLOAD: https://github.com/XOOPS/XoopsCore25/releases/tag/v2.5.11.1 What's fixed XOOPS 2.5.11 bundles the XMF library, and its input filter (Xmf\FilterInput, which XoopsFilterInput builds on) now includes the fixes from XMF 1.2.32.1: * Filtering always finishes: some input made the filter run until PHP hit its memory limit, so one request could take a page down. A value that does not settle after a fixed number of passes is now dropped. (GHSA-8j4x-8r8r-5jgw) * Stricter tag and attribute checks: some tag and attribute patterns got through the filter. Tag and attribute names are now checked strictly, event-handler attributes are matched whatever their case, link schemes are checked after HTML entities are decoded, and stripped text keeps no partial tag. (GHSA-pf53-59r5-mhjv) There are no database, template or language changes, and no new features. The fix keeps PHP 5.6 compatibility, so 2.5.11.1 runs on the same servers as 2.5.11. How to update From XOOPS 2.5.11 (recommended: the patch) 1. Download xoops-2.5.11-to-2.5.11.1-patch.zip from the release page 2. Back up your site files 3. Copy the contents of the zip's htdocs folder over your XOOPS root folder (the one that holds mainfile.php), keeping the folder paths. Two files are replaced: class/libraries/vendor/xoops/xmf/src/FilterInput.php include/version.php4. That's it. You don't need to run the upgrade wizard. System Admin now shows XOOPS 2.5.11.1-Stable New install, or a version older than 2.5.11 Use the full package (the source code zip on the release page) and follow the usual install or upgrade steps. XOOPS 2.7 XOOPS 2.7.4 RC 2 already includes the same fixes through XMF 1.3.2. If you are planning a move to the 2.7 line, see github.com/XOOPS/XoopsCore27/releases. Reporting issues Please report problems at github.com/XOOPS/XoopsCore25/issues, with your PHP and MySQL versions. Security issues should be reported privately, as described in the repository's SECURITY.md, not in a public issue. Questions are welcome in the support forums. Thank you Thank you to the researchers who reported these issues responsibly and to everyone who reviewed and tested the fixes. And a standing thank-you to JetBrains for the complimentary PhpStorm licenses that power the core team's development. The XOOPS Development Team more... |
|
| XOOPS 2.7.4-RC2 Released | ||
| Published: | Tue, 06 Oct 2026 15:00:00 +0000 | |
| Description: | XOOPS 2.7.4 RC 2 — security hardening ahead of the final release The XOOPS Development Team is pleased to announce XOOPS 2.7.4 RC 2, the second release candidate for XOOPS 2.7.4. RC 2 adds no new features. It collects the security hardening and bug fixes made since RC 1, after a review of the core with CodeQL, Snyk, SonarCloud, Scrutinizer and manual audits. XOOPS 2.7.4 brings two-factor authentication into the core, makes SCEditor a full visual editor and the default for new sites, and adds Markdown support through EasyMDE. It runs on PHP 8.2 through 8.5. Please test RC 2 on a staging copy of your site and report anything you find. Unless something serious turns up, the next release is 2.7.4 Final. DOWNLOAD: https://github.com/XOOPS/XoopsCore27/releases What's new since RC 1 Forms and redirects * Form security tokens no longer depend on the browser's User-Agent: a token is now a random value compared in constant time. A browser update, a privacy extension or a "desktop site" toggle between opening and submitting a form no longer rejects it. Forms opened before the upgrade still submit * Protector uses the core form token: its admin pages check the same token as the rest of XOOPS. XoopsGTicket is deprecated and now wraps the core token, so modules that still call it keep working * One same-site check for redirects: login, post-login and theme-switch return addresses share one check. It refuses targets written with backslashes, encoded slashes, HTML entities or embedded line breaks, and sends them to the home page instead * Escaped confirmation pages and error lists: xoops_confirm() escapes every field, value and label, and the object and login error lists are escaped too Files and storage * Uploads are deleted only inside the upload directory: the image manager and the smilies, user-rank and avatar admin pages resolve a stored file name before they delete it * Protected database dumps: a dump is written only under XOOPS_VAR_PATH, into a directory guarded by a deny-all .htaccess and private to the PHP user * Cache ids use a site key: the group part of theme and block cache ids is keyed with a random site key in xoops_data/data instead of the database credentials * Random installer names: the installer renames itself and names its cleanup script with random_bytes(). Only the installing session can finish the clean-up * Protector writes its ban files atomically and rejects an uploaded image it cannot inspect instead of staging it in uploads/ Server configuration * xoops_lib/.htaccess works on Apache 2.4 without mod_access_compat, where the old rules returned a 500 error instead of denying access * PHPMailer's unused OAuth helper is removed from the bundled vendor tree, and a Composer script removes it again after every vendor refresh * reCAPTCHA v2 verifies over POST, so the secret key no longer appears in proxy or server logs * The bundled XMF library is updated to 1.3.2, which tightens the tag and attribute filtering used for request input Fixes * The optional confirmation step for deleting notifications works again * Deleting a user rank or avatar that no longer exists shows an error instead of a fatal error * Uploading an image to a database-stored category reports a failed upload instead of stopping with a fatal error * The TinyMCE 5 and 7 image managers no longer double-encode their target field * Errors that were silenced with @ (cache, avatar and debug clean-up, session start-up, upgrade-script clean-up) are now handled or reported The full list is in docs/changelog.270.txt. Upgrading From 2.7.4 RC 1 Copy the new files over the web root. There are no database changes since RC 1, so the upgrade wizard is not required (running it does no harm). * A Protector admin form that was open during the upgrade must be reloaded once * xoops_data/data must stay writable: the new cache-id key is created there on first use From XOOPS 2.7.3 or a 2.7.4 beta Copy the new files over the web root and run the upgrade wizard. It creates the user_2fa table and the two-factor preference, registers the SCEditor emoticons as smileys, adds the Editors preferences, and updates the System module. No mainfile.php changes are needed. * Two-factor authentication needs the PHP sodium extension; the wizard reports whether it is available. Operations notes are in docs/2fa-operations.md * Every remembered device logs in once more after the upgrade * An upgraded site keeps its current editor settings; SCEditor becomes the default only on a fresh install * If you copied extras/login.php elsewhere on your site, replace or remove that copy * A site running a custom template set should re-import it System requirements * PHP 8.2 to 8.5 * MySQL 5.7+ or MariaDB 10.3+ * The PHP sodium extension for two-factor authentication Translations XOOPS is available in 37 community translations at github.com/XoopsLanguages. RC 2 adds two English strings for the database dump in the System module's maintenance page; docs/lang_diff.txt lists every new constant in 2.7.4. Translators, thank you: updated packs are very welcome before the final release. Reporting issues Please report bugs at github.com/XOOPS/XoopsCore27/issues, with your PHP and MySQL versions and the steps to reproduce. Questions are welcome in the support forums. Thank you Thank you to everyone who tested RC 1, reported issues, submitted pull requests (including the documentation and typo fixes from peter279k), translated strings and reviewed security findings. And a standing thank-you to JetBrains for the complimentary PhpStorm licenses that power the core team's development. The XOOPS Development Team more... |
|
| XOOPS 2.7.4-RC1 Released | ||
| Published: | Sat, 26 Sep 2026 04:50:00 +0000 | |
| Description: | XOOPS 2.7.4 RC 1 — two-factor authentication and a new editor experience The XOOPS Development Team is pleased to announce XOOPS 2.7.4 RC 1, the release candidate for XOOPS 2.7.4. This release brings two-factor authentication into the core, makes SCEditor a full visual editor and the default for new sites, adds Markdown support through EasyMDE, and continues the security hardening of the 2.7 line. The feature set is final. Please test this release candidate on a staging copy of your site and report anything you find before the final release. DOWNLOAD: https://github.com/XOOPS/XoopsCore27/releases Two-factor authentication * Two methods: a time-based authenticator app (Google Authenticator, Microsoft Authenticator, Aegis, FreeOTP, or any password manager that generates TOTP codes), or a six-digit code mailed to the member's address * Recovery codes: ten one-time codes at enrolment, for the day the phone or the mailbox is out of reach * Lockout: five wrong codes lock the second step for fifteen minutes, and the member is notified by e-mail * Self-service: members enrol, disable and replace their recovery codes from Edit Account; administrators can reset a member's factor from Users, and an operator locked out of the site has a documented recovery procedure * Off by default: switch it to "Optional" in System Preferences and every member may enrol; nobody is forced * Protected at rest: authenticator secrets are encrypted with a site key; mailed codes are stored hashed and expire after ten minutes Editors * SCEditor edits visually with its full toolbar and keeps XOOPS BBCode intact across visual and source modes. Its emoticons are registered as XOOPS smileys, and new installs use it as the default editor * System > Preferences > Editors configures SCEditor's toolbar buttons, plugins, emoticons, resizing, auto-expand, spellcheck, size and the image category for dropped images * Markdown through EasyMDE: Markdown is stored in the existing text columns and rendered with Parsedown in safe mode; the editor preview uses the same renderer * More BBCode: MyTextSanitizer renders the tags SCEditor writes: sub, sup, s (strikethrough), justify, hr, ol and table * TinyMCE 7.9.3: the bundled TinyMCE 7 is updated to the current 7.x release, which carries three content-sanitisation fixes Security hardening * Remember-me tokens are revoked when the password changes, including a lost-password reset * A restored session ends for a deactivated account, and group membership is read from the database on every request, so a removed group right takes effect immediately * Registration validates the account again at the save step, not only at the first step * Comment editing and deletion check that the comment belongs to the module handling the request * The TinyMCE image manager checks category permissions for upload, delete and listing, as the core image manager does * The upgrade wizard admits webmasters only * The LDAP and Active Directory adapters stop when a requested StartTLS connection fails, instead of continuing without it * Editor output is tightened: BBCode attributes and rendered Markdown are restored only where they belong, and SCEditor's visual view checks link schemes Fixes * The upgrade wizard reports a patch task that cannot complete, instead of re-queuing it silently, and no longer re-queues the 2.5.10-to-2.5.11 patch on every run * The Modern admin theme shows its redirect notifications again, in light, dark and right-to-left layouts * The Administration Menu link in the user block is shown only to administrators * Several legacy classes load again on PHP 8: the tar and zip downloaders, the XML-RPC parser, and XoopsTpl::fetchFromData() * An unknown user ID in the users admin shows a message instead of an error page, and logout works on sites with remember-me turned off Changed since Beta 2: * the editor work (SCEditor, the Editors preferences, Markdown), * the upgrade wizard fix, * the Modern theme notifications, * the user-block fix, * the PHP 8 legacy-class fixes, * translatable upgrade-wizard messages are new in RC 1. * the System module moves to 2.1.13; the upgrade wizard applies it. Upgrading from 2.7.3 Copy the new files over the web root and run the upgrade wizard. It creates the user_2fa table and the two-factor preference, registers the SCEditor emoticons as smileys, and adds the Editors preferences. No mainfile.php changes are needed. * Two-factor authentication needs the PHP sodium extension; the wizard reports whether it is available. Operations notes are in docs/2fa-operations.md * Every remembered device logs in once more after the upgrade * An upgraded site keeps its current editor settings; SCEditor becomes the default only on a fresh install. For SCEditor's MP3 button, set 'mp3' => 1 in xoops_data/configs/textsanitizer/config.php * If you copied extras/login.php (the SSL popup login) elsewhere on your site, replace or remove that copy: updating the core does not patch it * A site running a custom template set should re-import it From a 2.7.4 beta: copy the new files and run the upgrade wizard again; it applies the RC 1 changes and updates the System module. System requirements PHP 8.2 to 8.5, MySQL 5.7+ or MariaDB 10.3+, and the PHP sodium extension for two-factor authentication. Translations XOOPS is available in 37 community translations at https://github.com/XoopsLanguages. XOOPS 2.7.4 adds English strings for two-factor authentication, the Editors preferences, SCEditor and the upgrade wizard; docs/lang_diff.txt lists every new constant. Translators, thank you: updated packs are very welcome before the final release. Reporting issues Please report bugs at https://github.com/XOOPS/XoopsCore27/issues with your PHP and MySQL versions and the steps to reproduce. Questions are welcome in the support forums. Thank you to everyone who tested the betas, reported issues, submitted pull requests, translated strings and reviewed security findings during the 2.7.4 cycle. And a standing thank-you to JetBrains for the complimentary PhpStorm licenses that power the core team's development. The XOOPS Development Team more... |
|
| ModuleTools 1.5 for XOOPS 2.8.0 | ||
| Published: | Tue, 22 Sep 2026 05:30:00 +0000 | |
| Description: | ModuleTools: the shared toolbox every XOOPS 2.8.0 module now gets for free If you have ever built a XOOPS module, you know the ritual. Copy a class/Common/ folder from the last module. Paste in the install helpers, the version checks, the admin table code, the confirmation dialog, the breadcrumb builder. Fix the namespace. Hope nothing drifted since the last copy. With XOOPS 2.8, that ritual is over. ModuleTools ships inside XOOPS 2.8.0 Core as Xoops\ModuleTools\*, autoloaded on every request. There is nothing to install, nothing to activate, and no helper module to keep in sync. Your module just calls it. What is in the box ModuleTools is the successor to the mTools helper module, rebuilt as a proper library. It gathers the services modules used to carry as copied files: * Install and update hooks. Directory checks, file checks, dependency and version guards, sample-data buttons, and an update checker that reads your GitHub releases. * Admin pages in minutes. Object tables, tree tables, single-record views, CSV export, and a controller that handles create, edit, delete and uploads from one form definition. * Objects and forms. A dynamic object base with SEO fields and a form builder that turns your handler's metadata into a ready XoopsThemeForm. * Front-end helpers. Breadcrumbs, letter navigation, pagination, text truncation with intact HTML, social bookmarks, syntax highlighting, image resizing. * Permissions. Per-item group permissions with a clean gateway, so your module never writes to the permission table by hand. * Module lifecycle. A ModuleContext value object for paths, URLs and constants, a namespace autoloader that also understands legacy filenames, and a cloner that turns one module into the starting point for the next. Why it matters Less code to own. A typical converted module drops dozens of copied files. Fewer files means fewer places for a bug to hide and fewer places to patch when one is found. Security fixes land once. When the confirmation dialog or the CSV export is hardened, every module on the site gets the fix on the next Core update. No module release required. Modern PHP, tested. The library targets PHP 8.4, passes PHPStan at level 6, and ships a growing PHPUnit suite that includes consumer tests run against real modules inside a XOOPS tree. No migration cliff. Existing modules keep working. ModuleTools registers lazy aliases for the stable XoopsModules\Mtools\* names, so a module written for the mTools module runs on 2.8 unchanged. When you are ready, the migration guide walks through swapping copied classes for library calls, and a Rector rule set does most of the typing. Still there for 2.7. Sites on XOOPS 2.7.x keep the separately distributed mTools module with the same class names. Write against the API once and it runs on both. Getting started On XOOPS 2.8 the library is already loaded. In a module, grab your XMF helper and go: use XmfModuleHelper; use XoopsModuleToolsModuleModuleContext; $helper = Helper::getHelper('mymodule'); $ctx = ModuleContext::fromHelper($helper); $ctx->uploadPath('images'); For standalone development, composer require xoops/moduletools brings in the same package with its stubs and test suite. The full walkthrough lives in docs/getting-started.md, and docs/migrating-a-module.md covers converting an existing module. Try it on your next module, or on the one you have been meaning to clean up, and let us know what you build. PACKAGIST: https://packagist.org/packages/xoops/moduletools INSTALLATION: composer require xoops/moduletools more... |
|
| XOOPS Plugin for PhpStorm 1.0 Alpha 3 Released | ||
| Published: | Tue, 22 Sep 2026 05:30:00 +0000 | |
| Description: | XOOPS Support Plugin for PhpStorm: Alpha 3 is here PhpStorm finally speaks XOOPS. XOOPS Support 1.0.0 Alpha 3 teaches the IDE the conventions that used to live only in our heads: language constants, xoops_version.php, the <{ }> Smarty delimiters, the isResultSet guard, the direct-access guard. The result is fewer round trips to the browser, fewer "why is this blank" moments, and cleaner modules on the first commit. DOWNLOAD / INSTALLATION: Install it from the JetBrains Marketplace: plugins.jetbrains.com/plugin/33478 What you get Ctrl+B on language constants. Put the cursor on _MI_, _AM_, _MD_, _CO_ or _MB_ and jump straight to its define(), with language/english/ preferred. Find Usages works the other way round. Completion now reads every file under language/, not a fixed list, so your own catalogs are covered. Templates that match the manifest. Two inspections keep xoops_version.php and the templates/ folder in sync. A registered template that is missing on disk is flagged, and so is a .tpl on disk that was never registered. Both come with a one-click fix: create the file, or append the manifest entry. Ten inspections with Alt+Enter fixes. Missing defined('XOOPS_ROOT_PATH') || exit guard, fetchArray() without isResultSet(), query() used for a write, the deprecated queryF() / quoteString(), XOBJ_DTYPE_UNICODE_* (deprecated since 2.7.3), raw $_GET / $_POST / $_REQUEST, bare {if} instead of <{if}>, and include where include_once belongs. Each one explains why in its description and fixes itself with a keystroke. A site-wide Overview. The XOOPS Support tool window scans the whole install in the background, lists every module with its template, language, preload and class counts, and turns every finding into a clickable file:line. Cancel works, and it stays idle until you press Refresh. Core-version aware. Tell the plugin whether the project targets 2.5, 2.7 or 4.0 and the inspections adjust. The UNICODE deprecation, for example, stays quiet on a 2.5 LTS project. What changed in Alpha 3 This release grew out of real field reports on production modules, and every fix has a test behind it. * Findings are no longer reported twice per file. * The isResultSet quick-fix applies cleanly in an Inspect Code batch, and an early-exit guard now covers while (list(...) = $db->fetchRow($result)). * The direct-access guard understands namespaced files, die as well as exit, short <? tags and multiple declare statements, and inserts after namespace where PHP requires it. Entry points, admin/ scripts and 404 stubs are left alone. * Block templates in templates/blocks/ registered by bare name, the ['template'] = '…' assignment style, and manifests with URLs in descriptions all parse correctly, so the Overview no longer shows phantom template findings. * Commented-out define() calls stay out of completion and navigation. * Your Core Version setting from Alpha 2 carries over. Try it * Install the plugin and open your XOOPS webroot in PhpStorm. * Open View → Tool Windows → XOOPS Support and press Refresh. * Open any module file and press Alt+Enter on a highlight. The full walkthrough is in the tutorial that ships with the plugin. Feedback and bug reports are welcome at github.com/XOOPS/phpstorm-plugin. more... |
|
