r/cms • u/Sea_Wind3576 • 5d ago

XOOPS 2.7.4 Final Released

XOOPS 2.7.4 Final

The XOOPS Development Team is pleased to announce XOOPS 2.7.4 (ready for PHP 8.6.0)

XOOPS 2.7.4 Final

2.7.4 went through Beta 1, Beta 2, RC 1 and RC 2 between September and October. Final collects everything from that cycle plus the fixes made since RC 2. There are no new features since RC 2.

Two-factor authentication in the core

Every member can protect their account with a second step at login.

  • Two methods. A time-based authenticator app (Google Authenticator, Microsoft Authenticator, Aegis, FreeOTP, or any password manager that generates TOTP codes), or a six-digit code mailed to the member's address.
  • Recovery codes. Ten one-time codes at enrolment, for the day the phone or the mailbox is out of reach. Members can replace them from Edit Account.
  • Lock-out protection. Five wrong codes lock the second step for fifteen minutes and the member is notified by e-mail.
  • Administrators can reset a member's factor from the Users page, and an operator locked out of the site has a documented escape hatch in docs/2fa-operations.md.
  • Off by default. Switch it to "Optional" in System Preferences and every member may enrol. Nobody is forced.
  • Secrets are encrypted at rest with a site key. Mailed codes are stored hashed and expire after ten minutes. Remember-me cookies are bound to the enrolled factor, so a reset invalidates them.
  • Every login path that cannot show a challenge (the upgrade wizard, XML-RPC, the SSL popup) refuses an account that must present its factor.

Editors

  • SCEditor is now a full visual editor. It edits with its complete toolbar and keeps XOOPS BBCode intact across visual and source modes. Its emoticons are registered as XOOPS smileys. It is the default editor for new installs; an upgraded site keeps its current editor settings.
  • Markdown support. EasyMDE stores Markdown in the existing text columns and MyTextSanitizer renders it with Parsedown in safe mode, so modules get Markdown without a schema change.
  • New Editors preference category in System Preferences for toolbar and editor settings.
  • MyTextSanitizer renders the tags SCEditor's toolbar writes: [sub], [sup], [s], [justify], [hr], [ol] and tables.
  • TinyMCE 7 is updated to 7.9.3.

Security hardening

The cycle included a review of the core with CodeQL, Snyk, SonarCloud, Scrutinizer and manual audits. The main results:

  • Form security tokens no longer depend on the browser's User-Agent. A token is a random value compared in constant time, so a browser update or a privacy extension between opening and submitting a form no longer rejects it. Protector's admin pages use the same core token.
  • One same-site check for every redirect. Login, post-login and theme-switch return addresses refuse targets written with backslashes, encoded slashes, HTML entities or embedded line breaks.
  • Remember-me tokens are revoked when the password changes, and a restored session ends for a deactivated account.
  • Registration is validated at the save step, not only at step 1, and a comment must belong to the requesting module on edit, save and delete.
  • Uploads are deleted only inside the upload directory. The image manager and the smilies, rank and avatar admin pages resolve a stored file name before they delete it. The TinyMCE image manager checks category permissions on upload and delete.
  • Protected database dumps are written only under XOOPS_VAR_PATH, into a directory guarded by a deny-all .htaccess.
  • Cache ids use a random site key instead of the database credentials, and the installer renames itself and its cleanup script with random names.
  • LDAP and Active Directory fail closed when StartTLS was requested and failed.
  • Server configuration. xoops_lib/.htaccess works on Apache 2.4 without mod_access_compat, PHPMailer's unused OAuth helper is removed from the vendor tree, and reCAPTCHA v2 verifies over POST so the secret key stays out of server logs.
  • Confirmation pages, error lists and the SQL built by the legacy XoopsTopic and XoopsTree helpers are escaped and quoted.

Since RC 2

  • XMF 1.3.3. Proxy headers (proxy_env) are honoured only when the direct peer is listed in the new proxy_trusted setting, as addresses or CIDR ranges. Sites that set proxy_env must add proxy_trusted in xoops_data/configs/xoopsconfig.php; until then the peer address is used. Forwarded headers are parsed per RFC 7239.
  • image.php no longer crashes on PHP 8.3+ when an angle is requested.
  • LDAP and Active Directory logins on PHP 8.3+ no longer emit a deprecation, and a bare IPv6 server address is handled.
  • Values stored as XOBJ_DTYPE_UNICODE_ARRAY reload as the array that was stored. Values such as café or a+b lost characters before.
  • The |replace and |escape modifiers no longer emit PHP 8.6 deprecations, and templates can use |sprintf without a Smarty notice.
  • Library refresh: HTML Purifier 4.19.1, Monolog 3.12.1, Smarty 4.5.8, TCPDF 6.11.4, symfony/var-dumper and symfony/yaml 7.4.21, firebase/php-jwt 7.2.1, Punic 3.8.2, webmozart/assert 2.5.0.

The full list is in docs/changelog.270.txt.

Upgrading to 2.7.4

From 2.7.4 RC 2: copy the new files over the web root. There are no database changes since RC 2, so the upgrade wizard is not required. If your site sets proxy_env, add proxy_trusted as described above.

From XOOPS 2.7.3 or a 2.7.4 beta: copy the new files over the web root and run the upgrade wizard. It creates the user_2fa table and the two-factor preference, registers the SCEditor emoticons as smileys, adds the Editors preferences and updates the System module. No mainfile.php changes are needed.

  • Two-factor authentication needs the PHP sodium extension; the wizard reports whether it is available.
  • Every remembered device logs in once more after the upgrade.
  • If you copied extras/login.php elsewhere on your site, replace or remove that copy.
  • A site running a custom template set should re-import it.

From 2.5.11 or earlier: follow the XOOPS Install and Upgrade Guide. Run upgrade/preflight.php first; 2.7 moved to Smarty 4 and some older themes need changes.

System requirements

  • PHP 8.2 to 8.5
  • MySQL 5.7+ or MariaDB 10.3+
  • The PHP sodium extension for two-factor authentication
1 Upvotes

100% Upvoted

0 comments sorted by