3
XOOPS 2.7.1 Final — safer upgrades, stronger foundations
The XOOPS Development Team is pleased to announce XOOPS 2.7.1 Final. This maintenance release builds on XOOPS 2.7.0 with another security-hardening pass, more reliable upgrade tooling, form and theme improvements, and refreshed dependencies for current PHP environments.
Download XOOPS 2.7.1: https://github.com/XOOPS/XoopsCore27/releases
Highlights
Security and upgrade hardening
* The upgrade wizard now requires administrator-group membership, and the apply-patch path requires a valid security token.
* Upgrade SQL dumps are stored outside the public web root and their download path is access-controlled.
* SQL identifier and ORDER BY handling was tightened across Criteria, kernel blocks, and system administration.
* Protector's database wrapper now inspects queryF() calls, language-file loading is constrained to safe basenames, and module-administration output is escaped more consistently.
* The tell-a-friend form now uses CAPTCHA and persistent per-IP rate limiting.
These changes continue the secure-by-default work begun in XOOPS 2.7.0 while preserving compatibility with existing modules.
Forms, templates, and themes
* XoopsFormTabTray provides a native tabbed form container with theme-aware renderers.
* XoopsFormContainerInterface formalises the contract shared by form containers.
* SmartyExtensions are registered across the supplied themes.
* xBootstrap5, xSwatch5, and xTailwind2 include dark-mode support.
* TinyMCE 7 language mapping now preserves locale casing such as zh_TW and resolves the correct language-pack filename.
* Cloned blocks retain their module binding and validated callback fields.
Refreshed dependencies
The bundled dependency set has been refreshed, including php-debugbar 3.8.0, Smarty 4.5.7, Webmozart Assert 2.4.1, and Symfony VarDumper and YAML 7.4.14. XOOPS Helpers and TCPDF are now included directly, and SmartyExtensions was updated for QR-code support.
Debugbar is now a standalone module
The Debugbar module is no longer bundled in the XOOPS Core download. Moving the module to its own repository lets it publish fixes and improvements without waiting for a core release.
The underlying php-debugbar/php-debugbar library remains bundled in xoops_lib, so users do not need to run a separate Composer installation.
To install Debugbar:
* Download the current release from the XOOPS Debugbar releases page.
* Copy the included debugbar directory to htdocs/modules/debugbar.
* Install the module from System Admin → Modules.
If Debugbar is already installed, replace its module files with the standalone release and run Update in System Admin. Do not uninstall it first unless you intentionally want to remove its saved settings and profiles.
An overlay upgrade does not delete the old htdocs/modules/debugbar directory. Existing sites must replace those files explicitly so they do not continue running the older copy that was previously bundled with core.
The core Monolog adapter now exposes isActive() and accepts a fourth constructor argument for the default file handler's minimum log level, matching the standalone module's integration contract. It also supports Monolog 2 and 3 level handling and bounds or redacts sensitive file-log context.
Upgrading
From XOOPS 2.7.0
* Back up the database and site files.
* Test the upgrade on a staging copy first.
* Turn the site off from System Options → Preferences → General Settings.
* Copy the new htdocs/ files over the web root, including the updated xoops_lib and xoops_data contents for relocated directories.
* Copy /upgrade/ to the XOOPS root and run the upgrade wizard.
* Update the system, pm, profile, and protector modules from System Admin → Modules.
* Restore or update the standalone Debugbar module if the site uses it.
* Turn the site back on and review the logs.
From XOOPS 2.5.x
Sites older than XOOPS 2.5.11 should upgrade to 2.5.11 first. Run /upgrade/preflight.php before copying the 2.7.1 files; it identifies Smarty 4 template incompatibilities and other items that need attention before the main upgrade.
Full installation and upgrade documentation: https://xoops.github.io/xoops-docs/
System requirements
* PHP — >= 8.2.0; PHP 8.4 or 8.5 recommended
* MySQL / MariaDB — MySQL >= 5.7.8 or MariaDB >= 10.5; a supported MySQL 8.x or MariaDB LTS release is recommended
* Web server — Apache 2.4+ or nginx
Translations — 37 languages and counting
Beyond the English source, XOOPS is maintained in 37 community translations under the XoopsLanguages organization. Language packs are released independently; the current release page for every language is listed in docs/TRANSLATIONS.md.
XOOPS 2.7.1 adds one English language constant compared with 2.7.0: _AM_SYSTEM_BLOCKS_INVALID_CLONE. Translators can find its exact definition in docs/lang_diff.txt. No additional English constants changed between 2.7.1-RC1 and Final.
Please help review existing translations, report mistakes, or add a missing language. Every correction helps the whole community.
What changed since 2.7.1-RC1
* The Debugbar module moved to its standalone distribution while its supporting PHP library remained in core.
* XoopsMonologLogger gained the standalone module's required activation and minimum-level APIs, with direct core tests.
* Module About pages now render the safe subset of HTML used in changelog text.
* The SonarQube scan action was updated from 8.2.0 to 8.2.1.
For the complete release history, see docs/changelog.270.txt.
Reporting issues
* Bug reports: https://github.com/XOOPS/XoopsCore27/issues
* Support forums: https://xoops.org/modules/newbb/
* Contributing: https://github.com/XOOPS/XoopsCore27/blob/master/CONTRIBUTING.md
Thank you
Thank you to everyone who submitted pull requests, reported issues, tested the Beta and RC packages, translated strings, reviewed security findings, and helped other XOOPS users.
A special thank-you to the maintainers of the XOOPS modules, language packs, XMF, RegDom, and the wider dependency ecosystem.
We also thank JetBrains for supporting the project with PhpStorm licenses.
Download XOOPS 2.7.1: https://github.com/XOOPS/XoopsCore27/releases
The XOOPS Development Team
July 2026
XOOPS 2.7.1 Final — safer upgrades, stronger foundations
The XOOPS Development Team is pleased to announce XOOPS 2.7.1 Final. This maintenance release builds on XOOPS 2.7.0 with another security-hardening pass, more reliable upgrade tooling, form and theme improvements, and refreshed dependencies for current PHP environments.
Download XOOPS 2.7.1: https://github.com/XOOPS/XoopsCore27/releases
Highlights
Security and upgrade hardening
* The upgrade wizard now requires administrator-group membership, and the apply-patch path requires a valid security token.
* Upgrade SQL dumps are stored outside the public web root and their download path is access-controlled.
* SQL identifier and ORDER BY handling was tightened across Criteria, kernel blocks, and system administration.
* Protector's database wrapper now inspects queryF() calls, language-file loading is constrained to safe basenames, and module-administration output is escaped more consistently.
* The tell-a-friend form now uses CAPTCHA and persistent per-IP rate limiting.
These changes continue the secure-by-default work begun in XOOPS 2.7.0 while preserving compatibility with existing modules.
Forms, templates, and themes
* XoopsFormTabTray provides a native tabbed form container with theme-aware renderers.
* XoopsFormContainerInterface formalises the contract shared by form containers.
* SmartyExtensions are registered across the supplied themes.
* xBootstrap5, xSwatch5, and xTailwind2 include dark-mode support.
* TinyMCE 7 language mapping now preserves locale casing such as zh_TW and resolves the correct language-pack filename.
* Cloned blocks retain their module binding and validated callback fields.
Refreshed dependencies
The bundled dependency set has been refreshed, including php-debugbar 3.8.0, Smarty 4.5.7, Webmozart Assert 2.4.1, and Symfony VarDumper and YAML 7.4.14. XOOPS Helpers and TCPDF are now included directly, and SmartyExtensions was updated for QR-code support.
Debugbar is now a standalone module
The Debugbar module is no longer bundled in the XOOPS Core download. Moving the module to its own repository lets it publish fixes and improvements without waiting for a core release.
The underlying php-debugbar/php-debugbar library remains bundled in xoops_lib, so users do not need to run a separate Composer installation.
To install Debugbar:
* Download the current release from the XOOPS Debugbar releases page.
* Copy the included debugbar directory to htdocs/modules/debugbar.
* Install the module from System Admin → Modules.
If Debugbar is already installed, replace its module files with the standalone release and run Update in System Admin. Do not uninstall it first unless you intentionally want to remove its saved settings and profiles.
An overlay upgrade does not delete the old htdocs/modules/debugbar directory. Existing sites must replace those files explicitly so they do not continue running the older copy that was previously bundled with core.
The core Monolog adapter now exposes isActive() and accepts a fourth constructor argument for the default file handler's minimum log level, matching the standalone module's integration contract. It also supports Monolog 2 and 3 level handling and bounds or redacts sensitive file-log context.
Upgrading
From XOOPS 2.7.0
* Back up the database and site files.
* Test the upgrade on a staging copy first.
* Turn the site off from System Options → Preferences → General Settings.
* Copy the new htdocs/ files over the web root, including the updated xoops_lib and xoops_data contents for relocated directories.
* Copy /upgrade/ to the XOOPS root and run the upgrade wizard.
* Update the system, pm, profile, and protector modules from System Admin → Modules.
* Restore or update the standalone Debugbar module if the site uses it.
* Turn the site back on and review the logs.
From XOOPS 2.5.x
Sites older than XOOPS 2.5.11 should upgrade to 2.5.11 first. Run /upgrade/preflight.php before copying the 2.7.1 files; it identifies Smarty 4 template incompatibilities and other items that need attention before the main upgrade.
Full installation and upgrade documentation: https://xoops.github.io/xoops-docs/
System requirements
* PHP — >= 8.2.0; PHP 8.4 or 8.5 recommended
* MySQL / MariaDB — MySQL >= 5.7.8 or MariaDB >= 10.5; a supported MySQL 8.x or MariaDB LTS release is recommended
* Web server — Apache 2.4+ or nginx
Translations — 37 languages and counting
Beyond the English source, XOOPS is maintained in 37 community translations under the XoopsLanguages organization. Language packs are released independently; the current release page for every language is listed in docs/TRANSLATIONS.md.
XOOPS 2.7.1 adds one English language constant compared with 2.7.0: _AM_SYSTEM_BLOCKS_INVALID_CLONE. Translators can find its exact definition in docs/lang_diff.txt. No additional English constants changed between 2.7.1-RC1 and Final.
Please help review existing translations, report mistakes, or add a missing language. Every correction helps the whole community.
What changed since 2.7.1-RC1
* The Debugbar module moved to its standalone distribution while its supporting PHP library remained in core.
* XoopsMonologLogger gained the standalone module's required activation and minimum-level APIs, with direct core tests.
* Module About pages now render the safe subset of HTML used in changelog text.
* The SonarQube scan action was updated from 8.2.0 to 8.2.1.
For the complete release history, see docs/changelog.270.txt.
Reporting issues
* Bug reports: https://github.com/XOOPS/XoopsCore27/issues
* Support forums: https://xoops.org/modules/newbb/
* Contributing: https://github.com/XOOPS/XoopsCore27/blob/master/CONTRIBUTING.md
Thank you
Thank you to everyone who submitted pull requests, reported issues, tested the Beta and RC packages, translated strings, reviewed security findings, and helped other XOOPS users.
A special thank-you to the maintainers of the XOOPS modules, language packs, XMF, RegDom, and the wider dependency ecosystem.
We also thank JetBrains for supporting the project with PhpStorm licenses.
Download XOOPS 2.7.1: https://github.com/XOOPS/XoopsCore27/releases
The XOOPS Development Team
July 2026
5
XOOPS DebugBar 1.3.0 Is Here: Smarter Diagnostics, Safer Debugging, Faster Development
The XOOPS development experience just took another big step forward. XOOPS DebugBar 1.3.0 is now available for XOOPS 2.7, bringing developers and site administrators a more powerful, polished, and security-conscious way to understand what is happening inside their websites.
Built for PHP 8.2 and newer, XOOPS DebugBar adds an administrator-only diagnostics toolbar to rendered pages and pairs it with protected administration screens for performance analytics, logs, system diagnostics, and Xdebug profiles. The result is a practical command center that helps developers spot slow requests, repeated queries, configuration issues, and application errors without losing sight of security or usability.
Turn performance data into action
DebugBar 1.3.0 makes it easier to move from “this page feels slow” to a useful diagnosis. Its Analytics area brings together stored request profiles, slow URLs, repeated-query and N+1 candidates, per-module comparisons, performance-budget violations, flight-recorder snapshots, OPcache health, and available Xdebug profiles.
Teams can define budgets for slow requests, queries, resource use, and XOOPS bootstrap time, then use the collected evidence to focus optimization work where it matters most. Query logging modes and slow-query highlighting keep database investigations targeted, while the signed, read-only EXPLAIN workflow helps administrators inspect supported SELECT queries safely.
A clearer view of the whole XOOPS request
The browser toolbar puts essential request information close at hand, including database queries, timers, blocks, errors, Smarty data, and included files. A new practical guide helps developers and webmasters get productive quickly, while extension documentation explains how module authors can add their own instrumentation and collectors.
Optional integrations expand the toolkit without turning them into requirements. Monolog can provide structured file logging, Ray can receive forwarded diagnostics when available, Xdebug can create one-shot profiles, and OPcache statistics can reveal server health. xWhoops and Tracy remain capability-detected and optional, so their absence will not prevent DebugBar from loading.
Improved Security
Powerful diagnostics must be handled carefully, and security is a central theme of the 1.3.0 release. Toolbar output is restricted to authenticated administrators, administrative changes use XOOPS CSRF protection, and diagnostic values pass through bounded sanitization and redaction.
The release also introduces a dedicated protected signing key for EXPLAIN requests, stricter validation that accepts only a single read-only SELECT statement, safer rendering for dumped values and email previews, and allowlisted access to logs, profiles, and flight-recorder files. If an optional capability or required security resource is unavailable, DebugBar is designed to fail safely.
More dependable, more polished
Version 1.3.0 includes a wide range of fixes and refinements across AJAX behavior, editor links, mail previews, Server-Timing headers, dark-mode syntax highlighting, profile-table detection, Monolog storage fallback, and browser widgets. It also improves the accuracy of bootstrap measurements and repeated-query thresholds, while keeping collection-heavy features disabled or bounded by sensible defaults.
The module supports XOOPS 2.7.0 or newer and PHP 8.2 or newer, with compatibility coverage through PHP 8.5. Existing users should run the XOOPS module update after installing version 1.3.0 so the new preferences, protected EXPLAIN key, and refreshed browser assets are applied.
Whether you are building a module, tracking down an elusive error, or tuning a busy XOOPS site, DebugBar 1.3.0 gives you better evidence, faster answers, and greater confidence. Install or update the module, enable XOOPS Debug and the DebugBar toolbar for an administrator account, and start exploring what your site has been trying to tell you.
XOOPS DebugBar 1.3.0 Is Here: Smarter Diagnostics, Safer Debugging, Faster Development
The XOOPS development experience just took another big step forward. XOOPS DebugBar 1.3.0 is now available for XOOPS 2.7, bringing developers and site administrators a more powerful, polished, and security-conscious way to understand what is happening inside their websites.
Built for PHP 8.2 and newer, XOOPS DebugBar adds an administrator-only diagnostics toolbar to rendered pages and pairs it with protected administration screens for performance analytics, logs, system diagnostics, and Xdebug profiles. The result is a practical command center that helps developers spot slow requests, repeated queries, configuration issues, and application errors without losing sight of security or usability.
Turn performance data into action
DebugBar 1.3.0 makes it easier to move from “this page feels slow” to a useful diagnosis. Its Analytics area brings together stored request profiles, slow URLs, repeated-query and N+1 candidates, per-module comparisons, performance-budget violations, flight-recorder snapshots, OPcache health, and available Xdebug profiles.
Teams can define budgets for slow requests, queries, resource use, and XOOPS bootstrap time, then use the collected evidence to focus optimization work where it matters most. Query logging modes and slow-query highlighting keep database investigations targeted, while the signed, read-only EXPLAIN workflow helps administrators inspect supported SELECT queries safely.
A clearer view of the whole XOOPS request
The browser toolbar puts essential request information close at hand, including database queries, timers, blocks, errors, Smarty data, and included files. A new practical guide helps developers and webmasters get productive quickly, while extension documentation explains how module authors can add their own instrumentation and collectors.
Optional integrations expand the toolkit without turning them into requirements. Monolog can provide structured file logging, Ray can receive forwarded diagnostics when available, Xdebug can create one-shot profiles, and OPcache statistics can reveal server health. xWhoops and Tracy remain capability-detected and optional, so their absence will not prevent DebugBar from loading.
Improved Security
Powerful diagnostics must be handled carefully, and security is a central theme of the 1.3.0 release. Toolbar output is restricted to authenticated administrators, administrative changes use XOOPS CSRF protection, and diagnostic values pass through bounded sanitization and redaction.
The release also introduces a dedicated protected signing key for EXPLAIN requests, stricter validation that accepts only a single read-only SELECT statement, safer rendering for dumped values and email previews, and allowlisted access to logs, profiles, and flight-recorder files. If an optional capability or required security resource is unavailable, DebugBar is designed to fail safely.
More dependable, more polished
Version 1.3.0 includes a wide range of fixes and refinements across AJAX behavior, editor links, mail previews, Server-Timing headers, dark-mode syntax highlighting, profile-table detection, Monolog storage fallback, and browser widgets. It also improves the accuracy of bootstrap measurements and repeated-query thresholds, while keeping collection-heavy features disabled or bounded by sensible defaults.
The module supports XOOPS 2.7.0 or newer and PHP 8.2 or newer, with compatibility coverage through PHP 8.5. Existing users should run the XOOPS module update after installing version 1.3.0 so the new preferences, protected EXPLAIN key, and refreshed browser assets are applied.
Whether you are building a module, tracking down an elusive error, or tuning a busy XOOPS site, DebugBar 1.3.0 gives you better evidence, faster answers, and greater confidence. Install or update the module, enable XOOPS Debug and the DebugBar toolbar for an administrator account, and start exploring what your site has been trying to tell you.
7
Nice to see that xoops.org is back :)
In the meantime I had download 2.7.1 Beta from the GIT page alrady and did not counter any errors, keep up the good work !
In the meantime I had download 2.7.1 Beta from the GIT page alrady and did not counter any errors, keep up the good work !
8
Coming soon: fully rewritten PEDIGREE
This module will require mTools: https://github.com/mambax7/mtools to be installed
Coming soon: fully rewritten PEDIGREE
This module will require mTools: https://github.com/mambax7/mtools to be installed
10
Download: https://github.com/mambax7/quotes/
This module requires mTools: https://github.com/mambax7/mtools to be installed
Download: https://github.com/mambax7/quotes/
This module requires mTools: https://github.com/mambax7/mtools to be installed
Login
Search
Recent Posts
Donat-O-Meter
| Stats | |
| Goal: | $15.00 |
| Due Date: | Jul 31 |
| Gross Amount: | $0.00 |
| Net Balance: | $0.00 |
| Left to go: | $15.00 |
|
|