mambax7 · Oct 14, 2026 · Oct 14, 2026 · Oct 14, 2026
diff --git a/docs/changelog.270.txt b/docs/changelog.270.txt
@@ -7,6 +7,7 @@ Bug fixes:
 - templates can use |sprintf without a Smarty 4 deprecation notice: XoopsTpl registers sprintf as a modifier, as it already does for strstr, trim and file_exists (class/template.php) (#264)
 
 Libraries and assets:
+- update the bundled XMF library to 1.3.3: the proxy_env header is only honoured when the direct peer is listed in the new $xoopsConfig['proxy_trusted'] (addresses or CIDR ranges, documented in xoops_data/configs/xoopsconfig.dist.php) — sites that set proxy_env must add proxy_trusted, until then the peer address is used; Forwarded headers are parsed per RFC 7239; Xmf\Mail\SendmailRunner has a delivery timeout; Xmf\Database\Tables keeps CURRENT_TIMESTAMP defaults and refuses tables with functional index parts; Xmf\Security\Serializer accepts every legacy payload; Xmf\Jwt\TokenReader accepts Bearer tokens on custom headers again (xoops_lib/composer.dist.json, xoops_lib/vendor/xoops/xmf)
 - HTML Purifier 4.19.1, firebase/php-jwt 7.2.1, Monolog 3.12.1, Punic 3.8.2, Smarty 4.5.8, symfony/polyfill-mbstring 1.43.0, symfony/var-dumper 7.4.18, symfony/yaml 7.4.20, TCPDF 6.11.4, webmozart/assert 2.5.0 (xoops_lib/composer.dist.lock, xoops_lib/vendor) (#265)
 
 ===================================

diff --git a/htdocs/xoops_data/configs/xoopsconfig.dist.php b/htdocs/xoops_data/configs/xoopsconfig.dist.php
@@ -74,4 +74,14 @@
      * The default if proxy_env is not specified is no proxy ip address is considered.
      */
     //'proxy_env' => 'HTTP_FORWARDED',
+
+    /**
+     * proxy_trusted lists the proxy servers or load balancers allowed to set
+     * the proxy_env header. The header is only used when the direct peer
+     * (REMOTE_ADDR) is in this list; entries in the header that are trusted
+     * proxies are skipped, and the first untrusted address is the client.
+     * Accepts an array or a comma separated string of IP addresses and CIDR
+     * ranges. If proxy_trusted is not specified, the proxy_env header is ignored.
+     */
+    //'proxy_trusted' => ['10.0.0.1', '192.168.0.0/16', '2001:db8::/32'],
 ];
diff --git a/htdocs/xoops_lib/composer.dist.json b/htdocs/xoops_lib/composer.dist.json
@@ -33,7 +33,7 @@
     "xoops/helpers": "^1.0",
     "xoops/regdom": "^2.1.0",
     "xoops/smartyextensions": "^1.3",
-    "xoops/xmf": "^1.3.2"
+    "xoops/xmf": "^1.3.3"
   },
   "suggest": {
     "ext-sodium": "Required for two-factor enrolment and authenticator-code verification"

diff --git a/htdocs/xoops_lib/composer.dist.lock b/htdocs/xoops_lib/composer.dist.lock
@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "1519108191e313200e6a370e4888cec8",
+    "content-hash": "e1feffdc17804ff281ac1b93767049b8",
     "packages": [
         {
             "name": "boenrobot/money_format_polyfill",
@@ -1817,16 +1817,16 @@
         },
         {
             "name": "xoops/xmf",
-            "version": "v1.3.2",
+            "version": "v1.3.3",
             "source": {
                 "type": "git",
                 "url": "https://github.com/XOOPS/xmf.git",
-                "reference": "ca3d0cefff69c78e89355de6c706918a5677736d"
+                "reference": "503968036436a44b2fd32d90f3c9e6651b834ed9"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/XOOPS/xmf/zipball/ca3d0cefff69c78e89355de6c706918a5677736d",
-                "reference": "ca3d0cefff69c78e89355de6c706918a5677736d",
+                "url": "https://api.github.com/repos/XOOPS/xmf/zipball/503968036436a44b2fd32d90f3c9e6651b834ed9",
+                "reference": "503968036436a44b2fd32d90f3c9e6651b834ed9",
                 "shasum": ""
             },
             "require": {
@@ -1887,7 +1887,7 @@
                     "type": "opencollective"
                 }
             ],
-            "time": "2026-10-06T11:29:49+00:00"
+            "time": "2026-10-14T04:09:40+00:00"
         }
     ],
     "packages-dev": [],

diff --git a/htdocs/xoops_lib/vendor/composer/installed.json b/htdocs/xoops_lib/vendor/composer/installed.json
@@ -1886,17 +1886,17 @@
         },
         {
             "name": "xoops/xmf",
-            "version": "v1.3.2",
-            "version_normalized": "1.3.2.0",
+            "version": "v1.3.3",
+            "version_normalized": "1.3.3.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/XOOPS/xmf.git",
-                "reference": "ca3d0cefff69c78e89355de6c706918a5677736d"
+                "reference": "503968036436a44b2fd32d90f3c9e6651b834ed9"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/XOOPS/xmf/zipball/ca3d0cefff69c78e89355de6c706918a5677736d",
-                "reference": "ca3d0cefff69c78e89355de6c706918a5677736d",
+                "url": "https://api.github.com/repos/XOOPS/xmf/zipball/503968036436a44b2fd32d90f3c9e6651b834ed9",
+                "reference": "503968036436a44b2fd32d90f3c9e6651b834ed9",
                 "shasum": ""
             },
             "require": {
@@ -1912,7 +1912,7 @@
                 "roave/security-advisories": "dev-latest",
                 "squizlabs/php_codesniffer": "^3.11 || ^4.0"
             },
-            "time": "2026-10-06T11:29:49+00:00",
+            "time": "2026-10-14T04:09:40+00:00",
             "type": "library",
             "installation-source": "dist",
             "autoload": {

diff --git a/htdocs/xoops_lib/vendor/composer/installed.php b/htdocs/xoops_lib/vendor/composer/installed.php
@@ -3,7 +3,7 @@
         'name' => 'xoopscore27/libraries',
         'pretty_version' => 'dev-master',
         'version' => 'dev-master',
-        'reference' => '97110d0d50fbcd040dd05fe597861967b54e061d',
+        'reference' => '3b9bf84a8f6fe8b170148626b32942afc9088d0b',
         'type' => 'metapackage',
         'install_path' => __DIR__ . '/../../',
         'aliases' => array(),
@@ -260,9 +260,9 @@
             'dev_requirement' => false,
         ),
         'xoops/xmf' => array(
-            'pretty_version' => 'v1.3.2',
-            'version' => '1.3.2.0',
-            'reference' => 'ca3d0cefff69c78e89355de6c706918a5677736d',
+            'pretty_version' => 'v1.3.3',
+            'version' => '1.3.3.0',
+            'reference' => '503968036436a44b2fd32d90f3c9e6651b834ed9',
             'type' => 'library',
             'install_path' => __DIR__ . '/../xoops/xmf',
             'aliases' => array(),
@@ -271,7 +271,7 @@
         'xoopscore27/libraries' => array(
             'pretty_version' => 'dev-master',
             'version' => 'dev-master',
-            'reference' => '97110d0d50fbcd040dd05fe597861967b54e061d',
+            'reference' => '3b9bf84a8f6fe8b170148626b32942afc9088d0b',
             'type' => 'metapackage',
             'install_path' => __DIR__ . '/../../',
             'aliases' => array(),

diff --git a/htdocs/xoops_lib/vendor/xoops/xmf/src/Database/Migrate.php b/htdocs/xoops_lib/vendor/xoops/xmf/src/Database/Migrate.php
@@ -93,6 +93,8 @@ function ($match) {
      * @internal intended for module developers only
      *
      * @return int|false count of bytes written or false on error
+     *
+     * @throws \RuntimeException if a current table definition cannot be read
      */
     public function saveCurrentSchema()
     {
@@ -110,19 +112,43 @@ public function saveCurrentSchema()
     /**
      * get the current definitions
      *
+     * Module tables that do not exist are left out.
+     *
      * @return array
+     *
+     * @throws \RuntimeException if a table definition cannot be read
      */
     public function getCurrentSchema()
     {
         foreach ($this->moduleTables as $tableName) {
-            if (false === $this->tableHandler->useTable($tableName)) {
-                $this->tableHandler->addTable($tableName);
-            }
+            $this->loadCurrentTable($tableName);
         }
 
         return $this->tableHandler->dumpTables();
     }
 
+    /**
+     * Load the current definition of a module table into the table handler
+     *
+     * @param string $tableName table to load
+     *
+     * @return bool true if the table exists, false if it does not
+     *
+     * @throws \RuntimeException if the table definition cannot be read
+     */
+    protected function loadCurrentTable($tableName)
+    {
+        if ($this->tableHandler->useTable($tableName)) {
+            return true;
+        }
+        $error = $this->tableHandler->getLastError();
+        if (!empty($error)) {
+            throw new \RuntimeException(sprintf('Cannot read table %s: %s', $tableName, $error));
+        }
+
+        return false;
+    }
+
     /**
      * Return the target database condition
      *
@@ -149,6 +175,8 @@ public function getTargetDefinitions()
      * @param bool $force true to force updates even if this is a 'GET' request
      *
      * @return bool true if no errors, false if errors encountered
+     *
+     * @throws \RuntimeException if a current table definition cannot be read
      */
     public function synchronizeSchema($force = true)
     {
@@ -161,13 +189,15 @@ public function synchronizeSchema($force = true)
      * Compare target and current schema, building work queue in $this->migrate to synchronized
      *
      * @return string[] array of DDL/SQL statements to transform current to target schema
+     *
+     * @throws \RuntimeException if a current table definition cannot be read
      */
     public function getSynchronizeDDL()
     {
         $this->getTargetDefinitions();
         $this->preSyncActions();
         foreach ($this->moduleTables as $tableName) {
-            if ($this->tableHandler->useTable($tableName)) {
+            if ($this->loadCurrentTable($tableName)) {
                 $this->synchronizeTable($tableName);
             } else {
                 $this->addMissingTable($tableName);

diff --git a/htdocs/xoops_lib/vendor/xoops/xmf/src/Database/Tables.php b/htdocs/xoops_lib/vendor/xoops/xmf/src/Database/Tables.php
@@ -897,11 +897,13 @@ protected function fetch($result)
     /**
      * create default value clause for DDL
      *
-     * @param string|null $default the default value to be quoted
+     * @param string|null $default    the default value to be quoted
+     * @param string|null $columnType COLUMN_TYPE of the column; when given, CURRENT_TIMESTAMP
+     *                                is only treated as a function for TIMESTAMP and DATETIME
      *
      * @return string the correctly quoted default value
      */
-    protected function quoteDefaultClause($default)
+    protected function quoteDefaultClause($default, $columnType = null)
     {
         // . (($column['COLUMN_DEFAULT'] === null) ? '' : " DEFAULT '" . $column['COLUMN_DEFAULT'] . "' ")
         // no default specified
@@ -912,8 +914,14 @@ protected function quoteDefaultClause($default)
         // functions should not be quoted
         // this section will need expanded when XOOPS minimum is no longer a mysql 5 version
         // Until mysql 8, only allowed function is CURRENT_TIMESTAMP
-        if ($default === 'CURRENT_TIMESTAMP') {
-            return ' DEFAULT CURRENT_TIMESTAMP ';
+        // MariaDB reports it as current_timestamp(), and either may carry a precision
+        // a string column can hold the literal text, so the column type decides
+        // Render the canonical CURRENT_TIMESTAMP form (empty parentheses dropped) so a
+        // Migrate comparison against a CURRENT_TIMESTAMP target does not churn on MariaDB
+        $temporal = $columnType === null || preg_match('/^(timestamp|datetime)\b/i', $columnType) === 1;
+        if ($temporal && preg_match('/^current_timestamp(?:\((\d*)\))?\z/i', $default, $matches)) {
+            $precision = isset($matches[1]) && $matches[1] !== '' ? '(' . $matches[1] . ')' : '';
+            return ' DEFAULT CURRENT_TIMESTAMP' . $precision . ' ';
         }
 
         // surround default with quotes — escape embedded single quotes for valid DDL
@@ -930,6 +938,9 @@ protected function quoteDefaultClause($default)
      */
     protected function getTable($table)
     {
+        // errors describe this load only, so "missing" (true) has no error
+        $this->lastError = '';
+        $this->lastErrNo = 0;
         $tableDef = array();
 
         $sql  = 'SELECT TABLE_NAME, ENGINE, CHARACTER_SET_NAME ';
@@ -965,7 +976,10 @@ protected function getTable($table)
         while ($column = $this->fetch($result)) {
             $attributes = ' ' . $column['COLUMN_TYPE'] . ' '
                 . (($column['IS_NULLABLE'] === 'NO') ? ' NOT NULL ' : '')
-                . $this->quoteDefaultClause($column['COLUMN_DEFAULT'])
+                . $this->quoteDefaultClause(
+                    $column['COLUMN_DEFAULT'],
+                    is_string($column['COLUMN_TYPE']) ? $column['COLUMN_TYPE'] : null
+                )
                 //. $column['EXTRA'];
                 . str_replace('DEFAULT_GENERATED ', '', $column['EXTRA']);
 
@@ -995,9 +1009,20 @@ protected function getTable($table)
         $tableDef['keys'] = [];
         while ($key = $this->fetch($result)) {
             $currentKey = $key['INDEX_NAME'];
-            if (!is_string($currentKey) || !is_string($key['COLUMN_NAME'])) {
+            if (!is_string($currentKey)) {
                 continue;
             }
+            // a functional key part (MySQL 8.0.13+) has no COLUMN_NAME; dropping it
+            // would misdescribe the index, so refuse the table instead
+            if (!is_string($key['COLUMN_NAME'])) {
+                $this->lastError = sprintf(
+                    'Index %s on table %s has a functional key part, which is not supported',
+                    $currentKey,
+                    $this->name($table)
+                );
+                $this->lastErrNo = -1;
+                return false;
+            }
 
             if ($lastKey != $currentKey) {
                 if (!empty($lastKey)) {

diff --git a/htdocs/xoops_lib/vendor/xoops/xmf/src/FilterInput.php b/htdocs/xoops_lib/vendor/xoops/xmf/src/FilterInput.php
@@ -216,8 +216,8 @@ public static function clean($source, $type = 'string')
      */
     public function cleanVar($source, $type = 'string')
     {
-        // Handle the type constraint
-        switch (strtoupper($type)) {
+        // Handle the type constraint (null type, as Request::getHeader() passes, means string)
+        switch (strtoupper((string) $type)) {
             case 'INT':
             case 'INTEGER':
                 // Only use the first integer value

diff --git a/htdocs/xoops_lib/vendor/xoops/xmf/src/I18n/BlockPosition.php b/htdocs/xoops_lib/vendor/xoops/xmf/src/I18n/BlockPosition.php
@@ -28,15 +28,15 @@
 final class BlockPosition
 {
     /** XOOPS convention: integer representing the left/start side */
-    public const DEFAULT_LEFT  = 1;
+    public const DEFAULT_LEFT  = 0;
 
     /** XOOPS convention: integer representing the right/end side */
-    public const DEFAULT_RIGHT = 0;
+    public const DEFAULT_RIGHT = 1;
 
     /**
      * Map a side integer to logical class based on convention.
      *
-     * @param int $side       Physical side (convention: 1=left, 0=right in LTR context)
+     * @param int $side       Physical side (XOOPS: 0=left, 1=right in LTR context)
      * @param int $leftValue  What integer represents "left" in your CMS
      * @param int $rightValue What integer represents "right" in your CMS
      *

diff --git a/htdocs/xoops_lib/vendor/xoops/xmf/src/Jwt/TokenReader.php b/htdocs/xoops_lib/vendor/xoops/xmf/src/Jwt/TokenReader.php
@@ -111,7 +111,9 @@ public static function fromHeader($key, $assertClaims = array(), $headerName = '
             }
             $token = trim($parts[1]);
         } else {
-            $token = $header;
+            // custom headers may carry a bare token or "Bearer <token>"
+            $parts = explode(' ', $header, 2);
+            $token = (count($parts) === 2 && strcasecmp($parts[0], 'Bearer') === 0) ? trim($parts[1]) : $header;
         }
         return static::fromString($key, $token, $assertClaims);
     }

diff --git a/htdocs/xoops_lib/vendor/xoops/xmf/src/Mail/SendmailException.php b/htdocs/xoops_lib/vendor/xoops/xmf/src/Mail/SendmailException.php
@@ -76,6 +76,18 @@ public static function prematurePipeClosure(): self
         return new self('sendmail closed the input pipe prematurely.');
     }
 
+    /**
+     * Build an exception for a sendmail process that did not finish in time.
+     *
+     * @param int $seconds configured time limit
+     *
+     * @return self
+     */
+    public static function timedOut(int $seconds): self
+    {
+        return new self('Sendmail did not finish within ' . $seconds . ' seconds.');
+    }
+
     /**
      * Build an exception for a non-zero sendmail exit code.
      *