ClamAV Antivirus Scanner, How to Share Draft Content in Orchard Core via a Unique Link? - This week in Orchard (14/08/2026)
Worried about malicious file uploads reaching your media library? A new ClamAV integration by Mike Alhayek scans files before Orchard Core ever stores them.
Need a friendlier way to let users pick their time zone? A new ITimeZoneSelectListProvider interface makes that pluggable across the whole site.
And want to share a draft with a client without publishing it? A community module adds shareable, revocable draft links, demoed by Hisham Bin Ateya. We also point back to our latest Sponsorship Spotlight interview with him.
Orchard Core updates
ClamAV Antivirus Scanner
This change by Mike Alhayek introduces a new ClamAV antivirus integration for Orchard Core, scanning files with ClamAV before storage. It adds a new OrchardCore.Antivirus module, an Aspire host project, and related configuration and documentation. The new OrchardCore.AspireHost project orchestrates the ClamAV container via Aspire, including resource definition (ClamAVResource), program setup (Program.cs), and related configuration files, so ClamAV can run alongside Orchard Core in a distributed environment.
To try it out without the AspireHost project, first download ClamAV, an open-source antivirus engine for detecting trojans, viruses, malware, and other malicious threats. Then install it. Before you can start the scanning engine (clamd or clamscan), you need the ClamAV Virus Database (.cvd) files in place; the freshclam tool downloads and updates ClamAV's official virus signature databases. Once that's done, run clamd.exe (on Windows) to start the scanning engine.
Next, configure the ClamAV connection in the appsettings.json file of the Web project. We also added .txt to the list of allowed media file extensions, so we could test ClamAV with the EICAR test file: a standard file used to test antivirus programs without needing a real computer virus. You can download it here.
Once ready, head to Configuration -> Tools to enable the ClamAV Antivirus Scanner feature, which scans files with ClamAV before Orchard Core stores them. Then go to Media -> Library and upload the test file. ClamAV blocks it, because eicar.com.txt contains the standard EICAR anti-malware test string.
Add ITimeZoneSelectListProvider for Custom Time Zone Selectors
This introduces the ITimeZoneSelectListProvider interface and a default implementation, so you can swap in a human-friendly time zone selector across site settings, setup, and user profile editors without touching the views that use it. You can also find documentation and tests for the new approach.
To check it out, first navigate to Tools -> Features and enable the User Time Zone feature, which lets you set the time zone per user. Go to Access Control -> Users and hit Edit near any user; you will see a Default Time Zone select list, which determines the time zone used when displaying and editing dates and times.
Here we added a new class called MyTimeZoneSelectListProvider, which implements the ITimeZoneSelectListProvider interface. Inside the GetTimeZoneSelectListAsync method, we display the "Time Zone" text in the list before the name of the time zone.
Demos
How to Share Draft Content in Orchard Core via a Unique Link?
The OrchardCoreContrib.Modules repository is a community-maintained set of modules for Orchard Core. Its Contents Module includes a Share Draft Content feature, which lets you share draft content items via a unique link. That's what we're covering this week.
First, clone the repository and open the OrchardCoreContrib solution. As usual, the first step is to head to Tools -> Features and enable the Share Draft Content feature. We set up our site using the Blog recipe, so we head to Blog and use the Actions dropdown near our predefined blog post to select Unpublish. Editing this content item now shows a new button at the bottom of the editor. Hitting Share Draft creates a link that expires in 30 days.
Opening the link shows a yellow banner at the top: "You are viewing a draft. This content is not yet published." If you don't want the link active for the full 30 days, use the Revoke Link button at the bottom of the editor; once revoked, the link no longer shows the draft.
See this feature in action in the demo on YouTube by Hisham Bin Ateya.
News from the community
Sponsorship Spotlight: Hisham Bin Ateya
Hisham Bin Ateya is one of the main developers of Orchard Core and the first winner of the Jean-Thierry Kéchichian Community Award in 2024. In the latest Sponsorship Spotlight interview, he shares what he values most about the platform: "Flexibility, Extensibility, and Community."
Read the full interview to learn about his journey from the early Orchard vNext days, his other open-source projects like JSON Localizer, and the Orchard Core Contrib GitHub organization he founded.
Orchard Harvest 2026 Program
The Orchard Harvest 2026 conference will be held in Vancouver, and we look forward to seeing you all this autumn in Canada. Our confirmed dates for this year are September 10th and 11th.
Don't miss this limited-time offer: just $280 for two days of all-access learning and networking. Secure your early-bird tickets to the conference now!
The full Orchard Harvest 2026 program is live! Be sure to check out the conference's updated official website for the program!
As we move forward, we will keep community members informed of the details, and you will find every detail in this newsletter, too!
Don't miss the biggest Orchard Core event of the year!
Orchard Dojo Newsletter
Lombiq's Orchard Dojo Newsletter has 411 subscribers! We have started this newsletter to keep the Orchard community informed about the latest platform news. By subscribing to this newsletter, you will receive an email whenever a new post is published to Orchard Dojo, including 'This Week in Orchard', of course.
Do you know of other Orchard enthusiasts who would like to read our weekly articles? Tell them to subscribe here!