Several great features and fixes were added to Orchard Core this week! You could see a fix for an interesting issue about how you can use XSS in an SVG file, the new IContentHandleManager, and two great demos! One is about the upcoming Pager with the page size, then check out the improvements of the Shape Components! Orchard Core updates Media Content Security Policy There was a Stored Cross-site Scripting security breach through the upload of a malicious SVG file, containing malicious JavaScript code, that is then executed whenever a user tries to view the contents of the uploaded file. In order to replicate this issue, you just needed to follow the steps described below: Create an SVG file with malicious JavaScript: <?xml version="1.0" standalone="no"?> <!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd"> <svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg"> <rect width="300" height="100" style="fill:rgb(0,0,255);stroke-width:3;stroke:rgb(0,0,0)" /> <script type="text/javascript"> alert(1); </script> </svg> In the Media Library, upload the file you just created. Locate the uploaded file in the Media Library and select View. Observe that a JavaScript alert popup is triggered. To prevent that the fix is to add a new security policy. This means the browser will render the SVG without executing the inline scripts. The Media.StaticFileOptions is now slightly more configurable with services.PostConfigure to allow more fine-grained controlled, if any wants to adapt the event handlers and/or use them to block certain types of requests, or whatever they feel they need to. You can see the changes in the MediaOptionsConfiguration where the DefaultContentSecurityPolicy stores the value of the content security policy header. Refactor IContentAliasManager to IContentHandleManager This is about refactoring the IContentAliasManager and associated providers to be referred to as handle. From now you will see new extension methods: Orchard.GetContentItemIdByAlias("my-alias"); Orchard.GetContentItemIdBySlug("blog/post-1"); Orchard.GetContentItemIdByHandle("slug:blog/post-1"); and generally refactors everything else that referred to as an alias as a handle. It will not break anything, because it's keeping the IContentAliasManager and registering it to resolve the IContentHandleManager. The IContentAliasManager is not obsoleted to prevent compilations errors. But we could also just drop it completely in the near future. The IContentAliasProvider however has been renamed to IContentHandleProvider with no cross resolving. Now let's see an example to make this change clear. Let's say you have a content type that has the AliasPart attached. Every alias has a pattern, which is generated by the DisplayText of the content item: {{ Model.ContentItem | display_text | slugify }} So, if you create a new content item of this content type with a display text My new content item, your alias will be my-new-content-item. OK, now we have this content item. Let's say we need to get this content item and modify some properties of it from code. But how can we get this content item? Well, you can use the default implementation of the IContentAliasManager to do that: var myContentItem = await _contentAliasManager.GetContentItemIdAsync("alias:my-new-content-item"); Notice that here we need to pass the alias: string also because we would like to get a content item by an alias. From now we can use IContentHandleManager instead of the IContentAliasManager in the following way: var myContentItem = await _contentHandleManager.GetContentItemIdAsync("alias:my-new-content-item"); The GetContentItemIdAsync method of the IContentHandleManager iterates through all of the IContentHandleProver implementations and we have an AliasPartContentHandleProvider, that checks if the handle starts with the alias: string, and if yes, it returns the content item by using the AliasPartIndex table. As we mentioned you have new extension methods to use in your Razor code. The GetContentItemIdByHandleAsync is now just about calling the same IContentHandleManager implementation as we showed you above. Configure cookie lifetime for CulturePicker The issue was about you cannot change the expiration of the content localization cookies. By default, the cookie lifetime is set to 14 days, but if you would like to set it to 1 day, you couldn't do that until now. If you open the appsettings.json file in the OrchardCore.Cms.Web, you will find an OrchardCore_ContentLocalization_CulturePicker section there. Just uncomment that lines and use the CookieLifeTime to set the culture picker cookie lifetime in days. Demos Pager with page size If you have ever worked with an Orchard 1.x site, you may have seen how does the pager looks like at the bottom of the lists, like when you are on the page that shows you the contents list. It shows you the total number of items, the current page where you are right now, and you can also set how many items you would like to see on each page. It's slightly the same in Orchard Core too. The only difference is here that you don't have the option to set how many items you would like to see on the current page. If you navigate to Configuration -> Settings -> General you will see an option called Page size, but that's about saying 'I would like to see 10 items in every page'. You can't set the page size of the current page near the pagers. Antoine Griffard decided to start working on this feature for Orchard Core too. If you enabled the Tenants feature and navigate to Configuration -> Tenants, you will see the first prototype of this feature on that page. We have 11 tenants in the system and we set the page size to 10. In this case, the pager shows two pages and you can see the number 10 here as well. There is also a recording that shows you this feature, head to YouTube to know more! Shape Components updates Two weeks ago we wrote about a great upcoming feature to Orchard Core about having Shape Components. Let's think about a shape like a reusable component, like a view component in ASP.NET, but like an Orchard shape component, that can be reused. The development on that feature is continuing, this time you could see making the Razor Tag Helpers a little bit more feel like a component. Watch this recording on YouTube to see the current state of this upcoming feature! News from the community Blogs posts about Shortcodes, Shortcode Templates, and Shortcode Delegates I think we don't need to introduce David Hayden to the Orchard community. David Hayden is primarily a C#, .NET and Orchard CMS Developer with 20 years experience developing ASP.NET Websites and related technologies. David is currently primarily focusing on .NET Core, Orchard Core, and Orchard Core CMS for building modular, multi-tenant web applications and websites. He recently published two new posts in his blog about Shortcodes and Shortcode Templates in Orchard Core CMS and Shortcode Delegates. If you would like to learn more about Shortcodes or you haven't heard about them yet, it's definitely worth to check out these articles! But don't forget that you can find two videos on YouTube about Shortcodes: check out this one first, then watch this video for the second part of the demo! We also mentioned these features in This week in Orchard too several times. Check out this for an introduction, then this one for the first demo, finally don't forget to read this post to see the improvements of the Shortcodes! And the documentation is available in this URL! Orchard Dojo Newsletter Now we have 160 subscribers of the Lombiq's Orchard Dojo Newsletter! We have started this newsletter to inform the community around Orchard with the latest news about the platform. By subscribing to this newsletter, you will get an e-mail whenever a new post published to Orchard Dojo, including This week in Orchard of course. Do you know of other Orchard enthusiasts who you think would like to read our weekly articles? Tell them to subscribe here! If you are interested in more news around Orchard and the details of the topics above, don't forget to check out the recording of this week's Orchard meeting!

This week you could see two great demos: one is about showing you how you can manage and import/export your secrets between servers, the other is about using Blazor WebAssembly with Orchard Core! Orchard Core updates ChallengeOrForbid() in Api controllers Most of the API controllers are configured to use the Api scheme for authentication but return ChallengeOrForbid(), which ultimately uses the default challenge scheme (which is typically the cookie handler when the Users module is enabled). To fix that, the API controllers are updated to do ChallengeOrForbid("Api") instead of ChallengeOrForbid(), so that challenges are properly handled by OpenIddict when the OpenID token validation feature is enabled. Now there is a new override for the ChallengeOrForbid() extension method that accepts the authentication schemes to challenge. And now you can use this extension method in your API controller just by passing the Api, like: return this.ChallengeOrForbid("Api");. Include ContentsMetadata (PageTitle) in Blog Theme Category Taxonomy If you use the Blog recipe, a taxonomy Category with entry Travel is created by default. However, the title for the Travel page was not correct. If you created a site name Blogging using the Blog recipe, the expected title would be: Travel - Blogging, but you got a title: Blogging. The fix was to include the ContentsMetadata in the Content-Category.liquid file. Link to GitHub Discussions in Contributing If you open the GitHub repository of Orchard Core you will find a CONTRIBUTING.md file in the root of the repository. Now this markdown file has a direct link to GitHub Discussions. But what is GitHub Discussions? GitHub only offered issues and pull requests as places to have these conversations. But issues and pull requests both have a linear format - well suited for merging code, but not for creating a community knowledge base. Conversations need their own place - that’s what GitHub Discussions is for. If you have a question and need an answer, just visit the Discussions page and if you haven't find the answer for your issue, let's ask it there. Here you can find detailed and valuable answers for questions like what is a shape? Demos Secret Management Updates Head to the GitHub repository of Orchard Core and checkout to the deanmarcussen/secrets branch to be able to try out this upcoming feature! After you set up your Orchard Core site, head to Configuration -> Features and enable these features: Configuration Secrets Store: The secrets configuration store is a read-only store for secrets. Database Secrets Store: The secrets database stores encrypted secrets in the database. Secrets: The secrets feature manages secrets that other modules can contribute to. After you will find a new option under Configuration called Secrets. Here you can add two kinds of secrets: Authorization Secret: A secret used to manage a secure password or authorization key. Rsa Secret: A public / private RSA key pair used for encryption. Let's add a new Authorization Secret now and see what are Secret Bindings exactly? Secret Bindings can be used to enter secrets, like SMTP passwords. And you can choose where it's gonna come from. Right now they can be stored either in the database or in the configuration. But there is a plan to support the Key Vault provider as well. Let's use the smtp_password as the name and store it now in the Database Secret Store. And add the password into the Authentication String textbox. But how can use that secret? If you enable the Email feature, you can navigate to Configuration -> Settings -> Smtp and set up the network delivery options. If you put a tick on the Require credentials checkbox, you have to provide a user name and a password for authentication. If you would like to use your secret, you can use a Liquid filter to access the password stored in it. Here you can see that we entered the following Liquid expression to retrieve the password: {{ "smtp_password" | auth_secret }}. Remember, the smtp_password was the name of our secret. When we added our secret, we had the option to choose to create an Authorization Secret or an Rsa Secret. We created an Authorization Secret, so let's create an Rsa Secret this time! The RSA key pair is what we could use to actually crypt secrets when transmitting them to another server. At the moment the private key is in the editor, the idea is that once you created the private key you will never see it again. You can use the public key as an encryption key. Now let's create a new Deployment Plan and call it Secrets RSA! Add the All Secrets deployment step to it then hit Execute! After you will end up with a recipe that looks like the following. Here you can see the encriptionKey used for this particular recipe. It's a symmetric encryption key that is encrypted with the public key from the RSA key pair. Then all of the bindings that are available are here in the recipe. You will also find a decryptor here (js: decrypt()) which will use the encriptionKey and the private key on the other end to decrypt them. And when you run this recipe on your remote server - assuming you have installed the private key on the remote server - it will unencrypt your secrets correctly. But it's not all! If you would like to know more about this great upcoming feature, don't hesitate to watch the recording of it! Blazor WebAssembly with Orchard Core In this demo, you will see how to use a Blazor WebAssembly application that queries a blog post content through a REST API call using GraphQL. A JWT token used as a bearer token when calling the REST API GraphQL endpoint. Head to YouTube now to see the full demo! News from the community Orchard Dojo Newsletter Now we have 159 subscribers of the Lombiq's Orchard Dojo Newsletter! We have started this newsletter to inform the community around Orchard with the latest news about the platform. By subscribing to this newsletter, you will get an e-mail whenever a new post published to Orchard Dojo, including This week in Orchard of course. Do you know of other Orchard enthusiasts who you think would like to read our weekly articles? Tell them to subscribe here! If you are interested in more news around Orchard and the details of the topics above, don't forget to check out the recording of this week's Orchard meeting!

We prepared with an interesting topic for this week about how could you use shapes like reusable Angular components? But before that, we checked the latest updates of Orchard Core, like the new updates around Tag Helpers. Orchard Core updates Add UI permissions based on the user role This is about hiding some buttons based on the permissions, instead of returning the 401 page when clicking on those. What do we mean? Well, let's say we have a permission that doesn't contain a role to publish or unpublish pages. That means users with that permission can't see the Publish button at the bottom of the editor in a case of a Page content item. Meeting information in the documentation When you open the Orchard Core documentation page and navigate to Resources, you will find a new link in the Resources column at the left called Meeting. If you click on that you will see a brand new page where you can find every relevant information about the steering committee and the triage meetings. Support for dropping a password from a password manager during setup Some password managers let you drag and drop a password to a textbox. During setup, if we do this rather than focus then type or paste, the tick appears in the input, but the strength indicator doesn't update and clicking Finish setup just does nothing with no indication. The fix was to update the strength.js file to check for the drop event. Add missing Tag Helper references The root of this issue was the Tag Helpers are found during development because of the runtime compilation. But when you change the environment from development to production, it stops working if you don't have a direct reference on the ResourceManagement project. The compilation doesn't find the issue, because it's a runtime resolution. Yes, you can use the a tag it will compile, but in runtime, it has a different behavior based on the projects you reference and you don't get the behavior you expect. The only thing you can do is to have a functional test to be sure that it would work. Tag Helper for the anchor tag with asset-href attribute Added an HtmlTargetElement to the Anchor Tag Helper to also address anchor tags with asset-href attributes. Added needed const and property and changed the Process logic to require non-null asset-href for anchor tags. So, if you use the asset-href in the anchor tag, it will convert the URL of a media URL to a public URL. Demos Shape Components What makes it hard to build a new site using Orchard Core? The ultimate solution would be to remove the templating in Orchard and just use decoupled. So, you don't have to know about shapes at all. And then you just write your pages, your controllers, you have lot's of APIs to get your content, you can reuse ASP.NET caching and do your decoupled site like this. It would be a decoupled site. Let's just forget about shapes and rendering everything from modules. Just let people render their own things and provide tools to render the site. It might be slower at first to build the site, but they will never be blocked by 'I don't know what a shape is.' or 'I don't understand how shapes work.', 'What is placement?' and so on. We have themes and recipes today that build some predefined solutions, like a blog or an agency site and they can be extended to anything. For that, you still have to understand all the shape- and display mechanisms to build these elements. A new solution would be to still create recipes, but recipes that would contain Razor Pages and controllers and anything that would build a blog even if we didn't have shapes and placement and everything. Like build a decoupled site that is a blog and this is the recipe. When you install it you have the same blog, the same theme working and if you want to change it, you don't have to learn shapes. You just look at the page that renders the blog, the blog post and you just change it. Or you create a new one and change the code directly. This would be just ASP.NET, there is nothing new to learn out of ASP.NET. That would be a solution to have. But let's say the issue is not about the shapes, because shapes are great. The issue is zones and placement. And these are harder to learn. Shapes in the end, if you just take shapes by themself, they are just dynamic ViewModels that have alternates and that can be rendered using templates. It's like a view component in ASP.NET. But it's like a view component with more features like it can have an ID, CSS classes, attributes, it can have dynamic behavior, it can have a caching, it has alternates. So, it has a dynamic resolution of templates, which the view component doesn't have. Let's think about a shape like a reusable component, like a view component in ASP.NET, but like an Orchard shape component, that can be reused. Were we able to pique your curiosity? Then just navigate to YouTube and see this exciting demo about shape components! News from the community Orchard Dojo Newsletter Now we have 160 subscribers of the Lombiq's Orchard Dojo Newsletter! We have started this newsletter to inform the community around Orchard with the latest news about the platform. By subscribing to this newsletter, you will get an e-mail whenever a new post published to Orchard Dojo, including This week in Orchard of course. Do you know of other Orchard enthusiasts who you think would like to read our weekly articles? Tell them to subscribe here! If you are interested in more news around Orchard and the details of the topics above, don't forget to check out the recording of this week's Orchard meeting!

We have mentioned the Shortcodes feature several times and now it's available in the preview packages of Orchard Core. We will also show a demo about how you can use our .NET Analyzers in your Orchard Core solution. Check out our post for more! Orchard Core updates Tabs syntax changed in the documentation Orchard Core documentation contains code samples both in Liquid and Razor languages. You can see the given code samples in tabs near each other. If you want to change between them you just need to click on the Razor or the Liquid tab to see the snippets. Now, if you would like to improve the documentation and put some snippet there too, you have to use a new syntax in Markdown. In the screen below you can see the old one in red, and the new one in green. Thank you for making the documentation better and better! Media root folder selected by default If you navigated to the dashboard of Orchard Core and opened the Media Library (Content -> Media Library) you may found that the images in the root folder were not available on the list on the right. The workaround was to create a new folder to see the files in the root. Now, this issue is fixed, the media root folder is selected by default and you are able to see the content in the media library without any workarounds. New icons for User Disabled and Enabled events A small UI change here. When you add a new User Disabled or User Enabled event to your workflow you will find new icons here. These icons are also used when you are working on your events on the kanban board of your workflows. Shortcodes feature merged Shortcodes are small pieces of code wrapped into [brackets] that can add some behavior to content editors, like embedding media files. The Image Shortcode can be used to display an image from the media library in your WYSIWYG editors. The simplest way to use that Shortcode is the following: . And the good news is that now you can find the Shortcodes and the Shortcode Template features in the preview packages of Orchard Core! In case if you missed you can find two videos on YouTube about Shortcodes: check out this one first, then watch this video for the second part of the demo! We also mentioned these features in This week in Orchard too several times. Check out this for an introduction, then this one for the first demo, finally don't forget to read this post to see the improvements of the Shortcodes! And the documentation is available in this URL! Update configuration documentation The documentation now contains more lines to explain how to read a configuration from an external config file, that you can use in your Startup class. Click here to see the updated page! New workflow task to validate user There is a new Validate User Task to check if the user exists for the current request and has the specified role(s). This task has three outcomes: InRole: if the user in the current request has at least one of the selected roles. Anonymous: if the user in the current request is anonymous. Authenticated: if the user in the current request is authenticated If you check the Set the 'UserName' workflow property if the user is authenticated checkbox, the username of the current user will be added to the Properties dictionary of the WorkflowExecutionContext that you can use in the upcoming tasks. Demos Lombiq .NET Analyzers Our Lombiq .NET Analyzers repository contains .NET code analyzers and code convention settings for Lombiq projects. We use these to enforce common standards across all our .NET projects, including e.g. in all of our open-source Orchard Core extensions. If you contribute to our open-source projects while using that solution you'll be guided by these rules too. There is a built-in code analyzer in Visual Studio, but there is a lot of other analyzer projects out there. These analyzers can find issues in your code, but this is about to extend that and try to find even more issues. The Readme.md file in the repository tells you how you can add these files to your solution in just two quick steps! Now let's see a simple example of this! Let's imagine that you have an interface with a method that represents an asynchronous operation. After we created our great interface with the method you will notice that the IDE complains about some stuff. First of all, we have an interface and a method in it with no documentation. The DoSomethingGreat method is an async method, so the correct name of the method would be DoSomethingGreatAsync. Pretty cool, right? But that's not all! Head to YouTube to see the full demo about Lombiq .NET Analyzers! News from the community Extending event handlers sample in the Lombiq Training Demo for Orchard Core Orchard Core Training Demo module is a demo Orchard Core module for training purposes guiding you to become an Orchard developer. You can use this module as part of a vanilla Orchard Core source that including the full source code - which is the recommended way. You can use it as part of a solution the uses Orchard Core NuGet packages, however, it's harder to look under the hood of Orchard Core features. The latest update of the module is about to show you how you can extend Orchard Core with event handlers. The LoginGreeting class is about to implement the ILoginFormEvent interface and shows a notification to the user after a successful login. Check out the code here! Orchard Core workshops The contributors of Orchard Core will hold some unique online workshops in September 2020. So even with Orchard Harvest postponed due to the coronavirus pandemic we'll get some new learning events. Are you looking to get up to speed with Orchard? Check out the workshops' details on the Orchard Core homepage! Orchard Dojo Newsletter Now we have 160 subscribers of the Lombiq's Orchard Dojo Newsletter! We have started this newsletter to inform the community around Orchard with the latest news about the platform. By subscribing to this newsletter, you will get an e-mail whenever a new post published to Orchard Dojo, including This week in Orchard of course. Do you know of other Orchard enthusiasts who you think would like to read our weekly articles? Tell them to subscribe here! If you are interested in more news around Orchard and the details of the topics above, don't forget to check out the recording of this week's Orchard meeting!

New guides in the Orchard Core documentation to learn how to build a blog that allows users to login with their AzureAD account and gets assigned roles based on the Security Groups they belong to, and how to create a Deployment Plan to migrate from the File Content Definition feature. After we will show you our new Shape Tracing Helpful Extensions feature! Orchard Core updates Content definition stores guide Now you can find a new small guide in the Orchard Core documentation that explains what the File Content Definition feature is, and how to create a Deployment Plan to migrate from the File Content Definition feature. Implement class and alt attributes for ImageShortCode Shortcodes are small pieces of code wrapped into [brackets] that can add some behavior to content editors, like embedding media files. The Image Shortcode can be used to display an image from the media library in your WYSIWYG editors. The simplest way to use that Shortcode is the following: You can also provide several attributes, like the width, height, and mode. And now you can also pass the alt attribute that specifies an alternate text for an image if the image cannot be displayed. And you can pass your custom classes too! In the following line we used the Image Shortcode with multiple parameters: Users with Manage Users permission can't delete themselves or change their roles If you try to delete the admin account and you are currently the admin what you could do is actually block everyone from being able to edit the site if the admin is the only user. The idea here is that you can't delete yourself. If you navigate to Security -> Users and edit the admin user, you will see that the editor of the roles and the Is enabled? checkbox are disabled. Don't Detach a document already loaded for update This is about how documents are loaded from cache stores. If you use the ASP.NET caching abstractions you can store in the IMemoryCache or in the IDistributedCache. The main difference between these two is that in the IDistributedCache you would put stuff that has to be and can be serialized. In IMemoryCache you can put stuff that is not serialized. It's a live object that can be changed and updated. There is a new method for documents in the ISessionHelper called GetForCachingAsync that gets a single document (or create a new one) for caching and that should not be updated, and a bool indicating if it can be cached, not if it has been already loaded for an update. Note that for full isolation, it needs to be used in pairs with the LoadForUpdateAsync method that loads a single document (or create a new one) for updating and that should not be cached. When you call the GetForCachingAsync method you say that the object that you want to load from the database will be cached, which means you should not change it. You should not be able to update it, it's for caching. When you get a document from the database from this layer it will tell you if you are allowed to change it or not. This way you know you can put it in a durable cache or a live cache. Use Azure AD as an external identity provider guide In order to authenticate users with AzureAD, you must enable and configure the OrchardCore.MicrosoftAuthentication.AzureAD (you can learn more about here) and the OrchardCore.Users.Registration features. There is a new guide in the documentation where you will learn to build a blog that allows users to login with their AzureAD account and gets assigned roles based on the Security Groups they belong to. Demos Shape Tracing Helpful Extensions Lombiq Shape Tracing Helpful Extensions adds a dump of metadata to the output about every shape. This will help you understand how a shape is displayed and how you can override it. But let' see how you can use it in your solution! Imagine you have a NuGet-based Orchard Core solution and you would like to use the Shape Tracing Helpful Extensions. For that, you have to clone or download the orchard-core-preview branch of the Helpful Extensions repository that is targeting a recent nightly build of Orchard Core and you will only find the Shape Tracing Helpful Extensions in that branch. Now head to the GitHub repository of the Helpful Libraries module (same branch) and clone or download that too. You will need this library to use the Helpful Extensions. Now add these as an existing project to your solution and don't forget to check the project reference between these two! Reference the Lombiq.HelpfulExtensions module in your Web project and now you are ready to go! Set up a site using the Blog recipe then navigate to Configuration -> Features and search for the word helpful. Here you can find all of the following independent extensions of the module. If you are interested in the other ones too, check out the Readme.MD file of the repository for more! Now we will enable the Shape Tracing Helpful Extensions - Lombiq Helpful Extension feature. After you will get a dump about shapes in the HTML output. Just view the page source where you will see several comments in the code. These are generated when the shape is displayed that gives you some basic debug data. You can use these to actually override the shape. If you navigate to the detail view of the built-in blog post, you will see every relevant data that could be important for you to override the given shape, check the display type, the position, the differentiator, the wrappers of the shape and many more! But that's not all about Shape Tracing Helpful Extensions! If you would like to see more, don't forget to check out this recording on YouTube! News from the community Orchard Nuggets: How to debug a NuGet-based Orchard Core solution? How can you debug Orchard Core code when you're working with a solution that loads Orchard packages from NuGet? Easily! In our newest Orchard Nuggets post, we give you the answer! Check out the other posts for more such bite-sized Orchard tips and let us know if you'd have another question! Orchard Core workshops The contributors of Orchard Core will hold some unique online workshops in September 2020. So even with Orchard Harvest postponed due to the coronavirus pandemic we'll get some new learning events. Are you looking to get up to speed with Orchard? Check out the workshops' details on the Orchard Core homepage! Orchard Dojo Newsletter Now we have 160 subscribers of the Lombiq's Orchard Dojo Newsletter! We have started this newsletter to inform the community around Orchard with the latest news about the platform. By subscribing to this newsletter, you will get an e-mail whenever a new post published to Orchard Dojo, including This week in Orchard of course. Do you know of other Orchard enthusiasts who you think would like to read our weekly articles? Tell them to subscribe here! If you are interested in more news around Orchard and the details of the topics above, don't forget to check out the recording of this week's Orchard meeting!

How can you debug Orchard Core code when you’re working with a solution that loads Orchard packages from NuGet? Orchard’s packages are built with symbols so you can actually use them as source too! First, in Visual Studio be sure to uncheck “Enable Just My Code” under Tools → Options → Debugging → General. Then you can debug almost as usual: If you want to step into Orchard’s code from your own code then just put a breakpoint into your code as usual and hit Step Into (F11). It’ll open the Orchard source and debugging will work as usual. If you want to place a breakpoint anywhere in the Orchard Code that you can’t step into from yours (like a controller action) then do the following: Add a reference to the type anywhere in your own code. E.g. just write ItemController somewhere and import the namespace for OrchardCore.Contents.Controllers.ItemController. Hit Go To Definition (F12) on the type. Now you’re at the decompiled source of the type. This won’t be perfect but at least you’ll be able to place a breakpoint at the beginning of the method or other member you want to debug. Be sure to tick “Allow the source code to be different from the original” under the breakpoint’s settings. Run the app with the debugger attached. Your breakpoint will be hit and then the nice symbol sources will be used, just as when you step into Orchard’s code. Note that with “Enable Just My Code” you’ll also potentially see exceptions from the libraries you use or from .NET, even if they’re swallowed down the line. Depending on your work it might be better to keep the option ticked most of the time. Alternatively, you can also try opening a full Orchard source solution (with the Orchard version closest to what you’re using) and attach it to your own app. This sometimes works too but you can only debug Orchard’s own code in that case, not yours. Did you like this post? It's part of our Orchard Core Nuggets series where we answer common Orchard questions, be it about user-facing features or developer-level issues. Check out the other posts for more such bite-sized Orchard Core tips and let us know if you have another question!

This week we see the latest improvements of the Shortcodes module and the new pages of the Orchard Core documentation! Don't forget about our Traning Demo module, which has now got a new RESTful web API sample! Check out our current post for more! Orchard Core updates Highlight invalid fields When you have a driver for your content part or for your content field, the UpdateAsync method will be called when you are about to save and persist the new values of it. Let's say you have a TextField and you want to set it to be required. In the UpdateAsync method of the TextFieldDisplayDriver, we get the TextFieldSettings and if the value of the Required property is true and the Text property of the TextField has no value, then it's time to show an error for the user. Notice the second parameter of the AddModelError method. This is about passing a key to the ModelStateDictionary. The key would be the value of the Text property of the TextField and the Prefix would be the BlogPost.Subtitle string. But why is it important right now? Because there was an issue in Orchard Core about the different highlightings. If there is a validation error, it would be great to highlight the input editor, not just showing the validation summary at the top of the form. So, imagine you have a site installed with the Blog recipe and you set the Subtitle TextField of the Blog Post content type to be required. If you would like to save the existing blog post without providing a subtitle, the driver will pass the BlogPost.Subtitle as the Prefix and the name of the field.Text will be null. It's a small, but a good to know tip to provide a better user experience when editing values. Document Link Tag Helper There is a Tag Helper and a Liquid Helper in Orchard Core called Link that you can use to define the relationship between the current document and an external resource such as a favicon or stylesheet. This helper is available for a while, but there were no words in the documentation about it. Now you can find some lines in the documentation about how to use these helpers in your Orchard Core site. Add user updated event Two weeks ago we wrote about the new user deleted event, which is about to add a new DeletedAsync method to the IUserEventHandler. Now there is another new event for user events, that is about to occur when a user is updated. You can find the new UpdatedAsync method in the IUserEventHandler. And a new event is also accessible from your workflow type. If you create a new workflow type and click on the Add Event button, you will find the User Updated event in the User category. Password configuration documentation The password restrictions are set with the settings configured in ASP.NET Identity. Those options are used to define the required password strength when a user password is set. You can configure these requirements in order to specify properties like the minimal password length or if the process is expecting digits, uppercase, or non-alphanumeric characters. Check out the new how-to guide in the Orchard Core documentation to see how to change these settings and how to read configuration from an external config file! Demos Shortcodes improvements Two weeks ago we wrote about the upcoming Shortcodes feature for Orchard Core. Shortcodes are essential to WordPress, and for the Orchard Core, we wanted a similar feature. The parser was written by hand as the syntax is simple and it needs to be efficient. Check out that post if you haven't read that yet and don't forget to watch the recording on YouTube about that too! Now, let's continue from where we left off and see the newest improvements in that module! Set up your site using the Blog recipe, then head to Configuration -> Features to enable these features: Shortcode Templates: The Shortcode Templates feature provides a way to write custom shortcode templates from the admin. Shortcodes: The Shortcodes feature adds shortcode capabilities. Now head to Design and notice that the Shortcode Templates options is renamed to Shortcodes. Click here and add a new Shortcode! Here you will meet with a slightly changed editor. The first thing that you will notice is when you are starting to fill out the Name, the Hint, and the Usage inputs you will get a live preview in the right about how the card of the Shortcode will look like. You can ask what card do we mean, but let's not move so fast! The Categories selector is now working the same when you add tags to your blog post. You can type to search for the existing categories or add a new category right here from the editor. The Content will be about having the logic of the Shortcode. Here we create a Shortcode called safeimage, it means we sanitize the input from the user before rendering the content. We also created another Shortcode called unsafeimage. That would be the same, the only difference is we didn't call the sanitize Liquid helper. Now edit the Article content item named About. The HTML editor here has the Insert Shortcode button on the toolbar. Click on it and now you will see the cards we have just mentioned a few lines ago! Here you can filter by the name of the Shortcode and can filter by categories. Now let's try out the unsafeimage and the safeimage Shortcodes! After editing the code we have the following lines in the HTML body: unsafeimage: [unsafeimage]media/samoyed.jpg" onload=alert('xss')[/unsafeimage]unsafeimage: [unsafeimage]media/samoyed.jpg[/unsafeimage]safeimage: [safeimage]media/samoyed.jpg[/safeimage] Notice the script in the first line! Because we added this inside an unsafeimage Shortcode, it will render the alert when the user views this page. If we would put this little hack inside a safeimage Shortcode, then it would prevent the alert to appear. But that's not all about Shortcodes! If you would like to see more, don't forget to check out this recording on YouTube! News from the community RESTful web API sample in the Lombiq Training Demo for Orchard Core The Lombiq Training Demo for Orchard Core is a demo Orchard Core CMS module for training purposes guiding you to become an Orchard developer. You can use this module as part of a vanilla Orchard Core source that includes the full source code - which is the recommended way. You can also use it as part of a solution that uses Orchard Core NuGet packages, however, it's harder to look under the hood of Orchard Core features. And the module just got a new little RESTful web API sample! Check it out if you're learning Orchard and want to develop web APIs! Orchard Core workshops The contributors of Orchard Core will hold some unique online workshops in September 2020. So even with Orchard Harvest postponed due to the coronavirus pandemic we'll get some new learning events. Are you looking to get up to speed with Orchard? Check out the workshops' details on the Orchard Core homepage! Orchard Dojo Newsletter Now we have 157 subscribers of the Lombiq's Orchard Dojo Newsletter! We have started this newsletter to inform the community around Orchard with the latest news about the platform. By subscribing to this newsletter, you will get an e-mail whenever a new post published to Orchard Dojo, including This week in Orchard of course. Do you know of other Orchard enthusiasts who you think would like to read our weekly articles? Tell them to subscribe here! If you are interested in more news around Orchard and the details of the topics above, don't forget to check out the recording of this week's Orchard meeting! There will be no This week in Orchard post next week because of vacation, so see you in two weeks!

This week we are gonna show you three brand new features that are recently added to Orchard Core: the Add Content To Deployment Plan, the Export Content To Deployment Target, and View Or Download Content As JSON features. After we see a demo about user impersonation and finally we solve the mystery about what is GitHub Arctic Code Vault? Orchard Core updates Add Content To Deployment Plan, Export Content To Deployment Target, and View Or Download Content As JSON features Set up your site using the Blog recipe. Now you can head to Configuration -> Features and enable the Add Content To Deployment Plan, Export Content To Deployment Target, and View Or Download Content As JSON features. This will bring you several new stuff that you can use when you are managing the content items. If you click on the Actions button you can see that the context menu is now getting a lot more items. The Export to Deployment Target is about to automatically create a custom recipe file that can be downloaded locally or send it to a remote instance. You can use the Available Targets modal to select the destination. The Add to Deployment Plan is about to add a new content item step using this content item to an existing deployment plan. In this case, a new modal window will open again that lets you choose from the available deployment plans. The Download as JSON is about to directly download the recipe to your computer locally and the View as JSON is a very helpful feature because as you could see in the screen below it shows you the JSON representation of the content item. The same JSON will go to the content step of the recipe when you are hitting the Download as JSON button. Here you have the availability to copy the JSON structure by clicking on the copy icon at the top-right corner of the page. And don't forget that you can find two demos on YouTube about this feature. Click here for the Click to deploy demo and here to see the second part of the demo! Add authentication checks to some ISite drivers We had some drivers in Orchard Core where we hadn't check that the user has the appropriate permissions to modify the changes of given settings because the controllers won't do that for us. For example, if the user would like to change the settings of the reCAPTCHA, then we have to make sure that the user has the ManageReCaptchaSettings permission to do that. Now, these missings checks are added to the code. Fixing Linux setup by making sure a directory created before creating a file Let's say you would like to host your Orchard Core site in a Linux environment. But unfortunately, the setup failed on installation from Docker-Linux container. The strange issue was a directory needed to be created before file creation. Navigate to the SaveContentDefinitionAsync method of the FileContentDefinitionStore to see the check for the directory. Document HTML Sanitizer and Markdown Pipeline Options An HTML Sanitizer is available as part of the Orchard Core Infrastructure. The Sanitizer cleans user input that could lead to XSS attacks. From now you will find a new page in the Orchard Core Documentation about how to use the Sanitizer in your Razor view, how to configure the Sanitizer in the Startup classes, and much more. Markdown output is also sanitized during the rendering of content with Display Management. This page contains new sections about how to enable/disable or configure the Markdown Sanitization using the MarkdownPipelineOptions. Demos User impersonation Open GitHub in your browser and navigate to the OrchardCoreContrib.Modules repository. This repository contains a set of modules for Orchard Core CMS driven by the community members who love Orchard Core. Here we will focus on the one called Impersonation. That feature allows administrators to sign in with other user identities. To try this out, let's clone or download this repository then set up your site using a chosen recipe. After, navigate to Configuration -> Features and enable the Impersonation feature. To try out the impersonation, we need to have multiple users in the system. Go to Security -> Users and click on the Add User button to add a new one. In this case, we created a new user with the Author role with the author user name. In the users list, you will find a new green button called Impersonate. Here the Impersonate button is disabled for the admin user because we have already signed in with that user. So, click on that button near the user named author and see what will happen! You could notice a slightly changed admin UI in this case. The reason for that is quite simple: users with the Author role have access to the admin UI with some content and media library-related permissions. So in that case you can do and you can see what this exact user can see and can do in that site. It's a good way to for example test the permissions and the rights for that user. If you would like to end the impersonation and return your work using your account, you can just simply have to navigate to Security -> End Impersonation, that will do the trick for you. If you are interested in the full demo, head to YouTube for the recording! News from the community Orchard Core on GitHub Arctic Code Vault The GitHub Arctic Code Vault is a data repository preserved in the Arctic World Archive (AWA), a very-long-term archival facility 250 meters deep in the permafrost of an Arctic mountain. The archive is located in a decommissioned coal mine in the Svalbard archipelago, closer to the North Pole than the Arctic Circle. GitHub captured a snapshot of every active public repository on 02/02/2020 and preserved that data in the Arctic Code Vault. And why it is important? Because Orchard Core also sits in this Code Vault! If you have contributed a repository that is in the Code Vault you will see that in your GitHub profile! Check out this exciting video about the GitHub Arctic Code Vault! Lombiq Offline event Sometimes it's not just about work but doing something just for fun. These events are specifically for this: we get together, do something cool like breaking out of an escape room, going for a go-kart ride, or playing paintball. A few days ago we went hiking then we went back to Budapest in a boat. Check out this new picture of our team, shot at our Lombiq Offline event! While here in Hungary there are no restrictions on events like this anymore, we played it safe with a fully outdoor program. You can find this new picture on our About us page too! Orchard Core workshops The contributors of Orchard Core will hold some unique online workshops in September 2020. So even with Orchard Harvest postponed due to the coronavirus pandemic we'll get some new learning events. Are you looking to get up to speed with Orchard? Check out the workshops' details on the Orchard Core homepage! Orchard Dojo Newsletter Now we have 156 subscribers of the Lombiq's Orchard Dojo Newsletter! We have started this newsletter to inform the community around Orchard with the latest news about the platform. By subscribing to this newsletter, you will get an e-mail whenever a new post published to Orchard Dojo, including This week in Orchard of course. Do you know of other Orchard enthusiasts who you think would like to read our weekly articles? Tell them to subscribe here! If you are interested in more news around Orchard and the details of the topics above, don't forget to check out the recording of this week's Orchard meeting!

This week we show you two demos of the brand new upcoming features of Orchard Core! The first one is the Shortcodes feature, that allows text content editors to inject specialized content blocks using custom arguments, like images, twitter embeds, youtube videos, only with simple blocks like [video 123]. The Audit Trail module provides log records for creation, deletion of any Content Type, and events like user events, as you may see it Orchard 1.x. Heads up for a post full of demos! Orchard Core updates Add user deleted event In the OrchardCore.Users.Handlers.IUserEventHandler there was no contract for the user deleted event. From now there is the new DeletedAsync method that is invoked if a user has been deleted. Check out the code in the UserStore.cs file, where you can see the invoking of the new method. This new event is also accessible from your workflow type. If you create a new workflow type and click on the Add Event button, you will find the User Deleted event in the User category. Admin CSS/Bootstrap regressions Back in Bootstrap 3, col-lg means nothing, so we had some special CSS in the admin theme to make it mean something. In Bootstrap 4, the col-* now means something, because here you have auto-sizing columns. It's still not exactly ideal because there is a lot of variation for the sizes. You can see the new names here to make them more meaningful. These are the new classes in the TheAdmin.scss file. Demos Shortcodes Sébastien Ros created a new open-source project called Shortcodes. This is a .NET library to parse and evaluate shortcodes. It allows text content editors to inject specialized content blocks using custom arguments, like images, twitter embeds, youtube videos, only with simple blocks like [video 123]. Shortcodes are essential to WordPress, and for the Orchard Core, we wanted a similar feature. The parser was written by hand as the syntax is simple and it needs to be efficient. Thanks to Dean Marcussen, this library will be integrated into Orchard Core soon. In this demo, we will see what we can do in Orchard Core using that library! Let's say you installed your site using the Blog recipe. Make sure that the Shortcodes feature is enabled. When you are editing a content item with a WYSIWYG HTML editor (for example the HtmlBody Part of the Article content type or a content type with a MarkdownBody Part) you can get a little pop-up if you are clicking on the Insert Shortcode button near the Link button by default. The pop-up will contain a list of the available shortcodes. Let's try the one called bold now. As you may guess, this shortcode is about to make your text bold. Select it from the list and provide the text that you would like to appear as bold. Note that here we used the [bold "bold text"] syntax when made the text bold. That works, because if you check the definition of the bold shortcode, you could see that we get the value of the text using the args.NamedOrDefault method. If we don't use the text named argument to pass the value of the content that we want to make bold, then it will just simply use the default one, meaning that it will use the content without any argument. So, if you are using the syntax [bold text="bold text"] you will get the same result. But the bold shortcode is also supporting content arguments. It means shortcodes using opening and closing tags can access their inner content. If you would like to use content arguments you can do something like [bold]bold text[/bold]. It will work because if the value of the text is null we will just use the value of the content variable that is the text between the opening and closing tags. Now let's see something else! If you navigate to Design in the admin UI, you will find a new option called Shortcode Templates! Let's see what a Shortcode Template is! Here you have the ability to actually write shortcodes in Liquid. Create a new one and call it Primary! This is about checking if your shortcode has something in the argument called text. If yes, we use the value of the text argument, if not, we are about to work with the content argument. The shortcode wraps the text in a span and adds the text-primary class to it. In this case, you can use this shortcode as you could see in the case of the shortcode called bold. But you also have the option to override the shortcodes that are implemented from code. In that case, you just need to call your shortcode template bold, and that will replace the existing one that has been written in code. If you would like to know more about shortcodes, don't forget to check out the demo on YouTube! Audit Trail Let's install your site using the Blog recipe. Then head to Configuration -> Features and enable the Audit Trail module. After you will see a new option in the menu of the admin UI called Audit Trail. The Audit Trail module provides log records for creation, deletion of any content type, and events like user events. So, let's do some content modification to see how you can use the Audit Trail feature! Navigate to New -> Article and publish a new Article content item with some data. Now edit some data in your newly created article and hit Publish again! Now navigate to the Audit Trail option on the menu and see the new records in the table. The audit trail table provides you with filtering and with pagination to be able to easily find the audit trail event that you are looking for. You can filter by a given date range, categories (All categories, Content Item, User), the user name of the user who caused the event to occur. Every record of the table can have a view in the Summary column. A record with the Content Item category shows you the version of the content item at the moment of recording. If you click on the Version X link you can see the read-only editor of the content item filled with the values that the content item has at that version. If you click on the display text of the content item you can edit the content item. Here you will see four recorded events regarding the changes that we have just made in the case of our article. The first one is about showing you the fact that we created the first version of the Article content type with the display text My new article. The second is about telling you that you clicked on the Publish button, that means you published that article. After you will see a Saved event. If you publish a new version of the article, Orchard Core first saves a new version of it (it also creates a new draft version), then publishes it. You can also see that now we have two different kinds of versions of this article. Now let's see what we have just changed in that article. To do that, click on the Details link of the Saved event. Here you can get more information about the given event. When you are checking the Detail view of a Content Item event you can see a table that contains the differences between the current version of the content item and the previous version of the content item in the Diff column. The values of the current content item will be shown in green, and the values of the previous content item will be shown here in red. You can show/hide this column using the Show diff switch. If you turn the Show before/after switch on, you will see two new columns: Before and After. These are about to show you the values of the properties of the previous version of the content item and the values of the properties of the current version of the content item. Here you can see we changed the Subtitle Text Field and the Html value of the HtmlBody Part of the article. If you navigate back to the audit trail table and check out the first Published event of the article content item, you will also see a new link here called Restore. If you click on this link, Orchard Core will create a new draft instance of the selected content item version. You can also restore the removed content items too. You can attach the AuditTrailPart content part to your content type that allows content editors to enter a comment to be saved into the audit trail event when saving a content item. This comment will be shown in the Comment column of the audit trail table. If you navigate to Configuration -> Settings -> Audit Trail you will find a list that contains every event that can you record using the Audit Trail module. Here you can enable or disable the recording of the given events. You can also enable client IP address logging. When you enable that, the client IP address will be recorded in audit trail event records. If you click on the Set blacklisted content types button you will see a new modal window with all of the defined content types in your system. Here you can select the content types that you don't want to log using the Audit Trail. For example, if you don't want to log the changes of the Article content items, then you may put a tick of the checkbox of the Article content type. The Trimming Settings is about to say how long you would like to keep the audit trail logs in the database. You can disable trimming if you would like to keep the records. And that's not the whole demo! If you are interested in the upcoming Audit Trail feature of Orchard Core, head to YouTube and check out the recording! News from the community A new website using Orchard Core Singapore is the third international country outside North America to introduce Starbucks to its discerning customers who readily embrace the Starbucks Experience. And they used Orchard Core to build the website for Starbucks Singapore! If you are interested in more websites using Orchard and Orchard Core, don't forget to visit Show Orchard. Show Orchard is a website for showing representative Orchard CMS (and now Orchard Core) websites all around the internet. It was started by Ryan Drew Burnett, but since he doesn't work with Orchard anymore, as announced earlier it is now maintained by our team at Lombiq Technologies. Orchard Core workshops The contributors of Orchard Core will hold some unique online workshops in September 2020. So even with Orchard Harvest postponed due to the coronavirus pandemic we'll get some new learning events. Are you looking to get up to speed with Orchard? Check out the workshops' details on the Orchard Core homepage! Orchard Dojo Newsletter Now we have 154 subscribers of the Lombiq's Orchard Dojo Newsletter! We have started this newsletter to inform the community around Orchard with the latest news about the platform. By subscribing to this newsletter, you will get an e-mail whenever a new post published to Orchard Dojo, including This week in Orchard of course. Do you know of other Orchard enthusiasts who you think would like to read our weekly articles? Tell them to subscribe here! If you are interested in more news around Orchard and the details of the topics above, don't forget to check out the recording of this week's Orchard meeting!

Export contents as setup recipe and import recipe from JSON are about to make it easier to manipulate data and setup your Orchard Core site. Edit cached shapes using the Shape Debug mode to see your changes right away. We think if you are an Orchard Core developer, you will find these features very useful. These are the bigger topics for this week! Orchard Core updates Export Contents As Setup recipe This is a new feature that allows you to use a checkbox when you want to export some content and remove any information that would reuse properties like the content item ID, author, owner. Let's see an example for this and create a deployment plant that contains only that All content deployment step and see the JSON schema of the Blog content item that you can get if you install your site using the Blog recipe. So, if you leave this checkbox unchecked, you will see the following content. Nothing special here, you see the same content as you saw before. The content item has an ID, a version ID, and the dates when this content item was published and modified. But let's see what will happen if we put a tick in that checkbox! In this case, all the IDs are regenerated (for now it's not the case for the contained content items) and the values for the owner and the author are coming from the AdminUsername parameter. But be aware of the note that you can read under the checkbox: If checked, you will have to manually declare variables for the Content Picker fields, Taxonomy fields, Tags fields, and List item ids and replace them where needed in the recipe. Any reference to these content items will be lost. And the logic in the ContentDeploymentSource is about checking the value of the ExportAsSetupRecipe boolean property. If you want to export contents as a setup recipe, then the related properties of the objectData will be changed as you can see in the recipe file. We have to mention one new thing here. If you add the All features deployment step to your plan that exports the state of all features, you can say to ignore the disabled features. In that case, your recipe will only contain the enabled features and not the disabled ones. Import Recipe from JSON If you navigate to Configuration -> Import/Export in the admin UI, you will see a new option called JSON Import. This new feature will let you type some JSON and then run it, so you can execute some custom recipe steps from this UI. This new edition comes with the Deployment feature and it's using permission which is the Import permission. Let's say you want to change the site theme of your site for the default one. To do that you can use the following JSON. You can see you can do it in the same way as you would do it in a recipe file. Fix modules referencing other modules You may notice how many modules are referencing other modules for no need. Mostly this is just because they are doing so to get transitive references. The solution was to take direct references on the required abstractions/core projects instead of transitively depending on other modules to provide those references. Dean Marcussen also reviewed other references, removed superfluous references, and ordered them all. Migrate the OpenID module to OpenIddict 3.0 OpenIddict 3.0 has matured enough to envision using it in Orchard Core 1.0 RTM for both the server and validation features. As part of this migration, a few properties will be added to OpenIdServerSettings and OpenIdValidationSettings and others will be renamed for clarity. Due to this change, existing deployments will have to be updated to use the revamped settings. No exception should be thrown and the migration should be limited to re-configuring the server/validation options using the UI and/or updating custom recipes to use the new names. An important aspect of this migration is that the validation feature will now internally use the OpenIddict validation handler instead of the Microsoft JWT bearer handler, even with external OAuth 2.0 authorization servers. Unlike the MSFT JWT handler, the OpenIddict validation handler uses the new Microsoft.IdentityModel.JsonWebTokens stack and comes with JWT token type validation enforced by default, which is required by the not-yet-standardized JWT access token specification. This change will break existing deployments targeting OAuth 2.0 authorization servers that don't issue "typ": "at+jwt" access tokens. At least the following implementations are known to be impacted: Azure AD/B2C. IdentityServer3.IdentityServer4, except its latest 4.0 version (unless 4.0 is configured to use a different typ header) OpenIddict-based deployments are not impacted, as the validation handler includes special logic to deal with the tokens produced by OpenIddict 1.0 and 2.0, whose JWT tokens always include a special token_usage claim to prevent token substitution attacks, which has the same purpose as the "typ": "at+jwt" header. To ensure the validation feature can still be used with servers that don't issue "typ": "at+jwt" access tokens, an opt-in option was added to the validation configuration UI. This option can only be enabled when configuring a remote OAuth 2.0 server and is not shown when using a local OpenID server or a server located in another tenant, as OpenIddict 3.0 always issue "typ": "at+jwt" access tokens. Demos Shape Debug Mode to Dynamic Cache If you have a lot of menu shapes in your site and if you want to edit the templates you can't do that easily because the items are cached. The solution here is to provide an easy way to disable the cache, so in that case, the menus will not be cached. To set the cache mode, head to Configuration -> Settings -> General, where you will find a new tab called Cache. The settings here are very similar to the resource settings, the default is that the cache would be enabled in production and disabled otherwise. You can say I want to enable or disable it all the time. And there is a very useful option called Enabled with cache debug mode. Let's select this one and see what will happen! Now navigate to the homepage of your site and view the page source. Everywhere where is a cached block you will get a little piece of information about the given block. It shows you the cache ID, the dependencies that it's using, how long it's cached for, and any of the variations that are present. You will also see where is the end of the block. Let's see how it works! You will find a CacheStatement class that is about to check the value of the cacheOptions.DebugMode and if it's true, then it will add the additional content to the source of the page. If you are interested in more details about the cache settings, head to YouTube, and see the recording of the demo! News from the community Orchard Core workshops The contributors of Orchard Core will hold some unique online workshops in September 2020. So even with Orchard Harvest postponed due to the coronavirus pandemic we'll get some new learning events. Are you looking to get up to speed with Orchard? Check out the workshops' details on the Orchard Core homepage! Orchard Dojo Newsletter Now we have 154 subscribers of the Lombiq's Orchard Dojo Newsletter! We have started this newsletter to inform the community around Orchard with the latest news about the platform. By subscribing to this newsletter, you will get an e-mail whenever a new post published to Orchard Dojo, including This week in Orchard of course. Do you know of other Orchard enthusiasts who you think would like to read our weekly articles? Tell them to subscribe here! If you are interested in more news around Orchard and the details of the topics above, don't forget to check out the recording of this week's Orchard meeting!