Our blog contains the activity stream of Orchard Dojo: general news, new resources or tutorials are announced here.

Featured tags

IIS
API
SMS
SEO
All tags >

Gulp pipeline Guide, Security module - This week in Orchard (10/06/2022)

New Gulp pipeline Guide, fix content item display coordinator when a GroupId is provided, demo about the new Security module, and many more! Check out this post for the details! Orchard Core updates Gulp pipeline Guide There is a new Guide in the documentation that explains how the Gulp pipeline works and how to use it (what files to read, what files to output and bundle). If you would like to know more about the Gulp pipeline used in Orchard Core, check out this nicely-detailed page here! Use display names in registration settings If you enable the Users Registration module, you can have some registration-related settings under Security -> Settings -> User Registration. This page contains a Configure users registration drop-down where the values that the users can see was simply the names of enum that holds the user registration types. Now with this minor fix users can see nice-looking display names in this drop-down with spaces and everything. Fix content item display coordinator when a GroupId is provided When using the IContentItemDisplayManager build-editor for a specific GroupId, the drivers for each of the corresponding part never gets called. Steps to reproduce the behavior: Create a content part that generates special results when the content.GroupId is set to test. Create a content type and attach the content part you previously created. Now create a new controller to render the content items under a specific GroupId in the controller caller the driver like so _displayManager.BuildEditorAsync(contentItem, _accessor.Updater, true, "true", "some-prefix"). The expected behavior would be that the driver for each attached part would get called. It's then the driver's responsibility to return something, nothing, or something different when the groupId is set. The fix is that now we call shapeResult.OnGroup(context.GroupId); to ensure the shape is rendered with a provided groupId. Demos Security module The Security module right now is really focusing on security-related HTTP headers. Of course, you don't need a module for that or, you can write your own. You can just add headers directly, but the point here was to provide some defaults and secondly provide a way to easily configure them from the admin. This is especially interesting of course if you have a multi-tenant application and you don't want to hand-configure everything for everybody from code. First of all, you need to navigate to the admin UI of Orchard Core and enable the Security module under Configuration -> Features. After that, you will find a new option under Security -> Settings, called Security Headers. Here you see a UI to edit the Security Headers. The admin UI is not the only way to edit them, so just as with all these technical modules, it's also possible to configure it from the appsettings. There is also an example in the documentation of how to do that. The main sections are that we have content security policy-related headers (pretty much all of those, that are supported by browsers) and permissions policy headers, everything related to various peripherals, devices, etc. And finally, we also have one configuration for referrer policy. Let's try it out quickly! Let's say we set the referrer policy to Origin. If we open up the DevTools window of Google Chrome and navigate to the Network tab, you will see that the referrer-policy value of the response is now set to origin. If you like to use it check out the latest release of Orchard Core, and if you would like to know more about this new module, head to YouTube for a recording! News from the community Orchard Core Commerce MVP planning and survey A few weeks ago, you could see a nice demo about the Orchard Core Commerce module. And in that blog post, we also mentioned that Lombiq provides stewardship for this module. That actually means that we will do code reviews and work on features and fixes. To have that, Márk Bartha (who is the project leader from our side) started this thread and added this survey. This is about asking the community what the most important features for you would be in an Orchard Core-based e-commerce solution. If you do e-commerce or if you have an opinion about e-commerce, please share your opinion here. The point of this is to try to do not all the things but focus on what is really needed first. Orchard Dojo Newsletter Lombiq's Orchard Dojo Newsletter has 277 subscribers! We have started this newsletter to inform the community around Orchard with the latest news about the platform. By subscribing to this newsletter, you will get an e-mail whenever a new post is published to Orchard Dojo, including This week in Orchard of course. Do you know of other Orchard enthusiasts who you think would like to read our weekly articles? Tell them to subscribe here! If you are interested in more news around Orchard and the details of the topics above, don't forget to check out the recording of this Orchard meeting!

Option to disable SQLite connection pooling, tenant hostname duplicate check - This week in Orchard (08/04/2022)

Adding an AppSetting option to disable SQLite connection pooling, improving tenant hostname duplicate check, Monaco loader aware of the virtual folder, and a new tutorial sample project in the Lombiq Vue.js module for Orchard Core! Check out our current post to read about the details! Orchard Core updates Added an AppSettings option to disable SQLite connection pooling Most database configuration is handled automatically, but there are limited options that can affect the way the database works. By default in .NET 6, Microsoft.Data.Sqlite pools connections to the database. It achieves this by putting locking the database file and leaving connections open to be reused. If the lock is preventing tasks like backups, this functionality can be disabled. There may be a performance penalty associated with disabling connection pooling. See the Microsoft.Data.Sqlite documentation or the Orchard Core documentation for more details. As you can see in the screen below, you can configure the UseConnectionPooling by using the appsettings.json to turn on the pooling that will be used by the SqliteConnectionStringBuilder when using SQLite. Improving tenant hostname duplicate check There was an issue about the tenant's hostname was not checked for existence if the other tenant has multiple hostnames. You could reproduce this bug by following these simple steps: Create a tenant with the hostnames "example1.com, example2.com". Create a tenant with the hostname "example1.com". Observe that you can create the second tenant even though the hostname is duplicated. The expected behavior would be that you get the "A tenant with the same host and prefix already exists." validation error, and you can't save the tenant. Note that the validation error is raised if the first tenant has just a single hostname specified. In the following example, we created a tenant with the name Tenant4. We keep everything as is, and we just provided the hostname to be example1.com. After we added another tenant by using Tenant5 as the name. We kept the prefix empty and used example1.com as the hostname again. As you can see, we got the following validation error. Monaco loader is aware of the virtual folder We use the tenant prefix to set a data-tenant-prefix attribute that will be used by the monaco loader.js to load editor.main.js. But it doesn't take into account a possible virtual folder, so here we use the PathBase instead. Jean-Thierry Kéchichian kept the data-tenant-prefix attribute name to not break anything. Just for info, he tried to use tété as a tenant prefix, then in the HTML source code, we can see some attributes that are URL encoded t%C3%A9t%C3%A9, e.g., when .RouteUrl() is used, some are HTML encoded tété e.g., when @Url.Content(~/...) is used, and some that are not encoded tété, e.g., those provided by resources tag helpers. We know that the browser is able to do the right decoding/encoding (escaping is more important, e.g., on server-side redirections), so he let things as is to not break anything. But here it is an HTML data attribute used by a script, so here he opted to use the escaped PathBase by not using .Value so that the implicit .ToString() will encode it if needed. Don't forget that Url.Content("~/") doesn't encode URLs, so if you use href="@Url.Content("~/"), special chars that were not URL encoded will be HTML encoded by the rendering. News from the community New tutorial sample project in the Lombiq Vue.js module for Orchard Core The Lombiq Vue.js module for Orchard Core is an Orchard Core module that contains Vue.js and commonly used Vue.js components to be used in other Vue.js apps as dependencies. Provides extensibility to create Vue.js component templates as Orchard Core shapes making them able to override in themes or modules. We wrote about having Single File Components in the module a few weeks ago, and from now, this module contains this new, polished, detailed tutorial sample project about integrating Vue.Js into Orchard Core. The sample project has different top-level training sections, like: Writing Vue.js applications in Orchard Core modules Writing Vue.js Single File Components in Orchard Core modules If you want to know more about it, don't forget to check out the mentioned This week in Orchard post and this recording on YouTube! Orchard Dojo Newsletter Lombiq's Orchard Dojo Newsletter has 247 subscribers! We have started this newsletter to inform the community around Orchard with the latest news about the platform. By subscribing to this newsletter, you will get an e-mail whenever a new post is published to Orchard Dojo, including This week in Orchard of course. Do you know of other Orchard enthusiasts who you think would like to read our weekly articles? Tell them to subscribe here! If you are interested in more news around Orchard and the details of the topics above, don't forget to check out the recording of this Orchard meeting!

Add UI for email proxy settings, Lombiq Orchard Visual Studio Extension supports Visual Studio 2022 - This week in Orchard (31/03/2022)

Fixing that content parts/fields were not showing up in preview when ContentCard is used, preventing Visual Studio Missing Components warning, adding UI for email proxy settings, and the Lombiq Orchard Visual Studio Extension now supports Visual Studio 2022! Check out our current post to read about the details! Orchard Core updates Add UI for email proxy settings A few weeks ago, we mentioned that from now you have the option to configure the proxy server and the proxy port number if you would like to set up the SMTP settings. And you must configure ProxyHost and ProxyPort if the SMTP server runs through a proxy server. But you don't have a UI for these until now! If you enable the Email feature and navigate to Configuration -> Settings -> Email, you will find the text boxes that you can use to set up the proxy hostname and proxy port number. Prevent Visual Studio Missing Components warning If you have installed Visual Studio Community 2022 (and don't forget: Orchard Core 1.3.0 release is removing support for netcoreapp3.1 and net5.0. Only net6.0 is supported, which is not supported in Visual Studio 2019), you didn't need to install any additional components. So, maybe we could just remove the .vsconfig file. But maybe still useful to keep it, so Jean-Thierry Kéchichian removed the Microsoft.NetCore.ComponentGroup.Web.2.1, Microsoft.VisualStudio.Component.TypeScript.3.5, and Microsoft.VisualStudio.Workload.NetCoreTools components that aren't included in the Visual Studio Community component directory documentation or marked as no more supported. Content parts/fields were not showing up in preview when ContentCard is used Let's say, you are trying to modify the BagPart to support a read-only scenario. Like if a user does not have permission to EditContent but has permission to ViewContent. In that case, the user should not be able to edit but should be able to view the data. Here are the steps to reproduce the behavior: Add content type A and attach BagPart to it that contains content type B. Make B securable to control who can edit and who can view it. Give the user read-only permission to B and Edit permission to A. At this point, you'll need to modify the BagPart.Edit.cshtml template to set the BuildEditor property to false when the user does not have the proper permission to edit. Finally, you'll need to render the ContentPreview shape on the ContentCard.Frame to display the ContentCard in a preview only. The expected behavior would be that the ContentCard to show up in the BagPart as it would in a preview screen. But it does not. The display the content cards correctly, the fix was to do a little modification in the ContentCard.cshtml file. News from the community Lombiq Orchard Visual Studio Extension now supports Visual Studio 2022 Lombiq Orchard Visual Studio Extension is a Visual Studio extension with many features and templates frequently used by Lombiq developers. It contains Orchard-related (including Orchard Core) as well as generic goodies. It contains several useful features like: Dependency Injector: When a class is opened in the editor, you can inject a dependency with this feature. Type the dependency name, hit Enter, and it will be injected. Orchard Error Log Watcher: Watches the Orchard error log (or any other error log) and lights up an icon when a new entry was logged. And wait, there's more! This feature also supports BlinkStick USB LED sticks that can blink or light up when an error happens. Check out this video for a demo of the whole feature. And from now, our Orchard Visual Studio Extension supports Visual Studio 2022! For more details, check out the Readme! Orchard Dojo Newsletter Lombiq's Orchard Dojo Newsletter has 244 subscribers! We have started this newsletter to inform the community around Orchard with the latest news about the platform. By subscribing to this newsletter, you will get an e-mail whenever a new post is published to Orchard Dojo, including This week in Orchard of course. Do you know of other Orchard enthusiasts who you think would like to read our weekly articles? Tell them to subscribe here! If you are interested in more news around Orchard and the details of the topics above, don't forget to check out the recording of this Orchard meeting!

Hide the "New" option if they are not authorized to edit, UI testing PoC with the Lombiq UI Testing Toolbox - This week in Orchard (04/03/2022)

This week you can read about hiding the "New" option from the admin UI if they are not authorized to edit, changing the content of the built-in recipes, and a demo about a UI testing PoC with the Lombiq UI Testing Toolbox! Are you interested in the details? Check out this post for more! Orchard Core updates Hide the "New" option if they are not authorized to edit If you have a list content type (e.g., Blog) with the contained type (Blog Post) and the user doesn't have Edit Blog Post permission, they still see the New Blog Post button on the Blog editor. Note, that the user has permission to edit the Blog. And it was a bug that could be reproduced by just following some simple steps: Create a Blog Post content type. Create a Blog content type with a ListPart containing the Blog Post type. Update the Moderator role: set Edit for Blog but don't set it to Blog Post. Create a test user and associate them with the Moderator role. Log in with the test user and create a Blog. Observe that the New Blog Post button appears on the top-right corner, but you'll get a 403 when you click on it. The solution was just to similarly to the Content list page authorize the user to edit the types so if they are not authorized to edit, then hide the New option. Remove FileContentDefinition from recipes Last December, the community decided to do not to enable the File Content Definition feature by default. And by doing that, the OrchardCore.Contents.FileContentDefinition usage was removed from the Agency and Blog recipes. It's only useful in specific cases, and most of the time you need to turn it off. The same issue is there with the Headless and Blank recipes. Especially for the Blank recipe, there is no reason to include anything apart from the bare bones. The solution was just to remove the OrchardCore.Contents.FileContentDefinition enables a step from the two recipes. Demos UI testing PoC with the Lombiq UI Testing Toolbox In this demo, we will talk about this particular pull request, which is about a proof of concept. Maybe you have already heard about the Lombiq UI Testing Toolbox, our web UI testing toolbox mostly for Orchard Core applications. Everything you need to do UI testing with Selenium for an Orchard app is here. We wrote about it several times here as well, first when we open-sourced it when we added some Orchard Core Features tests to it, and some weeks ago, you could read about the automated monkey testing feature of the toolbox. So, what about trying out this toolbox in Orchard itself, and let's see whether it works and whether it can be useful. Of course, we have Cypress tests in Orchard Core, so this will be something with the same goal - not necessarily useful, not necessarily wanted to add - it's a proof of concept. Let's see how it looks! If you check out the mentioned pull request, you will find a new OrchardCore.Tests.UI project which references the UI Testing Toolbox. It contains a couple of classes, the main point here is the BasicOrchardFeaturesTests one. As you can see, this contains two xUnit test methods. The first is just running the TestBasicOrchardFeaturesExceptRegistrationAsync method, which tests all the basic Orchard features except for registration with the Blog recipe. You can specify the recipe itself with several other options like enabling accessibility checks. The second test is a failing test that you can check out on the CI. It's a usual Dotnet test execution, so you get a test summary in the end. You can see what the test did, and you can find the exact reason why this test failed (because it's cannot find the element by the navbar ID on a given page). If you go to Summary and check out Artifacts, you can download a file that contains the whole dump of the application with screenshots, HTML output, the Orchard logs, everything that you may need for troubleshooting. And, of course, you can also execute the test from Visual Studio as usual. The next steps here would be to: Recreate the Cypress tests so we can see how it compares. Most possibly, this would be running TestBasicOrchardFeaturesExceptRegistrationAsync with all recipes. Using WebApplicationFactory directly instead of running the tested app with the Dotnet CLI would be useful. What's behind TestBasicOrchardFeaturesExceptRegistrationAsync would potentially need to be copied to be serious here, since if something changes in Orchard deliberately, it can fail. If you would like to know more about this PoC, head to YouTube for a recording! News from the community War in Ukraine and Lombiq War in Ukraine and Lombiq: How does it affect us at Lombiq and what we're doing to help: https://lombiq.com/blog/war-in-ukraine-and-lombiq Orchard Dojo Newsletter Lombiq's Orchard Dojo Newsletter has 238 subscribers! We have started this newsletter to inform the community around Orchard with the latest news about the platform. By subscribing to this newsletter, you will get an e-mail whenever a new post is published to Orchard Dojo, including This week in Orchard of course. Do you know of other Orchard enthusiasts who you think would like to read our weekly articles? Tell them to subscribe here! If you are interested in more news around Orchard and the details of the topics above, don't forget to check out the recording of this Orchard meeting!

Monaco editor supports preview, Vue.js Single File Components in Lombiq Vue.js module - This week in Orchard (25/02/2022)

This week you can read about updating the Monaco editor to support preview, improving the documentation of Orchard Core, search form improvements, and a demo about using Vue.js Single File Components in Lombiq Vue.js module for Orchard Core! Are you interested in the details? Check out this post for more! Orchard Core updates Make the Monaco editor Field support preview Now the Monaco editor Field correctly supports the content preview feature on every change. To test this out, you just need to have a content type with a Text Field attached. Don't forget to set the editor type to Monaco editor for that field. Documentation improvements The documentation of Orchard Core has been improved. Documentation for the Audit Trail, SEO Meta, Deployment, Remote Deployment, Redis modules have been added, and there were some missing Orchard Core Demo YouTube videos that are now embedded into the corresponding page of the documentation. Search Form: allow to override Index used Let's say you have a content type, called Blog. Inside that, there are a lot of blog posts, and there is a need to search inside of that content type of Blog. The question is, how can you limit the full-text search based on that content type? Well, from now there is a new feature that allows passing a QueryString param in the search form page to override the current default Index used for displaying results. This can also be set as a hidden form input fixed value if used from a different form. These Indices are protected by permissions, so it should be fine to allow to do this, instead of needing to create a different controller per index required to be searched from. You can use this in the following way: /search?Terms=moon&Index=BlogIndex Demos Vue.js Single File Components in Lombiq Vue.js module for Orchard Core The Lombiq Vue.js module for Orchard Core is an Orchard Core module, that contains Vue.js and commonly used Vue.js components to be used in other Vue.js apps as dependencies. Provides extensibility to create Vue.js component templates as Orchard Core shapes making them able to override in themes or modules. And from now, you have the option to use Vue.js Single File Components! The module identifies Single File Components in the Assets/Scripts/VueComponents directory and harvests them as shapes. They have a custom .vue file renderer that displays the content of the <template> element after applying localization for the custom [[ ... ]] expression that calls IStringLocalizer. Besides that, it's pure Vue, yet you can still make use of shape overriding if needed. You can read more about it in the module's readme file. Now it's time to see it in action! You will find a Lombiq.VueJs.Samples project in the repository that contains some Vue files. The module now supports these special files (where you can put the template and the script in the same file) and harvest these as shapes. If you open up the demo-sfc.vue file, you can see one unique solution for localization. As we mentioned, by using the [[ ... ]] syntax, you can perform localization via IStringLocalizer at runtime. Let's run the Vue.js Single File Component sample in the Lombiq.VueJs.Samples module! As you can see, this sample is about providing a table with some data and a pager that you can use to navigate between the pages of the table with the help of the Single File Components. And we are just scratching the surface here! If you would like to know more about using Vue.js Single File Components with the help of the Lombiq Vue.js module, check out this recording on YouTube! News from the community Orchard Dojo Newsletter Lombiq's Orchard Dojo Newsletter has 237 subscribers! We have started this newsletter to inform the community around Orchard with the latest news about the platform. By subscribing to this newsletter, you will get an e-mail whenever a new post is published to Orchard Dojo, including This week in Orchard of course. Do you know of other Orchard enthusiasts who you think would like to read our weekly articles? Tell them to subscribe here! If you are interested in more news around Orchard and the details of the topics above, don't forget to check out the recording of this week's Orchard meeting!

Include or exclude tenant features and/or themes, allow editing Time Field seconds and milliseconds - This week in Orchard (07/09/2021)

Allow to edit Time Field seconds and milliseconds, document dependency version selection in ResourceManagementOptionsConfiguration class, demo about a feature to include or exclude tenant features and/or themes, and many more coming this week! Check out our post for more! Orchard Core updates Document dependency version selection in ResourceManagementOptionsConfiguration class Let's say that in the theme layout, you want to enforce Bootstrap 4.6 and added this <script asp-name="bootstrap" version="4" at="Foot"></script> which includes Bootstrap 4 as desired. Now let's have a custom module that allows converting a select-menu to a searchable-menu. This module depends on Bootstrap and jQuery to be able to function. So in the ResourceManagementOptionsConfiguration class, we need to define the dependencies like this: _manifest.DefineScript("SearchableDropdown") .SetUrl("~/SearchableDropdowns/bootstrap-select.min.js", "~/SearchableDropdowns/bootstrap-select.js") .SetDependencies("jquery", "bootstrap") .SetVersion("1.0.0"); _manifest.DefineStyle("SearchableDropdown") .SetUrl("~/SearchableDropdowns/bootstrap-select.min.css", "~/SearchableDropdowns/bootstrap-select.css") .SetDependencies("bootstrap") .SetVersion("1.0.0"); Unfortunately, the SetDependencies("bootstrap") call here forces to include Bootstrap 5, which will cause Bootstrap 4 and 5 to be included! Obviously, this is a problem. But you can easily solve this problem. You can use the SetDependencies method to ensure the script or style is loaded after their dependency, where you can set a specific version of your choice or the latest version available. Check out this new section in the Orchard Core documentation where we used SetDependencies("bootstrap:4") to say that we would like to define a style that depends on Bootstrap version 4. Allow editing Time Field seconds and milliseconds Let's take a quick look at the improvements of the Time Field. In our example, we have set up our Orchard Core site using the Blog recipe and modified the content definition of the Blog Post content type by adding a new Time Field to it. When you navigate to the settings of the Time Field, you will see a new setting here, called Step. This is just about manipulating the value of the step attribute of the time input type. You can read a lot about the step attribute here, now we just want to show you a small example of how you can use this new option. Let's say we want to allow to be able to edit the seconds for the Time Field too, but not the milliseconds. If we type 15 for the Step here, users can choose from the following values when setting the seconds: 0, 15, 30, and 45. It means, setting the value of this field to 03:39:15 PM would be suitable. If the user would like to create a new blog post and enter an invalid value for the Time Field, they would see the following message by showing some suggestions about the nearest valid values. Do not enable OrchardCore.Feeds by default in standard recipes By default by enabling the OrcardCore.Feeds module your lists will have feeds capabilities but for the Blank and the Agency recipe. This doesn't make any sense because we don't have any lists defined by default in these recipes. The change here is the Blank and the Agency recipes now will not enable the Feeds module by default. Demos Include or exclude tenant features and/or themes This upcoming feature is about through app settings/configuration adds the ability to restrict the features and/or themes that are available to either a tenant and/or all tenants or a mix of both. If you checkout to the deanmarcussen/excludefeatures branch, you will see a new OrchardCore_Features section in the appsettings.json file where you can see rules that you can apply to the various features. The idea here is that you can have the rule to either exclude or include a given expression based on the feature name. By default, the OrchardCore.Templates feature and the TheAgencyTheme are excluded for all tenants, but the default tenant has an include rule with a "*" expression which means that tenant gets everything. Now let's see this in practice! Let's set up a site using the Software as a Service recipe to get the Tenants feature enabled by default. If you navigate to Configuration -> Features on the admin UI, you will see that the Templates feature is available with the TheAgencyTheme as well (Design -> Themes). But if you have a tenant called blog1 and search for templates on the Features page, you will only find the Shortcode Templates one because the Templates feature is excluded for this tenant. And the same will apply if you navigate to Design -> Themes and try to find The Agency Theme. A nice additional feature would be to have a UI, where you can specify what kind of features and/or themes would like to exclude or include for the given tenant. But we are just scratching the surface of this upcoming feature. If you would like to know more, don't forget to head to YouTube for a recording to learn more! News from the community Helping the City of Santa Monica with Orchard Core consulting A few weeks ago we mentioned a new website using Orchard Core: the site of the City of Santa Monica, which you can find on Show Orchard as well! Show Orchard is a website for showing representative Orchard CMS (and now Orchard Core) websites all around the internet. It was started by Ryan Drew Burnett, but since he doesn't work with Orchard anymore, as announced earlier, it is now maintained by our team at Lombiq Technologies. Santa Monica is a beachside city of 8.3 square miles on the westside of Los Angeles County. Offering an environment of unparalleled natural beauty, the city is home to a mix of residential communities, commercial districts, and recreational venues. And we actually had a small part in this by helping the creation of this site with some Orchard Core consulting. If you would like to know more, check out the case study on our site here. Orchard Dojo Newsletter Lombiq's Orchard Dojo Newsletter has 224 subscribers! We have started this newsletter to inform the community around Orchard with the latest news about the platform. By subscribing to this newsletter, you will get an e-mail whenever a new post is published to Orchard Dojo, including This week in Orchard of course. Do you know of other Orchard enthusiasts who you think would like to read our weekly articles? Tell them to subscribe here! If you are interested in more news around Orchard and the details of the topics above, don't forget to check out the recording of this week's Orchard meeting!

Google Tag Manager, User Approval feature - This week in Orchard (06/08/2021)

We promised that we will continue showing you the newest features and additions of Orchard Core 1.0 this week too! Well, we still have a lot to write about, so without any further ado, let's get started! Orchard Core updates Add user approval feature The user registration process, whether from the Registration controller, or via an ExternalLoginProvider had no features to moderate a user. In Orchard 1 we could moderate users, through an approval process. A new user registering when moderation was required, would not be logged in to the site, but redirected to the registration pending page, (and workflows invoked, to start the moderation process). We already have the IsEnabled bool, but no way to control both local registration and external registration. This change adds a UsersAreModerated setting to the user registration feature. When set true all users, whether registering via an external provider, or direct through the registration controller, will require approval, i.e., their account set IsEnabled = true before they are logged into the site. It also prevents external users from being automatically logged in if they have not confirmed their email address (if the confirmation email setting is set to true). Register user workflow updated to support the feature as well. Let's see this one quickly in action! First of all, you need to enable the Users Registration feature that allows external users to sign up to the site and ask to confirm their email. Now you can head to Security -> Settings -> User Registration, where you will see a new option: Users must be approved before they can log in. Put a tick in this checkbox and, don't forget to select the AllowRegistration option from the select list. Now, let's register with a new user! If you create a new account and hit the Register button, you will find the following screen meaning that an admin needs to approve your account before it can be used. Let's see how you can use this one in workflows! Navigate to Workflows -> Create Workflow, and after you add a name to your workflow, hit the Add Task button. Find the Register User task from the list, and the editor of this task will contain a Users must be approved before they can log in checkbox. Now let's see how we can approve the newly registered users! If you navigate to Security -> Users on the admin UI, you will see a list that contains all the available users in the system, and you will also find a red badge with a Disabled text near the users who are not enabled yet. If you click on the Edit button near a disabled user, you can simply use the Is enabled? switch to enable the given user. After that, the user with the user name: newuser now can log in. OpenID Client parameters The OpenIdConnectOptions support an OnRedirectToIdentityProvider event feature which allows the setting of custom parameters on the protocol message when generating an OpenIdConnectMessage to an external provider. Sometimes you need to be able to send some custom parameters to some of your tenant's AzureB2C auth servers (but not all, and it varies per tenant). options.Events.OnRedirectToIdentityProvider = (context) =>{ context.ProtocolMessage.SetParameter("foo", "bar"); return Task.CompletedTask;}; The solution here would be to have editable parameter (kvp) options on the OpenIdConnectSettings so you can configure different tenants to use different custom parameters. To test this out, you need to enable the OpenID Client feature under Configuration -> Features. After, head to Security -> OpenID Connect -> Authentication client, where you will see the new table called Advanced Parameters. Google Tag Manager Google describes its Tag Manager product as a 'Tag Management System' (TMS). That’s an excellent way to think about it. It does for a website’s tags what a Content Management System (CMS) does for its content. The service provides an interface through which to create and track all the tags your site needs. You no longer have to code each tag manually. Instead, you can create all your tags through the interface. Tag Manager will then implement them for your site. That is if you’ve embedded a straightforward piece of Tag Manager code into each page of the website. The Google Tag Manager container snippet is a small piece of JavaScript and non-JavaScript code that you paste into your pages. It enables Tag Manager to fire tags by inserting gtm.js into the page (or through the use of an iframe when JavaScript isn't available). But how can we use Google Tag Manager in our Orchard Core site? Well, first of all, you have to navigate to the Google Tag Manager portal and create a Tag Manager account. This will give you a generated Container ID for you to use on your website. Copy this ID, we will need it later! Now, enable the Google Tag Manager feature on your Orchard Core site and head to Configuration -> Google Tag Manager. Paste the Container ID here and hit Save. This will mean that the required JavaScript code for Google Tag Manager will be registered for every page on the front-end. News from the community Updated Orchard Core sites OrchardCore.net is the official website for Orchard Core. Try Orchard Core is the place where you can easily set up an Orchard Core site within a few minutes and try out the features of Orchard Core. Both of these sites have been updated to Orchard Core 1.0! Head to Try Orchard Core to try out Orchard Core 1.0 now! The OrchardCore.Samples repository contains a sample Multi-tenant application and a Modular application demonstrating how to build a Modular and a Multi-Tenant ASP.NET Core application using the Orchard Core Framework. This solution is also using Orchard Core 1.0 now, you should check out this solution to see some nice code examples! DotNest Core DotNest Core is a complete redevelopment of the DotNest platform, all on the latest version of Orchard Core. We've been running it with a couple of select few customers for a while now, and it's time to open it up a bit more. While you can't yet just simply create an Orchard Core-based DotNest site, you can sign up for our limited beta here. You'll soon be able to get a fully functional, reliably hosted Orchard Core site on DotNest where you can build your personal website or something to showcase your Orchard skills with. Orchard Dojo Newsletter Lombiq's Orchard Dojo Newsletter has 214 subscribers! We have started this newsletter to inform the community around Orchard with the latest news about the platform. By subscribing to this newsletter, you will get an e-mail whenever a new post is published to Orchard Dojo, including This week in Orchard of course. Do you know of other Orchard enthusiasts who you think would like to read our weekly articles? Tell them to subscribe here!

Source Browser, Content Request Culture Provider cookie setting - This week in Orchard (12/07/2021)

Fixing forms multi submit, set the cookie in the Content Request Culture Provider, Source Browser with Orchard Core, and many more coming this week! Orchard Core updates Set the cookie in the ContentRequestCultureProvider The ContentRequestCultureProvider allows you to switch the current culture based on the content item URL. If you have a site in French and English and you go on a page that contains a French content item, then the full request will go in French. This is what the RequestCultureProvider does, it assigns the current thread culture to the one that a content item is taken. The issue is the following. Assume you have a drop-down French and English to switch languages. Like you are, for instance, on the home page for English. And in the drop-down, you select French using the content picker. In this case, your whole navigation is back in French. Everything you will click should be in French now; the widgets, the content items, everything. But if you go to a page that is in English, the cookie is still for French, which means the next page that will open will assume you still want to be in French. This new option lets you switch the cookie to the culture of the content item you are watching. That means if you go to a content item with a different culture, your cookie will say: 'Oh, I want to be in this culture now, I don't want to be in the one that the drop-down selected before!'. By default, the ContentCulturePicker sets a cookie for the CookieRequestCultureProvider. This can be disabled in the Configuration -> Settings -> Localization -> Content Culture Picker settings page. The ContentRequestCultureProvider can set the cookie based on the ContentItem that matches the current URL. This setting can be edited in the Configuration -> Settings -> Localization -> Content Request Culture Provider settings page. Minor security issue: Internal File Path Disclosure An issue has been raised that the Media module can potentially expose internal file paths, letting a would-be attacker find out what OS the server is using and gaining knowledge about the file structure being used by the web application. If you open up the AdminController and check out the HttpPost version of the Upload action, you would see the following lines in the code that prints the path of the given file. The media file stores are supposed to catch all exceptions and rethrow them as a FileStoreException. The issue was the result contains the path, while it shouldn't. This issue has been fixed by now. Fix forms multi submit The idea here is that if you add the no-multisubmit class, then you can't submit a form twice. So when you double click, there won't be two POST requests, just a single one. And the issues that it triggered were like locking issues or concurrency issues like two content items use the same version and then two published versions. This is preventing issues like this. And you had to change every single form to prevent that. Document Static File Provider Feature and robots.txt for Tenants There is a Static File Provider feature that allows you to have custom static files served for each tenant differently. And in this case, whatever file you put under the App_Data\Sites\[Tenant]\wwwroot will be served in priority over the module's static files or the theme's static files. This way you can customize, for instance, a CSS for a tenant by putting it in this folder. If all tenants use the same theme, you can customize CSS or JavaScript by putting the files there. If you would like to read more about this, check out this updated page of the documentation. Demos Source Browser Source browser website generator that powers https://referencesource.microsoft.com, http://sourceroslyn.io, https://source.dot.net, and others. Create and host your own static HTML website to browse your C#/VB/MSBuild/TypeScript source code. Note that it does require an ASP.NET Core website for hosting (symbol index is kept server-side), so without ASP.NET Core the search function doesn't work. Dean Marcussen decided to build one for Orchard Core. And you can now browse the source code of Orchard Core using Source Browser. You can find the source code in the dm/orchardcore branch of this repository. If you would like to see a nice demo and discussion about this feature, don't forget to check out the following recording on YouTube! News from the community Lombiq Helpful Libraries: Contents Libraries The Lombiq Helpful Libraries consist of several various libraries that can be handy when developing for Orchard Core CMS, to be used from your own Orchard modules. This time we will see some helpful constants and extensions regarding contents. The CommonContentDisplayTypes static class contains values that can be used with IContentItemDisplayManager.BuildDisplayAsync or OrchardRazorHelperExtensions.DisplayAsync to safely select the correct display type. Here we have a BuildDisplayAsync method that loads the content item if the display type is not SummaryAdmin. As you can see, we could use the SummaryAdmin constant string here. The PublicationStatus enum can be used for instance to query content items based on the status of the content item. The WithContentItem extension method also uses these enums to filters a query to match the publication status in ContentItemIndex. You can see we have a query.WithContentItem(PublicationStatus.Published) call that will extend the given query with the ContentItemIndex index and use the given status of the content item. Orchard Dojo Newsletter Lombiq's Orchard Dojo Newsletter has 207 subscribers! We have started this newsletter to inform the community around Orchard with the latest news about the platform. By subscribing to this newsletter, you will get an e-mail whenever a new post is published to Orchard Dojo, including This week in Orchard of course. Do you know of other Orchard enthusiasts who you think would like to read our weekly articles? Tell them to subscribe here! If you are interested in more news around Orchard and the details of the topics above, don't forget to check out the recording of this week's Orchard meeting!

Audit Trail module UI improvements, new User Event Handlers - This week in Orchard (29/06/2021)

Improving the UI of the Audit Trail module, new user event handlers, feature to lock-out users on wrong password, and many more additions to Orchard Core in our current post! Orchard Core updates New User Event Handlers You can already work with several user event handlers. Let's say you want to do something after a user is created. For example, after a user has been created, I would like to send a welcome email to that user. And from now you will find more events if you open up the IUserEventHandler interface in the OrchardCore.Users.Abstractions module. Like now you can implement the CreatingAsync method, which occurs before a user is created. Or you can use the UpadatingAsync or UpdatedAsync events too! ListPart shape names for placement The issue is that placement doesn't take into consideration the display type convention, i.e. _SummaryAdmin when placing shapes, so the convention for shape names fails, and placing a ListPart shape tries to collect all three shapes, and render them. Fixed whitespace parsing in output tags in Fluid Let's say you have the following Liquid expression which is totally a valid one: {{ "foo" | size }} But what if you write this expression in the following way {{ "foo" | size}} it would say a parse error. But from now, if you have only one expression in different lines, the parser will work as expected. For example, now you can do something like this, this will be valid: {{ "foo" |size}} Lockout on wrong password The Lockout settings are set with the settings configured in ASP.NET Identity. Those options are used to define, for example, the TimeSpan a user is locked out for when a lockout occurs or the number of failed access attempts allowed before a user is locked out. So, from now you can define the logic where you want users to be locked out and you can also set how long you want to lock out that user after how many failed access. And if you check out the documentation you will find some lines about how you can read the configuration from an external config file. Here you can say that we want to allow this feature for every new user. And if they provide a wrong username or password 5 times a row, we lock out them for the next 5 minutes. And you also have an option to unlock users from the admin UI right away. If you navigate to Security -> Users you will find an Unlock button if the given user locked himself out. As you can see in the screen below, the user with the editor user name is a locked-out one. Adding docs for the absolute_url and href Liquid filters The page about the Liquid module in the documentation is a super-useful one because here you can see the list of all the available Liquid filters that you can use in Orchard Core. And now this page got an update by adding the absolute_url and href Liquid filters to it. The absolute_url creates the full absolute URL for the given relative virtual path and the href creates a content URL for a relative virtual path. Recommended for generating URLs in every case you want to refer to a relative path. Demos Audit Trail module UI improvements The Audit Trail module provides log records for creation, deletion of any content type, and events like user events. We wrote about the Audit Trail module for Orchard Core in this This week in Orchard post, if you haven't read about it yet, start by checking out that one first. Now, we will focus on the new UI. First of all, set up your site using the Blog recipe. After, head to the admin UI of your site and enable the Audit Trail and the Users Audit Trail features under Configuration -> Features. Audit Trail: Provides a log for recording and viewing back-end changes. Users Audit Trail: The users audit trail feature allows logging of user events. Now you can set up the Audit Trail module that you can do under Configuration -> Settings -> Audit Trail. Here you will see 3 different tabs: Events, Trimming, and Content. Under the Events tab, you can select what kind of events you would like to record. For example, you can say that I want to record the fact when an attempt to login failed, but I don't care about the event when a user was disabled. Under the Trimming tab, you can say how long you want to keep your records in your database. You can say that I want to keep the records for 30 days and delete the older ones. The Content tab is about setting the types of content whose events are recorded. If you don't want to log the changes for a given content type, you can just simply untick the given one. Let's say that now we want to log the changes of every content type. We need to do some changes to be able to see records in the Audit Trail list. Let's just modify the built-in blog post. Don't forget that you still have the Audit Trail Part that you can attach to any content type. If you do that, you can optionally provide a comment about this change for the Audit Trail. Now, let's open up the Audit Trail to check out our changes. As you can see here, we published the built-in blog post two times in a row. We also published the built-in About article but for this time, we attached the Audit Trail Part too. The content of the part (the comment) can be seen under each event. Also, notice that the user with the editor username has two failed login attempts. Now, let's hit the Details button near one of the content events. The Content tab here shows you some basic data about the event: the name of the event, the timestamp of the event, the current version, and so on. You can see the JSON representation of the content item under the Diff tab. Here you can choose between two types of views: Split: the content of the previous version can be seen on the left side of the screen and the content of the selected version can be seen on the right side of the screen. You can see the previous, changed data in red and the current, modified data in green. This screen shows that the ContentItemVersionId has just changed with the ModifiedUtc and the PublishedUtc values. The reason for that is we changed the Markdown text of the blog post, by adding a new paragraph to it. Unified: the meaning of the colors is the same here, the only difference is that you can see the whole changes in one view, instead of a split one. You will see a whole new user experience when you would like to list or sort the events in the Audit Trail list. Last week we wrote about the improved search filters to the contents and users list where you could read about the syntax for the filters. And slightly the same applies here too. If you click on the funnel icon before the search box and select the Filter Syntax one, you will see a modal window that shows you the available filters. This modal describes all the registered filters that you can use with the given properties. It also shows you the current values of the given filters and a little bit of information about the syntax. And then down the bottom, you just get the current filter and the normalized version of it which describes how it's being constructed. And as always, if you would like to see more about the new UI of the Audit Trail module in action, head to YouTube for a nice and detailed recording! News from the community Piotr Szmyd Last Tuesday June 22nd 2021, our dear friend Piotr Szmyd passed away. Piotr was a respected member of our community, a steering committee member, and a passionate contributor. Everyone loved him. By creating this issue we hope you can share a story or a thought to help keep his memory alive and show his family and his friends how much he meant to us. This picture was taken in LAX on September 2012 on the way to the first Orchard Harvest conference ever. From left to right: Zoltán Lehóczky, Benedek Farkas, Piotr Szmyd and Sipke Schoorstra. May our branches merge again, Piotr! Lombiq Helpful Extensions: Flows Helpful Extensions The Lombiq Helpful Extensions module is an Orchard Core module containing some handy extensions (e.g. filters for Projector). This time we will see the Flows Helpful Extensions which adds additional styling capabilities to the OrchardCore.Flows feature by making it possible to add classes to widgets in the Flow Part editor. But how can you use the Flows Helpful Extensions feature? Let's say you have a site set up with the Agency recipe. The first thing that you need to do is to navigate to Configuration -> Features and enable the Flows Helpful Extensions - Lombiq Helpful Extensions feature. Now, it's time to edit a content item that has a FlowPart attached. The Page will be great for us now. Let's say we add a new Html widget to the FlowPart of our new page. If you click on the new cog icon, you can add custom classes to this widget and remove the grid extension classes that will be added to your widget by default. OK, but what does it mean? What's the difference? The right side of the screen below shows you the original HTML and the one on the left shows you the modified one. As you can see, the my-custom-class CSS class is there and the widget-size-* and widget-align-* classes were removed because we put a tick on the Remove grid extension classes checkbox. Removing these classes is a good idea if you are using a CSS framework that adds CSS properties to these classes but you don't want to add styling to these elements based on these classes. In this case, you don't need to overwrite these properties. Orchard Dojo Newsletter Lombiq's Orchard Dojo Newsletter has 205 subscribers! We have started this newsletter to inform the community around Orchard with the latest news about the platform. By subscribing to this newsletter, you will get an e-mail whenever a new post is published to Orchard Dojo, including This week in Orchard of course. Do you know of other Orchard enthusiasts who you think would like to read our weekly articles? Tell them to subscribe here! If you are interested in more news around Orchard and the details of the topics above, don't forget to check out the recording of this week's Orchard meeting!

Improving search filters to the contents list - This week in Orchard (22/06/2021)

We can write about several nice improvements this week! Adding missing deployment steps, new lines about Shortcodes in the documentation, updating the content type editor, and a demo about the search filters improvements to the contents list! Orchard Core updates Deployment steps We have several cases where we have the recipe steps but not the deployment steps. For example, now you can export the Facebook login settings but without secrets (like passwords) because we don't handle that in the recipes right now. The newly added import/export deployment steps are: FacebookLogin GoogleAnalytics Microsoft Azure AD OpenIdValidationSettings Technical name of Content Type and Display Name of Content Parts in Edit Content Type page This feature is about to show a read-only input with the technical name of the content type when you would like to edit the content type definition. With this feature, you can easily see the difference between the display name and the technical name. Of course, you can guess the display name by the technical name, but not everyone knows that. You can check it out easily. Let's just navigate to the admin UI of Orchard Core and go to Content -> Content Definition -> Content Types. Edit one of the content types, and you will see the technical name and the display name of the content type. Shortcodes docs and rename Razor helper We have the HtmlToShortcodesAsync Razor helper that you can use to render Shortcodes. This one is now renamed to ShortcodesToHtmlAsync, and the old one is marked as obsolete. And you can also find some new lines in the documentation about how to render Shortcodes via a Liquid filter or Razor helper. Check allowed file extensions when importing media You can have a list in Orchard Core that contains the file extensions that can be uploaded to the media library. If you would like to upload a PDF file to the media library and the PDF extension is not allowed, you won't be able to upload that. However, if you want to import a PDF file via recipes, you could do that because the file extension checking was missing from there. It could be a security issue but if you have rights to execute recipes, that means you have already logged in as a user who has Security Critical permissions. And one more note here: if you do _logger.LogWarning, don't forget to check is the LogLeveL.Debug enabled _logger.IsEnabled(LogLevel.Debug), otherwise, don't write a warning to the log files. Remove deprecated SHA256CryptoServiceProvider usage While running a benchmark, it started failing, the SDK throwing some warning that the CryptographyAlgorithms.CreateSHA256() is deprecated and cannot be used in .NET 6. The documentation says that now we can do SHA256.Create(), and it works for all the versions that we are targeting. Someone else from Microsoft related to benchmarking and performance mentioned this issue because they are using Orchard Core as a source for the PGO. PGO means Performance Guided Optimizations which is a way to analyze what's happening in an app to optimize the IL generated by the JIT. Demos Improving search filters to the contents list A few weeks ago, you could see a demo regarding search filters and parsers for the contents list. This demo is just about showing you the final version of the search filters that you can also try out right now if you are using the preview packages of Orchard Core! Let's see how you can use this feature that makes browsing your content items much easier! We have a site set up with the Blog recipe. The blog recipe creates an Article content type and one Article content item by default. If you want to list all of the article content items, you just need to navigate to Content -> Content Items and select Article from the filter by content type dropdown menu. As you can see, this means that the Search textbox will be populated with the type:Article expression. It means if you write, type: and the name of the content type, you can list all of the content items from the given type. If you also want to sort the items by the created date (select Recently created from the Sort dropdown menu), the sort:Created text will also appear in the Search textbox. If you click on the funnel icon before the search box and select the Filter Syntax one, you will see a modal window that shows you the available filters. This modal describes all the registered filters that you can use with the given properties. It also shows you the current values of the given filters and a little bit of information about the syntax. And then down the bottom, you just get the current filter and the normalized version of it which describes how it's being constructed. And the same applies to the Users list too (Security -> Users). Here we filtered for the Enabled users where the name contains admin, and where the Administrator role applies. Finally, we sort them by their email address. If you would like to know more about this feature don't forget to check out this recording on YouTube! News from the community Lombiq Utility Scripts: create a trusted certificate Our Utility Scripts project is open source from last year! Many scripts for Orchard Core, Orchard CMS, Azure, SqlServer development. E.g., quick Orchard Core solution init, reset/reinstall. In the following lines, we would like to show you a nice and useful script that could be a very handful one during your Orchard Core development. The CreateTrustedCertificate script creates all necessary files and imports them into the local Certificate Store so that it can be used to access localhost sites via HTTPS. If you open up that file in GitHub, you will find several comments in the script that help you to see what are the steps that are script is actually doing! Orchard Dojo Newsletter Lombiq's Orchard Dojo Newsletter has 204 subscribers! We have started this newsletter to inform the community around Orchard with the latest news about the platform. By subscribing to this newsletter, you will get an e-mail whenever a new post is published to Orchard Dojo, including This week in Orchard of course. Do you know of other Orchard enthusiasts who you think would like to read our weekly articles? Tell them to subscribe here! If you are interested in more news around Orchard and the details of the topics above, don't forget to check out the recording of this week's Orchard meeting!