Change how the permissions are grouped and sorted, provide a way to override YesSql configuration and additional OpenId Introspection/Revocation endpoints and PKCE to the OpenID Settings and Application UI pages! Check out our current post to read about the details! Orchard Core updates Change how the permissions are grouped and sorted When the permissions are listed during role edit/create, currently we show the feature ID instead of a name. Displaying just the feature ID is not user-friendly. Here the goal is to create a new UI for this and also to order the permissions by Feature Names. Also, for content types, then it would display the content type name instead of its technical value/ID. So, we could display:{ Content Type Display Name } Content Type - { Content Type Technical Name }. In the case of the Blog content type could be My Blog Content Type - Blog. In order to show dynamic permissions as { Content Type Display Name } Content Type - { Content Type Technical Name } we would have to change how the category is set here otherwise we don't have the content type technical name here. But how the new UI looks like now? If you head to the admin UI of Orchard Core and navigate to Security -> Roles and Edit a given role, you will see the new UI. Here you can see we have a feature with the name Media and you can find the feature ID in brackets (they can be defined in the Manifest.cs file of the module). And under the Media (OrchardCore.Media), you can find all of the permissions which were defined in this module. You will find the Page Content Type - Page header at the bottom of this screen. This means the first word here is the Display Name of the Page content type (which is Page) and the last word here is the Technical Name of the Page content type, which is Page. Provide a way to override YesSql configuration Currently, there is no way to change the configuration of YesSql in Orchard Core. From now on you will find a new YesSqlOptions class that provides options to allow one to override the defaults. Added additional OpenId Introspection/Revocation endpoints and PKCE to the OpenID Settings and Application UI pages As a basic authorization server, the OpenID module doesn't use all the features/endpoints offered by OpenIddict, like introspection and revocation. As mentioned in openiddict/openiddict-core#1359 (comment), these features can be configured by amending the OpenIddict settings via a custom plugin, but a simpler story - GUI or recipes-based - may be preferable. To see the new changes, enable the OpenID Authorization Server and the OpenID Client features and after navigate to Security -> OpenID Connect -> Settings -> Authorization server. You will find a new Require Proof Key for Code Exchange checkbox on this page, which is a global setting that applies PKCE to all registered clients whether or not the 'Require PKCE' flag was set in the Application settings page. And you can do the same when adding an OpenID Connect Application. You can add a new application under Security -> OpenID Connect -> Management -> Applications. If you click on the Add an application button and put a tick to the Allow Authorization Code Flow checkbox, you will find the Require Proof Key for Code Exchange checkbox here as well. Note: ensure that the client application and OAuth or OIDC library being used supports PKCE before enabling this option. The documentation has also been updated to show you a sample of the OpenID Connect Settings recipe step and a sample of the OpenID Connect App recipe step. News from the community Lombiq Offline event Sometimes it's not just about work but doing something just for fun. These events are specifically for this: we get together and do something cool like breaking out of an escape room, going for a go-kart ride, or playing paintball. Our latest event took place at Lake Velence. We had a nice cycling tour around Lake Velence, had lunch in a nice restaurant, and had a barbecue together at the accommodation. The next day we went on a kayak trip and did a nice trip together to the nearby hills of the lake. This was a great opportunity to update our group photo on our official website, so head to the About us page where you can see most, but not all of our team as of the summer of 2022. Orchard Dojo Newsletter Lombiq's Orchard Dojo Newsletter has 313 subscribers! We have started this newsletter to inform the community around Orchard with the latest news about the platform. By subscribing to this newsletter, you will get an e-mail whenever a new post is published to Orchard Dojo, including This week in Orchard of course. Do you know of other Orchard enthusiasts who you think would like to read our weekly articles? Tell them to subscribe here! If you are interested in more news around Orchard and the details of the topics above, don't forget to check out the recording of this Orchard meeting!

Updating the Getting Started page, Deployment UI improvements, using proper Canonical URL in SEO Tags, displaying all users in the User Picker Field by default. Check out our current post to read about the details! Orchard Core updates Updating the "Getting Started" page of the documentation The Getting Started page of the documentation is outdated, so much so that it is not possible to get the results described. As an example, the latest version of Orchard Core 1.4.0 uses .Net 6.0, and accordingly, if you create a new empty project '.NET Core web application' with .Net 6.0, you will not have a Startup.cs file in which all the basic manipulations should take place. For new developers, this section is an important element of getting started with Orchard. And such difficulties in the guide can have a negative impact on entering a new environment. The goal here was to update this section for use on the latest stable version of Orchard Core and be sure to specify the platform versions on which it should work in case of obsolescence to be clear for which version this instruction is valid. Now, if you open up the Getting Started page of the documentation, you will see a section that helps you get started with Program.cs only using .NET 6 Framework. Add Manage Steps to the button to the deployment and add a description to the feature When viewing deployment plans on the UI, clicking the title directs the user to the manage steps page, which is great. However, there is no other indication about managing steps. In other words, the user does not know the difference between editing or managing steps. Now, there is a new button called Manage Steps that directs the user to the manage deployment steps page. This way the user can easily understand that there are 2 edit functions here (i.e., one for editing the steps and the other one for editing the deployment plan itself.) Also, the Deployment feature now has some sort of description like: Provides a way to import and export recipes. You can see both improvements on this screen. Display all users in the User Picker Field by default unless the user selects a specific role When a user attaches a User Picker Field to a content type, the field settings do not have default roles selected or have the DisplayAllUsers set to true, so in this case, the search for a user returns no records. The fix is to display all users in the User Picker Field by default to allow all users to show up. If the user wants to override that behavior, then they can specific roles to select from. Without this, no users will show up in User Picker Field unless the user edits the field and set the settings. Here we played with our favorite content type, the BlogPost, where we added a User Picker Field to it (Content -> Content Definition -> Content Types -> Blog Post -> Add Field). And that's all we haven't done any other modifications regarding the settings of the User Picker Field. Now, if you create a new blog post, you will see that the User Picker Field will list every user from the site instead of listing nobody by default. Use proper Canonical URL in SEO Tags Piers Lawson noticed that when he generates the URL of a Content Item that happens to be the Home Page, then the URL generated includes the permalink for the page. This then flows into other uses of the URL such as when the SEO module creates the og:url property or the Twitter:url. <meta content="https://localhost:44300/home-page" property="og:url" /><meta content="https://localhost:44300/home-page" name="twitter:url" /> He thought he could override this behavior by turning on the SEOMeta Part for the Content-Type used for the home page and providing a Canonical URL for the Content Item that is being used for the home page. That causes the link rel canonical to be added and set correctly but not the other tags: <meta content="https://localhost:44300/home-page" property="og:url" /><meta content="https://localhost:44300/home-page" name="twitter:url" /><link href="https://localhost:44300/" rel="canonical" /> The issue was it doesn't appear possible to set up a page to be the home page without Autoroute nor with Autoroute and a blank permalink. Now, this has been fixed in the SeoMetaSettingsHandler.cs. News from the community Orchard Dojo Newsletter Lombiq's Orchard Dojo Newsletter has 291 subscribers! We have started this newsletter to inform the community around Orchard with the latest news about the platform. By subscribing to this newsletter, you will get an e-mail whenever a new post is published to Orchard Dojo, including This week in Orchard of course. Do you know of other Orchard enthusiasts who you think would like to read our weekly articles? Tell them to subscribe here! If you are interested in more news around Orchard and the details of the topics above, don't forget to check out the recording of this Orchard meeting!

New Gulp pipeline Guide, fix content item display coordinator when a GroupId is provided, demo about the new Security module, and many more! Check out this post for the details! Orchard Core updates Gulp pipeline Guide There is a new Guide in the documentation that explains how the Gulp pipeline works and how to use it (what files to read, what files to output and bundle). If you would like to know more about the Gulp pipeline used in Orchard Core, check out this nicely-detailed page here! Use display names in registration settings If you enable the Users Registration module, you can have some registration-related settings under Security -> Settings -> User Registration. This page contains a Configure users registration drop-down where the values that the users can see was simply the names of enum that holds the user registration types. Now with this minor fix users can see nice-looking display names in this drop-down with spaces and everything. Fix content item display coordinator when a GroupId is provided When using the IContentItemDisplayManager build-editor for a specific GroupId, the drivers for each of the corresponding part never gets called. Steps to reproduce the behavior: Create a content part that generates special results when the content.GroupId is set to test. Create a content type and attach the content part you previously created. Now create a new controller to render the content items under a specific GroupId in the controller caller the driver like so _displayManager.BuildEditorAsync(contentItem, _accessor.Updater, true, "true", "some-prefix"). The expected behavior would be that the driver for each attached part would get called. It's then the driver's responsibility to return something, nothing, or something different when the groupId is set. The fix is that now we call shapeResult.OnGroup(context.GroupId); to ensure the shape is rendered with a provided groupId. Demos Security module The Security module right now is really focusing on security-related HTTP headers. Of course, you don't need a module for that or, you can write your own. You can just add headers directly, but the point here was to provide some defaults and secondly provide a way to easily configure them from the admin. This is especially interesting of course if you have a multi-tenant application and you don't want to hand-configure everything for everybody from code. First of all, you need to navigate to the admin UI of Orchard Core and enable the Security module under Configuration -> Features. After that, you will find a new option under Security -> Settings, called Security Headers. Here you see a UI to edit the Security Headers. The admin UI is not the only way to edit them, so just as with all these technical modules, it's also possible to configure it from the appsettings. There is also an example in the documentation of how to do that. The main sections are that we have content security policy-related headers (pretty much all of those, that are supported by browsers) and permissions policy headers, everything related to various peripherals, devices, etc. And finally, we also have one configuration for referrer policy. Let's try it out quickly! Let's say we set the referrer policy to Origin. If we open up the DevTools window of Google Chrome and navigate to the Network tab, you will see that the referrer-policy value of the response is now set to origin. If you like to use it check out the latest release of Orchard Core, and if you would like to know more about this new module, head to YouTube for a recording! News from the community Orchard Core Commerce MVP planning and survey A few weeks ago, you could see a nice demo about the Orchard Core Commerce module. And in that blog post, we also mentioned that Lombiq provides stewardship for this module. That actually means that we will do code reviews and work on features and fixes. To have that, Márk Bartha (who is the project leader from our side) started this thread and added this survey. This is about asking the community what the most important features for you would be in an Orchard Core-based e-commerce solution. If you do e-commerce or if you have an opinion about e-commerce, please share your opinion here. The point of this is to try to do not all the things but focus on what is really needed first. Orchard Dojo Newsletter Lombiq's Orchard Dojo Newsletter has 277 subscribers! We have started this newsletter to inform the community around Orchard with the latest news about the platform. By subscribing to this newsletter, you will get an e-mail whenever a new post is published to Orchard Dojo, including This week in Orchard of course. Do you know of other Orchard enthusiasts who you think would like to read our weekly articles? Tell them to subscribe here! If you are interested in more news around Orchard and the details of the topics above, don't forget to check out the recording of this Orchard meeting!

Adding an AppSetting option to disable SQLite connection pooling, improving tenant hostname duplicate check, Monaco loader aware of the virtual folder, and a new tutorial sample project in the Lombiq Vue.js module for Orchard Core! Check out our current post to read about the details! Orchard Core updates Added an AppSettings option to disable SQLite connection pooling Most database configuration is handled automatically, but there are limited options that can affect the way the database works. By default in .NET 6, Microsoft.Data.Sqlite pools connections to the database. It achieves this by putting locking the database file and leaving connections open to be reused. If the lock is preventing tasks like backups, this functionality can be disabled. There may be a performance penalty associated with disabling connection pooling. See the Microsoft.Data.Sqlite documentation or the Orchard Core documentation for more details. As you can see in the screen below, you can configure the UseConnectionPooling by using the appsettings.json to turn on the pooling that will be used by the SqliteConnectionStringBuilder when using SQLite. Improving tenant hostname duplicate check There was an issue about the tenant's hostname was not checked for existence if the other tenant has multiple hostnames. You could reproduce this bug by following these simple steps: Create a tenant with the hostnames "example1.com, example2.com". Create a tenant with the hostname "example1.com". Observe that you can create the second tenant even though the hostname is duplicated. The expected behavior would be that you get the "A tenant with the same host and prefix already exists." validation error, and you can't save the tenant. Note that the validation error is raised if the first tenant has just a single hostname specified. In the following example, we created a tenant with the name Tenant4. We keep everything as is, and we just provided the hostname to be example1.com. After we added another tenant by using Tenant5 as the name. We kept the prefix empty and used example1.com as the hostname again. As you can see, we got the following validation error. Monaco loader is aware of the virtual folder We use the tenant prefix to set a data-tenant-prefix attribute that will be used by the monaco loader.js to load editor.main.js. But it doesn't take into account a possible virtual folder, so here we use the PathBase instead. Jean-Thierry Kéchichian kept the data-tenant-prefix attribute name to not break anything. Just for info, he tried to use tété as a tenant prefix, then in the HTML source code, we can see some attributes that are URL encoded t%C3%A9t%C3%A9, e.g., when .RouteUrl() is used, some are HTML encoded t&#xE9;t&#xE9; e.g., when @Url.Content(~/...) is used, and some that are not encoded tété, e.g., those provided by resources tag helpers. We know that the browser is able to do the right decoding/encoding (escaping is more important, e.g., on server-side redirections), so he let things as is to not break anything. But here it is an HTML data attribute used by a script, so here he opted to use the escaped PathBase by not using .Value so that the implicit .ToString() will encode it if needed. Don't forget that Url.Content("~/") doesn't encode URLs, so if you use href="@Url.Content("~/"), special chars that were not URL encoded will be HTML encoded by the rendering. News from the community New tutorial sample project in the Lombiq Vue.js module for Orchard Core The Lombiq Vue.js module for Orchard Core is an Orchard Core module that contains Vue.js and commonly used Vue.js components to be used in other Vue.js apps as dependencies. Provides extensibility to create Vue.js component templates as Orchard Core shapes making them able to override in themes or modules. We wrote about having Single File Components in the module a few weeks ago, and from now, this module contains this new, polished, detailed tutorial sample project about integrating Vue.Js into Orchard Core. The sample project has different top-level training sections, like: Writing Vue.js applications in Orchard Core modules Writing Vue.js Single File Components in Orchard Core modules If you want to know more about it, don't forget to check out the mentioned This week in Orchard post and this recording on YouTube! Orchard Dojo Newsletter Lombiq's Orchard Dojo Newsletter has 247 subscribers! We have started this newsletter to inform the community around Orchard with the latest news about the platform. By subscribing to this newsletter, you will get an e-mail whenever a new post is published to Orchard Dojo, including This week in Orchard of course. Do you know of other Orchard enthusiasts who you think would like to read our weekly articles? Tell them to subscribe here! If you are interested in more news around Orchard and the details of the topics above, don't forget to check out the recording of this Orchard meeting!

Fixing that content parts/fields were not showing up in preview when ContentCard is used, preventing Visual Studio Missing Components warning, adding UI for email proxy settings, and the Lombiq Orchard Visual Studio Extension now supports Visual Studio 2022! Check out our current post to read about the details! Orchard Core updates Add UI for email proxy settings A few weeks ago, we mentioned that from now you have the option to configure the proxy server and the proxy port number if you would like to set up the SMTP settings. And you must configure ProxyHost and ProxyPort if the SMTP server runs through a proxy server. But you don't have a UI for these until now! If you enable the Email feature and navigate to Configuration -> Settings -> Email, you will find the text boxes that you can use to set up the proxy hostname and proxy port number. Prevent Visual Studio Missing Components warning If you have installed Visual Studio Community 2022 (and don't forget: Orchard Core 1.3.0 release is removing support for netcoreapp3.1 and net5.0. Only net6.0 is supported, which is not supported in Visual Studio 2019), you didn't need to install any additional components. So, maybe we could just remove the .vsconfig file. But maybe still useful to keep it, so Jean-Thierry Kéchichian removed the Microsoft.NetCore.ComponentGroup.Web.2.1, Microsoft.VisualStudio.Component.TypeScript.3.5, and Microsoft.VisualStudio.Workload.NetCoreTools components that aren't included in the Visual Studio Community component directory documentation or marked as no more supported. Content parts/fields were not showing up in preview when ContentCard is used Let's say, you are trying to modify the BagPart to support a read-only scenario. Like if a user does not have permission to EditContent but has permission to ViewContent. In that case, the user should not be able to edit but should be able to view the data. Here are the steps to reproduce the behavior: Add content type A and attach BagPart to it that contains content type B. Make B securable to control who can edit and who can view it. Give the user read-only permission to B and Edit permission to A. At this point, you'll need to modify the BagPart.Edit.cshtml template to set the BuildEditor property to false when the user does not have the proper permission to edit. Finally, you'll need to render the ContentPreview shape on the ContentCard.Frame to display the ContentCard in a preview only. The expected behavior would be that the ContentCard to show up in the BagPart as it would in a preview screen. But it does not. The display the content cards correctly, the fix was to do a little modification in the ContentCard.cshtml file. News from the community Lombiq Orchard Visual Studio Extension now supports Visual Studio 2022 Lombiq Orchard Visual Studio Extension is a Visual Studio extension with many features and templates frequently used by Lombiq developers. It contains Orchard-related (including Orchard Core) as well as generic goodies. It contains several useful features like: Dependency Injector: When a class is opened in the editor, you can inject a dependency with this feature. Type the dependency name, hit Enter, and it will be injected. Orchard Error Log Watcher: Watches the Orchard error log (or any other error log) and lights up an icon when a new entry was logged. And wait, there's more! This feature also supports BlinkStick USB LED sticks that can blink or light up when an error happens. Check out this video for a demo of the whole feature. And from now, our Orchard Visual Studio Extension supports Visual Studio 2022! For more details, check out the Readme! Orchard Dojo Newsletter Lombiq's Orchard Dojo Newsletter has 244 subscribers! We have started this newsletter to inform the community around Orchard with the latest news about the platform. By subscribing to this newsletter, you will get an e-mail whenever a new post is published to Orchard Dojo, including This week in Orchard of course. Do you know of other Orchard enthusiasts who you think would like to read our weekly articles? Tell them to subscribe here! If you are interested in more news around Orchard and the details of the topics above, don't forget to check out the recording of this Orchard meeting!

This week you can read about hiding the "New" option from the admin UI if they are not authorized to edit, changing the content of the built-in recipes, and a demo about a UI testing PoC with the Lombiq UI Testing Toolbox! Are you interested in the details? Check out this post for more! Orchard Core updates Hide the "New" option if they are not authorized to edit If you have a list content type (e.g., Blog) with the contained type (Blog Post) and the user doesn't have Edit Blog Post permission, they still see the New Blog Post button on the Blog editor. Note, that the user has permission to edit the Blog. And it was a bug that could be reproduced by just following some simple steps: Create a Blog Post content type. Create a Blog content type with a ListPart containing the Blog Post type. Update the Moderator role: set Edit for Blog but don't set it to Blog Post. Create a test user and associate them with the Moderator role. Log in with the test user and create a Blog. Observe that the New Blog Post button appears on the top-right corner, but you'll get a 403 when you click on it. The solution was just to similarly to the Content list page authorize the user to edit the types so if they are not authorized to edit, then hide the New option. Remove FileContentDefinition from recipes Last December, the community decided to do not to enable the File Content Definition feature by default. And by doing that, the OrchardCore.Contents.FileContentDefinition usage was removed from the Agency and Blog recipes. It's only useful in specific cases, and most of the time you need to turn it off. The same issue is there with the Headless and Blank recipes. Especially for the Blank recipe, there is no reason to include anything apart from the bare bones. The solution was just to remove the OrchardCore.Contents.FileContentDefinition enables a step from the two recipes. Demos UI testing PoC with the Lombiq UI Testing Toolbox In this demo, we will talk about this particular pull request, which is about a proof of concept. Maybe you have already heard about the Lombiq UI Testing Toolbox, our web UI testing toolbox mostly for Orchard Core applications. Everything you need to do UI testing with Selenium for an Orchard app is here. We wrote about it several times here as well, first when we open-sourced it when we added some Orchard Core Features tests to it, and some weeks ago, you could read about the automated monkey testing feature of the toolbox. So, what about trying out this toolbox in Orchard itself, and let's see whether it works and whether it can be useful. Of course, we have Cypress tests in Orchard Core, so this will be something with the same goal - not necessarily useful, not necessarily wanted to add - it's a proof of concept. Let's see how it looks! If you check out the mentioned pull request, you will find a new OrchardCore.Tests.UI project which references the UI Testing Toolbox. It contains a couple of classes, the main point here is the BasicOrchardFeaturesTests one. As you can see, this contains two xUnit test methods. The first is just running the TestBasicOrchardFeaturesExceptRegistrationAsync method, which tests all the basic Orchard features except for registration with the Blog recipe. You can specify the recipe itself with several other options like enabling accessibility checks. The second test is a failing test that you can check out on the CI. It's a usual Dotnet test execution, so you get a test summary in the end. You can see what the test did, and you can find the exact reason why this test failed (because it's cannot find the element by the navbar ID on a given page). If you go to Summary and check out Artifacts, you can download a file that contains the whole dump of the application with screenshots, HTML output, the Orchard logs, everything that you may need for troubleshooting. And, of course, you can also execute the test from Visual Studio as usual. The next steps here would be to: Recreate the Cypress tests so we can see how it compares. Most possibly, this would be running TestBasicOrchardFeaturesExceptRegistrationAsync with all recipes. Using WebApplicationFactory directly instead of running the tested app with the Dotnet CLI would be useful. What's behind TestBasicOrchardFeaturesExceptRegistrationAsync would potentially need to be copied to be serious here, since if something changes in Orchard deliberately, it can fail. If you would like to know more about this PoC, head to YouTube for a recording! News from the community War in Ukraine and Lombiq War in Ukraine and Lombiq: How does it affect us at Lombiq and what we're doing to help: https://lombiq.com/blog/war-in-ukraine-and-lombiq Orchard Dojo Newsletter Lombiq's Orchard Dojo Newsletter has 238 subscribers! We have started this newsletter to inform the community around Orchard with the latest news about the platform. By subscribing to this newsletter, you will get an e-mail whenever a new post is published to Orchard Dojo, including This week in Orchard of course. Do you know of other Orchard enthusiasts who you think would like to read our weekly articles? Tell them to subscribe here! If you are interested in more news around Orchard and the details of the topics above, don't forget to check out the recording of this Orchard meeting!

This week you can read about updating the Monaco editor to support preview, improving the documentation of Orchard Core, search form improvements, and a demo about using Vue.js Single File Components in Lombiq Vue.js module for Orchard Core! Are you interested in the details? Check out this post for more! Orchard Core updates Make the Monaco editor Field support preview Now the Monaco editor Field correctly supports the content preview feature on every change. To test this out, you just need to have a content type with a Text Field attached. Don't forget to set the editor type to Monaco editor for that field. Documentation improvements The documentation of Orchard Core has been improved. Documentation for the Audit Trail, SEO Meta, Deployment, Remote Deployment, Redis modules have been added, and there were some missing Orchard Core Demo YouTube videos that are now embedded into the corresponding page of the documentation. Search Form: allow to override Index used Let's say you have a content type, called Blog. Inside that, there are a lot of blog posts, and there is a need to search inside of that content type of Blog. The question is, how can you limit the full-text search based on that content type? Well, from now there is a new feature that allows passing a QueryString param in the search form page to override the current default Index used for displaying results. This can also be set as a hidden form input fixed value if used from a different form. These Indices are protected by permissions, so it should be fine to allow to do this, instead of needing to create a different controller per index required to be searched from. You can use this in the following way: /search?Terms=moon&Index=BlogIndex Demos Vue.js Single File Components in Lombiq Vue.js module for Orchard Core The Lombiq Vue.js module for Orchard Core is an Orchard Core module, that contains Vue.js and commonly used Vue.js components to be used in other Vue.js apps as dependencies. Provides extensibility to create Vue.js component templates as Orchard Core shapes making them able to override in themes or modules. And from now, you have the option to use Vue.js Single File Components! The module identifies Single File Components in the Assets/Scripts/VueComponents directory and harvests them as shapes. They have a custom .vue file renderer that displays the content of the <template> element after applying localization for the custom [[ ... ]] expression that calls IStringLocalizer. Besides that, it's pure Vue, yet you can still make use of shape overriding if needed. You can read more about it in the module's readme file. Now it's time to see it in action! You will find a Lombiq.VueJs.Samples project in the repository that contains some Vue files. The module now supports these special files (where you can put the template and the script in the same file) and harvest these as shapes. If you open up the demo-sfc.vue file, you can see one unique solution for localization. As we mentioned, by using the [[ ... ]] syntax, you can perform localization via IStringLocalizer at runtime. Let's run the Vue.js Single File Component sample in the Lombiq.VueJs.Samples module! As you can see, this sample is about providing a table with some data and a pager that you can use to navigate between the pages of the table with the help of the Single File Components. And we are just scratching the surface here! If you would like to know more about using Vue.js Single File Components with the help of the Lombiq Vue.js module, check out this recording on YouTube! News from the community Orchard Dojo Newsletter Lombiq's Orchard Dojo Newsletter has 237 subscribers! We have started this newsletter to inform the community around Orchard with the latest news about the platform. By subscribing to this newsletter, you will get an e-mail whenever a new post is published to Orchard Dojo, including This week in Orchard of course. Do you know of other Orchard enthusiasts who you think would like to read our weekly articles? Tell them to subscribe here! If you are interested in more news around Orchard and the details of the topics above, don't forget to check out the recording of this week's Orchard meeting!

Allow to edit Time Field seconds and milliseconds, document dependency version selection in ResourceManagementOptionsConfiguration class, demo about a feature to include or exclude tenant features and/or themes, and many more coming this week! Check out our post for more! Orchard Core updates Document dependency version selection in ResourceManagementOptionsConfiguration class Let's say that in the theme layout, you want to enforce Bootstrap 4.6 and added this <script asp-name="bootstrap" version="4" at="Foot"></script> which includes Bootstrap 4 as desired. Now let's have a custom module that allows converting a select-menu to a searchable-menu. This module depends on Bootstrap and jQuery to be able to function. So in the ResourceManagementOptionsConfiguration class, we need to define the dependencies like this: _manifest.DefineScript("SearchableDropdown") .SetUrl("~/SearchableDropdowns/bootstrap-select.min.js", "~/SearchableDropdowns/bootstrap-select.js") .SetDependencies("jquery", "bootstrap") .SetVersion("1.0.0"); _manifest.DefineStyle("SearchableDropdown") .SetUrl("~/SearchableDropdowns/bootstrap-select.min.css", "~/SearchableDropdowns/bootstrap-select.css") .SetDependencies("bootstrap") .SetVersion("1.0.0"); Unfortunately, the SetDependencies("bootstrap") call here forces to include Bootstrap 5, which will cause Bootstrap 4 and 5 to be included! Obviously, this is a problem. But you can easily solve this problem. You can use the SetDependencies method to ensure the script or style is loaded after their dependency, where you can set a specific version of your choice or the latest version available. Check out this new section in the Orchard Core documentation where we used SetDependencies("bootstrap:4") to say that we would like to define a style that depends on Bootstrap version 4. Allow editing Time Field seconds and milliseconds Let's take a quick look at the improvements of the Time Field. In our example, we have set up our Orchard Core site using the Blog recipe and modified the content definition of the Blog Post content type by adding a new Time Field to it. When you navigate to the settings of the Time Field, you will see a new setting here, called Step. This is just about manipulating the value of the step attribute of the time input type. You can read a lot about the step attribute here, now we just want to show you a small example of how you can use this new option. Let's say we want to allow to be able to edit the seconds for the Time Field too, but not the milliseconds. If we type 15 for the Step here, users can choose from the following values when setting the seconds: 0, 15, 30, and 45. It means, setting the value of this field to 03:39:15 PM would be suitable. If the user would like to create a new blog post and enter an invalid value for the Time Field, they would see the following message by showing some suggestions about the nearest valid values. Do not enable OrchardCore.Feeds by default in standard recipes By default by enabling the OrcardCore.Feeds module your lists will have feeds capabilities but for the Blank and the Agency recipe. This doesn't make any sense because we don't have any lists defined by default in these recipes. The change here is the Blank and the Agency recipes now will not enable the Feeds module by default. Demos Include or exclude tenant features and/or themes This upcoming feature is about through app settings/configuration adds the ability to restrict the features and/or themes that are available to either a tenant and/or all tenants or a mix of both. If you checkout to the deanmarcussen/excludefeatures branch, you will see a new OrchardCore_Features section in the appsettings.json file where you can see rules that you can apply to the various features. The idea here is that you can have the rule to either exclude or include a given expression based on the feature name. By default, the OrchardCore.Templates feature and the TheAgencyTheme are excluded for all tenants, but the default tenant has an include rule with a "*" expression which means that tenant gets everything. Now let's see this in practice! Let's set up a site using the Software as a Service recipe to get the Tenants feature enabled by default. If you navigate to Configuration -> Features on the admin UI, you will see that the Templates feature is available with the TheAgencyTheme as well (Design -> Themes). But if you have a tenant called blog1 and search for templates on the Features page, you will only find the Shortcode Templates one because the Templates feature is excluded for this tenant. And the same will apply if you navigate to Design -> Themes and try to find The Agency Theme. A nice additional feature would be to have a UI, where you can specify what kind of features and/or themes would like to exclude or include for the given tenant. But we are just scratching the surface of this upcoming feature. If you would like to know more, don't forget to head to YouTube for a recording to learn more! News from the community Helping the City of Santa Monica with Orchard Core consulting A few weeks ago we mentioned a new website using Orchard Core: the site of the City of Santa Monica, which you can find on Show Orchard as well! Show Orchard is a website for showing representative Orchard CMS (and now Orchard Core) websites all around the internet. It was started by Ryan Drew Burnett, but since he doesn't work with Orchard anymore, as announced earlier, it is now maintained by our team at Lombiq Technologies. Santa Monica is a beachside city of 8.3 square miles on the westside of Los Angeles County. Offering an environment of unparalleled natural beauty, the city is home to a mix of residential communities, commercial districts, and recreational venues. And we actually had a small part in this by helping the creation of this site with some Orchard Core consulting. If you would like to know more, check out the case study on our site here. Orchard Dojo Newsletter Lombiq's Orchard Dojo Newsletter has 224 subscribers! We have started this newsletter to inform the community around Orchard with the latest news about the platform. By subscribing to this newsletter, you will get an e-mail whenever a new post is published to Orchard Dojo, including This week in Orchard of course. Do you know of other Orchard enthusiasts who you think would like to read our weekly articles? Tell them to subscribe here! If you are interested in more news around Orchard and the details of the topics above, don't forget to check out the recording of this week's Orchard meeting!

We promised that we will continue showing you the newest features and additions of Orchard Core 1.0 this week too! Well, we still have a lot to write about, so without any further ado, let's get started! Orchard Core updates Add user approval feature The user registration process, whether from the Registration controller, or via an ExternalLoginProvider had no features to moderate a user. In Orchard 1 we could moderate users, through an approval process. A new user registering when moderation was required, would not be logged in to the site, but redirected to the registration pending page, (and workflows invoked, to start the moderation process). We already have the IsEnabled bool, but no way to control both local registration and external registration. This change adds a UsersAreModerated setting to the user registration feature. When set true all users, whether registering via an external provider, or direct through the registration controller, will require approval, i.e., their account set IsEnabled = true before they are logged into the site. It also prevents external users from being automatically logged in if they have not confirmed their email address (if the confirmation email setting is set to true). Register user workflow updated to support the feature as well. Let's see this one quickly in action! First of all, you need to enable the Users Registration feature that allows external users to sign up to the site and ask to confirm their email. Now you can head to Security -> Settings -> User Registration, where you will see a new option: Users must be approved before they can log in. Put a tick in this checkbox and, don't forget to select the AllowRegistration option from the select list. Now, let's register with a new user! If you create a new account and hit the Register button, you will find the following screen meaning that an admin needs to approve your account before it can be used. Let's see how you can use this one in workflows! Navigate to Workflows -> Create Workflow, and after you add a name to your workflow, hit the Add Task button. Find the Register User task from the list, and the editor of this task will contain a Users must be approved before they can log in checkbox. Now let's see how we can approve the newly registered users! If you navigate to Security -> Users on the admin UI, you will see a list that contains all the available users in the system, and you will also find a red badge with a Disabled text near the users who are not enabled yet. If you click on the Edit button near a disabled user, you can simply use the Is enabled? switch to enable the given user. After that, the user with the user name: newuser now can log in. OpenID Client parameters The OpenIdConnectOptions support an OnRedirectToIdentityProvider event feature which allows the setting of custom parameters on the protocol message when generating an OpenIdConnectMessage to an external provider. Sometimes you need to be able to send some custom parameters to some of your tenant's AzureB2C auth servers (but not all, and it varies per tenant). options.Events.OnRedirectToIdentityProvider = (context) =>{ context.ProtocolMessage.SetParameter("foo", "bar"); return Task.CompletedTask;}; The solution here would be to have editable parameter (kvp) options on the OpenIdConnectSettings so you can configure different tenants to use different custom parameters. To test this out, you need to enable the OpenID Client feature under Configuration -> Features. After, head to Security -> OpenID Connect -> Authentication client, where you will see the new table called Advanced Parameters. Google Tag Manager Google describes its Tag Manager product as a 'Tag Management System' (TMS). That’s an excellent way to think about it. It does for a website’s tags what a Content Management System (CMS) does for its content. The service provides an interface through which to create and track all the tags your site needs. You no longer have to code each tag manually. Instead, you can create all your tags through the interface. Tag Manager will then implement them for your site. That is if you’ve embedded a straightforward piece of Tag Manager code into each page of the website. The Google Tag Manager container snippet is a small piece of JavaScript and non-JavaScript code that you paste into your pages. It enables Tag Manager to fire tags by inserting gtm.js into the page (or through the use of an iframe when JavaScript isn't available). But how can we use Google Tag Manager in our Orchard Core site? Well, first of all, you have to navigate to the Google Tag Manager portal and create a Tag Manager account. This will give you a generated Container ID for you to use on your website. Copy this ID, we will need it later! Now, enable the Google Tag Manager feature on your Orchard Core site and head to Configuration -> Google Tag Manager. Paste the Container ID here and hit Save. This will mean that the required JavaScript code for Google Tag Manager will be registered for every page on the front-end. News from the community Updated Orchard Core sites OrchardCore.net is the official website for Orchard Core. Try Orchard Core is the place where you can easily set up an Orchard Core site within a few minutes and try out the features of Orchard Core. Both of these sites have been updated to Orchard Core 1.0! Head to Try Orchard Core to try out Orchard Core 1.0 now! The OrchardCore.Samples repository contains a sample Multi-tenant application and a Modular application demonstrating how to build a Modular and a Multi-Tenant ASP.NET Core application using the Orchard Core Framework. This solution is also using Orchard Core 1.0 now, you should check out this solution to see some nice code examples! DotNest Core DotNest Core is a complete redevelopment of the DotNest platform, all on the latest version of Orchard Core. We've been running it with a couple of select few customers for a while now, and it's time to open it up a bit more. While you can't yet just simply create an Orchard Core-based DotNest site, you can sign up for our limited beta here. You'll soon be able to get a fully functional, reliably hosted Orchard Core site on DotNest where you can build your personal website or something to showcase your Orchard skills with. Orchard Dojo Newsletter Lombiq's Orchard Dojo Newsletter has 214 subscribers! We have started this newsletter to inform the community around Orchard with the latest news about the platform. By subscribing to this newsletter, you will get an e-mail whenever a new post is published to Orchard Dojo, including This week in Orchard of course. Do you know of other Orchard enthusiasts who you think would like to read our weekly articles? Tell them to subscribe here!

Fixing forms multi submit, set the cookie in the Content Request Culture Provider, Source Browser with Orchard Core, and many more coming this week! Orchard Core updates Set the cookie in the ContentRequestCultureProvider The ContentRequestCultureProvider allows you to switch the current culture based on the content item URL. If you have a site in French and English and you go on a page that contains a French content item, then the full request will go in French. This is what the RequestCultureProvider does, it assigns the current thread culture to the one that a content item is taken. The issue is the following. Assume you have a drop-down French and English to switch languages. Like you are, for instance, on the home page for English. And in the drop-down, you select French using the content picker. In this case, your whole navigation is back in French. Everything you will click should be in French now; the widgets, the content items, everything. But if you go to a page that is in English, the cookie is still for French, which means the next page that will open will assume you still want to be in French. This new option lets you switch the cookie to the culture of the content item you are watching. That means if you go to a content item with a different culture, your cookie will say: 'Oh, I want to be in this culture now, I don't want to be in the one that the drop-down selected before!'. By default, the ContentCulturePicker sets a cookie for the CookieRequestCultureProvider. This can be disabled in the Configuration -> Settings -> Localization -> Content Culture Picker settings page. The ContentRequestCultureProvider can set the cookie based on the ContentItem that matches the current URL. This setting can be edited in the Configuration -> Settings -> Localization -> Content Request Culture Provider settings page. Minor security issue: Internal File Path Disclosure An issue has been raised that the Media module can potentially expose internal file paths, letting a would-be attacker find out what OS the server is using and gaining knowledge about the file structure being used by the web application. If you open up the AdminController and check out the HttpPost version of the Upload action, you would see the following lines in the code that prints the path of the given file. The media file stores are supposed to catch all exceptions and rethrow them as a FileStoreException. The issue was the result contains the path, while it shouldn't. This issue has been fixed by now. Fix forms multi submit The idea here is that if you add the no-multisubmit class, then you can't submit a form twice. So when you double click, there won't be two POST requests, just a single one. And the issues that it triggered were like locking issues or concurrency issues like two content items use the same version and then two published versions. This is preventing issues like this. And you had to change every single form to prevent that. Document Static File Provider Feature and robots.txt for Tenants There is a Static File Provider feature that allows you to have custom static files served for each tenant differently. And in this case, whatever file you put under the App_Data\Sites\[Tenant]\wwwroot will be served in priority over the module's static files or the theme's static files. This way you can customize, for instance, a CSS for a tenant by putting it in this folder. If all tenants use the same theme, you can customize CSS or JavaScript by putting the files there. If you would like to read more about this, check out this updated page of the documentation. Demos Source Browser Source browser website generator that powers https://referencesource.microsoft.com, http://sourceroslyn.io, https://source.dot.net, and others. Create and host your own static HTML website to browse your C#/VB/MSBuild/TypeScript source code. Note that it does require an ASP.NET Core website for hosting (symbol index is kept server-side), so without ASP.NET Core the search function doesn't work. Dean Marcussen decided to build one for Orchard Core. And you can now browse the source code of Orchard Core using Source Browser. You can find the source code in the dm/orchardcore branch of this repository. If you would like to see a nice demo and discussion about this feature, don't forget to check out the following recording on YouTube! News from the community Lombiq Helpful Libraries: Contents Libraries The Lombiq Helpful Libraries consist of several various libraries that can be handy when developing for Orchard Core CMS, to be used from your own Orchard modules. This time we will see some helpful constants and extensions regarding contents. The CommonContentDisplayTypes static class contains values that can be used with IContentItemDisplayManager.BuildDisplayAsync or OrchardRazorHelperExtensions.DisplayAsync to safely select the correct display type. Here we have a BuildDisplayAsync method that loads the content item if the display type is not SummaryAdmin. As you can see, we could use the SummaryAdmin constant string here. The PublicationStatus enum can be used for instance to query content items based on the status of the content item. The WithContentItem extension method also uses these enums to filters a query to match the publication status in ContentItemIndex. You can see we have a query.WithContentItem(PublicationStatus.Published) call that will extend the given query with the ContentItemIndex index and use the given status of the content item. Orchard Dojo Newsletter Lombiq's Orchard Dojo Newsletter has 207 subscribers! We have started this newsletter to inform the community around Orchard with the latest news about the platform. By subscribing to this newsletter, you will get an e-mail whenever a new post is published to Orchard Dojo, including This week in Orchard of course. Do you know of other Orchard enthusiasts who you think would like to read our weekly articles? Tell them to subscribe here! If you are interested in more news around Orchard and the details of the topics above, don't forget to check out the recording of this week's Orchard meeting!