The MiniProfiler visibility is now based on permissions, tenant APIs improvements, and using ListContent permission instead of ViewContent to see the content items list. Interested in the details? Well, then check out our post for the details! Orchard Core updates MiniProfiler visibility based on permissions MiniProfiler is a library and UI for profiling your application. By letting you see where your time is spent, which queries are run, and any other custom timings you want to add, MiniProfiler helps you debug issues and optimize performance. And MiniProfiler is a built-in feature in Orchard Core that has some updates. Let's say an admin needs to profile a production instance. Enabling MiniProfiler for everyone to see is not acceptable in most cases. Also, a user may want to profile an ajax request to analyze a query or other info. The solution here is to provide new permissions when you enable the Mini Profiler feature. If you navigate to Security -> Roles and hit Edit near any role, you can see the new permissions which enable you to view the Mini Profiler widget on the back end and the front-end pages. Tenant APIs improvements Orchard Core tenant APIs got several updates lately. First of all, there was no way to update some tenant settings from API calls. Meaning, the tenant's category was missing in the ApiController. We should be able to set a tenant's description via an API call, so this property is now included in the sent model. Another improvement is the new Edit endpoint because there was no way to update tenant settings from API calls. The new Edit endpoint in the Tenant's ApiController takes care of this and enables us to modify the tenant settings either if the tenant is uninitialized or running. The updateable properties are the same as what is displayed on the tenant editor on the Admin UI. Use ListContent permission instead of ViewContent Currently, we use View Content as a minimal permission to list the contents in the content items UI. We use the same permission to also show the Content -> Content Items admin menu. Here the List Content permission should be used, not View Content. What if someone wants to allow a user to view content using a direct link but does not want them to list the contents in the UI? Currently, this isn't possible. Additionally, ViewContent is granted to all Anonymous and Authenticated roles, which is fine. But, access to list contents should be granted by the ListContent permission to avoid allowing listing content without explicit permission grant. If you check out the change logs in the docs of the upcoming release, you can read about the updated permissions. News from the community Hastlayer is now fully open-source Hastlayer is being developed by Lombiq Technologies, a software, training, and services company focusing on web development with open Microsoft technologies. Hastlayer transforms .NET software into FPGA-implemented logic circuits. (FPGAs are chips that can mimic other chips.) The result is code that runs faster and uses less power than a code-only solution without sacrificing the ability of further developing your software. Using Hastlayer will optimize your performance and lower the power consumption of hardware, which will bring you more satisfied customers who want your solution and a boost in your company’s revenue. And we have just recently fully open-sourced Hastlayer! Orchard Dojo Newsletter Lombiq's Orchard Dojo Newsletter has 410 subscribers! We have started this newsletter to inform the community around Orchard of the latest news about the platform. By subscribing to this newsletter, you will get an e-mail whenever a new post is published to Orchard Dojo, including This week in Orchard of course. Do you know of other Orchard enthusiasts who you think would like to read our weekly articles? Tell them to subscribe here! If you are interested in more news about Orchard and the details of the topics above, don't forget to check out the recording of this Orchard meeting!

Extending user permissions, updating Localization documentation for the PO extractor tool, and fixing using a media profile the quality parameter had no effect. Check out our post for the latest updates on Orchard Harvest and a new tutorial series from Lombiq! Orchard Core updates Extend user permissions Last September, you could see a demo about extending user permissions. This involved several changes in how we handle users on the site, and we added more permissions to the Users module to make it more usable and robust for many use cases: List users in {0} role Edit users in {0} role Delete users in {0} role Assign users to {0} role Manage user profile settings Also, we now have settings that would allow the user to prevent username and/or email changes on the edit screen. Here is a screenshot of the new settings. If you would like to try out the features mentioned in the linked post, now, you can do that easily by using the nightly build packages of Orchard Core! Update Localization documentation for the extractor tool Hisham Abdullah Bin Ateya released the stable version of the PO Extractor Tool. As you can see in the Readme, this is a dotnet global tool to extract translatable strings from the C# and VB code, Razor templates, and Liquid templates to POT (portable object template) files. It is designed to follow conventions used in the Orchard Core project. The Localization page in the Orchard Core documentation has been updated to reflect the changes, like updating the URL of the tool and the commands that you can use to install the tool and generate PO files. Fix using a media profile the quality parameter had no effect When using the Liquid filter resize_url the quality parameter of a media profile will have no effect for jpg/webp. The issue can easily be fixed by moving the quality parameter behind the format parameter. To fix the resize_url filter a change to the ordering of parameters in OrchardCore.Media.Services.MediaProfileService.GetMediaProfileCommands(string name) is required. And here, you can see this quick fix to make the quality parameter work. Because with Dictionary the order of items is not guaranteed the fix is not regression proof. OrderedDictionary could be used as an alternative, but this would require a reference to System.Collections.Specialized in addition. News from the community Orchard Harvest updates Last year we conducted a survey to help us organize this year's Orchard Harvest conference. We shared the results last month, and based on your feedback, the event will be held in North America. Mike Alhayek also reached us saying he may have the right contact needed to facilitate the event in Las Vegas. Now we needed a date for the conference, and based on the results, the best would be to hold the conference in the Q2 of 2023. If you follow the official Twitter account of Orchard, you may face a poll where the goal was to find the best date. Based on the results, the winner is the option May 22-23 (Mon, Tue). Thanks for voting! Now the next goal is to be able to find the best location in Las Vegas. Also, we are looking for sponsors and contributors for the following: T-shirts. Location. A meet-up after the programs. Recording the presentations. Renting equipment for presentations. Catering. Webpage (we can host the conference site on DotNest for free). If anyone could help in any way that would be really appreciated. Please use the following thread in GitHub Discussions if you feel, you can join in organizing the upcoming Harvest, or if you want to be as updated as possible chime into the discussion! As we move forward, we will keep everyone informed of the details, and you will also find every piece in this newsletter! New tutorial series from Lombiq: DotNest Core Tutorials The Lombiq Hosting - Media Theme for Orchard Core repository contains an open-source project which will allow developers to host their themes in the Orchard Core Media Library, including templates and assets. The inspiration came from our public Orchard (Core) SaaS called DotNest. If you don't know it, you can use this site to sign up and get an Orchard (Core) site with two clicks for everyone. We don't vet who is signing up, so it should be safe, and it should be limited. But still, we want people to be able to have their sites as flexible as possible. And of course, there are a lot of built-in features in Orchard for that, you can do a lot from the admin. Part of the things you can do from the admin as well in a limited fashion is theming. We first wrote about the Media Theme a few weeks ago in this post. Although you can't install custom themes on DotNest (see "Limitations") you still have a lot of control over theming. Using Media Theme you can develop themes using Liquid templates and static assets as usual, from your favorite IDE, working with a local version of your DotNest site, and deploying code to it. Please follow the guidelines of the DotNest Core SDK, and if you prefer tutorial videos instead, check out our brand-new playlist. This playlist called DotNest Core tutorials will contain 5 videos starting with how you can create your first DotNest site and we will also see how to set up your local development environment to style a DotNest site, how to use recipes to keep your local environment up to date and how to deploy your theme to your DotNest site. 3 videos are out, the 2 remaining's will be available during the weekend. Would you like to run your Orchard Core site on DotNest? Create your Orchard Core site with two clicks on DotNest! Orchard Dojo Newsletter Lombiq's Orchard Dojo Newsletter has 406 subscribers! We have started this newsletter to inform the community around Orchard of the latest news about the platform. By subscribing to this newsletter, you will get an e-mail whenever a new post is published to Orchard Dojo, including This week in Orchard of course. Do you know of other Orchard enthusiasts who you think would like to read our weekly articles? Tell them to subscribe here! If you are interested in more news about Orchard and the details of the topics above, don't forget to check out the recording of this Orchard meeting!

Add permission check for the content type filter, prevent the Users feature from breaking when the Roles feature is disabled, add new database options, and a demo about the new Build Version Display module! Check out our post for the details! Orchard Core updates Add permission check for content type filter The content type filter should only show accessible content types. The user should only see content types that they can view. Before this fix, all of the content types were listed, even if you don't have permission to see it. Let's say that I am an editor user who has no access to view the Blog content type. In this case, when this user navigates to Content -> Content Items and clicks on the content type filter, the predefined Blog content item will not appear in the list. Prevent the Users feature from breaking when the Roles feature is disabled This was an old issue in Orchard Core if you disable the Roles module, the site crashes because the Users module needs the following services to work: IRoleService RoleManager IRoleStore This issue is now fixed, and you can disable the Roles module from the UI without facing an error. You can find the implementation details in this pull request, thanks to Mike Alhayek! Add database options like TablePrefixSeparator, Schema, IdentityColumnType, and DocumentTable Here is a summary of the changes: both TableNameConvention and TablePrefixSeparator were removed from YesSqlOptions. The following properties were added to the ShellSettings of each tenant: TablePrefixSeparator when this value does not exist, we assume _, however, if an empty string is found, we use no prefix for the tables. Schema was added to allow you to provide a specific schema to use. IdentityColumnSize when this value is empty or invalid, we assume Int64. DocumentTable when this value is empty, we assume Document. If adding a new tenant failed due to missing Encrypt=false or TrustServerCertificate=True, we add the error to the log file to provide the admin with more about the issue. The following means that now you can find a new section in the configuration called OrchardCore_Data_TableOptions. Now you can define the name of the Document table if you want to change it, change the table name separator (changing the _ in tenant1_tablename), and the default identity column size, which is Int64 by default. Every existing tenant will work with Int32, but the new tenants will use Int64. It can happen because YesSql now supports Int64 as well. You can find some new lines about these settings in the documentation as well. If you want to migrate the existing tenants, you have to do your own migration. You can also define the schema of the tenant (DatabaseSchema) which is also configurable from the UI. This way all the table names are the same, just the schema that could be changed for each tenant. Demos Lombiq Hosting - Build Version Display The goal of the Lombiq Hosting - Build Version Display for Orchard Core module is to display the build version (i.e., .NET assembly version or other) on the admin of the Default tenant. By using this module, you can see at a glance which version of the app is deployed. But of course, there are various ways to know what's currently deployed into a specific environment (like staging or production), but the goal of this module is to cover the following use case: when you are looking at the app, you will know what's there. The only thing you have to do is to install the module, and navigate to Configuration -> Features, and enable the Lombiq Hosting - Build Version Display feature. After you navigate to the homepage of the admin UI, you will see the following on the dashboard. You can find the Orchard Core version, the version of the .NET assembly is currently being executed, which means the web application. If you have a CI build, usually that will generate a version number for you. And finally, during the build, you can also add a link to the build. This is just a dummy link for examples, but you can link to a GitHub action. You can read more about it in the Readme file of the module. Do you want to quickly try out this project and see it in action? Check it out in our Open-Source Orchard Core Extensions full Orchard Core solution, and also see our other useful Orchard Core-related open-source projects! And as always, if you want to know more about this feature, head to YouTube for a recording! News from the community Orchard Dojo Newsletter Lombiq's Orchard Dojo Newsletter has 396 subscribers! We have started this newsletter to inform the community around Orchard of the latest news about the platform. By subscribing to this newsletter, you will get an e-mail whenever a new post is published to Orchard Dojo, including This week in Orchard of course. Do you know of other Orchard enthusiasts who would like to read our weekly articles? Tell them to subscribe here! If you are interested in more news about Orchard and the details of the topics above, don't forget to check out the recording of this Orchard meeting!

Happy New Year everyone! Let's start this year with the improvements of the User Notifications feature, new Orchard Core sites, and of course, the latest fixes and improvements for Orchard Core. Check out our post for the details! Orchard Core updates Move role creation into the recipe instead of feature activation Features should not decide which roles are created but only the recipes. Features can decide what are the default permissions for a named role if the role exists. So, here is a summary of the enhancements this brings: We can now use recipe steps to explicitly list the roles we want to use for the site. We are no longer forced to use the default roles. If a role is deleted, it won't come back at some point after installing new features. Currently, even if we delete a role, it could come back after installing more features. If the Roles feature is disabled and re-enabled later, we keep track of permissions history to automatically assign any permission that would not have been assigned previously while the Roles feature is disabled. If an enabled feature introduces new permissions, it'll now get assigned to the proper roles by default "if these roles exist". Introduce the AddUsers extension method This change is about refactoring the logic that adds the specified user-related services to the collection. This is handy if we use OrchardCore.Users outside Orchard Core, something similar to AddPortableObjectLocalization, which registers the required services. Demos User Notifications Improvements The goal of the User Notifications module is to push notifications to the user, meaning notify the user somehow. There are many ways you can notify a user, one of them being a web notification, you can do SMS, you can do push to a mobile application, etc. We wrote about this new feature a few weeks ago in this post. If you head to Configuration -> Features and enable the Email Notifications and Notifications features, you will have a way to notify users and send email notifications to them. You can send notifications using workflows, but you can send them from code of course. The following workflow notifies the owner of the blog post when a blog post is published or deleted. It also notifies the user if the account of the given user is enabled, for example. You can see a bell icon near the Dark mode icon at the top right. If you click on that icon, you will see a list that shows you all of the notifications you have right now. You can click on them to mark them as read, or you can click on All Notifications at the bottom, which will redirect you to the page where you can see all of your notifications. And that's not everything! If you would like to know more, don't forget to check out this recording on YouTube! And if you want to try out this feature for yourself, now you can find the Notifications feature in the preview build of Orchard Core! News from the community New websites using Orchard Core: the site of the game called Transformers: Reactivate and the careers site of Splash Damage Transformers: Reactivate is a 1-4 player online action game developed by Splash Damage, coming to PC & consoles. Splash Damage worked on some of the biggest franchises in the world, with the likes of Batman, Halo, Gears of War, and now Transformers getting the Splash Damage treatment. Check out their careers site here! If you are interested in more websites using Orchard and Orchard Core, don't forget to visit Show Orchard. Show Orchard is a website for showing representative Orchard CMS (and now Orchard Core) websites all around the internet. It was started by Ryan Drew Burnett, but since he doesn't work with Orchard anymore, as announced earlier, it is now maintained by our team at Lombiq Technologies. Orchard Harvest 2023 For those too young to remember, we had Orchard conferences, called Orchard Harvest. And the conference website was available under orchardharvest.org, but unfortunately, it's not anymore. The last one was in 2017 in New York. So, having another get-together is very much overdue. If you would like to see or get a feeling of how this looked like before, we have a couple of mood videos on the Orchard YouTube channel, like this one from the first conference. The point is that we should really think about organizing the next one, and we at Lombiq can take part in that or provide an organizing role with anybody who wants to take part. If you have any feedback or are looking forward to having a Harvest again, please share your opinion by filling out this survey about the upcoming Orchard Harvest! Orchard Dojo Newsletter Lombiq's Orchard Dojo Newsletter has 394 subscribers! We have started this newsletter to inform the community around Orchard of the latest news about the platform. By subscribing to this newsletter, you will get an e-mail whenever a new post is published to Orchard Dojo, including This week in Orchard of course. Do you know of other Orchard enthusiasts who would like to read our weekly articles? Tell them to subscribe here! If you are interested in more news about Orchard and the details of the topics above, don't forget to check out the recording of this Orchard meeting!

Add Contained Stereotypes Bag Part Settings to allow a user to include content types by stereotype, add Displayed Stereotypes property to Content Picker Field Settings, demo about extending the user permissions, and many more waiting for you in our current post! Orchard Core updates Add Contained Stereotypes Bag Part Settings to allow a user to include content types by stereotype When attaching Bag Part to a content type, the user must explicitly set Contained Content Types with an array of content types to be included in the Bag Part. This is good for most cases; however, it would be great to allow for setting the contained content types using Stereotype. The stereotype would be in addition to not in place of Contained Content Types. For example, we want to group all Contact Methods (phone number, address, email address, etc.) by a stereotype type called ContactMethod. All of these content types share a similar functionality which is a way to contact a person. Now we created a Person content type and attached a Bag Part to it. In this case, we had to explicitly specify each content type in the Contained Content Types. But if a new content type was added later from other feature/module, the user would have manually to edit the Bag Part settings every time/everywhere ContactMethods are used to add the new content type which isn't efficient. So now the Bag Part is more flexible. And as you can see here, now we have two radio buttons under the Contained Content Types option where the user can select Content Types or Stereotype. Add Displayed Stereotypes property to Content Picker Field Settings And this one is quite the same as the previous feature but for the Content Picker Field. For example, we want to group all to-do items (appointments, meetings) by a stereotype type called ToDoTask. All of these content types share similar functionality which is a to-do task. Now we want to use Content Picker Field in a different content type to allow the user to select a to-do-task of any kind. In this case, we have to explicitly specify each content type in the DisplayedContentTypes. But if a new content type was added later from another feature/module, the user would have to manually edit the Content Picker Field settings all time. Everywhere to-do tasks are used to add the new content type which isn't efficient. So, let's say we navigate to the editor of a Content Picker Field. And here you can say that you can select the Contained Content Types to: Display All Content Types Content Types Stereotype Add settings to form widgets There was a bug in OC. The option editor wasn't loaded when trying to add Select Input while creating a form. Also, the edit button did not open the modal that would allow you to populate the options using JSON. If the content is saved, and the page is loaded again then the modal and the options editor work just fine. Another form-related improvement is validation. When creating a form using the Form input widgets like (Input, Select, and Text Area) there is no easy way to add a label and validation elements to the input. The current approach is to add a label widget and then a validation widget which is not always ideal. We can make this process much simpler by adding settings to the Input, Select, and Text Area widgets with the following properties: LabelOption an enum value with the following values (None, Standard, ScreenReaders). By default, None is selected to keep it backward compatible. ValidationOptions an enum value with the following values (None, Standard). By default, None is selected to keep it backward compatible. Now, if the user selects an option other than None in the settings, we’ll create the label in the same widget block. The same applies to ValidationOptions. This will make things like dragging/dropping widgets during edit and controlling the size much easier. At the same time, we output less HTML code. And if we add the validation rules, we’ll have more validation logic which makes the widgets more useful. And now, the editor of the Select Input looks like the following with the additional options. And of course, the same applies to all of the built-in form inputs. Demos Extend user permissions A couple of months back there was a need reported to have some roles to be able to edit a user and some not. And there is a conclusion that the user interface is not very flexible at the moment with the permissions. So, it kind of makes it hard if you have a unique case where you need some specific users to be able to do stuff. And also, to set up who can see what users, when you are listing the users. To be able to test out this feature with us, you have to check out this PR on GitHub. The first thing that you will notice is the new permissions regarding Users. In this case, we navigated to Security -> Roles and edited the Moderator role. There are new permissions, for example, Assign any role, Delete any user or Delete users in role - Administrator, List all users, etc. So, you can say you can list all the users, but it doesn't mean you will be able to edit all the users. If you try to edit a given user, you will notice something new here. As you can see, the user name of the user is not editable, but you can edit the email address of the given user. This is controlled by settings that you can reach under Configuration -> Settings -> User Profile Settings. As you can see, here you can allow or deny changing the user names or email addresses of the users. But now back to the users' list. Let's say we have some predefined users and made some changes regarding the permissions of the Moderator role. Now, we logged in with a user who has the Moderator role. After that, the user with the Moderator role will see something like this. First of all, you can notice that there is a little badge under every user that shows the roles the user has. You can also see that this user has permission to see users in the Editor role, but they can't edit or delete the editor user. Now let's edit the author user! Here you can see that this user can edit the settings of this user but can't fully manage the roles of the author user. They have the option to add or remove the Author role but that's it, nothing more. And we are just showing you some simple scenarios about what you can achieve and how you can customize the user permissions. If you want to see more complex scenarios, head to YouTube for a recording! News from the community Helping Global Health build an Advanced Form Builder using Form.io When Global Health from Australia approached us with the request to build an advanced form builder using Form.io, it promised to be an interesting project. They were looking to integrate this new form builder deeply into MasterCare+, their Multi-Tenanted SaaS-based platform for Health Care which is built on Orchard CMS. It would allow creating custom forms for a wide range of scenarios in the health care domain, using the advanced editing capabilities of Form.io. The solution built by Lombiq was an important step in bridging the gap between paper forms and electronic health care management. Check out the full post here! Orchard Dojo Newsletter Lombiq's Orchard Dojo Newsletter has 354 subscribers! We have started this newsletter to inform the community around Orchard of the latest news about the platform. By subscribing to this newsletter, you will get an e-mail whenever a new post is published to Orchard Dojo, including This week in Orchard of course. Do you know of other Orchard enthusiasts who you think would like to read our weekly articles? Tell them to subscribe here! If you are interested in more news around Orchard and the details of the topics above, don't forget to check out the recording of this Orchard meeting!

Enhance BagPart to honor permissions, add permissions for the Amazon S3 module, improve the workflow function description in the document, and a demo about the Admin Culture Picker! Let's get started! Orchard Core updates Enhance BagPart to honor permissions Let's say you want some users to be able to add content items to a specific bag while others to only be able to view only existing items. Currently, any content item contained in a BagPart is always editable regardless if the contained item is securable or not. In most cases, this is fine. However, this function should also be extended to honor the security rules when the contained item is securable. This means a user with EditContent permission can add/edit items to the BagPart whereas a user with ViewContent permission only should see the content item as a read-only version "like preview" but should not be able to make any change to it. So, this addition is about enhancing the BagPart to honor permissions for the contained content types. To try this one out, set up a site using the Agency recipe which contains the Landing Page content type which has several BagParts attached. Now, let's say that users with the Editor role will not be able to edit the services section of the Landing Page. Meaning the Editor role will not have Edit permission for the Service content items. We have to do things to achieve this: Edit the Service Content Type and put a tick to the Securable check box. This means this content type can have custom permissions. Edit the permissions of the Editor role. First, revoke the Edit content for others permission. Now, make sure that the Editor has no Edit Service for others permission regarding the Service Content Type. Now we set up that users with the Editor role will not be able to edit securable content types. Let's create a user with this role and log in as this new user. Now, we need to find the predefined Landing Page content item and edit it. As you can see, this user cannot add or edit an existing Service content item by using the editor of the BagPart. They can view the content of these items, but that's all. Notice that they can edit the Portfolio content items under the Services one. Add permissions for the Amazon S3 module A few weeks ago, we mentioned the new Amazon S3 module. The Amazon Media Storage feature enables support for storing assets in Amazon S3 Bucket. The feature replaces the default App_Data file-based media store with an Amazon Media Storage Provider. And now, you will see new permissions for that module called View Amazon S3 Media Options. If you have this permission, you can access the page under Configuration -> Media -> Amazon S3 Options which lists the Amazon S3 storage options. Improve the workflow function description in the document The Workflows module provides a way for users to visually implement business rules using flowchart diagrams. Many activities have settings that can contain either JavaScript or Liquid syntax. The fields of these activities allow you to enter Liquid markup, enabling access to system-wide variables and filters, as well as variables from the workflow execution context. And several JavaScript functions are available by default to any activity that supports script expressions. This page of the documentation lists these functions. And now, this table has been updated with some lines about the setProperty, executeQuery, and log functions. Demos Admin Culture Picker Unless you have a language switcher on website pages, you could not switch a language in the admin panel. This demo is about showing you a dropdown button in the admin panel header to switch languages. First of all, open up the admin UI of Orchard and head to Configuration -> Features, and enable the Admin Culture Picker one, which provides a culture picker shape for the admin. Don't forget to enable the Localization feature too, to be able to try out this culture picker. Now you can say that your site supports multiple cultures. Head to Configuration -> Settings -> Localization -> Cultures and have at least two supported cultures. And as you can see, the dropdown now contains all the cultures that the site supports. You can switch between them, and if you choose a given language, the UI of the admin will be shown by using the words of the given language. If you would like to see this picker in action, head to YouTube for a short demo! News from the community Orchard Dojo Newsletter Lombiq's Orchard Dojo Newsletter has 315 subscribers! We have started this newsletter to inform the community around Orchard with the latest news about the platform. By subscribing to this newsletter, you will get an e-mail whenever a new post is published to Orchard Dojo, including This week in Orchard of course. Do you know of other Orchard enthusiasts who you think would like to read our weekly articles? Tell them to subscribe here! If you are interested in more news around Orchard and the details of the topics above, don't forget to check out the recording of this Orchard meeting!

Add password to the user creation form, support a read-only behavior in the content management screen, and a demo about adding visual verification testing in the Lombiq UI Testing Toolbox! Let's get started! Orchard Core updates Add a password to the user creation form By default, apps use basic authentication to authenticate users into their site including Microsoft Identity-based apps. No user is able to authenticate/login without providing a "username" and "password". Alternatively, an admin could enable some sort of external authentication providers like Azure AD or any other providers to avoid the need to manage the authentication by the app directly. These external providers are optional and not enabled by default in Orchard Core, so creating a user with no password by default adds no value since no the user can't log in without one. Currently, when adding a new user using the admin UI, the admin has to create a user and then go to a second view to set/reset their password. This is a very awkward workflow, especially if you want to add many users. Since username/password are required by default for a user to log in, the admin should be required to provide a password rather than creating a useless user with no password. Note, the point here is that password is required to log in by default without having to enable optional additional authentication providers. Let's try it out quickly! Head to the admin UI of Orchard Core and navigate to Security -> Users. Here you will find the Add User button. Click on it! This will navigate you to the create user page, where you can find some new goodies. First of all, you can provide a password for the newly created user here. But you have the option to generate a random secure password or copy the password to the clipboard. Support a read-only behavior in the content management screen The idea here is that both Admin Menu and Content management screens should be viewable if the user has View own X, View X by others, Preview X by others, or List X content item(s) owner by all users permission. Any of these permissions should be enough to display content. View rules should be implied if one has edit, delete or publish permission; you can't delete, edit or publish if you can't view something. Making this change will easily add view-only support to the contents in the admin. Meaning, that if the user has permission to View Blog, we should list the Blog content items in the Manage Content screen, for example. To try this out, we will modify the permissions of the built-in Editor role (Security -> Roles -> Editor -> Edit). As you can see, the Editor now has no Edit content for others and Edit own content permissions, but we set these edit permissions for the Blog Content Type. Meaning the Editor can only edit the Blog content items but can view every other content item. Now, let's log in with a user with the Editor role and navigate to the Manage content screen. As you can see, this user now can see every content item in this list, but the Edit button is only available near the Blog content items. Meaning this list now shows every content item which can be viewed by this user. Demos Visual verification testing in the Lombiq UI Testing Toolbox Maybe you have already heard about the Lombiq UI Testing Toolbox, our web UI testing toolbox mostly for Orchard Core applications. Everything you need to do UI testing with Selenium for an Orchard app is here. We wrote about it several times here as well, first when we open-sourced it, when we added some Orchard Core Features tests to it, and when we added the automated monkey testing feature to it. This time we will introduce the Basic Visual verification testing in the Lombiq UI Testing Toolbox for Orchard Core. Lombiq's Open-Source Orchard Core Extensions is an Orchard Core CMS Visual Studio solution that contains most of Lombiq's open-source Orchard modules and themes, as well as related utilities and libraries. Please keep in mind that only those extensions included that use the latest released version of Orchard (i.e., the very cutting-edge ones depending on a nightly build are not yet here). This solution contains the Lombiq UI Testing Toolbox as well, so we will use this one for the demo. The BasicVisualVerificationTests.cs contains three different samples about how you can verify the content displayed on your page visually. The first one is about checking the content of the element that has the field-name-blog-image class. The second one is about checking the content of the navbar (the element that has the navbar-brand class), and the third one will check the whole content of the home page. Here you can see the page that we will test. The red texts show you the Navbar and Blog image elements. Let's verify the content of the Navbar! The Navbar contains the site name which we can provide when we set up our site. Let's try to set up our site using a different name than the Lombiq's OSOCE - UI Testing and run the test. Here you can see that the test set up the site using the Lombiq's OSOCE - UI Testing Demo site name, and our visual verification failed since the asserted element looks different from the baseline image. The baseline image was loaded from an embedded resource which you can find in the repository here. If you want a new baseline image, simply delete the existing one, and a new one will be generated on the next run. And that's not all of it! Do you want to know more about this new addition to the Lombiq UI Testing Toolbox for Orchard Core? Then check out the comments of the BasicVisualVerificationTests.cs file and this recording on YouTube! News from the community Orchard Dojo Newsletter Lombiq's Orchard Dojo Newsletter has 309 subscribers! We have started this newsletter to inform the community around Orchard with the latest news about the platform. By subscribing to this newsletter, you will get an e-mail whenever a new post is published to Orchard Dojo, including This week in Orchard of course. Do you know of other Orchard enthusiasts who you think would like to read our weekly articles? Tell them to subscribe here! If you are interested in more news around Orchard and the details of the topics above, don't forget to check out the recording of this Orchard meeting!

Updating Monaco editor to have Liquid IntelliSense, new UsersFolder for media assets, a brand new Orchard Core website, and many more in our upcoming post! Orchard Core updates Add UsersFolder for media assets Open up the admin UI of Orchard Core and head to Content -> Media Library. Here you will find a folder called _Users. Under this folder, you can find three different ones where each folder has the name by an ID of a given user. The reason for that is, we have three users in the system right now who have access to manage the content of the media folder and the content of their own media folder. If you check the permissions page for one of the roles you will see some new permissions come from the OrchardCore.Media feature: Manage All Media Folders Manage Media For Others Manage Own Media These permissions allow administrator users to be able to manage the content of other user's media folders but can restrict others to manage just their folders. Users with the Editor role can only see and manage their own media folder. Note that this is just about managing media assets not hiding the files of the folder. Every user can see the image served under the https://localhost:44300/media/_Users/4dsckq969tr2czhkskgg9nw3mj/image.jpg but they cannot delete this file and cannot modify the content of the 4dsckq969tr2czhkskgg9nw3mj folder. On the left window, the administrator user can see all of the folders, but on the right window, an editor user can only see their folder. If you don't like the naming _Users for the folder under AssetsPath, you can easily use another name for that just by using the appsettings.json file to configure media. If you navigate to Configuration -> Media -> Media Options you will find the name for the Assets user folder as well. Liquid IntelliSense for Monaco editor We have several custom Liquid filters and tags in Orchard Core and when you would like to use these from the admin UI of Orchard Core, (like editing a template or an Html Field using the Monaco editor) that would be nice to have some help with the registered filters and tags. This feature is about adding IntelliSense for Liquid in the Monaco editor. Let's see how we can try it out! Here we have a site installed with the Agency recipe. That recipe contains a Content__LandingPage template for the Landing Page content type by default. If we start to type the {% shape %} expression, we will see a list that contains all the registered filters with the word shape in it. Flow alignment icon always render as left aligned Let's say we have a content type with a Flow Part attached. If you are using Flow Part, you have the option to put several widgets to it. You can also set the alignments of the widgets and the width of the widgets meaning you can put two widgets near each other and you can say that I want to put this widget on the left side of the row and fill the 66% of the row with it and I want to put this widget on the right side of the row and fill the 33% of the row with it. You can do that using a nice UI but there was a minor bug which was about the little icon of the editor wasn't reflect the alignment of the given widget. You can see that now the icon here shows that the second Html widget inside the Container widget is right-aligned. News from the community A new website using Orchard Core: City of Santa Monica Santa Monica is a beachside city of 8.3 square miles on the westside of Los Angeles County. Offering an environment of unparalleled natural beauty, the city is home to a mix of residential communities, commercial districts, and recreational venues. And now the website of the City of Santa Monica is here, built by using Orchard Core! Check out this brand new, amazing-looking Orchard Core site here! If you are interested in more websites using Orchard and Orchard Core, don't forget to visit Show Orchard. Show Orchard is a website for showing representative Orchard CMS (and now Orchard Core) websites all around the internet. It was started by Ryan Drew Burnett, but since he doesn't work with Orchard anymore, as announced earlier it is now maintained by our team at Lombiq Technologies. DotNest Core DotNest Core is a complete redevelopment of the DotNest platform, all on the latest version of Orchard Core. We've been running it with a couple of select few customers for a while now, and it's time to open it up a bit more. While you can't yet just simply create an Orchard Core-based DotNest site, you can sign up for our limited beta here. You'll soon be able to get a fully functional, reliably hosted Orchard Core site on DotNest where you can build your personal website or something to showcase your Orchard skills with. Orchard Dojo Newsletter Lombiq's Orchard Dojo Newsletter has 216 subscribers! We have started this newsletter to inform the community around Orchard with the latest news about the platform. By subscribing to this newsletter, you will get an e-mail whenever a new post is published to Orchard Dojo, including This week in Orchard of course. Do you know of other Orchard enthusiasts who you think would like to read our weekly articles? Tell them to subscribe here! If you are interested in more news around Orchard and the details of the topics above, don't forget to check out the recording of this Orchard meeting!

We start this week by showing the ability to export templates as files, the negative role condition evaluator, and the brand new alternates for widget parts and for dynamic parts with great examples in the documentation. After, we will see a great demo about using templated GraphQL queries with Liquid. Check out our post for more! Orchard Core updates Add ability to export templates as files The idea here is in the exported ZIP file, the templates are now files instead of being embedded in the JSON recipe. Let's check it out quickly! Let's say you have the Templates module enabled (the Templates module provides a way to write custom shape templates from the admin) and have a defined template. If you set up your site using the Agency recipe, you will have one template, called Content__LandingPage, which is a template for the Landing Page content type, and the homepage of that installation is a Landing Page content item. Now, head to Configuration -> Import/Export and create a new Deployment Plan under the Deployment Plans option. Let's name the plan as Templates and add one Deployment Step to it, the All Templates one. Here you will see a new option: Export templates as files. Let's just put a tick in this checkbox to see what will happen. Now we have only one thing left to do, to execute the deployment plan. Let's just download the deployment plan locally and check the content of the Templates.zip file. Here you will see a Recipe.json file and a Templates folder. The Recipe.json file contains the Templates step with our only one Content__LandingPage template, and the content of that template can be found in the Content-LandingPage.liquid file in the Templates folder. Negative Role Condition Evaluator The way a role condition with a negative operator is evaluated right now doesn't take multiple roles into account. If we have 2 users: -- roleA roleB UserA X UserB X X The evaluator uses .Any() when evaluating the value against every role of the user. If we pick the operator "Equals" with the value "roleB", it will only be true for UserB, which has roleB. If we were now to just change the operator to "NotEquals" logically, it should be the opposite result of "Equals" but since the value gets compare against every role and roleA != roleB it will return true as well. .Any() (Current) Operator Value UserA UserB Equals roleB false true Not Equals roleB true true Contains roleB false true Not Contains roleB true true Using .All() with the negative operators which would give opposite results as intended. .All() Operator Value UserA UserB Equals roleB false true Not Equals roleB true false Contains roleB false true Not Contains roleB true false We have many negate operators, like StringNotContainsOperator, StringNotEndsWithOperator, StringNotStartsWithOperator, StringNotStartsWithOperator. Now, if you use them, the code execution will return with using the .All() instead of using the .Any(). If you don't know what are the rules and how to use them, check out the demo about the Rules module in this post! Validate content type and part names There was an unhandled exception during content item creation if you have a part named like property on ContentItem. The reason was that we have some reserved names that you cannot use when you are naming your content parts or content types. The _reservedNames HashSet here contains the names, that you cannot use. Use ZStringWriter ZString is a library that provides StringBuilder and StringWriter with zero allocation, meaning it's allocating an array on the stack for small buffers, instead of creating new StringBuilders and StringWriters every time. All ZString methods only allocate the final string. Also, ZString has enabled to access the inner buffer, so if the output target has stringless API, you can achieve completely zero allocation. Now we can use the new ZStringWriter instead of the existing StringWriter one. Alternates for Widget Parts This change contains several new alternates for widget parts and dynamic parts. And the documentation has also been updated with the new alternates. And when we are saying that the documentation has been updated, we mean that it's really got a huge update with many examples, like Display mode with Part Type and Shape without Display type Examples, Display mode with Part Type and Shape with Display type Examples, Display mode with Part Name and Custom Shape with Display type Examples and many more. Demos GraphQL Queries queries Let's meet with the new GraphQL Query type that basically allows you to use a GraphQL query in the admin interface and Liquid. It's using the same principle as the SQL query or the Lucene query. For example, let's say we have a GraphQL query created called ContactRequests, which is just about getting the Contact Request content items from the site. This query returns the contentItemID, the createdUtc, and the display text values of the Contact Request content items. But by using this experimental feature, you have the availability to use a templated GraphQL with Liquid. What do we mean? Well, first let's find the new Run GraphQL Query under Search -> Queries. Here let's add a template that contains Liquid code. By using Liquid, you can add output parameters to your query. In this case, we would like to get the email and the message fields too of the Content Request content items by using parameters. As you can see, we used the contactRequestEmail parameter to get the email and the contactRequestMessage parameter to get the message. If you open up the StatCan Orchard Core repository, you will find a collection of custom Orchard Core resources, modules, and themes that support various web applications and software-as-a-service (SaaS) products. One of the modules here is the VueForms module, which provides a form ContentType that simplifies using VueJs forms in the frontend. We had a demo about that one too, way back in 2020. If you don't remember about that, you can check out that in this post! And as always, if you want to know more about this feature, don't forget to check out the following recording on YouTube! News from the community Orchard Dojo Newsletter Lombiq's Orchard Dojo Newsletter has 203 subscribers! We have started this newsletter to inform the community around Orchard with the latest news about the platform. By subscribing to this newsletter, you will get an e-mail whenever a new post is published to Orchard Dojo, including This week in Orchard of course. Do you know of other Orchard enthusiasts who you think would like to read our weekly articles? Tell them to subscribe here!

YesSql 3 is here! Check out our current post to see what's new in YesSql, but first, read the new Liquid Widget guide and get to know why do the community needed to delete the Liquid Page and the Liquid Widget from the Blog and Agency recipes! Orchard Core updates Remove liquid type from recipes This is from a security report that if you have access to the admin, you can use and write in the LiquidPart. By using LiquidPart you can write HTML and JavaScript. It sounds obvious, but some sites don't expect users to be able to edit JavaScript on their pages, and it might have an issue. Because if you can write JavaScript, you can write XSS. The solution here is to remove the Liquid Page content type and Liquid Widget from the Blog and the Agency recipe. But the part is still there, and you can use it. And the Edit content types permission is marked as Security Critical. Meaning that, if you allow this permission to users, you let them be able to also use the LiquidPart and create some custom types that are about to render JavaScript in the frontend. Liquid widget guide As we mentioned previously, the Liquid Widgets from the default recipes were just removed. But that content type served as a very good example of how you can work with Liquid in Orchard Core. To have an example for working with Liquid, you will now find a new guide in the documentation about how to build a new Liquid Widget. Sometimes not having a feature but documenting how to use something is better than having a feature and no documentation about it. Did you know that our Helpful Extensions module for Orchard Core contains a Liquid Widget too, that adds Liquid code editing and rendering capabilities? Check out that repository for more goodies like the content definition code generation or the flows helpful extensions and many more! Use nameof for action name whenever it's possible Any controller action name that doesn't change can be called by using the nameof expression of C#. Now you won't break anything if you change the name of a method during some refactoring. Contents GetAsync: Recall published items Calls to IContentManager.GetAsync(string contentItemId, VersionOptions options) use IContentManagerSession.RecallPublishedItemId() to retrieve an already loaded content item if the request is to get a published item. The same could be used in GetAsync(IEnumerable<string> contentItemIds, bool latest = false) (i.e., the overload accepting multiple IDs). And the fix is here! When you do some loads with the content manager and if the content items are already have been loaded previously in the same request, there is no query that needs to be issued or just for the items that are missing. Demos YesSql 3 In the previous version of YesSql, every session created a new transaction automatically by default. Every session means even if your session is only doing reads. But when you are doing reads, you don't need a transaction because every read will be using the same transaction resolution. When you start a session in YesSql 3 and it's just about doing reads (like SELECTs) then it won't create a transaction. But the first time when you do a change on an object, the transaction will be created automatically (like when you would like to update a content item). Now it lazily creates a transaction if there are UPDATE, DELETE or INSERT statements. The second change is that if you really want to decide when the transaction should be created and not to wait for it to be automatically created. You can now call BeginTransaction and that will create a transaction or return the existing one if one is still open. And then there is another property (CurrentTransaction) that gives you either the existing transaction or NULL if there is no transaction. Everything has been renamed from CommitAsync to SaveChangesAsync. It's like in Entity Framework and now it's more obvious to know what it does (saves the changes). And what it means is that at that point if there is a transaction it will be committed and then released. If there is no transaction, it's just do nothing. And there is still the AutoFlush, meaning if you do some updates and then do a query to get some data, it will flush the changes from the database without committing a transaction, but your next request will be able to read the values that aren't in the database. Something that you can't do with YesSql before is let's say you start creating a session and there is an exception in the middle. If you didn't do a try-catch, and call CANCEL on the catch, it would commit the transaction because disposing of the session was committing the changes. In ASP.NET we don't have this issue because there is a rule that catches any exception that happens anywhere in the pipeline. But in some other apps, if you forget a try-catch, it would commit the changes even if it didn't go over the full list of commands that you want to execute. That was a big issue in YesSql. So, now that's actually changed. Meaning that if you don't call SaveChangesAsync now, it won't save anything. You have to call SaveChangesAsync at some point to commit the transaction. And if you disposing the session before calling SaveChangesAsync, it will cancel the transaction if it exists and closes the connection. So, SaveChangesAsync is now mandatory to mimic the EF behavior. So, if you have modules that use the session, you need now to call SaveChangesAsync, otherwise, nothing will be saved. But you should not have any module that calls SaveChangesAsync. And that's not all! If you would like to know every new feature and performance improvement included in YesSql 3, don't forget to check out the following recording on YouTube! News from the community Orchard Dojo Newsletter Lombiq's Orchard Dojo Newsletter has 199 subscribers! We have started this newsletter to inform the community around Orchard with the latest news about the platform. By subscribing to this newsletter, you will get an e-mail whenever a new post is published to Orchard Dojo, including This week in Orchard of course. Do you know of other Orchard enthusiasts who you think would like to read our weekly articles? Tell them to subscribe here! If you are interested in more news around Orchard and the details of the topics above, don't forget to check out the recording of this week's Orchard meeting!