Help for Developers

What changed in the source code most recently: the main branch of se7enxweb/exponential, read from its public feed by this server.

Show merge commits too

1. Updated: The hide cronjob puts ShowHiddenNodes back when it ends and … (opens in a new window) · 11/10/2026 05:50 pm

   Message

   Updated: The hide cronjob puts ShowHiddenNodes back when it ends and skips a root node that does not exist
   
   Follow-up of pull request #360 (the hide cronjob ends also when the process fetched nodes with
   ShowHiddenNodes=true before it).
   
   - Updated: The hide cronjob sets ShowHiddenNodes=false only while it hides: when it ends, also after an error, the
     setting and the cached value of eZContentObjectTreeNode::showInvisibleNodes() are as before, so the cronjob parts
     after it in the same process (a site's own or an extension's) see hidden nodes as the site has them. With the
     cache reset of #360 alone they would all have run with ShowHiddenNodes=false.
   - Updated: A node of content.ini [HideSettings] RootNodeList that does not exist is skipped with a warning; it
     stopped the whole cron run with a fatal error before.
   - Updated: HideCronjobSearchIndexTest runs on a clean installation too, as the throwaway database of a test run:
     when no class has a date or integer attribute, it creates one inside its rolled-back transaction. Before, it was
     always skipped there.
   - Updated: HideCronjobSearchIndexTest pushes its error handler marker only when eZDebug's handler is not on top
     already. eZDebug takes the handler on top off as its own, so with its handler on top (the kernel started before
     the test) the marker was taken off in its place and the test left one handler too many (risky).
   - Added: HC-04 (the setting is as before after the cronjob) and HC-05 (a root node that does not exist is skipped).
   - Updated: phpstan-baseline.neon: hide.php has 1 known "undefined variable $cli" instead of 7, as the hiding moved into a
     method that takes $cli as a parameter.

   546bf41b09
2. Updated: The manifest check of the pre-commit hook passes a commit wi… (opens in a new window) · 11/10/2026 04:51 pm

   Message

   Updated: The manifest check of the pre-commit hook passes a commit with nothing staged
   
   bin/php/checkmanifest.php --staged read git's output to tell whether git worked, and an empty output (nothing staged, as when only a commit message is amended or with git commit --allow-empty) looked the same as a failure: the hook refused the commit with "git is not available". It now runs git with proc_open() and takes git's exit code; outside a repository it still says git is not available.
   
   - Added: CheckManifestStagedTest: nothing staged passes, a staged file listed with its checksum passes, one not listed or stale fails, outside a repository git is not available.

   122a2b118b
3. Updated: The hide cronjob ends also when the process fetched nodes wi… (opens in a new window) vmeyke · 11/10/2026 04:36 pm

   Message

   Updated: The hide cronjob ends also when the process fetched nodes with ShowHiddenNodes=true before it
   
   eZContentObjectTreeNode::showInvisibleNodes() keeps the ShowHiddenNodes value it read first. The hide cronjob sets
   ShowHiddenNodes=false and fetches batches until none is left; after an earlier fetch in the same process (an earlier
   cronjob part, or a siteaccess with ShowHiddenNodes=true) the fetch kept returning the nodes it had just hidden, and
   the loop never ended.
   
   - Added: eZContentObjectTreeNode::resetShowInvisibleNodesCache(), which forgets the cached value; the cronjob calls
     it after it changes the setting.
   - Updated: the batch loop of the cronjob also stops, with a warning, when a batch holds only nodes the run hid
     already.
   - Updated: HideCronjobSearchIndexTest reads ShowHiddenNodes=true before the cronjob runs (HC-03, the case in which
     it looped for ever) and resets the cached value in tearDown. Without the fix the cronjob does not end (stopped by
     a time limit); with it the test passes.
   - Updated: the test enables ViewCaching for HC-02, as the content/cache event is sent only when view caches are
     cleared; it failed on an installation with ViewCaching disabled.
   - Updated: the test leaves PHP's error handlers as it found them: the debug messages of the cache clearing make
     eZDebug::setHandleType() take the top handler off the stack, which was PHPUnit's, and the test was risky. It now
     pushes a marker that passes errors on, and pops back to it afterwards (as 484cac5606 did for exception handlers).
   - Updated: share/filelist.md5.

   dc144ec401
4. Added: The URL map import shows every format with an example to copy,… (opens in a new window) · 11/10/2026 04:19 pm

   Message

   Added: The URL map import shows every format with an example to copy, download or open in the import
   
   Whoever writes a URL map for the first time can now see what each format looks like.
   
   - Added: The tab Formats and examples of the URL map import (content/urlimport/(source)/examples), also a button on
     the URL translator and URL wildcards pages: an example file of every format (CSV, CSV with wildcards, CSV with
     queries and temporary redirects, JSON, Excel, LibreOffice, Apache and nginx rules) with what it shows, the
     extensions its format is read from and the rows the import makes of it; the text ones shown to copy (Copy in
     admin4), Download (content/urlimport/(example)/), and Open in the import (content/urlimport/(use)/), which
     puts the file into the import's text field with its format. Below: the columns and the kinds. The upload page links
     it next to the file field.
   - Added: expUrlMapExamples: the examples are the files of the documentation (doc/eng-us/examples/url-maps), the German
     ones for a German interface, each read with its format's reader.
   - Added: old-site.xlsx and old-site.ods (German alte-site.*) to the URL map examples, written from the CSV example by
     the import's own writers.
   - Added: The 44 new texts in every administration catalogue; Excel and LibreOffice to the translation allowlist as
     product names; the test expUrlMapExamplesTest.
   - Updated: Migrating URLs, Importing and exporting URL maps and the examples' README name the tab, also in German.
   - Updated: admin4's copy chips (data-a4-copy) name a long value by data-a4-copy-name in their notice.

   1ba99ee957
5. Updated: share/filelist.md5 for the OpenSpec files of pull request #358 (opens in a new window) · 11/10/2026 03:30 pm

   Message

   Updated: share/filelist.md5 for the OpenSpec files of pull request #358
   
   The 24 new files of the marketing automation changes (openspec/changes and the build guide in openspec/handoff) are listed, and the checksums of the two planned-changes overview pages (English and German) are updated, so the upgrade check does not report them as unknown or modified.

   0de0514d6d
6. Updated: The translation cache checks the locale it names a directory… (opens in a new window) · 11/10/2026 03:08 pm

   Message

   Updated: The translation cache checks the locale it names a directory after and rebuilds files written before the split by locale
   
   Follow-up of pull request #359 (the translation cache kept per locale).
   
   - Updated: eZTranslationCache::cacheLocale() uses a given locale only when it is a locale code (letters, digits,
     "-", "_", "@", ".", no ".."); any other value falls back to the Locale setting with a warning. The locale names
     a directory of PHP files that are included later.
   - Added: eZTranslationCache::isLocaleCode().
   - Updated: eZTranslationCache::CODE_DATE is raised, so cache files written before the split, which could hold
     another locale's texts, are not restored but rebuilt from the translation files on first use; no manual cache
     clear is needed after the update.
   - Updated: The cache directory of a locale is kept per site cache directory, so a process that serves several sites
     does not write one site's cache into another's.
   - Updated: eZTSTranslator checks a cached context strictly against null, like the context list, and does not
     iterate a context it could not restore.
   - Added: eZTranslationCacheHardeningTest; tests/test-map.json and share/filelist.md5 updated.

   494bb59c72
7. Updated: The translation cache keeps each locale apart, so an English… (opens in a new window) vmeyke · 11/10/2026 03:08 pm

   Message

   Updated: The translation cache keeps each locale apart, so an English page no longer shows German texts
   
   eZTranslationCache named its directory after RegionalSettings/Locale, kept that directory for the whole process and
   kept one in-memory table for all locales. A translator for another locale than the setting (a second language in the
   same request, a test) therefore wrote its texts into the setting's cache, and later lookups of that locale returned
   them: with Locale=eng-US, "Register new account" came out as "Neues Konto registrieren".
   
   - Updated: Every eZTranslationCache method takes an optional $locale; the cache directory and the in-memory table are
     kept per locale. Without $locale the RegionalSettings/Locale setting is used as before, so other callers keep
     working unchanged.
   - Added: eZTranslationCache::cacheLocale(), the locale a call works on.
   - Updated: eZTSTranslator passes its own locale to every cache call.
   - Added: eZTranslationCacheLocaleTest: a context cached for one locale is not returned for another, the same context
     is kept per locale, a call without a locale uses the setting, each locale has a cache directory of its own, and the
     translator passes its locale to every cache call. Without the fix all five fail.
   - Updated: eZTSTranslatorEmptyContextListTest looks for the strict comparison with the locale argument
     (contextCache( 'cachecontexts', $this->Locale ) === null) and still refuses the loose one.
   - Updated: tests/test-map.json maps both changed classes to the new test; share/filelist.md5.

   47fe603a2c
8. Updated: The service worker leaves the shop to the browser, so a bask… (opens in a new window) se7enxweb · 11/09/2026 07:46 pm

   Message

   Updated: The service worker leaves the shop to the browser, so a basket update shows the new quantity
   
   The basket, its updates and the checkout follow the visitor's session, which
   lives in an HttpOnly cookie the worker cannot see. Handled by the worker, the
   round trip of a basket update (post, update, back to the basket) came back
   showing the basket as it was before the change, although the new quantity
   was stored. /shop joins /admin, /editor and /user in the paths the worker
   never handles, and a test keeps those four on the list.

   fa5a36b217
9. Updated: SVG files kept by the file and media datatypes are stored on… (opens in a new window) se7enxweb · 11/09/2026 05:29 pm

   Message

   Updated: SVG files kept by the file and media datatypes are stored only sanitized
   
   An SVG uploaded through the binary file or media datatype is stored under
   storage/original/image/, the directory every shipped web-server
   configuration serves as files, but only the image datatype ran it through
   the SVG sanitizer. Such a file could carry script that runs in the site's
   origin when it is opened directly; the Content-Security-Policy sandbox
   header of the shipped configurations was the only barrier.
   
   - expSvgSanitizer::sanitizeStoredUpload() sanitizes a stored upload in
     place when it is an SVG by its name, the uploader's name or its content,
     and refuses a .svg that is no SVG.
   - eZHTTPFile::store() calls it for every browser upload; the file and media
     datatypes call it for their file imports (insertRegularFile) and package
     imports. A refused file is removed and the upload fails.
   - file.ini FileExtensionBlackList[] also refuses html, htm, xhtml and xht,
     as defence in depth for servers that hand out storage/original as files.
   - The security-hardening guide (English and German) states that var/ must
     never be served statically beyond the shipped allow-list.
   
   Reported by 0xpack.

   3b0fc18474
10. Updated: The cron setup takes out the blocks of installations that ar… (opens in a new window) · 11/09/2026 05:05 pm

    Message

    Updated: The cron setup takes out the blocks of installations that are gone
    
    installcrontab.php --add (and the installers' cron step) kept every other
    installation's block, also of folders that no longer exist. An installation
    built in a fresh folder and then moved into place (a demo rebuilt every two
    hours) left one block per build: a crontab of 185 blocks whose jobs started
    every minute, failed at their cd and mailed the failure.
    
    expCrontabSetup::add() now takes those blocks out on the way (pruneGone(): a
    block whose root folder is gone; the installation being written and unfinished
    blocks stay) and names them in its result. The installer crontab guide says
    so, and how a build-and-move installation writes its block from the folder it
    is served from. Covered by two new tests.

    cd2c022c8f