Skip to the content
Documentation

Help center

Help for Developers

Build on it: extensions, templates, settings, the APIs, the command line and upgrades.

5997 pages

Start here All pages for Developers All audiences

Start here

Read these pages in this order.

  1. Develop with Git: grow from user to developer The recommended way to build websites with Exponential. Install the kernel and every se7enxweb extension as...
  2. Extension development: the book (start here) A complete book on growing from user to builder, extension developer and theme developer with Exponential:...
  3. Add a database table A migration that creates a table of the site's own on every engine from a share/db_schema.dba definition, w...
  4. AI, agents and agentic: start here The landing page for people who use AI with Exponential and for people who build agents and agentic workflo...
  5. Ecosystem: start here The landing page for the Exponential Ecosystem - the greater Exponential world within the PHP stack, its us...
  6. Integrators: start here The landing page for system integrators and integration developers who connect Exponential with CRM, ERP, P...

Good to know

  • Migrations

    The start of everything about migrations in Exponential 6.0.15 - schema and content changes written once as files under version control and applied to every installation of a site in the same order, with a caption…

  • Migrations: a first PHP migration, step by step

    In this tutorial you write two PHP migrations for a site: one creates a table exp_news_note with a first row, the other publishes a folder "News" below the content root and notes it in the table. You check them, look at…

  • Add a database table

    A migration that creates a table of the site's own on every engine from a share/db_schema.dba definition, writes a first row, and drops it again in down() - with the dry run, the run, the checks and the rollback.

  • Testing migrations: check, simulate, diff and CI

    Four layers of tests for migrations - the lint without a database, the dry run, the simulation with a diff on PostgreSQL or SQLite, and a PHPUnit test on a throwaway SQLite database - and how to run them in CI.

  • Deploying with migrations: CI/CD and GitHub Actions

    Run migrations as part of every deploy - the order of the steps, a complete GitHub Actions workflow that checks pull requests and deploys over SSH, the exit codes a pipeline acts on, the installation lock, and runs…

  • Team workflow with git: branches, conflicts and order

    How several developers write migrations on branches without stepping on each other - timestamps and order, requires for real dependencies, two migrations with the same timestamp, rebasing, renaming only before a merge…

Search by topic

Each button lists the pages of one topic for Developers.

Latest commits to Exponential

Full history on GitHub (opens in a new window)

What changed in the source code most recently: the main branch of se7enxweb/exponential, read from its public feed by this server.

Show merge commits too

  1. Added: Tests that generated passwords, REST tokens, forgot-password k… (opens in a new window) ·
    Message 
    Added: Tests that generated passwords, REST tokens, forgot-password keys and stored file names come from the secure random source

expRandomSourcesTest (testsuite security, no database): the length, alphabet and uniqueness of eZUser::createPassword(), that a seed does not reproduce a password, that the generator uses random_int() only, 40-character REST tokens without repeats, and that the forgot-password key, the stored file names, the activation hash and the site installer's accounts use random_bytes().
    e4f8bf18c2
  2. Updated: Stored files, uploads and the Word extractor's temporary fil… (opens in a new window) ·
    Message 
    Updated: Stored files, uploads and the Word extractor's temporary file are named from the cryptographically secure random source

The file and media datatypes, eZHTTPFile::store() and the Word text
extractor name their files with bin2hex( random_bytes( 16 ) ) instead of
md5() of the time and mt_rand(). The names keep their form: 32 hex
characters and the suffix.
    21afa48343
  3. Updated: Generated passwords, forgot-password keys and token manager … (opens in a new window) ·
    Message 
    Updated: Generated passwords, forgot-password keys and token manager tokens come from the cryptographically secure random source

eZUser::createPassword() draws every character of the password character
table with random_int(); it built the password from md5() of the time and
mt_rand(). Length and table stay the same; the $seed parameter is accepted
and no longer used, so a password is never reproducible from it.

The key of a forgot-password link is bin2hex( random_bytes( 16 ) ), 32
characters as before, without the openssl_random_pseudo_bytes() call and
its mt_rand() fallback.

ezpRestTokenManager::generateToken() returns a token of
ezpRestToken::generateToken() instead of the same value on every call.

A user account the site installer creates for an ezuser attribute gets a
random login, address and password instead of the password "publish".

The file manifest carries the checksums of the files of this change and
of the commits that follow it.
    ed71cdb9e2

Showing 41–43 of 43 commits

« Previous 1 2 3 4 5

Key pages

All pages for Developers

Recently updated

Free documentation: use it to help yourself and others

This help is free documentation, licensed under the GNU Free Documentation License 1.3 or later. You may use it, share it and improve it:

  • Study it Read any page as often as you like, for any purpose.
  • Copy it and share it Give pages to other users, on paper or as files. Keep the copyright notice, the license notice and a copy of the license with every copy.
  • Translate, adapt and improve it Share your version under the same license, with the original notices and a note of what you changed.
  • Cite it Refer to a page by its title and its address in the help, or its file in the doc directory.
  • Contribute fixes back Use "Edit on GitHub" on any page. Changes are accepted under the same license, so they stay free for everyone.

Exponential Copyright © 1998-2026 Exponential Foundation and 7x

What you can do with free documentation Read the license The license on the web (opens in a new window)