ezie: the image editor #

This page is for editors who adjust images while editing content, and for administrators who add watermarks. ezie ("eZ Image Editor") is an image editor inside the edit form of any content object that has an image attribute. Crop, flip, rotate, add a watermark, change contrast and brightness, then Save & Close: the edited image is stored as a new version of the attribute.

The September to October 2026 releases (6.0.3 to 6.0.8) repaired it for current PHP and jQuery, fixed several defects that made tools fail, and closed two security holes. If you tried the editor before and gave up on it, try it again.

Requirements #

Exponential 6, PHP 8.0 or later (PHP 7.4 usable without support), GD2 or ImageMagick, and an Exponential edit form (admin, or a design that loads the edit form scripts). It uses jQuery, jQuery UI, the Jcrop and colorpicker plugins and the image conversion library of the expcomponents (ezcImageConverter, forked from the Zeta Components).

Install it #

ezie is installed with Exponential: the root composer.json requires se7enxweb/ezie and the image conversion it needs (se7enxweb/expcomponents-image-conversion since 6.0.15, zetacomponents/image-conversion before), which ezie does not declare itself. The sevenx_multisite site package activates it for the classic admin designs; the setup wizard and the kickstarter activate expimageeditor for admin4 instead. A project that builds its own composer.json without the root's requires both:

composer require se7enxweb/ezie se7enxweb/expcomponents-image-conversion

To use ezie in admin4 too, ActiveExtensions[]=ezie instead of expimageeditor (both replace the same include, only one of the two can draw the button), regenerate the autoloads and clear the caches.

ezie composites only the watermark images of its own folder (design/standard/images/watermarks, resolved with realpath()), so the file name the image conversion's ImageMagick handler builds into its command unescaped never comes from a request.

Use it #

1. Edit an object that has an image attribute, and open the editor from the image field.
2. Choose a tool in the Actions window: select, crop, flip, rotate, watermark, contrast, brightness. Keyboard shortcuts are shown in each tool's title.
3. Work on the selection (keep ratio, free, or type a size), apply, and undo as needed.
4. Click Save & Close. The edit form shows the saved image wherever the attribute is.

Quit asks a translated question ("If you leave without saving, all your modifications will be definitely lost"), and only when something was changed.

What runs where #

The server side of each tool is a view of the ezie module (module.php):

Select, zoom, undo and redo work in the browser (design/standard/javascript/ezie.gui.config.bind.tool_*.js). So the editor also has pixelate, black and white and sepia, which the tool list above does not name.

The third-party scripts it bundles are named in ezinfo.php (jQuery UI 1.8.9, Jcrop 0.9.8, jQuery Hotkeys 0.7.9); the colour picker is in design/standard/javascript/colorpicker. jQuery itself comes from ezjscore.

Add your own watermark #

1. Put the image (usually a PNG file) in a design/standard/images/watermarks folder of your extension, for example extension/mydesign/design/standard/images/watermarks/logo_ubuntu.png.
2. Register it in extension/mydesign/settings/image.ini.append.php:

[eZIE]
watermarks[]=logo_ubuntu.png

3. Clear the caches. The watermark is offered in the editor.

Only a plain file name that exists in a design/standard/images/watermarks folder is accepted. The shipped ones are elephpant.png and ez-logo.png.

What was fixed #

Security (6.0.6) #

• The watermark name from the request used to be appended to a folder path, so ../ read any image the web server can read. Only a plain file name found in the watermark folder is accepted.
• The working folder of an edit came from a key the browser sent, so any user with access to the ezie module could make the tools write into, and no_save_and_quit recursively delete, any folder under the installation. The folder is now built from the current user and the image; the key is ignored.
• Only prepare checked permissions, with the language code cast to an integer, which disabled the language limitation. Every view now requires the image attribute to belong to a draft of the current user that the user may edit in that language, and prepare checks that the attribute belongs to the object and language in its URL. A published version can no longer be changed through save_and_quit.
• Failures answer JSON {"error": ...} with 400, 403, 404 or 500 (before: an HTML error page, a die() text, or a 200 with a broken image). Request values are read from POST only and validated (numbers, a six digit colour, a selection with four positive numbers).
• The editor sends the form token as the ezxform_token field and as the X-CSRF-Token header, read for every request from the hidden span or from the csrf-token meta tag.

Languages #

The extension carries translation files in translations/<locale>/translation.ts: cro-HR, ell-GR, eng-US, esl-ES, fre-FR, ger-DE, ita-IT, jpn-JP, pol-PL, por-BR. The German file holds 47 messages (count <message in translations/ger-DE/translation.ts). The texts are looked up in the contexts design/standard/ezie and design/standard/content/datatype.

After editing a translation file, refresh the compiled translation cache with ./console exp:ezgeneratetranslationcache and clear the template and content caches. ./console exp:ezchecktranslation ger-DE prints statistics of the kernel's share/translations/ger-DE/translation.ts, not of this extension's file.

Related pages #

• YUI removal and jQuery 4
• Extension metadata specification
• Chronicle and release notes
• Change ledger
• Behaviour changes of the extensions
• Months: 2024-03, 2026-09, 2026-10 (all extensions)