sevenx_dse: the Database Source Editor #

This page is for administrators who need to look at, and with care change, the live database without leaving the admin. sevenx_dse ("7x Database Source Editor") embeds the AdminNeo database tool (a downstream fork of Adminer) as a native module of the Exponential admin, at /dse/dashboard. It is the only sanctioned database editor extension of Exponential.

What it gives you #

• Raw SQL execution with syntax highlighting.
• Table browsing with filter, sort and pagination; schema inspection and editing (tables, columns, indexes, foreign keys).
• Import (SQL, CSV, TSV) and export (SQL dump, CSV, TSV) as direct file downloads that bypass the template wrapping.
• Several database drivers: MySQL 8.0+ and MariaDB 10.3+, PostgreSQL 14+, SQLite 3.35+.
• The site's own database, preselected: "Open the database of this site" on the dashboard opens the main database of the installation with one click, read from site.ini [DatabaseSettings] of the siteaccess the way the kernel reads it, as AdminNeo's configured server main. Its login comes from the INI: it is never typed in, written into a form or shown, and only the server key main appears in the address. An SQLite database named without a path is the file in var/storage/sqlite3/, as for the kernel; its table list leaves out SQLite's own tables (sqlite_sequence ...).
• Any other database, the database chooser: "Connect to another database" on the dashboard, the "Change database" link inside the editor and AdminNeo's "Logout" open the database chooser (/dse/dashboard/(dse_choose)/1): "Open the database of this site" with one click, the logins remembered in this session (the current connection marked "Connected now", one click switches to another), and AdminNeo's own login form with every driver it has here (MySQL/MariaDB, PostgreSQL, MS SQL, SQLite, Oracle, MongoDB ... as far as their PHP extensions are loaded) and the free-form server, username, password and database fields; an SQLite file is named by its path relative to the installation (inside it only). The list shows only driver, server, username and database, never a password. main is the configured server only for requests about it, so the free-form form is always available. "Logout" forgets the login it signed out of; the others stay in the list.
• Safety gate: a mandatory disclaimer and backup acknowledgement screen on every visit from the menu. Once confirmed in a session, "Change database" goes straight to the database chooser; without that confirmation (a new session) the chooser's address shows the warning first.
• CSRF-protected database switching: the "Change database" link carries a per-session token dse_switch; "return to last database" works without storing URLs; AdminNeo's server password sessions are kept across the gate.
• View parameters, no query strings: the editor's state is in the address as view parameters, for example /dse/dashboard/(sqlite)/main/(username)/~/(db)/~dmFy.../(select)/ezsection. Plain values stay readable, ~ is an empty value, other values (paths with slashes) are ~ plus their base64url form, and filters and column lists travel together in (qs). AdminNeo still works with query strings inside; the view fills them from the view parameters and rewrites every link, form action, script address and redirect AdminNeo prints. AdminNeo's GET forms (search, filter, database selector) are posted and redirected to their view-parameter address, and an old ?sqlite=... or ?dse_switch=... address is redirected the same way. Background requests of AdminNeo's scripts append &page=2 or &script=db to the path, which the view reads. The SQL command form is only posted; it no longer puts the statement into the address. No login is ever a view parameter.
• Role policy: access is the policy dse/dashboard.
• CSS isolation: AdminNeo's global styles cannot damage the admin's own layout.

Requires PHP 8.3 or later (8.3 and 8.5 recommended), Exponential 6 and the admin3 design.

Set it up #

1. Install the package:

composer require se7enxweb/sevenx_dse

2. Activate it in settings/override/site.ini.append.php:

[ExtensionSettings]
ActiveExtensions[]=sevenx_dse

3. Regenerate autoloads and clear the caches:

php bin/php/ezpgenerateautoloads.php
php bin/php/ezcache.php --clear-all

4. Assign the policy dse/dashboard only to the roles that must have it.
5. Take a backup first (for example with git_manager), then open /dse/dashboard and confirm the backup acknowledgement.

Settings #

What changed #

About 1.1.1:

• AdminNeo's content security policy nonce stayed the same for every request a worker served (get_nonce() kept it in a function static), so the policy lost its point. It now lives in $GLOBALS, fresh per request.
• A second dashboard request in the same worker died, because AdminNeo declares constants and driver functions per request. The dashboard now asks the worker to be replaced after it answers, so the next request gets a fresh one (a guarded call that does nothing under any other server).

Related pages #

• AdminNeo database manager
• Ecosystem overview: the upstream tool
• Velocity engines
• Extension metadata specification
• Chronicle and release notes
• Change ledger
• Behaviour changes of the extensions
• Months: 2026-04, 2026-09 (all extensions)