Help for Developers

What changed in the source code most recently: the main branch of se7enxweb/exponential, read from its public feed by this server.

Show merge commits too

1. Updated: The generated help examples show the help's reading_key and … (opens in a new window) · 11/05/2026 10:34 am

   Message

   Updated: The generated help examples show the help's reading_key and report_links fetch functions and its ReportSecurityAnchor setting
   
   The reference examples below doc/eng-us/examples/ and their German pages below
   doc/ger-de/beispiele/ are generated again from the current sources with
   exp:help:examples, so they match what has landed:
   
   - the fetch functions exphelp/reading_key and exphelp/report_links get their
     pages, and the exphelp index counts seven functions;
   - exphelp.ini [ContextHelp] lists ReportSecurityAnchor, and the path rules of
     [AudienceSettings] and [CategorySettings] and the [TreeSettings] and
     [TypeSettings] entries follow the shipped file;
   - the German site.ini [DatabaseSettings] page lists the SQLite busy-wait and
     transaction-wait settings;
   - count_chars, extract_right, html_entity_decode and simplify quote their first
     use in a shipped template, now the help menu and the text part of form mail.
   
   doc/ger-de/.paths.json maps the two new German pages. exp:help:examples --check
   reports no difference for either language.

   ff3d9701b2
2. Updated: A subtree copy re-points every link and embed of its XML tex… (opens in a new window) · 11/05/2026 10:23 am

   Message

   Updated: A subtree copy re-points every link and embed of its XML text at the copies, also those before a literal block
   
   The string scan of step 5 jumped past the next literal block before it looked for links, so every link and embed
   that came before a literal (code) block in the same text kept pointing at the original; it also took the next
   link before an earlier embed or object. A copy of 2,714 nodes left 730 node ids in 189 XML texts pointing at the
   originals.
   
   The XML text is now parsed as XML by expContentJobCopySubtree::remapXMLText(): node_id and object_id of link,
   embed, embed-inline and a, id of object, and href values eznode:// and ezobject:// are re-pointed wherever
   they are. Nothing inside a literal block is changed, ids outside the copied subtree stay, and a text with nothing
   to change is kept byte for byte. The content job "copy", content/copysubtree,
   eZContentObjectTreeNodeOperations::copySubtree() and bin/php/ezsubtreecopy.php all use it.
   
   Tests with an XML fixture cover links before, between and after literal blocks, several literal blocks, embeds,
   eznode:// and ezobject:// hrefs and ids outside the copy (no database).

   3c24718c25
3. Updated: Session defaults in the documentation match site.ini (360 days) (opens in a new window) · 11/05/2026 10:17 am

   Message

   Updated: Session defaults in the documentation match site.ini (360 days)
   
   settings/site.ini ships SessionTimeout=31104000 and RememberMeTimeout=31104000
   (360 days, Remember me checked on the login forms by default), but the
   security hardening chapter (13.7) still listed SessionTimeout 259200 and an
   empty RememberMeTimeout, and some 25 help pages in English and German still
   said three days.
   
   - 13.7 lists both shipped values and what they mean; its HTTPS-only example
     shortens RememberMeTimeout together with SessionTimeout, as site.ini asks
     (SessionTimeout at least as long as RememberMeTimeout)
   - the CONFIGURING example no longer sets RememberMeTimeout above SessionTimeout
   - sign-in, retention, accessibility, hosting, trainer and developer pages
     state 360 days, in both languages

   3bc1631261
4. Updated: Files of the file and media datatypes imported from a packag… (opens in a new window) · 11/05/2026 10:11 am

   Message

   Updated: Files of the file and media datatypes imported from a package get their key and, when the name is taken, their name from the secure random source
   
   The package key of a file is bin2hex( random_bytes( 16 ) ) and the name of an imported file whose own name is taken is eight characters of random_bytes(), instead of md5( mt_rand() ).

   9c43a8706d
5. Updated: The 6.0.15 changelog describes the random sources of generat… (opens in a new window) · 11/05/2026 10:05 am

   Message

   Updated: The 6.0.15 changelog describes the random sources of generated passwords, keys and file names, Dependabot and CodeQL

   d70f257192
6. Updated: The MongoDB adapter and its limits page say that code decidi… (opens in a new window) · 11/05/2026 10:04 am

   Message

   Updated: The MongoDB adapter and its limits page say that code deciding access reads an empty result of untranslated SQL as no
   
   The class docblock of expMongoDB also says why escapeString() returns the value unchanged: WHERE values become scalar comparisons, never query operators. English and German limits pages.

   24d7706bd5
7. Added: Dependabot updates for Composer, npm and GitHub Actions, and a… (opens in a new window) · 11/05/2026 10:04 am

   Message

   Added: Dependabot updates for Composer, npm and GitHub Actions, and a CodeQL workflow for JavaScript and the workflows
   
   Weekly, grouped update pull requests (se7enxweb packages stay pinned by hand). CodeQL analyses the repository's own JavaScript and its workflows; bundled libraries and minified files are left out. CodeQL has no PHP analysis; PHPStan and the tests check the PHP code.

   9bf6c84f79
8. Added: Tests that generated passwords, REST tokens, forgot-password k… (opens in a new window) · 11/05/2026 10:04 am

   Message

   Added: Tests that generated passwords, REST tokens, forgot-password keys and stored file names come from the secure random source
   
   expRandomSourcesTest (testsuite security, no database): the length, alphabet and uniqueness of eZUser::createPassword(), that a seed does not reproduce a password, that the generator uses random_int() only, 40-character REST tokens without repeats, and that the forgot-password key, the stored file names, the activation hash and the site installer's accounts use random_bytes().

   e4f8bf18c2
9. Updated: Stored files, uploads and the Word extractor's temporary fil… (opens in a new window) · 11/05/2026 10:04 am

   Message

   Updated: Stored files, uploads and the Word extractor's temporary file are named from the cryptographically secure random source
   
   The file and media datatypes, eZHTTPFile::store() and the Word text
   extractor name their files with bin2hex( random_bytes( 16 ) ) instead of
   md5() of the time and mt_rand(). The names keep their form: 32 hex
   characters and the suffix.

   21afa48343
10. Updated: Generated passwords, forgot-password keys and token manager … (opens in a new window) · 11/05/2026 10:04 am

    Message

    Updated: Generated passwords, forgot-password keys and token manager tokens come from the cryptographically secure random source
    
    eZUser::createPassword() draws every character of the password character
    table with random_int(); it built the password from md5() of the time and
    mt_rand(). Length and table stay the same; the $seed parameter is accepted
    and no longer used, so a password is never reproducible from it.
    
    The key of a forgot-password link is bin2hex( random_bytes( 16 ) ), 32
    characters as before, without the openssl_random_pseudo_bytes() call and
    its mt_rand() fallback.
    
    ezpRestTokenManager::generateToken() returns a token of
    ezpRestToken::generateToken() instead of the same value on every call.
    
    A user account the site installer creates for an ezuser attribute gets a
    random login, address and password instead of the password "publish".
    
    The file manifest carries the checksums of the files of this change and
    of the commits that follow it.

    ed71cdb9e2