- Module result and content info What $module_result holds after a view has run (content, path, title_path, uri, content_info, view_parameters, errorType and errorNumber) and how the pagelayout uses content_info to know the class, node, section, view…
- Menus and navigation Building a site's main menu, sub menus and footer links in templates: fetching the root's children with limits and class filters, marking the current page with aria-current, a second level, caching the menu, and…
- Breadcrumbs A breadcrumb trail from $module_result.path: the markup (nav, ol, aria-current), skipping the tree root, pages of other modules, structured data, and the breadcrumb templates of the shipped designs.
- Pagination Paging long lists: the offset view parameter, a fetch with offset and limit plus a count, the shipped navigator templates (navigator/google.tpl and others) and their parameters, an accessible pager of your own, and how…
- Fetch functions: how they work What happens when a template calls fetch() - eZFunctionHandler, eZModuleFunctionInfo, the module's function_definition.php and its function collection class - the definition format, results and errors, the module…
- Publishing workflow for apps The landing page of the publishing workflow pages for app developers - how editors' drafts, versions and publishing relate to what an app sees, previewing app screens before publishing, the user accounts and roles an…
- Search results template Styling the site search: the content/search.tpl template and the variables it uses, the search fetch, results drawn with a search view, the navigator with the search text in its links, an accessible search form, no…
- Security engineering overview The security model of Exponential for engineers - access control through policies, output escaping, safe SQL, CSRF tokens, the secure defaults of 2026, the HTTP security layer, authentication and two-factor sign-in, the…
- Drafts, preview and publishing How drafts and versions of Exponential content relate to an app - REST reads only published content, reading drafts and versions through the expversion services with versionread rights, building an editor preview for…
- HTTP security: headers, CSP, request rules and proxies The HTTP security layer of Exponential - security headers from SecurityHeaders[], the Content Security Policy with modes, directives, nonces and reports, request rules that allow, deny, redirect or log after URL…
- User and login templates Styling the sign-in, registration, password and profile pages of the user module: the templates in user/, the field names the module reads, autocomplete and accessibility, the signed-in state in the pagelayout, and…
- Authentication, sessions and two-factor sign-in How users and machines authenticate to Exponential - password storage and policy, the list of well-known passwords, lockout, session handlers and cookies, two-factor sign-in with sevenx_authentication_2fa, OAuth 2.0 and…
- Block definitions How a block type is defined in explayouts.ini (Name, Handler, ViewTypes, IsContainer, Placeholders, HasCollection, Category), the shipped blocks by category, and adding a view type or a new block to a design.
- Forms in templates Forms on a public site built from content: information collection (feedback and contact forms) with ActionCollectInformation, the collect templates, validation messages, the result page and mail templates, the form…
- Permissions for app users Set up the user accounts and roles an app runs as - integration users, read roles limited by section or subtree, write roles limited to one folder and class, the policies OAuth and API keys need, checking a user's…
- Edit, remove and create buttons on the site Buttons on public pages that open the edit form, remove an item or create a new one below it - the content/action form fields they post, the permission checks that decide when to show them, and where the user lands…
- Custom edit templates Give one content class its own edit form on the public site with an override of content/edit.tpl - the override rule, the variables the edit template receives, the form fields and buttons it must keep, and a short…
- Alternate layouts (print, popup and your own) Show any page in another page layout with the address prefix layout/set/<name> - the layouts layout.ini defines, how to add your own with PageLayout, ContentType, UseAccessPass and UseFullUrl, the layout override key…
- Error templates Designing the error pages (access denied, not found, module not found, form token refused ...): the error/kernel/<number>.tpl templates and what each number means, the HTTP status sent, the sign-in form embedded on…
- Security review checklist A checklist for reviewing a change to Exponential or an extension for security - access control, input and output, SQL and shell, CSRF, files and uploads, redirects, secrets, logging and privacy, HTTP headers and CSP…
Documentation license
This documentation is free documentation, licensed under the GNU Free Documentation License 1.3 or later.
Exponential Copyright © 1998-2026 Exponential Foundation and 7x