Extension development
Building extensions step by step: structure, settings, modules, templates, classes and contributing back.
216 pages
- Security in extensions The security rules every extension follows: policies on views, POST and form tokens, escaping, safe SQL, untrusted input, safe redirects, files, secrets and no inline code.
- Content Security Policy for extension authors What a Content Security Policy means for templates and scripts: the modes, why inline code fails, the data-attribute pattern, csp_nonce() and its limits, and finding violations.
- Directories under var/ What lives under var/ - the site's cache, storage and log, var/log, var/autoload - what may be deleted, what must be backed up, and where an extension keeps its own files.
- Admin pages in the admin4 style Extension admin pages that look like the rest of the admin: shared .a4- components, --a4- tokens with dark values, your own stylesheet, no inline CSS, menu links, light and dark checks.
- Error codes and module results The kernel error codes a view returns with handleError() - access denied, not found, not available, moved, form token refused - their HTTP status in error.ini and the error templates.
- Tests for extensions Tests that ship with an extension and need no database: phpunit.xml.dist and bootstrap, unit and file tests, the kernel's own suite, and the other checks before every commit.
- The expui JavaScript API A reference card of Exponential UI, the admin's JavaScript library: packer keys, exp_config(), the Exp core, Exp.io server calls, dialogs, tables, date pickers, uploads and toolbars.
- admin4 components and tokens A reference card of the administration's shared components (.a4-* classes) and design tokens (--a4-* custom properties) an extension's admin pages use, with the rules that keep them working in light and dark mode.
- Debugging extensions A routine for an extension that does nothing or breaks a page: is it active, are its settings read, do its classes load, are caches or workers stale, with the RAD health check, checkclasses and the logs.
- Performance in extensions Keep an extension fast and safe under persistent workers: count queries, fetch with limits, cache, keep listeners cheap, measure, and never keep request state in statics.
- The help system for extensions Putting an extension's documentation into the admin help: README.md and INSTALL.md on top, Markdown in doc/, shown while the extension is active (ExtensionDocDirs for an inactive one), front matter and audience ids…
- Documenting your extension, including help pages Document an extension where people look: README.md and INSTALL.md on top, the rest as Markdown in doc/, in English; the help center shows it while the extension is active, with front matter, featured pages and context…
- expservices: remote services for extensions What expservices offers extension authors - services over ezjscore with declared access, paging and one envelope, a catalogue, API tokens - and how to write a service of your own.
- Glossary for extension developers The words this book uses, in one alphabetical list - from access word, append file and attribute to view mode, view parameter and workflow - each with a short definition and the chapter that explains it.
- Book index: every topic from A to Z The index of the extension development book - every topic from access checks to YUI, each with the chapters that explain it, so you can jump straight to what you need.
- Tutorials: build real extensions step by step Step-by-step tutorials that build real small extensions, first with the RAD wizards of Setup > RAD, then by hand, ending with a complete extension from idea to release. Every file shown was checked with php -l and run.
Documentation license
This documentation is free documentation, licensed under the GNU Free Documentation License 1.3 or later.
Exponential Copyright © 1998-2026 Exponential Foundation and 7x