Since 2013, we’ve been working with Óbuda University on a hands-on way to teach web development. What began as a course built around Orchard CMS later evolved into an Orchard Core-based subject, giving students a chance to learn by building something that could actually work in the real world, not just completing classroom exercises.

Orchard Core updatesWarn against unsafe Liquid output in SQL queriesA SQL query is actually a Liquid template. This allows your queries to be shaped based on the parameters it gets. But you could srew up with SQL and Liquid if you start by injecting Liquid in a value, as you can see below. Because in that case, you can inject any SQL and expose all your databases. So, do not inject user-provided values directly with Liquid output expressions, as this can lead to SQL injection.

Orchard Core updatesIndependent Render Liquid and Sanitize HTML settings for HTML and Markdown componentsThe current SanitizeHtml settings' hint could be a little bit misleading, and enabling or disabling it causes potentially unwanted behavior because the hint only refers to preventing custom scripts, which is true, but it does much more by default. This, in itself, is trivial to fix. However, the SanitizeHtml setting also governs whether Liquid markup is rendered. If SanitizeHtml is false, that means Liquid is rendered. This prevents a simple use case where (script) sanitization is desired, but Liquid should still be rendered.

Orchard Core updatesNew OrchardCore.ContentFields.Core moduleEvery time you want to use any content field, for example, creating your own migrations, you have to reference the OrchardCore.ContentFields project. But it's unnecessary because in this case, you don't really need anything more than the class derived from ContentField and the corresponding settings.

The DotNest homepage was starting to show its age. Not just visually, but also in day-to-day site management UX. So we took a step back and rebuilt the frontend from the ground up.

Orchard Core updatesRemove implicit CancelAsync from ValidateAsyncThis change means the code won't cancel the current session if an issue occurs during validation in the DefaultContentManager.ValidateAsync() method. It's up to the caller of the validation, because this can discard unrelated pending changes from other components sharing the session.

From shock to acceptance — every developer goes through a grieving process when AI agents enter their workflow. Here are the 7 stages, what you gain, what you risk losing, and what remains irreplaceable.

Orchard Core updatesData Protection guideThanks to Laode Muhammad Al Fatih, there is now a new guide that provides information on implementing data protection in Orchard Core applications, particularly in multi-tenant and load-balanced environments. The guide also explains when you should use Distributed Data Protection and what providers do that.