- Soften IsSandboxed XML doc as a best-effort marker
- Replace #XXXXX placeholders with #25399
- Set Scriban MemberFilter to allowlist public properties only,
blocking method/field access and reflection escape paths
- Update Razor and Scriban safe-runtime docs to match
- Add reflection-escape, method-invocation and nested-property
tests for Scriban
ITemplateRenderingEngine exposes a new IsSandboxed property so callers can
decide whether editing a template requires elevated trust.
- TemplateRenderingEngineBase provides a virtual default of false (secure-by-default)
- RazorTemplateRenderingEngine declares IsSandboxed=false (compiles to .NET assembly via Roslyn)
- ScribanTemplateRenderingEngine declares IsSandboxed=true (DSL without .NET interop)
- Razor integration docs and TextTemplateManagement docs document the implications
- Migration guide for ABP 10.4 documents the new abstraction member
Updated release notes for version 3.0.1 with enhanced project wizard, React admin console improvements, macOS performance optimizations, and stability fixes.
- Index.cshtml.cs: cache the rendered parameter name set so
IsParameterVisible doesn't allocate a HashSet per call inside the cshtml
loop; clarify per-rule semantics in comments (empty allow-list is an
explicit "never show", null/unknown-key rules fail-open)
- forms-validation.md: drop the inaccurate IValidationRule reference and
describe MudBlazor's actual validation surface (ValidationAttribute on
the Validation parameter, Func<T,string>/Func<T,IEnumerable<string>>,
optional FluentValidation)
- book-store/part-02.md: use {(int)context.Item.Type} for the BookType
localization key to stay consistent with the rest of the tutorial
- book-store/part-02: switch the Books page from AbpMudExtensibleDataGrid to
the standard MudBlazor MudDataGrid + <PropertyColumn> pattern (matches
Identity.Pro SecurityLogManagement); use RowsPerPage instead of PageSize
- book-store/part-03: replace the abp-internal MudDataGridEntityActionsColumn /
MudEntityActions / MudEntityAction wrappers with the standard MudBlazor
TemplateColumn + MudMenu + MudMenuItem so the tutorial stays approachable;
drop a misleading link to the legacy abp-samples/MudBlazorSample demo;
add a note that MudDatePicker.@bind-Date requires DateTime?
- book-store/part-09: wrap MudDialog.ShowAsync/CloseAsync calls with
InvokeAsync (matches Identity.Pro OrganizationUnitsManagement) and harden
OnDataGridReadAsync against null SortBy entries
- forms-validation: drop incorrect manual _form.Validate() inside
OnCreatingEntityAsync; the base CreateEntityAsync validates CreateFormRef
before calling the override hook
- book-store/part-03: note that MudDatePicker.@bind-Date requires DateTime?
and link the abp-samples/MudBlazorSample reference
- Introduce a new "BlazorUI" doc-params dimension (Blazorise / MudBlazor) so
Blazor docs can show MudBlazor variants of code samples next to the existing
Blazorise ones
- Cover framework/ui/blazor (overall, theming, basic-theme, forms-validation,
submit-button, page-layout, page-header, page-toolbar-extensions,
entity-action-extensions, data-table-column-extensions, error-handling,
customization-overriding-components)
- Cover ui-themes (index, basic-theme, lepton-x, lepton-x-lite)
- Cover tutorials (book-store part 02/03/09/10, todo single-layer/layered,
modular-crm part 03/05/06, book-store-with-abp-suite part-05)
- Add an optional "DependsOn" map to DocumentParameterDto so a parameter can
be hidden when dependencies aren't satisfied (e.g. only show BlazorUI when
UI is one of Blazor/BlazorServer/BlazorWebApp). Visibility is evaluated on
the server in the project document index page.