- Soften IsSandboxed XML doc as a best-effort marker
- Replace #XXXXX placeholders with #25399
- Set Scriban MemberFilter to allowlist public properties only,
blocking method/field access and reflection escape paths
- Update Razor and Scriban safe-runtime docs to match
- Add reflection-escape, method-invocation and nested-property
tests for Scriban
ITemplateRenderingEngine exposes a new IsSandboxed property so callers can
decide whether editing a template requires elevated trust.
- TemplateRenderingEngineBase provides a virtual default of false (secure-by-default)
- RazorTemplateRenderingEngine declares IsSandboxed=false (compiles to .NET assembly via Roslyn)
- ScribanTemplateRenderingEngine declares IsSandboxed=true (DSL without .NET interop)
- Razor integration docs and TextTemplateManagement docs document the implications
- Migration guide for ABP 10.4 documents the new abstraction member
- Index.cshtml.cs: cache the rendered parameter name set so
IsParameterVisible doesn't allocate a HashSet per call inside the cshtml
loop; clarify per-rule semantics in comments (empty allow-list is an
explicit "never show", null/unknown-key rules fail-open)
- forms-validation.md: drop the inaccurate IValidationRule reference and
describe MudBlazor's actual validation surface (ValidationAttribute on
the Validation parameter, Func<T,string>/Func<T,IEnumerable<string>>,
optional FluentValidation)
- book-store/part-02.md: use {(int)context.Item.Type} for the BookType
localization key to stay consistent with the rest of the tutorial
- forms-validation: drop incorrect manual _form.Validate() inside
OnCreatingEntityAsync; the base CreateEntityAsync validates CreateFormRef
before calling the override hook
- book-store/part-03: note that MudDatePicker.@bind-Date requires DateTime?
and link the abp-samples/MudBlazorSample reference
- Introduce a new "BlazorUI" doc-params dimension (Blazorise / MudBlazor) so
Blazor docs can show MudBlazor variants of code samples next to the existing
Blazorise ones
- Cover framework/ui/blazor (overall, theming, basic-theme, forms-validation,
submit-button, page-layout, page-header, page-toolbar-extensions,
entity-action-extensions, data-table-column-extensions, error-handling,
customization-overriding-components)
- Cover ui-themes (index, basic-theme, lepton-x, lepton-x-lite)
- Cover tutorials (book-store part 02/03/09/10, todo single-layer/layered,
modular-crm part 03/05/06, book-store-with-abp-suite part-05)
- Add an optional "DependsOn" map to DocumentParameterDto so a parameter can
be hidden when dependencies aren't satisfied (e.g. only show BlazorUI when
UI is one of Blazor/BlazorServer/BlazorWebApp). Visibility is evaluated on
the server in the project document index page.
Normalize Markdown in several docs: corrected code fence markers, fixed mismatched/backticked bold items and list formatting, removed stray dashes and extra whitespace, and standardized image placeholders. Files updated: docs/en/cli/index.md (fix command list/backtick issues and trailing newlines), docs/en/framework/ui/mvc-razor-pages/overall.md (fix code fences, list markers, and image text), and docs/en/framework/ui/react-native/index.md (normalize code fences, image placeholders, CLI notes, ports/examples formatting, and a password escaping fix). These are formatting-only changes to improve consistency and rendering.
- Fix Hangfire/Quartz UpdateScheduleAsync to operate directly on persistent
scheduler state without checking the in-memory registry, consistent with
the RemoveAsync fix; this allows updating schedules after restart
- Revert TickerQ IsRegistered to return false instead of throwing;
a boolean query method should not throw exceptions
- Update docs: note that UpdateScheduleAsync works after restart for
persistent providers
- Fix reflection method lookup in DefaultDynamicBackgroundJobManager to match by parameter types
- Add StopAllAsync to IDynamicBackgroundWorkerManager interface and all implementations
- Add semaphore locking to StopAllAsync in DefaultDynamicBackgroundWorkerManager with volatile _isDisposed
- Fix HangfireDynamicBackgroundWorkerManager.GetCron to match existing HangfireBackgroundWorkerManager format
- Fix QuartzDynamicBackgroundWorkerManager.UpdateScheduleAsync to reuse BuildTrigger method
- Fix TickerQDynamicBackgroundWorkerManager.IsRegistered to throw AbpException (consistent with other methods)
- Add GetAllNames and Clear to IDynamicBackgroundWorkerHandlerRegistry
- Call StopAllAsync in AbpBackgroundWorkersModule.OnApplicationShutdownAsync
- Move DynamicBackgroundWorkerManager_Tests to correct namespace/directory
- Fix singleton state pollution in BackgroundJobManager_Tests
- Update docs to warn about handler loss after restart for dynamic jobs and workers
When Application Services are registered via ConventionalControllers.Create(),
their types are added to DynamicProxyIgnoreTypes, which disables the
ValidationInterceptor. The AbpValidationActionFilter only checked ModelState
(DataAnnotations), so FluentValidation rules were never executed.
Add IValidationEnabled check in AbpValidationActionFilter to call
IMethodInvocationValidator for conventional controllers, enabling
FluentValidation support without duplicating validation for regular controllers.
Resolve#23457
maliming
Engincan VESKE
Anton Gritsenko
sumeyye