Themes & Appearance

Encrypt CMS separates presentation from core business logic through its modular theme architecture.

---

1. Theme Management (/admin/themes)

Navigate to Admin > Themes to view, preview, and activate installed themes.

• Active Theme: Displays the currently active presentation theme, its active version, author details, and screenshot.
• Available Themes: A grid of installed themes ready for activation.
• Live Preview: Preview how your existing content looks in another theme before activating it publicly.
• Upload Theme: Administrators can upload official theme archives (.zip). Every uploaded archive is validated against the Theme Package Contract before extraction.

---

2. The Theme Package Contract

To ensure security and compatibility, Encrypt CMS enforces strict package boundaries for all uploaded themes:

1. Manifest File: The root of the theme directory must contain a valid theme.json file.
2. Template Files: The theme must supply at minimum:
   • index.php or layouts/default.php (master layout)
   • home.php or front-page.php (homepage layout)
   • single.php (single article template)
   • page.php (static page template)
   • 404.php (error page template)
3. Archive Security: Uploaded ZIP archives are inspected before extraction to prevent directory traversal (..), leading slashes, Windows drive paths (C:\), or illegal root configuration tampering (.htaccess).

---

3. The theme.json Specification

Every theme must include a UTF-8 encoded theme.json manifest:

{
  "name": "Encrypt One",
  "slug": "encrypt-cms-one",
  "version": "1.0.0",
  "author": "Encrypt CMS Team",
  "description": "Clean, fast, high-contrast default theme for publishing blogs and documentation.",
  "screenshot": "screenshot.png",
  "features": [
    "dark-mode",
    "responsive-grid",
    "custom-navigation"
  ]
}

---

4. Live Theme Customizer (/admin/themes/customize)

The built-in customizer service (ThemeCustomizerService) allows administrators to adjust visual options with live preview:

• Site logo and favicon upload.
• Primary accent color and background colors.
• Custom header and footer navigation menus.
• Custom typography choices.
• Custom CSS injection (sanitized to prevent XSS).