Fix: OrchardCore.Setup silently overrides tenant localization settings

[DavidHolmlabs]

Summary

OrchardCore.Setup.Startup.Configure() unconditionally calls app.UseRequestLocalization(...), using its own hard-coded, setup-wizard-only culture list (~20 languages). Nothing disables the OrchardCore.Setup feature once a tenant finishes setup, and this Startup has no ConfigureOrder override, so it runs after OrchardCore.Localization.Startup (ConfigureOrder = -100).

Both resolve the same shared IOptions<RequestLocalizationOptions>.Value instance, and AddSupportedCultures/AddSupportedUICultures replace SupportedCultures/SupportedUICultures rather than merge into them. So on every running (already set-up) tenant, OrchardCore.Setup's hard-coded culture list silently clobbers the tenant's real LocalizationSettings.SupportedCultures right after OrchardCore.Localization correctly configures it — and since Setup's middleware is registered second, it also runs last and wins.

Symptom

The admin culture picker (OrchardCore.Localization.AdminCulturePicker) sets its cookie correctly, but any tenant-configured culture that isn't also in the setup wizard's hard-coded list (most regional variants without an OrchardCore admin translation — e.g. sl-SI) is silently rejected by RequestLocalizationMiddleware, and the request falls back to the tenant's default culture. Cultures that happen to overlap with the hard-coded list (or whose parent does, when "fall back to parent culture" is enabled) appear to work, which makes the bug confusing to diagnose — it looks culture-specific rather than systemic.

Confirmed via Serilog.MinimumLevel.Override["Microsoft.AspNetCore.Localization"] = "Debug", which logs AdminCookieCultureProvider returned the following unsupported cultures [...], and via dumping the live IOptions<RequestLocalizationOptions>.Value, which showed exactly OrchardCore.Setup's hard-coded list instead of the tenant's configured cultures.

Fix

Guard the request-localization configuration in OrchardCore.Setup.Startup.Configure() behind ShellSettings.IsUninitialized(). The setup wizard's own culture list is only relevant while the tenant genuinely hasn't been set up yet; once it's running, OrchardCore.Localization's configuration (driven by the tenant's real Localization settings) should be the only source of truth. The route registration is left untouched — this only affects the localization options mutation.

Workaround (for anyone hitting this before this ships)

Disable the OrchardCore.Setup feature on any tenant that has already completed setup (Admin → Configuration → Features → Setup → Disable). It's only needed for the initial tenant-provisioning wizard.

Test plan

• dotnet build src/OrchardCore.Modules/OrchardCore.Setup/OrchardCore.Setup.csproj — 0 errors, both before and after pulling latest main
• Reproduced and verified the fix live against a real multi-tenant OrchardCore app: with OrchardCore.Setup enabled, a tenant-configured culture (sl-SI) not in the setup wizard's hard-coded list was silently rejected; disabling the feature (the operational equivalent of this code fix not mattering once the tenant is running) immediately resolved it
• Would appreciate a maintainer sanity-check on whether the actual first-run setup wizard flow (an uninitialized tenant, ShellSettings.State == Uninitialized) still localizes correctly with this change — the guarded branch should behave identically to before in that case, but I don't have an easy way to exercise the very first setup request in my repro environment

🤖 Generated with Claude Code

[github-actions]

Thank you for submitting your first pull request, awesome! 🚀 If you haven't already, please take a moment to review our contribution guide. This guide provides helpful information to ensure your contribution aligns with our standards. A core team member will review your pull request.
If you like Orchard Core, please star our repo and join our community channels.

[DavidHolmlabs]

@dotnet-policy-service agree company="Sustainable Interaction AB" Den tors 17 sep. 2026 kl 14:28 skrev github-actions[bot] < ***@***.***>:

…

*github-actions[bot]* left a comment (OrchardCMS/OrchardCore#19898) <#19898 (comment)> Thank you for submitting your first pull request, awesome! 🚀 If you haven't already, please take a moment to review our contribution guide <https://docs.orchardcore.net/en/latest/contributing/>. This guide provides helpful information to ensure your contribution aligns with our standards. A core team member will review your pull request. If you like Orchard Core, please star our repo and join our community channels <https://github.com/OrchardCMS/OrchardCore/?tab=readme-ov-file#get-in-touch> . — Reply to this email directly, view it on GitHub <#19898?email_source=notifications&email_token=AAETT4XWG2UMRJYKI657TDT5PPKF7A5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKNZRGQZTIOBQGQY2M4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJLDGN5XXIZLSL5RWY2LDNM#issuecomment-5714348041>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAETT4TNSNQGSDFR4RI57EL5PPKF7AVCNFSNUABEKJSXA33TNF2G64TZHMZDMOBYGQ3TENJ3JFZXG5LFHM2TIOBXGMZTKNBUHGQXMAQ> . Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS <https://github.com/notifications/mobile/ios/AAETT4UKWUQKDPBEGLZZVXT5PPKF7A5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKNZRGQZTIOBQGQY2M4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJKTGN5XXIZLSL5UW64Y> and Android <https://github.com/notifications/mobile/android/AAETT4UNWO4EQ5L4FZCX2K35PPKF7A5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKNZRGQZTIOBQGQY2M4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJLTGN5XXIZLSL5QW4ZDSN5UWI>. Download it today! You are receiving this because you were mentioned.Message ID: ***@***.***>

[sebastienros]

Would you be able to add a functional test to verify it's doing what you need now and we don't regress?

[DavidHolmlabs]

Fixed. The problem was that I have enabled OrchardCore.Setup in a self-service module in order to create tenants for customers. Now there are functional tests. All the best David Den tors 17 sep. 2026 kl 20:02 skrev Sébastien Ros ***@***.***

…

: *sebastienros* left a comment (OrchardCMS/OrchardCore#19898) <#19898 (comment)> Would you be able to add a functional test to verify it's doing what you need now and we don't regress? — Reply to this email directly, view it on GitHub <#19898?email_source=notifications&email_token=AAETT4SSQ4QIOKPRQWWMCI35PQRNDA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKNZRHA4TSMBXGM3KM4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJLDGN5XXIZLSL5RWY2LDNM#issuecomment-5718990736>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAETT4SPG734WOQWRAPJ27D5PQRNDAVCNFSNUABEKJSXA33TNF2G64TZHMZDMOBYGQ3TENJ3JFZXG5LFHM2TIOBXGMZTKNBUHGQXMAQ> . Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS <https://github.com/notifications/mobile/ios/AAETT4TBZ5UZNQZDNXXZGNL5PQRNDA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKNZRHA4TSMBXGM3KM4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJKTGN5XXIZLSL5UW64Y> and Android <https://github.com/notifications/mobile/android/AAETT4TSPMRDOA6VHJNRB7T5PQRNDA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKNZRHA4TSMBXGM3KM4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJLTGN5XXIZLSL5QW4ZDSN5UWI>. Download it today! You are receiving this because you were mentioned.Message ID: ***@***.***>