activeadmin 0.6.6 → 1.0.0.pre1

data/features/sti_resource.feature

@@ -6,8 +6,12 @@ Feature: STI Resource
     Given I am logged in
     And a configuration of:
     """
-      ActiveAdmin.register Publisher
-      ActiveAdmin.register User
+      ActiveAdmin.register Publisher do
+        permit_params :first_name, :last_name, :username, :age if Rails::VERSION::MAJOR == 4
+      end
+      ActiveAdmin.register User do
+        permit_params :first_name, :last_name, :username, :age if Rails::VERSION::MAJOR == 4
+      end
     """
 
   Scenario: Create, update and delete a child STI resource

data/features/strong_parameters.feature

@@ -0,0 +1,73 @@
+@rails4
+@silent_unpermitted_params_failure
+Feature: Strong Params
+
+  When I am using Rails 4
+  I want to use Strong Parameters
+
+  Background:
+    Given a category named "Music" exists
+    And a user named "John Doe" exists
+    And a post with the title "Hello World" written by "John Doe" exists
+    And I am logged in
+    Given a configuration of:
+    """
+      ActiveAdmin.register Post do
+      end
+    """
+    When I am on the index page for posts
+
+  Scenario: Static permitted parameters
+    Given a configuration of:
+    """
+      ActiveAdmin.register Post do
+        permit_params :author, :title, :starred
+      end
+    """
+    Given I follow "Edit"
+
+    When I fill in "Title" with "Hello World from update"
+    And I check "Starred"
+    When I press "Update Post"
+    Then I should see "Post was successfully updated."
+    And I should see the attribute "Title" with "Hello World from update"
+    And I should see the attribute "Author" with "John Doe"
+    And I should see the attribute "Starred" with "true"
+
+  Scenario: Dynamic permitted parameters
+    Given a configuration of:
+    """
+      ActiveAdmin.register Post do
+        permit_params do
+          allow = [:author, :title]
+          allow << :starred
+          allow
+        end
+      end
+    """
+    Given I follow "Edit"
+
+    When I fill in "Title" with "Hello World from update"
+    And I check "Starred"
+    When I press "Update Post"
+    Then I should see "Post was successfully updated."
+    And I should see the attribute "Title" with "Hello World from update"
+    And I should see the attribute "Author" with "John Doe"
+    And I should see the attribute "Starred" with "true"
+
+  Scenario: Should not update parameters that are not declared as permitted
+    Given a configuration of:
+    """
+      ActiveAdmin.register Post do
+        permit_params :author, :title
+      end
+    """
+    Given I follow "Edit"
+
+    When I fill in "Title" with "Hello World from update"
+    And I check "Starred"
+    When I press "Update Post"
+    Then I should see "Post was successfully updated."
+    And I should see the attribute "Title" with "Hello World from update"
+    And I should see the attribute "Author" with "John Doe"
+    And the attribute "Starred" should be empty

data/features/support/env.rb

@@ -5,25 +5,20 @@
 # files.
 
 ENV["RAILS_ENV"] ||= "cucumber"
-ENV['BUNDLE_GEMFILE'] = File.expand_path('../../../Gemfile', __FILE__)
-require "rubygems"
-require "bundler"
-Bundler.setup
 
-require File.expand_path('../../../spec/support/detect_rails_version', __FILE__)
-ENV["RAILS"] = detect_rails_version
+require File.expand_path('../../../spec/spec_helper', __FILE__)
 
 ENV['RAILS_ROOT'] = File.expand_path("../../../spec/rails/rails-#{ENV["RAILS"]}", __FILE__)
 
-
 # Create the test app if it doesn't exists
 unless File.exists?(ENV['RAILS_ROOT'])
   system 'rake setup'
 end
 
-# Ensure the Active Admin load path is happy
 require 'rails'
+require 'active_record'
 require 'active_admin'
+require 'devise'
 ActiveAdmin.application.load_paths = [ENV['RAILS_ROOT'] + "/app/admin"]
 
 require ENV['RAILS_ROOT'] + '/config/environment'
@@ -34,11 +29,29 @@ autoload :ActiveAdmin, 'active_admin'
 
 require 'cucumber/rails'
 
-require 'cucumber/rspec/doubles'
+require 'rspec/mocks'
+World(RSpec::Mocks::ExampleMethods)
+
+Before do
+  RSpec::Mocks.setup
+end
+
+After do
+  begin
+    RSpec::Mocks.verify
+  ensure
+    RSpec::Mocks.teardown
+  end
+end
 
 require 'capybara/rails'
 require 'capybara/cucumber'
 require 'capybara/session'
+require 'capybara/poltergeist'
+require 'phantomjs/poltergeist'
+
+Capybara.javascript_driver = :poltergeist
+
 # Capybara defaults to XPath selectors rather than Webrat's default of CSS3. In
 # order to ease the transition to Capybara we set the default here. If you'd
 # prefer to use XPath just remove this line and adjust any selectors in your
@@ -118,3 +131,15 @@ unless ENV['DEFER_GC'] == '0' || ENV['DEFER_GC'] == 'false'
   Before { DeferredGarbageCollection.start }
   After  { DeferredGarbageCollection.reconsider }
 end
+
+# Don't run @rails4 tagged features for versions before Rails 4.
+Before('@rails4') do |scenario|
+  scenario.skip_invoke! if Rails::VERSION::MAJOR < 4
+end
+
+Around '@silent_unpermitted_params_failure' do |scenario, block|
+  original = ActionController::Parameters.action_on_unpermitted_parameters
+  ActionController::Parameters.action_on_unpermitted_parameters = false
+  block.call
+  ActionController::Parameters.action_on_unpermitted_parameters = original
+end

data/features/support/paths.rb

@@ -6,7 +6,10 @@ module NavigationHelpers
   # step definition in web_steps.rb
   #
   def path_to(page_name)
-    case page_name
+    params = page_name.scan(/with params "(.*?)"/).flatten[0] || ''
+    page_name.sub! /\ with params.*/, ''
+
+    url = case page_name
 
     when /the home\s?page/
       '/'
@@ -16,6 +19,10 @@ module NavigationHelpers
       "/admin/posts/new"
     when /the login page/
       "/admin/login"
+    when /the first post show page/
+      "/admin/posts/1"
+    when /the first post edit page/
+      "/admin/posts/1/edit"
     when /the admin password reset form with token "([^"]*)"/
       "/admin/password/edit?reset_password_token=#{$1}"
 
@@ -23,20 +30,20 @@ module NavigationHelpers
     # the index page for posts in the user_admin namespace
     when /^the index page for (.*) in the (.*) namespace$/
       if $2 != 'root'
-        send(:"#{$2}_#{$1}_path")
+        send "#{$2}_#{$1}_path"
       else
-        send(:"#{$1}_path")
+        send "#{$1}_path"
       end
 
     # same as above, except defaults to admin namespace
     when /^the index page for (.*)$/
-      send(:"admin_#{$1}_path")
+      send "admin_#{$1}_path"
 
     when /^the last author's posts$/
       admin_user_posts_path(User.last)
 
     when /^the last author's last post page$/
-      admin_user_post_path(User.last, Post.where(:author_id => User.last.id).last)
+      admin_user_post_path(User.last, Post.where(author_id: User.last.id).last)
 
     when /^the last post's edit page$/
       edit_admin_post_path(Post.last)
@@ -51,12 +58,13 @@ module NavigationHelpers
       begin
         page_name =~ /the (.*) page/
         path_components = $1.split(/\s+/)
-        self.send(path_components.push('path').join('_').to_sym)
+        self.send path_components.push('path').join('_')
       rescue Object => e
         raise "Can't find mapping from \"#{page_name}\" to a path.\n" +
           "Now, go and add a mapping in #{__FILE__}"
       end
     end
+    url + params
   end
 end
 

data/features/support/selectors.rb

@@ -27,7 +27,7 @@ module HtmlSelectorsHelpers
       [:css, "table.index_grid"]
 
     when /^the "([^"]*)" sidebar$/
-      [:css, "##{$1.gsub(" ", '').underscore}_sidebar_section"]
+      [:css, "##{$1.tr(" ", '').underscore}_sidebar_section"]
 
     # This allows you to provide a quoted selector as the scope
     # for "within" steps as was previously the default for the

data/features/symbol_leak.feature

@@ -0,0 +1,35 @@
+Feature: User input shouldn't be symbolized
+
+  Background:
+    Given a configuration of:
+    """
+      ActiveAdmin.register Post
+    """
+    Given I am logged in
+    And 1 post exists
+
+  Scenario: The dashboard doesn't leak
+    Given I am on the dashboard with params "?really_long_malicious_key0"
+    Then "really_long_malicious_key0" shouldn't be a symbol
+
+  Scenario: The index page doesn't leak
+    Given I am on the index page for posts with params "?really_long_malicious_key1"
+    Then "really_long_malicious_key1" shouldn't be a symbol
+
+  @allow-rescue
+  Scenario: The filter query hash doesn't leak
+    Given I am on the index page for posts with params "?q[really_long_malicious_key2]"
+    Then "really_long_malicious_key2" shouldn't be a symbol
+
+  Scenario: The show page doesn't leak
+    Given I go to the first post show page with params "?really_long_malicious_key3"
+    Then "really_long_malicious_key3" shouldn't be a symbol
+
+  Scenario: The edit page doesn't leak
+    Given I go to the first post edit page with params "?really_long_malicious_key4"
+    Then "really_long_malicious_key4" shouldn't be a symbol
+
+  @allow-rescue
+  Scenario: Batch Actions don't leak
+    Given I POST to "admin/posts/batch_action" with params "?batch_action=really_long_malicious_key5"
+    Then "really_long_malicious_key5" shouldn't be a symbol

data/features/users/resetting_password.feature

@@ -15,21 +15,20 @@ Feature: User Resetting Password
     And I follow "Forgot your password?"
     When I fill in "Email" with "admin@example.com"
     And I press "Reset My Password"
-    Then I should see "You will receive an email with instructions"
-    And I should see "how to reset your password in a few minutes."
+    Then I should see "You will receive an email with instructions on how to reset your password in a few minutes."
 
   Scenario: Changing password after resetting
-    When "admin@example.com" requests a pasword reset with token "foobarbaz"
+    When "admin@example.com" requests a password reset with token "foobarbaz"
     When I go to the admin password reset form with token "foobarbaz"
-    And I fill in "Password" with "password"
+    And I fill in the password field with "password"
     And I fill in "Password confirmation" with "password"
     And I press "Change my password"
     Then I should see "success"
 
   Scenario: Changing password after resetting with errors
-    When "admin@example.com" requests a pasword reset with token "foobarbaz" but it expires
+    When "admin@example.com" requests a password reset with token "foobarbaz" but it expires
     When I go to the admin password reset form with token "foobarbaz"
-    And I fill in "Password" with "password"
+    And I fill in the password field with "password"
     And I fill in "Password confirmation" with "wrong"
     And I press "Change my password"
     Then I should see "expired"

data/lib/active_admin.rb

@@ -1,16 +1,19 @@
-require 'meta_search'
-require 'meta_search_ext'
+require 'active_support/core_ext'
+require 'set'
+
+require 'ransack'
+require 'ransack_ext'
 require 'bourbon'
-require 'devise'
 require 'kaminari'
 require 'formtastic'
-require 'sass'
+require 'sass-rails'
 require 'inherited_resources'
 require 'jquery-rails'
+require 'jquery-ui-rails'
+require 'coffee-rails'
 require 'arbre'
-require 'active_admin/dependency_checker'
-require 'active_admin/sass/helpers'
-require 'active_admin/engine'
+
+require 'active_admin/helpers/i18n'
 
 module ActiveAdmin
 
@@ -19,12 +22,13 @@ module ActiveAdmin
   autoload :AssetRegistration,        'active_admin/asset_registration'
   autoload :Authorization,            'active_admin/authorization_adapter'
   autoload :AuthorizationAdapter,     'active_admin/authorization_adapter'
-  autoload :Breadcrumbs,              'active_admin/breadcrumbs'
   autoload :Callbacks,                'active_admin/callbacks'
   autoload :Component,                'active_admin/component'
   autoload :BaseController,           'active_admin/base_controller'
+  autoload :CanCanAdapter,            'active_admin/cancan_adapter'
   autoload :ControllerAction,         'active_admin/controller_action'
   autoload :CSVBuilder,               'active_admin/csv_builder'
+  autoload :Dependency,               'active_admin/dependency'
   autoload :Deprecation,              'active_admin/deprecation'
   autoload :Devise,                   'active_admin/devise'
   autoload :DSL,                      'active_admin/dsl'
@@ -36,11 +40,12 @@ module ActiveAdmin
   autoload :MenuCollection,           'active_admin/menu_collection'
   autoload :MenuItem,                 'active_admin/menu_item'
   autoload :Namespace,                'active_admin/namespace'
+  autoload :OrderClause,              'active_admin/order_clause'
   autoload :Page,                     'active_admin/page'
   autoload :PagePresenter,            'active_admin/page_presenter'
   autoload :PageController,           'active_admin/page_controller'
   autoload :PageDSL,                  'active_admin/page_dsl'
-  autoload :Reloader,                 'active_admin/reloader'
+  autoload :PunditAdapter,            'active_admin/pundit_adapter'
   autoload :Resource,                 'active_admin/resource'
   autoload :ResourceController,       'active_admin/resource_controller'
   autoload :ResourceDSL,              'active_admin/resource_dsl'
@@ -67,17 +72,11 @@ module ActiveAdmin
       application.prepare!
     end
 
-    delegate :register,      :to => :application
-    delegate :register_page, :to => :application
-    delegate :unload!,       :to => :application
-    delegate :load!,         :to => :application
-    delegate :routes,        :to => :application
-
-    # Returns true if this rails application has the asset
-    # pipeline enabled.
-    def use_asset_pipeline?
-      DependencyChecker.rails_3_1? && Rails.application.config.try(:assets).try(:enabled)
-    end
+    delegate :register,      to: :application
+    delegate :register_page, to: :application
+    delegate :unload!,       to: :application
+    delegate :load!,         to: :application
+    delegate :routes,        to: :application
 
     # A callback is triggered each time (before) Active Admin loads the configuration files.
     # In development mode, this will happen whenever the user changes files. In production
@@ -118,12 +117,14 @@ module ActiveAdmin
 
 end
 
-ActiveAdmin::DependencyChecker.check!
+# Require things that don't support autoload
+require 'active_admin/engine'
+require 'active_admin/error'
 
-# Require internal Plugins
-require 'active_admin/comments'
+# Require internal plugins
 require 'active_admin/batch_actions'
 require 'active_admin/filters'
 
-# Load gem-specific code only if that gem is being used
-require 'active_admin/cancan_adapter' if ActiveAdmin::DependencyChecker.cancan?
+# Require ORM-specific plugins
+require 'active_admin/orm/active_record' if defined? ActiveRecord
+require 'active_admin/orm/mongoid'       if defined? Mongoid

data/lib/active_admin/abstract_view_factory.rb

@@ -17,12 +17,12 @@ module ActiveAdmin
     # eg:
     #
     #   factory = AbstractViewFactory.new
-    #   factory.register :my_view => SomeViewClass
+    #   factory.register my_view: SomeViewClass
     #
     # You can setup many at the same time:
     #
-    #   factory.register  :my_view => SomeClass,
-    #                     :another_view => OtherViewClass
+    #   factory.register  my_view: SomeClass,
+    #                     another_view: OtherViewClass
     #
     def register(view_hash)
       view_hash.each do |view_key, view_class|
@@ -46,8 +46,7 @@ module ActiveAdmin
       set_view_for_key(key, value)
     end
 
-    # Override respond to to include keys
-    def respond_to?(method)
+    def respond_to_missing?(method, include_private)
       key = key_from_method_name(method)
       if has_key?(key)
         true
@@ -62,26 +61,17 @@ module ActiveAdmin
       key = key_from_method_name(method)
       if has_key?(key)
         if method.to_s.include?('=')
-          self.class_eval <<-EOS
-            def #{key}=(value)
-              set_view_for_key(:#{key}, value)
-            end
-          EOS
+          set_view_for_key key, args.first
         else
-          self.class_eval <<-EOS
-            def #{key}
-              get_view_for_key(:#{key})
-            end
-          EOS
+          get_view_for_key key
         end
-        self.send(method, *args)
       else
         super
       end
     end
 
     def key_from_method_name(method)
-      method.to_s.gsub('=', '').to_sym
+      method.to_s.tr('=', '').to_sym
     end
 
     def get_view_for_key(key)