activeadmin 2.6.1 → 3.2.3

data/lib/active_admin/application.rb

@@ -1,6 +1,7 @@
-require 'active_admin/router'
-require 'active_admin/application_settings'
-require 'active_admin/namespace_settings'
+# frozen_string_literal: true
+require "active_admin/router"
+require "active_admin/application_settings"
+require "active_admin/namespace_settings"
 
 module ActiveAdmin
   class Application
@@ -45,8 +46,8 @@ module ActiveAdmin
     include AssetRegistration
 
     # Event that gets triggered on load of Active Admin
-    BeforeLoadEvent = 'active_admin.application.before_load'.freeze
-    AfterLoadEvent  = 'active_admin.application.after_load'.freeze
+    BeforeLoadEvent = "active_admin.application.before_load".freeze
+    AfterLoadEvent = "active_admin.application.after_load".freeze
 
     # Runs before the app's AA initializer
     def setup!
@@ -75,7 +76,7 @@ module ActiveAdmin
 
       namespace = namespaces[name.to_sym] ||= begin
         namespace = Namespace.new(self, name)
-        ActiveSupport::Notifications.publish ActiveAdmin::Namespace::RegisterEvent, namespace
+        ActiveSupport::Notifications.instrument ActiveAdmin::Namespace::RegisterEvent, { active_admin_namespace: namespace }
         namespace
       end
 
@@ -111,10 +112,10 @@ module ActiveAdmin
     # To reload everything simply call `ActiveAdmin.unload!`
     def load!
       unless loaded?
-        ActiveSupport::Notifications.publish BeforeLoadEvent, self # before_load hook
-        files.each { |file| load file }                            # load files
-        namespace(default_namespace)                               # init AA resources
-        ActiveSupport::Notifications.publish AfterLoadEvent, self  # after_load hook
+        ActiveSupport::Notifications.instrument BeforeLoadEvent, { active_admin_application: self } # before_load hook
+        files.each { |file| load file } # load files
+        namespace(default_namespace) # init AA resources
+        ActiveSupport::Notifications.instrument AfterLoadEvent, { active_admin_application: self } # after_load hook
         @@loaded = true
       end
     end
@@ -125,7 +126,7 @@ module ActiveAdmin
 
     # Returns ALL the files to be loaded
     def files
-      load_paths.flatten.compact.uniq.flat_map { |path| Dir["#{path}/**/*.rb"] }
+      load_paths.flatten.compact.uniq.flat_map { |path| Dir["#{path}/**/*.rb"].sort }
     end
 
     # Creates all the necessary routes for the ActiveAdmin configurations
@@ -144,13 +145,13 @@ module ActiveAdmin
 
     # Adds before, around and after filters to all controllers.
     # Example usage:
-    #   ActiveAdmin.before_filter :authenticate_admin!
+    #   ActiveAdmin.before_action :authenticate_admin!
     #
     AbstractController::Callbacks::ClassMethods.public_instance_methods.
-      select { |m| m.match(/(filter|action)/) }.each do |name|
+      select { |m| m.match(/_action\z/) }.each do |name|
       define_method name do |*args, &block|
-        controllers_for_filters.each do |controller|
-          controller.public_send name, *args, &block
+        ActiveSupport.on_load(:active_admin_controller) do
+          public_send name, *args, &block
         end
       end
     end
@@ -164,9 +165,8 @@ module ActiveAdmin
     private
 
     def register_default_assets
-      register_stylesheet 'active_admin.css', media: 'screen'
-      register_stylesheet 'active_admin/print.css', media: 'print'
-      register_javascript 'active_admin.js'
+      register_stylesheet "active_admin.css", media: "all"
+      register_javascript "active_admin.js"
     end
 
     # Since app/admin is alphabetically before app/models, we have to remove it
@@ -176,7 +176,7 @@ module ActiveAdmin
     # files from being loaded twice in production.
     def remove_active_admin_load_paths_from_rails_autoload_and_eager_load
       ActiveSupport::Dependencies.autoload_paths -= load_paths
-      Rails.application.config.eager_load_paths  -= load_paths
+      Rails.application.config.eager_load_paths -= load_paths
     end
 
     # Hook into the Rails code reloading mechanism so that things are reloaded

data/lib/active_admin/application_settings.rb

@@ -1,4 +1,5 @@
-require 'active_admin/settings_node'
+# frozen_string_literal: true
+require "active_admin/settings_node"
 
 module ActiveAdmin
   class ApplicationSettings < SettingsNode
@@ -15,7 +16,7 @@ module ActiveAdmin
     # Load paths for admin configurations. Add folders to this load path
     # to load up other resources for administration. External gems can
     # include their paths in this load path to provide active_admin UIs
-    register :load_paths, [File.expand_path('app/admin', Rails.root)]
+    register :load_paths, [File.expand_path("app/admin", Rails.root)]
 
     # Set default localize format for Date/Time values
     register :localize_format, :long
@@ -34,7 +35,7 @@ module ActiveAdmin
                                       :to_s ]
 
     # To make debugging easier, by default don't stream in development
-    register :disable_streaming_in, ['development']
+    register :disable_streaming_in, ["development"]
 
     # Remove sensitive attributes from being displayed, made editable, or exported by default
     register :filter_attributes, [:encrypted_password, :password, :password_confirmation]

data/lib/active_admin/asset_registration.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module ActiveAdmin
   module AssetRegistration
 
@@ -13,12 +14,12 @@ module ActiveAdmin
       stylesheets.clear
     end
 
-    def register_javascript(name)
-      javascripts.add name
+    def register_javascript(path, options = {})
+      javascripts[path] = options
     end
 
     def javascripts
-      @javascripts ||= Set.new
+      @javascripts ||= {}
     end
 
     def clear_javascripts!

data/lib/active_admin/authorization_adapter.rb

@@ -1,10 +1,13 @@
+# frozen_string_literal: true
 module ActiveAdmin
 
   # Default Authorization permissions for Active Admin
   module Authorization
-    READ    = :read
-    CREATE  = :create
-    UPDATE  = :update
+    READ = :read
+    NEW = :new
+    CREATE = :create
+    EDIT = :edit
+    UPDATE = :update
     DESTROY = :destroy
   end
 

data/lib/active_admin/base_controller/authorization.rb

@@ -1,15 +1,16 @@
+# frozen_string_literal: true
 module ActiveAdmin
   class BaseController < ::InheritedResources::Base
     module Authorization
       extend ActiveSupport::Concern
 
       ACTIONS_DICTIONARY = {
-        index:   ActiveAdmin::Authorization::READ,
-        show:    ActiveAdmin::Authorization::READ,
-        new:     ActiveAdmin::Authorization::CREATE,
-        create:  ActiveAdmin::Authorization::CREATE,
-        edit:    ActiveAdmin::Authorization::UPDATE,
-        update:  ActiveAdmin::Authorization::UPDATE,
+        index: ActiveAdmin::Authorization::READ,
+        show: ActiveAdmin::Authorization::READ,
+        new: ActiveAdmin::Authorization::NEW,
+        create: ActiveAdmin::Authorization::CREATE,
+        edit: ActiveAdmin::Authorization::EDIT,
+        update: ActiveAdmin::Authorization::UPDATE,
         destroy: ActiveAdmin::Authorization::DESTROY
       }
 
@@ -52,9 +53,10 @@ module ActiveAdmin
       #                 an ActiveAdmin::AccessDenied.
       def authorize!(action, subject = nil)
         unless authorized? action, subject
-          raise ActiveAdmin::AccessDenied.new(current_active_admin_user,
-                                              action,
-                                              subject)
+          raise ActiveAdmin::AccessDenied.new(
+            current_active_admin_user,
+            action,
+            subject)
         end
       end
 
@@ -80,7 +82,7 @@ module ActiveAdmin
       def active_admin_authorization_adapter
         adapter = active_admin_namespace.authorization_adapter
         if adapter.is_a? String
-          ActiveSupport::Dependencies.constantize adapter
+          adapter.constantize
         else
           adapter
         end
@@ -112,9 +114,9 @@ module ActiveAdmin
             redirect_backwards_or_to_root
           end
 
-          format.csv  { render body:          error,           status: :unauthorized }
-          format.json { render json: { error: error },         status: :unauthorized }
-          format.xml  { render xml: "<error>#{error}</error>", status: :unauthorized }
+          format.csv { render body: error, status: :unauthorized }
+          format.json { render json: { error: error }, status: :unauthorized }
+          format.xml { render xml: "<error>#{error}</error>", status: :unauthorized }
         end
       end
 

data/lib/active_admin/base_controller/menu.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module ActiveAdmin
   class BaseController < ::InheritedResources::Base
     module Menu

data/lib/active_admin/base_controller.rb

@@ -1,12 +1,12 @@
-require 'active_admin/base_controller/authorization'
-require 'active_admin/base_controller/menu'
+# frozen_string_literal: true
+require "active_admin/base_controller/authorization"
+require "active_admin/base_controller/menu"
 
 module ActiveAdmin
   # BaseController for ActiveAdmin.
   # It implements ActiveAdmin controllers core features.
   class BaseController < ::InheritedResources::Base
     helper ::ActiveAdmin::ViewHelpers
-    helper_method :env
 
     layout :determine_active_admin_layout
 
@@ -69,13 +69,14 @@ module ActiveAdmin
     #   2.  If we're rendering a custom action, we'll use the active_admin layout so
     #       that users can render any template inside Active Admin.
     def determine_active_admin_layout
-      ACTIVE_ADMIN_ACTIONS.include?(params[:action].to_sym) ? false : 'active_admin'
+      ACTIVE_ADMIN_ACTIONS.include?(params[:action].to_sym) ? false : "active_admin"
     end
 
     def active_admin_root
-      controller, action = active_admin_namespace.root_to.split '#'
+      controller, action = active_admin_namespace.root_to.split "#"
       { controller: controller, action: action }
     end
 
+    ActiveSupport.run_load_hooks(:active_admin_controller, self)
   end
 end

data/lib/active_admin/batch_actions/controller.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module ActiveAdmin
   module BatchActions
     module Controller
@@ -5,10 +6,10 @@ module ActiveAdmin
       # Controller action that is called when submitting the batch action form
       def batch_action
         if action_present?
-          selection  =            params[:collection_selection] || []
-          inputs     = JSON.parse params[:batch_action_inputs]  || '{}'
+          selection = params[:collection_selection] || []
+          inputs = JSON.parse params[:batch_action_inputs] || "{}"
           valid_keys = MethodOrProcHelper.render_in_context(self, current_batch_action.inputs).try(:keys)
-          inputs     = inputs.with_indifferent_access.slice *valid_keys
+          inputs = inputs.with_indifferent_access.slice *valid_keys
           instance_exec selection, inputs, &current_batch_action.block
         else
           raise "Couldn't find batch action \"#{params[:batch_action]}\""

data/lib/active_admin/batch_actions/resource_extension.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module ActiveAdmin
 
   module BatchActions
@@ -57,21 +58,22 @@ module ActiveAdmin
       def add_default_batch_action
         destroy_options = {
           priority: 100,
-          confirm: proc { I18n.t('active_admin.batch_actions.delete_confirmation', plural_model: active_admin_config.plural_resource_label.downcase) },
-          if: proc { controller.action_methods.include?('destroy') && authorized?(ActiveAdmin::Auth::DESTROY, active_admin_config.resource_class) }
+          confirm: proc { I18n.t("active_admin.batch_actions.delete_confirmation", plural_model: active_admin_config.plural_resource_label.downcase) },
+          if: proc { controller.action_methods.include?("destroy") && authorized?(ActiveAdmin::Auth::DESTROY, active_admin_config.resource_class) }
         }
 
-        add_batch_action :destroy, proc { I18n.t('active_admin.delete') }, destroy_options do |selected_ids|
+        add_batch_action :destroy, proc { I18n.t("active_admin.delete") }, destroy_options do |selected_ids|
           batch_action_collection.find(selected_ids).each do |record|
             authorize! ActiveAdmin::Auth::DESTROY, record
             destroy_resource(record)
           end
 
           redirect_to active_admin_config.route_collection_path(params),
-                      notice: I18n.t("active_admin.batch_actions.succesfully_destroyed",
-                                        count: selected_ids.count,
-                                        model: active_admin_config.resource_label.downcase,
-                                        plural_model: active_admin_config.plural_resource_label(count: selected_ids.count).downcase)
+                      notice: I18n.t(
+                        "active_admin.batch_actions.succesfully_destroyed",
+                        count: selected_ids.count,
+                        model: active_admin_config.resource_label.downcase,
+                        plural_model: active_admin_config.plural_resource_label(count: selected_ids.count).downcase)
         end
       end
 
@@ -84,7 +86,7 @@ module ActiveAdmin
 
     attr_reader :block, :title, :sym
 
-    DEFAULT_CONFIRM_MESSAGE = proc { I18n.t 'active_admin.batch_actions.default_confirmation' }
+    DEFAULT_CONFIRM_MESSAGE = proc { I18n.t "active_admin.batch_actions.default_confirmation" }
 
     # Create a Batch Action
     #

data/lib/active_admin/batch_actions/views/batch_action_form.rb

@@ -1,4 +1,5 @@
-require 'active_admin/component'
+# frozen_string_literal: true
+require "active_admin/component"
 
 module ActiveAdmin
   module BatchActions
@@ -16,7 +17,7 @@ module ActiveAdmin
         # batch_action        => name of the specific action called
         # batch_action_inputs => a JSON string of any requested confirmation values
         text_node form_tag active_admin_config.route_batch_action_path(params, url_options), id: options[:id]
-        input name: :batch_action,        id: :batch_action,        type: :hidden
+        input name: :batch_action, id: :batch_action, type: :hidden
         input name: :batch_action_inputs, id: :batch_action_inputs, type: :hidden
 
         super(options)
@@ -30,7 +31,7 @@ module ActiveAdmin
       private
 
       def closing_form_tag
-        '</form>'.html_safe
+        "</form>".html_safe
       end
 
     end

data/lib/active_admin/batch_actions/views/batch_action_selector.rb

@@ -1,4 +1,5 @@
-require 'active_admin/component'
+# frozen_string_literal: true
+require "active_admin/component"
 
 module ActiveAdmin
   module BatchActions
@@ -31,17 +32,17 @@ module ActiveAdmin
             confirmation_text = render_or_call_method_or_proc_on(self, batch_action.confirm)
 
             options = {
-              :class         => "batch_action",
-              "data-action"  => batch_action.sym,
-              "data-confirm" => confirmation_text,
-              "data-inputs"  => render_in_context(self, batch_action.inputs).to_json
+              class: "batch_action",
+              "data-action": batch_action.sym,
+              "data-confirm": confirmation_text,
+              "data-inputs": render_in_context(self, batch_action.inputs).to_json
             }
 
             default_title = render_or_call_method_or_proc_on(self, batch_action.title)
             title = I18n.t("active_admin.batch_actions.labels.#{batch_action.sym}", default: default_title)
             label = I18n.t("active_admin.batch_actions.action_label", title: title)
 
-            item label, "#", options
+            item label, "#", **options
           end
         end
       end

data/lib/active_admin/batch_actions/views/selection_cells.rb

@@ -1,4 +1,5 @@
-require 'active_admin/component'
+# frozen_string_literal: true
+require "active_admin/component"
 
 module ActiveAdmin
   module BatchActions
@@ -7,7 +8,7 @@ module ActiveAdmin
     class ResourceSelectionToggleCell < ActiveAdmin::Component
       builder_method :resource_selection_toggle_cell
 
-      def build(label_text = '')
+      def build(label_text = "")
         label do
           input type: "checkbox", id: "collection_selection_toggle_all", name: "collection_selection_toggle_all", class: "toggle_all"
           text_node label_text if label_text.present?
@@ -30,7 +31,7 @@ module ActiveAdmin
 
       def build
         super(id: "collection_selection_toggle_panel")
-        resource_selection_toggle_cell(I18n.t('active_admin.batch_actions.selection_toggle_explanation', default: "(Toggle Selection)"))
+        resource_selection_toggle_cell(I18n.t("active_admin.batch_actions.selection_toggle_explanation", default: "(Toggle Selection)"))
       end
     end
 

data/lib/active_admin/batch_actions.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 ActiveAdmin.before_load do |app|
   require "active_admin/batch_actions/resource_extension"
   require "active_admin/batch_actions/controller"

data/lib/active_admin/callbacks.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module ActiveAdmin
   module Callbacks
     extend ActiveSupport::Concern

data/lib/active_admin/cancan_adapter.rb

@@ -1,8 +1,9 @@
+# frozen_string_literal: true
 unless ActiveAdmin::Dependency.cancan? || ActiveAdmin::Dependency.cancancan?
   ActiveAdmin::Dependency.cancan!
 end
 
-require 'cancan'
+require "cancan"
 
 # Add a setting to the application to configure the ability
 ActiveAdmin::Application.inheritable_setting :cancan_ability_class, "Ability"

data/lib/active_admin/collection_decorator.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+module ActiveAdmin
+  # This class decorates a collection of objects delegating
+  # mehods to behave like an Array. It's used to decouple ActiveAdmin
+  # from Draper and thus being able to use PORO decorators as well.
+  #
+  # It's implementation is heavily based on the Draper::CollectionDecorator
+  # https://github.com/drapergem/draper/blob/aaa06bd2f1e219838b241a5534e7ca513edd1fe2/lib/draper/collection_decorator.rb
+  class CollectionDecorator
+    # @return the collection being decorated.
+    attr_reader :object
+
+    # @return [Class] the decorator class used to decorate each item, as set by {#initialize}.
+    attr_reader :decorator_class
+
+    array_methods = Array.instance_methods - Object.instance_methods
+    delegate :==, :as_json, *array_methods, to: :decorated_collection
+
+    def initialize(object, with:)
+      @object = object
+      @decorator_class = with
+    end
+
+    class << self
+      alias_method :decorate, :new
+    end
+
+    def decorated_collection
+      @decorated_collection ||= object.map { |item| decorator_class.new(item) }
+    end
+  end
+end

data/lib/active_admin/component.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module ActiveAdmin
   class Component < Arbre::Component
 

data/lib/active_admin/controller_action.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module ActiveAdmin
   class ControllerAction
     attr_reader :name

data/lib/active_admin/csv_builder.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module ActiveAdmin
   # CSVBuilder stores CSV configuration
   #
@@ -42,25 +43,19 @@ module ActiveAdmin
     end
 
     def build(controller, csv)
-      @collection  = controller.send :find_collection, except: :pagination
-      columns      = exec_columns controller.view_context
-      bom          = options.delete :byte_order_mark
+      columns = exec_columns controller.view_context
+      bom = options[:byte_order_mark]
       column_names = options.delete(:column_names) { true }
-      csv_options  = options.except :encoding_options, :humanize_name
+      csv_options = options.except :encoding_options, :humanize_name, :byte_order_mark
 
       csv << bom if bom
 
       if column_names
-        csv << CSV.generate_line(columns.map { |c| encode c.name, options }, **csv_options)
+        csv << CSV.generate_line(columns.map { |c| sanitize(encode(c.name, options)) }, **csv_options)
       end
 
-      ActiveRecord::Base.uncached do
-        (1..paginated_collection.total_pages).each do |page|
-          paginated_collection(page).each do |resource|
-            resource = controller.send :apply_decorator, resource
-            csv << CSV.generate_line(build_row(resource, columns, options), **csv_options)
-          end
-        end
+      controller.send(:in_paginated_batches) do |resource|
+        csv << CSV.generate_line(build_row(resource, columns, options), **csv_options)
       end
 
       csv
@@ -75,7 +70,7 @@ module ActiveAdmin
 
     def build_row(resource, columns, options)
       columns.map do |column|
-        encode call_method_or_proc_on(resource, column.data), options
+        sanitize(encode(call_method_or_proc_on(resource, column.data), options))
       end
     end
 
@@ -91,6 +86,10 @@ module ActiveAdmin
       end
     end
 
+    def sanitize(content)
+      Sanitizer.sanitize(content)
+    end
+
     def method_missing(method, *args, &block)
       if @view_context.respond_to? method
         @view_context.public_send method, *args, &block
@@ -124,13 +123,22 @@ module ActiveAdmin
     def column_transitive_options
       @column_transitive_options ||= @options.slice(*COLUMN_TRANSITIVE_OPTIONS)
     end
+  end
+
+  # Prevents CSV Injection according to https://owasp.org/www-community/attacks/CSV_Injection
+  module Sanitizer
+    extend self
+
+    ATTACK_CHARACTERS = ["=", "+", "-", "@", "\t", "\r"].freeze
+
+    def sanitize(value)
+      return "'#{value}" if require_sanitization?(value)
 
-    def paginated_collection(page_no = 1)
-      @collection.public_send(Kaminari.config.page_method_name, page_no).per(batch_size)
+      value
     end
 
-    def batch_size
-      1000
+    def require_sanitization?(value)
+      value.is_a?(String) && value.starts_with?(*ATTACK_CHARACTERS)
     end
   end
 end

data/lib/active_admin/dependency.rb

@@ -1,27 +1,28 @@
+# frozen_string_literal: true
 module ActiveAdmin
   module Dependency
     module Requirements
-      DEVISE = '>= 4.0', '< 5'
+      DEVISE = ">= 4.0", "< 5"
     end
 
     # Provides a clean interface to check for gem dependencies at runtime.
     #
-    # ActiveAdmin::Dependency.draper
-    # => #<ActiveAdmin::Dependency::Matcher for draper 1.2.1>
+    # ActiveAdmin::Dependency.rails
+    # => #<ActiveAdmin::Dependency::Matcher for rails 6.0.3.2>
     #
-    # ActiveAdmin::Dependency.draper?
+    # ActiveAdmin::Dependency.rails?
     # => true
     #
-    # ActiveAdmin::Dependency.draper? '>= 1.5.0'
+    # ActiveAdmin::Dependency.rails? '>= 6.1'
     # => false
     #
-    # ActiveAdmin::Dependency.draper? '= 1.2.1'
+    # ActiveAdmin::Dependency.rails? '= 6.0.3.2'
     # => true
     #
-    # ActiveAdmin::Dependency.draper? '~> 1.2.0'
+    # ActiveAdmin::Dependency.rails? '~> 6.0.3'
     # => true
     #
-    # ActiveAdmin::Dependency.rails? '>= 4.2.7', '<= 5.0.2'
+    # ActiveAdmin::Dependency.rails? '>= 6.0.3', '<= 6.1.0'
     # => true
     #
     # ActiveAdmin::Dependency.rails! '5'
@@ -42,9 +43,9 @@ module ActiveAdmin
     # => false
     #
     def self.method_missing(name, *args)
-      if name[-1] == '?'
+      if name[-1] == "?"
         Matcher.new(name[0..-2]).match? args
-      elsif name[-1] == '!'
+      elsif name[-1] == "!"
         Matcher.new(name[0..-2]).match! args
       else
         Matcher.new name.to_s
@@ -55,10 +56,6 @@ module ActiveAdmin
       Matcher.new name.to_s
     end
 
-    def self.supports_zeitwerk?
-      rails >= "6.0.0.beta3" && RUBY_ENGINE != "jruby"
-    end
-
     class Matcher
       attr_reader :name
 
@@ -91,7 +88,7 @@ module ActiveAdmin
       end
 
       def inspect
-        info = spec ? "#{spec.name} #{spec.version}" : '(missing)'
+        info = spec ? "#{spec.name} #{spec.version}" : "(missing)"
         "<ActiveAdmin::Dependency::Matcher for #{info}>"
       end
     end