activeadmin 3.0.0 → 3.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 79c4d32ec46b6d4de5bceb98519d5c8402ccbec03a653a132f3f32b85aa5d741
-  data.tar.gz: edae8745a9f18c01cf2ba44de84fb915fd87c804ceb18879295dc9b52c5bd920
+  metadata.gz: 500a0615ecf1635299471dcbc309082815a82d24f03528b7c5926c4a5449fb64
+  data.tar.gz: 7ee23a9a3f4658eef536dec2032b40a9d60b054272a09b5e5a833ee51fae4430
 SHA512:
-  metadata.gz: 9a0d6743ea067aa183840b9c85c8ab3273752e190ee4c2f2406ac3e0e0db9f0646d628d42c90e07494bff83c2118e2c6ae8df9c466d0b34f98e3e11dfe445013
-  data.tar.gz: 3d6aa1a685ef21a44da6fd90195e1692ea82c8c53b584e31671babc16f735fcfa7faa9789682f3983fe562d4be442b66d289d21bda4cb10b472c4ac6157f5a8f
+  metadata.gz: 62b6e4f0a45f0d1d102dd3753de0fdddd4b661e6f53af9caebf37fcdda1924e769ed932027f517147f0db2e0c9724bcff49ca5640130a524ae48701c3ae1551b
+  data.tar.gz: eb0a26b263ed3cb17e8157581ac30a182467649b622807a4af9fccc2618ddb6b392307e4ec16abca591ed6f3b039c451868c7d9a6869ea89de68893672962455

data/CHANGELOG.md

@@ -2,6 +2,31 @@
 
 ## Unreleased
 
+## 3.2.0 [☰](https://github.com/activeadmin/activeadmin/compare/v3.1.0..v3.2.0)
+
+### Security Fixes
+
+* Backport protect against CSV Injection. [#8167] by [@mgrunberg]
+
+### Enhancements
+
+* Backport support citext column type in string filter. [#8165] by [@mgrunberg]
+* Backport provide detail in DB statement timeout error for filters. [#8163] by [@mgrunberg]
+
+### Bug Fixes
+
+* Backport make sure menu creation does not modify menu options. [#8166] by [@mgrunberg]
+* Backport ransack error with filters when ActiveStorage is used. [#8164] by [@mgrunberg]
+
+## 3.1.0 [☰](https://github.com/activeadmin/activeadmin/compare/v3.0.0..v3.1.0)
+
+### Enhancements
+
+* Support Rails 7.1. [#8102] by [@mgrunberg]
+* Remove deprecated usage of ActiveSupport::Deprecation singleton. [#8106] by [@mgrunberg]
+* Replace to_formatted_s with to_s to convert date to string. [#8105] by [@mgrunberg]
+* Remove upper bound dependency limits from gemspec. [#8098] by [@javierjulio]
+
 ## 3.0.0 [☰](https://github.com/activeadmin/activeadmin/compare/v2.14.0..v3.0.0)
 
 ### Breaking Changes
@@ -864,6 +889,15 @@ Please check [0-6-stable] for previous changes.
 [#7993]: https://github.com/activeadmin/activeadmin/pull/7993
 [#8009]: https://github.com/activeadmin/activeadmin/pull/8009
 [#8010]: https://github.com/activeadmin/activeadmin/pull/8010
+[#8098]: https://github.com/activeadmin/activeadmin/pull/8098
+[#8102]: https://github.com/activeadmin/activeadmin/pull/8102
+[#8105]: https://github.com/activeadmin/activeadmin/pull/8105
+[#8106]: https://github.com/activeadmin/activeadmin/pull/8106
+[#8163]: https://github.com/activeadmin/activeadmin/pull/8163
+[#8164]: https://github.com/activeadmin/activeadmin/pull/8164
+[#8165]: https://github.com/activeadmin/activeadmin/pull/8165
+[#8166]: https://github.com/activeadmin/activeadmin/pull/8166
+[#8167]: https://github.com/activeadmin/activeadmin/pull/8167
 
 [@1000ship]: https://github.com/1000ship
 [@5t111111]: https://github.com/5t111111

data/CONTRIBUTING.md

@@ -107,13 +107,6 @@ with the db:
 bin/rake local db:migrate
 ```
 
-### Get the style right
-
-Your patch should follow the same conventions & pass the same code quality
-checks as the rest of the project. `bin/rake lint` will give you feedback in
-this regard. You can check & fix style issues by running each linter
-individually. Run `bin/rake -T lint` to see the available linters.
-
 ### Make a Pull Request
 
 At this point, you should switch back to your master branch and make sure it's

data/lib/active_admin/csv_builder.rb

@@ -51,7 +51,7 @@ module ActiveAdmin
       csv << bom if bom
 
       if column_names
-        csv << CSV.generate_line(columns.map { |c| encode c.name, options }, **csv_options)
+        csv << CSV.generate_line(columns.map { |c| sanitize(encode(c.name, options)) }, **csv_options)
       end
 
       controller.send(:in_paginated_batches) do |resource|
@@ -70,7 +70,7 @@ module ActiveAdmin
 
     def build_row(resource, columns, options)
       columns.map do |column|
-        encode call_method_or_proc_on(resource, column.data), options
+        sanitize(encode(call_method_or_proc_on(resource, column.data), options))
       end
     end
 
@@ -86,6 +86,10 @@ module ActiveAdmin
       end
     end
 
+    def sanitize(content)
+      Sanitizer.sanitize(content)
+    end
+
     def method_missing(method, *args, &block)
       if @view_context.respond_to? method
         @view_context.public_send method, *args, &block
@@ -120,4 +124,21 @@ module ActiveAdmin
       @column_transitive_options ||= @options.slice(*COLUMN_TRANSITIVE_OPTIONS)
     end
   end
+
+  # Prevents CSV Injection according to https://owasp.org/www-community/attacks/CSV_Injection
+  module Sanitizer
+    extend self
+
+    ATTACK_CHARACTERS = ["=", "+", "-", "@", "\t", "\r"].freeze
+
+    def sanitize(value)
+      return "'#{value}" if require_sanitization?(value)
+
+      value
+    end
+
+    def require_sanitization?(value)
+      value.is_a?(String) && value.starts_with?(*ATTACK_CHARACTERS)
+    end
+  end
 end

data/lib/active_admin/engine.rb

@@ -21,5 +21,9 @@ module ActiveAdmin
     initializer "active_admin.routes" do
       require "active_admin/helpers/routes/url_helpers"
     end
+
+    initializer "active_admin.deprecator" do |app|
+      app.deprecators[:activeadmin] = ActiveAdmin.deprecator if app.respond_to?(:deprecators)
+    end
   end
 end

data/lib/active_admin/filters/forms.rb

@@ -31,7 +31,7 @@ module ActiveAdmin
           case column.type
           when :date, :datetime
             :date_range
-          when :string, :text
+          when :string, :text, :citext
             :string
           when :integer, :float, :decimal
             :numeric

data/lib/active_admin/filters/formtastic_addons.rb

@@ -47,7 +47,7 @@ module ActiveAdmin
       #
 
       def searchable_has_many_through?
-        if reflection && reflection.options[:through]
+        if klass.ransackable_associations.include?(method.to_s) && reflection && reflection.options[:through]
           reflection.through_reflection.klass.ransackable_attributes.include? reflection.foreign_key
         else
           false

data/lib/active_admin/inputs/filters/select_input.rb

@@ -43,6 +43,8 @@ module ActiveAdmin
           else
             super
           end
+        rescue ActiveRecord::QueryCanceled => error
+          raise ActiveRecord::QueryCanceled.new "#{error.message.strip} while querying the values for the ActiveAdmin :#{method} filter"
         end
 
         def pluck_column

data/lib/active_admin/menu.rb

@@ -48,6 +48,7 @@ module ActiveAdmin
       #   menu.add parent: 'Dashboard', label: 'My Child Dashboard'
       #
       def add(options)
+        options = options.dup # Make sure parameter is not modified
         parent_chain = Array.wrap(options.delete(:parent))
 
         item = if parent = parent_chain.shift

data/lib/active_admin/namespace.rb

@@ -28,7 +28,7 @@ module ActiveAdmin
   class Namespace
     class << self
       def setting(name, default)
-        Deprecation.warn "This method does not do anything and will be removed."
+        ActiveAdmin.deprecator.warn "This method does not do anything and will be removed."
       end
     end
 

data/lib/active_admin/pundit_adapter.rb

@@ -77,7 +77,7 @@ module ActiveAdmin
 
       policy_name = policy.class.to_s
 
-      Deprecation.warn "You have `pundit_policy_namespace` configured as `#{default_policy_namespace}`, " \
+      ActiveAdmin.deprecator.warn "You have `pundit_policy_namespace` configured as `#{default_policy_namespace}`, " \
         "but ActiveAdmin was unable to find policy #{default_policy_module}::#{policy_name}. " \
         "#{policy_name} will be used instead. " \
         "This behavior will be removed in future versions of ActiveAdmin. " \

data/lib/active_admin/resource_controller/streaming.rb

@@ -31,7 +31,7 @@ module ActiveAdmin
       end
 
       def csv_filename
-        "#{resource_collection_name.to_s.gsub('_', '-')}-#{Time.zone.now.to_date.to_formatted_s(:default)}.csv"
+        "#{resource_collection_name.to_s.gsub('_', '-')}-#{Time.zone.now.to_date.to_s}.csv"
       end
 
       def stream_csv

data/lib/active_admin/version.rb

@@ -1,4 +1,4 @@
 # frozen_string_literal: true
 module ActiveAdmin
-  VERSION = "3.0.0"
+  VERSION = "3.2.0"
 end

data/lib/active_admin.rb

@@ -26,7 +26,6 @@ module ActiveAdmin
   autoload :ControllerAction, "active_admin/controller_action"
   autoload :CSVBuilder, "active_admin/csv_builder"
   autoload :Dependency, "active_admin/dependency"
-  autoload :Deprecation, "active_admin/deprecation"
   autoload :Devise, "active_admin/devise"
   autoload :DSL, "active_admin/dsl"
   autoload :FormBuilder, "active_admin/form_builder"
@@ -61,6 +60,10 @@ module ActiveAdmin
       @application ||= ::ActiveAdmin::Application.new
     end
 
+    def deprecator
+      @deprecator ||= ActiveSupport::Deprecation.new("4.0", "active-admin")
+    end
+
     # Gets called within the initializer
     def setup
       application.setup!

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: activeadmin
 version: !ruby/object:Gem::Version
-  version: 3.0.0
+  version: 3.2.0
 platform: ruby
 authors:
 - Charles Maresh
@@ -15,7 +15,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-07-15 00:00:00.000000000 Z
+date: 2023-12-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: arbre
@@ -44,9 +44,6 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '3.1'
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: '5.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -54,21 +51,18 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '3.1'
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: '5.0'
 - !ruby/object:Gem::Dependency
   name: formtastic_i18n
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0.4'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0.4'
 - !ruby/object:Gem::Dependency
@@ -89,23 +83,20 @@ dependencies:
   name: jquery-rails
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '4.2'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '4.2'
 - !ruby/object:Gem::Dependency
   name: kaminari
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.0'
     - - ">="
       - !ruby/object:Gem::Version
         version: 1.2.1
@@ -113,9 +104,6 @@ dependencies:
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.0'
     - - ">="
       - !ruby/object:Gem::Version
         version: 1.2.1
@@ -126,9 +114,6 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '6.1'
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: '7.1'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -136,9 +121,6 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '6.1'
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: '7.1'
 - !ruby/object:Gem::Dependency
   name: ransack
   requirement: !ruby/object:Gem::Requirement
@@ -146,9 +128,6 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '4.0'
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: '5'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -156,9 +135,6 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '4.0'
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: '5'
 description: The administration framework for Ruby on Rails.
 email:
 - deivid.rodriguez@riseup.net
@@ -331,7 +307,6 @@ files:
 - lib/active_admin/controller_action.rb
 - lib/active_admin/csv_builder.rb
 - lib/active_admin/dependency.rb
-- lib/active_admin/deprecation.rb
 - lib/active_admin/devise.rb
 - lib/active_admin/dsl.rb
 - lib/active_admin/dynamic_setting.rb
@@ -522,7 +497,14 @@ homepage: https://activeadmin.info
 licenses:
 - MIT
 metadata:
+  bug_tracker_uri: https://github.com/activeadmin/activeadmin/issues
+  changelog_uri: https://github.com/activeadmin/activeadmin/blob/master/CHANGELOG.md
+  documentation_uri: https://activeadmin.info
+  homepage_uri: https://activeadmin.info
+  mailing_list_uri: https://groups.google.com/group/activeadmin
   rubygems_mfa_required: 'true'
+  source_code_uri: https://github.com/activeadmin/activeadmin
+  wiki_uri: https://github.com/activeadmin/activeadmin/wiki
 post_install_message:
 rdoc_options: []
 require_paths:
@@ -538,7 +520,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.13
+rubygems_version: 3.4.21
 signing_key:
 specification_version: 4
 summary: Active Admin is a Ruby on Rails plugin for generating administration style

data/lib/active_admin/deprecation.rb

@@ -1,11 +0,0 @@
-# frozen_string_literal: true
-module ActiveAdmin
-  module Deprecation
-    module_function
-
-    def warn(message, callstack = caller)
-      ActiveSupport::Deprecation.warn "Active Admin: #{message}", callstack
-    end
-
-  end
-end