alchemy_cms 2.9.1 → 3.0.0.rc5

data/app/controllers/alchemy/admin/attachments_controller.rb

@@ -3,59 +3,48 @@ module Alchemy
     class AttachmentsController < ResourcesController
       helper 'alchemy/admin/tags'
 
-      protect_from_forgery :except => [:create]
-
       def index
-        @attachments = Attachment.scoped
+        @attachments = Attachment.all
         @attachments = @attachments.tagged_with(params[:tagged_with]) if params[:tagged_with].present?
         @attachments = @attachments.find_paginated(params, 15, sort_order)
+        @options = options_from_params
         if in_overlay?
           archive_overlay
-        else
-          # render index.html.erb
         end
       end
 
+      # The resources controller renders the edit form as default for show actions.
+      def show
+        render :show
+      end
+
       def new
         @attachment = Attachment.new
         if in_overlay?
-          @while_assigning = true
-          @content = Content.find(params[:content_id], :select => 'id')
-          @swap = params[:swap]
-          @options = options_from_params
+          set_instance_variables
         end
-        render :layout => !request.xhr?
       end
 
       def create
-        @attachment = Attachment.create!(:file => params[:Filedata])
-        if in_overlay?
-          @while_assigning = true
-          @content = Content.find(params[:content_id], :select => 'id') if !params[:content_id].blank?
-          @swap = params[:swap]
-          @options = options_from_params
-        end
-        @attachments = Attachment.find_paginated(params, per_page_value_for_screen_size, sort_order)
-        @message = _t('File %{name} uploaded succesfully', :name => @attachment.name)
-        # Are we using the Flash uploader? Or the plain html file uploader?
-        if params[Rails.application.config.session_options[:key]].blank?
-          flash[:notice] = @message
-          redirect_to :action => :index
+        @attachment = Attachment.new(attachment_attributes)
+        if @attachment.save
+          if in_overlay?
+            set_instance_variables
+          end
+          message = _t('File uploaded succesfully', name: @attachment.name)
+          render json: {files: [@attachment.to_jq_upload], growl_message: message}, status: :created
+        else
+          message = _t('File upload error', error: @attachment.errors[:file].join)
+          render json: {files: [@attachment.to_jq_upload], growl_message: message}, status: :unprocessable_entity
         end
       end
 
-      def edit
-        @attachment = Attachment.find(params[:id])
-        render layout: !request.xhr?
-      end
-
       def update
         @attachment = Attachment.find(params[:id])
-        oldname = @attachment.name
-        @attachment.update_attributes(params[:attachment])
+        @attachment.update_attributes(attachment_attributes)
         render_errors_or_redirect(
           @attachment,
-          admin_attachments_path(:page => params[:page], :query => params[:query], :per_page => params[:per_page]),
+          admin_attachments_path(page: params[:page], query: params[:query], per_page: params[:per_page]),
           _t("File successfully updated")
         )
       end
@@ -72,40 +61,40 @@ module Alchemy
         flash[:notice] = _t("File: '%{name}' deleted successfully", name: name)
       end
 
-      def show
-        @attachment = Attachment.find(params[:id])
-        render layout: !request.xhr?
-      end
-
       def download
         @attachment = Attachment.find(params[:id])
-        send_data(
-          @attachment.file.data, {
-            :filename => @attachment.file_name,
-            :type => @attachment.file_mime_type
-          }
-        )
+        send_data @attachment.file.data, {
+          filename: @attachment.file_name,
+          type: @attachment.file_mime_type
+        }
       end
 
-    private
+      private
 
       def in_overlay?
         params[:content_id].present?
       end
 
       def archive_overlay
-        @content = Content.find(params[:content_id], select: 'id')
+        @content = Content.select('id').find_by(id: params[:content_id])
         @options = options_from_params
         respond_to do |format|
-          format.html {
-            render partial: 'archive_overlay'
-          }
-          format.js {
-            render action: 'archive_overlay'
-          }
+          format.html { render partial: 'archive_overlay' }
+          format.js   { render action:  'archive_overlay' }
         end
       end
 
+      def attachment_attributes
+        params.require(:attachment).permit(:file, :name, :file_name, :tag_list)
+      end
+
+      def set_instance_variables
+        @while_assigning = true
+        @content = Content.select('id').find_by(id: params[:content_id])
+        @swap = params[:swap]
+        @options = options_from_params
+      end
+
     end
   end
 end

data/app/controllers/alchemy/admin/base_controller.rb

@@ -2,20 +2,33 @@ module Alchemy
   module Admin
     class BaseController < Alchemy::BaseController
       include Userstamp
+      include Alchemy::Locale
 
       before_filter { enforce_ssl if ssl_required? && !request.ssl? }
-      before_filter :set_translation
 
       helper_method :clipboard_empty?, :trash_empty?, :get_clipboard, :is_admin?
 
-      filter_access_to :all
+      check_authorization
 
-      rescue_from Exception, :with => :exception_handler unless Rails.env == 'test'
+      rescue_from Exception do |exception|
+        if exception.is_a? CanCan::AccessDenied
+          permission_denied(exception)
+        elsif Rails.env.test?
+          raise
+        else
+          exception_handler(exception)
+        end
+      end
 
-      layout 'alchemy/admin'
+      layout :set_layout
 
       private
 
+      # Disable layout rendering for xhr requests.
+      def set_layout
+        request.xhr? ? false : 'alchemy/admin'
+      end
+
       # Handles exceptions
       def exception_handler(e)
         exception_logger(e)
@@ -32,7 +45,7 @@ module Alchemy
         @notice = e.message[0..255]
         @trace = e.backtrace[0..50]
         if request.xhr?
-          render :action => "error_notice", :layout => false
+          render :action => "error_notice"
         else
           render '500', :status => 500
         end
@@ -94,44 +107,31 @@ module Alchemy
       #
       def render_errors_or_redirect(object, redirect_url, flash_notice)
         if object.errors.empty?
-          @redirect_url = redirect_url
           flash[:notice] = _t(flash_notice)
-          respond_to do |format|
-            format.js   { render :action => :redirect }
-            format.html { redirect_to @redirect_url }
-          end
+          do_redirect_to redirect_url
         else
-          respond_to do |format|
-            format.js   { render_remote_errors(object) }
-            format.html { render :action => (params[:action] == "update" ? :edit : :new) }
-          end
+          render action: (params[:action] == 'update' ? 'edit' : 'new')
         end
       end
 
-      # Renders an unordered list of objects errors in an errors div via javascript.
-      #
-      # Note: You have to have a hidden div with the id +#errors+ in your form, to make this work.
-      #
-      # You can pass a div id as second argument to display the errors in alternative div.
-      #
-      # Hint: If you use an alternative div, please use the +errors+ css class to get the correct styling.
-      #
-      # @param object [ActiveRecord::Base]
-      # @param error_div_id [String]
-      #
-      def render_remote_errors(object, error_div_id = nil)
-        @error_div_id = error_div_id || '#errors'
-        @error_fields = object.errors.messages.keys.map { |f| "#{object.class.model_name.demodulize.underscore}_#{f}" }
-        @errors = ("<ul>" + object.errors.full_messages.map { |e| "<li>#{e}</li>" }.join + "</ul>").html_safe
-        render :action => :remote_errors
-      end
-
       def per_page_value_for_screen_size
         return 25 if session[:screen_size].blank?
         screen_height = session[:screen_size].split('x').last.to_i
         (screen_height / 30) - 10
       end
 
+      # Does redirects for html and js requests
+      #
+      def do_redirect_to(url_or_path)
+        respond_to do |format|
+          format.js   {
+            @redirect_url = url_or_path
+            render :redirect
+          }
+          format.html { redirect_to url_or_path }
+        end
+      end
+
       # Extracts options from params.
       #
       # Helps to parse JSONified options into Hash or Array

data/app/controllers/alchemy/admin/clipboard_controller.rb

@@ -1,13 +1,13 @@
 module Alchemy
   module Admin
-
     class ClipboardController < Alchemy::Admin::BaseController
+      authorize_resource class: Alchemy::Clipboard
 
       def index
         @clipboard = get_clipboard
         @clipboard_items = model_class.all_from_clipboard(@clipboard.all(params[:remarkable_type]))
         respond_to do |format|
-          format.html { render layout: !request.xhr? }
+          format.html
         end
       end
 

data/app/controllers/alchemy/admin/contents_controller.rb

@@ -1,19 +1,20 @@
 module Alchemy
   module Admin
     class ContentsController < Alchemy::Admin::BaseController
+      helper 'alchemy/admin/essences'
 
-      helper "alchemy/admin/essences"
+      authorize_resource class: Alchemy::Content
 
       def new
         @element = Element.find(params[:element_id])
+        @options = options_from_params
         @contents = @element.available_contents
         @content = @element.contents.build
-        render layout: !request.xhr?
       end
 
       def create
         @element = Element.find(params[:content][:element_id])
-        @content = Content.create_from_scratch(@element, params[:content])
+        @content = Content.create_from_scratch(@element, content_params)
         @options = options_from_params
         @html_options = params[:html_options] || {}
         if picture_gallery_editor?
@@ -27,8 +28,8 @@ module Alchemy
       end
 
       def update
-        content = Content.find(params[:id])
-        content.essence.update_attributes(params[:content])
+        @content = Content.find(params[:id])
+        @content.update_essence(content_params)
       end
 
       def order
@@ -41,13 +42,17 @@ module Alchemy
 
       def destroy
         @content = Content.find(params[:id])
-        @content_dup = @content.clone
-        @notice = _t("Successfully deleted content", :content => @content.name_for_label)
+        @content_dom_id = @content.dom_id
+        @notice = _t("Successfully deleted content", content: @content.name_for_label)
         @content.destroy
       end
 
       private
 
+      def content_params
+        params.require(:content).permit(:element_id, :name, :ingredient, :essence_type)
+      end
+
       def picture_gallery_editor?
         params[:content][:essence_type] == 'Alchemy::EssencePicture' && @options[:grouped] == 'true'
       end

data/app/controllers/alchemy/admin/dashboard_controller.rb

@@ -4,6 +4,7 @@ require 'alchemy/version'
 module Alchemy
   module Admin
     class DashboardController < Alchemy::Admin::BaseController
+      authorize_resource class: :alchemy_admin_dashboard
 
       def index
         @last_edited_pages = Page.from_current_site.all_last_edited_from(current_alchemy_user)
@@ -20,7 +21,6 @@ module Alchemy
 
       def info
         @alchemy_version = Alchemy.version
-        render layout: !request.xhr?
       end
 
       def update_check

data/app/controllers/alchemy/admin/elements_controller.rb

@@ -1,37 +1,32 @@
 module Alchemy
   module Admin
     class ElementsController < Alchemy::Admin::BaseController
-
-      cache_sweeper Alchemy::ContentSweeper, :only => [:create, :update, :destroy]
+      before_action :load_element, only: [:update, :trash, :fold]
+      authorize_resource class: Alchemy::Element
 
       def index
-        @page = Page.find(params[:page_id], :include => {:elements => :contents})
+        @page = Page.find(params[:page_id])
         @cells = @page.cells
         if @cells.blank?
           @elements = @page.elements.not_trashed
         else
           @elements = @page.elements_grouped_by_cells
         end
-        render layout: !request.xhr?
       end
 
       def list
         @page_id = params[:page_id]
         if @page_id.blank? && !params[:page_urlname].blank?
-          @page_id = Page.find_by_urlname_and_language_id(params[:page_urlname], session[:language_id]).id
+          @page_id = Language.current.pages.find_by(urlname: params[:page_urlname]).id
         end
-        @elements = Element.published.find_all_by_page_id(@page_id)
+        @elements = Element.published.where(page_id: @page_id)
       end
 
       def new
         @page = Page.find_by_id(params[:page_id])
         @element = @page.elements.build
         @elements = @page.available_element_definitions
-        clipboard_elements = get_clipboard[:elements]
-        unless clipboard_elements.blank?
-          @clipboard_items = Element.all_from_clipboard_for_page(clipboard_elements, @page)
-        end
-        render layout: !request.xhr?
+        @clipboard_items = Element.all_from_clipboard_for_page(get_clipboard[:elements], @page)
       end
 
       # Creates a element as discribed in config/alchemy/elements.yml on page via AJAX.
@@ -49,25 +44,30 @@ module Alchemy
             end
             @element.save
           end
-          if @insert_at_top = @page.definition['insert_elements_at'] == 'top'
+          if @page.definition['insert_elements_at'] == 'top'
+            @insert_at_top = true
             @element.move_to_top
           end
         end
         @cell_name = @cell.nil? ? "for_other_elements" : @cell.name
         if @element.valid?
-          render :action => :create
+          render :create
         else
-          render_remote_errors(@element, params[:paste_from_clipboard].nil? ? nil : '#paste_element_errors')
+          @element.page = @page
+          @elements = @page.available_element_definitions
+          @clipboard_items = Element.all_from_clipboard_for_page(get_clipboard[:elements], @page)
+          render :new
         end
       end
 
-      # Saves all contents in the elements by calling save_contents.
-      # And then updates the element itself.
+      # Updates the element.
+      #
+      # And update all contents in the elements by calling update_contents.
+      #
       def update
-        @element = Element.find_by_id(params[:id])
-        if @element.save_contents(params[:contents])
+        if @element.update_contents(contents_params)
           @page = @element.page
-          @element_validated = @element.update_attributes!(params[:element])
+          @element_validated = @element.update_attributes!(element_params)
         else
           @element_validated = false
           @notice = _t('Validation failed')
@@ -77,28 +77,25 @@ module Alchemy
 
       # Trashes the Element instead of deleting it.
       def trash
-        @element = Element.find(params[:id])
         @page = @element.page
         @element.trash!
       end
 
       def order
-        @trashed_elements = Element.trashed.where(id: params[:element_ids]).pluck(:id)
-        Element.transaction do
-          params[:element_ids].each_with_index do |element_id, idx|
-            # Ensure to set page_id and cell_id to the current page and
-            # cell because of trashed elements could still have old values
-            Element.where(id: element_id).update_all(
-              page_id: params[:page_id],
-              cell_id: params[:cell_id],
-              position: idx + 1
-            )
+        @trashed_elements = []
+        params[:element_ids].each do |element_id|
+          element = Element.find(element_id)
+          if element.trashed?
+            element.page_id = params[:page_id]
+            element.cell_id = params[:cell_id]
+            element.insert_at
+            @trashed_elements << element
           end
+          element.move_to_bottom
         end
       end
 
       def fold
-        @element = Element.find(params[:id])
         @page = @element.page
         @element.folded = !@element.folded
         @element.save
@@ -106,6 +103,10 @@ module Alchemy
 
       private
 
+      def load_element
+        @element = Element.find(params[:id])
+      end
+
       # Returns the cell for element name in params.
       # Creates the cell if necessary.
       def find_or_create_cell
@@ -121,7 +122,7 @@ module Alchemy
         if cell_definition.blank?
           raise CellDefinitionError, "Cell definition not found for #{cell_name}"
         end
-        @page.cells.find_or_create_by_name(cell_definition['name'])
+        @page.cells.find_or_create_by(name: cell_definition['name'])
       end
 
       def element_from_clipboard
@@ -146,6 +147,14 @@ module Alchemy
         @source_element.destroy
       end
 
+      def contents_params
+        params.fetch(:contents, {}).permit!
+      end
+
+      def element_params
+        params.require(:element).permit(:public, :tag_list)
+      end
+
     end
   end
 end