alchemy_cms 2.9.1 → 3.0.0.rc5

data/app/controllers/alchemy/admin/pictures_controller.rb

@@ -1,89 +1,58 @@
 module Alchemy
   module Admin
     class PicturesController < Alchemy::Admin::BaseController
-      protect_from_forgery :except => [:create]
       helper 'alchemy/admin/tags'
 
-      cache_sweeper Alchemy::PicturesSweeper, :only => [:update, :destroy]
-
       respond_to :html, :js
 
+      before_action :load_picture,
+        only: [:show, :edit, :update, :info, :destroy]
+
+      authorize_resource class: Alchemy::Picture
+
       def index
         @size = params[:size].present? ? params[:size] : 'medium'
-        @pictures = Picture.scoped
+        @pictures = Picture.all
         @pictures = @pictures.tagged_with(params[:tagged_with]) if params[:tagged_with].present?
         @pictures = @pictures.filtered_by(params[:filter]) if params[:filter]
         @pictures = @pictures.find_paginated(params, pictures_per_page_for_size(@size))
         if in_overlay?
           archive_overlay
-        else
-          # render index.html.erb
         end
       end
 
       def new
         @picture = Picture.new
-        @while_assigning = params[:while_assigning] == 'true'
-        @size = params[:size] || 'medium'
+        set_size_or_default
         if in_overlay?
-          @while_assigning = true
-          @content = Content.find_by_id(params[:content_id], :select => 'id')
-          @element = Element.find(params[:element_id], :select => 'id')
-          @options = options_from_params
-          @page = params[:page]
-          @per_page = params[:per_page]
+          set_instance_variables
         end
-        render layout: !request.xhr?
       end
 
       def create
-        @picture = Picture.new(
-          :image_file => params[:Filedata],
-          :upload_hash => params[:upload_hash]
-        )
+        @picture = Picture.new(picture_params)
         @picture.name = @picture.humanized_name
-        @picture.save!
-        @size = params[:size] || 'medium'
-        if in_overlay?
-          @while_assigning = true
-          @content = Content.find(params[:content_id], :select => 'id') if !params[:content_id].blank?
-          @element = Element.find(params[:element_id], :select => 'id')
-          @options = options_from_params
-          @page = params[:page] || 1
-          @per_page = pictures_per_page_for_size(@size)
-        end
-        @pictures = Picture.find_paginated(params, pictures_per_page_for_size(@size))
-        @message = _t('Picture uploaded succesfully', :name => @picture.name)
-        # Are we using the single file uploader?
-        if params[Rails.application.config.session_options[:key]].blank?
-          flash[:notice] = @message
-          redirect_to admin_pictures_path(:filter => 'last_upload')
+        if @picture.save
+          set_size_or_default
+          if in_overlay?
+            set_instance_variables
+          end
+          message = _t('Picture uploaded succesfully', name: @picture.name)
+          render json: {files: [@picture.to_jq_upload], growl_message: message}, status: :created
         else
-          # Or the mutliple file uploader?
-          render # create.js.erb template
+          message = _t('Picture validation error', name: @picture.name)
+          render json: {files: [@picture.to_jq_upload], growl_message: message}, status: :unprocessable_entity
         end
       end
 
-      def show
-        @picture = Picture.find(params[:id])
-        render layout: !request.xhr?
-      end
-
-      def edit
-        @picture = Picture.find(params[:id])
-        render :layout => !request.xhr?
-      end
-
       def edit_multiple
-        @pictures = Picture.find(params[:picture_ids])
-        render :layout => !request.xhr?
+        @pictures = Picture.where(id: params[:picture_ids])
+        @tags = @pictures.collect(&:tag_list).flatten.uniq.join(', ')
       end
 
       def update
-        @picture = Picture.find(params[:id])
-
-        if @picture.update_attributes(params[:picture])
-          flash[:notice] = _t(:picture_updated_successfully, :name => @picture.name)
+        if @picture.update_attributes(picture_params)
+          flash[:notice] = _t(:picture_updated_successfully, name: @picture.name)
         else
           flash[:error] = _t(:picture_update_failed)
         end
@@ -93,10 +62,7 @@ module Alchemy
       def update_multiple
         @pictures = Picture.find(params[:picture_ids])
         @pictures.each do |picture|
-          # Do not delete name from multiple pictures, if the form field is blank!
-          picture.name = params[:pictures_name] if params[:pictures_name].present?
-          picture.tag_list = params[:pictures_tag_list]
-          picture.save
+          picture.update_name_and_tag_list!(params)
         end
         flash[:notice] = _t("Pictures updated successfully")
         redirect_to_index
@@ -130,30 +96,26 @@ module Alchemy
       end
 
       def destroy
-        @picture = Picture.find(params[:id])
         name = @picture.name
         @picture.destroy
         flash[:notice] = _t("Picture deleted successfully", :name => name)
       rescue Exception => e
         flash[:error] = e.message
       ensure
-        @redirect_url = admin_pictures_path(:per_page => params[:per_page], :page => params[:page], :query => params[:query])
-        render :redirect
+        do_redirect_to admin_pictures_path(:per_page => params[:per_page], :page => params[:page], :query => params[:query])
       end
 
       def flush
-        # FileUtils.rm_rf only takes arrays of folders...
-        FileUtils.rm_rf Dir.glob(Rails.root.join('public', Alchemy::MountPoint.get, 'pictures', '*'))
+        FileUtils.rm_rf Rails.root.join('public', Alchemy::MountPoint.get, 'pictures')
         @notice = _t('Picture cache flushed')
       end
 
-      def info
+      private
+
+      def load_picture
         @picture = Picture.find(params[:id])
-        render layout: !request.xhr?
       end
 
-    private
-
       def pictures_per_page_for_size(size)
         case size
         when 'small'
@@ -171,29 +133,41 @@ module Alchemy
       end
 
       def archive_overlay
-        @content = Content.find_by_id(params[:content_id], :select => 'id')
-        @element = Element.find_by_id(params[:element_id], :select => 'id')
+        @content = Content.select('id').find_by(id: params[:content_id])
+        @element = Element.select('id').find_by(id: params[:element_id])
         @options = options_from_params
         respond_to do |format|
-          format.html {
-            render :partial => 'archive_overlay'
-          }
-          format.js {
-            render :action => 'archive_overlay'
-          }
+          format.html { render partial: 'archive_overlay' }
+          format.js   { render action:  'archive_overlay' }
         end
       end
 
       def redirect_to_index
-        redirect_to(
-          :action => :index,
-          :query => params[:query],
-          :tagged_with => params[:tagged_with],
-          :size => params[:size],
-          :filter => params[:filter]
+        redirect_to admin_pictures_path(
+          query: params[:query],
+          tagged_with: params[:tagged_with],
+          size: params[:size],
+          filter: params[:filter]
         )
       end
 
+      def picture_params
+        params.require(:picture).permit(:image_file, :upload_hash, :name, :tag_list)
+      end
+
+      def set_size_or_default
+        @size = params[:size] || 'medium'
+      end
+
+      def set_instance_variables
+        @while_assigning = true
+        @content = Content.select('id').find_by(id: params[:content_id])
+        @element = Element.select('id').find_by(id: params[:element_id])
+        @options = options_from_params
+        @page = params[:page] || 1
+        @per_page = pictures_per_page_for_size(@size)
+      end
+
     end
   end
 end

data/app/controllers/alchemy/admin/resources_controller.rb

@@ -7,10 +7,16 @@ module Alchemy
   module Admin
     class ResourcesController < Alchemy::Admin::BaseController
       include Alchemy::ResourcesHelper
+
       helper Alchemy::ResourcesHelper
       helper_method :resource_handler
 
-      before_filter :load_resource, :only => [:show, :edit, :update, :destroy]
+      before_filter :load_resource,
+        only: [:show, :edit, :update, :destroy]
+
+      before_filter do
+        authorize!(action_name.to_sym, resource_instance_variable || resource_handler.model)
+      end
 
       handles_sortable_columns do |c|
         c.default_sort_value = :name
@@ -41,19 +47,16 @@ module Alchemy
 
       def new
         instance_variable_set("@#{resource_handler.resource_name}", resource_handler.model.new)
-        render :layout => !request.xhr?
       end
 
       def show
-        render action: 'edit', layout: !request.xhr?
+        render action: 'edit'
       end
 
-      def edit
-        render :layout => !request.xhr?
-      end
+      def edit; end
 
       def create
-        instance_variable_set("@#{resource_handler.resource_name}", resource_handler.model.new(params[resource_handler.namespaced_resource_name.to_sym]))
+        instance_variable_set("@#{resource_handler.resource_name}", resource_handler.model.new(resource_params))
         resource_instance_variable.save
         render_errors_or_redirect(
           resource_instance_variable,
@@ -63,7 +66,7 @@ module Alchemy
       end
 
       def update
-        resource_instance_variable.update_attributes(params[resource_handler.namespaced_resource_name.to_sym])
+        resource_instance_variable.update_attributes(resource_params)
         render_errors_or_redirect(
           resource_instance_variable,
           resources_path,
@@ -74,13 +77,14 @@ module Alchemy
       def destroy
         resource_instance_variable.destroy
         flash_notice_for_resource_action
+        do_redirect_to resource_url_proxy.url_for(action: 'index')
       end
 
       def resource_handler
         @_resource_handler ||= Alchemy::Resource.new(controller_path, alchemy_module)
       end
 
-    protected
+      protected
 
       # Returns a translated +flash[:notice]+.
       # The key should look like "Modelname successfully created|updated|destroyed."
@@ -164,6 +168,18 @@ module Alchemy
         end.join(" OR ")
       end
 
+      # Permits all parameters as default!
+      #
+      # THIS IS INSECURE! Although only signed in admin users can send requests anyway, but we should change this.
+      #
+      # Please define this method in your inheriting controller and set the parameters you want to permit.
+      #
+      # TODO: Hook this into authorization provider.
+      #
+      def resource_params
+        params.require(resource_handler.namespaced_resource_name).permit!
+      end
+
     end
   end
 end

data/app/controllers/alchemy/admin/tags_controller.rb

@@ -1,8 +1,7 @@
 module Alchemy
   module Admin
     class TagsController < ResourcesController
-
-      before_filter :load_tag, :only => [:edit, :update, :destroy]
+      before_filter :load_tag, only: [:edit, :update, :destroy]
 
       def index
         @tags = ActsAsTaggableOn::Tag.where(
@@ -12,27 +11,25 @@ module Alchemy
 
       def new
         @tag = ActsAsTaggableOn::Tag.new
-        render layout: !request.xhr?
       end
 
       def create
-        @tag = ActsAsTaggableOn::Tag.create(params[:tag])
+        @tag = ActsAsTaggableOn::Tag.create(tag_params)
         render_errors_or_redirect @tag, admin_tags_path, _t('New Tag Created')
       end
 
       def edit
-        @tags = ActsAsTaggableOn::Tag.order("name ASC").all - [@tag]
-        render layout: !request.xhr?
+        @tags = ActsAsTaggableOn::Tag.order("name ASC").to_a - [@tag]
       end
 
       def update
-        if params[:replace]
-          @new_tag = ActsAsTaggableOn::Tag.find(params[:tag][:merge_to])
+        if tag_params[:merge_to]
+          @new_tag = ActsAsTaggableOn::Tag.find(tag_params[:merge_to])
           Tag.replace(@tag, @new_tag)
           operation_text = _t('Replaced Tag %{old_tag} with %{new_tag}') % {:old_tag => @tag.name, :new_tag => @new_tag.name}
           @tag.destroy
         else
-          @tag.update_attributes(params[:tag])
+          @tag.update_attributes(tag_params)
           @tag.save
           operation_text = _t(:successfully_updated_tag)
         end
@@ -44,21 +41,36 @@ module Alchemy
           @tag.destroy
           flash[:notice] = _t(:successfully_deleted_tag)
         end
-        @redirect_url = admin_tags_path
-        render :action => :redirect
+        do_redirect_to admin_tags_path
       end
 
       def autocomplete
-        items = ActsAsTaggableOn::Tag.where(['LOWER(name) LIKE ?', "#{params[:term].downcase}%"])
-        render :json => json_for_autocomplete(items, :name)
+        items = tags_from_term(params[:term])
+        render json: json_for_autocomplete(items, :name).to_json
       end
 
-    private
+      private
 
       def load_tag
         @tag = ActsAsTaggableOn::Tag.find(params[:id])
       end
 
+      def tag_params
+        @tag_params ||= params.require(:tag).permit(:name, :merge_to)
+      end
+
+      def tags_from_term(term)
+        return [] if term.blank?
+        ActsAsTaggableOn::Tag.where(['LOWER(name) LIKE ?', "#{term.downcase}%"])
+      end
+
+      def json_for_autocomplete(items, attribute)
+        items.map do |item|
+          value = item.send(attribute)
+          {id: value, text: value}
+        end
+      end
+
     end
   end
 end

data/app/controllers/alchemy/admin/trash_controller.rb

@@ -4,13 +4,16 @@ module Alchemy
 
       helper "alchemy/admin/elements"
 
+      authorize_resource class: false
+
       def index
         @elements = Element.trashed
         @page = Page.find(params[:page_id])
         @allowed_elements = @page.available_element_definitions
         @draggable_trash_items = {}
-        @elements.each { |e| @draggable_trash_items["element_#{e.id}"] = e.belonging_cellnames(@page) }
-        render layout: !request.xhr?
+        @elements.each do |element|
+          @draggable_trash_items["element_#{element.id}"] = element.available_page_cell_names(@page)
+        end
       end
 
       def clear

data/app/controllers/alchemy/attachments_controller.rb

@@ -1,16 +1,16 @@
 module Alchemy
   class AttachmentsController < BaseController
-
-    filter_access_to [:show, :download], :attribute_check => true, :model => Alchemy::Attachment, :load_method => :load_attachment
+    before_action :load_attachment
+    authorize_resource class: Alchemy::Attachment
 
     # sends file inline. i.e. for viewing pdfs/movies in browser
     def show
       send_data(
         @attachment.file.data,
         {
-          :filename => @attachment.file_name,
-          :type => @attachment.file_mime_type,
-          :disposition => 'inline'
+          filename: @attachment.file_name,
+          type: @attachment.file_mime_type,
+          disposition: 'inline'
         }
       )
     end
@@ -19,13 +19,13 @@ module Alchemy
     def download
       send_data(
         @attachment.file.data, {
-          :filename => @attachment.file_name,
-          :type => @attachment.file_mime_type
+          filename: @attachment.file_name,
+          type: @attachment.file_mime_type
         }
       )
     end
 
-  private
+    private
 
     def load_attachment
       @attachment = Attachment.find(params[:id])

data/app/controllers/alchemy/base_controller.rb

@@ -1,19 +1,21 @@
 # This is the main Alchemy controller all other controllers inherit from.
+#
 module Alchemy
   class BaseController < ApplicationController
     include Alchemy::Modules
 
     protect_from_forgery
 
-    before_filter :set_current_site
-    before_filter :set_language
-    before_filter :mailer_set_url_options
-    before_filter :set_authorization_user
+    before_action :mailer_set_url_options
+    before_action :set_locale
 
-    helper_method :current_alchemy_user,
-      :current_site,
-      :multi_site?,
-      :current_server
+    helper_method :multi_site?
+
+    helper 'alchemy/admin/form'
+
+    rescue_from CanCan::AccessDenied do |exception|
+      permission_denied(exception)
+    end
 
     def leave
       render layout: !request.xhr?
@@ -21,12 +23,13 @@ module Alchemy
 
     private
 
-    # Returns a host string with the domain the app is running on.
-    def current_server
-     "#{request.protocol}#{request.host_with_port}"
+    # Sets +I18n.locale+ to current Alchemy language.
+    #
+    def set_locale
+      ::I18n.locale = Language.current.code
     end
 
-    # Returns the configuratin value of given key.
+    # Returns the configuration value of given key.
     #
     # Config file is in +config/alchemy/config.yml+
     #
@@ -51,65 +54,8 @@ module Alchemy
       I18n.t(key, *args)
     end
 
-    # The current authorized user.
-    #
-    # In order to have Alchemy's authorization work, you have to
-    # provide a +current_user+ method in your app's ApplicationController,
-    # that returns the current user.
-    #
-    # If you don't have an App that can provide a +current_user+ object,
-    # you can install the `alchemy-devise` gem that provides everything you need.
-    #
-    def current_alchemy_user
-      raise NoCurrentUserFoundError if !defined?(current_user)
-      current_user
-    end
-
-    # Returns true if a +current_alchemy_user+ is present
-    #
-    def alchemy_user_signed_in?
-      current_alchemy_user.present?
-    end
-
-    # Returns the current site.
-    #
-    def current_site
-      @current_site ||= Site.find_for_host(request.host)
-    end
-
-    # Sets the current site in a cvar so the Language model
-    # can be scoped against it.
-    #
-    def set_current_site
-      Site.current = current_site
-    end
-
-    # Stores the current_user for declarative_authorization
-    #
-    def set_authorization_user
-      Authorization.current_user = current_alchemy_user
-    end
-
-    # Sets Alchemy's GUI translation to users preffered language and stores it in the session.
-    #
-    # Guesses the language from browser locale. If not successful it takes the default.
-    #
-    # You can set the default translation in your +config/application.rb+ file, via Rails +default_locale+ config option.
-    #
-    # If one passes a locale parameter the locale is set to its value
-    #
-    def set_translation
-      if params[:locale].blank? && session[:current_locale].present?
-        ::I18n.locale = session[:current_locale]
-      elsif params[:locale].present? && ::I18n.available_locales.include?(params[:locale].to_sym)
-        session[:current_locale] = ::I18n.locale = params[:locale]
-      elsif current_alchemy_user && current_alchemy_user.respond_to?(:language) && current_alchemy_user.language.present?
-        ::I18n.locale = current_alchemy_user.language
-      else
-        ::I18n.locale = request.env['HTTP_ACCEPT_LANGUAGE'].try(:scan, /^[a-z]{2}/).try(:first) || ::I18n.default_locale
-      end
-    end
-
+    # Store current request path into session,
+    # so we can later redirect to it.
     def store_location
       session[:redirect_path] = request.path
     end
@@ -118,22 +64,6 @@ module Alchemy
       ActionMailer::Base.default_url_options[:host] = request.host_with_port
     end
 
-    # Returns the layout to be used by the current page. This method is being
-    # used in PageController#show's invocation of #render.
-    #
-    # It allows you to request a specific page layout by passing a 'layout' parameter
-    # in a request. If this parameter is set to 'none' or 'false', no layout whatsoever
-    # will be used to render the page; otherwise, a layout by the given name
-    # will be applied.
-    #
-    def layout_for_page
-      if params[:layout] == 'none' || params[:layout] == 'false'
-        false
-      else
-        params[:layout] || 'application'
-      end
-    end
-
     def render_404(exception = nil)
       if exception
         logger.info "Rendering 404: #{exception.message}"
@@ -168,7 +98,7 @@ module Alchemy
     def permission_denied(exception = nil)
       Rails.logger.debug <<-WARN
 
-/!\\ No permissions to request #{request.path} for:
+/!\\ Failed to permit #{exception.action} on #{exception.subject.inspect} for:
 #{current_alchemy_user.inspect}
 WARN
       if current_alchemy_user
@@ -180,7 +110,7 @@ WARN
 
     def handle_redirect_for_user
       flash[:warning] = _t('You are not authorized')
-      if permitted_to? :index, :alchemy_admin_dashboard
+      if can?(:index, :alchemy_admin_dashboard)
         redirect_or_render_notice
       else
         redirect_to('/')
@@ -216,5 +146,9 @@ WARN
       Rails.logger.error(e.backtrace[1..50].each { |l| l.gsub(/#{Rails.root.to_s}/, '') }.join("\n"))
     end
 
+    def raise_authorization_exception(exception)
+      raise("Not permitted to #{exception.action} #{exception.subject}")
+    end
+
   end
 end