alchemy_cms 5.1.0 → 5.2.0

data/app/helpers/alchemy/pages_helper.rb

@@ -100,7 +100,9 @@ module Alchemy
 
     # Returns true if page is in the active branch
     def page_active?(page)
-      @_page_ancestors ||= Page.ancestors_for(@page)
+      Alchemy::Deprecation.warn("page_active? helper is deprecated and will be removed from Alchemy 6.0")
+
+      @_page_ancestors ||= @page.self_and_ancestors.contentpages
       @_page_ancestors.include?(page)
     end
 

data/app/models/alchemy/attachment.rb

@@ -125,6 +125,10 @@ module Alchemy
         "file-alt"
       when *EXCEL_FILE_TYPES
         "file-excel"
+      when *POWERPOINT_FILE_TYPES
+        "file-powerpoint"
+      when *WORD_FILE_TYPES
+        "file-word"
       when *VCARD_FILE_TYPES
         "address-card"
       when *ARCHIVE_FILE_TYPES

data/app/models/alchemy/content.rb

@@ -46,9 +46,12 @@ module Alchemy
 
     delegate :restricted?, to: :page, allow_nil: true
     delegate :trashed?, to: :element, allow_nil: true
+    deprecate :trashed?, deprecator: Alchemy::Deprecation
     delegate :public?, to: :element, allow_nil: true
 
     class << self
+      deprecate :not_trashed, deprecator: Alchemy::Deprecation
+
       # Returns the translated label for a content name.
       #
       # Translate it in your locale yml file:
@@ -189,6 +192,10 @@ module Alchemy
       essence && !essence.link.blank?
     end
 
+    def deprecated?
+      !!definition["deprecated"]
+    end
+
     # Returns true if this content should be taken for element preview.
     def preview_content?
       !!definition["as_element_title"]

data/app/models/alchemy/element.rb

@@ -37,6 +37,7 @@ module Alchemy
       "taggable",
       "compact",
       "message",
+      "deprecated",
     ].freeze
 
     SKIPPED_ATTRIBUTES_ON_COPY = [
@@ -124,6 +125,9 @@ module Alchemy
 
     # class methods
     class << self
+      deprecate :trashed, deprecator: Alchemy::Deprecation
+      deprecate :not_trashed, deprecator: Alchemy::Deprecation
+
       # Builds a new element as described in +/config/alchemy/elements.yml+
       #
       # - Returns a new Alchemy::Element object if no name is given in attributes,
@@ -227,10 +231,12 @@ module Alchemy
       self.folded = true
       remove_from_list
     end
+    deprecate :trash!, deprecator: Alchemy::Deprecation
 
     def trashed?
       position.nil?
     end
+    deprecate :trashed?, deprecator: Alchemy::Deprecation
 
     # Returns true if the definition of this element has a taggable true value.
     def taggable?
@@ -247,6 +253,38 @@ module Alchemy
       definition["compact"] == true
     end
 
+    # Defined as deprecated element?
+    #
+    # You can either set true or a String on your elements definition.
+    #
+    # == Passing true
+    #
+    #     - name: old_element
+    #       deprecated: true
+    #
+    # The deprecation notice can be translated. Either as global notice for all deprecated elements.
+    #
+    #     en:
+    #       alchemy:
+    #         element_deprecation_notice: Foo baz widget is deprecated
+    #
+    # Or add a translation to your locale file for a per element notice.
+    #
+    #     en:
+    #       alchemy:
+    #         element_deprecation_notices:
+    #           old_element: Foo baz widget is deprecated
+    #
+    # == Pass a String
+    #
+    #     - name: old_element
+    #       deprecated: This element will be removed soon.
+    #
+    # @return Boolean
+    def deprecated?
+      !!definition["deprecated"]
+    end
+
     # The element's view partial is dependent from its name
     #
     # == Define elements

data/app/models/alchemy/element/definitions.rb

@@ -13,41 +13,24 @@ module Alchemy
       # your own set of elements
       #
       def definitions
-        @definitions ||= read_definitions_file.map(&:with_indifferent_access)
+        ElementDefinition.all
       end
 
       # Returns one element definition by given name.
       #
       def definition_by_name(name)
-        definitions.detect { |d| d["name"] == name }
-      end
-
-      private
-
-      # Reads the element definitions file named +elements.yml+ from +config/alchemy/+ folder.
-      #
-      def read_definitions_file
-        if ::File.exist?(definitions_file_path)
-          ::YAML.safe_load(ERB.new(File.read(definitions_file_path)).result, YAML_WHITELIST_CLASSES, [], true) || []
-        else
-          raise LoadError, "Could not find elements.yml file! Please run `rails generate alchemy:install`"
-        end
-      end
-
-      # Returns the +elements.yml+ file path
-      #
-      def definitions_file_path
-        Rails.root.join "config/alchemy/elements.yml"
+        ElementDefinition.get(name)
       end
     end
 
     # The definition of this element.
     #
     def definition
-      if definition = self.class.definitions.detect { |d| d["name"] == name }
+      if definition = self.class.definition_by_name(name)
         definition
       else
-        log_warning "Could not find element definition for #{name}. Please check your elements.yml file!"
+        log_warning "Could not find element definition for #{name}. " \
+                    "Please check your elements.yml file!"
         {}
       end
     end

data/app/models/alchemy/page/page_elements.rb

@@ -38,11 +38,17 @@ module Alchemy
       after_update :trash_not_allowed_elements!,
         if: :saved_change_to_page_layout?
 
-      after_update :generate_elements,
-        if: :saved_change_to_page_layout?
+      after_update(if: :saved_change_to_page_layout?) do
+        Alchemy::Deprecation.warn(
+          "Autogenerating elements on page_layout change is deprecated and will be removed from Alchemy 6.0"
+        )
+        generate_elements
+      end
     end
 
     module ClassMethods
+      deprecate :trashed_elements, deprecator: Alchemy::Deprecation
+
       # Copy page elements
       #
       # @param source [Alchemy::Page]
@@ -210,6 +216,7 @@ module Alchemy
       ])
       not_allowed_elements.to_a.map(&:trash!)
     end
+    deprecate :trash_not_allowed_elements!, deprecator: Alchemy::Deprecation
 
     # Deletes unique and already present definitions from @_element_definitions.
     #

data/app/models/alchemy/picture_variant.rb

@@ -93,7 +93,7 @@ module Alchemy
 
       convert_format = render_format.sub("jpeg", "jpg") != picture.image_file_format.sub("jpeg", "jpg")
 
-      if render_format =~ /jpe?g/ && convert_format
+      if render_format =~ /jpe?g/ && (convert_format || options[:quality])
         quality = options[:quality] || Config.get(:output_image_jpg_quality)
         encoding_options << "-quality #{quality}"
       end

data/app/views/alchemy/admin/elements/_element.html.erb

@@ -25,7 +25,7 @@
         <div id="element_<%= element.id %>_errors" class="element_errors"></div>
 
         <div id="element_<%= element.id %>_content" class="element-content-editors">
-          <%= render element.contents.map { |content| Alchemy::ContentEditor.new(content) } %>
+          <%= render element.contents %>
         </div>
 
         <% if element.taggable? %>

data/app/views/alchemy/admin/elements/_element_footer.html.erb

@@ -5,7 +5,7 @@
     </p>
   <% end %>
 
-  <button type="submit" <%= "disabled" unless element.public? %> form="element_<%= element.id %>_form" class="button" data-alchemy-button>
+  <button type="submit" form="element_<%= element.id %>_form" class="button" data-alchemy-button>
     <%= Alchemy.t(:save) %>
   </button>
 </div>

data/app/views/alchemy/admin/elements/_element_header.html.erb

@@ -2,6 +2,8 @@
   <span class="element-handle">
     <% if element.definition.blank? %>
       <%= hint_with_tooltip Alchemy.t(:element_definition_missing) %>
+    <% elsif element.deprecated? %>
+      <%= hint_with_tooltip element.deprecation_notice %>
     <% else %>
       <% if element.public? %>
         <%= render_icon('window-maximize', style: 'regular', class: 'element') %>

data/app/views/alchemy/admin/elements/_element_toolbar.html.erb

@@ -1,4 +1,4 @@
-<% remarkable_type = element.class.name.demodulize.underscore.pluralize %>
+<% remarkable_type = "elements" %>
 <div class="element-toolbar">
   <span class="element_tools">
     <div class="button_with_label">

data/config/brakeman.ignore

@@ -1,14 +1,65 @@
 {
   "ignored_warnings": [
+    {
+      "warning_type": "Cross-Site Scripting",
+      "warning_code": 2,
+      "fingerprint": "0551e3f9180b85fca4b17fe3c7cbbac1611d2ef8d385f77e9445c562c471d688",
+      "check_name": "CrossSiteScripting",
+      "message": "Unescaped parameter value",
+      "file": "app/views/alchemy/admin/elements/update.js.erb",
+      "line": 18,
+      "link": "https://brakemanscanner.org/docs/warning_types/cross_site_scripting",
+      "code": "j(Element.find(params[:id]).essence_error_messages.join(\"</li><li>\"))",
+      "render_path": [
+        {
+          "type": "controller",
+          "class": "Alchemy::Admin::ElementsController",
+          "method": "update",
+          "line": 55,
+          "file": "app/controllers/alchemy/admin/elements_controller.rb",
+          "rendered": {
+            "name": "alchemy/admin/elements/update",
+            "file": "app/views/alchemy/admin/elements/update.js.erb"
+          }
+        }
+      ],
+      "location": {
+        "type": "template",
+        "template": "alchemy/admin/elements/update"
+      },
+      "user_input": "params[:id]",
+      "confidence": "Weak",
+      "note": ""
+    },
+    {
+      "warning_type": "File Access",
+      "warning_code": 16,
+      "fingerprint": "154e5d85347ab40256b60182d3143830247b33b81de2ae9ac0622155a1de8e51",
+      "check_name": "SendFile",
+      "message": "Parameter value used in file name",
+      "file": "app/controllers/alchemy/admin/attachments_controller.rb",
+      "line": 65,
+      "link": "https://brakemanscanner.org/docs/warning_types/file_access/",
+      "code": "send_file(Attachment.find(params[:id]).file.path, :filename => Attachment.find(params[:id]).file_name, :type => Attachment.find(params[:id]).file_mime_type)",
+      "render_path": null,
+      "location": {
+        "type": "method",
+        "class": "Alchemy::Admin::AttachmentsController",
+        "method": "download"
+      },
+      "user_input": "params[:id]",
+      "confidence": "Weak",
+      "note": ""
+    },
     {
       "warning_type": "Mass Assignment",
       "warning_code": 70,
       "fingerprint": "1dd8f69d9b1bdd4017212f38098f03d2ecb2db06269fb940090f209eee7570c6",
       "check_name": "MassAssignment",
-      "message": "Parameters should be whitelisted for mass assignment",
+      "message": "Specify exact keys allowed for mass assignment instead of using `permit!` which allows any keys",
       "file": "app/controllers/alchemy/admin/resources_controller.rb",
-      "line": 130,
-      "link": "http://brakemanscanner.org/docs/warning_types/mass_assignment/",
+      "line": 136,
+      "link": "https://brakemanscanner.org/docs/warning_types/mass_assignment/",
       "code": "params.require(resource_handler.namespaced_resource_name).permit!",
       "render_path": null,
       "location": {
@@ -20,34 +71,170 @@
       "confidence": "Medium",
       "note": "Because we actually can't know all attributes each inheriting controller supports, we permit all resource model params. It is adviced that all inheriting controllers implement this method and provide its own set of permitted attributes. As this all happens inside the password protected /admin namespace this can be considered a false positive."
     },
+    {
+      "warning_type": "Cross-Site Scripting",
+      "warning_code": 2,
+      "fingerprint": "293a6f5581ba3f0e7aa4f81b38d68baf21f1219c8f3bae3eca6b3e1776b734df",
+      "check_name": "CrossSiteScripting",
+      "message": "Unescaped parameter value",
+      "file": "app/views/alchemy/admin/elements/order.js.erb",
+      "line": 17,
+      "link": "https://brakemanscanner.org/docs/warning_types/cross_site_scripting",
+      "code": "Element.trashed.where(:id => params[:element_ids]).pluck(:id).collect do\n \"#element_area [data-element-id=\\\"#{id}\\\"]\"\n end.join(\", \")",
+      "render_path": [
+        {
+          "type": "controller",
+          "class": "Alchemy::Admin::ElementsController",
+          "method": "order",
+          "line": 78,
+          "file": "app/controllers/alchemy/admin/elements_controller.rb",
+          "rendered": {
+            "name": "alchemy/admin/elements/order",
+            "file": "app/views/alchemy/admin/elements/order.js.erb"
+          }
+        }
+      ],
+      "location": {
+        "type": "template",
+        "template": "alchemy/admin/elements/order"
+      },
+      "user_input": "params[:element_ids]",
+      "confidence": "Weak",
+      "note": ""
+    },
     {
       "warning_type": "Dynamic Render Path",
       "warning_code": 15,
-      "fingerprint": "79e194e21561d40888d86ebc7fd2ab474fdb0ce32d605dbe9ac6e8984ecc5e92",
+      "fingerprint": "2eb67abb2b025c3446afa2f9b8d48c6b6a05379234a9228c9af4c25b7e672b00",
       "check_name": "Render",
       "message": "Render path contains parameter value",
-      "file": "app/views/alchemy/admin/contents/create.js.erb",
-      "line": 1,
-      "link": "http://brakemanscanner.org/docs/warning_types/dynamic_render_path/",
-      "code": "render(action => \"alchemy/essences/#{Content.create(Element.find(params[:content][:element_id]), content_params).essence_partial_name}_editor\", { :content => Content.create(Element.find(params[:content][:element_id]), content_params) })",
-      "render_path": [{"type":"controller","class":"Alchemy::Admin::ContentsController","method":"create","line":21,"file":"app/controllers/alchemy/admin/contents_controller.rb"}],
+      "file": "app/views/alchemy/admin/elements/index.html.erb",
+      "line": 18,
+      "link": "https://brakemanscanner.org/docs/warning_types/dynamic_render_path/",
+      "code": "render(action => Page.find(params[:page_id]).all_elements.not_nested.unfixed.not_trashed.includes(*element_includes).map do\n Alchemy::ElementEditor.new(element)\n end, {})",
+      "render_path": [
+        {
+          "type": "controller",
+          "class": "Alchemy::Admin::ElementsController",
+          "method": "index",
+          "line": 13,
+          "file": "app/controllers/alchemy/admin/elements_controller.rb",
+          "rendered": {
+            "name": "alchemy/admin/elements/index",
+            "file": "app/views/alchemy/admin/elements/index.html.erb"
+          }
+        }
+      ],
       "location": {
         "type": "template",
-        "template": "alchemy/admin/contents/create"
+        "template": "alchemy/admin/elements/index"
       },
-      "user_input": "params[:content][:element_id]",
+      "user_input": "params[:page_id]",
       "confidence": "Weak",
-      "note": "This dynamic render path comes from the Contents essence not from any params or user mutated string. This can safely be ignored."
+      "note": ""
+    },
+    {
+      "warning_type": "Dynamic Render Path",
+      "warning_code": 15,
+      "fingerprint": "2eb67abb2b025c3446afa2f9b8d48c6b6a05379234a9228c9af4c25b7e672b00",
+      "check_name": "Render",
+      "message": "Render path contains parameter value",
+      "file": "app/views/alchemy/admin/elements/index.html.erb",
+      "line": 31,
+      "link": "https://brakemanscanner.org/docs/warning_types/dynamic_render_path/",
+      "code": "render(action => Page.find(params[:page_id]).all_elements.not_nested.unfixed.not_trashed.includes(*element_includes).map do\n Alchemy::ElementEditor.new(element)\n end, {})",
+      "render_path": [
+        {
+          "type": "controller",
+          "class": "Alchemy::Admin::ElementsController",
+          "method": "index",
+          "line": 13,
+          "file": "app/controllers/alchemy/admin/elements_controller.rb",
+          "rendered": {
+            "name": "alchemy/admin/elements/index",
+            "file": "app/views/alchemy/admin/elements/index.html.erb"
+          }
+        }
+      ],
+      "location": {
+        "type": "template",
+        "template": "alchemy/admin/elements/index"
+      },
+      "user_input": "params[:page_id]",
+      "confidence": "Weak",
+      "note": ""
+    },
+    {
+      "warning_type": "Dynamic Render Path",
+      "warning_code": 15,
+      "fingerprint": "2fa9bf5c73b4e6e3c272f0b14635f96efbd763e9a2c5b785caefffe3589ac461",
+      "check_name": "Render",
+      "message": "Render path contains parameter value",
+      "file": "app/views/alchemy/admin/essence_pictures/assign.js.erb",
+      "line": 2,
+      "link": "https://brakemanscanner.org/docs/warning_types/dynamic_render_path/",
+      "code": "render(action => Alchemy::ContentEditor.new(Content.find(params[:content_id])), {})",
+      "render_path": [
+        {
+          "type": "controller",
+          "class": "Alchemy::Admin::EssencePicturesController",
+          "method": "assign",
+          "line": 49,
+          "file": "app/controllers/alchemy/admin/essence_pictures_controller.rb",
+          "rendered": {
+            "name": "alchemy/admin/essence_pictures/assign",
+            "file": "app/views/alchemy/admin/essence_pictures/assign.js.erb"
+          }
+        }
+      ],
+      "location": {
+        "type": "template",
+        "template": "alchemy/admin/essence_pictures/assign"
+      },
+      "user_input": "params[:content_id]",
+      "confidence": "Weak",
+      "note": ""
+    },
+    {
+      "warning_type": "Dynamic Render Path",
+      "warning_code": 15,
+      "fingerprint": "384ec61125c6390d59fb7ebcf52792ba284bfd463d70d4ef552ab6c328e776f6",
+      "check_name": "Render",
+      "message": "Render path contains parameter value",
+      "file": "app/views/alchemy/admin/elements/fold.js.erb",
+      "line": 11,
+      "link": "https://brakemanscanner.org/docs/warning_types/dynamic_render_path/",
+      "code": "render(action => Alchemy::ElementEditor.new(Element.find(params[:id])), {})",
+      "render_path": [
+        {
+          "type": "controller",
+          "class": "Alchemy::Admin::ElementsController",
+          "method": "fold",
+          "line": 95,
+          "file": "app/controllers/alchemy/admin/elements_controller.rb",
+          "rendered": {
+            "name": "alchemy/admin/elements/fold",
+            "file": "app/views/alchemy/admin/elements/fold.js.erb"
+          }
+        }
+      ],
+      "location": {
+        "type": "template",
+        "template": "alchemy/admin/elements/fold"
+      },
+      "user_input": "params[:id]",
+      "confidence": "Weak",
+      "note": ""
     },
     {
       "warning_type": "Mass Assignment",
       "warning_code": 70,
       "fingerprint": "4b4dc24a6f5251bc1a6851597dfcee39608a2932eb7f81a4a241c00fca8a3043",
       "check_name": "MassAssignment",
-      "message": "Parameters should be whitelisted for mass assignment",
+      "message": "Specify exact keys allowed for mass assignment instead of using `permit!` which allows any keys",
       "file": "app/controllers/alchemy/admin/elements_controller.rb",
-      "line": 168,
-      "link": "http://brakemanscanner.org/docs/warning_types/mass_assignment/",
+      "line": 146,
+      "link": "https://brakemanscanner.org/docs/warning_types/mass_assignment/",
       "code": "params.fetch(:contents, {}).permit!",
       "render_path": null,
       "location": {
@@ -58,8 +245,109 @@
       "user_input": null,
       "confidence": "Medium",
       "note": "`Alchemy::Content` is a polymorphic association of any kind of model extending `Alchemy::Essence`. Since we can't know the attributes of all potential essences we need to permit all attributes. As this all happens inside the password protected /admin namespace this can be considered a false positive."
+    },
+    {
+      "warning_type": "Cross-Site Scripting",
+      "warning_code": 4,
+      "fingerprint": "6e6ed4f8b20c07868bc04a4dc419103ecce33bb514eff77790abd57246a4513f",
+      "check_name": "LinkToHref",
+      "message": "Potentially unsafe model attribute in `link_to` href",
+      "file": "app/views/alchemy/admin/nodes/_node.html.erb",
+      "line": 62,
+      "link": "https://brakemanscanner.org/docs/warning_types/link_to_href",
+      "code": "link_to((Unresolved Model).new.url, (Unresolved Model).new.url, :target => \"_blank\", :title => (Unresolved Model).new.url)",
+      "render_path": [
+        {
+          "type": "template",
+          "name": "alchemy/admin/nodes/_node",
+          "line": 71,
+          "file": "app/views/alchemy/admin/nodes/_node.html.erb",
+          "rendered": {
+            "name": "alchemy/admin/nodes/_node",
+            "file": "app/views/alchemy/admin/nodes/_node.html.erb"
+          }
+        }
+      ],
+      "location": {
+        "type": "template",
+        "template": "alchemy/admin/nodes/_node"
+      },
+      "user_input": "(Unresolved Model).new.url",
+      "confidence": "Weak",
+      "note": ""
+    },
+    {
+      "warning_type": "File Access",
+      "warning_code": 16,
+      "fingerprint": "6f642c32a45d9f6bbdff89c51873485c930479f4d72885ad0a1883c4372140bf",
+      "check_name": "SendFile",
+      "message": "Parameter value used in file name",
+      "file": "app/controllers/alchemy/attachments_controller.rb",
+      "line": 25,
+      "link": "https://brakemanscanner.org/docs/warning_types/file_access/",
+      "code": "send_file(Attachment.find(params[:id]).file.path, :filename => Attachment.find(params[:id]).file_name, :type => Attachment.find(params[:id]).file_mime_type)",
+      "render_path": null,
+      "location": {
+        "type": "method",
+        "class": "Alchemy::AttachmentsController",
+        "method": "download"
+      },
+      "user_input": "params[:id]",
+      "confidence": "Weak",
+      "note": ""
+    },
+    {
+      "warning_type": "File Access",
+      "warning_code": 16,
+      "fingerprint": "a1197cfa89e3a66e6d10ee060cd87af97d5e978d6d93b5936eb987288f1c02e6",
+      "check_name": "SendFile",
+      "message": "Parameter value used in file name",
+      "file": "app/controllers/alchemy/attachments_controller.rb",
+      "line": 12,
+      "link": "https://brakemanscanner.org/docs/warning_types/file_access/",
+      "code": "send_file(Attachment.find(params[:id]).file.path, :filename => Attachment.find(params[:id]).file_name, :type => Attachment.find(params[:id]).file_mime_type, :disposition => \"inline\")",
+      "render_path": null,
+      "location": {
+        "type": "method",
+        "class": "Alchemy::AttachmentsController",
+        "method": "show"
+      },
+      "user_input": "params[:id]",
+      "confidence": "Weak",
+      "note": ""
+    },
+    {
+      "warning_type": "Dynamic Render Path",
+      "warning_code": 15,
+      "fingerprint": "b9f63fd46d0ebd6684b649ab260f27df8a6422d44fed4769273d8e6a6a30397c",
+      "check_name": "Render",
+      "message": "Render path contains parameter value",
+      "file": "app/views/alchemy/admin/essence_files/assign.js.erb",
+      "line": 1,
+      "link": "https://brakemanscanner.org/docs/warning_types/dynamic_render_path/",
+      "code": "render(action => Alchemy::ContentEditor.new(Content.find_by(:id => params[:content_id])), {})",
+      "render_path": [
+        {
+          "type": "controller",
+          "class": "Alchemy::Admin::EssenceFilesController",
+          "method": "assign",
+          "line": 32,
+          "file": "app/controllers/alchemy/admin/essence_files_controller.rb",
+          "rendered": {
+            "name": "alchemy/admin/essence_files/assign",
+            "file": "app/views/alchemy/admin/essence_files/assign.js.erb"
+          }
+        }
+      ],
+      "location": {
+        "type": "template",
+        "template": "alchemy/admin/essence_files/assign"
+      },
+      "user_input": "params[:content_id]",
+      "confidence": "Weak",
+      "note": ""
     }
   ],
-  "updated": "2017-10-23 11:49:41 +0200",
-  "brakeman_version": "4.0.1"
+  "updated": "2021-01-04 16:29:42 +0100",
+  "brakeman_version": "4.10.1"
 }