alchemy_cms 5.1.9 → 5.2.0.b1

Sign up to get free protection for your applications and to get access to all the features.
Files changed (52) hide show
  1. checksums.yaml +4 -4
  2. data/.github/workflows/ci.yml +2 -1
  3. data/CHANGELOG.md +21 -25
  4. data/Gemfile +2 -6
  5. data/alchemy_cms.gemspec +3 -3
  6. data/app/assets/stylesheets/alchemy/_variables.scss +2 -0
  7. data/app/assets/stylesheets/alchemy/elements.scss +38 -5
  8. data/app/assets/stylesheets/tinymce/skins/alchemy/content.min.css.scss +3 -3
  9. data/app/assets/stylesheets/tinymce/skins/alchemy/skin.min.css.scss +7 -7
  10. data/app/controllers/alchemy/admin/base_controller.rb +1 -0
  11. data/app/controllers/alchemy/admin/trash_controller.rb +2 -0
  12. data/app/decorators/alchemy/content_editor.rb +64 -0
  13. data/app/decorators/alchemy/element_editor.rb +1 -25
  14. data/app/helpers/alchemy/admin/contents_helper.rb +3 -8
  15. data/app/helpers/alchemy/elements_helper.rb +0 -18
  16. data/app/helpers/alchemy/pages_helper.rb +1 -1
  17. data/app/models/alchemy/attachment.rb +5 -1
  18. data/app/models/alchemy/content.rb +7 -0
  19. data/app/models/alchemy/element/definitions.rb +5 -22
  20. data/app/models/alchemy/element.rb +39 -1
  21. data/app/models/alchemy/node.rb +1 -1
  22. data/app/models/alchemy/page/page_elements.rb +9 -2
  23. data/app/models/alchemy/page.rb +1 -1
  24. data/app/models/alchemy/picture.rb +2 -2
  25. data/app/models/alchemy/picture_variant.rb +1 -1
  26. data/app/views/alchemy/admin/elements/_element.html.erb +1 -1
  27. data/app/views/alchemy/admin/elements/_element_header.html.erb +2 -0
  28. data/app/views/alchemy/essences/_essence_picture_view.html.erb +3 -3
  29. data/config/brakeman.ignore +305 -17
  30. data/config/locales/alchemy.en.yml +40 -24
  31. data/lib/alchemy/deprecation.rb +1 -1
  32. data/lib/alchemy/element_definition.rb +70 -0
  33. data/lib/alchemy/elements_finder.rb +6 -2
  34. data/lib/alchemy/engine.rb +1 -1
  35. data/lib/alchemy/essence.rb +4 -4
  36. data/lib/alchemy/filetypes.rb +13 -0
  37. data/lib/alchemy/forms/builder.rb +1 -1
  38. data/lib/alchemy/i18n.rb +4 -5
  39. data/lib/alchemy/page_layout.rb +1 -0
  40. data/lib/alchemy/resource.rb +3 -5
  41. data/lib/alchemy/test_support/integration_helpers.rb +5 -5
  42. data/lib/alchemy/upgrader/five_point_zero.rb +0 -32
  43. data/lib/alchemy/version.rb +1 -1
  44. data/lib/alchemy_cms.rb +1 -0
  45. data/lib/generators/alchemy/install/install_generator.rb +1 -2
  46. data/lib/tasks/alchemy/thumbnails.rake +2 -4
  47. data/lib/tasks/alchemy/upgrade.rake +0 -20
  48. data/package/admin.js +0 -2
  49. data/package/src/__tests__/i18n.spec.js +0 -23
  50. data/package/src/i18n.js +3 -1
  51. data/package.json +1 -1
  52. metadata +12 -18
@@ -37,6 +37,7 @@ module Alchemy
37
37
  "taggable",
38
38
  "compact",
39
39
  "message",
40
+ "deprecated",
40
41
  ].freeze
41
42
 
42
43
  SKIPPED_ATTRIBUTES_ON_COPY = [
@@ -60,7 +61,7 @@ module Alchemy
60
61
  #
61
62
  acts_as_list scope: [:page_id, :fixed, :parent_element_id]
62
63
 
63
- stampable stamper_class_name: Alchemy.user_class.name
64
+ stampable stamper_class_name: Alchemy.user_class_name
64
65
 
65
66
  has_many :contents, dependent: :destroy, inverse_of: :element
66
67
 
@@ -124,6 +125,9 @@ module Alchemy
124
125
 
125
126
  # class methods
126
127
  class << self
128
+ deprecate :trashed, deprecator: Alchemy::Deprecation
129
+ deprecate :not_trashed, deprecator: Alchemy::Deprecation
130
+
127
131
  # Builds a new element as described in +/config/alchemy/elements.yml+
128
132
  #
129
133
  # - Returns a new Alchemy::Element object if no name is given in attributes,
@@ -227,10 +231,12 @@ module Alchemy
227
231
  self.folded = true
228
232
  remove_from_list
229
233
  end
234
+ deprecate :trash!, deprecator: Alchemy::Deprecation
230
235
 
231
236
  def trashed?
232
237
  position.nil?
233
238
  end
239
+ deprecate :trashed?, deprecator: Alchemy::Deprecation
234
240
 
235
241
  # Returns true if the definition of this element has a taggable true value.
236
242
  def taggable?
@@ -247,6 +253,38 @@ module Alchemy
247
253
  definition["compact"] == true
248
254
  end
249
255
 
256
+ # Defined as deprecated element?
257
+ #
258
+ # You can either set true or a String on your elements definition.
259
+ #
260
+ # == Passing true
261
+ #
262
+ # - name: old_element
263
+ # deprecated: true
264
+ #
265
+ # The deprecation notice can be translated. Either as global notice for all deprecated elements.
266
+ #
267
+ # en:
268
+ # alchemy:
269
+ # element_deprecation_notice: Foo baz widget is deprecated
270
+ #
271
+ # Or add a translation to your locale file for a per element notice.
272
+ #
273
+ # en:
274
+ # alchemy:
275
+ # element_deprecation_notices:
276
+ # old_element: Foo baz widget is deprecated
277
+ #
278
+ # == Pass a String
279
+ #
280
+ # - name: old_element
281
+ # deprecated: This element will be removed soon.
282
+ #
283
+ # @return Boolean
284
+ def deprecated?
285
+ !!definition["deprecated"]
286
+ end
287
+
250
288
  # The element's view partial is dependent from its name
251
289
  #
252
290
  # == Define elements
@@ -7,7 +7,7 @@ module Alchemy
7
7
  before_destroy :check_if_related_essence_nodes_present
8
8
 
9
9
  acts_as_nested_set scope: "language_id", touch: true
10
- stampable stamper_class_name: Alchemy.user_class.name
10
+ stampable stamper_class_name: Alchemy.user_class_name
11
11
 
12
12
  belongs_to :language, class_name: "Alchemy::Language"
13
13
  belongs_to :page, class_name: "Alchemy::Page", optional: true, inverse_of: :nodes
@@ -38,11 +38,17 @@ module Alchemy
38
38
  after_update :trash_not_allowed_elements!,
39
39
  if: :saved_change_to_page_layout?
40
40
 
41
- after_update :generate_elements,
42
- if: :saved_change_to_page_layout?
41
+ after_update(if: :saved_change_to_page_layout?) do
42
+ Alchemy::Deprecation.warn(
43
+ "Autogenerating elements on page_layout change is deprecated and will be removed from Alchemy 6.0"
44
+ )
45
+ generate_elements
46
+ end
43
47
  end
44
48
 
45
49
  module ClassMethods
50
+ deprecate :trashed_elements, deprecator: Alchemy::Deprecation
51
+
46
52
  # Copy page elements
47
53
  #
48
54
  # @param source [Alchemy::Page]
@@ -210,6 +216,7 @@ module Alchemy
210
216
  ])
211
217
  not_allowed_elements.to_a.map(&:trash!)
212
218
  end
219
+ deprecate :trash_not_allowed_elements!, deprecator: Alchemy::Deprecation
213
220
 
214
221
  # Deletes unique and already present definitions from @_element_definitions.
215
222
  #
@@ -82,7 +82,7 @@ module Alchemy
82
82
 
83
83
  acts_as_nested_set(dependent: :destroy, scope: [:layoutpage, :language_id])
84
84
 
85
- stampable stamper_class_name: Alchemy.user_class.name
85
+ stampable stamper_class_name: Alchemy.user_class_name
86
86
 
87
87
  belongs_to :language
88
88
 
@@ -91,7 +91,7 @@ module Alchemy
91
91
  end
92
92
 
93
93
  # Create important thumbnails upfront
94
- after_create -> { PictureThumb.generate_thumbs!(self) if has_convertible_format? }
94
+ after_create -> { PictureThumb.generate_thumbs!(self) }
95
95
 
96
96
  # We need to define this method here to have it available in the validations below.
97
97
  class << self
@@ -108,7 +108,7 @@ module Alchemy
108
108
  case_sensitive: false,
109
109
  message: Alchemy.t("not a valid image")
110
110
 
111
- stampable stamper_class_name: Alchemy.user_class.name
111
+ stampable stamper_class_name: Alchemy.user_class_name
112
112
 
113
113
  scope :named, ->(name) { where("#{table_name}.name LIKE ?", "%#{name}%") }
114
114
  scope :recent, -> { where("#{table_name}.created_at > ?", Time.current - 24.hours).order(:created_at) }
@@ -93,7 +93,7 @@ module Alchemy
93
93
 
94
94
  convert_format = render_format.sub("jpeg", "jpg") != picture.image_file_format.sub("jpeg", "jpg")
95
95
 
96
- if render_format =~ /jpe?g/ && convert_format
96
+ if render_format =~ /jpe?g/ && (convert_format || options[:quality])
97
97
  quality = options[:quality] || Config.get(:output_image_jpg_quality)
98
98
  encoding_options << "-quality #{quality}"
99
99
  end
@@ -25,7 +25,7 @@
25
25
  <div id="element_<%= element.id %>_errors" class="element_errors"></div>
26
26
 
27
27
  <div id="element_<%= element.id %>_content" class="element-content-editors">
28
- <%= render element.contents %>
28
+ <%= render element.contents.map { |content| Alchemy::ContentEditor.new(content) } %>
29
29
  </div>
30
30
 
31
31
  <% if element.taggable? %>
@@ -2,6 +2,8 @@
2
2
  <span class="element-handle">
3
3
  <% if element.definition.blank? %>
4
4
  <%= hint_with_tooltip Alchemy.t(:element_definition_missing) %>
5
+ <% elsif element.deprecated? %>
6
+ <%= hint_with_tooltip element.deprecation_notice %>
5
7
  <% else %>
6
8
  <% if element.public? %>
7
9
  <%= render_icon('window-maximize', style: 'regular', class: 'element') %>
@@ -1,6 +1,6 @@
1
1
  <% content = local_assigns[:content] || local_assigns[:essence_picture_view] %>
2
2
  <%= Alchemy::EssencePictureView.new(
3
3
  content,
4
- local_assigns[:options] || {},
5
- local_assigns[:html_options] || {}
6
- ).render %>
4
+ local_assigns[:options],
5
+ local_assigns[:html_options]
6
+ ).render %>
@@ -1,14 +1,65 @@
1
1
  {
2
2
  "ignored_warnings": [
3
+ {
4
+ "warning_type": "Cross-Site Scripting",
5
+ "warning_code": 2,
6
+ "fingerprint": "0551e3f9180b85fca4b17fe3c7cbbac1611d2ef8d385f77e9445c562c471d688",
7
+ "check_name": "CrossSiteScripting",
8
+ "message": "Unescaped parameter value",
9
+ "file": "app/views/alchemy/admin/elements/update.js.erb",
10
+ "line": 18,
11
+ "link": "https://brakemanscanner.org/docs/warning_types/cross_site_scripting",
12
+ "code": "j(Element.find(params[:id]).essence_error_messages.join(\"</li><li>\"))",
13
+ "render_path": [
14
+ {
15
+ "type": "controller",
16
+ "class": "Alchemy::Admin::ElementsController",
17
+ "method": "update",
18
+ "line": 55,
19
+ "file": "app/controllers/alchemy/admin/elements_controller.rb",
20
+ "rendered": {
21
+ "name": "alchemy/admin/elements/update",
22
+ "file": "app/views/alchemy/admin/elements/update.js.erb"
23
+ }
24
+ }
25
+ ],
26
+ "location": {
27
+ "type": "template",
28
+ "template": "alchemy/admin/elements/update"
29
+ },
30
+ "user_input": "params[:id]",
31
+ "confidence": "Weak",
32
+ "note": ""
33
+ },
34
+ {
35
+ "warning_type": "File Access",
36
+ "warning_code": 16,
37
+ "fingerprint": "154e5d85347ab40256b60182d3143830247b33b81de2ae9ac0622155a1de8e51",
38
+ "check_name": "SendFile",
39
+ "message": "Parameter value used in file name",
40
+ "file": "app/controllers/alchemy/admin/attachments_controller.rb",
41
+ "line": 65,
42
+ "link": "https://brakemanscanner.org/docs/warning_types/file_access/",
43
+ "code": "send_file(Attachment.find(params[:id]).file.path, :filename => Attachment.find(params[:id]).file_name, :type => Attachment.find(params[:id]).file_mime_type)",
44
+ "render_path": null,
45
+ "location": {
46
+ "type": "method",
47
+ "class": "Alchemy::Admin::AttachmentsController",
48
+ "method": "download"
49
+ },
50
+ "user_input": "params[:id]",
51
+ "confidence": "Weak",
52
+ "note": ""
53
+ },
3
54
  {
4
55
  "warning_type": "Mass Assignment",
5
56
  "warning_code": 70,
6
57
  "fingerprint": "1dd8f69d9b1bdd4017212f38098f03d2ecb2db06269fb940090f209eee7570c6",
7
58
  "check_name": "MassAssignment",
8
- "message": "Parameters should be whitelisted for mass assignment",
59
+ "message": "Specify exact keys allowed for mass assignment instead of using `permit!` which allows any keys",
9
60
  "file": "app/controllers/alchemy/admin/resources_controller.rb",
10
- "line": 130,
11
- "link": "http://brakemanscanner.org/docs/warning_types/mass_assignment/",
61
+ "line": 136,
62
+ "link": "https://brakemanscanner.org/docs/warning_types/mass_assignment/",
12
63
  "code": "params.require(resource_handler.namespaced_resource_name).permit!",
13
64
  "render_path": null,
14
65
  "location": {
@@ -20,34 +71,170 @@
20
71
  "confidence": "Medium",
21
72
  "note": "Because we actually can't know all attributes each inheriting controller supports, we permit all resource model params. It is adviced that all inheriting controllers implement this method and provide its own set of permitted attributes. As this all happens inside the password protected /admin namespace this can be considered a false positive."
22
73
  },
74
+ {
75
+ "warning_type": "Cross-Site Scripting",
76
+ "warning_code": 2,
77
+ "fingerprint": "293a6f5581ba3f0e7aa4f81b38d68baf21f1219c8f3bae3eca6b3e1776b734df",
78
+ "check_name": "CrossSiteScripting",
79
+ "message": "Unescaped parameter value",
80
+ "file": "app/views/alchemy/admin/elements/order.js.erb",
81
+ "line": 17,
82
+ "link": "https://brakemanscanner.org/docs/warning_types/cross_site_scripting",
83
+ "code": "Element.trashed.where(:id => params[:element_ids]).pluck(:id).collect do\n \"#element_area [data-element-id=\\\"#{id}\\\"]\"\n end.join(\", \")",
84
+ "render_path": [
85
+ {
86
+ "type": "controller",
87
+ "class": "Alchemy::Admin::ElementsController",
88
+ "method": "order",
89
+ "line": 78,
90
+ "file": "app/controllers/alchemy/admin/elements_controller.rb",
91
+ "rendered": {
92
+ "name": "alchemy/admin/elements/order",
93
+ "file": "app/views/alchemy/admin/elements/order.js.erb"
94
+ }
95
+ }
96
+ ],
97
+ "location": {
98
+ "type": "template",
99
+ "template": "alchemy/admin/elements/order"
100
+ },
101
+ "user_input": "params[:element_ids]",
102
+ "confidence": "Weak",
103
+ "note": ""
104
+ },
23
105
  {
24
106
  "warning_type": "Dynamic Render Path",
25
107
  "warning_code": 15,
26
- "fingerprint": "79e194e21561d40888d86ebc7fd2ab474fdb0ce32d605dbe9ac6e8984ecc5e92",
108
+ "fingerprint": "2eb67abb2b025c3446afa2f9b8d48c6b6a05379234a9228c9af4c25b7e672b00",
27
109
  "check_name": "Render",
28
110
  "message": "Render path contains parameter value",
29
- "file": "app/views/alchemy/admin/contents/create.js.erb",
30
- "line": 1,
31
- "link": "http://brakemanscanner.org/docs/warning_types/dynamic_render_path/",
32
- "code": "render(action => \"alchemy/essences/#{Content.create(Element.find(params[:content][:element_id]), content_params).essence_partial_name}_editor\", { :content => Content.create(Element.find(params[:content][:element_id]), content_params) })",
33
- "render_path": [{"type":"controller","class":"Alchemy::Admin::ContentsController","method":"create","line":21,"file":"app/controllers/alchemy/admin/contents_controller.rb"}],
111
+ "file": "app/views/alchemy/admin/elements/index.html.erb",
112
+ "line": 18,
113
+ "link": "https://brakemanscanner.org/docs/warning_types/dynamic_render_path/",
114
+ "code": "render(action => Page.find(params[:page_id]).all_elements.not_nested.unfixed.not_trashed.includes(*element_includes).map do\n Alchemy::ElementEditor.new(element)\n end, {})",
115
+ "render_path": [
116
+ {
117
+ "type": "controller",
118
+ "class": "Alchemy::Admin::ElementsController",
119
+ "method": "index",
120
+ "line": 13,
121
+ "file": "app/controllers/alchemy/admin/elements_controller.rb",
122
+ "rendered": {
123
+ "name": "alchemy/admin/elements/index",
124
+ "file": "app/views/alchemy/admin/elements/index.html.erb"
125
+ }
126
+ }
127
+ ],
34
128
  "location": {
35
129
  "type": "template",
36
- "template": "alchemy/admin/contents/create"
130
+ "template": "alchemy/admin/elements/index"
37
131
  },
38
- "user_input": "params[:content][:element_id]",
132
+ "user_input": "params[:page_id]",
39
133
  "confidence": "Weak",
40
- "note": "This dynamic render path comes from the Contents essence not from any params or user mutated string. This can safely be ignored."
134
+ "note": ""
135
+ },
136
+ {
137
+ "warning_type": "Dynamic Render Path",
138
+ "warning_code": 15,
139
+ "fingerprint": "2eb67abb2b025c3446afa2f9b8d48c6b6a05379234a9228c9af4c25b7e672b00",
140
+ "check_name": "Render",
141
+ "message": "Render path contains parameter value",
142
+ "file": "app/views/alchemy/admin/elements/index.html.erb",
143
+ "line": 31,
144
+ "link": "https://brakemanscanner.org/docs/warning_types/dynamic_render_path/",
145
+ "code": "render(action => Page.find(params[:page_id]).all_elements.not_nested.unfixed.not_trashed.includes(*element_includes).map do\n Alchemy::ElementEditor.new(element)\n end, {})",
146
+ "render_path": [
147
+ {
148
+ "type": "controller",
149
+ "class": "Alchemy::Admin::ElementsController",
150
+ "method": "index",
151
+ "line": 13,
152
+ "file": "app/controllers/alchemy/admin/elements_controller.rb",
153
+ "rendered": {
154
+ "name": "alchemy/admin/elements/index",
155
+ "file": "app/views/alchemy/admin/elements/index.html.erb"
156
+ }
157
+ }
158
+ ],
159
+ "location": {
160
+ "type": "template",
161
+ "template": "alchemy/admin/elements/index"
162
+ },
163
+ "user_input": "params[:page_id]",
164
+ "confidence": "Weak",
165
+ "note": ""
166
+ },
167
+ {
168
+ "warning_type": "Dynamic Render Path",
169
+ "warning_code": 15,
170
+ "fingerprint": "2fa9bf5c73b4e6e3c272f0b14635f96efbd763e9a2c5b785caefffe3589ac461",
171
+ "check_name": "Render",
172
+ "message": "Render path contains parameter value",
173
+ "file": "app/views/alchemy/admin/essence_pictures/assign.js.erb",
174
+ "line": 2,
175
+ "link": "https://brakemanscanner.org/docs/warning_types/dynamic_render_path/",
176
+ "code": "render(action => Alchemy::ContentEditor.new(Content.find(params[:content_id])), {})",
177
+ "render_path": [
178
+ {
179
+ "type": "controller",
180
+ "class": "Alchemy::Admin::EssencePicturesController",
181
+ "method": "assign",
182
+ "line": 49,
183
+ "file": "app/controllers/alchemy/admin/essence_pictures_controller.rb",
184
+ "rendered": {
185
+ "name": "alchemy/admin/essence_pictures/assign",
186
+ "file": "app/views/alchemy/admin/essence_pictures/assign.js.erb"
187
+ }
188
+ }
189
+ ],
190
+ "location": {
191
+ "type": "template",
192
+ "template": "alchemy/admin/essence_pictures/assign"
193
+ },
194
+ "user_input": "params[:content_id]",
195
+ "confidence": "Weak",
196
+ "note": ""
197
+ },
198
+ {
199
+ "warning_type": "Dynamic Render Path",
200
+ "warning_code": 15,
201
+ "fingerprint": "384ec61125c6390d59fb7ebcf52792ba284bfd463d70d4ef552ab6c328e776f6",
202
+ "check_name": "Render",
203
+ "message": "Render path contains parameter value",
204
+ "file": "app/views/alchemy/admin/elements/fold.js.erb",
205
+ "line": 11,
206
+ "link": "https://brakemanscanner.org/docs/warning_types/dynamic_render_path/",
207
+ "code": "render(action => Alchemy::ElementEditor.new(Element.find(params[:id])), {})",
208
+ "render_path": [
209
+ {
210
+ "type": "controller",
211
+ "class": "Alchemy::Admin::ElementsController",
212
+ "method": "fold",
213
+ "line": 95,
214
+ "file": "app/controllers/alchemy/admin/elements_controller.rb",
215
+ "rendered": {
216
+ "name": "alchemy/admin/elements/fold",
217
+ "file": "app/views/alchemy/admin/elements/fold.js.erb"
218
+ }
219
+ }
220
+ ],
221
+ "location": {
222
+ "type": "template",
223
+ "template": "alchemy/admin/elements/fold"
224
+ },
225
+ "user_input": "params[:id]",
226
+ "confidence": "Weak",
227
+ "note": ""
41
228
  },
42
229
  {
43
230
  "warning_type": "Mass Assignment",
44
231
  "warning_code": 70,
45
232
  "fingerprint": "4b4dc24a6f5251bc1a6851597dfcee39608a2932eb7f81a4a241c00fca8a3043",
46
233
  "check_name": "MassAssignment",
47
- "message": "Parameters should be whitelisted for mass assignment",
234
+ "message": "Specify exact keys allowed for mass assignment instead of using `permit!` which allows any keys",
48
235
  "file": "app/controllers/alchemy/admin/elements_controller.rb",
49
- "line": 168,
50
- "link": "http://brakemanscanner.org/docs/warning_types/mass_assignment/",
236
+ "line": 146,
237
+ "link": "https://brakemanscanner.org/docs/warning_types/mass_assignment/",
51
238
  "code": "params.fetch(:contents, {}).permit!",
52
239
  "render_path": null,
53
240
  "location": {
@@ -58,8 +245,109 @@
58
245
  "user_input": null,
59
246
  "confidence": "Medium",
60
247
  "note": "`Alchemy::Content` is a polymorphic association of any kind of model extending `Alchemy::Essence`. Since we can't know the attributes of all potential essences we need to permit all attributes. As this all happens inside the password protected /admin namespace this can be considered a false positive."
248
+ },
249
+ {
250
+ "warning_type": "Cross-Site Scripting",
251
+ "warning_code": 4,
252
+ "fingerprint": "6e6ed4f8b20c07868bc04a4dc419103ecce33bb514eff77790abd57246a4513f",
253
+ "check_name": "LinkToHref",
254
+ "message": "Potentially unsafe model attribute in `link_to` href",
255
+ "file": "app/views/alchemy/admin/nodes/_node.html.erb",
256
+ "line": 62,
257
+ "link": "https://brakemanscanner.org/docs/warning_types/link_to_href",
258
+ "code": "link_to((Unresolved Model).new.url, (Unresolved Model).new.url, :target => \"_blank\", :title => (Unresolved Model).new.url)",
259
+ "render_path": [
260
+ {
261
+ "type": "template",
262
+ "name": "alchemy/admin/nodes/_node",
263
+ "line": 71,
264
+ "file": "app/views/alchemy/admin/nodes/_node.html.erb",
265
+ "rendered": {
266
+ "name": "alchemy/admin/nodes/_node",
267
+ "file": "app/views/alchemy/admin/nodes/_node.html.erb"
268
+ }
269
+ }
270
+ ],
271
+ "location": {
272
+ "type": "template",
273
+ "template": "alchemy/admin/nodes/_node"
274
+ },
275
+ "user_input": "(Unresolved Model).new.url",
276
+ "confidence": "Weak",
277
+ "note": ""
278
+ },
279
+ {
280
+ "warning_type": "File Access",
281
+ "warning_code": 16,
282
+ "fingerprint": "6f642c32a45d9f6bbdff89c51873485c930479f4d72885ad0a1883c4372140bf",
283
+ "check_name": "SendFile",
284
+ "message": "Parameter value used in file name",
285
+ "file": "app/controllers/alchemy/attachments_controller.rb",
286
+ "line": 25,
287
+ "link": "https://brakemanscanner.org/docs/warning_types/file_access/",
288
+ "code": "send_file(Attachment.find(params[:id]).file.path, :filename => Attachment.find(params[:id]).file_name, :type => Attachment.find(params[:id]).file_mime_type)",
289
+ "render_path": null,
290
+ "location": {
291
+ "type": "method",
292
+ "class": "Alchemy::AttachmentsController",
293
+ "method": "download"
294
+ },
295
+ "user_input": "params[:id]",
296
+ "confidence": "Weak",
297
+ "note": ""
298
+ },
299
+ {
300
+ "warning_type": "File Access",
301
+ "warning_code": 16,
302
+ "fingerprint": "a1197cfa89e3a66e6d10ee060cd87af97d5e978d6d93b5936eb987288f1c02e6",
303
+ "check_name": "SendFile",
304
+ "message": "Parameter value used in file name",
305
+ "file": "app/controllers/alchemy/attachments_controller.rb",
306
+ "line": 12,
307
+ "link": "https://brakemanscanner.org/docs/warning_types/file_access/",
308
+ "code": "send_file(Attachment.find(params[:id]).file.path, :filename => Attachment.find(params[:id]).file_name, :type => Attachment.find(params[:id]).file_mime_type, :disposition => \"inline\")",
309
+ "render_path": null,
310
+ "location": {
311
+ "type": "method",
312
+ "class": "Alchemy::AttachmentsController",
313
+ "method": "show"
314
+ },
315
+ "user_input": "params[:id]",
316
+ "confidence": "Weak",
317
+ "note": ""
318
+ },
319
+ {
320
+ "warning_type": "Dynamic Render Path",
321
+ "warning_code": 15,
322
+ "fingerprint": "b9f63fd46d0ebd6684b649ab260f27df8a6422d44fed4769273d8e6a6a30397c",
323
+ "check_name": "Render",
324
+ "message": "Render path contains parameter value",
325
+ "file": "app/views/alchemy/admin/essence_files/assign.js.erb",
326
+ "line": 1,
327
+ "link": "https://brakemanscanner.org/docs/warning_types/dynamic_render_path/",
328
+ "code": "render(action => Alchemy::ContentEditor.new(Content.find_by(:id => params[:content_id])), {})",
329
+ "render_path": [
330
+ {
331
+ "type": "controller",
332
+ "class": "Alchemy::Admin::EssenceFilesController",
333
+ "method": "assign",
334
+ "line": 32,
335
+ "file": "app/controllers/alchemy/admin/essence_files_controller.rb",
336
+ "rendered": {
337
+ "name": "alchemy/admin/essence_files/assign",
338
+ "file": "app/views/alchemy/admin/essence_files/assign.js.erb"
339
+ }
340
+ }
341
+ ],
342
+ "location": {
343
+ "type": "template",
344
+ "template": "alchemy/admin/essence_files/assign"
345
+ },
346
+ "user_input": "params[:content_id]",
347
+ "confidence": "Weak",
348
+ "note": ""
61
349
  }
62
350
  ],
63
- "updated": "2017-10-23 11:49:41 +0200",
64
- "brakeman_version": "4.0.1"
351
+ "updated": "2021-01-04 16:29:42 +0100",
352
+ "brakeman_version": "4.10.1"
65
353
  }
@@ -130,31 +130,45 @@ en:
130
130
  # == Mime Types translations
131
131
  # These are human readable mime types used for the document-type row in archive files.
132
132
  mime_types:
133
- audio/mp4: 'MP4-Audio'
134
- application/msword: 'Word-Document'
135
- application/rtf: 'RTF-Document'
136
- audio/mpeg: 'MP3-Audio'
137
- text/plain: 'Text-Document'
138
- video/mp4: 'MP4-Video'
139
- video/mpeg: 'MPEG-Video'
140
- application/pdf: 'PDF-Document'
141
- application/x-flash-video: 'Flash-Video'
142
- video/x-flv: 'Flash-Video'
143
- application/x-shockwave-flash: 'Flash-Movie'
144
- application/zip: 'ZIP-Archive'
145
- application/x-rar: 'RAR-Archive'
133
+ application/msexcel: Excel Spreadsheet
134
+ application/mspowerpoint: PowerPoint Presentation
135
+ application/msword: Word Document
136
+ application/pdf: PDF Document
137
+ application/rtf: RTF Document
138
+ application/vcard: vCard
146
139
  application/vnd:
147
- ms-excel: 'Excel-Document'
148
- video/quicktime: 'Quicktime-Video'
149
- image/x-psd: 'Photoshop-File'
150
- image/gif: 'GIF-Image'
151
- image/png: 'PNG-Image'
152
- image/jpeg: 'JPG-Image'
153
- video/x-msvideo: 'AVI-Video'
154
- video/x-ms-wmv: 'Windows Media Video'
155
- image/tiff: 'TIFF-Image'
156
- 'text/x-vcard': 'vCard'
157
- application/vcard: 'vCard'
140
+ ms-excel: Excel Spreadsheet
141
+ ms-powerpoint: PowerPoint Presentation
142
+ ms-word: Word Document
143
+ openxmlformats-officedocument:
144
+ presentationml:
145
+ presentation: PowerPoint 2007 Presentation
146
+ spreadsheetml:
147
+ sheet: Excel 2007 Spreadsheet
148
+ wordprocessingml:
149
+ document: Word 2007 Document
150
+ application/x-flash-video: Flash Video
151
+ application/x-rar: RAR Archive
152
+ application/x-shockwave-flash: Flash Movie
153
+ application/zip: ZIP Archive
154
+ audio/mp4: MPEG-4 Audio
155
+ audio/mpeg: MP3 Audio
156
+ audio/wav: WAV Audio
157
+ audio/x-wav: WAV Audio
158
+ image/gif: GIF Image
159
+ image/jpeg: JPG Image
160
+ image/png: PNG Image
161
+ image/tiff: TIFF Image
162
+ image/x-psd: Photoshop File
163
+ image/svg+xml: SVG Image
164
+ text/plain: Plain Text Document
165
+ text/x-vcard: vCard
166
+ video/mp4: MPEG-4 Video
167
+ video/mpeg: MPEG Video
168
+ video/quicktime: Quicktime Video
169
+ video/x-flv: Flash Video
170
+ video/x-ms-wmv: Windows Media Video
171
+ video/x-msvideo: AVI Video
158
172
 
159
173
  link_target_options:
160
174
  default: Same Window
@@ -295,7 +309,9 @@ en:
295
309
  "Visit page": "Visit page"
296
310
  "Warning!": "Warning!"
297
311
  content_definition_missing: "Warning: Content is missing its definition. Please check the elements.yml"
312
+ content_deprecated: "WARNING! This content is deprecated and will be removed soon. Please do not use it anymore."
298
313
  element_definition_missing: "WARNING! Missing element definition. Please check your elements.yml file."
314
+ element_deprecated: "WARNING! This element is deprecated and will be removed soon. Please do not use it anymore."
299
315
  page_definition_missing: "WARNING! Missing page layout definition. Please check your page_layouts.yml file."
300
316
  "Welcome to Alchemy": "Welcome to Alchemy"
301
317
  "Who else is online": "Who else is online"
@@ -1,4 +1,4 @@
1
1
  # frozen_string_literal: true
2
2
  module Alchemy
3
- Deprecation = ActiveSupport::Deprecation.new("5.1", "Alchemy")
3
+ Deprecation = ActiveSupport::Deprecation.new("6.0", "Alchemy")
4
4
  end