alchemy_cms 7.1.13 → 7.2.0.b

data/app/controllers/alchemy/admin/base_controller.rb

@@ -31,30 +31,9 @@ module Alchemy
 
       private
 
-      def safe_redirect_path(path = params[:redirect_to], fallback: admin_path)
-        if is_safe_redirect_path?(path)
-          path
-        elsif is_safe_redirect_path?(fallback)
-          fallback
-        else
-          admin_path
-        end
-      end
-
-      def is_safe_redirect_path?(path)
-        mount_path = alchemy.root_path
-        path.to_s.match? %r{^#{mount_path}admin/}
-      end
-
-      def relative_referer_path(referer = request.referer)
-        return unless referer
-
-        URI(referer).path
-      end
-
       # Disable layout rendering for xhr requests.
       def set_layout
-        request.xhr? ? false : "alchemy/admin"
+        (request.xhr? || turbo_frame_request?) ? false : "alchemy/admin"
       end
 
       # Handles exceptions
@@ -127,16 +106,13 @@ module Alchemy
 
       # Does redirects for html and js requests
       #
-      # Makes sure that the redirect path is safe.
-      #
       def do_redirect_to(url_or_path)
-        redirect_path = safe_redirect_path(url_or_path)
         respond_to do |format|
           format.js {
-            @redirect_url = redirect_path
+            @redirect_url = url_or_path
             render :redirect
           }
-          format.html { redirect_to redirect_path }
+          format.html { redirect_to url_or_path }
         end
       end
 

data/app/controllers/alchemy/admin/elements_controller.rb

@@ -76,9 +76,11 @@ module Alchemy
       end
 
       def destroy
-        @richtext_ids = @element.richtext_ingredients_ids
         @element.destroy
-        @notice = Alchemy.t("Successfully deleted element") % {element: @element.display_name}
+
+        render json: {
+          message: Alchemy.t("Successfully deleted element") % {element: @element.display_name}
+        }
       end
 
       def publish

data/app/controllers/alchemy/admin/ingredients_controller.rb

@@ -10,6 +10,8 @@ module Alchemy
       helper "Alchemy::Admin::Ingredients"
 
       def edit
+        @language = Alchemy::Language.find_by(id: params[:language_id]) ||
+          Alchemy::Current.language
       end
 
       def update

data/app/controllers/alchemy/admin/languages_controller.rb

@@ -40,13 +40,13 @@ module Alchemy
       def switch
         @language = set_alchemy_language(params[:language_id])
         session[:alchemy_language_id] = @language.id
-        do_redirect_to relative_referer_path || alchemy.admin_dashboard_path
+        do_redirect_to request.referer || alchemy.admin_dashboard_path
       end
 
       private
 
       def load_current_site
-        @current_site = Alchemy::Site.current
+        @current_site = Alchemy::Current.site
         if @current_site.nil?
           flash[:warning] = Alchemy.t("Please create a site first.")
           do_redirect_to admin_sites_path

data/app/controllers/alchemy/admin/layoutpages_controller.rb

@@ -17,25 +17,6 @@ module Alchemy
       def edit
         @page = Page.find(params[:id])
       end
-
-      def update
-        @page = Page.find(params[:id])
-        if @page.update(page_params)
-          @notice = Alchemy.t("Page saved", name: @page.name)
-          render "alchemy/admin/pages/update"
-        else
-          render :edit, status: :unprocessable_entity
-        end
-      end
-
-      private
-
-      def page_params
-        params.require(:page).permit(
-          :name,
-          :tag_list
-        )
-      end
     end
   end
 end

data/app/controllers/alchemy/admin/legacy_page_urls_controller.rb

@@ -9,13 +9,17 @@ module Alchemy
     end
 
     def create
-      @legacy_page_url = @page.legacy_urls.build(legacy_page_url_params)
-      @legacy_page_url.save
+      @legacy_page_url = @page.legacy_urls.create(legacy_page_url_params)
+      @message = message_for_resource_action
+    end
+
+    def show
     end
 
     def update
       @legacy_page_url = LegacyPageUrl.find(params[:id])
       if @legacy_page_url.update(legacy_page_url_params)
+        @message = message_for_resource_action
         render :update
       else
         render :edit
@@ -23,8 +27,8 @@ module Alchemy
     end
 
     def destroy
-      @legacy_page_url = LegacyPageUrl.find(params[:id])
-      @legacy_page_url.destroy
+      @page.legacy_urls.destroy(@legacy_page_url)
+      @message = message_for_resource_action
     end
 
     private
@@ -33,6 +37,10 @@ module Alchemy
       @page = Page.find(params[:page_id])
     end
 
+    def load_resource
+      @legacy_page_url = LegacyPageUrl.find(params[:id])
+    end
+
     def legacy_page_url_params
       params.require(:legacy_page_url).permit(:urlname)
     end

data/app/controllers/alchemy/admin/nodes_controller.rb

@@ -16,6 +16,32 @@ module Alchemy
         )
       end
 
+      def create
+        if turbo_frame_request?
+          @page = Alchemy::Page.find(resource_params[:page_id])
+          @node = @page.nodes.build(resource_params)
+          if @node.valid?
+            @node.save
+            flash_notice_for_resource_action(:create)
+          else
+            flash[:error] = @node.errors.full_messages.join(", ")
+          end
+        else
+          super
+        end
+      end
+
+      def destroy
+        if turbo_frame_request?
+          @node = Alchemy::Node.find(params[:id])
+          @page = @node.page
+          @page.nodes.destroy(@node)
+          flash_notice_for_resource_action(:destroy)
+        else
+          super
+        end
+      end
+
       private
 
       def resource_params

data/app/controllers/alchemy/admin/pages_controller.rb

@@ -7,11 +7,11 @@ module Alchemy
 
       helper "alchemy/pages"
 
-      before_action :load_resource, except: [:index, :flush, :new, :order, :create, :copy_language_tree, :link]
+      before_action :load_resource, except: [:index, :flush, :new, :create, :copy_language_tree, :link]
 
       authorize_resource class: Alchemy::Page, except: [:index, :tree]
 
-      before_action only: [:index, :tree, :flush, :new, :order, :create, :copy_language_tree] do
+      before_action only: [:index, :tree, :flush, :new, :create, :copy_language_tree] do
         authorize! :index, :alchemy_admin_pages
       end
 
@@ -21,7 +21,7 @@ module Alchemy
         except: [:show]
 
       before_action :set_root_page,
-        only: [:index, :show, :order]
+        only: [:index, :show]
 
       before_action :set_preview_mode, only: [:show]
 
@@ -66,7 +66,7 @@ module Alchemy
       # Used by page preview iframe in Page#edit view.
       #
       def show
-        Page.current_preview = @page
+        Current.preview_page = @page
         # Setting the locale to pages language, so the page content has it's correct translations.
         ::I18n.locale = @page.language.locale
         render(layout: Alchemy::Config.get(:admin_page_preview_layout) || "application")
@@ -112,7 +112,9 @@ module Alchemy
             klass.new(routes: Alchemy::Engine.routes).url_for(@page)
           ]
         end
+        @preview_url = @preview_urls.first.last
         @layoutpage = @page.layoutpage?
+        Alchemy::Current.language = @page.language
       end
 
       # Set page configuration like page names, meta tags and states.
@@ -163,9 +165,7 @@ module Alchemy
       end
 
       def link
-        @attachments = Attachment.all.collect { |f|
-          [f.name, download_attachment_path(id: f.id, name: f.slug)]
-        }
+        render LinkDialog::Tabs.new(**link_dialog_params)
       end
 
       def fold
@@ -189,7 +189,11 @@ module Alchemy
       end
 
       def unlock_redirect_path
-        safe_redirect_path(fallback: admin_pages_path)
+        if params[:redirect_to].to_s.match?(/\A\/admin\/(layout_)?pages/)
+          params[:redirect_to]
+        else
+          admin_pages_path
+        end
       end
 
       # Sets the page public and updates the published_at attribute that is used as cache_key
@@ -208,23 +212,6 @@ module Alchemy
         redirect_to admin_pages_path
       end
 
-      # Receives a JSON object representing a language tree to be ordered
-      # and updates all pages in that language structure to their correct indexes
-      def order
-        neworder = JSON.parse(params[:set])
-        tree = create_tree(neworder, @page_root)
-
-        Alchemy::Page.transaction do
-          tree.each do |key, node|
-            dbitem = Page.find(key)
-            dbitem.update_node!(node)
-          end
-        end
-
-        flash[:notice] = Alchemy.t("Pages order saved")
-        do_redirect_to admin_pages_path
-      end
-
       def flush
         @current_language.pages.flushables.update_all(published_at: Time.current)
         # We need to ensure, that also all layoutpages get the +published_at+ timestamp set,
@@ -257,60 +244,6 @@ module Alchemy
         Page.language_root_for(params[:languages][:old_lang_id])
       end
 
-      # Returns the current left index and the aggregated hash of tree nodes indexed by page id visited so far
-      #
-      # Visits a batch of children nodes, assigns them the correct ordering indexes and spuns recursively the same
-      # procedure on their children, if any
-      #
-      # @param [Array]
-      #   An array of children nodes to be visited
-      # @param [Integer]
-      #   The lft attribute that should be given to the first node in the array
-      # @param [Integer]
-      #   The page id of the parent of this batch of children nodes
-      # @param [Integer]
-      #   The depth at which these children reside
-      # @param [Hash]
-      #   A Hash of TreeNode's indexed by their page ids
-      # @param [String]
-      #   The url for the parent node of these children
-      # @param [Boolean]
-      #   Whether these children reside in a restricted branch according to their ancestors
-      #
-      def visit_nodes(nodes, my_left, parent, depth, tree, url, restricted)
-        nodes.each do |item|
-          my_right = my_left + 1
-          my_restricted = item["restricted"] || restricted
-          urls = process_url(url, item)
-
-          if item["children"]
-            my_right, tree = visit_nodes(item["children"], my_left + 1, item["id"], depth + 1, tree, urls[:children_path], my_restricted)
-          end
-
-          tree[item["id"]] = TreeNode.new(my_left, my_right, parent, depth, urls[:my_urlname], my_restricted)
-          my_left = my_right + 1
-        end
-
-        [my_left, tree]
-      end
-
-      # Returns a Hash of TreeNode's indexed by their page ids
-      #
-      # Grabs the array representing a tree structure of pages passed as a parameter,
-      # visits it and creates a map of TreeNodes indexed by page id featuring Nested Set
-      # ordering information consisting of the left, right, depth and parent_id indexes as
-      # well as a node's url and restricted status
-      #
-      # @param [Array]
-      #   An Array representing a tree of Alchemy::Page's
-      # @param [Alchemy::Page]
-      #   The root page for the language being ordered
-      #
-      def create_tree(items, rootpage)
-        _, tree = visit_nodes(items, rootpage.lft + 1, rootpage.id, rootpage.depth + 1, {}, "", rootpage.restricted)
-        tree
-      end
-
       # Returns a pair, the path that a given tree node should take, and the path its children should take
       #
       # This function will add a node's own slug into their ancestor's path
@@ -351,6 +284,10 @@ module Alchemy
         params.require(:page).permit(*secure_attributes)
       end
 
+      def link_dialog_params
+        params.permit([:url, :selected_tab, :link_title, :link_target])
+      end
+
       def secure_attributes
         if can?(:create, Alchemy::Page)
           Page::PERMITTED_ATTRIBUTES + [:language_root, :parent_id, :language_id, :language_code]

data/app/controllers/alchemy/admin/picture_descriptions_controller.rb

@@ -0,0 +1,15 @@
+module Alchemy
+  module Admin
+    class PictureDescriptionsController < Alchemy::Admin::ResourcesController
+      def edit
+        @picture_description = @picture.descriptions.find_or_initialize_by(language_id: params[:language_id])
+      end
+
+      private
+
+      def load_resource
+        @picture = Alchemy::Picture.find(params[:picture_id])
+      end
+    end
+  end
+end

data/app/controllers/alchemy/admin/pictures_controller.rb

@@ -5,6 +5,7 @@ module Alchemy
     class PicturesController < Alchemy::Admin::ResourcesController
       include UploaderResponses
       include ArchiveOverlay
+      include CurrentLanguage
 
       helper "alchemy/admin/tags"
 
@@ -33,6 +34,9 @@ module Alchemy
         @previous = filtered_pictures.where("name < ?", @picture.name).last
         @next = filtered_pictures.where("name > ?", @picture.name).first
         @assignments = @picture.picture_ingredients.joins(element: :page)
+        @picture_description = @picture.descriptions.find_or_initialize_by(
+          language_id: Alchemy::Current.language.id
+        )
 
         render action: "show"
       end
@@ -193,7 +197,20 @@ module Alchemy
       end
 
       def picture_params
-        params.require(:picture).permit(:image_file, :upload_hash, :name, :tag_list)
+        params.require(:picture).permit(
+          :image_file,
+          :upload_hash,
+          :name,
+          {
+            descriptions_attributes: [
+              :id,
+              :text,
+              :language_id,
+              :picture_id
+            ]
+          },
+          :tag_list
+        )
       end
 
       def picture_url_params

data/app/controllers/alchemy/admin/resources_controller.rb

@@ -78,7 +78,7 @@ module Alchemy
           flash[:error] = resource_instance_variable.errors.full_messages.join(", ")
         end
         flash_notice_for_resource_action
-        do_redirect_to resource_url_proxy.url_for(search_filter_params.merge(action: "index", only_path: true))
+        do_redirect_to resource_url_proxy.url_for(search_filter_params.merge(action: "index"))
       end
 
       def resource_handler
@@ -141,23 +141,28 @@ module Alchemy
         resource_filters.map(&:values).flatten
       end
 
-      # Returns a translated +flash[:notice]+.
-      # The key should look like "Modelname successfully created|updated|destroyed."
-      def flash_notice_for_resource_action(action = params[:action])
+      # Returns a translated +flash[:notice]+ for current controller action.
+      def flash_notice_for_resource_action(action = action_name)
         return if resource_instance_variable.errors.any?
 
+        flash[:notice] = message_for_resource_action(action)
+      end
+
+      # Returns a translated message for a +flash[:notice]+.
+      # The key should look like "Modelname successfully created|updated|destroyed."
+      def message_for_resource_action(action = action_name)
         case action.to_sym
         when :create
-          verb = "created"
+          verb = Alchemy.t("created", scope: "resources.actions")
         when :update
-          verb = "updated"
+          verb = Alchemy.t("updated", scope: "resources.actions")
         when :destroy
-          verb = "removed"
+          verb = Alchemy.t("removed", scope: "resources.actions")
         end
-        flash[:notice] = Alchemy.t(
-          "#{resource_handler.resource_name.classify} successfully #{verb}",
-          default: Alchemy.t("Successfully #{verb}")
-        )
+        Alchemy.t("%{resource_name} successfully %{action}",
+          resource_name: resource_handler.model.model_name.human,
+          action: verb,
+          default: Alchemy.t("Successfully #{verb}"))
       end
 
       def is_alchemy_module?

data/app/controllers/alchemy/api/attachments_controller.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+module Alchemy
+  class Api::AttachmentsController < Api::BaseController
+    def index
+      authorize! :index, Attachment
+
+      @attachments = Attachment.all
+      @attachments = @attachments.ransack(params[:q]).result
+
+      if params[:page]
+        @attachments = @attachments.page(params[:page]).per(params[:per_page])
+      end
+
+      render json: @attachments, adapter: :json, root: "data", meta: meta_data
+    end
+
+    private
+
+    def meta_data
+      {
+        total_count: total_count_value,
+        per_page: per_page_value,
+        page: page_value
+      }
+    end
+
+    def total_count_value
+      params[:page] ? @attachments.total_count : @attachments.size
+    end
+
+    def per_page_value
+      if params[:page]
+        (params[:per_page] || Kaminari.config.default_per_page).to_i
+      else
+        @attachments.size
+      end
+    end
+
+    def page_value
+      params[:page] ? params[:page].to_i : 1
+    end
+  end
+end

data/app/controllers/alchemy/api/pages_controller.rb

@@ -49,9 +49,13 @@ module Alchemy
     def move
       @page = Page.find(params[:id])
       authorize! :update, @page
-      target_parent_page = Page.find(params[:target_parent_id])
-      @page.move_to_child_with_index(target_parent_page, params[:new_position])
-      render json: @page, serializer: PageSerializer
+      begin
+        target_parent_page = Page.find(params[:target_parent_id])
+        @page.move_to_child_with_index(target_parent_page, params[:new_position])
+        render json: @page, serializer: PageNodeSerializer
+      rescue => err
+        render json: {message: err.message}, status: 422
+      end
     end
 
     private
@@ -66,11 +70,11 @@ module Alchemy
     end
 
     def load_page_by_urlname
-      return unless Language.current
+      return unless Current.language
 
-      Language.current.pages.where(
+      Current.language.pages.where(
         urlname: params[:urlname],
-        language_code: params[:locale] || Language.current.code
+        language_code: params[:locale] || Current.language.code
       ).includes(page_includes).first
     end
 

data/app/controllers/alchemy/base_controller.rb

@@ -25,9 +25,9 @@ module Alchemy
     # Sets +I18n.locale+ to current Alchemy language.
     #
     def set_locale
-      return unless Language.current
+      return unless Current.language
 
-      ::I18n.locale = Language.current&.locale
+      ::I18n.locale = Current.language&.locale
     end
 
     def not_found_error!(msg = "Not found \"#{request.fullpath}\"")

data/app/controllers/alchemy/messages_controller.rb

@@ -97,9 +97,9 @@ module Alchemy
       else
         Language.current_root_page.urlname
       end
-      redirect_to alchemy.show_page_path(
+      redirect_to show_page_path(
         urlname: urlname,
-        locale: prefix_locale? ? Language.current.code : nil
+        locale: prefix_locale? ? Current.language.code : nil
       )
     end
 
@@ -117,7 +117,7 @@ module Alchemy
     end
 
     def get_page
-      @page = Language.current.pages.find_by(page_layout: mailer_config["page_layout_name"])
+      @page = Current.language.pages.find_by(page_layout: mailer_config["page_layout_name"])
       if @page.blank?
         raise "Page for page_layout #{mailer_config["page_layout_name"]} not found"
       end

data/app/controllers/alchemy/pages_controller.rb

@@ -105,6 +105,7 @@ module Alchemy
     #
     def load_index_page
       @page ||= Language.current_root_page
+      Current.page = @page
       render template: "alchemy/welcome", layout: false if signup_required?
     end
 
@@ -118,16 +119,17 @@ module Alchemy
     # @return NilClass
     #
     def load_page
-      page_not_found! unless Language.current
+      page_not_found! unless Current.language
 
-      @page ||= Language.current.pages.contentpages.find_by(
+      @page ||= Current.language.pages.contentpages.find_by(
         urlname: params[:urlname],
-        language_code: params[:locale] || Language.current.code
+        language_code: params[:locale] || Current.language.code
       )
+      Current.page = @page
     end
 
     def enforce_locale
-      redirect_permanently_to page_locale_redirect_url(locale: Language.current.code)
+      redirect_permanently_to page_locale_redirect_url(locale: Current.language.code)
     end
 
     def locale_prefix_missing?
@@ -135,7 +137,7 @@ module Alchemy
     end
 
     def default_locale?
-      Language.current.code.to_sym == ::I18n.default_locale.to_sym
+      Current.language.code.to_sym == ::I18n.default_locale.to_sym
     end
 
     # Page url with or without locale while keeping all additional params
@@ -214,7 +216,7 @@ module Alchemy
     def render_fresh_page?
       must_not_cache? || stale?(
         etag: page_etag,
-        last_modified: @page.published_at,
+        last_modified: @page.last_modified_at,
         public: !@page.restricted,
         template: "pages/show"
       )

data/app/controllers/concerns/alchemy/admin/current_language.rb

@@ -6,26 +6,16 @@ module Alchemy
       extend ActiveSupport::Concern
 
       included do
-        # This needs to happen before BaseController#current_alchemy_site sets the session value.
-        prepend_before_action :clear_current_language_from_session, if: :switching_site?, only: :index
         before_action :load_current_language
       end
 
       private
 
-      def switching_site?
-        params[:site_id].present? && (params[:site_id] != session[:alchemy_site_id]&.to_s)
-      end
-
-      def clear_current_language_from_session
-        session.delete(:alchemy_language_id)
-      end
-
       def load_current_language
         @current_language = if session[:alchemy_language_id].present?
           set_alchemy_language(session[:alchemy_language_id])
         else
-          Alchemy::Language.current
+          Current.language
         end
         if @current_language.nil?
           flash[:warning] = Alchemy.t("Please create a language first.")

data/app/controllers/concerns/alchemy/legacy_page_redirects.rb

@@ -46,7 +46,7 @@ module Alchemy
       LegacyPageUrl.joins(:page).where(
         :urlname => urlname,
         Page.table_name => {
-          language_id: Language.current.id
+          language_id: Current.language.id
         }
       )
     end

data/app/decorators/alchemy/element_editor.rb

@@ -59,8 +59,8 @@ module Alchemy
         compact? ? "compact" : nil,
         deprecated? ? "deprecated" : nil,
         fixed? ? "is-fixed" : "not-fixed",
-        public? ? "visible" : "hidden"
-      ].join(" ")
+        public? ? nil : "element-hidden"
+      ]
     end
 
     # Tells us, if we should show the element footer and form inputs.