alchemy_cms 7.4.13 → 7.4.15

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 27f806a1a21492486b1f8bc57ecb2d38c23064f6bf39b489426b1f916b244165
-  data.tar.gz: cdd3d19162be0606e8d8a91b00a2ee207670c8dd1065e9a886b832295316b4c8
+  metadata.gz: 820ced84f65c22ce14dcf2d399bb78fb7463bc311d56ebec29b9106d9b168eb8
+  data.tar.gz: 6760e300fe2497a33e1a657cb6792dcd535343ddedb6897831f18569a6ea2b49
 SHA512:
-  metadata.gz: 8e6605933d4e61657bb83dad115f4c29ab676c6eae1df863af973deddedb4c289d8b8b45358b9880aba5ff14b8d73a89a48d9dabc65a721a760c96e3d0d4ce5f
-  data.tar.gz: 90cd853afa25f55975d091f57d7c1d4a769f2f6b2ed12a31b201f9d2038f8ab7507b8a046d8e62cce8b81820beea07a60c33c8946c6d2c93f7c1b0713281b250
+  metadata.gz: 2862492de3c1bc9c3e4bf30a7a6127af4dcd8eb11f02914806469f0c22de6936b8b2ba5cda736737f98de0ec7c950e0d3042dec785befe69018130bd118e6767
+  data.tar.gz: 73f531a006df56e276c378765346e537f216f7a4ed7ca641e3520ac12f5bf56cdc980a27c1872ce581c6dd50d3bc323a2bdb76baeca0742ce1c5456afabb7805

data/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## 7.4.15 (2026-06-18)
+
+## What's Changed
+* [7.4] Fix double form submission in picture overlay by @tvdeyen in https://github.com/AlchemyCMS/alchemy_cms/pull/3825
+* [7.4] fix(api): authorize nested pages endpoint against restricted content by @tvdeyen in https://github.com/AlchemyCMS/alchemy_cms/pull/3983
+
+
+**Full Changelog**: https://github.com/AlchemyCMS/alchemy_cms/compare/v7.4.14...v7.4.15
+
+## 7.4.14 (2026-03-26)
+
+## What's Changed
+* [7.4-stable] Fix exception in admin when current language is deleted by @alchemycms-bot[bot] in https://github.com/AlchemyCMS/alchemy_cms/pull/3791
+
+
+**Full Changelog**: https://github.com/AlchemyCMS/alchemy_cms/compare/v7.4.13...v7.4.14
+
 ## 7.4.13 (2026-02-17)
 
 ## What's Changed

data/Gemfile

@@ -16,6 +16,7 @@ end
 gem "pg", "~> 1.0" if ENV["DB"] == "postgresql"
 
 gem "alchemy_i18n", git: "https://github.com/AlchemyCMS/alchemy_i18n.git", branch: "4.2-stable"
+gem "i18n", "< 1.15" # >= 1.15 needs Ruby 3.2, but we still support Ruby 3.1
 
 group :development, :test do
   gem "execjs", "~> 2.9.1"

data/app/controllers/alchemy/admin/languages_controller.rb

@@ -30,6 +30,9 @@ module Alchemy
 
       def destroy
         if @language.destroy
+          if session[:alchemy_language_id] == @language.id
+            session.delete(:alchemy_language_id)
+          end
           flash[:notice] = Alchemy.t("Language successfully removed")
         else
           flash[:warning] = @language.errors.full_messages.to_sentence

data/app/controllers/alchemy/api/pages_controller.rb

@@ -28,6 +28,8 @@ module Alchemy
     def nested
       @page = Page.find_by(id: params[:page_id]) || Language.current_root_page
 
+      authorize! :show, @page
+
       render json: PageTreeSerializer.new(
         @page,
         ability: current_ability,

data/app/models/alchemy/language/code.rb

@@ -13,6 +13,7 @@ module Alchemy::Language::Code
 
   module ClassMethods
     def find_by_code(code)
+      return unless code.respond_to?(:split)
       codes = code.split("-")
       codes << "" if codes.length == 1
       on_current_site.find_by(

data/app/serializers/alchemy/page_tree_serializer.rb

@@ -9,7 +9,21 @@ module Alchemy
     def pages
       tree = []
       path = [{id: object.parent_id, children: tree}]
-      page_list = object.self_and_descendants.includes(:public_version, {language: :site})
+      page_list = object.self_and_descendants
+        .accessible_by(opts[:ability], :read)
+        .includes(:public_version, {language: :site})
+        .to_a
+      # Drop pages whose parent was filtered out by the ability, so a
+      # restricted or unpublished branch does not leak its accessible
+      # descendants. self_and_descendants is ordered pre-order, so a parent
+      # always precedes its children and a single pass is sufficient.
+      kept_ids = Set.new([object.id])
+      page_list = page_list.select do |page|
+        next true if page.id == object.id
+        kept_ids.include?(page.parent_id).tap do |kept|
+          kept_ids << page.id if kept
+        end
+      end
       base_level = object.level - 1
       # Load folded pages in advance
       folded_user_pages = FoldedPage.folded_for_user(opts[:user]).pluck(:page_id)
@@ -83,6 +97,8 @@ module Alchemy
     end
 
     def page_elements(page)
+      return Alchemy::Element.none unless opts[:ability].can?(:read, page)
+
       elements = page.public_version&.elements || Alchemy::Element.none
       if opts[:elements] == "true"
         elements

data/app/views/alchemy/admin/pictures/_form.html.erb

@@ -1,5 +1,5 @@
 <%= turbo_frame_tag(@picture) do %>
-  <%= alchemy_form_for [alchemy, :admin, @picture] do |f| %>
+  <%= alchemy_form_for [alchemy, :admin, @picture], remote: false do |f| %>
     <%= f.input :name %>
     <%= render "alchemy/admin/pictures/picture_description_field", f: f %>
     <%= render Alchemy::Admin::TagsAutocomplete.new(additional_class: "input") do %>

data/lib/alchemy/controller_actions.rb

@@ -80,7 +80,8 @@ module Alchemy
 
     def load_alchemy_language_from_id_or_code(id_or_code)
       Language.find_by(id: id_or_code) ||
-        Language.find_by_code(id_or_code)
+        Language.find_by_code(id_or_code) ||
+        Language.default
     end
 
     # Stores language in +Current.language+

data/lib/alchemy/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module Alchemy
-  VERSION = "7.4.13"
+  VERSION = "7.4.15"
 
   def self.version
     VERSION

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: alchemy_cms
 version: !ruby/object:Gem::Version
-  version: 7.4.13
+  version: 7.4.15
 platform: ruby
 authors:
 - Thomas von Deyen
@@ -1409,7 +1409,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements:
 - ImageMagick (libmagick), v6.6 or greater.
-rubygems_version: 4.0.3
+rubygems_version: 4.0.10
 specification_version: 4
 summary: A powerful, userfriendly and flexible CMS for Rails
 test_files: []