alchemy_cms 7.4.14 → 7.4.15

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 077c54f0dbbd27c0de4c42ba39eb7c3aa79309c6dfff2f22db2c4dbbd6c4ba77
-  data.tar.gz: 3e07a946b0692a2b93e9d175fe33c1933604228c60f541d753e37849eab452b1
+  metadata.gz: 820ced84f65c22ce14dcf2d399bb78fb7463bc311d56ebec29b9106d9b168eb8
+  data.tar.gz: 6760e300fe2497a33e1a657cb6792dcd535343ddedb6897831f18569a6ea2b49
 SHA512:
-  metadata.gz: bfaaa49962d68073188b6d2a384babc691e087d7ba5554f0362809f273ac61a72ee6ca9b3aad8e14551847f7a046ef6328def9e506aaee909e3a910f0a9aebfa
-  data.tar.gz: 0acfea518110808170b2d3d3d01ec03f0e1eddf7ff52a5ab3331572471b0618087e84dafb66f0393bb43e6c15f54f549b1a312f0bdb26ff9002d5d72fcbeb543
+  metadata.gz: 2862492de3c1bc9c3e4bf30a7a6127af4dcd8eb11f02914806469f0c22de6936b8b2ba5cda736737f98de0ec7c950e0d3042dec785befe69018130bd118e6767
+  data.tar.gz: 73f531a006df56e276c378765346e537f216f7a4ed7ca641e3520ac12f5bf56cdc980a27c1872ce581c6dd50d3bc323a2bdb76baeca0742ce1c5456afabb7805

data/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 7.4.15 (2026-06-18)
+
+## What's Changed
+* [7.4] Fix double form submission in picture overlay by @tvdeyen in https://github.com/AlchemyCMS/alchemy_cms/pull/3825
+* [7.4] fix(api): authorize nested pages endpoint against restricted content by @tvdeyen in https://github.com/AlchemyCMS/alchemy_cms/pull/3983
+
+
+**Full Changelog**: https://github.com/AlchemyCMS/alchemy_cms/compare/v7.4.14...v7.4.15
+
 ## 7.4.14 (2026-03-26)
 
 ## What's Changed

data/Gemfile

@@ -16,6 +16,7 @@ end
 gem "pg", "~> 1.0" if ENV["DB"] == "postgresql"
 
 gem "alchemy_i18n", git: "https://github.com/AlchemyCMS/alchemy_i18n.git", branch: "4.2-stable"
+gem "i18n", "< 1.15" # >= 1.15 needs Ruby 3.2, but we still support Ruby 3.1
 
 group :development, :test do
   gem "execjs", "~> 2.9.1"

data/app/controllers/alchemy/api/pages_controller.rb

@@ -28,6 +28,8 @@ module Alchemy
     def nested
       @page = Page.find_by(id: params[:page_id]) || Language.current_root_page
 
+      authorize! :show, @page
+
       render json: PageTreeSerializer.new(
         @page,
         ability: current_ability,

data/app/serializers/alchemy/page_tree_serializer.rb

@@ -9,7 +9,21 @@ module Alchemy
     def pages
       tree = []
       path = [{id: object.parent_id, children: tree}]
-      page_list = object.self_and_descendants.includes(:public_version, {language: :site})
+      page_list = object.self_and_descendants
+        .accessible_by(opts[:ability], :read)
+        .includes(:public_version, {language: :site})
+        .to_a
+      # Drop pages whose parent was filtered out by the ability, so a
+      # restricted or unpublished branch does not leak its accessible
+      # descendants. self_and_descendants is ordered pre-order, so a parent
+      # always precedes its children and a single pass is sufficient.
+      kept_ids = Set.new([object.id])
+      page_list = page_list.select do |page|
+        next true if page.id == object.id
+        kept_ids.include?(page.parent_id).tap do |kept|
+          kept_ids << page.id if kept
+        end
+      end
       base_level = object.level - 1
       # Load folded pages in advance
       folded_user_pages = FoldedPage.folded_for_user(opts[:user]).pluck(:page_id)
@@ -83,6 +97,8 @@ module Alchemy
     end
 
     def page_elements(page)
+      return Alchemy::Element.none unless opts[:ability].can?(:read, page)
+
       elements = page.public_version&.elements || Alchemy::Element.none
       if opts[:elements] == "true"
         elements

data/app/views/alchemy/admin/pictures/_form.html.erb

@@ -1,5 +1,5 @@
 <%= turbo_frame_tag(@picture) do %>
-  <%= alchemy_form_for [alchemy, :admin, @picture] do |f| %>
+  <%= alchemy_form_for [alchemy, :admin, @picture], remote: false do |f| %>
     <%= f.input :name %>
     <%= render "alchemy/admin/pictures/picture_description_field", f: f %>
     <%= render Alchemy::Admin::TagsAutocomplete.new(additional_class: "input") do %>

data/lib/alchemy/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module Alchemy
-  VERSION = "7.4.14"
+  VERSION = "7.4.15"
 
   def self.version
     VERSION

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: alchemy_cms
 version: !ruby/object:Gem::Version
-  version: 7.4.14
+  version: 7.4.15
 platform: ruby
 authors:
 - Thomas von Deyen
@@ -1409,7 +1409,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements:
 - ImageMagick (libmagick), v6.6 or greater.
-rubygems_version: 4.0.6
+rubygems_version: 4.0.10
 specification_version: 4
 summary: A powerful, userfriendly and flexible CMS for Rails
 test_files: []