alchemy_cms 7.4.14 → 7.4.16

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 077c54f0dbbd27c0de4c42ba39eb7c3aa79309c6dfff2f22db2c4dbbd6c4ba77
-  data.tar.gz: 3e07a946b0692a2b93e9d175fe33c1933604228c60f541d753e37849eab452b1
+  metadata.gz: d0a06fcd96871af12f69f0fc6ce8fca812e488cb8f237422b0d96d698b93e5d0
+  data.tar.gz: 9efa2b94685991f66d48f4a252b7386003e351a3f13c6ff4edfe4e020eb54ffc
 SHA512:
-  metadata.gz: bfaaa49962d68073188b6d2a384babc691e087d7ba5554f0362809f273ac61a72ee6ca9b3aad8e14551847f7a046ef6328def9e506aaee909e3a910f0a9aebfa
-  data.tar.gz: 0acfea518110808170b2d3d3d01ec03f0e1eddf7ff52a5ab3331572471b0618087e84dafb66f0393bb43e6c15f54f549b1a312f0bdb26ff9002d5d72fcbeb543
+  metadata.gz: 249f19b6adb1ac0e372969eeea89c475410490da05bb29d01450efd38b4c58d8ab4d819956391956ce8bc8fcc660b872cdf4793ffe17a5b0dee386d18cbb910a
+  data.tar.gz: 9ac152930b4533aa7598c069864f77f56d72178a56f114496d6fee66220639b84dc8aaf648d70e8b86bac79ab3ae201b5b9154094ef2a9dfc5dee8c4d7de7dd9

data/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## 7.4.16 (2026-07-28)
+
+## What's Changed
+* [7.4] authorize nodes#index to prevent navigation tree disclosure by @tvdeyen in https://github.com/AlchemyCMS/alchemy_cms/pull/4099
+
+
+**Full Changelog**: https://github.com/AlchemyCMS/alchemy_cms/compare/v7.4.15...v7.4.16
+
+## 7.4.15 (2026-06-18)
+
+## What's Changed
+* [7.4] Fix double form submission in picture overlay by @tvdeyen in https://github.com/AlchemyCMS/alchemy_cms/pull/3825
+* [7.4] fix(api): authorize nested pages endpoint against restricted content by @tvdeyen in https://github.com/AlchemyCMS/alchemy_cms/pull/3983
+
+
+**Full Changelog**: https://github.com/AlchemyCMS/alchemy_cms/compare/v7.4.14...v7.4.15
+
 ## 7.4.14 (2026-03-26)
 
 ## What's Changed

data/Gemfile

@@ -16,6 +16,7 @@ end
 gem "pg", "~> 1.0" if ENV["DB"] == "postgresql"
 
 gem "alchemy_i18n", git: "https://github.com/AlchemyCMS/alchemy_i18n.git", branch: "4.2-stable"
+gem "i18n", "< 1.15" # >= 1.15 needs Ruby 3.2, but we still support Ruby 3.1
 
 group :development, :test do
   gem "execjs", "~> 2.9.1"

data/app/controllers/alchemy/api/nodes_controller.rb

@@ -6,7 +6,7 @@ module Alchemy
     before_action :authorize_access, only: [:move, :toggle_folded]
 
     def index
-      @nodes = Node.all
+      @nodes = Node.accessible_by(current_ability, :index)
       @nodes = @nodes.includes(:parent)
       @nodes = @nodes.where(language_id: params[:language_id]) if params[:language_id]
       @nodes = @nodes.ransack(params[:filter]).result.order(:lft)

data/app/controllers/alchemy/api/pages_controller.rb

@@ -28,6 +28,8 @@ module Alchemy
     def nested
       @page = Page.find_by(id: params[:page_id]) || Language.current_root_page
 
+      authorize! :show, @page
+
       render json: PageTreeSerializer.new(
         @page,
         ability: current_ability,

data/app/models/alchemy/node.rb

@@ -19,6 +19,27 @@ module Alchemy
       foreign_key: :related_object_id,
       inverse_of: :related_object
 
+    # All nodes of the current site whose language is published.
+    scope :from_current_public_site, -> {
+      joins(:language)
+        .where(Alchemy::Language.table_name => {site_id: Alchemy::Current.site})
+        .merge(Alchemy::Language.published)
+    }
+
+    # Nodes an anonymous visitor may see: external links or nodes attached to a
+    # published, unrestricted page, scoped to the current site.
+    scope :available_to_guests, -> {
+      from_current_public_site.where(page: nil)
+        .or(from_current_public_site.where(page: Alchemy::Page.published.not_restricted))
+    }
+
+    # Like #available_to_guests but including nodes attached to restricted pages,
+    # which logged in members are allowed to see.
+    scope :available_to_members, -> {
+      from_current_public_site.where(page: nil)
+        .or(from_current_public_site.where(page: Alchemy::Page.published))
+    }
+
     before_validation :translate_root_menu_name, if: -> { root? }
     before_validation :set_menu_type_from_root, unless: -> { root? }
 

data/app/serializers/alchemy/page_tree_serializer.rb

@@ -9,7 +9,21 @@ module Alchemy
     def pages
       tree = []
       path = [{id: object.parent_id, children: tree}]
-      page_list = object.self_and_descendants.includes(:public_version, {language: :site})
+      page_list = object.self_and_descendants
+        .accessible_by(opts[:ability], :read)
+        .includes(:public_version, {language: :site})
+        .to_a
+      # Drop pages whose parent was filtered out by the ability, so a
+      # restricted or unpublished branch does not leak its accessible
+      # descendants. self_and_descendants is ordered pre-order, so a parent
+      # always precedes its children and a single pass is sufficient.
+      kept_ids = Set.new([object.id])
+      page_list = page_list.select do |page|
+        next true if page.id == object.id
+        kept_ids.include?(page.parent_id).tap do |kept|
+          kept_ids << page.id if kept
+        end
+      end
       base_level = object.level - 1
       # Load folded pages in advance
       folded_user_pages = FoldedPage.folded_for_user(opts[:user]).pluck(:page_id)
@@ -83,6 +97,8 @@ module Alchemy
     end
 
     def page_elements(page)
+      return Alchemy::Element.none unless opts[:ability].can?(:read, page)
+
       elements = page.public_version&.elements || Alchemy::Element.none
       if opts[:elements] == "true"
         elements

data/app/views/alchemy/admin/pictures/_form.html.erb

@@ -1,5 +1,5 @@
 <%= turbo_frame_tag(@picture) do %>
-  <%= alchemy_form_for [alchemy, :admin, @picture] do |f| %>
+  <%= alchemy_form_for [alchemy, :admin, @picture], remote: false do |f| %>
     <%= f.input :name %>
     <%= render "alchemy/admin/pictures/picture_description_field", f: f %>
     <%= render Alchemy::Admin::TagsAutocomplete.new(additional_class: "input") do %>

data/lib/alchemy/permissions.rb

@@ -44,6 +44,11 @@ module Alchemy
         can :read, Alchemy::Page, Alchemy::Page.published.not_restricted.from_current_site do |p|
           p.public? && !p.restricted? && p.site == Alchemy::Current.site
         end
+
+        can :read, Alchemy::Node, Alchemy::Node.available_to_guests do |node|
+          node.language.public? && node.language.site_id == Alchemy::Current.site&.id &&
+            (node.page.nil? || (node.page.public? && !node.page.restricted?))
+        end
       end
     end
 
@@ -67,6 +72,11 @@ module Alchemy
         can :read, Alchemy::Page, Alchemy::Page.published.from_current_site do |p|
           p.public? && p.site == Alchemy::Current.site
         end
+
+        can :read, Alchemy::Node, Alchemy::Node.available_to_members do |node|
+          node.language.public? && node.language.site_id == Alchemy::Current.site&.id &&
+            (node.page.nil? || node.page.public?)
+        end
       end
     end
 

data/lib/alchemy/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module Alchemy
-  VERSION = "7.4.14"
+  VERSION = "7.4.16"
 
   def self.version
     VERSION

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: alchemy_cms
 version: !ruby/object:Gem::Version
-  version: 7.4.14
+  version: 7.4.16
 platform: ruby
 authors:
 - Thomas von Deyen
@@ -1409,7 +1409,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements:
 - ImageMagick (libmagick), v6.6 or greater.
-rubygems_version: 4.0.6
+rubygems_version: 4.0.16
 specification_version: 4
 summary: A powerful, userfriendly and flexible CMS for Rails
 test_files: []