alchemy_cms 7.4.15 → 7.4.16

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 820ced84f65c22ce14dcf2d399bb78fb7463bc311d56ebec29b9106d9b168eb8
-  data.tar.gz: 6760e300fe2497a33e1a657cb6792dcd535343ddedb6897831f18569a6ea2b49
+  metadata.gz: d0a06fcd96871af12f69f0fc6ce8fca812e488cb8f237422b0d96d698b93e5d0
+  data.tar.gz: 9efa2b94685991f66d48f4a252b7386003e351a3f13c6ff4edfe4e020eb54ffc
 SHA512:
-  metadata.gz: 2862492de3c1bc9c3e4bf30a7a6127af4dcd8eb11f02914806469f0c22de6936b8b2ba5cda736737f98de0ec7c950e0d3042dec785befe69018130bd118e6767
-  data.tar.gz: 73f531a006df56e276c378765346e537f216f7a4ed7ca641e3520ac12f5bf56cdc980a27c1872ce581c6dd50d3bc323a2bdb76baeca0742ce1c5456afabb7805
+  metadata.gz: 249f19b6adb1ac0e372969eeea89c475410490da05bb29d01450efd38b4c58d8ab4d819956391956ce8bc8fcc660b872cdf4793ffe17a5b0dee386d18cbb910a
+  data.tar.gz: 9ac152930b4533aa7598c069864f77f56d72178a56f114496d6fee66220639b84dc8aaf648d70e8b86bac79ab3ae201b5b9154094ef2a9dfc5dee8c4d7de7dd9

data/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 7.4.16 (2026-07-28)
+
+## What's Changed
+* [7.4] authorize nodes#index to prevent navigation tree disclosure by @tvdeyen in https://github.com/AlchemyCMS/alchemy_cms/pull/4099
+
+
+**Full Changelog**: https://github.com/AlchemyCMS/alchemy_cms/compare/v7.4.15...v7.4.16
+
 ## 7.4.15 (2026-06-18)
 
 ## What's Changed

data/app/controllers/alchemy/api/nodes_controller.rb

@@ -6,7 +6,7 @@ module Alchemy
     before_action :authorize_access, only: [:move, :toggle_folded]
 
     def index
-      @nodes = Node.all
+      @nodes = Node.accessible_by(current_ability, :index)
       @nodes = @nodes.includes(:parent)
       @nodes = @nodes.where(language_id: params[:language_id]) if params[:language_id]
       @nodes = @nodes.ransack(params[:filter]).result.order(:lft)

data/app/models/alchemy/node.rb

@@ -19,6 +19,27 @@ module Alchemy
       foreign_key: :related_object_id,
       inverse_of: :related_object
 
+    # All nodes of the current site whose language is published.
+    scope :from_current_public_site, -> {
+      joins(:language)
+        .where(Alchemy::Language.table_name => {site_id: Alchemy::Current.site})
+        .merge(Alchemy::Language.published)
+    }
+
+    # Nodes an anonymous visitor may see: external links or nodes attached to a
+    # published, unrestricted page, scoped to the current site.
+    scope :available_to_guests, -> {
+      from_current_public_site.where(page: nil)
+        .or(from_current_public_site.where(page: Alchemy::Page.published.not_restricted))
+    }
+
+    # Like #available_to_guests but including nodes attached to restricted pages,
+    # which logged in members are allowed to see.
+    scope :available_to_members, -> {
+      from_current_public_site.where(page: nil)
+        .or(from_current_public_site.where(page: Alchemy::Page.published))
+    }
+
     before_validation :translate_root_menu_name, if: -> { root? }
     before_validation :set_menu_type_from_root, unless: -> { root? }
 

data/lib/alchemy/permissions.rb

@@ -44,6 +44,11 @@ module Alchemy
         can :read, Alchemy::Page, Alchemy::Page.published.not_restricted.from_current_site do |p|
           p.public? && !p.restricted? && p.site == Alchemy::Current.site
         end
+
+        can :read, Alchemy::Node, Alchemy::Node.available_to_guests do |node|
+          node.language.public? && node.language.site_id == Alchemy::Current.site&.id &&
+            (node.page.nil? || (node.page.public? && !node.page.restricted?))
+        end
       end
     end
 
@@ -67,6 +72,11 @@ module Alchemy
         can :read, Alchemy::Page, Alchemy::Page.published.from_current_site do |p|
           p.public? && p.site == Alchemy::Current.site
         end
+
+        can :read, Alchemy::Node, Alchemy::Node.available_to_members do |node|
+          node.language.public? && node.language.site_id == Alchemy::Current.site&.id &&
+            (node.page.nil? || node.page.public?)
+        end
       end
     end
 

data/lib/alchemy/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module Alchemy
-  VERSION = "7.4.15"
+  VERSION = "7.4.16"
 
   def self.version
     VERSION

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: alchemy_cms
 version: !ruby/object:Gem::Version
-  version: 7.4.15
+  version: 7.4.16
 platform: ruby
 authors:
 - Thomas von Deyen
@@ -1409,7 +1409,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements:
 - ImageMagick (libmagick), v6.6 or greater.
-rubygems_version: 4.0.10
+rubygems_version: 4.0.16
 specification_version: 4
 summary: A powerful, userfriendly and flexible CMS for Rails
 test_files: []