alchemy_cms 7.4.9 → 7.4.10

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 599bd5102e32131bf2e09816138effbe10a42f7a566b20d546daa5b9d10d6005
-  data.tar.gz: ad5ae57a1ca11863b2467fa36fc4f87289b077e652e2de6b1e039f085255adf2
+  metadata.gz: 6bad48bb119901cb52a788e4eff97309b416af2dc7e8a696b82b679f835df987
+  data.tar.gz: 06f164f3d85053c79f9af5c60e5bcaa8f8bb9398007ed02bf381ce3f192b7e1c
 SHA512:
-  metadata.gz: 2271fbba51fd74d0019764845a54a892ed896276a57c516b2b2261d6bc00ab02c2c13f4f71e02cd1b227f4a94ed08b262b72f0fac08dcadb114499e6a9021ffa
-  data.tar.gz: c1ddedb6f0fc7d326b34ef88042aa505c4e6a882c0984a7fb728ae1d795d90f3ec16b6b8e00da450d70ef6f70576ab20f8bdc29224867f29ffd8a86c92d97982
+  metadata.gz: 37d2a38d099106c06f14914d8ed1e266b61d0ccb9efd50396e3dd8a9f824d0f802b2341152cd498450acec9643240d1d4f5edc51f735ebbd931edaddb2301996
+  data.tar.gz: d89e896f9a6a8584e302c41a7507abb59901f32bb5e1895368f4b9c5b52b541d7893dec7e9f13ebb8dd8ec96482139604b7955b84c1c132ca8ef015c74e52328

data/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 7.4.10 (2025-10-02)
+
+- [7.4-stable] Fix admin page preview permissions [#3389](https://github.com/AlchemyCMS/alchemy_cms/pull/3389) ([alchemycms-bot](https://github.com/alchemycms-bot))
+- [7.4] Sanititze filenames before upload [#3375](https://github.com/AlchemyCMS/alchemy_cms/pull/3375) ([tvdeyen](https://github.com/tvdeyen))
+- [7.4] Allow importmap-rails v2.0 [#3374](https://github.com/AlchemyCMS/alchemy_cms/pull/3374) ([tvdeyen](https://github.com/tvdeyen))
+
 ## 7.4.9 (2025-09-04)
 
 - [7.4-stable] Alchemy TinyMCE: Remove frontend presence validation [#3361](https://github.com/AlchemyCMS/alchemy_cms/pull/3361) ([alchemycms-bot](https://github.com/alchemycms-bot))

data/alchemy_cms.gemspec

@@ -40,7 +40,7 @@ Gem::Specification.new do |gem|
   gem.add_runtime_dependency "dragonfly", ["~> 1.4"]
   gem.add_runtime_dependency "dragonfly_svg", ["~> 0.0.4"]
   gem.add_runtime_dependency "gutentag", ["~> 2.2", ">= 2.2.1"]
-  gem.add_runtime_dependency "importmap-rails", ["~> 1.2", ">= 1.2.1"]
+  gem.add_runtime_dependency "importmap-rails", [">= 1.2.1", "< 3.0"]
   gem.add_runtime_dependency "kaminari", ["~> 1.1"]
   gem.add_runtime_dependency "originator", ["~> 3.1"]
   gem.add_runtime_dependency "ransack", [">= 1.8", "< 5.0"]

data/app/controllers/alchemy/admin/pages_controller.rb

@@ -66,6 +66,8 @@ module Alchemy
       # Used by page preview iframe in Page#edit view.
       #
       def show
+        authorize! :edit_content, @page
+
         Current.preview_page = @page
         # Setting the locale to pages language, so the page content has it's correct translations.
         ::I18n.locale = @page.language.locale

data/app/helpers/alchemy/pages_helper.rb

@@ -163,7 +163,7 @@ module Alchemy
     end
 
     def meta_robots
-      "#{@page.robot_index? ? "" : "no"}index, #{@page.robot_follow? ? "" : "no"}follow"
+      "#{"no" unless @page.robot_index?}index, #{"no" unless @page.robot_follow?}follow"
     end
 
     private

data/app/models/alchemy/attachment.rb

@@ -96,6 +96,7 @@ module Alchemy
       message: Alchemy.t("not a valid file"),
       unless: -> { self.class.allowed_filetypes.include?("*") }
 
+    before_save :sanitize_file_name
     before_save :set_name, if: :file_name_changed?
 
     scope :with_file_type, ->(file_type) { where(file_mime_type: file_type) }
@@ -156,6 +157,10 @@ module Alchemy
 
     private
 
+    def sanitize_file_name
+      self.file_name = sanitized_filename(file_name)
+    end
+
     def set_name
       self.name = convert_to_humanized_name(file_name, file.ext)
     end

data/app/models/alchemy/page/page_naming.rb

@@ -5,6 +5,7 @@ module Alchemy
     module PageNaming
       extend ActiveSupport::Concern
       include NameConversions
+
       RESERVED_URLNAMES = %w[admin messages new]
 
       included do

data/app/models/alchemy/picture.rb

@@ -94,6 +94,7 @@ module Alchemy
       end
     end
 
+    before_save :sanitize_image_file_name
     # Create important thumbnails upfront
     after_create -> { PictureThumb.generate_thumbs!(self) if has_convertible_format? }
 
@@ -312,5 +313,9 @@ module Alchemy
     def image_file_dimensions
       "#{image_file_width}x#{image_file_height}"
     end
+
+    def sanitize_image_file_name
+      self.image_file_name = sanitized_filename(image_file_name)
+    end
   end
 end

data/app/models/alchemy/site/layout.rb

@@ -3,6 +3,7 @@
 module Alchemy
   module Site::Layout
     extend ActiveSupport::Concern
+
     SITE_DEFINITIONS_FILE = Rails.root.join("config/alchemy/site_layouts.yml")
 
     module ClassMethods

data/lib/alchemy/name_conversions.rb

@@ -22,5 +22,11 @@ module Alchemy
     def convert_to_humanized_name(name, suffix)
       name.gsub(/\.#{::Regexp.quote(suffix)}$/i, "").tr("_", " ").strip
     end
+
+    # Sanitizes a given filename by removing directory traversal attempts and HTML entities.
+    def sanitized_filename(file_name)
+      file_name = File.basename(file_name)
+      CGI.escapeHTML(file_name)
+    end
   end
 end

data/lib/alchemy/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module Alchemy
-  VERSION = "7.4.9"
+  VERSION = "7.4.10"
 
   def self.version
     VERSION

data/lib/tasks/alchemy/usage.rake

@@ -7,6 +7,7 @@ namespace :alchemy do
   desc "List Alchemy elements usage"
   task page_usage: :environment do
     include ActionView::Helpers::NumberHelper
+
     puts "\n  Alchemy pages usage"
     results = Alchemy::Tasks::Usage.pages_count_by_type
     if results.any?
@@ -24,6 +25,7 @@ namespace :alchemy do
   desc "List Alchemy elements usage"
   task element_usage: :environment do
     include ActionView::Helpers::NumberHelper
+
     puts "\n  Alchemy elements usage"
     results = Alchemy::Tasks::Usage.elements_count_by_name
     if results.any?

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: alchemy_cms
 version: !ruby/object:Gem::Version
-  version: 7.4.9
+  version: 7.4.10
 platform: ruby
 authors:
 - Thomas von Deyen
@@ -314,22 +314,22 @@ dependencies:
   name: importmap-rails
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.2'
     - - ">="
       - !ruby/object:Gem::Version
         version: 1.2.1
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.2'
     - - ">="
       - !ruby/object:Gem::Version
         version: 1.2.1
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3.0'
 - !ruby/object:Gem::Dependency
   name: kaminari
   requirement: !ruby/object:Gem::Requirement
@@ -1409,7 +1409,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements:
 - ImageMagick (libmagick), v6.6 or greater.
-rubygems_version: 3.6.9
+rubygems_version: 3.7.2
 specification_version: 4
 summary: A powerful, userfriendly and flexible CMS for Rails
 test_files: []