alchemy_cms 8.0.14 → 8.0.16

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9789161d6c201059cca5051f7bccc49f8ab6135cce60603b4d7fe746042f0406
-  data.tar.gz: 108a61b06d1b54dcc527d8264ecc26cce54351a37b868aa047bb3e5e461a0982
+  metadata.gz: 6cc660884996a75925cb1bf4819120c62359a58f0030191f8d571131f6f9365f
+  data.tar.gz: 3c082ef811ae62e5f6411ea4f70878b071cf079ca334cdc239dfb075e77111e4
 SHA512:
-  metadata.gz: bfbfcced4a951b6baf9e934d28ea52c35aea448be113866f07722a1d084e3e36d00d0947f698f56bd93f81125b41f69509126aa94dda2140033971b64cf97d8f
-  data.tar.gz: 2c01c00eaba2eca05da790b784495075e4ebb6b7905e0519b8c1cd79ba1427832d3fb1c4fd27747c7c0cddff1f5f32da9f3b34dde0dd2048d5ee4ee89189c915
+  metadata.gz: 27aec37f2f3868eed5ab2ade74517e77556c19ebfd0bfab4b8c42d61f215d52061d495f9e08acfb509b3015e466b10610cb56ac8efb95d5ce1d7eaff37990896
+  data.tar.gz: 7aff2d6a5b7223df1dbe027bd8cd01bedc8e36d341ec5aa9d608b42d308c4795de5c21b666bd458b86b04946ea200d15081bf3bdee600090655b995339eacab6

data/app/components/alchemy/ingredients/base_view.rb

@@ -16,7 +16,7 @@ module Alchemy
       end
 
       def call
-        value.html_safe
+        h(value)
       end
 
       def render?

data/app/components/alchemy/ingredients/picture_view.rb

@@ -68,7 +68,7 @@ module Alchemy
       def caption
         return unless show_caption?
 
-        @_caption ||= content_tag(:figcaption, ingredient.caption.html_safe)
+        @_caption ||= content_tag(:figcaption, sanitize(ingredient.caption))
       end
 
       def src

data/app/components/alchemy/ingredients/text_view.rb

@@ -18,7 +18,7 @@ module Alchemy
 
       def call
         if disable_link?
-          dom_id.present? ? anchor : value
+          dom_id.present? ? anchor : h(value)
         else
           link_to(value, url_for(link), {
             id: dom_id.presence,
@@ -26,7 +26,7 @@ module Alchemy
             target: link_target_value(link_target),
             rel: link_rel_value(link_target)
           }.merge(html_options))
-        end.html_safe
+        end
       end
 
       private

data/app/controllers/alchemy/api/pages_controller.rb

@@ -28,6 +28,8 @@ module Alchemy
     def nested
       @page = Page.find_by(id: params[:page_id]) || Language.current_root_page
 
+      authorize! :show, @page
+
       render json: PageTreeSerializer.new(
         @page,
         ability: current_ability,

data/app/serializers/alchemy/page_tree_serializer.rb

@@ -9,7 +9,21 @@ module Alchemy
     def pages
       tree = []
       path = [{id: object.parent_id, children: tree}]
-      page_list = object.self_and_descendants.includes(:public_version, {language: :site})
+      page_list = object.self_and_descendants
+        .accessible_by(opts[:ability], :read)
+        .includes(:public_version, {language: :site})
+        .to_a
+      # Drop pages whose parent was filtered out by the ability, so a
+      # restricted or unpublished branch does not leak its accessible
+      # descendants. self_and_descendants is ordered pre-order, so a parent
+      # always precedes its children and a single pass is sufficient.
+      kept_ids = Set.new([object.id])
+      page_list = page_list.select do |page|
+        next true if page.id == object.id
+        kept_ids.include?(page.parent_id).tap do |kept|
+          kept_ids << page.id if kept
+        end
+      end
       base_level = object.level - 1
       # Load folded pages in advance
       folded_user_pages = FoldedPage.folded_for_user(opts[:user]).pluck(:page_id)
@@ -83,6 +97,8 @@ module Alchemy
     end
 
     def page_elements(page)
+      return Alchemy::Element.none unless opts[:ability].can?(:read, page)
+
       elements = page.public_version&.elements || Alchemy::Element.none
       if opts[:elements] == "true"
         elements

data/app/views/alchemy/admin/layoutpages/_layoutpage.html.erb

@@ -8,7 +8,7 @@
         <%= render_icon "file-edit", size: "xl" %>
       </sl-tooltip>
     <% else %>
-      <%= render_icon "file-edit", size: "xl" %>
+      <%= render_icon "file", size: "xl" %>
     <% end %>
     </div>
     <div class="sitemap_sitename without-status">

data/lib/alchemy/cache_digests/template_tracker.rb

@@ -18,8 +18,6 @@ module Alchemy
         when /^alchemy\/page_layouts\/_(\w+)/
           page_definition = PageDefinition.get($1)
           page_definition.elements.map { "alchemy/elements/_#{_1}" }
-        when /^alchemy\/elements\/_(\w+)/
-          ingredient_types($1).map { "alchemy/ingredients/_#{_1.underscore}_view" }.tap(&:uniq!)
         else
           ActionView::DependencyTracker::ERBTracker.call(@name, @template)
         end

data/lib/alchemy/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module Alchemy
-  VERSION = "8.0.14"
+  VERSION = "8.0.16"
 
   def self.version
     VERSION

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: alchemy_cms
 version: !ruby/object:Gem::Version
-  version: 8.0.14
+  version: 8.0.16
 platform: ruby
 authors:
 - Thomas von Deyen
@@ -1438,7 +1438,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements:
 - ImageMagick (libmagick), v6.6 or greater.
-rubygems_version: 4.0.10
+rubygems_version: 4.0.16
 specification_version: 4
 summary: A powerful, userfriendly and flexible CMS for Rails
 test_files: []