alchemy_cms 8.2.8 → 8.2.10

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 15844e64546633908fff8dba970ab929e40d6044a0be2a7cced0c8597dff7fe1
-  data.tar.gz: 4801714707a3773127714d3dcc5058a4a54f9d30567a50685a0088d2a528d3c9
+  metadata.gz: 4f71f14030df55abfe021569d0c8c816c5e94a4176b07c9949aac4a4605b4c97
+  data.tar.gz: 9ed19aa050280a931a26c04b6d1c0dba213f80a5e1b67d3480565808489557de
 SHA512:
-  metadata.gz: 0e773361f910a147d5f3430e07d28d53b2797d4838bc8a9710305a8c7ae6358cd6c5f9de14503118f3003a34cd36decb2ed20e3e50cb227ce460925e2ce75c28
-  data.tar.gz: be3a4416c757c31a384c3e3c9e6cce73002811963c0267160ae4ab063ec42d328004be12f342cec1db1122236fb393e63aeab13155dd5d044f8ff7aa92821b4d
+  metadata.gz: 72ccdb22228d035975cea321c2e4de08442a9f580fec0b269fafde14e134c795cbf0348c28cafb6a60ffbc98b4d2d88711179862b35a6eb3e014de1eea6d253b
+  data.tar.gz: ee40daf52d764ffb4f247110edfef6fb0d5dc42644c28de6dcb76edc2e71b1e215fde3e204ae103c3c0e4cc799d14ddaacd81532dcb9e578e453844683eb41c0

data/app/components/alchemy/admin/resource/action.rb

@@ -10,6 +10,8 @@ module Alchemy
       #   name of an action to evaluate if the user can perform these action on the given object
       # @param [String, nil] :tooltip
       #   show a tooltip around the button
+      # @param [Object, nil] :resource
+      #   the resource of the row the action belongs to
       # @param [Lambda] :block
       #   a block to include a button or a link
       #
@@ -30,15 +32,11 @@ module Alchemy
           <% end %>
         ERB
 
-        def initialize(name = nil, tooltip = nil, &block)
+        def initialize(name = nil, tooltip = nil, resource = nil, &block)
           @name = name
           @tooltip = tooltip
-          @block = block
-        end
-
-        def with_resource(resource)
           @resource = resource
-          self
+          @block = block
         end
       end
     end

data/app/components/alchemy/admin/resource/cell.rb

@@ -7,6 +7,8 @@ module Alchemy
       #
       # @param [String, nil] :css_classes
       #   css classes that are show at the table cell
+      # @param [Object, nil] :resource
+      #   the resource of the row the cell belongs to
       # @param [Lambda] :block
       #   a block to include a button or a link
       #
@@ -19,14 +21,10 @@ module Alchemy
           </td>
         ERB
 
-        def initialize(css_classes, &block)
+        def initialize(css_classes, resource = nil, &block)
           @css_classes = css_classes
-          @block = block
-        end
-
-        def with_resource(resource)
           @resource = resource
-          self
+          @block = block
         end
       end
     end

data/app/components/alchemy/admin/resource/table.rb

@@ -69,12 +69,12 @@ module Alchemy
                 <% collection.each do |resource| %>
                   <tr class="<%= cycle('even', 'odd') %>">
                     <% cells.each do |cell| %>
-                       <%= render cell.with_resource(resource) %>
+                       <%= render cell_for(cell, resource) %>
                     <% end %>
                     <% if actions? %>
                       <td class="tools">
                         <% actions.each do |action| %>
-                          <%= render action.with_resource(resource) %>
+                          <%= render action_for(action, resource) %>
                         <% end %>
                       </td>
                     <% end %>
@@ -134,6 +134,18 @@ module Alchemy
 
         private
 
+        # A fresh cell instance is built for every resource because ViewComponent
+        # instances are single-use and may not be rendered more than once.
+        def cell_for(cell, resource)
+          Cell.new(cell.css_classes, resource, &cell.block)
+        end
+
+        # A fresh action instance is built for every resource because ViewComponent
+        # instances are single-use and may not be rendered more than once.
+        def action_for(action, resource)
+          Action.new(action.name, action.tooltip, resource, &action.block)
+        end
+
         ##
         # if no cells are available the resource_helper will be used, to generate the
         # default attributes of the given resource

data/app/components/alchemy/ingredients/base_view.rb

@@ -16,7 +16,7 @@ module Alchemy
       end
 
       def call
-        value.html_safe
+        h(value)
       end
 
       def render?

data/app/components/alchemy/ingredients/picture_view.rb

@@ -68,7 +68,7 @@ module Alchemy
       def caption
         return unless show_caption?
 
-        @_caption ||= content_tag(:figcaption, ingredient.caption.html_safe)
+        @_caption ||= content_tag(:figcaption, sanitize(ingredient.caption))
       end
 
       def src

data/app/components/alchemy/ingredients/text_view.rb

@@ -18,7 +18,7 @@ module Alchemy
 
       def call
         if disable_link?
-          dom_id.present? ? anchor : value
+          dom_id.present? ? anchor : h(value)
         else
           link_to(value, url_for(link), {
             id: dom_id.presence,
@@ -26,7 +26,7 @@ module Alchemy
             target: link_target_value(link_target),
             rel: link_rel_value(link_target)
           }.merge(html_options))
-        end.html_safe
+        end
       end
 
       private

data/app/models/concerns/alchemy/publishable.rb

@@ -9,9 +9,7 @@ module Alchemy
       scope :published, ->(at: Current.preview_time) {
         scheduled
           .where("#{table_name}.public_on <= :at", at:)
-          .where(public_until: nil).or(
-            where("#{table_name}.public_until > :at", at:)
-          )
+          .where("#{table_name}.public_until IS NULL OR #{table_name}.public_until > :at", at:)
       }
 
       validate do

data/config/importmap.rb

@@ -13,12 +13,18 @@ pin "@rails/ujs", to: "rails-ujs.min.js", preload: true # @7.1.2
 pin "tinymce", to: "tinymce.min.js", preload: true
 
 pin "alchemy_admin", to: "alchemy/alchemy_admin.min.js", preload: true
-pin "alchemy_admin/components/remote_select", to: "alchemy/alchemy_admin.min.js"
-pin "alchemy_admin/components/page_select", to: "alchemy/alchemy_admin.min.js"
-pin "alchemy_admin/components/attachment_select", to: "alchemy/alchemy_admin.min.js"
-pin "alchemy_admin/components/element_select", to: "alchemy/alchemy_admin.min.js"
-pin "alchemy_admin/components/tags_autocomplete", to: "alchemy/alchemy_admin.min.js"
-pin "alchemy_admin/components/tinymce", to: "alchemy/alchemy_admin.min.js"
+# Individually importable admin components. These resolve to their source
+# files (not the bundle) so host engines can import a single component without
+# loading and executing the whole admin bundle. Not preloaded, so they add no
+# fetches to normal admin page loads (which import the bundle instead).
+pin "alchemy_admin/components/page_select"
+pin "alchemy_admin/components/attachment_select"
+pin "alchemy_admin/components/element_select"
+pin "alchemy_admin/components/tags_autocomplete"
+pin "alchemy_admin/components/tinymce"
+pin "alchemy_admin/components/remote_select"
+pin "alchemy_admin/components/select"
+pin "alchemy_admin/i18n"
 pin "alchemy_admin/image_cropper", to: "alchemy/alchemy_admin.min.js"
 pin "alchemy_admin/image_overlay", to: "alchemy/alchemy_admin.min.js"
 pin "alchemy_admin/picture_selector", to: "alchemy/alchemy_admin.min.js"

data/db/migrate/20260702090038_add_index_to_elements_pages_join_table.rb

@@ -0,0 +1,14 @@
+class AddIndexToElementsPagesJoinTable < ActiveRecord::Migration[7.2]
+  disable_ddl_transaction! if connection.adapter_name.match?(/postgres/i)
+
+  def change
+    add_index :alchemy_elements_alchemy_pages, :element_id, if_not_exists: true, algorithm: algorithm
+    add_index :alchemy_elements_alchemy_pages, :page_id, if_not_exists: true, algorithm: algorithm
+  end
+
+  private
+
+  def algorithm
+    connection.adapter_name.match?(/postgres/i) ? :concurrently : nil
+  end
+end

data/lib/alchemy/test_support/shared_publishable_examples.rb

@@ -81,6 +81,16 @@ RSpec.shared_examples_for "being publishable" do |factory_name|
         ])
       end
     end
+
+    context "with a publication window that has not started yet" do
+      let!(:future_window) do
+        create(factory_name, public_on: Date.tomorrow, public_until: Date.tomorrow + 2.days)
+      end
+
+      it "does not return the record" do
+        expect(described_class.published.where(id: future_window.id)).to be_empty
+      end
+    end
   end
 
   describe "#scheduled?" do

data/lib/alchemy/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module Alchemy
-  VERSION = "8.2.8"
+  VERSION = "8.2.10"
 
   def self.version
     VERSION

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: alchemy_cms
 version: !ruby/object:Gem::Version
-  version: 8.2.8
+  version: 8.2.10
 platform: ruby
 authors:
 - Thomas von Deyen
@@ -1285,6 +1285,7 @@ files:
 - db/migrate/20260102121232_add_metadata_to_page_versions.rb
 - db/migrate/20260115164704_add_publication_timestamps_to_alchemy_elements.rb
 - db/migrate/20260115164705_add_index_to_element_publication_timestamps.rb
+- db/migrate/20260702090038_add_index_to_elements_pages_join_table.rb
 - lib/alchemy.rb
 - lib/alchemy/ability_helper.rb
 - lib/alchemy/admin/locale.rb
@@ -1490,7 +1491,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements:
 - ImageMagick (libmagick), v6.6 or greater.
-rubygems_version: 4.0.10
+rubygems_version: 4.0.20
 specification_version: 4
 summary: A powerful, userfriendly and flexible CMS for Rails
 test_files: []