alchemy_cms 8.3.5 → 8.3.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bbbeeb181a57c8aa3b7093ff06d224379e907c822cc904966a60ea9e4fd47a9a
-  data.tar.gz: 14534974daa1420fa07cd3af38c71ed2a983ef6a0952d4b0457f8805a441dab4
+  metadata.gz: e13db27417e434306c2ba48c7b3718758690ca49b7cc0ad85aea8921210779e6
+  data.tar.gz: 2a13089265941fac886d3523485414f4cf774d0150382926a0a7131d421f0296
 SHA512:
-  metadata.gz: d69c8d862b3301e857ed130f974be1106aef8fca47cf296571596e5121e51c42a5a8e81ae9421b8fe88b5765ddeecbc5ec07a5fe07944a4f1795e11477e0eb27
-  data.tar.gz: 1aebb4ad39b71937f7168d4659e3f9318579c5e9ba13dde47b16108e8d27ec5e3c5f38302397d7561b6ed5136838f1460ecb54257106839073a817e11581688c
+  metadata.gz: 4aa7ac27020b95dea3b8ea39a039a0186c5d62d12461f2a6af14d1ff3122fb74fbf33f6e44313345e2d04c8b5b3c8c668658cc7beacf34cf35cdd0af63539280
+  data.tar.gz: b301ea1b3dfc42b213fc6af56f08feabec797d6ffe8354614a8465ec653b436065fd292183593bb71bbccb9225207c64e8608239602cc23929e1d3ba3653280d

data/app/components/alchemy/ingredients/richtext_view.rb

@@ -3,6 +3,8 @@ module Alchemy
     class RichtextView < BaseView
       attr_reader :plain_text
 
+      delegate :sanitizer_settings, to: :ingredient
+
       # @param ingredient [Alchemy::Ingredient]
       # @param plain_text [Boolean] (false) Whether to show as plain text or with markup
       def initialize(ingredient, plain_text: nil, html_options: {})
@@ -13,6 +15,8 @@ module Alchemy
       def call
         if plain_text
           ingredient.stripped_body
+        elsif sanitizer_settings.present?
+          sanitize(value.to_s, **sanitizer_settings)
         else
           value.to_s.html_safe
         end.html_safe

data/app/controllers/alchemy/api/nodes_controller.rb

@@ -6,7 +6,7 @@ module Alchemy
     before_action :authorize_access, only: [:move, :toggle_folded]
 
     def index
-      @nodes = Node.all
+      @nodes = Node.accessible_by(current_ability, :index)
       @nodes = @nodes.includes(:parent)
       @nodes = @nodes.where(language_id: params[:language_id]) if params[:language_id]
       @nodes = @nodes.ransack(params[:filter]).result.order(:lft)

data/app/models/alchemy/ingredients/richtext.rb

@@ -36,6 +36,10 @@ module Alchemy
         settings[:tinymce] || {}
       end
 
+      def sanitizer_settings
+        settings[:sanitizer] || {}
+      end
+
       private
 
       def strip_content
@@ -48,10 +52,6 @@ module Alchemy
           sanitizer_settings
         )
       end
-
-      def sanitizer_settings
-        settings[:sanitizer] || {}
-      end
     end
   end
 end

data/app/models/alchemy/node.rb

@@ -20,6 +20,27 @@ module Alchemy
       foreign_key: :related_object_id,
       inverse_of: :related_object
 
+    # All nodes of the current site whose language is published.
+    scope :from_current_public_site, -> {
+      joins(:language)
+        .where(Alchemy::Language.table_name => {site_id: Alchemy::Current.site})
+        .merge(Alchemy::Language.published)
+    }
+
+    # Nodes an anonymous visitor may see: external links or nodes attached to a
+    # published, unrestricted page, scoped to the current site.
+    scope :available_to_guests, -> {
+      from_current_public_site.where(page: nil)
+        .or(from_current_public_site.where(page: Alchemy::Page.published.not_restricted))
+    }
+
+    # Like #available_to_guests but including nodes attached to restricted pages,
+    # which logged in members are allowed to see.
+    scope :available_to_members, -> {
+      from_current_public_site.where(page: nil)
+        .or(from_current_public_site.where(page: Alchemy::Page.published))
+    }
+
     before_validation :translate_root_menu_name, if: -> { root? }
     before_validation :set_menu_type_from_root, unless: -> { root? }
 

data/app/models/alchemy/permissions.rb

@@ -44,6 +44,11 @@ module Alchemy
         can :read, Alchemy::Page, Alchemy::Page.published.not_restricted.from_current_site do |p|
           p.public? && !p.restricted? && p.site == Alchemy::Current.site
         end
+
+        can :read, Alchemy::Node, Alchemy::Node.available_to_guests do |node|
+          node.language.public? && node.language.site_id == Alchemy::Current.site&.id &&
+            (node.page.nil? || (node.page.public? && !node.page.restricted?))
+        end
       end
     end
 
@@ -67,6 +72,11 @@ module Alchemy
         can :read, Alchemy::Page, Alchemy::Page.published.from_current_site do |p|
           p.public? && p.site == Alchemy::Current.site
         end
+
+        can :read, Alchemy::Node, Alchemy::Node.available_to_members do |node|
+          node.language.public? && node.language.site_id == Alchemy::Current.site&.id &&
+            (node.page.nil? || node.page.public?)
+        end
       end
     end
 

data/app/models/alchemy/storage_adapter/active_storage.rb

@@ -11,6 +11,17 @@ module Alchemy
           base.after_create_commit if: :svg? do
             SanitizeSvgJob.perform_later(self, file_accessor: :image_file)
           end
+
+          # The image file's dirty state is cleared by the time
+          # +after_update_commit+ runs, so capture it here to know whether the
+          # blob was actually replaced (rather than only its metadata updated).
+          base.before_update do
+            @image_file_replaced = image_file.changed?
+          end
+
+          base.after_update_commit if: -> { @image_file_replaced && svg? } do
+            SanitizeSvgJob.perform_later(self, file_accessor: :image_file)
+          end
         end
       end
 
@@ -20,6 +31,17 @@ module Alchemy
           base.after_create_commit if: :svg? do
             SanitizeSvgJob.perform_later(self, file_accessor: :file)
           end
+
+          # The file's dirty state is cleared by the time
+          # +after_update_commit+ runs, so capture it here to know whether the
+          # blob was actually replaced (rather than only its metadata updated).
+          base.before_update do
+            @file_replaced = file.changed?
+          end
+
+          base.after_update_commit if: -> { @file_replaced && svg? } do
+            SanitizeSvgJob.perform_later(self, file_accessor: :file)
+          end
         end
       end
 

data/lib/alchemy/engine.rb

@@ -178,13 +178,12 @@ module Alchemy
       end
 
       if app.config.active_storage
-        # Rails sends svg images as attachment instead of inline.
-        # We want to display svgs and not download them.
-        unless app.config.active_storage.content_types_allowed_inline.include? svg
-          app.config.active_storage.content_types_allowed_inline += [svg]
-        end
-        # Rails renders SVG as binary for security reasons.
-        # We sanitize SVGs on upload and therefore can serve them as image.
+        # Serve SVGs with their real image/svg+xml content type so they render
+        # in <img> tags. We deliberately do NOT add svg to
+        # +content_types_allowed_inline+: an SVG opened as a top-level document
+        # executes its embedded scripts, so it must be served with an
+        # attachment (download) disposition rather than inline. <img> ignores
+        # Content-Disposition, so image display is unaffected.
         if app.config.active_storage.content_types_to_serve_as_binary.include? svg
           app.config.active_storage.content_types_to_serve_as_binary.delete(svg)
         end

data/lib/alchemy/version.rb

@@ -3,7 +3,7 @@
 module Alchemy
   extend self
 
-  VERSION = "8.3.5"
+  VERSION = "8.3.6"
 
   def version
     VERSION

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: alchemy_cms
 version: !ruby/object:Gem::Version
-  version: 8.3.5
+  version: 8.3.6
 platform: ruby
 authors:
 - Thomas von Deyen