alchemy_cms 8.3.5 → 8.3.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bbbeeb181a57c8aa3b7093ff06d224379e907c822cc904966a60ea9e4fd47a9a
-  data.tar.gz: 14534974daa1420fa07cd3af38c71ed2a983ef6a0952d4b0457f8805a441dab4
+  metadata.gz: c8f639a1d9089eea972ddfa6d299a072337dfe342441fddd6150cd2dfae8e47f
+  data.tar.gz: dcc66f199295ff7bffbe07e5e2c28f98e3867675066faa87a6142d745425bf5a
 SHA512:
-  metadata.gz: d69c8d862b3301e857ed130f974be1106aef8fca47cf296571596e5121e51c42a5a8e81ae9421b8fe88b5765ddeecbc5ec07a5fe07944a4f1795e11477e0eb27
-  data.tar.gz: 1aebb4ad39b71937f7168d4659e3f9318579c5e9ba13dde47b16108e8d27ec5e3c5f38302397d7561b6ed5136838f1460ecb54257106839073a817e11581688c
+  metadata.gz: 65edc33be6840411cefa89b7a01e99f9d63d556b80c7e3b51f8efe40eac5d75fb6fc9ed7622c9af74161ac80719834e1128dfb7e312e85db5cc0a1254a0f5bd1
+  data.tar.gz: 00254aaacad56b9fd1cd0ac085d676bb3907f4c69f73a0590ab6c0e1b43ae0f7ae0b59c83e84b953131e65a1937da917cbccecd14ec6447af3080921bd1a54fa

data/app/components/alchemy/admin/resource/action.rb

@@ -10,6 +10,8 @@ module Alchemy
       #   name of an action to evaluate if the user can perform these action on the given object
       # @param [String, nil] :tooltip
       #   show a tooltip around the button
+      # @param [Object, nil] :resource
+      #   the resource of the row the action belongs to
       # @param [Lambda] :block
       #   a block to include a button or a link
       #
@@ -30,15 +32,11 @@ module Alchemy
           <% end %>
         ERB
 
-        def initialize(name = nil, tooltip = nil, &block)
+        def initialize(name = nil, tooltip = nil, resource = nil, &block)
           @name = name
           @tooltip = tooltip
-          @block = block
-        end
-
-        def with_resource(resource)
           @resource = resource
-          self
+          @block = block
         end
       end
     end

data/app/components/alchemy/admin/resource/cell.rb

@@ -7,6 +7,8 @@ module Alchemy
       #
       # @param [String, nil] :css_classes
       #   css classes that are show at the table cell
+      # @param [Object, nil] :resource
+      #   the resource of the row the cell belongs to
       # @param [Lambda] :block
       #   a block to include a button or a link
       #
@@ -19,14 +21,10 @@ module Alchemy
           </td>
         ERB
 
-        def initialize(css_classes, &block)
+        def initialize(css_classes, resource = nil, &block)
           @css_classes = css_classes
-          @block = block
-        end
-
-        def with_resource(resource)
           @resource = resource
-          self
+          @block = block
         end
       end
     end

data/app/components/alchemy/admin/resource/table.rb

@@ -69,12 +69,12 @@ module Alchemy
                 <% collection.each do |resource| %>
                   <tr class="<%= cycle('even', 'odd') %>">
                     <% cells.each do |cell| %>
-                       <%= render cell.with_resource(resource) %>
+                       <%= render cell_for(cell, resource) %>
                     <% end %>
                     <% if actions? %>
                       <td class="tools">
                         <% actions.each do |action| %>
-                          <%= render action.with_resource(resource) %>
+                          <%= render action_for(action, resource) %>
                         <% end %>
                       </td>
                     <% end %>
@@ -134,6 +134,18 @@ module Alchemy
 
         private
 
+        # A fresh cell instance is built for every resource because ViewComponent
+        # instances are single-use and may not be rendered more than once.
+        def cell_for(cell, resource)
+          Cell.new(cell.css_classes, resource, &cell.block)
+        end
+
+        # A fresh action instance is built for every resource because ViewComponent
+        # instances are single-use and may not be rendered more than once.
+        def action_for(action, resource)
+          Action.new(action.name, action.tooltip, resource, &action.block)
+        end
+
         ##
         # if no cells are available the resource_helper will be used, to generate the
         # default attributes of the given resource

data/app/components/alchemy/ingredients/richtext_view.rb

@@ -3,6 +3,8 @@ module Alchemy
     class RichtextView < BaseView
       attr_reader :plain_text
 
+      delegate :sanitizer_settings, to: :ingredient
+
       # @param ingredient [Alchemy::Ingredient]
       # @param plain_text [Boolean] (false) Whether to show as plain text or with markup
       def initialize(ingredient, plain_text: nil, html_options: {})
@@ -13,6 +15,8 @@ module Alchemy
       def call
         if plain_text
           ingredient.stripped_body
+        elsif sanitizer_settings.present?
+          sanitize(value.to_s, **sanitizer_settings)
         else
           value.to_s.html_safe
         end.html_safe

data/app/controllers/alchemy/admin/elements_controller.rb

@@ -10,9 +10,11 @@ module Alchemy
       include Alchemy::Admin::PreviewTime
 
       before_action :load_element, only: [:update, :destroy, :collapse, :expand, :publish]
-      authorize_resource class: Alchemy::Element
+      authorize_resource class: Alchemy::Element, except: [:index]
 
       def index
+        authorize! :edit_content, @page
+
         preloaded = Alchemy::ElementPreloader
           .new(page_version: @page_version)
           .call

data/app/controllers/alchemy/api/nodes_controller.rb

@@ -6,7 +6,7 @@ module Alchemy
     before_action :authorize_access, only: [:move, :toggle_folded]
 
     def index
-      @nodes = Node.all
+      @nodes = Node.accessible_by(current_ability, :index)
       @nodes = @nodes.includes(:parent)
       @nodes = @nodes.where(language_id: params[:language_id]) if params[:language_id]
       @nodes = @nodes.ransack(params[:filter]).result.order(:lft)

data/app/models/alchemy/ingredients/richtext.rb

@@ -36,6 +36,10 @@ module Alchemy
         settings[:tinymce] || {}
       end
 
+      def sanitizer_settings
+        settings[:sanitizer] || {}
+      end
+
       private
 
       def strip_content
@@ -48,10 +52,6 @@ module Alchemy
           sanitizer_settings
         )
       end
-
-      def sanitizer_settings
-        settings[:sanitizer] || {}
-      end
     end
   end
 end

data/app/models/alchemy/node.rb

@@ -20,6 +20,27 @@ module Alchemy
       foreign_key: :related_object_id,
       inverse_of: :related_object
 
+    # All nodes of the current site whose language is published.
+    scope :from_current_public_site, -> {
+      joins(:language)
+        .where(Alchemy::Language.table_name => {site_id: Alchemy::Current.site})
+        .merge(Alchemy::Language.published)
+    }
+
+    # Nodes an anonymous visitor may see: external links or nodes attached to a
+    # published, unrestricted page, scoped to the current site.
+    scope :available_to_guests, -> {
+      from_current_public_site.where(page: nil)
+        .or(from_current_public_site.where(page: Alchemy::Page.published.not_restricted))
+    }
+
+    # Like #available_to_guests but including nodes attached to restricted pages,
+    # which logged in members are allowed to see.
+    scope :available_to_members, -> {
+      from_current_public_site.where(page: nil)
+        .or(from_current_public_site.where(page: Alchemy::Page.published))
+    }
+
     before_validation :translate_root_menu_name, if: -> { root? }
     before_validation :set_menu_type_from_root, unless: -> { root? }
 

data/app/models/alchemy/permissions.rb

@@ -44,6 +44,11 @@ module Alchemy
         can :read, Alchemy::Page, Alchemy::Page.published.not_restricted.from_current_site do |p|
           p.public? && !p.restricted? && p.site == Alchemy::Current.site
         end
+
+        can :read, Alchemy::Node, Alchemy::Node.available_to_guests do |node|
+          node.language.public? && node.language.site_id == Alchemy::Current.site&.id &&
+            (node.page.nil? || (node.page.public? && !node.page.restricted?))
+        end
       end
     end
 
@@ -67,6 +72,11 @@ module Alchemy
         can :read, Alchemy::Page, Alchemy::Page.published.from_current_site do |p|
           p.public? && p.site == Alchemy::Current.site
         end
+
+        can :read, Alchemy::Node, Alchemy::Node.available_to_members do |node|
+          node.language.public? && node.language.site_id == Alchemy::Current.site&.id &&
+            (node.page.nil? || node.page.public?)
+        end
       end
     end
 

data/app/models/alchemy/storage_adapter/active_storage.rb

@@ -11,6 +11,17 @@ module Alchemy
           base.after_create_commit if: :svg? do
             SanitizeSvgJob.perform_later(self, file_accessor: :image_file)
           end
+
+          # The image file's dirty state is cleared by the time
+          # +after_update_commit+ runs, so capture it here to know whether the
+          # blob was actually replaced (rather than only its metadata updated).
+          base.before_update do
+            @image_file_replaced = image_file.changed?
+          end
+
+          base.after_update_commit if: -> { @image_file_replaced && svg? } do
+            SanitizeSvgJob.perform_later(self, file_accessor: :image_file)
+          end
         end
       end
 
@@ -20,6 +31,17 @@ module Alchemy
           base.after_create_commit if: :svg? do
             SanitizeSvgJob.perform_later(self, file_accessor: :file)
           end
+
+          # The file's dirty state is cleared by the time
+          # +after_update_commit+ runs, so capture it here to know whether the
+          # blob was actually replaced (rather than only its metadata updated).
+          base.before_update do
+            @file_replaced = file.changed?
+          end
+
+          base.after_update_commit if: -> { @file_replaced && svg? } do
+            SanitizeSvgJob.perform_later(self, file_accessor: :file)
+          end
         end
       end
 

data/app/views/alchemy/_menubar.html.erb

@@ -17,7 +17,7 @@
           box-shadow: 0 0 0 1px #fff;
           box-sizing: border-box;
           border-bottom-right-radius: var(--border-radius);
-          padding: 12px 16px 12px;
+          padding: 12px 16px 12px 12px;
           gap: 12px;
           justify-content: space-between;
           align-items: center;
@@ -26,6 +26,7 @@
           font-family: "Open Sans", "Lucida Grande", "Lucida Sans Unicode",
             "Lucida Sans", Verdana, Tahoma, sans-serif;
           font-size: 13px;
+          line-height: normal;
         }
 
         .menubar * {
@@ -107,7 +108,7 @@
           <% end %>
         <% end %>
         <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 30 30">
-          <path fill="#fff" d="M15.7 7.9L9.9 2.2 2.1 4.3 0 12.1l5.7 5.8 7.8-2.1 2.2-7.9zm-5.3 10.3l-1.2 4.4 3.2 3.2 4.4-1.2 1.2-4.4-3.2-3.2-4.4 1.2zM23.5 7.3L17.2 9l-1.7 6.2 4.5 4.6 6.2-1.7 1.7-6.2-4.4-4.6z"/>
+          <path fill="#fff" d="M15.7 7.9L9.9 2.2 2.1 4.3 0 12.1l5.7 5.8 7.8-2.1 2.2-7.9zm-5.3 10.3l-1.2 4.4 3.2 3.2 4.4-1.2 1.2-4.4-3.2-3.2-4.4 1.2zM23.5 7.3L17.2 9l-1.7 6.2 4.5 4.6 6.2-1.7 1.7-6.2-4.4-4.6z" />
         </svg>
       </div>
     </template>

data/lib/alchemy/engine.rb

@@ -178,13 +178,12 @@ module Alchemy
       end
 
       if app.config.active_storage
-        # Rails sends svg images as attachment instead of inline.
-        # We want to display svgs and not download them.
-        unless app.config.active_storage.content_types_allowed_inline.include? svg
-          app.config.active_storage.content_types_allowed_inline += [svg]
-        end
-        # Rails renders SVG as binary for security reasons.
-        # We sanitize SVGs on upload and therefore can serve them as image.
+        # Serve SVGs with their real image/svg+xml content type so they render
+        # in <img> tags. We deliberately do NOT add svg to
+        # +content_types_allowed_inline+: an SVG opened as a top-level document
+        # executes its embedded scripts, so it must be served with an
+        # attachment (download) disposition rather than inline. <img> ignores
+        # Content-Disposition, so image display is unaffected.
         if app.config.active_storage.content_types_to_serve_as_binary.include? svg
           app.config.active_storage.content_types_to_serve_as_binary.delete(svg)
         end

data/lib/alchemy/seeder.rb

@@ -111,7 +111,6 @@ module Alchemy
       def create_page(draft, attributes = {})
         children = draft.delete("children") || []
         page = Alchemy::Page.new(draft.merge(attributes))
-        page.versions.build
         page.save!
         log "Created page: #{page.name}"
         children.each do |child|

data/lib/alchemy/version.rb

@@ -3,7 +3,7 @@
 module Alchemy
   extend self
 
-  VERSION = "8.3.5"
+  VERSION = "8.3.7"
 
   def version
     VERSION

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: alchemy_cms
 version: !ruby/object:Gem::Version
-  version: 8.3.5
+  version: 8.3.7
 platform: ruby
 authors:
 - Thomas von Deyen