alchemy_cms 8.3.6 → 8.3.8

data/app/components/alchemy/admin/resource/action.rb

@@ -10,6 +10,8 @@ module Alchemy
       #   name of an action to evaluate if the user can perform these action on the given object
       # @param [String, nil] :tooltip
       #   show a tooltip around the button
+      # @param [Object, nil] :resource
+      #   the resource of the row the action belongs to
       # @param [Lambda] :block
       #   a block to include a button or a link
       #
@@ -30,15 +32,11 @@ module Alchemy
           <% end %>
         ERB
 
-        def initialize(name = nil, tooltip = nil, &block)
+        def initialize(name = nil, tooltip = nil, resource = nil, &block)
           @name = name
           @tooltip = tooltip
-          @block = block
-        end
-
-        def with_resource(resource)
           @resource = resource
-          self
+          @block = block
         end
       end
     end

data/app/components/alchemy/admin/resource/cell.rb

@@ -7,6 +7,8 @@ module Alchemy
       #
       # @param [String, nil] :css_classes
       #   css classes that are show at the table cell
+      # @param [Object, nil] :resource
+      #   the resource of the row the cell belongs to
       # @param [Lambda] :block
       #   a block to include a button or a link
       #
@@ -19,14 +21,10 @@ module Alchemy
           </td>
         ERB
 
-        def initialize(css_classes, &block)
+        def initialize(css_classes, resource = nil, &block)
           @css_classes = css_classes
-          @block = block
-        end
-
-        def with_resource(resource)
           @resource = resource
-          self
+          @block = block
         end
       end
     end

data/app/components/alchemy/admin/resource/table.rb

@@ -69,12 +69,12 @@ module Alchemy
                 <% collection.each do |resource| %>
                   <tr class="<%= cycle('even', 'odd') %>">
                     <% cells.each do |cell| %>
-                       <%= render cell.with_resource(resource) %>
+                       <%= render cell_for(cell, resource) %>
                     <% end %>
                     <% if actions? %>
                       <td class="tools">
                         <% actions.each do |action| %>
-                          <%= render action.with_resource(resource) %>
+                          <%= render action_for(action, resource) %>
                         <% end %>
                       </td>
                     <% end %>
@@ -134,6 +134,18 @@ module Alchemy
 
         private
 
+        # A fresh cell instance is built for every resource because ViewComponent
+        # instances are single-use and may not be rendered more than once.
+        def cell_for(cell, resource)
+          Cell.new(cell.css_classes, resource, &cell.block)
+        end
+
+        # A fresh action instance is built for every resource because ViewComponent
+        # instances are single-use and may not be rendered more than once.
+        def action_for(action, resource)
+          Action.new(action.name, action.tooltip, resource, &action.block)
+        end
+
         ##
         # if no cells are available the resource_helper will be used, to generate the
         # default attributes of the given resource

data/app/controllers/alchemy/admin/elements_controller.rb

@@ -10,9 +10,11 @@ module Alchemy
       include Alchemy::Admin::PreviewTime
 
       before_action :load_element, only: [:update, :destroy, :collapse, :expand, :publish]
-      authorize_resource class: Alchemy::Element
+      authorize_resource class: Alchemy::Element, except: [:index]
 
       def index
+        authorize! :edit_content, @page
+
         preloaded = Alchemy::ElementPreloader
           .new(page_version: @page_version)
           .call

data/app/javascript/alchemy_admin/components/attachment_select.js

@@ -1,4 +1,7 @@
-import { RemoteSelect } from "alchemy_admin/components/remote_select"
+import {
+  RemoteSelect,
+  escapeHtml
+} from "alchemy_admin/components/remote_select"
 
 export class AttachmentSelect extends RemoteSelect {
   _renderResult(item) {
@@ -15,7 +18,7 @@ export class AttachmentSelect extends RemoteSelect {
   _renderListEntry(attachment, term) {
     return `
       <div class="attachment-select--attachment">
-        <alchemy-icon name="${attachment.icon_css_class}"></alchemy-icon>
+        <alchemy-icon name="${escapeHtml(attachment.icon_css_class)}"></alchemy-icon>
         <span class="attachment-select--attachment-name">${this._hightlightTerm(attachment.name, term)}</span>
       </div>
     `

data/app/javascript/alchemy_admin/components/node_select.js

@@ -1,4 +1,7 @@
-import { RemoteSelect } from "alchemy_admin/components/remote_select"
+import {
+  RemoteSelect,
+  escapeHtml
+} from "alchemy_admin/components/remote_select"
 
 class NodeSelect extends RemoteSelect {
   _searchQuery(term, page) {
@@ -23,7 +26,7 @@ class NodeSelect extends RemoteSelect {
    * @private
    */
   _renderListEntry(node, term) {
-    const ancestors = node.ancestors.map((a) => a.name)
+    const ancestors = node.ancestors.map((a) => escapeHtml(a.name))
     const seperator = `<alchemy-icon name="arrow-right-s"></alchemy-icon>`
 
     return `
@@ -38,7 +41,7 @@ class NodeSelect extends RemoteSelect {
           </span>
         </div>
         <div class="node-select--node-url">
-          ${node.url || ""}
+          ${escapeHtml(node.url || "")}
         </div>
       </div>
     `

data/app/javascript/alchemy_admin/components/page_select.js

@@ -1,4 +1,7 @@
-import { RemoteSelect } from "alchemy_admin/components/remote_select"
+import {
+  RemoteSelect,
+  escapeHtml
+} from "alchemy_admin/components/remote_select"
 
 export class PageSelect extends RemoteSelect {
   get pageId() {
@@ -30,7 +33,7 @@ export class PageSelect extends RemoteSelect {
    * @private
    */
   _renderResult(page) {
-    return page.text || page.name
+    return escapeHtml(page.text || page.name)
   }
 
   /**
@@ -46,11 +49,11 @@ export class PageSelect extends RemoteSelect {
         <div class="page-select--top">
           <alchemy-icon name="file-3"></alchemy-icon>
           <span class="page-select--page-name">${this._hightlightTerm(page.name, term)}</span>
-          <span class="page-select--site-name">${page.site.name}</span>
+          <span class="page-select--site-name">${escapeHtml(page.site.name)}</span>
         </div>
         <div class="page-select--bottom">
-          <span class="page-select--page-urlname">${page.url_path}</span>
-          <span class="page-select--language-code">${page.language_code}</span>
+          <span class="page-select--page-urlname">${escapeHtml(page.url_path)}</span>
+          <span class="page-select--language-code">${escapeHtml(page.language_code)}</span>
         </div>
       </div>
     `

data/app/javascript/alchemy_admin/components/remote_select.js

@@ -1,7 +1,41 @@
 import { setupSelectLocale } from "alchemy_admin/i18n"
 
+/**
+ * Escapes a string for use within HTML. Select2 hands the return value of
+ * `formatResult`/`formatSelection` straight to jQuery, so everything woven into
+ * those templates has to be escaped here.
+ * @param {string} value
+ * @returns {string}
+ */
+export function escapeHtml(value) {
+  return `${value}`
+    .replace(/&/g, "&")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;")
+}
+
+/**
+ * Escapes a string for literal use inside a `RegExp`, so a term with
+ * metacharacters (e.g. `(`) matches itself instead of being compiled as a
+ * pattern, which could match the wrong text or throw a SyntaxError.
+ * @param {string} value
+ * @returns {string}
+ */
+export function escapeRegExp(value) {
+  return String(value).replace(/[.*+?^${}()|[\]\\]/g, "\\$&")
+}
+
 export function hightlightTerm(name, term) {
-  return name.replace(new RegExp(term, "gi"), (match) => `<em>${match}</em>`)
+  // The result is rendered raw as the entry's name, so the name must be escaped
+  // before the term markup is woven in — otherwise a crafted name (e.g. a menu
+  // node title) is a stored XSS sink.
+  const escapedName = escapeHtml(name)
+  if (!term) return escapedName
+  return escapedName.replace(
+    new RegExp(escapeRegExp(term), "gi"),
+    (match) => `<em>${match}</em>`
+  )
 }
 
 export class RemoteSelect extends HTMLElement {

data/app/stylesheets/alchemy/admin/_tom-select.scss

@@ -229,6 +229,7 @@
   .option {
     padding: var(--spacing-2);
     cursor: pointer;
+    min-height: 2.75em;
 
     .highlight {
       text-decoration: underline;

data/app/stylesheets/alchemy/admin/forms.scss

@@ -128,7 +128,8 @@ form {
   }
 
   .field_with_errors {
-    input[type="text"],
+    &:not(:has(.ts-control)) input[type="text"],
+    .ts-control,
     input[type="email"],
     input[type="password"],
     textarea,

data/app/views/alchemy/_menubar.html.erb

@@ -17,7 +17,7 @@
           box-shadow: 0 0 0 1px #fff;
           box-sizing: border-box;
           border-bottom-right-radius: var(--border-radius);
-          padding: 12px 16px 12px;
+          padding: 12px 16px 12px 12px;
           gap: 12px;
           justify-content: space-between;
           align-items: center;
@@ -26,6 +26,7 @@
           font-family: "Open Sans", "Lucida Grande", "Lucida Sans Unicode",
             "Lucida Sans", Verdana, Tahoma, sans-serif;
           font-size: 13px;
+          line-height: normal;
         }
 
         .menubar * {
@@ -107,7 +108,7 @@
           <% end %>
         <% end %>
         <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 30 30">
-          <path fill="#fff" d="M15.7 7.9L9.9 2.2 2.1 4.3 0 12.1l5.7 5.8 7.8-2.1 2.2-7.9zm-5.3 10.3l-1.2 4.4 3.2 3.2 4.4-1.2 1.2-4.4-3.2-3.2-4.4 1.2zM23.5 7.3L17.2 9l-1.7 6.2 4.5 4.6 6.2-1.7 1.7-6.2-4.4-4.6z"/>
+          <path fill="#fff" d="M15.7 7.9L9.9 2.2 2.1 4.3 0 12.1l5.7 5.8 7.8-2.1 2.2-7.9zm-5.3 10.3l-1.2 4.4 3.2 3.2 4.4-1.2 1.2-4.4-3.2-3.2-4.4 1.2zM23.5 7.3L17.2 9l-1.7 6.2 4.5 4.6 6.2-1.7 1.7-6.2-4.4-4.6z" />
         </svg>
       </div>
     </template>

data/app/views/alchemy/admin/nodes/_page_nodes.html.erb

@@ -7,11 +7,13 @@
       <th class="tools"></th>
     </tr>
     <% nodes = @page.nodes.select(&:persisted?) %>
-    <% seperator = '<alchemy-icon name="arrow-right-s" style="vertical-align: text-bottom"></alchemy-icon>' %>
+    <% seperator = '<alchemy-icon name="arrow-right-s" style="vertical-align: text-bottom"></alchemy-icon>'.html_safe %>
     <% if nodes.length > 0 %>
       <% nodes.each do |node| %>
         <tr class="even">
-          <td><%== node.ancestors.map(&:name).join(seperator) %><%== seperator %><strong><%== node.name %></strong></td>
+          <td>
+            <%= safe_join(node.ancestors.map(&:name), seperator) %><%= seperator %><strong><%= node.name %></strong>
+          </td>
           <td class="tools">
             <sl-tooltip content="<%= Alchemy.t("delete_node") %>">
               <%= link_to render_icon(:minus),

data/lib/alchemy/seeder.rb

@@ -111,7 +111,6 @@ module Alchemy
       def create_page(draft, attributes = {})
         children = draft.delete("children") || []
         page = Alchemy::Page.new(draft.merge(attributes))
-        page.versions.build
         page.save!
         log "Created page: #{page.name}"
         children.each do |child|

data/lib/alchemy/version.rb

@@ -3,7 +3,7 @@
 module Alchemy
   extend self
 
-  VERSION = "8.3.6"
+  VERSION = "8.3.8"
 
   def version
     VERSION

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: alchemy_cms
 version: !ruby/object:Gem::Version
-  version: 8.3.6
+  version: 8.3.8
 platform: ruby
 authors:
 - Thomas von Deyen