alchemy_cms 8.3.7 → 8.3.9

data/app/components/alchemy/admin/element_select.rb

@@ -17,7 +17,6 @@ module Alchemy
           placeholder: Alchemy.t(:select_element) do
           text_field_tag(field_name, nil, {
             autofocus:,
-            required: true,
             value: elements.many? ? nil : elements.first&.name,
             class: "alchemy_selectbox full_width"
           })

data/app/controllers/alchemy/admin/elements_controller.rb

@@ -49,8 +49,9 @@ module Alchemy
         if @element.save
           render :create, status: 201
         else
+          @parent_element = @element.parent_element
           @element.page_version = @page_version
-          @elements = @page.available_element_definitions
+          @elements = @page.available_elements_within_current_scope(@parent_element)
           render :new, status: 422
         end
       end

data/app/helpers/alchemy/resources_helper.rb

@@ -99,6 +99,31 @@ module Alchemy
       end
     end
 
+    # Returns the value prepared for a cell of a CSV export.
+    #
+    # Spreadsheet applications evaluate a cell starting with one of these characters
+    # as a formula, turning exported content into code that runs on the machine
+    # opening the file. The tab keeps the cell text and, unlike the more common
+    # single quote, survives Excel saving and re-opening the file, which strips
+    # quotes and would reactivate the formula. It only works inside a quoted field,
+    # so the export generates with `force_quotes`.
+    #
+    # A bare negative number is exempt, because spreadsheets read it as a number
+    # instead of a formula, so escaping it would only break arithmetic on the
+    # exported column. An expression like `-2+3` is a formula and stays escaped.
+    #
+    # @see https://owasp.org/www-community/attacks/CSV_Injection
+    #
+    # @param [Object] value
+    # @return [String]
+    #
+    def csv_value(value)
+      value = value.to_s
+      return value if value.match?(/\A-\d+(\.\d+)?\z/)
+
+      value.match?(/\A[-=+@\t\r\n\uFF0D\uFF1D\uFF0B\uFF20]/) ? "\t#{value}" : value
+    end
+
     # Returns a options hash for simple_form input fields.
     def resource_attribute_field_options(attribute)
       options = {hint: resource_handler.help_text_for(attribute)}

data/app/javascript/alchemy_admin/components/attachment_select.js

@@ -1,4 +1,7 @@
-import { RemoteSelect } from "alchemy_admin/components/remote_select"
+import {
+  RemoteSelect,
+  escapeHtml
+} from "alchemy_admin/components/remote_select"
 
 export class AttachmentSelect extends RemoteSelect {
   _renderResult(item) {
@@ -15,7 +18,7 @@ export class AttachmentSelect extends RemoteSelect {
   _renderListEntry(attachment, term) {
     return `
       <div class="attachment-select--attachment">
-        <alchemy-icon name="${attachment.icon_css_class}"></alchemy-icon>
+        <alchemy-icon name="${escapeHtml(attachment.icon_css_class)}"></alchemy-icon>
         <span class="attachment-select--attachment-name">${this._hightlightTerm(attachment.name, term)}</span>
       </div>
     `

data/app/javascript/alchemy_admin/components/node_select.js

@@ -1,4 +1,7 @@
-import { RemoteSelect } from "alchemy_admin/components/remote_select"
+import {
+  RemoteSelect,
+  escapeHtml
+} from "alchemy_admin/components/remote_select"
 
 class NodeSelect extends RemoteSelect {
   _searchQuery(term, page) {
@@ -23,7 +26,7 @@ class NodeSelect extends RemoteSelect {
    * @private
    */
   _renderListEntry(node, term) {
-    const ancestors = node.ancestors.map((a) => a.name)
+    const ancestors = node.ancestors.map((a) => escapeHtml(a.name))
     const seperator = `<alchemy-icon name="arrow-right-s"></alchemy-icon>`
 
     return `
@@ -38,7 +41,7 @@ class NodeSelect extends RemoteSelect {
           </span>
         </div>
         <div class="node-select--node-url">
-          ${node.url || ""}
+          ${escapeHtml(node.url || "")}
         </div>
       </div>
     `

data/app/javascript/alchemy_admin/components/page_select.js

@@ -1,4 +1,7 @@
-import { RemoteSelect } from "alchemy_admin/components/remote_select"
+import {
+  RemoteSelect,
+  escapeHtml
+} from "alchemy_admin/components/remote_select"
 
 export class PageSelect extends RemoteSelect {
   get pageId() {
@@ -30,7 +33,7 @@ export class PageSelect extends RemoteSelect {
    * @private
    */
   _renderResult(page) {
-    return page.text || page.name
+    return escapeHtml(page.text || page.name)
   }
 
   /**
@@ -46,11 +49,11 @@ export class PageSelect extends RemoteSelect {
         <div class="page-select--top">
           <alchemy-icon name="file-3"></alchemy-icon>
           <span class="page-select--page-name">${this._hightlightTerm(page.name, term)}</span>
-          <span class="page-select--site-name">${page.site.name}</span>
+          <span class="page-select--site-name">${escapeHtml(page.site.name)}</span>
         </div>
         <div class="page-select--bottom">
-          <span class="page-select--page-urlname">${page.url_path}</span>
-          <span class="page-select--language-code">${page.language_code}</span>
+          <span class="page-select--page-urlname">${escapeHtml(page.url_path)}</span>
+          <span class="page-select--language-code">${escapeHtml(page.language_code)}</span>
         </div>
       </div>
     `

data/app/javascript/alchemy_admin/components/remote_select.js

@@ -1,7 +1,41 @@
 import { setupSelectLocale } from "alchemy_admin/i18n"
 
+/**
+ * Escapes a string for use within HTML. Select2 hands the return value of
+ * `formatResult`/`formatSelection` straight to jQuery, so everything woven into
+ * those templates has to be escaped here.
+ * @param {string} value
+ * @returns {string}
+ */
+export function escapeHtml(value) {
+  return `${value}`
+    .replace(/&/g, "&")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;")
+}
+
+/**
+ * Escapes a string for literal use inside a `RegExp`, so a term with
+ * metacharacters (e.g. `(`) matches itself instead of being compiled as a
+ * pattern, which could match the wrong text or throw a SyntaxError.
+ * @param {string} value
+ * @returns {string}
+ */
+export function escapeRegExp(value) {
+  return String(value).replace(/[.*+?^${}()|[\]\\]/g, "\\$&")
+}
+
 export function hightlightTerm(name, term) {
-  return name.replace(new RegExp(term, "gi"), (match) => `<em>${match}</em>`)
+  // The result is rendered raw as the entry's name, so the name must be escaped
+  // before the term markup is woven in — otherwise a crafted name (e.g. a menu
+  // node title) is a stored XSS sink.
+  const escapedName = escapeHtml(name)
+  if (!term) return escapedName
+  return escapedName.replace(
+    new RegExp(escapeRegExp(term), "gi"),
+    (match) => `<em>${match}</em>`
+  )
 }
 
 export class RemoteSelect extends HTMLElement {

data/app/javascript/alchemy_admin/components/select.js

@@ -197,6 +197,10 @@ class Select extends HTMLSelectElement {
   }
 
   #destroyTomSelect() {
+    // Tom Select's destroy() removes the dropdown, but it never closes it, so
+    // the onDropdownClose handler does not run and the full window dropdown
+    // mask would be left behind, swallowing every click.
+    this.#tomSelect?.close(false)
     this.#tomSelect?.destroy()
     this.#tomSelect = null
   }

data/app/javascript/alchemy_admin/components/uploader/file_upload.js

@@ -93,11 +93,14 @@ export class FileUpload extends HTMLElement {
       ? config.allowed_filetypes.alchemy_pictures
       : config.allowed_filetypes.alchemy_attachments
 
+    // The allowlist holds filename extensions, so we cannot derive the format
+    // from the MIME type: `application/msword` is not `doc` and every Office
+    // Open XML type only yields `vnd`.
+    const extension = this.file?.name.match(/\.([^.]+)$/)?.[1].toLowerCase()
+
     const isFileFormatSupported =
       allowedFiletypes.includes("*") ||
-      allowedFiletypes.includes(
-        this.file?.type.replace(/^\w+\/(\w+)(\+\w+)?/i, "$1")
-      )
+      allowedFiletypes.some((type) => type.toLowerCase() === extension)
 
     if (!isFileFormatSupported) {
       errorMessage = translate("File type not allowed")

data/app/models/alchemy/storage_adapter/dragonfly.rb

@@ -148,6 +148,12 @@ module Alchemy
       # @param [Alchemy::Attachment]
       # @return [String]
       def file_extension(attachment)
+        extension = File.extname(file_name(attachment).to_s).delete_prefix(".").downcase
+        return extension if extension.present?
+
+        # Marcel returns the canonical extension for a mime type, which is not
+        # always the one the file was named after: `audio/mpeg` yields `mpga`,
+        # not `mp3`. Only reach for it when the name has no extension at all.
         content_type = file_mime_type(attachment)
         Marcel::Magic.new(content_type).extensions.first if content_type
       end

data/app/stylesheets/alchemy/admin/_tom-select.scss

@@ -229,6 +229,7 @@
   .option {
     padding: var(--spacing-2);
     cursor: pointer;
+    min-height: 2.75em;
 
     .highlight {
       text-decoration: underline;

data/app/stylesheets/alchemy/admin/forms.scss

@@ -128,7 +128,8 @@ form {
   }
 
   .field_with_errors {
-    input[type="text"],
+    &:not(:has(.ts-control)) input[type="text"],
+    .ts-control,
     input[type="email"],
     input[type="password"],
     textarea,

data/app/views/alchemy/admin/elements/_form.html.erb

@@ -6,16 +6,13 @@
   <%= turbo_frame_tag @element do %>
     <%= alchemy_form_for [:admin, @element], remote: false do |form| %>
       <%= form.hidden_field :page_version_id %>
-      <div class="input">
-        <%= form.label(:name, class: "control-label required") do %>
-          <%= Alchemy.t(:element_of_type) %><abbr>*</abbr>
-        <% end %>
+      <%= form.input :name, label: Alchemy.t(:element_of_type) do %>
         <%= render Alchemy::Admin::ElementSelect.new(
           @elements,
           field_name: form.field_name(:name),
           autofocus: true
         ) %>
-      </div>
+      <% end %>
       <%= form.hidden_field :parent_element_id, value: @parent_element.try(:id) %>
       <%= form.submit Alchemy.t(:add) %>
     <%- end -%>

data/app/views/alchemy/admin/nodes/_page_nodes.html.erb

@@ -7,11 +7,13 @@
       <th class="tools"></th>
     </tr>
     <% nodes = @page.nodes.select(&:persisted?) %>
-    <% seperator = '<alchemy-icon name="arrow-right-s" style="vertical-align: text-bottom"></alchemy-icon>' %>
+    <% seperator = '<alchemy-icon name="arrow-right-s" style="vertical-align: text-bottom"></alchemy-icon>'.html_safe %>
     <% if nodes.length > 0 %>
       <% nodes.each do |node| %>
         <tr class="even">
-          <td><%== node.ancestors.map(&:name).join(seperator) %><%== seperator %><strong><%== node.name %></strong></td>
+          <td>
+            <%= safe_join(node.ancestors.map(&:name), seperator) %><%= seperator %><strong><%= node.name %></strong>
+          </td>
           <td class="tools">
             <sl-tooltip content="<%= Alchemy.t("delete_node") %>">
               <%= link_to render_icon(:minus),

data/app/views/alchemy/admin/resources/index.csv.erb

@@ -1,13 +1,13 @@
-<% csv = CSV.generate(col_sep: ";", row_sep: "\r\n") do |row| %>
+<% csv = CSV.generate(col_sep: ";", row_sep: "\r\n", force_quotes: true) do |row| %>
   <% row << ["Id"] + resource_handler.attributes.collect do |a|
-              resource_handler.model.human_attribute_name(a[:name])
+              csv_value(resource_handler.model.human_attribute_name(a[:name]))
             end %>
   <% resources_instance_variable.each do |resource| %>
     <% row << [resource.id] + resource_handler.attributes.map do |a|
                 if a[:type] == :boolean
                   resource.send(a[:name]) ? 'x' : ''
                 else
-                  render_attribute(resource, a, {truncate: false}).to_s.strip
+                  csv_value(render_attribute(resource, a, {truncate: false}).to_s.strip)
                 end
               end %>
   <% end %>

data/db/migrate/20260115164704_add_publication_timestamps_to_alchemy_elements.rb

@@ -1,30 +1,44 @@
 class AddPublicationTimestampsToAlchemyElements < ActiveRecord::Migration[7.2]
+  # Only SQLite needs this: it has no real ALTER TABLE, so the remove_column
+  # calls in down rebuild the table via DROP TABLE, whose implicit DELETE
+  # cascades into alchemy_ingredients. The adapter's PRAGMA foreign_keys = OFF
+  # guard against that is a silent no-op inside a transaction.
+  disable_ddl_transaction! if connection.adapter_name.match?(/sqlite/i)
+
   def up
-    add_column :alchemy_elements, :public_on, :datetime
-    add_column :alchemy_elements, :public_until, :datetime
+    # Adding nullable columns is a plain ALTER TABLE ADD COLUMN, so up can keep
+    # the atomicity the declaration above gives up for both directions.
+    connection.transaction do
+      add_column :alchemy_elements, :public_on, :datetime
+      add_column :alchemy_elements, :public_until, :datetime
 
-    say_with_time "Populating publication dates" do
-      update <<-SQL.squish
-        UPDATE alchemy_elements
-        SET public_on = created_at
-        WHERE public = #{connection.quoted_true}
-      SQL
+      say_with_time "Populating publication dates" do
+        update <<-SQL.squish
+          UPDATE alchemy_elements
+          SET public_on = created_at
+          WHERE public = #{connection.quoted_true}
+        SQL
+      end
     end
   end
 
   def down
-    say_with_time "Reverting publication dates" do
-      update <<-SQL.squish
-        UPDATE alchemy_elements
-        SET public = CASE
-          WHEN public_on IS NOT NULL AND public_on <= CURRENT_TIMESTAMP
-          THEN #{connection.quoted_true}
-          ELSE #{connection.quoted_false}
-        END
-      SQL
+    # Running without a transaction on SQLite, a re-run can start after the
+    # columns are already gone, leaving the statement below nothing to read.
+    if connection.column_exists?(:alchemy_elements, :public_on)
+      say_with_time "Reverting publication dates" do
+        update <<-SQL.squish
+          UPDATE alchemy_elements
+          SET public = CASE
+            WHEN public_on IS NOT NULL AND public_on <= CURRENT_TIMESTAMP
+            THEN #{connection.quoted_true}
+            ELSE #{connection.quoted_false}
+          END
+        SQL
+      end
     end
 
-    remove_column :alchemy_elements, :public_until
-    remove_column :alchemy_elements, :public_on
+    remove_column :alchemy_elements, :public_until, if_exists: true
+    remove_column :alchemy_elements, :public_on, if_exists: true
   end
 end

data/lib/alchemy/version.rb

@@ -3,7 +3,7 @@
 module Alchemy
   extend self
 
-  VERSION = "8.3.7"
+  VERSION = "8.3.9"
 
   def version
     VERSION

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: alchemy_cms
 version: !ruby/object:Gem::Version
-  version: 8.3.7
+  version: 8.3.9
 platform: ruby
 authors:
 - Thomas von Deyen