alchemy_cms 8.3.8 → 8.3.9

data/app/components/alchemy/admin/element_select.rb

@@ -17,7 +17,6 @@ module Alchemy
           placeholder: Alchemy.t(:select_element) do
           text_field_tag(field_name, nil, {
             autofocus:,
-            required: true,
             value: elements.many? ? nil : elements.first&.name,
             class: "alchemy_selectbox full_width"
           })

data/app/controllers/alchemy/admin/elements_controller.rb

@@ -49,8 +49,9 @@ module Alchemy
         if @element.save
           render :create, status: 201
         else
+          @parent_element = @element.parent_element
           @element.page_version = @page_version
-          @elements = @page.available_element_definitions
+          @elements = @page.available_elements_within_current_scope(@parent_element)
           render :new, status: 422
         end
       end

data/app/helpers/alchemy/resources_helper.rb

@@ -99,6 +99,31 @@ module Alchemy
       end
     end
 
+    # Returns the value prepared for a cell of a CSV export.
+    #
+    # Spreadsheet applications evaluate a cell starting with one of these characters
+    # as a formula, turning exported content into code that runs on the machine
+    # opening the file. The tab keeps the cell text and, unlike the more common
+    # single quote, survives Excel saving and re-opening the file, which strips
+    # quotes and would reactivate the formula. It only works inside a quoted field,
+    # so the export generates with `force_quotes`.
+    #
+    # A bare negative number is exempt, because spreadsheets read it as a number
+    # instead of a formula, so escaping it would only break arithmetic on the
+    # exported column. An expression like `-2+3` is a formula and stays escaped.
+    #
+    # @see https://owasp.org/www-community/attacks/CSV_Injection
+    #
+    # @param [Object] value
+    # @return [String]
+    #
+    def csv_value(value)
+      value = value.to_s
+      return value if value.match?(/\A-\d+(\.\d+)?\z/)
+
+      value.match?(/\A[-=+@\t\r\n\uFF0D\uFF1D\uFF0B\uFF20]/) ? "\t#{value}" : value
+    end
+
     # Returns a options hash for simple_form input fields.
     def resource_attribute_field_options(attribute)
       options = {hint: resource_handler.help_text_for(attribute)}

data/app/javascript/alchemy_admin/components/select.js

@@ -197,6 +197,10 @@ class Select extends HTMLSelectElement {
   }
 
   #destroyTomSelect() {
+    // Tom Select's destroy() removes the dropdown, but it never closes it, so
+    // the onDropdownClose handler does not run and the full window dropdown
+    // mask would be left behind, swallowing every click.
+    this.#tomSelect?.close(false)
     this.#tomSelect?.destroy()
     this.#tomSelect = null
   }

data/app/javascript/alchemy_admin/components/uploader/file_upload.js

@@ -93,11 +93,14 @@ export class FileUpload extends HTMLElement {
       ? config.allowed_filetypes.alchemy_pictures
       : config.allowed_filetypes.alchemy_attachments
 
+    // The allowlist holds filename extensions, so we cannot derive the format
+    // from the MIME type: `application/msword` is not `doc` and every Office
+    // Open XML type only yields `vnd`.
+    const extension = this.file?.name.match(/\.([^.]+)$/)?.[1].toLowerCase()
+
     const isFileFormatSupported =
       allowedFiletypes.includes("*") ||
-      allowedFiletypes.includes(
-        this.file?.type.replace(/^\w+\/(\w+)(\+\w+)?/i, "$1")
-      )
+      allowedFiletypes.some((type) => type.toLowerCase() === extension)
 
     if (!isFileFormatSupported) {
       errorMessage = translate("File type not allowed")

data/app/models/alchemy/storage_adapter/dragonfly.rb

@@ -148,6 +148,12 @@ module Alchemy
       # @param [Alchemy::Attachment]
       # @return [String]
       def file_extension(attachment)
+        extension = File.extname(file_name(attachment).to_s).delete_prefix(".").downcase
+        return extension if extension.present?
+
+        # Marcel returns the canonical extension for a mime type, which is not
+        # always the one the file was named after: `audio/mpeg` yields `mpga`,
+        # not `mp3`. Only reach for it when the name has no extension at all.
         content_type = file_mime_type(attachment)
         Marcel::Magic.new(content_type).extensions.first if content_type
       end

data/app/views/alchemy/admin/elements/_form.html.erb

@@ -6,16 +6,13 @@
   <%= turbo_frame_tag @element do %>
     <%= alchemy_form_for [:admin, @element], remote: false do |form| %>
       <%= form.hidden_field :page_version_id %>
-      <div class="input">
-        <%= form.label(:name, class: "control-label required") do %>
-          <%= Alchemy.t(:element_of_type) %><abbr>*</abbr>
-        <% end %>
+      <%= form.input :name, label: Alchemy.t(:element_of_type) do %>
         <%= render Alchemy::Admin::ElementSelect.new(
           @elements,
           field_name: form.field_name(:name),
           autofocus: true
         ) %>
-      </div>
+      <% end %>
       <%= form.hidden_field :parent_element_id, value: @parent_element.try(:id) %>
       <%= form.submit Alchemy.t(:add) %>
     <%- end -%>

data/app/views/alchemy/admin/resources/index.csv.erb

@@ -1,13 +1,13 @@
-<% csv = CSV.generate(col_sep: ";", row_sep: "\r\n") do |row| %>
+<% csv = CSV.generate(col_sep: ";", row_sep: "\r\n", force_quotes: true) do |row| %>
   <% row << ["Id"] + resource_handler.attributes.collect do |a|
-              resource_handler.model.human_attribute_name(a[:name])
+              csv_value(resource_handler.model.human_attribute_name(a[:name]))
             end %>
   <% resources_instance_variable.each do |resource| %>
     <% row << [resource.id] + resource_handler.attributes.map do |a|
                 if a[:type] == :boolean
                   resource.send(a[:name]) ? 'x' : ''
                 else
-                  render_attribute(resource, a, {truncate: false}).to_s.strip
+                  csv_value(render_attribute(resource, a, {truncate: false}).to_s.strip)
                 end
               end %>
   <% end %>

data/db/migrate/20260115164704_add_publication_timestamps_to_alchemy_elements.rb

@@ -1,30 +1,44 @@
 class AddPublicationTimestampsToAlchemyElements < ActiveRecord::Migration[7.2]
+  # Only SQLite needs this: it has no real ALTER TABLE, so the remove_column
+  # calls in down rebuild the table via DROP TABLE, whose implicit DELETE
+  # cascades into alchemy_ingredients. The adapter's PRAGMA foreign_keys = OFF
+  # guard against that is a silent no-op inside a transaction.
+  disable_ddl_transaction! if connection.adapter_name.match?(/sqlite/i)
+
   def up
-    add_column :alchemy_elements, :public_on, :datetime
-    add_column :alchemy_elements, :public_until, :datetime
+    # Adding nullable columns is a plain ALTER TABLE ADD COLUMN, so up can keep
+    # the atomicity the declaration above gives up for both directions.
+    connection.transaction do
+      add_column :alchemy_elements, :public_on, :datetime
+      add_column :alchemy_elements, :public_until, :datetime
 
-    say_with_time "Populating publication dates" do
-      update <<-SQL.squish
-        UPDATE alchemy_elements
-        SET public_on = created_at
-        WHERE public = #{connection.quoted_true}
-      SQL
+      say_with_time "Populating publication dates" do
+        update <<-SQL.squish
+          UPDATE alchemy_elements
+          SET public_on = created_at
+          WHERE public = #{connection.quoted_true}
+        SQL
+      end
     end
   end
 
   def down
-    say_with_time "Reverting publication dates" do
-      update <<-SQL.squish
-        UPDATE alchemy_elements
-        SET public = CASE
-          WHEN public_on IS NOT NULL AND public_on <= CURRENT_TIMESTAMP
-          THEN #{connection.quoted_true}
-          ELSE #{connection.quoted_false}
-        END
-      SQL
+    # Running without a transaction on SQLite, a re-run can start after the
+    # columns are already gone, leaving the statement below nothing to read.
+    if connection.column_exists?(:alchemy_elements, :public_on)
+      say_with_time "Reverting publication dates" do
+        update <<-SQL.squish
+          UPDATE alchemy_elements
+          SET public = CASE
+            WHEN public_on IS NOT NULL AND public_on <= CURRENT_TIMESTAMP
+            THEN #{connection.quoted_true}
+            ELSE #{connection.quoted_false}
+          END
+        SQL
+      end
     end
 
-    remove_column :alchemy_elements, :public_until
-    remove_column :alchemy_elements, :public_on
+    remove_column :alchemy_elements, :public_until, if_exists: true
+    remove_column :alchemy_elements, :public_on, if_exists: true
   end
 end

data/lib/alchemy/version.rb

@@ -3,7 +3,7 @@
 module Alchemy
   extend self
 
-  VERSION = "8.3.8"
+  VERSION = "8.3.9"
 
   def version
     VERSION

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: alchemy_cms
 version: !ruby/object:Gem::Version
-  version: 8.3.8
+  version: 8.3.9
 platform: ruby
 authors:
 - Thomas von Deyen