alchemy_cms 8.4.2 → 8.4.3

data/app/controllers/alchemy/admin/dashboard/widgets_controller.rb

@@ -11,10 +11,13 @@ module Alchemy
       private
 
       def get_widget(id)
-        "#{MODULE_NAMESPACE}::#{id.camelcase}".constantize
-      rescue NameError => e
+        widget = "#{MODULE_NAMESPACE}::#{id.camelcase}".safe_constantize
+        # Constant lookup also finds classes in the ancestors of a widget,
+        # e.g. "system_info/template" resolves to a ViewComponent internal.
+        return widget if widget.is_a?(Class) && widget.module_parent_name == MODULE_NAMESPACE
+
         Alchemy::Logger.error "No dashboard widget found for id: #{id}"
-        raise ActionController::RoutingError, e.message
+        raise ActionController::RoutingError, "No dashboard widget found for id: #{id}"
       end
     end
   end

data/app/controllers/alchemy/base_controller.rb

@@ -9,7 +9,7 @@ module Alchemy
     include Alchemy::ControllerActions
     include Alchemy::Modules
 
-    protect_from_forgery
+    protect_from_forgery prepend: true
 
     before_action :mailer_set_url_options
     before_action :set_locale

data/app/helpers/alchemy/admin/base_helper.rb

@@ -258,6 +258,12 @@ module Alchemy
         ].compact
       end
 
+      # Restores the elements window width the user dragged it to.
+      def alchemy_body_style
+        width = cookies["alchemy-elements-window-width"]
+        "--elements-window-width: #{width}px" if width&.match?(/\A\d+(\.\d+)?\z/)
+      end
+
       # (internal) Returns options for the clipboard select tag
       def clipboard_select_tag_options(items)
         options = items.map do |item|

data/app/models/alchemy/element/element_ingredients.rb

@@ -18,10 +18,24 @@ module Alchemy
         before_create :build_ingredients,
           unless: -> { autogenerate_ingredients == false }
 
-        accepts_nested_attributes_for :ingredients
+        accepts_nested_attributes_for :ingredients, reject_if: ->(attributes) { attributes[:id].blank? }
         validates_associated :ingredients, on: :update
       end
 
+      # Only the editable attributes of each ingredient's own class are
+      # assigned, so +type+, +role+ or +related_object_type+ can never be.
+      def ingredients_attributes=(attributes)
+        attributes = attributes.to_h if attributes.respond_to?(:permitted?)
+        if attributes.is_a?(Hash) && !attributes.key?("id") && !attributes.key?(:id)
+          attributes = attributes.values
+        end
+        super(Array.wrap(attributes).map { |ingredient_attributes|
+          ingredient_attributes = ingredient_attributes.to_h.with_indifferent_access
+          ingredient = ingredients.detect { _1.id.to_s == ingredient_attributes[:id].to_s }
+          ingredient_attributes.slice(:id, *ingredient&.class&.editable_attributes)
+        })
+      end
+
       # The value of an ingredient of the element by role
       def value_for(role)
         ingredient_by_role(role)&.value

data/app/models/alchemy/ingredient.rb

@@ -34,6 +34,8 @@ module Alchemy
 
     attribute :data, :json
 
+    class_attribute :related_object_id_alias, instance_accessor: false
+
     belongs_to :element, touch: true, class_name: "Alchemy::Element", inverse_of: :ingredients
     belongs_to :related_object, polymorphic: true, optional: true
 
@@ -72,6 +74,7 @@ module Alchemy
       # @param [String|Symbol] The name of the alias
       # @param [String] The class name of the related object
       def related_object_alias(name, class_name:)
+        self.related_object_id_alias = :"#{name}_id"
         alias_method name, :related_object
         alias_method :"#{name}=", :related_object=
 
@@ -116,6 +119,11 @@ module Alchemy
       def allowed_settings
         @allowed_settings ||= []
       end
+
+      # Attributes editors may assign through the element form
+      def editable_attributes
+        [:value, *stored_attributes[:data], related_object_id_alias].compact
+      end
     end
 
     # The value or the related object if present

data/app/stylesheets/alchemy/admin/archive.scss

@@ -19,7 +19,8 @@ alchemy-uploader {
 
 .resources-table-wrapper {
   width: 100%;
-  height: 100%;
+  flex: 1;
+  min-height: 0;
   overflow-x: auto;
   padding: var(--spacing-2);
 }

data/app/stylesheets/alchemy/admin/frame.scss

@@ -115,6 +115,8 @@ div#overlay_text_box {
   }
 
   &:has(.resources-table-wrapper) {
+    display: flex;
+    flex-direction: column;
     padding-top: var(--top-menu-height);
     padding-right: 0;
     padding-bottom: 0;

data/app/stylesheets/alchemy/admin/sitemap.scss

@@ -65,8 +65,8 @@ alchemy-sitemap {
 }
 
 #alchemy_pages_tree {
-  display: block;
-  height: calc(100vh - var(--top-menu-height) - var(--spacing-3));
+  display: flow-root;
+  height: 100%;
   position: relative;
 }
 

data/app/views/layouts/alchemy/admin.html.erb

@@ -37,7 +37,7 @@
   </head>
   <%= content_tag :body, id: 'alchemy',
     class: alchemy_body_class,
-    style: cookies["alchemy-elements-window-width"] && "--elements-window-width: #{cookies["alchemy-elements-window-width"]}px" do %>
+    style: alchemy_body_style do %>
     <noscript>
       <h1><%= Alchemy.t(:javascript_disabled_headline) %></h1>
       <p><%= Alchemy.t(:javascript_disabled_text) %></p>

data/lib/alchemy/version.rb

@@ -3,7 +3,7 @@
 module Alchemy
   extend self
 
-  VERSION = "8.4.2"
+  VERSION = "8.4.3"
 
   def version
     VERSION

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: alchemy_cms
 version: !ruby/object:Gem::Version
-  version: 8.4.2
+  version: 8.4.3
 platform: ruby
 authors:
 - Thomas von Deyen