alchemy_cms 8.0.14 → 8.0.15

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 9789161d6c201059cca5051f7bccc49f8ab6135cce60603b4d7fe746042f0406
4
- data.tar.gz: 108a61b06d1b54dcc527d8264ecc26cce54351a37b868aa047bb3e5e461a0982
3
+ metadata.gz: b0cc969963dbe3e7c04db1c2568c4a9de91e71795fbc50a0aad6a6326bf1e721
4
+ data.tar.gz: 0b8beb15950a53dad7718a84b5741452424580c5d9fdb2a8a971ba8379125f4a
5
5
  SHA512:
6
- metadata.gz: bfbfcced4a951b6baf9e934d28ea52c35aea448be113866f07722a1d084e3e36d00d0947f698f56bd93f81125b41f69509126aa94dda2140033971b64cf97d8f
7
- data.tar.gz: 2c01c00eaba2eca05da790b784495075e4ebb6b7905e0519b8c1cd79ba1427832d3fb1c4fd27747c7c0cddff1f5f32da9f3b34dde0dd2048d5ee4ee89189c915
6
+ metadata.gz: 9129a55022b22839f6428bcb4117c12eccb6ba5cbe5e07231fec98b0d8801a581574074756004cf61c20cfbcb4f8b1dc19e9d557b977a1793faa3ca7b484fefa
7
+ data.tar.gz: bf00adbf712881752a39d96acb5f4e89f45845aa2e12335fd1d3def932d35324631932ba8555692b24ca7e5216b6bf7d52685b89e683f7fcfd7aa66ddeba17df
@@ -28,6 +28,8 @@ module Alchemy
28
28
  def nested
29
29
  @page = Page.find_by(id: params[:page_id]) || Language.current_root_page
30
30
 
31
+ authorize! :show, @page
32
+
31
33
  render json: PageTreeSerializer.new(
32
34
  @page,
33
35
  ability: current_ability,
@@ -9,7 +9,21 @@ module Alchemy
9
9
  def pages
10
10
  tree = []
11
11
  path = [{id: object.parent_id, children: tree}]
12
- page_list = object.self_and_descendants.includes(:public_version, {language: :site})
12
+ page_list = object.self_and_descendants
13
+ .accessible_by(opts[:ability], :read)
14
+ .includes(:public_version, {language: :site})
15
+ .to_a
16
+ # Drop pages whose parent was filtered out by the ability, so a
17
+ # restricted or unpublished branch does not leak its accessible
18
+ # descendants. self_and_descendants is ordered pre-order, so a parent
19
+ # always precedes its children and a single pass is sufficient.
20
+ kept_ids = Set.new([object.id])
21
+ page_list = page_list.select do |page|
22
+ next true if page.id == object.id
23
+ kept_ids.include?(page.parent_id).tap do |kept|
24
+ kept_ids << page.id if kept
25
+ end
26
+ end
13
27
  base_level = object.level - 1
14
28
  # Load folded pages in advance
15
29
  folded_user_pages = FoldedPage.folded_for_user(opts[:user]).pluck(:page_id)
@@ -83,6 +97,8 @@ module Alchemy
83
97
  end
84
98
 
85
99
  def page_elements(page)
100
+ return Alchemy::Element.none unless opts[:ability].can?(:read, page)
101
+
86
102
  elements = page.public_version&.elements || Alchemy::Element.none
87
103
  if opts[:elements] == "true"
88
104
  elements
@@ -8,7 +8,7 @@
8
8
  <%= render_icon "file-edit", size: "xl" %>
9
9
  </sl-tooltip>
10
10
  <% else %>
11
- <%= render_icon "file-edit", size: "xl" %>
11
+ <%= render_icon "file", size: "xl" %>
12
12
  <% end %>
13
13
  </div>
14
14
  <div class="sitemap_sitename without-status">
@@ -18,8 +18,6 @@ module Alchemy
18
18
  when /^alchemy\/page_layouts\/_(\w+)/
19
19
  page_definition = PageDefinition.get($1)
20
20
  page_definition.elements.map { "alchemy/elements/_#{_1}" }
21
- when /^alchemy\/elements\/_(\w+)/
22
- ingredient_types($1).map { "alchemy/ingredients/_#{_1.underscore}_view" }.tap(&:uniq!)
23
21
  else
24
22
  ActionView::DependencyTracker::ERBTracker.call(@name, @template)
25
23
  end
@@ -1,7 +1,7 @@
1
1
  # frozen_string_literal: true
2
2
 
3
3
  module Alchemy
4
- VERSION = "8.0.14"
4
+ VERSION = "8.0.15"
5
5
 
6
6
  def self.version
7
7
  VERSION
metadata CHANGED
@@ -1,7 +1,7 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: alchemy_cms
3
3
  version: !ruby/object:Gem::Version
4
- version: 8.0.14
4
+ version: 8.0.15
5
5
  platform: ruby
6
6
  authors:
7
7
  - Thomas von Deyen