avo 2.46.0 → 2.48.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1732dea0a1d6b5884e2119151890af9c9231130feb1ae8fcfda51ce5f6380fa2
-  data.tar.gz: 2ad0edd469aa3452c563ab37d65380f9ac04aac8845da08c1a8830bb3b36cf7f
+  metadata.gz: 63a1e190de1ea81343c769a8896e64c91aab1024084dc04d3b8ed1ce96e55233
+  data.tar.gz: cd447a81f2d123f536fe500ee57c6cd1396df2e5615ae4b8f1d3dfa944ff8214
 SHA512:
-  metadata.gz: bc5bd679ff67400b1b68ad0c09b16b1f991b0c7e2e1db02cc2e15aa8fc25873f0fdfb2304b5482531e71bf49a62d7f24be2baff6ff5247321ecc70980c763ce4
-  data.tar.gz: ae13f86f47ed15d14f0eb128072d4ea5c4dfc5299f9dfd2729c7eb48d561ac6c1bd24af6bc92732a0eac3c798c38dbe3e2d7e37896415dba79f74beeaf18b7c6
+  metadata.gz: 83f2e5618a4fd689d5619d0c390bf41bae93e73b74b75d30b2cfddc2091eb7770a76704df7a251897910c886d25fefd97e5c4e0de179cb2ac2b93f3a3886855c
+  data.tar.gz: 30ed29798e3563143acf57eb594c915fdaac080b082bf02fb5a72c4073b3eed53256773b17987f17e0cb0a26bc3e257ee77ea45aaed92ac9d3c5e2b10843b8ca

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    avo (2.46.0)
+    avo (2.48.0)
       actionview (>= 6.0)
       active_link_to
       activerecord (>= 6.0)
@@ -269,10 +269,10 @@ GEM
     net-smtp (0.3.3)
       net-protocol
     nio4r (2.5.9)
-    nokogiri (1.15.4)
+    nokogiri (1.16.0)
       mini_portile2 (~> 2.8.2)
       racc (~> 1.4)
-    nokogiri (1.15.4-x86_64-linux)
+    nokogiri (1.16.0-x86_64-linux)
       racc (~> 1.4)
     orm_adapter (0.5.0)
     pagy (6.0.4)

data/app/components/avo/field_wrapper_component.rb

@@ -82,6 +82,12 @@ class Avo::FieldWrapperComponent < ViewComponent::Base
       **@data
     }
 
+    # Fetch the data attributes off the html option
+    wrapper_data_attributes = @field.get_html :data, view: view, element: :wrapper
+    if wrapper_data_attributes.present?
+      attributes.merge! wrapper_data_attributes
+    end
+
     # Add the built-in stimulus integration data tags.
     if @resource.present?
       add_stimulus_attributes_for(@resource, attributes)
@@ -91,12 +97,6 @@ class Avo::FieldWrapperComponent < ViewComponent::Base
       add_stimulus_attributes_for(@action, attributes)
     end
 
-    # Fetch the data attributes off the html option
-    wrapper_data_attributes = @field.get_html :data, view: view, element: :wrapper
-    if wrapper_data_attributes.present?
-      attributes.merge! wrapper_data_attributes
-    end
-
     attributes
   end
 

data/app/components/avo/fields/common/files/view_type/grid_item_component.html.erb

@@ -1,6 +1,6 @@
 <div id="<%= dom_id file %>" class="relative min-h-full max-w-full flex-1 flex flex-col justify-between space-y-2">
   <% if file.present? %>
-    <div class="flex h-full">
+    <div class="flex flex-col h-full">
       <% if file.representable? && is_image? %>
         <%= image_tag helpers.main_app.url_for(file), class: "rounded-lg max-w-full #{@extra_classes}" %>
       <% elsif is_audio? %>

data/app/components/avo/fields/hidden_field/edit_component.html.erb

@@ -1,5 +1,6 @@
 <%= @form.hidden_field @field.id,
   class: @field.get_html(:classes, view: view, element: :input),
   data: @field.get_html(:data, view: view, element: :input),
-  style: @field.get_html(:style, view: view, element: :input)
+  style: @field.get_html(:style, view: view, element: :input),
+  value: @field.value
 %>

data/app/javascript/js/controllers/fields/key_value_controller.js

@@ -1,4 +1,5 @@
 /* eslint-disable max-len */
+import * as DOMPurify from 'dompurify'
 import { Controller } from '@hotwired/stimulus'
 import { castBoolean } from '../../helpers/cast_boolean'
 
@@ -80,7 +81,7 @@ export default class extends Controller {
     let index = 0
     this.fieldValue.forEach((row) => {
       const [key, value] = row
-      result += this.interpolatedRow(key, value, index)
+      result += this.interpolatedRow(DOMPurify.sanitize(key), DOMPurify.sanitize(value), index)
       index++
     })
     this.rowsTarget.innerHTML = result

data/lib/avo/services/encryption_service.rb

@@ -32,16 +32,12 @@ module Avo
       private
 
       def encryption_key
-        secret_key_base[0..31]
+        Rails.application.secret_key_base[0..31]
       rescue
         # This will fail the decryption process.
         # It's here only to keep Avo from crashing
         SecureRandom.random_bytes(32)
       end
-
-      def secret_key_base
-        ENV["SECRET_KEY_BASE"] || Rails.application.credentials.secret_key_base || Rails.application.secrets.secret_key_base
-      end
     end
   end
 end

data/lib/avo/version.rb

@@ -1,3 +1,3 @@
 module Avo
-  VERSION = "2.46.0" unless const_defined?(:VERSION)
+  VERSION = "2.48.0" unless const_defined?(:VERSION)
 end