avo 3.32.2 → 3.32.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 13b1c5a0ed066f284574b8743387b19cbe300f29f0f204f87072908c050ee3be
-  data.tar.gz: b98a7f5a5692062ebd43f3c56350d28766d504a5bc9f4ee5c1cb49ff7a331341
+  metadata.gz: 0f28594c5b85e9c195d101136003422d6ddc321255474393a02313a54cc0aa86
+  data.tar.gz: 9e483c35a6ca7cddc0173c63526bed3370d7a81d3d7f356813a98e838c11664e
 SHA512:
-  metadata.gz: a92fc374327988751ca0a074da5705b807f7a39fc9ea27973c5f3244fd118d276b74fa5ce67ae6726b92445554ba6bebd32a2b4b6924261acf1336fe015edf8f
-  data.tar.gz: 9838f165435ecb2529c51a138f02a1cc01d18a0b00dee0f448ae865769a0d85bdf9315e9443c3f0890762b349e5ed5494a7a5c55e6706e602c3af3bc14f98930
+  metadata.gz: c5b5123b31107a6acc2456f46d36982af364f665b9593a23cdfc8f45f2edbe32bcc01448dccdbbe406f0c6ae5b3c49bd021e795d2baabbb81cc560228cc84843
+  data.tar.gz: cb4c91879fb962f4a0267a60e768ff2f49ce915a361201564a4b5325797839dcebf99a8ad9acfa13dd06cbac72ad361916bbc105aa06d8af4ccb15f38e4447d6

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    avo (3.32.2)
+    avo (3.32.4)
       actionview (>= 6.1)
       active_link_to
       activerecord (>= 6.1)

data/app/components/avo/fields/belongs_to_field/edit_component.rb

@@ -62,6 +62,7 @@ class Avo::Fields::BelongsToField::EditComponent < Avo::Fields::EditComponent
 
     helpers.new_resource_path(**{
       via_relation: @field.id.to_s,
+      via_relation_class: resource.model_class.to_s,
       resource: target_resource || @field.target_resource,
       via_record_id: resource.record.persisted? ? resource.record.to_param : nil,
       via_belongs_to_resource_class: resource.class.name

data/app/controllers/avo/media_library_controller.rb

@@ -1,6 +1,7 @@
 module Avo
   class MediaLibraryController < ApplicationController
     include Pagy::Backend
+
     before_action :authorize_access!
 
     def index
@@ -37,6 +38,13 @@ module Avo
 
     def authorize_access!
       raise_404 if Avo::MediaLibrary.configuration.disabled?
+
+      # `visible` is the per-user gate for the whole feature, not just the
+      # sidebar item. It reads like access control -- a block returning false
+      # for a user is plainly meant to keep that user out -- so it has to be
+      # enforced here, or every Media Library route stays reachable by URL to
+      # anyone who can sign in to Avo.
+      raise_404 unless Avo::MediaLibrary.configuration.visible?
     end
   end
 end

data/lib/avo/resources/base.rb

@@ -575,16 +575,16 @@ module Avo
 
               reflection = @record.class.reflect_on_association(@params[:via_relation]) if @params[:via_relation].present?
 
-              if field.polymorphic_as.present? && field.types.map(&:to_s).include?(@params[:via_relation_class])
+              if field.polymorphic_as.present? && field.types.map(&:to_s).include?(@params[:via_relation_class]) && @params[:via_record_id].present?
                 # set the value to the actual record
                 via_resource = Avo.resource_manager.get_resource_by_model_class(@params[:via_relation_class])
-                value = via_resource.find_record(@params[:via_record_id])
-              elsif reflection.present? && reflection.foreign_key.present? && field.id.to_s == @params[:via_relation].to_s
+                value = via_resource.find_record(@params[:via_record_id]) if via_resource.present?
+              elsif reflection.present? && reflection.foreign_key.present? && field.id.to_s == @params[:via_relation].to_s && @params[:via_record_id].present?
                 resource = Avo.resource_manager.get_resource_by_model_class params[:via_relation_class]
-                record = resource.find_record @params[:via_record_id], params: params
+                record = resource.find_record @params[:via_record_id], params: params if resource.present?
                 id_param = reflection.options[:primary_key] || :id
 
-                value = record.send(id_param)
+                value = record.send(id_param) if record.present?
               end
             end
 

data/lib/avo/version.rb

@@ -1,3 +1,3 @@
 module Avo
-  VERSION = "3.32.2" unless const_defined?(:VERSION)
+  VERSION = "3.32.4" unless const_defined?(:VERSION)
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: avo
 version: !ruby/object:Gem::Version
-  version: 3.32.2
+  version: 3.32.4
 platform: ruby
 authors:
 - Adrian Marin