avo 3.30.2 → 3.30.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9a17bd5d64c6fd414881870b8be0a2931760b73fe27584d79b89d4e4b7646e7a
-  data.tar.gz: 314c446cca23dc08ad254bd0f04df648832b53a7f48e7d538dd1bccdf395518f
+  metadata.gz: cd6222805c1fb419248e68b029cd5b9dec91b0d2faccf403d6f1ad39ce2a96f2
+  data.tar.gz: fa3ff35952311e35121b928d89dbc9c9d7e613ee96465b83a1c106ad9c2eb342
 SHA512:
-  metadata.gz: fcf5f063eddacec4a7298837b1200e400acb86034f5c469a4c56adc7fa5e087b464c2ed5ee1a56a924368c88dd30b1012bbc7b3a13ed8b5d2cae3d319e34e62a
-  data.tar.gz: f4c58d1f4806ff77e0a73885a6bb2e491b6f55f4e45a66dfb345665e290b093b2571c6b03f6b3bfaa62ee2f13bde21761ee4b263dae7e19eacae5234d1101468
+  metadata.gz: f47c3579be975550a03d97c5451d9a3911ecc71ba473a9e8b9897ffd6130d5e0e694ffe7f68573c58fe4a56da267cb58e7230f44f5fa5c5fa5b39b19e6e0cbcf
+  data.tar.gz: a9b8729b81e5d8487738aa22c2298ae3e809089892e4116f1c23b25cfc52941a2207619a21c6f70db64741a682641f46ba9792dfa10769a2de3edc576a6c3823

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    avo (3.30.2)
+    avo (3.30.3)
       actionview (>= 6.1)
       active_link_to
       activerecord (>= 6.1)

data/app/components/avo/referrer_params_component.html.erb

@@ -4,5 +4,5 @@
 <%= hidden_field_tag :via_record_id, params[:via_record_id] if params[:via_record_id] %>
 <%= hidden_field_tag :via_relation, params[:via_relation] if params[:via_relation] %>
 <%= hidden_field_tag :via_belongs_to_resource_class, params[:via_belongs_to_resource_class] if params[:via_belongs_to_resource_class] %>
-<%= hidden_field_tag :return_to, params[:return_to] if params[:return_to].present? %>
+<%= hidden_field_tag :return_to, e(params[:return_to]) if params[:return_to].present? %>
 <%= hidden_field_tag :referrer, @back_path if params[:via_resource_class] %>

data/app/components/avo/views/resource_show_component.rb

@@ -57,7 +57,7 @@ class Avo::Views::ResourceShowComponent < Avo::ResourceComponent
     # When coming from a turbo frame, we don't want to return to that exact frame
     # for example when editing a has_one field we want to return to the parent frame
     # not the frame of the has_one field.
-    args[:return_to] = request.url unless request.url.include?("turbo_frame=")
+    args[:return_to] = e(request.fullpath) unless request.url.include?("turbo_frame=")
 
     helpers.edit_resource_path(record: @resource.record, resource: @resource, **args)
   end

data/app/controllers/avo/base_application_controller.rb

@@ -326,7 +326,6 @@ module Avo
 
     def decode_params
       if params[:return_to].present?
-        params[:raw_return_to] = params[:return_to]
         params[:return_to] = d(params[:return_to])
       end
     end

data/app/controllers/avo/base_controller.rb

@@ -546,7 +546,9 @@ module Avo
       return nil if @resource.class.send(action).blank?
 
       extra_args = {}
-      extra_args[:return_to] = params[:return_to] if params[:return_to].present?
+      if params[:return_to].present?
+        extra_args[:return_to] = e(params[:return_to])
+      end
 
       if @resource.class.send(action) == :index
         resources_path(resource: @resource, **extra_args)

data/app/helpers/avo/application_helper.rb

@@ -161,14 +161,16 @@ module Avo
 
     # encode & encrypt params
     def e(value)
-      Avo::Services::EncryptionService.encrypt(message: value, purpose: :return_to, serializer: Marshal)
+      encrypted = Avo::Services::EncryptionService.encrypt(message: value, purpose: :return_to, serializer: Marshal)
+      Base64.urlsafe_encode64(encrypted, padding: false)
     end
 
     # decrypt & decode params
     def d(value)
-      Avo::Services::EncryptionService.decrypt(message: value, purpose: :return_to, serializer: Marshal)
+      decoded = Base64.urlsafe_decode64(value.to_s)
+      Avo::Services::EncryptionService.decrypt(message: decoded, purpose: :return_to, serializer: Marshal)
     rescue
-      value
+      nil
     end
 
     private

data/lib/avo/version.rb

@@ -1,3 +1,3 @@
 module Avo
-  VERSION = "3.30.2" unless const_defined?(:VERSION)
+  VERSION = "3.30.3" unless const_defined?(:VERSION)
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: avo
 version: !ruby/object:Gem::Version
-  version: 3.30.2
+  version: 3.30.3
 platform: ruby
 authors:
 - Adrian Marin