bf4-browsercms 3.1.0

data/app/controllers/cms/sessions_controller.rb

@@ -0,0 +1,71 @@
+# This controller handles the login/logout function of the site.  
+class Cms::SessionsController < Cms::ApplicationController
+
+  before_filter :redirect_to_cms_site, :only => [:new]
+  layout "cms/login"
+
+  def new
+
+  end
+
+  def create
+    logout_keeping_session!
+    user = User.authenticate(params[:login], params[:password])
+    if user
+      # Protects against session fixation attacks, causes request forgery
+      # protection if user resubmits an earlier form using back
+      # button. Uncomment if you understand the tradeoffs.
+      # reset_session
+      self.current_user = user
+      new_cookie_flag = (params[:remember_me] == "1")
+      handle_remember_cookie! new_cookie_flag
+      flash[:notice] = "Logged in successfully"
+      if params[:success_url] # Coming from login portlet
+        redirect_to((!params[:success_url].blank? && params[:success_url]) || session[:return_to] || "/")
+        session[:return_to] = nil
+      else
+        redirect_back_or_default(cms_home_url)
+      end
+    else
+      note_failed_signin
+      @login       = params[:login]
+      @remember_me = params[:remember_me]
+      flash[:login_error] = "Log in failed"
+      if params[:success_url] # Coming from login portlet
+        if params[:success_url].blank?
+          success_url = session[:return_to] || "/"
+        else
+          success_url = params[:success_url]
+        end
+        flash[:login] = params[:login]
+        flash[:remember_me] = params[:remember_me]
+        flash[:success_url] = success_url
+        redirect_to request.referrer
+      else
+        render :action => "new"
+      end
+    end
+  end
+
+  def destroy
+    logout_user
+    redirect_back_or_default("/")
+  end
+
+  protected
+
+  # Pulled this out as a separate method so that modules (like bcms_cas) can override/alias destroy and
+  # not have a redirect happen as a side effect.
+  def logout_user
+    logout_killing_session!
+    cookies.delete :openSectionNodes
+    flash[:notice] = "You have been logged out."
+  end
+
+  # Track failed login attempts
+  def note_failed_signin
+    flash[:error] = "Couldn't log you in as '#{params[:login]}'"
+    logger.warn "Failed login for '#{params[:login]}' from #{request.remote_ip} at #{Time.now.utc}"
+  end
+
+end

data/app/controllers/cms/tags_controller.rb

@@ -0,0 +1,12 @@
+class Cms::TagsController < Cms::ContentBlockController
+  def index
+    load_blocks
+    respond_to do |format| 
+      format.html { render "#{template_directory}/index" }
+      format.js { render :inline => "var tags = #{@blocks.map{|e| e.name}.to_json}" }
+    end
+  end
+  def show
+    redirect_to cms_tags_url
+  end
+end

data/app/controllers/cms/task_items_controller.rb

@@ -0,0 +1,52 @@
+class Cms::TaskItemsController < Cms::BaseController
+  
+  before_filter :set_toolbar_tab
+  before_filter :load_page, :only => [:new, :create]
+  
+  def new
+    @task_item = @page.task_items.build(:assigned_by => current_user)
+  end
+  
+  def create
+    @task_item = @page.task_items.build(params[:task_item])
+    @task_item.assigned_by = current_user
+    if @task_item.save
+      flash[:notice] = "Page was assigned to '#{@task_item.assigned_to.login}'"
+      redirect_to @page.path
+    else
+      render :action => 'new'
+    end
+  end
+  
+  def complete
+    if params[:task_item_ids]
+      TaskItem.all(:conditions => ["id in (?)", params[:task_item_ids]]).each do |t|
+        if t.assigned_to == current_user
+          t.mark_as_complete!
+        end
+      end
+      flash[:notice] = "Tasks marked as complete"
+      redirect_to cms_dashboard_path
+    else
+      @task_item = TaskItem.find(params[:id])
+      if @task_item.assigned_to == current_user
+        if @task_item.mark_as_complete!
+          flash[:notice] = "Task was marked as complete"
+        end
+      else
+        flash[:error] = "You cannot complete task_items that are not assigned to you"
+      end
+      redirect_to @task_item.page.path
+    end
+  end
+  
+  private
+    def load_page
+      @page = Page.find(params[:page_id])
+    end
+  
+    def set_toolbar_tab
+      @toolbar_tab = :sitemap
+    end  
+  
+end

data/app/controllers/cms/toolbar_controller.rb

@@ -0,0 +1,12 @@
+class Cms::ToolbarController < Cms::BaseController
+
+  def index
+    if params[:page_toolbar] != "0"
+      @mode = params[:mode]
+      @page_toolbar_enabled = true
+    end
+    @page_version = params[:page_version]    
+    @page = Page.find(params[:page_id]).as_of_version(params[:page_version])
+  end  
+  
+end

data/app/controllers/cms/users_controller.rb

@@ -0,0 +1,100 @@
+class Cms::UsersController < Cms::ResourceController
+  layout 'cms/administration'
+
+  check_permissions :administrate, :except => [:show, :change_password, :update_password]
+  before_filter :only_self_or_administrator, :only => [:show, :change_password, :update_password]
+  
+  before_filter :set_menu_section
+  after_filter :update_group_membership, :only => [:update, :create]
+  after_filter :update_flash, :only => [ :update, :create ]
+  
+  verify :method => :put, :only => [ :enable, :disable, :update_password ]
+  
+  def index
+    query, conditions = [], []
+    
+    unless params[:show_expired]
+      query << "expires_at IS NULL OR expires_at >= ?"
+      conditions << Time.now.utc
+    end
+
+    unless params[:key_word].blank?
+      query << %w(login email first_name last_name).collect { |f| "lower(#{f}) LIKE lower(?)" }.join(" OR ")
+      4.times { conditions << "%#{params[:key_word]}%" }
+    end
+    
+    unless params[:group_id].to_i == 0
+      query << "user_group_memberships.group_id = ?"
+      conditions << params[:group_id]
+    end
+    
+    query.collect! { |q| "(#{q})"}
+    conditions = conditions.unshift(query.join(" AND "))
+    per_page = params[:per_page] || 10
+    
+    @users = User.paginate(:page => params[:page], :per_page => per_page, :include => :user_group_memberships, :conditions => conditions, :order => "first_name, last_name, email")
+  end
+
+  def change_password
+    user
+  end
+
+  def update_password
+    if user.update_attributes(params[:user])
+      flash[:notice] = "Password for '#{user.login}' was changed"
+      redirect_to(current_user.able_to?(:administrate) ? cms_users_path : cms_user_path(user))
+    else
+      render :action => 'change_password'
+    end
+  end
+
+  def disable
+    begin
+      user.disable!
+      flash[:notice] = "User #{user.login} disabled"
+    rescue Exception => e
+      flash[:error] = e.message
+    end
+    redirect_to cms_users_path
+  end
+  
+  def enable
+    user.enable!
+    redirect_to cms_users_path
+  end
+
+  protected
+    def after_create_url
+      index_url
+    end
+
+    def after_update_url
+      index_url
+    end
+
+    def update_flash
+      if params[:on_fail_action] == "change_password"
+        flash[:notice] = "Password for '#{@object.login}' changed"
+      elsif params[:action] == "create"
+        flash[:notice] = "User '#{@object.login}' was created"
+      else
+        flash[:notice] = "User '#{@object.login}' was updated"
+      end
+    end
+
+    def update_group_membership
+      @object.group_ids = params[:group_ids] unless params[:on_fail_action] == "change_password"
+    end
+
+  private
+    def user
+      @user ||= User.find(params[:id])
+    end
+    def set_menu_section
+      @menu_section = 'users'
+    end
+    
+    def only_self_or_administrator
+      raise Cms::Errors::AccessDenied if !current_user.able_to?(:administrate) && params[:id].to_i != current_user.id
+    end
+end

data/app/controllers/tests/pretend_controller.rb

@@ -0,0 +1,32 @@
+# This class exists to provide a test for including page behavior in controllers.
+# I didn't know of a way to add functional tests for controllers/routes that aren't in
+# the apps directory.
+#
+# This should be moved to the test directory if possible.
+class Tests::PretendController < ApplicationController
+  include Cms::Acts::ContentPage
+  
+  requires_permission_for_section "/members", :only=>[:restricted]
+
+  RESTRICTED_H1 = "Restricted"
+
+  def restricted
+    render :text =>"<h1>#{RESTRICTED_H1}</h1> You can see this restricted page."
+  end
+
+  def open
+    render :text =>"<h1>Open Page</h1> You can see this public page."   
+  end
+
+  def error
+    raise StandardError     
+  end
+
+  def not_found
+    raise ActiveRecord::RecordNotFound.new("This thing was missing!")
+  end
+
+  def open_with_layout
+    render :layout=>"templates/subpage"
+  end
+end

data/app/helpers/application_helper.rb

@@ -0,0 +1,3 @@
+# Any code for core CMS should go in /cms/application_helper.rb rather than here.
+module ApplicationHelper
+end

data/app/helpers/cms/application_helper.rb

@@ -0,0 +1,187 @@
+# Methods added to this helper will be available to all templates in the cms.
+module Cms
+  module ApplicationHelper
+
+    def require_stylesheet_link(sources=(), content_area=:html_head)
+      @required_stylesheet_links ||= []
+      new_links = sources.to_a - @required_stylesheet_links
+      if !new_links.empty?
+        @required_stylesheet_links |= new_links
+        content_for(content_area, stylesheet_link_tag(new_links))
+      end
+    end
+
+    def require_javascript_include(sources=(), content_area=:html_head)
+      @required_javascript_includes ||= []
+      new_links = sources.to_a - @required_javascript_includes
+      if !new_links.empty?
+        @required_javascript_includes |= new_links
+        content_for(content_area, javascript_include_tag(new_links))
+      end
+    end
+    
+    def searchable_sections(selected = nil)
+      root = Section.root.first
+      options = [['All sections', 'all'], [root.name, root.id]]
+      root.all_children_with_name.each { |s|  options << [s.full_path, s.id] }
+      options_for_select(options, selected.to_i)
+    end
+
+    def select_per_page
+      options = [10, 20, 50, 100].collect { |c| ["#{c} per page", c] }
+      select_tag("per_page", options_for_select(options, params[:per_page].to_i))
+    end
+
+    def page_versions(page)
+      text = select_tag(:version, 
+                        options_for_select(page.versions.all(:order => "version desc").map { |r| 
+                                             ["v#{r.version}: #{r.version_comment} by #{r.updated_by.login} at #{time_on_date(r.updated_at)}", r.version] 
+                                           }, page.version), 
+                        :onchange => 'this.form.submit(); return false')
+      text << javascript_tag("$('version').selectedIndex = 0") if page.live?
+      text
+    end
+
+   def render_connector_and_connectable(connector, connectable)
+     if logged_in? && @mode == "edit" && current_user.able_to_edit?(connector.page)
+       render :partial => 'cms/pages/edit_connector',
+         :locals => { :connector => connector, :connectable => connectable}
+     else
+       render_connectable(connectable)
+     end
+   end
+
+   def render_connectable(content_block)
+     if content_block
+       if content_block.class.renderable?
+         logger.info "..... Rendering connectable #{content_block.class} ##{content_block.id} #{"v#{content_block.version}" if content_block.respond_to?(:version)}"
+         content_block.perform_render(@controller)
+       else
+         logger.warn "Connectable #{content_block.class} ##{content_block.id} is not renderable"
+       end
+     else
+       logger.warn "Connectable is null"
+     end
+   rescue Exception => e
+     logger.error "Error occurred while rendering #{content_block.class}##{content_block.id}: #{e.message}\n#{e.backtrace.join("\n")}"
+     "ERROR: #{e.message}"
+   end
+    
+    def action_icon_src(name)
+      "cms/icons/actions/#{name}.png"
+    end
+    
+    def action_icon(name, options={})
+      image_tag action_icon_src(name), {:alt => name.to_s.titleize}.merge(options)
+    end
+
+    def status_icon(status, options={})
+      image_tag "cms/icons/status/#{status.to_s.underscore}.gif", {:alt => status.to_s.titleize}.merge(options)
+    end
+    
+   def render_cms_toolbar(tab=:dashboard)
+     render :partial => 'layouts/cms_toolbar', :locals => {:tab => tab}
+   end
+    
+    def link_to_usages(block)
+      count = block.connected_pages.count
+      if count > 0
+        # Would love a cleaner solution to this problem, see http://stackoverflow.com/questions/702728
+        path = Portlet === block ? usages_cms_portlet_path(block) : [:usages, :cms, block]
+        link_to count, path, :id => block.id, :block_type => block.content_block_type
+      else
+        count
+      end
+    end
+    
+    def time_on_date(time)
+      time && "#{time.strftime("%l:%M %p")} on #{time.strftime("%b %e, %Y")}"
+    end
+
+    def format_date(time)
+      time && "#{time.strftime("%b %e, %Y")}"
+    end
+    
+    def link_to_check_all(selector, name="Check All")
+      link_to_function name, "$('#{selector}').attr('checked', true)"
+    end
+
+    def link_to_uncheck_all(selector, name="Uncheck All")
+      link_to_function name, "$('#{selector}').attr('checked', false)"
+    end
+    
+   def able_to?(*perms, &block)
+     yield if current_user.able_to?(*perms)
+   end
+    
+    def span_tag(content)
+      content_tag :span, content
+    end
+    def lt_button_wrapper(content)
+<<LBW
+  <div class="lt_button">
+    <img src="/images/cms/lt_button_l.gif" alt="" />
+    <div class="lt_button_content">
+      <span>#{ content }</span>
+    </div>
+    <img src="/images/cms/lt_button_r.gif" alt="" style="margin-right: 10px;" />
+  </div>
+LBW
+    end
+
+    def dk_button_wrapper(content)
+      lt_button_wrapper(content).gsub("lt_button_","dk_button_")
+    end
+    def group_ids
+      (params[:group_ids] || @user.group_ids).collect { |g| g.to_i }
+    end
+
+    def group_filter
+      select_tag("group_id", options_from_collection_for_select(Group.all.insert(0, Group.new(:id => nil, :name => "Show All Groups")), "id", "name", params[:group_id].to_i))
+    end	  	  
+    
+    def categories_for(category_type_name, order="name")
+      cat_type = CategoryType.named(category_type_name).first
+      cat_type ? cat_type.category_list(order) : []
+    end	  
+    
+    def render_pagination(collection, collection_name, options={})
+      if collection.blank?
+        content_tag(:div, "No Content", :class => "pagination")
+      else
+        render :partial => "cms/shared/pagination", :locals => {
+          :collection => collection,
+          :first_page_path => send("cms_#{collection_name}_path", {:page => 1}.merge(options)),
+          :previous_page_path => send("cms_#{collection_name}_path", {:page => collection.previous_page ? collection.previous_page : 1}.merge(options)),
+          :current_page_path => send("cms_#{collection_name}_path", options),
+          :next_page_path => send("cms_#{collection_name}_path", {:page => collection.next_page ? collection.next_page : collection.current_page}.merge(options)),
+          :last_page_path => send("cms_#{collection_name}_path", {:page => collection.total_pages}.merge(options))
+        }
+      end
+    end	  
+
+    def url_with_mode(url, mode)
+      uri = URI.parse(url)
+      if uri.query =~ /mode=[^&]*/
+        "#{uri.path}?#{uri.query.gsub(/((^|&)mode=)[^&]*/) {|s| "#{$1}#{mode}" }}"
+      elsif uri.query
+        "#{uri.path}?#{uri.query}&mode=#{mode}"
+      else
+        "#{uri.path}?mode=#{mode}"
+      end
+    end
+    
+    def determine_order(current_order, order)
+      if current_order == order
+        if order =~ / desc$/i
+          order.sub(/ desc$/i, '')
+        else
+          order << ' desc'
+        end
+      else
+        order
+      end 
+    end
+    
+  end
+end