browsercms 3.0.0

data/db/migrate/20081114172307_load_seed_data.rb

@@ -0,0 +1,92 @@
+class LoadSeedData < ActiveRecord::Migration
+  extend Cms::DataLoader
+  def self.up
+    if %w[development test dev local].include?(Rails.env)
+      pwd = "cmsadmin"
+    else
+      pwd = (0..8).inject(""){|s,i| s << (('a'..'z').to_a + ('A'..'Z').to_a + ('0'..'9').to_a).rand}
+    end
+    User.current = create_user(:cmsadmin, :login => "cmsadmin", :first_name => "CMS", :last_name => "Administrator", :email => "cmsadmin@example.com", :password => pwd, :password_confirmation => pwd)
+
+    create_permission(:administrate, :name => "administrate", :full_name => "Administer CMS" , :description => "Allows users to administer the CMS, including adding users and groups.")
+    create_permission(:edit_content, :name => "edit_content", :full_name => "Edit Content" , :description => "Allows users to Add, Edit and Delete both Pages and Blocks. Can Save (but not Publish) and Assign them as well.")
+    create_permission(:publish_content, :name => "publish_content", :full_name => "Publish Content" , :description => "Allows users to Save and Publish, Hide and Archive both Pages and Blocks.")
+
+    create_group_type(:guest_group_type, :name => "Guest", :guest => true)
+    create_group_type(:registered_public_user, :name => "Registered Public User")
+    create_group_type(:cms_user, :name => "CMS User", :cms_access => true)
+    group_types(:cms_user).permissions<<permissions(:edit_content)
+    group_types(:cms_user).permissions<<permissions(:publish_content)
+
+    create_group(:guest, :name => 'Guest', :code => 'guest', :group_type => group_types(:guest_group_type))
+    create_group(:content_admin, :name => 'Cms Administrators', :code => 'cms-admin', :group_type => group_types(:cms_user))
+    create_group(:content_editor, :name => 'Content Editors', :code => 'content-editor', :group_type => group_types(:cms_user))
+    users(:cmsadmin).groups << groups(:content_admin)
+    users(:cmsadmin).groups << groups(:content_editor)
+
+    groups(:content_admin).permissions<<permissions(:administrate)
+    groups(:content_editor).permissions<<permissions(:edit_content)
+    groups(:content_editor).permissions<<permissions(:publish_content)    
+    
+    create_site(:default, :name => "Default", :domain => "example.com")
+    create_section(:root, :name => "My Site", :path => "/", :root => true)
+    create_section(:system, :name => "system", :parent => sections(:root), :path => "/system", :hidden => true)
+        
+    Group.all.each{|g| g.sections = Section.all }    
+    
+    create_page(:home, :name => "Home", :path => "/", :section => sections(:root), :template_file_name => "default.html.erb", :cacheable => true)
+    create_page(:not_found, :name => "Page Not Found", :path => "/system/not_found", :section => sections(:system), :template_file_name => "default.html.erb", :publish_on_save => true, :hidden => true, :cacheable => true)
+    create_page(:access_denied, :name => "Access Denied", :path => "/system/access_denied", :section => sections(:system), :template_file_name => "default.html.erb", :publish_on_save => true, :hidden => true, :cacheable => true)
+    create_page(:server_error, :name => "Server Error", :path => "/system/server_error", :section => sections(:system), :template_file_name => "default.html.erb", :publish_on_save => true, :hidden => true, :cacheable => true)
+
+    create_html_block(:page_not_found, :name => "Page Not Found", :content => "<p>The page you tried to access does not exist on this server.</p>", :publish_on_save => true)
+    pages(:not_found).create_connector(html_blocks(:page_not_found), "main")
+    pages(:not_found).publish!
+
+    create_html_block(:access_denied, :name => "Access Denied", :content => "<p>You have tried to reach a resource or page which you do not have permission to view.</p>", :publish_on_save => true)
+    pages(:access_denied).create_connector(html_blocks(:access_denied), "main")
+    pages(:access_denied).publish!
+
+    create_html_block(:server_error, :name => "Server Error", :content => "<p>The server encountered an unexpected condition that prevented it from fulfilling the request.</p>", :publish_on_save => true)
+    pages(:server_error).create_connector(html_blocks(:server_error), "main")
+    pages(:server_error).publish!
+
+    create_page_template(:default, 
+      :name => "default", :format => "html", :handler => "erb", 
+      :body => <<-HTML
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
+  <head>
+    <meta http-equiv="Content-Type" content="text/html;charset=utf-8" />
+    <title><%= page_title %></title>
+    <%= yield :html_head %>
+  </head>
+  <body style="margin: 0; padding: 0; text-align: center;">
+    <%= cms_toolbar %>
+    <div id="wrapper" style="width: 700px; margin: 0 auto; text-align: left; padding: 30px">
+      Breadcrumbs: <%= render_breadcrumbs %>
+      Main Menu: <%= render_menu %>
+      <h1><%= @page_title %></h1>
+      <p>BrowserCMS has been installed successfully.</p> 
+
+      <h2>Getting Started</h2>
+      <p>To start building your site, you can either <%= link_to "alter this template", edit_cms_page_template_path(PageTemplate.find_by_file_name("default.html.erb")) %> or <%= link_to "create a new one", new_cms_page_template_path %>.  You will be prompted to login with the credentials provided during the install process.  To change which template the pages use, you can click the 'Edit Properties' button above, and choose a different template. After all pages in the site, use the new template, you can safely delete this one.</p>
+
+      <%= container :main %>
+    </div>
+  </body>
+</html>
+HTML
+    )
+    
+    pages(:home).publish! 
+        
+    puts "*************************************************"    
+    puts "* YOUR CMS username/password is: cmsadmin/#{pwd}"    
+    puts "*************************************************"
+        
+  end
+
+  def self.down
+  end
+end

data/lib/acts_as_list.rb

@@ -0,0 +1,252 @@
+module ActsAsList
+  def self.included(base)
+    base.extend(ClassMethods)
+  end
+
+  # This +acts_as+ extension provides the capabilities for sorting and reordering a number of objects in a list.
+  # The class that has this specified needs to have a +position+ column defined as an integer on
+  # the mapped database table.
+  #
+  # Todo list example:
+  #
+  #   class TodoList < ActiveRecord::Base
+  #     has_many :todo_items, :order => "position"
+  #   end
+  #
+  #   class TodoItem < ActiveRecord::Base
+  #     belongs_to :todo_list
+  #     acts_as_list :scope => :todo_list
+  #   end
+  #
+  #   todo_list.first.move_to_bottom
+  #   todo_list.last.move_higher
+  module ClassMethods
+    # Configuration options are:
+    #
+    # * +column+ - specifies the column name to use for keeping the position integer (default: +position+)
+    # * +scope+ - restricts what is to be considered a list. Given a symbol, it'll attach <tt>_id</tt> 
+    #   (if it hasn't already been added) and use that as the foreign key restriction. It's also possible 
+    #   to give it an entire string that is interpolated if you need a tighter scope than just a foreign key.
+    #   Example: <tt>acts_as_list :scope => 'todo_list_id = #{todo_list_id} AND completed = 0'</tt>
+    def acts_as_list(options = {})
+      configuration = { :column => "position", :scope => "1 = 1" }
+      configuration.update(options) if options.is_a?(Hash)
+
+      configuration[:scope] = "#{configuration[:scope]}_id".intern if configuration[:scope].is_a?(Symbol) && configuration[:scope].to_s !~ /_id$/
+
+      if configuration[:scope].is_a?(Symbol)
+        scope_condition_method = %(
+          def scope_condition
+            if #{configuration[:scope].to_s}.nil?
+              "#{configuration[:scope].to_s} IS NULL"
+            else
+              "#{configuration[:scope].to_s} = \#{#{configuration[:scope].to_s}}"
+            end
+          end
+        )
+      else
+        scope_condition_method = "def scope_condition() \"#{configuration[:scope]}\" end"
+      end
+
+      class_eval <<-EOV
+        include ActsAsList::InstanceMethods
+
+        def acts_as_list_class
+          ::#{self.name}
+        end
+
+        def position_column
+          '#{configuration[:column]}'
+        end
+
+        #{scope_condition_method}
+
+        before_destroy :remove_from_list
+        before_create  :add_to_list_bottom
+      EOV
+    end
+  end
+
+  # All the methods available to a record that has had <tt>acts_as_list</tt> specified. Each method works
+  # by assuming the object to be the item in the list, so <tt>chapter.move_lower</tt> would move that chapter
+  # lower in the list of all chapters. Likewise, <tt>chapter.first?</tt> would return +true+ if that chapter is
+  # the first in the list of all chapters.
+  module InstanceMethods
+    # Insert the item at the given position (defaults to the top position of 1).
+    def insert_at(position = 1)
+      insert_at_position(position)
+    end
+
+    # Swap positions with the next lower item, if one exists.
+    def move_lower
+      lower = lower_item
+      return unless lower
+      acts_as_list_class.transaction do
+        self.update_attribute(position_column, lower.send(position_column))
+        lower.decrement_position
+      end
+    end
+
+    # Swap positions with the next higher item, if one exists.
+    def move_higher
+      higher = higher_item
+      return unless higher
+      acts_as_list_class.transaction do
+        self.update_attribute(position_column, higher.send(position_column))
+        higher.increment_position
+      end
+    end
+
+    # Move to the bottom of the list. If the item is already in the list, the items below it have their
+    # position adjusted accordingly.
+    def move_to_bottom
+      return unless in_list?
+      acts_as_list_class.transaction do
+        decrement_positions_on_lower_items
+        assume_bottom_position
+      end
+    end
+
+    # Move to the top of the list. If the item is already in the list, the items above it have their
+    # position adjusted accordingly.
+    def move_to_top
+      return unless in_list?
+      acts_as_list_class.transaction do
+        increment_positions_on_higher_items
+        assume_top_position
+      end
+    end
+
+    # Removes the item from the list.
+    def remove_from_list
+      if in_list?
+        decrement_positions_on_lower_items
+        update_attribute position_column, nil
+      end
+    end
+
+    # Increase the position of this item without adjusting the rest of the list.
+    def increment_position
+      return unless in_list?
+      update_attribute position_column, self.send(position_column).to_i + 1
+    end
+
+    # Decrease the position of this item without adjusting the rest of the list.
+    def decrement_position
+      return unless in_list?
+      update_attribute position_column, self.send(position_column).to_i - 1
+    end
+
+    # Return +true+ if this object is the first in the list.
+    def first?
+      return false unless in_list?
+      self.send(position_column) == 1
+    end
+
+    # Return +true+ if this object is the last in the list.
+    def last?
+      return false unless in_list?
+      self.send(position_column) == bottom_position_in_list
+    end
+
+    # Return the next higher item in the list.
+    def higher_item
+      return nil unless in_list?
+      acts_as_list_class.find(:first, :conditions =>
+        "#{scope_condition} AND #{position_column} < #{send(position_column).to_s}", :order => "#{position_column} DESC"
+      )
+    end
+
+    # Return the next lower item in the list.
+    def lower_item
+      return nil unless in_list?
+      acts_as_list_class.find(:first, :conditions =>
+        "#{scope_condition} AND #{position_column} > #{send(position_column).to_s}", :order => "#{position_column} ASC"
+      )
+    end
+
+    # Test if this record is in a list
+    def in_list?
+      !send(position_column).nil?
+    end
+
+    private
+      def add_to_list_top
+        increment_positions_on_all_items
+      end
+
+      def add_to_list_bottom
+        self[position_column] = bottom_position_in_list.to_i + 1
+      end
+
+      # Overwrite this method to define the scope of the list changes
+      def scope_condition() "1" end
+
+      # Returns the bottom position number in the list.
+      #   bottom_position_in_list    # => 2
+      def bottom_position_in_list(except = nil)
+        item = bottom_item(except)
+        item ? item.send(position_column) : 0
+      end
+
+      # Returns the bottom item
+      def bottom_item(except = nil)
+        conditions = scope_condition
+        conditions = "#{conditions} AND #{self.class.primary_key} != #{except.id}" if except
+        acts_as_list_class.find(:first, :conditions => conditions, :order => "#{position_column} DESC")
+      end
+
+      # Forces item to assume the bottom position in the list.
+      def assume_bottom_position
+        update_attribute(position_column, bottom_position_in_list(self).to_i + 1)
+      end
+
+      # Forces item to assume the top position in the list.
+      def assume_top_position
+        update_attribute(position_column, 1)
+      end
+
+      # This has the effect of moving all the higher items up one.
+      def decrement_positions_on_higher_items(position)
+        acts_as_list_class.update_all(
+          "#{position_column} = (#{position_column} - 1)", "#{scope_condition} AND #{position_column} <= #{position}"
+        )
+      end
+
+      # This has the effect of moving all the lower items up one.
+      def decrement_positions_on_lower_items
+        return unless in_list?
+        acts_as_list_class.update_all(
+          "#{position_column} = (#{position_column} - 1)", "#{scope_condition} AND #{position_column} > #{send(position_column).to_i}"
+        )
+      end
+
+      # This has the effect of moving all the higher items down one.
+      def increment_positions_on_higher_items
+        return unless in_list?
+        acts_as_list_class.update_all(
+          "#{position_column} = (#{position_column} + 1)", "#{scope_condition} AND #{position_column} < #{send(position_column).to_i}"
+        )
+      end
+
+      # This has the effect of moving all the lower items down one.
+      def increment_positions_on_lower_items(position)
+        acts_as_list_class.update_all(
+          "#{position_column} = (#{position_column} + 1)", "#{scope_condition} AND #{position_column} >= #{position}"
+       )
+      end
+
+      # Increments position (<tt>position_column</tt>) of all items in the list.
+      def increment_positions_on_all_items
+        acts_as_list_class.update_all(
+          "#{position_column} = (#{position_column} + 1)",  "#{scope_condition}"
+        )
+      end
+
+      def insert_at_position(position)
+        remove_from_list
+        increment_positions_on_lower_items(position)
+        self.update_attribute(position_column, position)
+      end
+  end
+end

data/lib/browsercms.rb

@@ -0,0 +1,12 @@
+require 'cms/extensions'
+require 'cms/init'
+require 'cms/routes'
+require 'cms/caching'
+
+#Load libraries that are included with CMS
+require 'acts_as_list'
+ActiveRecord::Base.send(:include, ActsAsList)
+
+#Include CMS Behaviors
+ActiveRecord::Base.send(:include, Cms::Acts::ContentBlock)
+require 'cms/behaviors'

data/lib/cms/acts/content_block.rb

@@ -0,0 +1,31 @@
+module Cms
+  module Acts
+    module ContentBlock
+      def self.included(model_class)
+        model_class.extend(MacroMethods)
+      end
+      module MacroMethods
+        def acts_as_content_block(options={})
+          belongs_to_attachment(options[:belongs_to_attachment].is_a?(Hash) ? options[:belongs_to_attachment] : {}) if options[:belongs_to_attachment]
+          is_archivable(options[:archiveable].is_a?(Hash) ? options[:archiveable] : {}) unless options[:archiveable] == false
+          is_connectable(options[:connectable].is_a?(Hash) ? options[:connectable] : {}) unless options[:connectable] == false
+          flush_cache_on_change(options[:flush_cache_on_change].is_a?(Hash) ? options[:flush_cache_on_change] : {}) unless options[:flush_cache_on_change] == false
+          is_renderable({:instance_variable_name_for_view => "@content_block"}.merge(options[:renderable].is_a?(Hash) ? options[:renderable] : {})) unless options[:renderable] == false
+          is_publishable(options[:publishable].is_a?(Hash) ? options[:publishable] : {}) unless options[:publishable] == false
+          is_searchable(options[:searchable].is_a?(Hash) ? options[:searchable] : {}) unless options[:searchable] == false
+          uses_soft_delete(options[:soft_delete].is_a?(Hash) ? options[:soft_delete] : {}) unless options[:soft_delete] == false
+          is_taggable(options[:taggable].is_a?(Hash) ? options[:taggable] : {}) if options[:taggable]
+          is_userstamped(options[:userstamped].is_a?(Hash) ? options[:userstamped] : {}) unless options[:userstamped] == false  
+          is_versioned(options[:versioned].is_a?(Hash) ? options[:versioned] : {}) unless options[:versioned] == false
+        
+          include InstanceMethods
+        end
+        module InstanceMethods
+          def to_s
+            "#{self.class.name.titleize} '#{name}'"
+          end
+        end
+      end
+    end
+  end
+end

data/lib/cms/authentication/controller.rb

@@ -0,0 +1,194 @@
+module Cms
+  module Authentication
+    module Controller
+      protected
+        # Returns true or false if the user is logged in.
+        # Preloads User.current with the user model if they're logged in.
+        def logged_in?
+          !current_user.nil? && !current_user.guest?
+        end
+
+        # Accesses the current user from the session.
+        # If the user is not logged in, this will be set to the guest user
+        def current_user
+          @current_user ||= begin
+            User.current = (login_from_session || login_from_cookie || User.guest)  
+          end
+        end
+
+        # Store the given user id in the session.
+        def current_user=(new_user)
+          session[:user_id] = new_user ? new_user.id : nil
+          @current_user = new_user || false
+          @current_user = User.current
+        end
+
+        # Check if the user is authorized
+        #
+        # Override this method in your controllers if you want to restrict access
+        # to only a few actions or if you want to check if the user
+        # has the correct rights.
+        #
+        # Example:
+        #
+        #  # only allow nonbobs
+        #  def authorized?
+        #    current_user.login != "bob"
+        #  end
+        #
+        def authorized?(action=nil, resource=nil, *args)
+          logged_in?
+        end
+
+        # Filter method to enforce a login requirement.
+        #
+        # To require logins for all actions, use this in your controllers:
+        #
+        #   before_filter :login_required
+        #
+        # To require logins for specific actions, use this in your controllers:
+        #
+        #   before_filter :login_required, :only => [ :edit, :update ]
+        #
+        # To skip this in a subclassed controller:
+        #
+        #   skip_before_filter :login_required
+        #
+        def login_required
+          authorized? || access_denied
+        end
+
+        # Redirect as appropriate when an access request fails.
+        #
+        # The default action is to redirect to the login screen.
+        #
+        # Override this method in your controllers if you want to have special
+        # behavior in case the user is not authorized
+        # to access the requested action.  For example, a popup window might
+        # simply close itself.
+        def access_denied
+          respond_to do |format|
+            format.html do
+              store_location
+              redirect_to cms_login_path
+            end
+            # format.any doesn't work in rails version < http://dev.rubyonrails.org/changeset/8987
+            # you may want to change format.any to e.g. format.any(:js, :xml)
+            # format.any do
+            #   request_http_basic_authentication 'Web Password'
+            # end
+          end
+        end
+
+        # Store the URI of the current request in the session.
+        #
+        # We can return to this location by calling #redirect_back_or_default.
+        def store_location
+          session[:return_to] = request.request_uri
+        end
+
+        # Redirect to the URI stored by the most recent store_location call or
+        # to the passed default.  Set an appropriately modified
+        #   after_filter :store_location, :only => [:index, :new, :show, :edit]
+        # for any controller you want to be bounce-backable.
+        def redirect_back_or_default(default)
+          redirect_to(session[:return_to] || default)
+          session[:return_to] = nil
+        end
+
+        # Inclusion hook to make #current_user and #logged_in?
+        # available as ActionView helper methods.
+        def self.included(base)
+          base.send :helper_method, :current_user, :logged_in?, :authorized? if base.respond_to? :helper_method
+        end
+
+        #
+        # Login
+        #
+
+        # Called from #current_user.  First attempt to login by the user id stored in the session.
+        def login_from_session
+          self.current_user = User.find_by_id(session[:user_id]) if session[:user_id]
+        end
+
+        # Called from #current_user.  Now, attempt to login by basic authentication information.
+        def login_from_basic_auth
+          authenticate_with_http_basic do |login, password|
+            self.current_user = User.authenticate(login, password)
+          end
+        end
+    
+        #
+        # Logout
+        #
+
+        # Called from #current_user.  Finaly, attempt to login by an expiring token in the cookie.
+        # for the paranoid: we _should_ be storing user_token = hash(cookie_token, request IP)
+        def login_from_cookie
+          user = cookies[:auth_token] && User.find_by_remember_token(cookies[:auth_token])
+          if user && user.remember_token?
+            self.current_user = user
+            handle_remember_cookie! false # freshen cookie token (keeping date)
+            self.current_user
+          end
+        end
+
+        # This is ususally what you want; resetting the session willy-nilly wreaks
+        # havoc with forgery protection, and is only strictly necessary on login.
+        # However, **all session state variables should be unset here**.
+        def logout_keeping_session!
+          # Kill server-side auth cookie
+          User.current.forget_me if User.current.is_a? User
+          User.current = false     # not logged in, and don't do it for me
+          kill_remember_cookie!     # Kill client-side auth cookie
+          session[:user_id] = nil   # keeps the session but kill our variable
+          # explicitly kill any other session variables you set
+        end
+
+        # The session should only be reset at the tail end of a form POST --
+        # otherwise the request forgery protection fails. It's only really necessary
+        # when you cross quarantine (logged-out to logged-in).
+        def logout_killing_session!
+          logout_keeping_session!
+          reset_session
+        end
+    
+        #
+        # Remember_me Tokens
+        #
+        # Cookies shouldn't be allowed to persist past their freshness date,
+        # and they should be changed at each login
+
+        # Cookies shouldn't be allowed to persist past their freshness date,
+        # and they should be changed at each login
+
+        def valid_remember_cookie?
+          return nil unless User.current
+          (User.current.remember_token?) && 
+            (cookies[:auth_token] == User.current.remember_token)
+        end
+    
+        # Refresh the cookie auth token if it exists, create it otherwise
+        def handle_remember_cookie! new_cookie_flag
+          return unless User.current
+          case
+          when valid_remember_cookie? then User.current.refresh_token # keeping same expiry date
+          when new_cookie_flag        then User.current.remember_me 
+          else                             User.current.forget_me
+          end
+          send_remember_cookie!
+        end
+  
+        def kill_remember_cookie!
+          cookies.delete :auth_token
+        end
+    
+        def send_remember_cookie!
+          cookies[:auth_token] = {
+            :value   => User.current.remember_token,
+            :expires => User.current.remember_token_expires_at }
+        end
+
+    end
+  end
+end