browsercms 3.5.7 → 4.0.0.alpha

data/app/models/cms/redirect.rb

@@ -7,6 +7,6 @@ module Cms
       where(:from_path => path).first
     end
 
-    attr_accessible :from_path, :to_path
+    extend DefaultAccessible
   end
 end

data/app/models/cms/search_filter.rb

@@ -0,0 +1,18 @@
+module Cms
+  # Captures values for the search form.
+  class SearchFilter
+    include ::ActiveModel::Model
+
+    attr_accessor :model_class, :term
+
+    def self.build(params_hash, model_class)
+      model = self.new(params_hash)
+      model.model_class = model_class
+      model
+    end
+
+    def path
+      model_class
+    end
+  end
+end

data/app/models/cms/section.rb

@@ -2,36 +2,42 @@ module Cms
   class Section < ActiveRecord::Base
     flush_cache_on_change
 
+    is_addressable no_dynamic_path: true, destroy_if: :deletable?
+    # Cannot use dependent => :destroy to do this. Ancestry's callbacks trigger before the before_destroy callback.
+    #   So sections would always get deleted since deletable? would return true
+    after_destroy :destroy_node
+    before_destroy :deletable?
 
-
-    #The node that links this section to its parent
-    has_one :section_node, :class_name => 'Cms::SectionNode', :as => :node, :inverse_of => :node
     SECTION = "Cms::Section"
     PAGE = "Cms::Page"
     LINK = "Cms::Link"
     VISIBLE_NODE_TYPES = [SECTION, PAGE, LINK]
+    HIDDEN_NODE_TYPES = "Cms::Attachment"
 
-    include DefaultAccessible
-    attr_accessible :allow_groups, :group_ids, :name, :path, :root, :hidden
+    extend DefaultAccessible
+    # @override
+    def self.permitted_params
+      super + [:allow_groups, group_ids: []]
+    end
 
-    include Cms::Addressable
-    include Cms::Addressable::NodeAccessors
+    has_many :group_sections, :class_name => 'Cms::GroupSection'
+    has_many :groups, :through => :group_sections, :class_name => 'Cms::Group'
 
+    scope :root, -> { where(['root = ?', true]) }
+    scope :system, -> { where({:name => 'system'}) }
+    scope :hidden, -> { where({:hidden => true}) }
+    scope :not_hidden, -> { where({:hidden => false}) }
 
-    # Cannot use dependent => :destroy to do this. Ancestry's callbacks trigger before the before_destroy callback.
-    #   So sections would always get deleted since deletable? would return true
-    after_destroy :destroy_node
-    before_destroy :deletable?
+    def self.named(name)
+      where(["#{table_name}.name = ?", name])
+    end
 
-    has_many :group_sections, :class_name => 'Cms::GroupSection'
-    has_many :groups, :through => :group_sections, :class_name => 'Cms::Group'
+    def self.with_path(path)
+      where(["#{table_name}.path = ?", path])
+    end
 
-    scope :root, :conditions => ['root = ?', true]
-    scope :system, :conditions => {:name => 'system'}
-    scope :hidden, :conditions => {:hidden => true}
-    scope :not_hidden, :conditions => {:hidden => false}
-    scope :named, lambda { |name| {:conditions => ["#{table_name}.name = ?", name]} }
-    scope :with_path, lambda { |path| {:conditions => ["#{table_name}.path = ?", path]} }
+    #scope :named, lambda { |name| {-> {where( ["#{table_name}.name = ?", name]} }   )}
+    #scope :with_path, lambda { |path| {-> {where( ["#{table_name}.path = ?", path]} }    )}
 
     validates_presence_of :name, :path
 
@@ -84,11 +90,11 @@ module Cms
     end
 
     def self.sitemap
-      SectionNode.of_type(VISIBLE_NODE_TYPES).fetch_nodes.arrange(:order => :position)
+      SectionNode.not_of_type(HIDDEN_NODE_TYPES).fetch_nodes.arrange(:order => :position)
     end
 
     def visible_child_nodes(options={})
-      children = child_nodes.of_type(VISIBLE_NODE_TYPES).fetch_nodes.in_order.all
+      children = child_nodes.of_type(VISIBLE_NODE_TYPES).fetch_nodes.in_order.to_a
       visible_children = children.select { |sn| sn.visible? }
       options[:limit] ? visible_children[0...options[:limit]] : visible_children
     end
@@ -137,11 +143,6 @@ module Cms
       !root? && empty?
     end
 
-    # Callback to clean up related nodes
-    def destroy_node
-      node.destroy
-    end
-
     def editable_by_group?(group)
       group.editable_by_section(self)
     end
@@ -166,9 +167,10 @@ module Cms
       current_section
     end
 
-    #The first page that is a decendent of this section
+    #The first page that is a descendent of this section
     def first_page_or_link
-      section_node = child_nodes.of_type([LINK, PAGE]).fetch_nodes.in_order.first
+      types = Cms::ContentType.addressable.collect(&:name).push(LINK).push(PAGE)
+      section_node = child_nodes.of_type(types).fetch_nodes.in_order.first
       return section_node.node if section_node
       sections.each do |s|
         node = s.first_page_or_link
@@ -209,5 +211,14 @@ module Cms
         self.groups = Cms::Group.all
       end
     end
+
+    # Sections are accessible to guests if they marked as such. Variables are passed in for performance reasons
+    # since this gets called 'MANY' times on the sitemap.
+    #
+    # @param [Array<Section>] public_sections
+    # @param [Section] parent
+    def accessible_to_guests?(public_sections, parent)
+      public_sections.include?(self)
+    end
   end
 end

data/app/models/cms/section_node.rb

@@ -1,9 +1,10 @@
 require 'ancestry'
 
 class Cms::SectionNode < ActiveRecord::Base
-  attr_accessible :node, :section, :parent, :node_id, :node_type
   has_ancestry
 
+  validates :slug, uniqueness: { scope: :node_type }, unless: lambda { |sn| sn.slug.blank?}
+
   # This is the parent section for this node
   # For backwards compatiblity
   def parent_section
@@ -26,9 +27,31 @@ class Cms::SectionNode < ActiveRecord::Base
     ancestry ? "ancestry = '#{ancestry}'" : 'ancestry IS NULL'
   end
 
-  scope :of_type, lambda{|types| {:conditions => ["#{table_name}.node_type IN (?)", types]}}
-  scope :in_order, :order => "position asc"
-  scope :fetch_nodes, :include => :node
+
+  class << self
+    def of_type(types)
+      where(["#{table_name}.node_type IN (?)", types])
+    end
+
+    def in_order
+      order("position asc")
+    end
+
+    def fetch_nodes
+      includes(:node)
+    end
+  end
+
+  # Return all section nodes which are not of the given type (i.e. class name)
+  # @param [String] klass A specific class name that should be excluded.
+  def self.not_of_type(klass)
+    where("#{table_name}.node_type NOT IN (?)", klass)
+  end
+
+  # Determines if this node is the homepage of the site.
+  def home?
+    page? && node.home?
+  end
 
   def visible?
     return false unless node
@@ -52,6 +75,10 @@ class Cms::SectionNode < ActiveRecord::Base
     node_type == 'Cms::Page'
   end
 
+  def link?
+    node_type == 'Cms::Link'
+  end
+
   # @param [Section] section
   # @param [Integer] position
   def move_to(section, position)
@@ -68,7 +95,7 @@ class Cms::SectionNode < ActiveRecord::Base
         #This helps prevent the position from getting out of whack
         #If you pass in a really high number for position, 
         #this just corrects it to the right number
-        node_count =Cms::SectionNode.count(:conditions => {:ancestry => ancestry})
+        node_count = Cms::SectionNode.where({:ancestry => ancestry}).count
         position = node_count if position > node_count
       end
       

data/app/models/cms/site.rb

@@ -1,7 +1,7 @@
 module Cms
   class Site < ActiveRecord::Base
 
-    attr_accessible :name, :domain
+   #attr_accessible :name, :domain
 
     validates_uniqueness_of :domain
 
@@ -10,12 +10,12 @@ module Cms
     before_save :unset_default
     after_save :set_default
 
-    scope :default, :conditions => {:the_default => true}
+    scope :default, -> {where(:the_default => true)}
 
     def self.find_by_domain(domain)
       d = domain.clone
       strip_www!(d)
-      if site = first(:conditions => {:domain => d})
+      if site = where(:domain => d).first
         site
       else
         default.first

data/app/models/cms/tag.rb

@@ -2,25 +2,27 @@ module Cms
   class Tag < ActiveRecord::Base
 
     has_many :taggings, :class_name => 'Cms::Tagging'
-    include DefaultAccessible
+    extend DefaultAccessible
+    include Concerns::IgnoresPublishing
 
     validates_uniqueness_of :name
 
     attr_accessor :size
     is_searchable
-    scope :named, lambda { |tag| {:conditions => ["#{table_name}.name = ? ", tag]} }
+    has_content_type :module => :categorization
 
-    # Returns an array of tags with a count attribute
+    def self.named(tag)
+      where(name: tag)
+    end
+
+    # Returns an array of tags with a #count attribute
     #
     # @return [Array] Each element of the area contains [Id (Integer), Name (String), count (Integer)] (with Sqlite3 anyway)
-    def self.counts(options={})
-      with_scope(:find => {
-          :select => "#{Tag.table_name}.id, #{Tag.table_name}.name, count(*) as count",
-          :joins => :taggings,
-          :group => "#{Tag.table_name}.id, #{Tag.table_name}.name",
-          :order => "count desc, #{Tag.table_name}.name"}) do
-        all(options)
-      end
+    def self.counts()
+      select("#{table_name}.id, #{table_name}.name, count(#{table_name}.id) as count")
+        .joins(:taggings)
+        .group("#{table_name}.id, #{table_name}.name")
+        .order("count desc, #{table_name}.name")
     end
 
     # Returns an array of tags with a size attribute
@@ -30,7 +32,7 @@ module Cms
     def self.cloud(options={})
       sizes = (options.delete(:sizes) || 5) - 1
       sizes = 1 if sizes < 1
-      tags = counts(options)
+      tags = counts.limit(sizes)
       return [] if tags.blank?
 
       min = nil

data/app/models/cms/tagging.rb

@@ -3,8 +3,8 @@ module Cms
     belongs_to :tag, :class_name => 'Cms::Tag'
     belongs_to :taggable, :polymorphic => true, :class_name => 'Cms::Taggable', :foreign_type => 'taggable_type'
 
-    include DefaultAccessible
-    attr_accessible :tag, :taggable
+    extend DefaultAccessible
+   #attr_accessible :tag, :taggable
 
     def content_type
       Cms::ContentType.first(:conditions => {:name => taggable_type})

data/app/models/cms/task.rb

@@ -8,17 +8,21 @@ module Cms
     belongs_to :assigned_to, :class_name => 'Cms::User'
     belongs_to :page, :class_name => 'Cms::Page'
 
-    include DefaultAccessible
-    attr_accessible :assigned_by, :assigned_to, :page
+    extend DefaultAccessible
 
     after_create :mark_other_tasks_for_the_same_page_as_complete
     after_create :send_email
 
-    scope :complete, :conditions => ["completed_at is not null"]
-    scope :incomplete, :conditions => ["completed_at is null"]
+    scope :complete, ->{ where( ["completed_at is not null"])}
+    scope :incomplete, ->{ where( ["completed_at is null"])}
 
-    scope :for_page, lambda { |p| {:conditions => ["page_id = ?", p]} }
-    scope :other_than, lambda { |t| {:conditions => ["id != ?", t.id]} }
+    def self.for_page(p)
+      where(["page_id = ?", p])
+    end
+
+    def self.other_than(t)
+      where( ["id != ?", t.id])
+    end
 
     validates_presence_of :assigned_by_id, :message => "is required"
     validates_presence_of :assigned_to_id, :message => "is required"
@@ -36,30 +40,19 @@ module Cms
 
     protected
     def mark_other_tasks_for_the_same_page_as_complete
-      self.class.for_page(self.page_id.to_i).other_than(self).incomplete.all.each do |t|
+      self.class.for_page(self.page_id.to_i).other_than(self).incomplete.to_a.each do |t|
         t.mark_as_complete!
       end
     end
 
     def send_email
-      #Hmm... what if the assign_by or assign_to don't have email addresses?
-      #For now we'll say just don't send an email and log that as a warning
-      if assigned_by.email.blank?
-        logger.warn "Can't send email for task because assigned by user #{assigned_by.login}:#{assigned_by.id} has no email address"
-      elsif assigned_to.email.blank?
+      if assigned_to.email.blank?
         logger.warn "Can't send email for task because assigned to user #{assigned_to.login}:#{assigned_to.id} has no email address"
       else
-        domain = Rails.configuration.cms.site_domain
-        if domain =~ /^www/
-          host = domain.sub(/^www\./, "#{cms_domain_prefix}.")
-        else
-          host = "#{cms_domain_prefix}.#{domain}"
-        end
-        email = Cms::EmailMessage.create(
-            :sender => assigned_by.email,
+        Cms::EmailMessage.create(
             :recipients => assigned_to.email,
             :subject => "Page '#{page.name}' has been assigned to you",
-            :body => "http://#{host}#{page.path}\n\n#{comment}"
+            :body => "#{Cms::EmailMessage.absolute_cms_url(page.path)}\n\n#{comment}"
         )
       end
       true #don't accidently return false and halt the chain

data/app/models/cms/templates.rb

@@ -16,11 +16,10 @@ module Cms
     <%= yield :html_head %>
   </head>
   <body style="margin: 0; padding: 0; text-align: center;">
-    <%= cms_toolbar %>
     <div id="wrapper" style="width: 700px; margin: 0 auto; text-align: left; padding: 30px">
       Breadcrumbs: <%= render_breadcrumbs %>
       Main Menu: <%= render_menu %>
-      <h1><%= page_title %></h1>
+      <h1><%= page_header %></h1>
       <%= container :main %>
     </div>
   </body>

data/app/models/cms/user.rb

@@ -1,173 +1,34 @@
-require 'digest/sha1'
-
 module Cms
-  class User < ActiveRecord::Base
-
-    include Cms::Authentication::Model
-
-    validates_presence_of :login
-    #validates_length_of       :login,    :within => 3..40
-    validates_uniqueness_of :login, :case_sensitive => false
-    validates_format_of :login, :with => /\A\w[\w\.\-_@]+\z/, :message => "use only letters, numbers, and .-_@ please."
-
-    validates_presence_of :email
-    #validates_length_of       :email,    :within => 6..100 #r@a.wk
-    #validates_uniqueness_of   :email,    :case_sensitive => false
-    validates_format_of :email, :with => /^([^@\s]+)@((?:[-a-z0-9]+\.)+[a-z]{2,})$/i, :message => "should be an email address, ex. xx@xx.com"
-    attr_accessible :login, :email, :name, :first_name, :last_name, :password, :password_confirmation, :expires_at
 
-    has_many :user_group_memberships, :class_name => 'Cms::UserGroupMembership'
-    has_many :groups, :through => :user_group_memberships, :class_name => 'Cms::Group'
-    has_many :tasks, :foreign_key => "assigned_to_id", :class_name => 'Cms::Task'
-
-    scope :active, :conditions => ["expires_at IS NULL OR expires_at > ?", Time.now.utc]
-    scope :able_to_edit_or_publish_content,
-          :include => {:groups => :permissions},
-          :conditions => ["#{Permission.table_name}.name = ? OR #{Permission.table_name}.name = ?", "edit_content", "publish_content"]
-
-    def self.current
-      Thread.current[:cms_user]
-    end
-
-    def self.current=(user)
-      Thread.current[:cms_user] = user
-    end
-
-    def self.guest(options = {})
-      Cms::GuestUser.new(options)
-    end
-
-    def guest?
-      !!@guest
-    end
-
-    # Determines if this user should have access to the CMS administration tools. Can be overridden by specific users (like GuestUser)
-    # which may not need to check the database for that information.
-    def cms_access?
-      groups.cms_access.count > 0
-    end
-
-    def disable
-      if self.class.count(:conditions => ["expires_at is null and id != ?", id]) > 0
-        self.expires_at = Time.now - 2.minutes
-      else
-        false
-      end
-    end
-
-    def disable!
-      unless disable
-        raise "You must have at least 1 enabled user"
+  # Represents a CMS users that is managed through the CMS UI.
+  class User < PersistentUser
+    include Devise::Models::Validatable
+    include Devise::Models::Recoverable
+
+    class << self
+      # Change a given user's password.
+      #
+      # @param [String] login
+      # @param [String] new_password
+      def change_password(login, new_password)
+        find_by_login(login).change_password(new_password)
       end
-      save!
-    end
-
-    def expired?
-      expires_at && expires_at <= Time.now
-    end
-
-    def enable
-      self.expires_at = nil
-    end
-
-    def enable!
-      enable
-      save!
-    end
-
-    def full_name
-      [first_name, last_name].reject { |e| e.nil? }.join(" ")
-    end
 
-    def full_name_with_login
-      "#{full_name} (#{login})"
-    end
-
-    def full_name_or_login
-      if full_name.strip.blank?
-        login
-      else
-        full_name
+      def permitted_params
+        super + [:password, :password_confirmation]
       end
     end
 
-    # This is to show a formated date on the input form. I'm unsure that
-    # this is the best way to solve this, but it works.
-    def expires_at_formatted
-      expires_at ? (expires_at.strftime '%m/%d/%Y') : nil
-    end
-
-    def permissions
-      @permissions ||= Cms::Permission.find(:all, :include => {:groups => :users}, :conditions => ["#{User.table_name}.id = ?", id])
+    # Change this User's password to a new value.
+    def change_password(new_password)
+      update(:password => new_password, :password_confirmation => new_password)
     end
 
-    def viewable_sections
-      @viewable_sections ||= Cms::Section.find(:all, :include => {:groups => :users}, :conditions => ["#{User.table_name}.id = ?", id])
-    end
-
-    def modifiable_sections
-      @modifiable_sections ||= Cms::Section.find(:all, :include => {:groups => [:group_type, :users]}, :conditions => ["#{Cms::User.table_name}.id = ? and #{GroupType.table_name}.cms_access = ?", id, true])
-    end
-
-    # Expects a list of names of Permissions
-    # true if the user has any of the permissions
-    def able_to?(*required_permissions)
-      perms = required_permissions.map(&:to_sym)
-      permissions.any? do |p|
-        perms.include?(p.name.to_sym)
-      end
-    end
-
-    # Determine if this user has permission to view the specific object. Permissions
-    #   are always tied to a specific section. This method can take different input parameters
-    #   and will attempt to determine the relevant section to check.
-    # Expects object to be of type:
-    #   1. Section - Will check the user's groups to see if any of those groups can view this section.
-    #   2. Path - Will look up the section based on the path, then check it.  (Note that section paths are not currently unique, so this will check the first one it finds).
-    #   3. Other - Assumes it has a section attribute and will call that and check the return value.
+    # By default, Users are coming from the the CMS database (cms_users). All Cms::User class have have the same source.
     #
-    # Returns: true if the user can view this object, false otherwise.
-    # Raises: ActiveRecord::RecordNotFound if a path to a not existent section is passed in.
-    def able_to_view?(object)
-      section = object
-      if object.is_a?(String)
-        section = Cms::Section.find_by_path(object)
-        raise ActiveRecord::RecordNotFound.new("Could not find section with path = '#{object}'") unless section
-      elsif !object.is_a?(Cms::Section)
-        section = object.section
-      end
-      viewable_sections.include?(section) || cms_access?
-    end
-
-    def able_to_modify?(object)
-      case object
-        when Cms::Section
-          modifiable_sections.include?(object)
-        when Cms::Page, Cms::Link
-          modifiable_sections.include?(object.section)
-        else
-          if object.class.respond_to?(:connectable?) && object.class.connectable?
-            object.connected_pages.all? { |page| able_to_modify?(page) }
-          else
-            true
-          end
-      end
-    end
-
-    # Expects node to be a Section, Page or Link
-    # Returns true if the specified node, or any of its ancestor sections, is editable by any of
-    # the user's 'CMS User' groups.
-    def able_to_edit?(object)
-      able_to?(:edit_content) && able_to_modify?(object)
-    end
-
-    def able_to_publish?(object)
-      able_to?(:publish_content) && able_to_modify?(object)
+    # @override #source The otherwise persistent attribute.
+    def source
+      "CMS Users"
     end
-
-    def able_to_edit_or_publish_content?
-      able_to?(:edit_content, :publish_content)
-    end
-
   end
 end