browsercms 3.5.7 → 4.0.0.alpha

data/lib/cms/configure_simple_form_bootstrap.rb

@@ -0,0 +1,49 @@
+# Use this setup block to configure all options available in SimpleForm.
+SimpleForm.setup do |config|
+  config.wrappers :bootstrap, tag: 'div', class: 'control-group row-fluid', error_class: 'error' do |b|
+    b.use :html5
+    b.use :placeholder
+    b.use :label
+    b.use :input
+    b.use :error, wrap_with: {tag: 'span', class: 'help-inline'}
+    b.use :hint, wrap_with: {tag: 'p', class: 'help-block'}
+  end
+
+  config.wrappers :checkbox, :tag => 'div', :class => 'control-group row-fluid', :error_class => 'error' do |b|
+    b.use :html5
+    b.use :placeholder
+    b.use :label_input
+    b.use :hint, :wrap_with => {:tag => 'span', :class => 'help-block'}
+    b.use :error, :wrap_with => {:tag => 'span', :class => 'help-inline'}
+  end
+
+  config.wrapper_mappings = { :boolean => :checkbox }
+
+  config.wrappers :prepend, tag: 'div', class: "control-group", error_class: 'error' do |b|
+    b.use :html5
+    b.use :placeholder
+    b.use :label
+    b.wrapper tag: 'div', class: 'input-prepend' do |prepend|
+      prepend.use :input
+    end
+    b.use :hint, wrap_with: {tag: 'span', class: 'help-block'}
+    b.use :error, wrap_with: {tag: 'span', class: 'help-inline'}
+  end
+
+  config.wrappers :append, tag: 'div', class: "control-group", error_class: 'error' do |b|
+    b.use :html5
+    b.use :placeholder
+    b.use :label
+    b.wrapper tag: 'div', class: 'input-append' do |append|
+      append.use :input
+    end
+    b.use :hint, wrap_with: {tag: 'span', class: 'help-block'}
+    b.use :error, wrap_with: {tag: 'span', class: 'help-inline'}
+  end
+
+  # Wrappers for forms and inputs using the Twitter Bootstrap toolkit.
+  # Check the Bootstrap docs (http://twitter.github.com/bootstrap)
+  # to learn about the different styles for forms and inputs,
+  # buttons and other elements.
+  config.default_wrapper = :bootstrap
+end

data/lib/cms/content_filter.rb

@@ -0,0 +1,18 @@
+module Cms
+  class ContentFilter
+
+    # Strips HTML from any attribute that's not :content
+    #
+    # Handles CKEditor's habit of adding opening/closing <p> tags to everything.
+    # @TODO Have this inspect the underlying model to determine the actual attribute.
+    def filter(content)
+      c = content.clone
+      c.keys.each do |key|
+        if(key != :content && key != "content")
+          c[key] = HTML::FullSanitizer.new.sanitize(c[key]).strip
+        end
+      end
+      c
+    end
+  end
+end

data/lib/cms/content_page.rb

@@ -0,0 +1,77 @@
+module Cms
+
+  # Add to controllers to allow them to behave like pages. A newer version of Acts::ContentPage
+  module ContentPage
+    extend ActiveSupport::Concern
+
+    included do
+      helper_method :cms_template
+      layout :determine_layout
+      class_attribute :template_name
+      class_attribute :template_options
+
+      include Cms::Authentication::Controller
+      include Cms::PageHelper
+      helper Cms::PageHelper
+      helper Cms::RenderingHelper
+      helper Cms::MenuHelper
+      include Cms::Configuration::ConfigurableTemplate
+    end
+
+    module ClassMethods
+
+      # Specify which CMS template should be used for this controller. Works similarly to ActionController::Base#layout.
+      # Will use the named template from the appropriate directory (typically app/views/layouts/templates)
+      #
+      # The default CMS layout will be used if no template is specified.
+      #
+      # @example
+      #   template :subpage, only: [:new, :create]
+      #   template :subpage, except: [:new, :create]
+      #   template :subpage, only: [:new, :create]
+      #
+      # @param [Symbol] template_name Name of the template with no directory prefixes or file type. (i.e. subpage, homepage)
+      # @param [Hash] options (Optional)
+      # @option options [Array<Symbol>] :only The actions to apply the template to.
+      # @option options [Array<Symbol>] :exception The actions to not apply the template to.
+      def template(template_name, options={})
+        self.template_name = template_name.to_s
+        self.template_options = options
+      end
+
+    end
+
+    # Returns the page template that should be used to render this page.
+    def cms_template
+      "layouts/#{normalize_layout(self.class, self.class.template_name)}"
+    end
+
+    def content_page_layout
+      'cms/content_page'
+    end
+
+    protected
+
+    def template_options
+      self.class.template_options
+    end
+
+    def use_template?
+      if template_name.blank?
+        false
+      elsif template_options.empty?
+        true
+      elsif template_options[:only] && template_options[:only].include?(action_name.to_sym)
+        true
+      elsif template_options[:except] && !template_options[:except].include?(action_name.to_sym)
+        true
+      else
+        false
+      end
+    end
+
+    def determine_layout
+      use_template? ? content_page_layout : 'cms/application'
+    end
+  end
+end

data/lib/cms/content_rendering_support.rb

@@ -1,3 +1,4 @@
+require 'cms/error_handling'
 #
 # This module can be added to Controllers to provide support for rendering CMS content pages.
 #
@@ -6,10 +7,24 @@ module Cms
 
     def self.included(base)
       base.send :include, Cms::ErrorHandling
-
       base.rescue_from Exception, :with => :handle_server_error_on_page
-      base.rescue_from Cms::Errors::AccessDenied, :with => :handle_access_denied_on_page
       base.rescue_from ActiveRecord::RecordNotFound, :with => :handle_not_found_on_page
+      base.rescue_from Cms::Errors::ContentNotFound, :with => :handle_not_found_on_page
+      base.rescue_from Cms::Errors::DraftNotFound, :with => :handle_draft_not_found
+      base.rescue_from Cms::Errors::AccessDenied, :with => :handle_access_denied_on_page
+
+    end
+
+    def show_content_as_page(content)
+      @page = content # page templates expect a @page attribute
+      @content_block = content # render.html.erb's expect a @content_block attribute
+    end
+
+    def handle_draft_not_found(exception)
+      logger.warn "Draft Content Not Found"
+      render(:layout => 'cms/application',
+             :template => 'cms/content/no_page',
+             :status => :not_found)
     end
 
     def handle_not_found_on_page(exception)
@@ -28,12 +43,6 @@ module Cms
       handle_error_with_cms_page(Cms::ErrorPages::SERVER_ERROR_PATH, exception, :internal_server_error)
     end
 
-    # Basic implementation for looking up the template based on the page layout.
-    # This will be overwritten by Cms::MobileAware to show mobile aware templates.
-    def determine_page_layout
-      @page.layout
-    end
-
     private
 
     # This is the method all error handlers delegate to
@@ -41,9 +50,9 @@ module Cms
 
       # If we are in the CMS, we just want to show the exception
       if perform_caching
-        return handle_server_error(exception) if cms_site?
+        return handle_server_error(exception, status) if cms_site?
       else
-        return handle_server_error(exception) if current_user.able_to?(:edit_content, :publish_content)
+        return handle_server_error(exception, status) if current_user.able_to?(:edit_content, :publish_content)
       end
 
       # We must be showing the page outside of the CMS
@@ -60,7 +69,7 @@ module Cms
 
         # clear out any content already captured
         # by previous attempts to render the page within this request
-        @template.instance_variables.select{|v| v =~ /@content_for_/ }.each do |v|
+        @template.instance_variables.select { |v| v =~ /@content_for_/ }.each do |v|
           @template.instance_variable_set("#{v}", nil)
         end
 
@@ -68,18 +77,18 @@ module Cms
 
         # The error pages are ALWAYS html since they are managed by the CMS as normal pages.
         # So .gif or .jpg requests that throw errors will return html rather than a format warning.
-        render :layout => determine_page_layout, :template => 'cms/content/show', :status => status, :formats=>[:html]
+        render :layout => @page.layout, :template => 'cms/content/show', :status => status, :formats => [:html]
       else
-        handle_server_error(exception)
+        handle_server_error(exception, status)
       end
     end
 
     # If any of the page's connectables (portlets, etc) are renderable, they may have a render method
     # which does "controller" stuff, so we need to get that run before rendering the page.
     def prepare_connectables_for_render
-      @_connectors = @page.connectors.for_page_version(@page.version)
-      @_connectables = @_connectors.map(&:connectable_with_deleted)
-    
+      @_connectors = @page.current_connectors
+      @_connectables = @page.contents
+
       unless (logged_in? && current_user.able_to?(:administrate, :edit_content, :publish_content))
         worst_exception = nil
         @_connectables.each do |c|

data/lib/cms/controllers/admin_controller.rb

@@ -0,0 +1,78 @@
+module Cms
+
+  # Before for any controller that is considered an admin page within BrowserCMS.
+  module AdminController
+    extend ActiveSupport::Concern
+
+    included do
+      include Cms::Authentication::Controller
+      include Cms::ErrorHandling
+      include Cms::DomainSupport
+
+      helper Cms::ApplicationHelper
+      helper Cms::FormTagHelper
+      include Cms::PathHelper
+      helper Cms::PathHelper
+      include Cms::PageHelper
+      helper Cms::PageHelper
+      helper Cms::MenuHelper
+      helper Cms::RenderingHelper
+      helper Cms::UiElementsHelper
+      include Cms::NavMenuHelper
+
+    end
+
+    protected
+    def escape_javascript(javascript)
+      (javascript || '').gsub('\\', '\0\0').gsub('</', '<\/').gsub(/\r\n|\n|\r/, "\\n").gsub(/["']/) { |m| "\\#{m}" }
+    end
+
+    def redirect_to_first(*urls)
+      urls.each do |url|
+        unless url.blank?
+          return redirect_to(url)
+        end
+      end
+    end
+
+    def current_site
+      @current_site ||= Site.find_by_domain(request.host)
+    end
+
+    def redirect_to_cms_site
+      if using_cms_subdomains? && !request_is_for_cms_subdomain?
+        redirect_to(url_with_cms_domain_prefix)
+      end
+    end
+
+    def append_to_query_string(url, *params)
+      new_url = url["?"] ? url : "#{url}?"
+      new_url << params.map { |k, v| "#{k.to_s}=#{CGI::escape(v.to_s)}" }.join("&")
+    end
+
+    def cms_access_required
+      raise Cms::Errors::AccessDenied unless current_user.able_to?(:administrate, :edit_content, :publish_content)
+    end
+
+    def url_with_cms_domain_prefix
+      if cms_site?
+        request.url
+      elsif request.subdomains.first == "www"
+        request.url.sub(/www\./, "#{cms_domain_prefix}.")
+      else
+        request.url.sub(/:\/\//, "://#{cms_domain_prefix}.")
+      end
+    end
+
+    def url_without_cms_domain_prefix
+      request.url.sub(/#{cms_domain_prefix}\./, '')
+    end
+
+    def ensure_current_user_can_view(content)
+      unless current_user.able_to_view?(content)
+        store_location
+        raise Cms::Errors::AccessDenied
+      end
+    end
+  end
+end

data/lib/cms/data_loader.rb

@@ -1,20 +1,22 @@
 module Cms
+  # A DSL for creating CMS content in seed data. Creating content in this manner will log the creation of the record
+  # and store any created records in a hash.
+  # To use, add the following to your seeds.rb.
+  # require "cms/data_loader"
+  #
+  # @example Create a Page in the root section
+  #   create_page(:hello, name: "Hello", path: "/hello", parent: sections(:root))
+  #
+  # @example Lookup a previously created page
+  #   puts pages(:hello).name
   module DataLoader
 
     mattr_accessor :silent_mode
 
     def method_missing(method_name, *args)
       if md = method_name.to_s.match(/^create_(.+)$/)
-        # We search the CMS namespace first.
-        # for things like DynamicPortlets "Cms::DynamicPortlet".constantize returns "DynamicPortlet"
-        model_name = "Cms/#{md[1]}".classify.constantize.name        
-        begin
-          #Make sure this is an active record class
-          super unless model_name.classify.constantize.ancestors.include?(ActiveRecord::Base)
-        rescue NameError => e
-          super
-        end
-        self.create(model_name, args[0], args[1] || {})
+        klass = model_class(md[1])
+        self.create(klass.name, args[0], args[1] || {})
       elsif @data && @data.has_key?(method_name)
         record = @data[method_name][args.first]
         record ? record.class.find(record.id) : nil
@@ -22,6 +24,22 @@ module Cms
         super
       end
     end
+
+    # We search the CMS namespace first.
+    # for things like DynamicPortlets "Cms::DynamicPortlet".constantize returns "DynamicPortlet"
+    def model_class(model_name)
+      klass = begin
+        "Cms/#{model_name}".classify.constantize
+      rescue NameError => e
+        model_name.classify.constantize
+      end
+      unless klass.method_defined?(:save!)
+        raise "Can't create an instance of #{klass} because its not an ActiveRecord instance."
+      end
+      klass
+    end
+
+
     def create(model_name, record_name, data={})
       puts "-- create_#{model_name}(:#{record_name})" unless Cms::DataLoader.silent_mode
       @data ||= {}
@@ -32,4 +50,5 @@ module Cms
       @data[model_storage_name][record_name] = model
     end
   end
-end
+end
+extend Cms::DataLoader

data/lib/cms/default_accessible.rb

@@ -1,12 +1,12 @@
 module Cms
   module DefaultAccessible
 
-    def self.included(model_class)
-      model_class.attribute_names.each do |name|
-        unless [:id, :type, :created_by_id, :updated_by_id, :created_at, :updated_at].include?(name.to_sym)
-          model_class.attr_accessible name
-        end
-      end
+    def permitted_params
+      attribute_names.map{|string| string.to_sym} - non_permitted_params
+    end
+
+    def non_permitted_params
+      [:id, :type, :created_by_id, :updated_by_id, :created_at, :updated_at]
     end
 
   end

data/lib/cms/domain_support.rb

@@ -28,10 +28,6 @@ module Cms
       result
     end
 
-    def should_write_to_page_cache?
-      using_cms_subdomains?
-    end
-
     private
 
     def wants_to_use_subdomains?

data/lib/cms/engine.rb

@@ -1,34 +1,32 @@
-require 'rails'
+# Load just enough dependencies for this file to be loadable.
 require 'cms/module'
-require 'cms/configuration'
-require 'cms/version'
-require 'browsercms'
-
-# Gem name is different than file name
-# Must be required FIRST, so that our assets paths appear before its do.
-# This allows app/assets/ckeditor/config.js to set CMS specific defaults.
-require 'ckeditor-rails'
-
-# Explicitly require this, so that CMS projects do not need to add it to their Gemfile
-# especially while upgrading
-require 'jquery-rails'
 
 module Cms
-
   class Engine < Rails::Engine
     include Cms::Module
     isolate_namespace Cms
 
     config.cms = ActiveSupport::OrderedOptions.new
     config.cms.attachments = ActiveSupport::OrderedOptions.new
-    
+
     # Allows additional menu items to be added to the 'Tools' menu on the Admin tab.
     config.cms.tools_menu = ActiveSupport::OrderedOptions.new
 
     # Define configuration for the CKEditor
     config.cms.ckeditor = ActiveSupport::OrderedOptions.new
-    
-    # Make sure we use our rails model template (rather then its default) when `rails g cms:content_block` is run.
+
+    # Configuration for content types.
+    config.cms.content_types = ActiveSupport::OrderedOptions.new
+
+    # Configuration for working on BrowserCMS core.
+    # We want these configuration for generators.
+    config.generators do |g|
+      g.test_framework :mini_test, :spec => true, :fixture => false
+      g.stylesheets false
+    end
+
+    # Configuration for projects using BrowserCMS>
+    # Need to use our rails model template (rather then its default) when `rails g cms:content_block` is run.
     config.app_generators do |g|
       path = File::expand_path('../../templates', __FILE__)
       g.templates.unshift path
@@ -44,6 +42,7 @@ module Cms
     # Set reasonable defaults
     # These default values can be changed by developers in their projects in their application.rb or environment's files.
     config.before_configuration do |app|
+      WillPaginate.per_page = 15
 
       # Default cache directories.
       app.config.cms.mobile_cache_directory = File.join(Rails.root, 'public', 'cache', 'mobile')
@@ -62,13 +61,44 @@ module Cms
       # I.e.
       #   config.cms.site_domain = "www.browsercms.org"
       app.config.cms.site_domain = "localhost:3000"
-      
+
+      # Determines what email sender will be applied to messages generated by the CMS.
+      # By default, this is based on the site_domain, i.e. mailbot@example.com
+      app.config.cms.mailbot = :default
+
+      # Allows Addressable content types and Controllers to set which template will be used for page layouts.
+      # This takes precedence over the :template attribute set on models/controllers.
+      #    Keys are looked up based on Class.name.underscore
+      # @example:
+      #   config.cms.templates['cms/form'] = 'my-form-layout' # app/views/layouts/templates/my-form-layout
+      #   config.cms.templates['cms/sites/sessions_controller'] = 'subpage' # For /login
+      #
+      app.config.cms.templates = {}
+
       # Determines which ckeditor file will be used to configure all instances.
       # There should be at most ONE of these, so use manifest files which require the below one to augement it.
       app.config.cms.ckeditor.configuration_file = 'bcms/ckeditor_standard_config.js'
-      
+
       # Define menu items to be added dynamically to the CMS Admin tab.
       app.config.cms.tools_menu = []
+
+      # Disable portlets so they don't appear in menus and can't be created. Existing portlets will not be deleted.
+      app.config.cms.content_types.blacklist = [:login_portlet, :forgot_password_portlet, :dynamic_portlet]
+
+      # Initialization
+      require 'cms/configure_simple_form'
+      require 'cms/configure_simple_form_bootstrap'
+      require 'cms/configuration/devise'
+
+      # Sets the default .css file that will be added to forms created via the Forms module.
+      # Projects can override this as needed.
+      app.config.cms.form_builder_css = 'cms/default-forms'
+    end
+
+    # Needed to ensure routes added to the main app by the Engine are available. (Since engine draws its routes after the main app)
+    # Borrrow from Spree as documenented here: https://github.com/rails/rails/issues/11895
+    config.after_initialize do
+      Rails.application.routes_reloader.reload!
     end
 
     initializer 'browsercms.add_core_routes', :after => 'action_dispatch.prepare_dispatcher' do |app|
@@ -76,13 +106,15 @@ module Cms
     end
 
     initializer 'browsercms.add_load_paths', :after => 'action_controller.deprecated_routes' do |app|
+
       ActiveSupport::Dependencies.autoload_paths += %W( #{self.root}/vendor #{self.root}/app/mailers #{self.root}/app/helpers)
       ActiveSupport::Dependencies.autoload_paths += %W( #{self.root}/app/controllers #{self.root}/app/models #{self.root}/app/portlets)
       ActiveSupport::Dependencies.autoload_paths += %W( #{Rails.root}/app/portlets )
+      ActiveSupport::Dependencies.autoload_paths += %W( #{Rails.root}/app/presenters )
       ActiveSupport::Dependencies.autoload_paths += %W( #{Rails.root}/app/portlets/helpers )
       ActionController::Base.append_view_path DynamicView.base_path
       ActionController::Base.append_view_path %W( #{self.root}/app/views)
-      ActionView::Base.default_form_builder = Cms::FormBuilder
+      ActionView::Base.default_form_builder = Cms::FormBuilder::ContentBlockFormBuilder
       require 'jdbc_adapter' if defined?(JRUBY_VERSION)
     end