caboose-cms 0.9.97 → 0.9.98

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: b313b528aff85bf26feb9bb66e90738cd9c31a22
-  data.tar.gz: 84d6f32889e9ac803b6a63f9985dc3ea4ad8956c
+  metadata.gz: ca1352e277b5912b8d76b35ede5fb8844a065142
+  data.tar.gz: c946efea7125a13ceebfac7784482686c00c2e25
 SHA512:
-  metadata.gz: f9b18df80b08810a8503b674fb0bab6513ccb6397fad41b1db36cfd05dbaa68babd48950ccd9676daf46cca620890162dda40c9a8ac1b49f39053febd1704e1c
-  data.tar.gz: e0145fa9e2cb9d4f1efbd9374822949d2b35103bf7f902de4e1697f51ce34b5a8975666e0e485ed9131d669417d85c86f405cb1f3787ed92bf341aac29082ebe
+  metadata.gz: 1d7807b7d666bd2b9063f667408bd3b83c6c8572ecb75edf289f678939713eb10f22842aa1ba62d92058b86edb09dfdbc1dad60caadc5ef3a5c534f4fa986bac
+  data.tar.gz: c647c6574f4030e03b451b2379706de9c452e4d85e578fbfe6abb7e326c4aabf98931b6aec88ca16d770be2ff76f13679128d458059c53649862fe642e3745f3

data/app/controllers/caboose/pages_controller.rb

@@ -169,7 +169,11 @@ module Caboose
     def admin_edit_permissions
       return unless user_is_allowed('pages', 'edit')
       @page = Page.find(params[:id])
-      render :layout => 'caboose/admin'
+      if @page.site_id != @logged_in_user.site_id
+        redirect_to '/admin/pages'
+      else
+        render :layout => 'caboose/admin'
+      end
     end
     
     # @route PUT /admin/pages/:id/update-child-permissions
@@ -186,7 +190,7 @@ module Caboose
     def admin_edit_content
       @page = Page.find(params[:id])
       redirect_to "/login?return_url=/admin/pages/#{@page.id}/content" and return if @logged_in_user.nil?
-      condition = @logged_in_user && ( @logged_in_user.is_allowed('all','all') || @logged_in_user.is_allowed('pages','edit') && Page.permissible_actions(@logged_in_user, @page.id).include?('edit'))
+      condition = @logged_in_user && @logged_in_user.site_id == @page.site_id && ( @logged_in_user.is_allowed('all','all') || @logged_in_user.is_allowed('pages','edit') && Page.permissible_actions(@logged_in_user, @page.id).include?('edit'))
       redirect_to "/admin/pages" and return unless condition
       if @page.block.nil?
         redirect_to "/admin/pages/#{@page.id}/layout"
@@ -199,7 +203,11 @@ module Caboose
     def admin_edit_layout
       return unless user_is_allowed('pages', 'edit')      
       @page = Page.find(params[:id])
-      render :layout => 'caboose/admin'
+      if @page.site_id != @logged_in_user.site_id
+        redirect_to '/admin/pages'
+      else
+        render :layout => 'caboose/admin'
+      end
     end
     
     # @route PUT /admin/pages/:id/layout
@@ -267,28 +275,44 @@ module Caboose
     def admin_edit_css
       return unless user_is_allowed('pages', 'edit')
       @page = Page.find(params[:id])
-      render :layout => 'caboose/admin'
+      if @page.site_id != @logged_in_user.site_id
+        redirect_to '/admin/pages'
+      else
+        render :layout => 'caboose/admin'
+      end
     end
     
     # @route GET /admin/pages/:id/js
     def admin_edit_js
       return unless user_is_allowed('pages', 'edit')
       @page = Page.find(params[:id])
-      render :layout => 'caboose/admin'
+      if @page.site_id != @logged_in_user.site_id
+        redirect_to '/admin/pages'
+      else
+        render :layout => 'caboose/admin'
+      end
     end
     
     # @route GET /admin/pages/:id/seo
     def admin_edit_seo
       return unless user_is_allowed('pages', 'edit')
       @page = Page.find(params[:id])
-      render :layout => 'caboose/admin'
+      if @page.site_id != @logged_in_user.site_id
+        redirect_to '/admin/pages'
+      else
+        render :layout => 'caboose/admin'
+      end
     end
     
     # @route GET /admin/pages/:id/child-order
     def admin_edit_child_sort_order
       return unless user_is_allowed('pages', 'edit')
       @page = Page.find(params[:id])
-      render :layout => 'caboose/admin'
+      if @page.site_id != @logged_in_user.site_id
+        redirect_to '/admin/pages'
+      else
+        render :layout => 'caboose/admin'
+      end
     end
     
     # @route PUT /admin/pages/:id/child-order
@@ -310,7 +334,11 @@ module Caboose
     def admin_duplicate_form
       return unless user_is_allowed('pages', 'add')
       @page = Page.find(params[:id])      
-      render :layout => 'caboose/admin'      
+      if @page.site_id != @logged_in_user.site_id
+        redirect_to '/admin/pages'
+      else
+        render :layout => 'caboose/admin'
+      end   
     end
     
     # @route POST /admin/pages/:id/duplicate
@@ -341,7 +369,11 @@ module Caboose
     def admin_delete_form
       return unless user_is_allowed('pages', 'delete')
       @page = Page.find(params[:id])      
-      render :layout => 'caboose/admin'      
+      if @page.site_id != @logged_in_user.site_id
+        redirect_to '/admin/pages'
+      else
+        render :layout => 'caboose/admin'
+      end   
     end
     
     # @route GET /admin/pages/:id/uri
@@ -355,7 +387,11 @@ module Caboose
     def admin_sitemap
       return unless user_is_allowed('pages', 'delete')
       @page = Page.find(params[:id])
-      render :layout => 'caboose/admin'
+      if @page.site_id != @logged_in_user.site_id
+        redirect_to '/admin/pages'
+      else
+        render :layout => 'caboose/admin'
+      end
     end
 
     # @route GET /admin/pages/:id
@@ -363,7 +399,11 @@ module Caboose
       return if !user_is_allowed('pages', 'edit')
       #return if !Page.is_allowed(logged_in_user, params[:id], 'edit')            
       @page = Page.find(params[:id])
-      render :layout => 'caboose/admin'
+      if @page.site_id != @logged_in_user.site_id
+        redirect_to '/admin/pages'
+      else
+        render :layout => 'caboose/admin'
+      end
     end
     
     # @route POST /admin/pages
@@ -557,7 +597,6 @@ module Caboose
       return unless user_is_allowed('pages', 'delete')
       p = Page.find(params[:id])
       p.destroy
-      
       resp = StdClass.new({
         'redirect' => '/admin/pages'
       })

data/lib/caboose/version.rb

@@ -1,3 +1,3 @@
 module Caboose
-  VERSION = '0.9.97'
+  VERSION = '0.9.98'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: caboose-cms
 version: !ruby/object:Gem::Version
-  version: 0.9.97
+  version: 0.9.98
 platform: ruby
 authors:
 - William Barry