caboose-cms 0.9.194 → 0.9.195

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: bf3d9753758ba664b6736b5756ecb4c4fc398499
-  data.tar.gz: 6eb53a89f67dde04a4fe88223d3d11aaeb7dcb81
+  metadata.gz: 23803eb2e4de5b950f3968d7232e8c15324c2a08
+  data.tar.gz: 7b04e7ca4a9102717531603e8dcb2387f338e8c8
 SHA512:
-  metadata.gz: bfbde88b45b6c9cba1c63b25883fb15998bcefd7a5c00f6a02207d69f1acc3aa0a988aa826f7dfafe566df8639363047cded4ea0423aad5310c2cd0395e2422f
-  data.tar.gz: a33f9b2094e41767a3a5a759ccc151db972219d6e2edeecc9e981ea3eed0e7963ff86a26d24c34b12862a2344d4cbab294ba8aac54e3db0dc7a1fa83d7dfdd54
+  metadata.gz: 923cf92e138005734a17250f5d47b0e31671c023266334916b3437b371e0e191983c320fa8c6b3ab4268cfbe10a7906b50d507e678d4a845945f19668efbd1d1
+  data.tar.gz: 911d24ae64333b88ee701a9927a7c1c1f984b3b7d921196f2e2521275608bdbab6909b66c05a7d717545189b0656c60e812f580f9dfc9b2461408a9f057cedf5

data/app/controllers/caboose/admin_controller.rb

@@ -5,10 +5,6 @@ module Caboose
     # @route GET /admin
     def index      
       return if !user_is_allowed('admin', 'view')
-      #if logged_in?
-      #  redirect_to '/admin/pages'
-      #  return
-      #end
       @return_url = params[:return_url].nil? ? '/admin/pages' : params[:return_url]
     end
     

data/app/controllers/caboose/domains_controller.rb

@@ -11,16 +11,15 @@ module Caboose
     # @route POST /admin/sites/:site_id/domains
     def admin_add
       return if !user_is_allowed('domains', 'edit')
-      
-      resp = Caboose::StdClass.new      
+      return if params[:site_id] != @site.id.to_s && !@site.is_master
+      resp = Caboose::StdClass.new
       d = Domain.where(:domain => params[:domain]).first
-            
       if d && d.site_id != params[:site_id]
         resp.error = "That domain is already associated with another site."
       elsif d && d.site_id == params[:site_id]
         resp.refresh = true
       elsif d.nil?
-        primary = Domain.where(:site_id => params[:site_id]).count == 0        
+        primary = Domain.where(:site_id => params[:site_id]).count == 0
         d = Domain.create(:site_id => params[:site_id], :domain => params[:domain], :primary => primary)
         resp.refresh = true
       end
@@ -30,10 +29,9 @@ module Caboose
     # @route PUT /admin/sites/:site_id/domains/:id
     def admin_update
       return if !user_is_allowed('domains', 'edit')
-
+      return if params[:site_id] != @site.id.to_s && !@site.is_master
       resp = StdClass.new     
-      d = Domain.find(params[:id])
-    
+      d = get_edit_domain(params[:id], @site.id)
       save = true
       params.each do |name,value|
         case name
@@ -51,7 +49,6 @@ module Caboose
             end
     	  end
     	end
-    	
     	resp.success = save && d.save
     	render :json => resp
     end        
@@ -59,17 +56,19 @@ module Caboose
     # @route DELETE /admin/sites/:site_id/domains/:id
     def admin_delete
       return if !user_is_allowed('sites', 'delete')
-      Domain.find(params[:id]).destroy
+      return if params[:site_id] != @site.id.to_s && !@site.is_master
+      domain = get_edit_domain(params[:id], @site.id)
+      domain.destroy if domain
       render :json => { 'refresh' => "/admin/sites/#{params[:site_id]}" }
     end
 
     # @route PUT /admin/sites/:site_id/domains/:id/set-primary
     def admin_set_primary
       return if !user_is_allowed('domains', 'edit')
+      return if params[:site_id] != @site.id.to_s && !@site.is_master
       resp = StdClass.new     
-      d = Domain.find(params[:id])
+      d = get_edit_domain(params[:id], @site.id)
       save = true
-      #d.primary = value
       Domain.where(:site_id => params[:site_id]).all.each do |d2|
         d2.primary = d2.id == d.id ? true : false
         d2.save
@@ -77,6 +76,14 @@ module Caboose
       resp.success = save && d.save
       render :json => resp
     end 
+
+    private
+
+    def get_edit_domain(domain_id, site_id)
+      domain = Domain.find(domain_id)
+      return domain if domain && (domain.site_id == site_id || logged_in_user.is_super_admin?)
+      return nil
+    end
             
   end
 end

data/app/controllers/caboose/logout_controller.rb

@@ -4,7 +4,6 @@ module Caboose
     # @route GET /logout
     def index
       Caboose.plugin_hook('before_logout')
-      
       logout_user
       elo = User.logged_out_user(@site.id)        
       login_user(elo)      

data/app/controllers/caboose/my_account_controller.rb

@@ -25,8 +25,10 @@ module Caboose
               resp.error = "Username must be at least three characters."
             elsif Caboose::User.where(:username => uname, :site_id => @site.id).where('id != ?',user.id).exists?
               resp.error = "That username is already taken."
+            elsif uname == 'superadmin'
+              resp.error = "Choose a different username."
             else
-              user.username    = uname
+              user.username = uname
             end
     	  	when "email"
             email = value.strip.downcase
@@ -35,9 +37,9 @@ module Caboose
             elsif Caboose::User.where(:email => email, :site_id => @site.id).where('id != ?',user.id).exists?
               resp.error = "That email address is already in the system."
             else
-              user.email    = email
+              user.email = email
             end
-    	  	when "phone"      then user.phone       = value
+    	  	when "phone"      then user.phone = value
 
           when "address"  then user.address   = value
           when "address2"  then user.address2   = value

data/app/controllers/caboose/post_custom_fields_controller.rb

@@ -50,10 +50,8 @@ module Caboose
     # @route PUT /admin/post-custom-fields/:id
     def admin_update      
       return if !user_is_allowed('postcustomfields', 'edit')
-      
       resp = Caboose::StdClass.new
       f = PostCustomField.find(params[:id])
-      
       save = true
       params.each do |name, value|    
         case name          

data/app/controllers/caboose/posts_controller.rb

@@ -3,11 +3,6 @@ module Caboose
     
     helper :application
      
-    # @route GET /posts
-    # def index
-    # 	@posts = Post.where(:published => true, :site_id => @site.id).limit(10).reorder('created_at DESC')
-    # end
-    
     # @route GET /posts/:id
     # @route GET /posts/:year/:month/:day/:slug
     def show
@@ -29,7 +24,6 @@ module Caboose
       @editing = false
       @preview = false
       @post = Caboose.plugin_hook('post_content', @post)
-   #   @editmode = !params['edit'].nil? && user.is_allowed('posts', 'edit') ? true : false  
     end
   
     #=============================================================================
@@ -46,17 +40,18 @@ module Caboose
     # @route GET /admin/posts/json
     def admin_json
       return if !user_is_allowed('posts', 'view')
-        
       pager = PageBarGenerator.new(params, {
           'site_id'     => @site.id,
           'title_like'  => '',
-      },{
+      },
+      {
           'model'       => 'Caboose::Post',
           'sort'        => 'created_at',
           'desc'        => true,
           'base_url'    => '/admin/posts',
           'items_per_page' => 50,
-          'use_url_params' => false
+          'use_url_params' => false,
+          'additional_where' => [ "(site_id = #{@site.id})" ]
       })
       render :json => {
         :pager => pager,
@@ -67,21 +62,21 @@ module Caboose
     # @route GET /admin/posts/:id/json
     def admin_json_single
       return if !user_is_allowed('posts', 'edit')    
-      @post = Post.find(params[:id])
+      @post = get_edit_post(params[:id], @site.id)
       render :json => @post
     end
     
     # @route GET /admin/posts/:id/preview
     def admin_edit_preview
       return if !user_is_allowed('posts', 'edit')    
-      @post = Post.find(params[:id])      
+      @post = get_edit_post(params[:id], @site.id)     
       render :layout => 'caboose/admin'
     end
 
     # @route GET /admin/posts/:id/publish
     def admin_publish
       return unless user_is_allowed('posts', 'edit')
-      post = Post.find(params[:id])
+      post = get_edit_post(params[:id], @site.id)
       post.publish
       redirect_to "/admin/posts/#{post.id}/content"
     end
@@ -89,7 +84,7 @@ module Caboose
     # @route GET /admin/posts/:id/revert
     def admin_revert
       return unless user_is_allowed('posts', 'edit')
-      post = Post.find(params[:id])
+      post = get_edit_post(params[:id], @site.id)
       post.revert
       redirect_to "/admin/posts/#{post.id}/content"
     end
@@ -97,7 +92,7 @@ module Caboose
     # @route GET /admin/posts/:id/content
     def admin_edit_content
       return if !user_is_allowed('posts', 'edit')    
-      @post = Post.find(params[:id])
+      @post = get_edit_post(params[:id], @site.id)
       if @post.body
         @post.preview = @post.body
         @post.body = nil
@@ -116,7 +111,7 @@ module Caboose
     # @route GET /admin/posts/:id/preview-post
     def admin_preview_post
       return if !user_is_allowed('posts', 'edit')    
-      @post = Post.find(params[:id])
+      @post = get_edit_post(params[:id], @site.id)
       @editing = true
       @preview = true
     end
@@ -124,7 +119,7 @@ module Caboose
     # @route GET /admin/posts/:id/categories
     def admin_edit_categories
       return if !user_is_allowed('posts', 'edit')    
-      @post = Post.find(params[:id])
+      @post = get_edit_post(params[:id], @site.id)
       @categories = PostCategory.where(:site_id => @site.id).reorder(:name).all
       if @categories.nil? || @categories.count == 0
         PostCategory.create(:site_id => @site.id, :name => 'General News')
@@ -136,14 +131,14 @@ module Caboose
     # @route GET /admin/posts/:id/layout
     def admin_edit_layout
       return unless user_is_allowed('posts', 'edit')      
-      @post = Post.find(params[:id])
+      @post = get_edit_post(params[:id], @site.id)
       render :layout => 'caboose/admin'
     end
     
     # @route GET /admin/posts/:id/delete
     def admin_delete_form
       return if !user_is_allowed('posts', 'delete')
-      @post = Post.find(params[:id])
+      @post = get_edit_post(params[:id], @site.id)
       render :layout => 'caboose/admin'
     end
     
@@ -151,7 +146,7 @@ module Caboose
     # @route GET /admin/posts/:id/edit
     def admin_edit_general
       return if !user_is_allowed('posts', 'edit')    
-      @post = Post.find(params[:id])
+      @post = get_edit_post(params[:id], @site.id)
       @post.verify_custom_field_values_exist
       render :layout => 'caboose/admin'
     end
@@ -160,8 +155,9 @@ module Caboose
     def admin_update_layout
       return unless user_is_allowed('posts', 'edit')      
       bt = BlockType.find(params[:block_type_id])
-      Block.where(:post_id => params[:id]).destroy_all
-      Block.create(:post_id => params[:id], :block_type_id => params[:block_type_id], :name => bt.name)
+      post = get_edit_post(params[:id], @site.id)
+      Block.where(:post_id => post.id).destroy_all if post
+      Block.create(:post_id => post.id, :block_type_id => params[:block_type_id], :name => bt.name) if post
       resp = Caboose::StdClass.new({
         'redirect' => "/admin/posts/#{params[:id]}/content"
       })
@@ -171,10 +167,8 @@ module Caboose
     # @route PUT /admin/posts/:id
     def admin_update      
       return if !user_is_allowed('posts', 'edit')
-      
       resp = Caboose::StdClass.new({'attributes' => {}})
-      post = Post.find(params[:id])
-      
+      post = get_edit_post(params[:id], @site.id)
       save = true
       params.each do |name, value|    
         case name                      
@@ -198,14 +192,12 @@ module Caboose
     
     # @route POST /admin/posts/:id/image
     def admin_update_image
-      return if !user_is_allowed('posts', 'edit')
-                 
+      return if !user_is_allowed('posts', 'edit')  
       resp = Caboose::StdClass.new
-      post = Post.find(params[:id])
+      post = get_edit_post(params[:id], @site.id)
       post.image = params[:image]            
       resp.success = post.save
       resp.attributes = { 'image' => { 'value' => post.image.url(:thumb) }}
-      
       render :text => resp.to_json
     end
     
@@ -220,66 +212,62 @@ module Caboose
     # @route POST /admin/posts
     def admin_add
       return if !user_is_allowed('posts', 'add')
-  
       resp = Caboose::StdClass.new({
         'error' => nil,
         'redirect' => nil
       })
-    
       post = Post.new
       post.site_id = @site.id
       post.title = params[:title]                  
       post.published = false
-  
-      if post.title == nil || post.title.length == 0
+      if post.title.blank?
         resp.error = 'A title is required.'      
       else
         post.save        
         post.set_slug_and_uri(post.title)                
         resp.redirect = "/admin/posts/#{post.id}"
       end
-      
       render :json => resp
     end
     
     # @route GET /admin/posts/:id/add-to-category
     def admin_add_to_category
       return if !user_is_allowed('posts', 'edit')
-      
-      post_id = params[:id]
+      post = get_edit_post(params[:id], @site.id)
       cat_id = params[:post_category_id]
-      
-      if !PostCategoryMembership.exists?(:post_id => post_id, :post_category_id => cat_id)
-        PostCategoryMembership.create(:post_id => post_id, :post_category_id => cat_id)
+      if post && !PostCategoryMembership.exists?(:post_id => post.id, :post_category_id => cat_id)
+        PostCategoryMembership.create(:post_id => post.id, :post_category_id => cat_id)
       end
-  
       render :json => true      
     end
     
     # @route GET /admin/posts/:id/remove-from-category
     def admin_remove_from_category
       return if !user_is_allowed('posts', 'edit')
-      
-      post_id = params[:id]
+      post = get_edit_post(params[:id], @site.id)
       cat_id = params[:post_category_id]
-      
-      if PostCategoryMembership.exists?(:post_id => post_id, :post_category_id => cat_id)
-        PostCategoryMembership.where(:post_id => post_id, :post_category_id => cat_id).destroy_all
+      if post && PostCategoryMembership.exists?(:post_id => post.id, :post_category_id => cat_id)
+        PostCategoryMembership.where(:post_id => post.id, :post_category_id => cat_id).destroy_all
       end
-  
       render :json => true      
     end
     
     # @route DELETE /admin/posts/:id
     def admin_delete
       return if !user_is_allowed('posts', 'edit')
-      
-      post_id = params[:id]
-      PostCategoryMembership.where(:post_id => post_id).destroy_all
-      Post.where(:id => post_id).destroy_all
-  
+      post = get_edit_post(params[:id], @site.id)
+      PostCategoryMembership.where(:post_id => post.id).destroy_all if post
+      Post.where(:id => post.id).destroy_all if post
       render :json => { 'redirect' => '/admin/posts' }      
     end
+
+    private
+
+    def get_edit_post(post_id, site_id)
+      post = Post.find(post_id)
+      return post if post && (post.site_id == site_id || logged_in_user.is_super_admin?)
+      return nil
+    end
     
   end
 end

data/app/controllers/caboose/roles_controller.rb

@@ -24,7 +24,7 @@ module Caboose
     # @route GET /admin/roles/:id
     def edit
       return unless user_is_allowed('roles', 'edit')
-      @role = Role.find(params[:id])
+      @role = get_edit_role(params[:id], @site.id)
     end
     
     # @route POST /admin/roles
@@ -56,7 +56,7 @@ module Caboose
       return unless user_is_allowed('roles', 'edit')
       
       resp = StdClass.new     
-      role = Role.find(params[:id])
+      role = get_edit_role(params[:id], @site.id)
       
       save = true
       params.each do |name,value|
@@ -99,7 +99,7 @@ module Caboose
     # @route DELETE /admin/roles/:id
     def destroy
       return unless user_is_allowed('roles', 'delete')
-      @role = Role.find(params[:id])
+      @role = get_edit_role(params[:id], @site.id)
       @role.destroy
       render json: { 'redirect' => '/admin/roles' }
     end
@@ -107,8 +107,9 @@ module Caboose
     # @route POST /admin/roles/:id/permissions/:permission_id
     def add_permission
       return if !user_is_allowed('roles', 'edit')
-      if !RolePermission.where(:role_id => params[:id], :permission_id => params[:permission_id], ).exists?
-        RolePermission.create(:role_id => params[:id], :permission_id => params[:permission_id])
+      role = get_edit_role(params[:id], @site.id)
+      if role && !RolePermission.where(:role_id => role.id, :permission_id => params[:permission_id], ).exists?
+        RolePermission.create(:role_id => role.id, :permission_id => params[:permission_id])
       end
       render :json => true
     end
@@ -116,7 +117,8 @@ module Caboose
     # @route DELETE /admin/roles/:id/permissions/:permission_id
     def remove_permission
       return if !user_is_allowed('roles', 'edit')
-      RolePermission.where(:role_id => params[:id], :permission_id => params[:permission_id]).destroy_all        
+      role = get_edit_role(params[:id], @site.id)
+      RolePermission.where(:role_id => role.id, :permission_id => params[:permission_id]).destroy_all if role      
       render :json => true
     end
     
@@ -143,5 +145,16 @@ module Caboose
       end
       return arr
     end
+
+
+    private
+
+    def get_edit_role(role_id, site_id)
+      role = Role.find(role_id)
+      return role if role && (role.site_id == site_id || logged_in_user.is_super_admin?)
+      return nil
+    end
+
+
   end
 end

data/app/controllers/caboose/sites_controller.rb

@@ -46,6 +46,10 @@ module Caboose
     # @route GET /admin/sites/json
     def admin_json
       return if !user_is_allowed('sites', 'view')
+      if !@site.is_master
+        @error = "You are not allowed to view sites."
+        render :file => 'caboose/extras/error' and return
+      end
       h = {        
         'name'              => '',
         'description'       => '',
@@ -68,14 +72,14 @@ module Caboose
     # @route GET /admin/sites/:id/json
     def admin_json_single
       return if !user_is_allowed('sites', 'view')
-      site = Site.find(params[:id])
+      site = get_edit_site(params[:id], @site.id)
       render :json => site.as_json(:include => :domains)      
     end
     
     # @route GET /admin/sites/new
     def admin_new
       return if !user_is_allowed('sites', 'add')
-      if (@site.id.to_s != params[:id] && !@site.is_master)
+      if !@site.is_master
         @error = "You are not allowed to edit this site."
         render :file => 'caboose/extras/error' and return
       end
@@ -299,6 +303,7 @@ module Caboose
     # @route GET /admin/sites/:id/:field-options    
     def options
       return if !user_is_allowed('sites', 'view')
+      render :json => { :error => "You are not allowed to manage sites." } and return if !@site.is_master
       case params[:field]
         when nil
           options = logged_in_user.is_super_admin? ? Site.reorder('name').all.collect { |s| { 'value' => s.id, 'text' => s.name }} : []
@@ -312,5 +317,14 @@ module Caboose
       render :json => options
     end
 
+
+    private
+
+    def get_edit_site(s_id, site_id)
+      site = Site.find(s_id)
+      return site if site && (site.id == site_id || logged_in_user.is_super_admin?)
+      return nil
+    end
+
   end
 end

data/app/controllers/caboose/sns_controller.rb

@@ -12,13 +12,6 @@ module Caboose
     def admin_add
       body = JSON.parse(request.raw_post, {symbolize_names: true})
       Caboose.log(body)
-      # if body[:Records]
-      #   records = body[:Records]
-      #   # if body[:Type] && body[:Type] == "SubscriptionConfirmation"
-      #   #   Caboose.log("SNS Subscription SubscribeURL\n#{body[:SubscribeURL]}")
-      #   if records['eventSource'] == "aws:s3"
-      #     msg = JSON.parse(body[:Message])
-      #     if msg['Records']
       if body && body[:Records]
         body[:Records].each do |r|
           if r[:eventName] && r[:eventName].starts_with?('ObjectCreated')          
@@ -36,9 +29,6 @@ module Caboose
           end                  
         end
       end
-      #     end
-      #   end
-      # end
       render :json => true
     end
     

data/app/controllers/caboose/users_controller.rb

@@ -37,7 +37,8 @@ module Caboose
     	    'sort'			     => 'last_name, first_name',
     		  'desc'			     => false,
     		  'base_url'		   => '/admin/users',
-    		  'use_url_params' => false
+    		  'use_url_params' => false,
+          'additional_where' => [ "(site_id = #{@site.id})" ]
     	})    	    	      
     	render :json => {
     	  :pager => pager,
@@ -253,6 +254,8 @@ module Caboose
               resp.error = "Username must be at least three characters."
             elsif Caboose::User.where(:username => uname, :site_id => @site.id).where('id != ?',user.id).exists?
               resp.error = "That username is already taken."
+            elsif uname == 'superadmin'
+              resp.error = "Choose a different username."
             else
               user.username    = uname
             end

data/app/views/caboose/roles/edit.html.erb

@@ -3,12 +3,12 @@
 
 <p><input type='button' value='< Back' onclick="window.location='/admin/roles';" /></p>
 
-<div id="role_<%= @role.id %>_name"></div>
-<div id="role_<%= @role.id %>_parent_id"></div>
-<div id="role_<%= @role.id %>_description"></div>
+<p><div id="role_<%= @role.id %>_name"></div></p>
+<p><div id="role_<%= @role.id %>_parent_id"></div></p>
+<p><div id="role_<%= @role.id %>_description"></div></p>
 
 <h3>Members</h3>
-<% users = Caboose::User.where(:site_id => @site.id).reorder("last_name, first_name").all %>
+<% users = Caboose::User.where(:site_id => @site.id).reorder("last_name, first_name").limit(100) %>
 <% if users && users.count > 0 %>
   <div id='members'>
     <table class='data'>

data/app/views/caboose/sites/admin_edit.html.erb

@@ -59,7 +59,7 @@ user_ids = [] if user_ids.nil?
 <div id='members'>
 <table class='data'>
 <tr><th>User</th><th>None</th><th>User</th><th>Admin</th></tr>
-<% Caboose::User.where(:site_id => @site.id).reorder('last_name, first_name').all.each do |u| %>
+<% Caboose::User.where(:site_id => @site.id).reorder('last_name, first_name').limit(100).each do |u| %>
   <tr>
     <td><%= u.first_name %> <%= u.last_name %> (<%= u.email %>)</td>
     <td align='center'><input type='radio' name='user<%= u.id %>' <%= !admin_ids.include?(u.id) && !user_ids.include?(u.id) ? "checked='true'" : '' %> onclick="remove_site_membership(<%= s.id %>, <%= u.id %>);" /></td>

data/lib/caboose/version.rb

@@ -1,3 +1,3 @@
 module Caboose
-  VERSION = '0.9.194'
+  VERSION = '0.9.195'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: caboose-cms
 version: !ruby/object:Gem::Version
-  version: 0.9.194
+  version: 0.9.195
 platform: ruby
 authors:
 - William Barry