cama_contact_form 0.1.0 → 0.1.13

data/app/controllers/plugins/cama_contact_form/front_controller.rb

@@ -1,27 +1,51 @@
+# frozen_string_literal: true
+
+# Public endpoint that receives a form submission (`save_form`) and redisplays the form on refusal.
 class Plugins::CamaContactForm::FrontController < CamaleonCms::Apps::PluginsFrontController
   include Plugins::CamaContactForm::MainHelper
   include Plugins::CamaContactForm::ContactFormControllerConcern
-  
+
   # here add your custom functions
   def save_form
     flash[:contact_form] = {}
-    @form = current_site.contact_forms.find_by_id(params[:id])
+    @form = current_site.contact_forms.find_by(id: params[:id])
     fields = params[:fields]
     errors = []
     success = []
 
-    args = {form: @form, values: fields, flag: true}; hooks_run("contact_form_before_submit", args)
+    args = { form: @form, values: fields, flag: true }
+    hooks_run('contact_form_before_submit', args)
     if args[:flag]
       perform_save_form(@form, fields, success, errors)
       if success.present?
         flash[:contact_form][:notice] = success.join('<br>')
       else
         flash[:contact_form][:error] = errors.join('<br>')
-        flash[:values] = fields.delete_if{|k, v| v.class.name == 'ActionDispatch::Http::UploadedFile' }
+        # Redisplaying the submission is the only reason it ever reaches the page, so a submission
+        # containing anything malign is refused whole and echoed back not at all. Filtering it down
+        # to the safe fields would be more work for a worse result: the visitor gets a half-filled
+        # form, and every future edit to the rendering has to stay in step with the filter.
+        #
+        # Stamped with the form it was judged against. The gate walks `@form.fields` for the form
+        # named by params[:id], but the redisplay page hands flash[:values] to *every* shortcode on
+        # it, and auto-generated cids are `c1, c2, …` in every form -- so a value cleared as textarea
+        # content for one form was being rendered into a value attribute by another.
+        #
+        # `@form` is whatever `find_by_id` returned, which is nil for a deleted or bogus id -- a
+        # POST anyone can make without credentials. `unsafe_submitted?` fails closed on that, so the
+        # guard below is belt and braces for the `@form.id` read on the line after it.
+        if @form.present? && fields.respond_to?(:delete_if) && !unsafe_submitted?(@form, fields)
+          flash[:values] = fields.delete_if { |_k, v| v.instance_of?(::ActionDispatch::Http::UploadedFile) }
+          flash[:values_form_id] = @form.id
+        end
       end
     end
     if Rails::VERSION::MAJOR >= 5
-      params[:format] == 'json' ? render(json: flash.discard(:contact_form).to_hash) : (redirect_back fallback_location: cama_root_path)
+      if params[:format] == 'json'
+        render(json: flash.discard(:contact_form).to_hash)
+      else
+        redirect_back fallback_location: cama_root_path
+      end
     else
       params[:format] == 'json' ? render(json: flash.discard(:contact_form).to_hash) : (redirect_to :back)
     end

data/app/helpers/plugins/cama_contact_form/main_helper.rb

@@ -1,70 +1,77 @@
+# frozen_string_literal: true
+
+# View helpers that render a form's fields to Bootstrap markup for the `[forms]` shortcode.
 module Plugins::CamaContactForm::MainHelper
   include Recaptcha::Adapters::ViewMethods
+
   def self.included(klass)
-    klass.helper_method [:cama_form_element_bootstrap_object, :cama_form_shortcode] rescue "" # here your methods accessible from views
+    klass.helper_method %i[cama_form_element_bootstrap_object cama_form_shortcode]
+  rescue StandardError
+    ''
+    # here your methods accessible from views
   end
 
   def contact_form_on_export(args)
-    args[:obj][:plugins][self_plugin_key] = JSON.parse(current_site.contact_forms.to_json(:include => [:responses]))
+    args[:obj][:plugins][self_plugin_key] = JSON.parse(current_site.contact_forms.to_json(include: [:responses]))
   end
 
   def contact_form_on_import(args)
     plugins = args[:data][:plugins]
-    if plugins[self_plugin_key.to_sym].present?
-      plugins[self_plugin_key.to_sym].each do |contact|
-        unless current_site.contact_forms.where(slug: contact[:slug]).first.present?
-          sba_data = ActionController::Parameters.new(contact)
-          contact_new = current_site.contact_forms.new(sba_data.permit(:name, :slug, :count, :description, :value, :settings))
-          if contact_new.save!
-            if contact[:get_field_groups] # save group fields
-              save_field_group(contact_new, contact[:get_field_groups])
-            end
-            save_field_values(contact_new, contact[:field_values])
+    return if plugins[self_plugin_key.to_sym].blank?
 
-            if contact[:responses].present? # saving responses for this contact
-              contact[:responses].each do |response|
-                sba_data = ActionController::Parameters.new(response)
-                contact_new.responses.create!(sba_data.permit(:name, :slug, :count, :description, :value, :settings))
-              end
-            end
-            args[:messages] << "Saved Plugin Contact Form: #{contact_new.name}"
-          end
+    plugins[self_plugin_key.to_sym].each do |contact|
+      next if current_site.contact_forms.where(slug: contact[:slug]).first.present?
+
+      sba_data = ActionController::Parameters.new(contact)
+      contact_new = current_site.contact_forms.new(sba_data.permit(:name, :slug, :count, :description, :value,
+                                                                   :settings))
+      next unless contact_new.save!
+
+      save_field_group(contact_new, contact[:get_field_groups]) if contact[:get_field_groups] # save group fields
+      save_field_values(contact_new, contact[:field_values])
+
+      if contact[:responses].present? # saving responses for this contact
+        contact[:responses].each do |response|
+          sba_data = ActionController::Parameters.new(response)
+          contact_new.responses.create!(sba_data.permit(:name, :slug, :count, :description, :value, :settings))
         end
       end
+      args[:messages] << "Saved Plugin Contact Form: #{contact_new.name}"
     end
   end
 
   # here all actions on plugin destroying
   # plugin: plugin model
-  def contact_form_on_destroy(plugin)
-
-  end
+  def contact_form_on_destroy(plugin); end
 
   # here all actions on going to active
   # you can run sql commands like this:
   # results = ActiveRecord::Base.connection.execute(query);
   # plugin: plugin model
-  def contact_form_on_active(plugin)
-
-  end
+  def contact_form_on_active(plugin); end
 
   # here all actions on going to inactive
   # plugin: plugin model
-  def contact_form_on_inactive(plugin)
-
-  end
+  def contact_form_on_inactive(plugin); end
 
   def contact_form_admin_before_load
-    admin_menu_append_menu_item("settings", {icon: "envelope-o", title: t('plugins.cama_contact_form.title', default: 'Contact Form'), url: admin_plugins_cama_contact_form_admin_forms_path, datas: "data-intro='This plugin permit you to create you contact forms with desired fields and paste your short_code in any content.' data-position='right'"})
+    admin_menu_append_menu_item(
+      'settings',
+      { icon: 'envelope-o',
+        title: t('plugins.cama_contact_form.title', default: 'Contact Form'),
+        url: admin_plugins_cama_contact_form_admin_forms_path,
+        datas: "data-intro='This plugin permit you to create you contact forms with desired fields " \
+               "and paste your short_code in any content.' data-position='right'" }
+    )
   end
 
   def contact_form_app_before_load
-    shortcode_add('forms', plugin_view("forms_shorcode"), "This is a shortocode for contact form to permit you to put your contact form in any content. Sample: [forms slug='key-for-my-form']")
+    shortcode_add('forms', plugin_view('forms_shorcode'),
+                  'This is a shortocode for contact form to permit you to put your contact form in any ' \
+                  "content. Sample: [forms slug='key-for-my-form']")
   end
 
-  def contact_form_front_before_load
-
-  end
+  def contact_form_front_before_load; end
 
   # ============== HTML ==================
   # This returns the format of the plugin shortcode.
@@ -72,95 +79,202 @@ module Plugins::CamaContactForm::MainHelper
     "[forms slug=#{slug}]"
   end
 
+  # Nothing in this file escapes anything, by design. Every value it interpolates -- an author's
+  # labels, descriptions, classes, default values, wrappers and templates, a visitor's redisplayed
+  # submission, and the structural identifiers the form builder generates -- reaches the page
+  # VERBATIM.
+  #
+  # That is safe because it is enforced at the gate rather than at the sink. The admin controller
+  # refuses to store content an untrusted author may not write, and refuses structurally malformed
+  # values from anyone; the front controller refuses a submission carrying anything malign and
+  # echoes it back not at all. Stored content therefore always equals written content, so rendering
+  # it verbatim introduces nothing the writer did not put there -- and an author holding
+  # :manage, :contact_form_unfiltered_html can put markup, or script, anywhere in a form and have
+  # guests receive it exactly as written.
+  #
+  # Emit a field's custom attributes verbatim.
+  #
+  # Camaleon's Hash#to_attr_format is deliberately NOT used here. That method escapes values and
+  # drops keys that are not valid attribute names, which is exactly right for its other callers --
+  # plugins and themes handing it data from who-knows-where -- but wrong for this one.
+  # field_attributes is authored content: it is validated when the form is saved, and an author
+  # holding the unfiltered-HTML grant is entitled to emit an event handler through it.
+  def cf_attrs(attrs)
+    (attrs || {}).map { |key, value| "#{key} = \"#{value}\"" }.join(' ')
+  end
+
+  # Substitute every placeholder in ONE pass, so no replacement is ever scanned for the next
+  # placeholder. Substituting in sequence meant `[label ci]` was searched for in the field markup
+  # `[ci]` had just produced -- so a visitor typing the literal `[label ci]` into a message had the
+  # author's label spliced into the middle of the textarea that was echoing it back.
+  #
+  # `[ci]` and `[descr ci]` keep first-occurrence semantics and `[label ci]` all-occurrence, which is
+  # what the three separate sub/sub/gsub calls did.
+  #
+  # The block form of #gsub is used throughout: a String replacement would treat `\1` or `\\` in the
+  # value as a backreference and silently mangle it.
+  CF_PLACEHOLDER = /\[(?:ci|label ci|descr ci)\]/
+  CF_REPEATABLE_PLACEHOLDERS = ['[label ci]'].freeze
+
+  def cf_substitute(template, replacements)
+    seen = Hash.new(0)
+    template.to_s.gsub(CF_PLACEHOLDER) do |placeholder|
+      seen[placeholder] += 1
+      if seen[placeholder] == 1 || CF_REPEATABLE_PLACEHOLDERS.include?(placeholder)
+        replacements.fetch(placeholder, placeholder)
+      else
+        placeholder
+      end
+    end
+  end
+
   # form contact with css bootstrap
   def cama_form_element_bootstrap_object(form, object, values)
-    html = ""
-    object.each do |ob|
-      ob[:label] = ob[:label].to_s.translate
-      ob[:description] = ob[:description].to_s.translate
-      r = {field: ob, form: form, template: (ob[:field_options][:template].present? ? ob[:field_options][:template] :  Plugins::CamaContactForm::CamaContactForm::field_template), custom_class: (ob[:field_options][:field_class] rescue nil), custom_attrs: {id: ob[:cid] }.merge((JSON.parse(ob[:field_options][:field_attributes]) rescue {})) }
-      hooks_run("contact_form_item_render", r)
-      ob = r[:field]
-      ob[:custom_class] = r[:custom_class]
-      ob[:custom_attrs] = r[:custom_attrs]
-      ob[:custom_attrs][:required] = 'true' if ob[:required].present? && ob[:required].to_bool
-      field_options = ob[:field_options]
-      for_name = ob[:label].to_s
-      f_name = "fields[#{ob[:cid]}]"
-      cid = ob[:cid].to_sym
-
-      temp2 = ""
-
-      case ob[:field_type].to_s
-        when 'paragraph','textarea'
-          temp2 = "<textarea #{ob[:custom_attrs].to_attr_format} name=\"#{f_name}\" maxlength=\"#{field_options[:maxlength] || 500 }\"  class=\"#{ob[:custom_class].presence || 'form-control'}  \">#{values[cid] || ob[:default_value].to_s.translate}</textarea>"
-        when 'radio'
-          temp2=  cama_form_select_multiple_bootstrap(ob, ob[:label], ob[:field_type],values)
-        when 'checkboxes'
-          temp2=  cama_form_select_multiple_bootstrap(ob, ob[:label], "checkbox",values)
-        when 'submit'
-          temp2 = "<button #{ob[:custom_attrs].to_attr_format} type=\"#{ob[:field_type]}\" name=\"#{f_name}\"  class=\"#{ob[:custom_class].presence || 'btn btn-default'}\">#{ob[:label]}</button>"
-        when 'button'
-          temp2 = "<button #{ob[:custom_attrs].to_attr_format} type='button' name=\"#{f_name}\" class=\"#{ob[:custom_class].presence || 'btn btn-default'}\">#{ob[:label]}</button>"
-        when 'reset_button'
-          temp2 = "<button #{ob[:custom_attrs].to_attr_format} type='reset' name=\"#{f_name}\" class=\"#{ob[:custom_class].presence || 'btn btn-default'}\">#{ob[:label]}</button>"
-        when 'text', 'website', 'email'
-          class_type = ""
-          class_type = "railscf-field-#{ob[:field_type]}" if ob[:field_type]=="website"
-          class_type = "railscf-field-#{ob[:field_type]}" if ob[:field_type]=="email"
-          temp2 = "<input #{ob[:custom_attrs].to_attr_format} type=\"#{ob[:field_type]}\" value=\"#{values[cid] || ob[:default_value].to_s.translate}\" name=\"#{f_name}\"  class=\"#{ob[:custom_class].presence || 'form-control'} #{class_type}\">"
-        when 'captcha'
-          if form.recaptcha_enabled?
-            temp2 = recaptcha_tags
-          else
-            temp2 = cama_captcha_tag(5, {}, {class: "#{ob[:custom_class].presence || 'form-control'} field-captcha required"}.merge(ob[:custom_attrs]))
-          end
-        when 'file'
-          temp2 = "<input multiple=\"multiple\" type=\"file\" value=\"\" name=\"#{f_name}[]\" #{ob[:custom_attrs].to_attr_format} class=\"#{ob[:custom_class].presence || 'form-control'}\">"
-        when 'dropdown'
-          temp2 = cama_form_select_multiple_bootstrap(ob, ob[:label], "select",values)
+    html = ''
+    object.each do |obj|
+      obj[:label] = obj[:label].to_s.translate
+      obj[:description] = obj[:description].to_s.translate
+      template = obj[:field_options][:template].presence ||
+                 Plugins::CamaContactForm::CamaContactForm.field_template
+      r = { field: obj, form: form, template: template, custom_class: begin
+        obj[:field_options][:field_class]
+      rescue StandardError
+        nil
+      end, custom_attrs: { id: obj[:cid] }.merge(begin
+        JSON.parse(obj[:field_options][:field_attributes])
+      rescue StandardError
+        {}
+      end) }
+      hooks_run('contact_form_item_render', r)
+      obj = r[:field]
+      obj[:custom_class] = r[:custom_class]
+      obj[:custom_attrs] = r[:custom_attrs]
+      # `cama_true?`, not `to_bool`: `to_bool` raises ArgumentError on anything outside its two
+      # patterns, so a stored `required` of `maybe` was a 500 on every visit to the page.
+      obj[:custom_attrs][:required] = 'true' if obj[:required].to_s.cama_true?
+      field_options = obj[:field_options]
+      for_name = obj[:label].to_s
+      f_name = "fields[#{obj[:cid]}]"
+      cid = obj[:cid].to_sym
+
+      temp2 = ''
+
+      # Both a redisplayed submission and the author's default_value render verbatim: each was
+      # validated before it could be stored or stashed, so neither can carry anything the submitter
+      # was not permitted to write.
+      current_value = values[cid] || obj[:default_value].to_s.translate
+
+      case obj[:field_type].to_s
+      when 'paragraph', 'textarea'
+        temp2 = "<textarea #{cf_attrs(obj[:custom_attrs])} name=\"#{f_name}\" " \
+                "maxlength=\"#{field_options[:maxlength] || 500}\"  " \
+                "class=\"#{obj[:custom_class].presence || 'form-control'}  \">#{current_value}</textarea>"
+      when 'radio'
+        temp2 = cama_form_select_multiple_bootstrap(obj, obj[:label], obj[:field_type], values)
+      when 'checkboxes'
+        temp2 = cama_form_select_multiple_bootstrap(obj, obj[:label], 'checkbox', values)
+      when 'submit'
+        temp2 = "<button #{cf_attrs(obj[:custom_attrs])} type=\"#{obj[:field_type]}\" name=\"#{f_name}\"  " \
+                "class=\"#{obj[:custom_class].presence || 'btn btn-default'}\">#{obj[:label]}</button>"
+      when 'button'
+        temp2 = "<button #{cf_attrs(obj[:custom_attrs])} type='button' name=\"#{f_name}\" " \
+                "class=\"#{obj[:custom_class].presence || 'btn btn-default'}\">#{obj[:label]}</button>"
+      when 'reset_button'
+        temp2 = "<button #{cf_attrs(obj[:custom_attrs])} type='reset' name=\"#{f_name}\" " \
+                "class=\"#{obj[:custom_class].presence || 'btn btn-default'}\">#{obj[:label]}</button>"
+      when 'text', 'website', 'email'
+        class_type = ''
+        class_type = "railscf-field-#{obj[:field_type]}" if obj[:field_type] == 'website'
+        class_type = "railscf-field-#{obj[:field_type]}" if obj[:field_type] == 'email'
+        temp2 = "<input #{cf_attrs(obj[:custom_attrs])} type=\"#{obj[:field_type]}\" value=\"#{current_value}\" " \
+                "name=\"#{f_name}\"  class=\"#{obj[:custom_class].presence || 'form-control'} #{class_type}\">"
+      when 'captcha'
+        if form.recaptcha_enabled?
+          temp2 = recaptcha_tags
         else
+          # The one field type whose attributes do not go through cf_attrs: cama_captcha_tag builds
+          # its markup with Rails' `tag`, which escapes values and rewrites malformed names. That is
+          # a documented exception to this file's verbatim contract rather than a gap in it -- `tag`
+          # is the stricter of the two, so a trusted author's quoted value is escaped here and a
+          # malformed attribute name is mangled rather than emitted. Left as it is deliberately:
+          # reproducing cf_attrs would mean rebuilding the helper's output by string surgery, which
+          # is a real risk of breaking the captcha for a consistency gain and no security gain.
+          captcha_class = "#{obj[:custom_class].presence || 'form-control'} field-captcha required"
+          temp2 = cama_captcha_tag(5, {}, { class: captcha_class }.merge(obj[:custom_attrs]))
+        end
+      when 'file'
+        temp2 = "<input multiple=\"multiple\" type=\"file\" value=\"\" name=\"#{f_name}[]\" " \
+                "#{cf_attrs(obj[:custom_attrs])} class=\"#{obj[:custom_class].presence || 'form-control'}\">"
+      when 'dropdown'
+        temp2 = cama_form_select_multiple_bootstrap(obj, obj[:label], 'select', values)
       end
-      r[:template] = r[:template].sub('[ci]', temp2)
-      r[:template] = r[:template].sub('[descr ci]', field_options[:description].to_s.translate).sub('<p></p>', '')
-      html += r[:template].gsub('[label ci]', for_name)
+      r[:template] = cf_substitute(r[:template],
+                                   '[ci]' => temp2,
+                                   '[descr ci]' => field_options[:description].to_s.translate,
+                                   '[label ci]' => for_name).sub('<p></p>', '')
+      html += r[:template]
     end
     html
   end
 
-  def cama_form_select_multiple_bootstrap(ob, title, type, values)
-    options = ob[:field_options][:options]
-    include_other_option = ob[:field_options][:include_other_option]
-    other_input = ""
+  # Field control types rendered as a group of <input> tags rather than a <select>.
+  RADIO_CHECKBOX_CONTROL_TYPES = %w[radio checkbox].freeze
+
+  def cama_form_select_multiple_bootstrap(obj, title, type, values)
+    # Defensive, because a form saved before the gate required a well-formed option list carries
+    # whatever it carries -- and `nil.each`, or `op[:label]` on a String, is a 500 on every visit to
+    # the page. `Array()` alone will not do: on a Hash it yields key/value pairs.
+    raw_options = obj[:field_options][:options]
+    options = (raw_options.is_a?(Hash) ? raw_options.values : Array(raw_options))
+              .grep(Hash)
+    include_other_option = obj[:field_options][:include_other_option]
+    other_input = ''
 
-    f_name = "fields[#{ob[:cid]}]"
-    cid = ob[:cid].to_sym
-    html = ""
+    f_name = "fields[#{obj[:cid]}]"
+    cid = obj[:cid].to_sym
+    html = ''
 
-    if type == "radio" || type == "checkbox"
-      other_input = (include_other_option)? "<div class=\"#{type} #{ob[:custom_class]}\"> <label for=\"#{ob[:cid]}\"><input id=\"#{ob[:cid]}-other\" type=\"#{type}\" name=\"#{title.downcase}[]\" class=\"\">Other <input type=\"text\" /></label></div>" : " "
+    custom_class = obj[:custom_class].to_s
+
+    if RADIO_CHECKBOX_CONTROL_TYPES.include?(type)
+      other_input = if include_other_option
+                      "<div class=\"#{type} #{custom_class}\"> <label for=\"#{obj[:cid]}\">" \
+                        "<input id=\"#{obj[:cid]}-other\" type=\"#{type}\" name=\"#{title.downcase}[]\" class=\"\">" \
+                        'Other <input type="text" /></label></div>'
+                    else
+                      ' '
+                    end
     else
-      html = "<select #{ob[:custom_attrs].to_attr_format} name=\"#{f_name}\" class=\"#{ob[:custom_class]}\">"
+      html = "<select #{cf_attrs(obj[:custom_attrs])} name=\"#{f_name}\" class=\"#{custom_class}\">"
     end
 
     options.each do |op|
-      label = op[:label].translate
-      if type == "radio" || type == "checkbox"
-        html += "<div class=\"#{type} #{ob[:custom_class]}\">
-                    <label for=\"#{ob[:cid]}\">
-                      <input #{ob[:custom_attrs].to_attr_format} type=\"#{type}\" #{'checked' if op[:checked].to_s.cama_true?} name=\"#{f_name}[]\" class=\"\" value=\"#{label.downcase}\">
+      label = op[:label].to_s.translate
+      if RADIO_CHECKBOX_CONTROL_TYPES.include?(type)
+        input_tag = "<input #{cf_attrs(obj[:custom_attrs])} type=\"#{type}\" " \
+                    "#{'checked' if op[:checked].to_s.cama_true?} name=\"#{f_name}[]\" " \
+                    "class=\"\" value=\"#{label.downcase}\">"
+        html += "<div class=\"#{type} #{custom_class}\">
+                    <label for=\"#{obj[:cid]}\">
+                      #{input_tag}
                       #{label}
                     </label>
                   </div>"
       else
-        html += "<option  value=\"#{label.downcase.gsub(" ", "_")}\" #{"selected" if "#{label.downcase.gsub(" ", "_")}" == values[cid] || op[:checked].to_s.cama_true? } >#{label}</option>"
+        # A dropdown submits the label lowercased with spaces collapsed to underscores. Derived once
+        # so the emitted value and the `selected` comparison cannot drift apart -- but only here:
+        # radio and checkbox have always submitted the plain lowercased label, and unifying the two
+        # would silently change what every existing response row is compared against.
+        option_value = label.downcase.tr(' ', '_')
+        html += "<option  value=\"#{option_value}\" " \
+                "#{'selected' if option_value == values[cid] || op[:checked].to_s.cama_true?} >#{label}</option>"
       end
     end
 
-    if type == "radio" || type == "checkbox"
-      html += other_input
-    else
-      html += " </select>"
-    end
+    html += if RADIO_CHECKBOX_CONTROL_TYPES.include?(type)
+              other_input
+            else
+              ' </select>'
+            end
   end
 end

data/app/models/plugins/cama_contact_form/cama_contact_form.rb

@@ -1,12 +1,21 @@
+# frozen_string_literal: true
+
+# A contact form and, through `parent_id`, its stored response rows, scoped to a site.
 class Plugins::CamaContactForm::CamaContactForm < ActiveRecord::Base
   include Plugins::CamaContactForm::MainHelper
+
   self.table_name = 'plugins_contact_forms'
-  belongs_to :site, class_name: "CamaleonCms::Site"
+  belongs_to :site, class_name: 'CamaleonCms::Site'
   # attr_accessible :site_id, :name, :description, :count, :slug, :value, :settings, :parent_id
 
-  has_many :responses, :class_name => "Plugins::CamaContactForm::CamaContactForm", :foreign_key => :parent_id, dependent: :destroy
+  # A self-referential parent/child: a form and its stored response rows. There is no reciprocal
+  # `belongs_to :parent` to point `inverse_of` at, so the cop is disabled for this association only.
+  # rubocop:disable Rails/InverseOf
+  has_many :responses, class_name: 'Plugins::CamaContactForm::CamaContactForm', foreign_key: :parent_id,
+                       dependent: :destroy
+  # rubocop:enable Rails/InverseOf
   validates :name, presence: true
-  validates_uniqueness_of :slug, scope: :site_id
+  validates :slug, uniqueness: { scope: :site_id }
 
   before_validation :before_validating
   before_create :fix_save_settings
@@ -14,64 +23,90 @@ class Plugins::CamaContactForm::CamaContactForm < ActiveRecord::Base
 
   default_scope { order(created_at: :desc) }
 
+  # Example of the stored `value` JSON, kept on one line for copy-paste:
+  # rubocop:disable Layout/LineLength
   # [{"label":"Untitled","field_type":"text","required":true,"field_options":{"size":"large","field_class":"Default"},"cid":"c2"},{"label":"Untitled","field_type":"paragraph","required":true,"field_options":{"size":"large","field_class":"Default"},"cid":"c6"},{"label":"Untitled","field_type":"captcha","required":true,"field_options":{"field_class":"Default"},"cid":"c10"},{"label":"Untitled","field_type":"checkboxes","required":true,"field_options":{"options":[{"label":"Default","checked":false},{"label":"Default","checked":false}],"field_class":"Default","description":"description\n"},"cid":"c12"}]
+  # rubocop:enable Layout/LineLength
   def fields
-    @_the_fields ||= JSON.parse(self.value || '{fields: []}').with_indifferent_access
-    @_the_fields[:fields]
+    @_the_fields ||= JSON.parse(value || '{"fields": []}').with_indifferent_access
+    Array(@_the_fields[:fields])
   end
 
   def the_settings
-    @_the_settings ||= JSON.parse(self.settings || '{}').with_indifferent_access
+    @the_settings ||= JSON.parse(settings || '{}').with_indifferent_access
+  end
+
+  # The three settings containers, always readable. A form that has never been saved carries
+  # `settings` of `{}`, and a partial update can leave any of them unset -- so every caller in the
+  # admin views guards its read with `rescue ''`, while the ones that do not (the public shortcode,
+  # the mailer) raised NoMethodError on every request until someone edited the database by hand.
+  def mail_settings
+    settings_hash(:railscf_mail)
+  end
+
+  def form_button_settings
+    settings_hash(:railscf_form_button)
+  end
+
+  def message_settings
+    settings_hash(:railscf_message)
   end
 
   def the_message(key, default)
-    r = self.the_settings[:railscf_message][key].to_s.translate
-    r.present? ? r : default
+    r = message_settings[key].to_s.translate
+    r.presence || default
   end
 
   def self.field_template
     "<div class='form-group'>\n\t <label>[label ci]</label>\n\t<p>[descr ci]</p>\n\t<div>[ci]</div> \n</div>"
   end
-  
+
   # define recaptcha settings
   def set_captcha_settings!
-    if recaptcha_enabled?
-      Recaptcha.configure do |config|
-        config.site_key  = the_settings[:recaptcha_site_key]
-        config.secret_key = the_settings[:recaptcha_secret_key]
-      end
+    return unless recaptcha_enabled?
+
+    Recaptcha.configure do |config|
+      config.site_key = the_settings[:recaptcha_site_key]
+      config.secret_key = the_settings[:recaptcha_secret_key]
     end
   end
-  
+
   # verify if recaptcha was enabled for this form
-  # this method can be overwritten if recaptcha was already defined on initializers to return true as default 
+  # this method can be overwritten if recaptcha was already defined on initializers to return true as default
   def recaptcha_enabled?
     the_settings[:recaptcha_site_key].present?
   end
 
   private
+
+  def settings_hash(key)
+    value = the_settings[key]
+    value.is_a?(Hash) ? value : {}.with_indifferent_access
+  end
+
   def before_validating
     slug = self.slug
-    slug = self.name if slug.blank?
+    slug = name if slug.blank?
     self.slug = slug.to_s.parameterize
   end
 
   def fix_save_settings
-    self.value = {"fields" => []}.to_json unless self.value.present?
-    self.settings = {}.to_json unless self.settings.present?
+    self.value = { 'fields' => [] }.to_json if value.blank?
+    self.settings = {}.to_json if settings.blank?
   end
 
   def delete_uploaded_files
-    return if self.parent_id.nil?
-    form = self.class.find_by_id self.parent_id
+    return if parent_id.nil?
+
+    form = self.class.find_by id: parent_id
     response_data = the_settings[:fields]
     file_cids = form.fields
                     .select { |f| f[:field_type] == 'file' }
                     .map { |f| f[:cid].to_sym }
 
     file_cids
-        .flat_map { |cid| response_data[cid] }
-        .map { |file| file.sub Rails.application.routes.url_helpers.cama_root_url, Rails.public_path.to_s }
-        .each { |file| File.delete file if File.exists? file }
+      .flat_map { |cid| response_data[cid] }
+      .map { |file| file.sub Rails.application.routes.url_helpers.cama_root_url, Rails.public_path.to_s }
+      .each { |file| FileUtils.rm_f file }
   end
-end
+end

data/app/views/plugins/cama_contact_form/admin_forms/_item_field.html.erb

@@ -31,7 +31,14 @@
             <%= text_area_tag "fields[#{cid}][field_options][description]", field[:field_options][:description], class: 'form-control translatable' %>
         </div>
         <% case field[:field_type] %>
-            <% when 'checkboxes', 'radio', 'select', 'dropdown'; options = (field[:field_options][:options] || []) %>
+            <%# A refused save redraws this editor from the params the author submitted, which is the %>
+            <%# whole point -- but those params are exactly the ones that failed validation, so an   %>
+            <%# option here may be a bare string or the list may be a hash. Coerced rather than      %>
+            <%# assumed, or the refusal message is replaced by a 500.                                %>
+            <% when 'checkboxes', 'radio', 'select', 'dropdown'
+                 raw_options = field[:field_options][:options]
+                 raw_options = raw_options.values if raw_options.is_a?(Hash)
+                 options = Array(raw_options).map { |o| o.is_a?(Hash) ? o : { label: o.to_s, checked: false } } %>
                 <label><%= t('.options', default: 'Options') %></label>
                 <ul class="options_sortable" data-options-count="<%= options.size %>">
                     <% options.unshift({label: '', checked: false}).each_with_index do |option, index| %>

data/app/views/plugins/cama_contact_form/forms_shorcode.html.erb

@@ -2,9 +2,12 @@
    @form =  attributes['slug'] == '__first__' ? current_site.contact_forms.first : current_site.contact_forms.where({slug: attributes['slug']}).first
    if @form.present?
      @form.set_captcha_settings!
-     values_fields =  (flash[:values].present?)? flash[:values].to_sym : {}
+     # Only the form the values were judged safe for -- see FrontController#save_form.
+     values_fields = (flash[:values].present? && flash[:values_form_id].to_s == @form.id.to_s) ? flash[:values].to_sym : {}
      values = JSON.parse(@form.value).to_sym
-     r = {form: @form, form_class: "railscf-form railscf-form-group", before_form: @form.the_settings[:railscf_mail][:previous_html].to_s, after_form: @form.the_settings[:railscf_mail][:after_html].to_s, submit: "<div class='form-group'><button class='submit_btn btn btn-default pull-right' type='submit'>[submit_label]</button></div>"}
+     # `mail_settings`/`form_button_settings`, not `the_settings[...]`: a form that has never been
+     # saved, or one saved without these containers, otherwise raised NoMethodError on every visit.
+     r = {form: @form, form_class: "railscf-form railscf-form-group", before_form: @form.mail_settings[:previous_html].to_s, after_form: @form.mail_settings[:after_html].to_s, submit: "<div class='form-group'><button class='submit_btn btn btn-default pull-right' type='submit'>[submit_label]</button></div>"}
      hooks_run("contact_form_render", r)
 %>
     <section>
@@ -14,7 +17,8 @@
             <%= render :partial => "camaleon_cms/flash_messages", locals:{ flash: (flash[:contact_form] || {}).with_indifferent_access } %>
             <%= raw cama_form_element_bootstrap_object(r[:form], values[:fields], values_fields) %>
             <% if values[:fields].present? && !values[:fields].delete_if{|field| field[:field_type] != 'submit' }.present? %>
-                <%= raw  r[:submit].sub('[submit_label]', @form.the_settings[:railscf_form_button][:name_button])%>
+                <%# element content: rendered as markup, refused on save unless the author is trusted %>
+                <%= raw r[:submit].sub('[submit_label]') { @form.form_button_settings[:name_button].to_s } %>
             <% end %>
             <%= raw front_editor_link(edit_admin_plugins_cama_contact_form_admin_form_url(@form.id)) rescue "" %>
         <% end %>