cama_contact_form 0.1.0 → 0.1.12

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a8f3c768c126ee5bc5444636a26f1aa0423bf74f7e6851ce8d0c656330a137ea
-  data.tar.gz: c52eea668803c03487b09a4a5af1a21c17b30f18339f899dc5cad06cab79909b
+  metadata.gz: b3853b9d6da4e632d947929a801497c0ea6daa25eff3b08834adf1c1aa5d5b86
+  data.tar.gz: 2293350d6071301a7795322485e25402974f82ef2dfadd485833a3c7bf89c851
 SHA512:
-  metadata.gz: 6dcf81c9421fc18ea88be664ba52d3f5471eeb59fc0aeeb7c1f942a4e7e4eaddfa2823c55d236373c2f0ff206b038116ceb907d52b392f2bfe64d8b66ea37143
-  data.tar.gz: faca0df162e1a7ca43824b172b41c26ce9b5d86c83b83d75bc5ffa74f925e0fc985705edb46f655bd6a623fe7854567869e5b729a0f54331514eba24b9de974c
+  metadata.gz: d6aff50b5f8576691862b332848774945591b00600bae4f0c36bd69852ce15dc90c92f2869b1a21a4d6b2e6bab2a6d623b2c1cd5ef93f70ce7265314d8c96112
+  data.tar.gz: e4f5b5977c96e550e3960d07b2fd4c5ae84ed2dae74c4e21f71036815f447476557580ba59c85738bd74f479a4580931d14f67688bfe47067f12d0d83571dcc4

data/README.md

@@ -0,0 +1,204 @@
+# Camaleon CMS Plugin
+This is a plugin for Camaleon CMS to manage Contact Forms
+
+## Releasing
+
+Releases are cut by the **Release** GitHub Actions workflow
+([`.github/workflows/release_builder.yml`](.github/workflows/release_builder.yml)). It only runs
+when you start it by hand — merging to `master` releases nothing. A single run does everything a
+release needs, in this order:
+
+1. verifies the release is safe to cut (see [What the workflow checks](#what-the-workflow-checks)),
+2. builds the gem and inspects the built artifact,
+3. pushes it to RubyGems,
+4. creates the annotated git tag,
+5. publishes the GitHub release, with notes taken from `CHANGELOG.md` and the `.gem` plus its
+   checksums attached.
+
+No tests run here — the suite that covers this plugin lives in the
+[camaleon_cms](https://github.com/owen2345/camaleon-cms) repository.
+
+`lib/cama_contact_form/version.rb` is the single source of truth for the version. The tag, the
+published gem and the GitHub release all derive from it, so they cannot disagree.
+
+> **`0.1.12` below is only an example.** Every command, filename and heading in this section uses it
+> as a stand-in for the version you are actually releasing — substitute yours as you go. This
+> document is not updated each release, so do not expect the number here to be the next one.
+
+### Before you start
+
+- You need **write access** to this repository.
+- The `RUBY_GEMS_PUBLISH_GEM_KEY` repository secret must exist — it is the RubyGems API key the
+  workflow publishes with. It is already configured; you never need to see or handle its value.
+- You do **not** need RubyGems credentials on your own machine for the automated release. You only
+  need them for the [manual fallback](#fallback-releasing-entirely-by-hand).
+
+### Step 1 — Open a release PR
+
+Create a branch, bump the version, and describe the release:
+
+```bash
+git checkout master && git pull
+git checkout -b release/0.1.12
+```
+
+Edit `lib/cama_contact_form/version.rb`:
+
+```ruby
+module CamaContactForm
+  VERSION = "0.1.12"
+end
+```
+
+Then add a matching section at the top of `CHANGELOG.md`, directly under the `# Change Log`
+heading. If an `## Unreleased` section is already sitting there, rename it to the version you are
+shipping and fold your notes into it rather than adding a second section.
+
+**The heading must be exactly `## 0.1.12`** — the workflow copies everything between that heading
+and the next `## ` into the GitHub release body, so an inexact heading (`## v0.1.12`,
+`## 0.1.12 (2026-08-01)`, or a leftover `## Unreleased`) silently costs you your release notes and
+falls back to a bare commit list:
+
+```markdown
+## 0.1.12
+
+What changed and why it matters to someone upgrading.
+[#65](https://github.com/owen2345/cama_contact_form/pull/65)
+```
+
+Commit, push, open the PR, and merge it once it is approved:
+
+```bash
+git commit -am "Release 0.1.12"
+git push -u origin release/0.1.12
+gh pr create --title "Release 0.1.12" --body "Bumps the version and adds the changelog entry."
+```
+
+### Step 2 — Run the Release workflow
+
+Merging does **not** publish anything. Once the PR is merged:
+
+1. Open the repository on GitHub.
+2. Click the **Actions** tab (in the top row, next to *Pull requests*).
+3. In the left sidebar, under *All workflows*, click **Release**.
+4. On the right-hand side of the blue banner, click the **Run workflow** dropdown button.
+5. Leave **Use workflow from** as `Branch: master`. The workflow refuses to run from any other
+   branch, so a gem can never be published from unmerged code.
+6. In **Version to release**, type the version exactly as it appears in `version.rb` — not the
+   `0.1.12` of this example. A leading `v` is accepted and stripped, and a mismatch fails the run
+   before anything is published.
+7. Click the green **Run workflow** button.
+
+The page takes a few seconds to show the new run; reload if it does not appear. Click into the run
+to watch the three jobs — *Verify and build*, *Publish to RubyGems*, and *Tag and publish GitHub
+release* — go green in turn.
+
+> If the **Release** workflow is not listed in step 3, the workflow file has not reached `master`
+> yet. GitHub only offers a manually-triggered workflow once its file exists on the default branch.
+> Merge the PR first.
+
+### Step 3 — Confirm
+
+- **RubyGems**: <https://rubygems.org/gems/cama_contact_form/versions/0.1.12> — it can take a
+  minute or two to appear.
+- **GitHub**: the repository's *Releases* page should show *Release 0.1.12* with your changelog
+  text and three attached files (`.gem`, `.sha256`, `.sha512`).
+- Locally: `gem fetch cama_contact_form -v 0.1.12`
+
+### What the workflow checks
+
+Every check runs *before* anything is published, because pushing to RubyGems is the only step that
+cannot be undone — a version can be yanked, but that version number can never be re-used. If a
+check fails, nothing has been published and nothing has been tagged: fix the cause and start the
+workflow again.
+
+| Failure message | Cause | Fix |
+| --- | --- | --- |
+| `is not a valid gem version` | Typo in the input box | Re-run with the correct version |
+| `Releases must be cut from master` | *Use workflow from* was not `master` | Re-run from `master` |
+| `does not match lib/cama_contact_form/version.rb` | The typed version and `version.rb` disagree | Bump `version.rb`, or type the version it already has |
+| `Tag <version> already exists` | That version was released before | Bump to a new version |
+| `already published on RubyGems` | Same, but caught on the RubyGems side | Bump to a new version |
+| `No release notes` | No `## <version>` section in `CHANGELOG.md` **and** no commits since the last tag | Add the changelog section |
+| `gem build` fails under `--strict` | The gemspec has a warning (missing homepage, missing `required_ruby_version`, …) | Fix the gemspec |
+| `Test files packaged into the gem` | `s.test_files` was re-added to the gemspec | Remove it — RubyGems merges `test_files` into `files` |
+| `<file> is missing from the gem` | A filename in `s.files` no longer matches a real file | Correct the name in the gemspec |
+
+The one failure that needs manual recovery is a job that fails *after* `gem push` succeeded — the
+gem is public, but the tag and release were never created. Do not re-run the workflow, it would
+stop at the "already published" check. Finish it by hand instead, using steps 5 and 6 of the
+fallback below.
+
+### Fallback: releasing entirely by hand
+
+Use this if Actions is down, if the workflow is broken, or to finish a release that failed after
+the gem was already pushed. It needs your own RubyGems credentials, and you must be an owner of the
+gem on RubyGems.
+
+As above, **`0.1.12` is a stand-in for the version you are releasing** — every command below needs
+your own number substituted in, including the `.gem` filenames.
+
+Sign in to RubyGems once per machine — this writes a token to `~/.gem/credentials`:
+
+```bash
+gem signin
+```
+
+Then, from a clean checkout of `master` with the correct version already in `version.rb`:
+
+**1. Start from exactly what you intend to publish.**
+
+```bash
+git checkout master && git pull && git status
+```
+
+`git status` must report a clean tree — `gem build` packages the files on disk, so any stray local
+edit would end up in the published gem.
+
+**2. Build the gem.**
+
+```bash
+gem build cama_contact_form.gemspec --strict
+```
+
+**3. Inspect what you are about to publish.** This is the step the workflow automates; publishing
+is irreversible, so it is worth the minute.
+
+```bash
+gem unpack cama_contact_form-0.1.12.gem --target /tmp/gem-check
+find /tmp/gem-check -type f | sort
+```
+
+Expect about 26 files in total: `MIT-LICENSE`, `Rakefile`, `README.md`, and the rest under `app/`,
+`config/`, `db/` and `lib/`. There must be **no `test/` directory** and no credentials of any kind.
+
+**4. Push to RubyGems.** If your account has MFA enabled for publishing, this prompts for a
+one-time code.
+
+```bash
+gem push cama_contact_form-0.1.12.gem
+```
+
+**5. Create and push the tag.** Annotated (`-a`), to match every existing tag in this repository:
+
+```bash
+git tag -a 0.1.12 -m "Release 0.1.12"
+git push origin 0.1.12
+```
+
+**6. Publish the GitHub release.** Either with the CLI:
+
+```bash
+gh release create 0.1.12 --title "Release 0.1.12" --notes-file notes.md cama_contact_form-0.1.12.gem
+```
+
+where `notes.md` holds the changelog section for this version — or through the web interface:
+
+1. On the repository's front page, click **Releases** in the right-hand sidebar.
+2. Click **Draft a new release**.
+3. In **Choose a tag**, select the `0.1.12` tag you pushed in step 5.
+4. Set **Target** to `master`.
+5. Set the title to `Release 0.1.12`.
+6. Paste the `CHANGELOG.md` section for this version into the description box.
+7. Drag `cama_contact_form-0.1.12.gem` into the *Attach binaries* area at the bottom.
+8. Click **Publish release**.

data/Rakefile

@@ -10,7 +10,7 @@ RDoc::Task.new(:rdoc) do |rdoc|
   rdoc.rdoc_dir = 'rdoc'
   rdoc.title    = 'CamaContactForm'
   rdoc.options << '--line-numbers'
-  rdoc.rdoc_files.include('README.rdoc')
+  rdoc.rdoc_files.include('README.md')
   rdoc.rdoc_files.include('lib/**/*.rb')
 end
 

data/app/assets/javascripts/plugins/cama_contact_form/admin_editor.js

@@ -16,7 +16,7 @@ $(function() {
         res.find('.options_sortable').sortable({ handle: '.options-sortable' })
         res.find('.add_option').click().click()
         res.find('.translatable').Translatable(ADMIN_TRANSLATIONS)
-        return hideLoading()
+        hideLoading()
       })
     return false
   })
@@ -27,7 +27,7 @@ $(function() {
 
     const clone = list.children().first().clone().removeClass('hidden')
     clone.find('input').prop('disabled', false).each(function() {
-      return $(this).attr('name', $(this).attr('name').replace('[0]', '[' + list.attr('data-options-count') + ']'))
+      $(this).attr('name', $(this).attr('name').replace('[0]', '[' + list.attr('data-options-count') + ']'))
     })
 
     list.append(clone)
@@ -42,7 +42,7 @@ $(function() {
 
   panel.on('click', '.panel-delete', function() {
     $(this).closest('li.panel').fadeOut('slow', function() {
-      return $(this).remove()
+      $(this).remove()
     })
     return false
   })
@@ -53,5 +53,5 @@ $(function() {
   })
 
   myFields.find('.options_sortable').sortable({ handle: '.options-sortable' })
-  return panel.find('.translatable').Translatable(ADMIN_TRANSLATIONS)
+  panel.find('.translatable').Translatable(ADMIN_TRANSLATIONS)
 })

data/app/controllers/concerns/plugins/cama_contact_form/contact_form_controller_concern.rb

@@ -1,4 +1,19 @@
 module Plugins::CamaContactForm::ContactFormControllerConcern
+  # The field types whose submitted value the renderer interpolates back into the page, and the
+  # position each one lands in. Everything else -- radio, checkboxes, dropdown, file -- is only ever
+  # compared against, never interpolated, so nothing it contains can escape anything.
+  ECHOED_ATTRIBUTE_FIELD_TYPES = %w[text website email].freeze
+  ECHOED_TEXTAREA_FIELD_TYPES = %w[paragraph textarea].freeze
+
+  # Elements that do something rather than say something, wherever they appear.
+  ACTIVE_ELEMENTS = %w[script style iframe object embed applet frame frameset form input button
+                       link meta base svg math template].freeze
+  ACTIVE_ELEMENT = /<\s*\/?\s*(?:#{ACTIVE_ELEMENTS.join('|')})\b/i
+  EVENT_HANDLER_IN_TAG = /<[a-zA-Z][^>]*\son[a-zA-Z]+\s*=/im
+  URL_SCHEME_IN_TAG =
+    %r{<[a-zA-Z][^>]*\b(?:href|src|action|formaction|data|poster|srcdoc|background)\s*=\s*
+       ["']?\s*(?:javascript|vbscript|data)\s*:}imx
+
   def perform_save_form(form, fields, success, errors)
     attachments = []
     if validate_to_save_form(form, fields, errors)
@@ -26,14 +41,14 @@ module Plugins::CamaContactForm::ContactFormControllerConcern
       form_new = current_site.contact_forms.new(name: "response-#{Time.now}", description: form.description, settings: new_settings, site_id: form.site_id, parent_id: form.id)
       if form_new.save
         fields_data = convert_form_values(form, fields)
-        message_body = form.the_settings[:railscf_mail][:body].to_s.translate.cama_replace_codes(fields)
-        content = render_to_string(partial: plugin_view('contact_form/email_content'), layout: false, formats: ['html'], locals: {file_attachments: attachments, fields: fields_data, values: fields, message_body: message_body, form: form})
-        cama_send_email(form.the_settings[:railscf_mail][:to], form.the_settings[:railscf_mail][:subject].to_s.translate.cama_replace_codes(fields), {attachments: attachments, content: content, extra_data: {fields: fields_data}})
+        message_body = form.mail_settings[:body].to_s.translate.cama_replace_codes(fields)
+        content = render_to_string(partial: plugin_view('contact_form/email_content'), layout: false, formats: [:html], locals: {file_attachments: attachments, fields: fields_data, values: fields, message_body: message_body, form: form})
+        cama_send_email(form.mail_settings[:to], form.mail_settings[:subject].to_s.translate.cama_replace_codes(fields), {attachments: attachments, content: content, extra_data: {fields: fields_data}})
         success << form.the_message('mail_sent_ok', t('.success_form_val', default: 'Your message has been sent successfully. Thank you very much!'))
         args = {form: form, values: fields}; hooks_run("contact_form_after_submit", args)
-        if form.the_settings[:railscf_mail][:to_answer].present? && (answer_to = fields[form.the_settings[:railscf_mail][:to_answer].gsub(/(\[|\])/, '').to_sym]).present?
-          content = form.the_settings[:railscf_mail][:body_answer].to_s.translate.cama_replace_codes(fields)
-          cama_send_email(answer_to, form.the_settings[:railscf_mail][:subject_answer].to_s.translate.cama_replace_codes(fields), {content: content})
+        if form.mail_settings[:to_answer].present? && (answer_to = fields[form.mail_settings[:to_answer].to_s.gsub(/(\[|\])/, '').to_sym]).present?
+          content = form.mail_settings[:body_answer].to_s.translate.cama_replace_codes(fields)
+          cama_send_email(answer_to, form.mail_settings[:subject_answer].to_s.translate.cama_replace_codes(fields), {content: content})
         end
       else
         errors << form.the_message('mail_sent_ng', t('.error_form_val', default: 'An error occurred, please try again.'))
@@ -41,9 +56,107 @@ module Plugins::CamaContactForm::ContactFormControllerConcern
     end
   end
 
+  # A visitor's submission is rejected, not escaped, for the same reason an untrusted author's is:
+  # what is stored and redisplayed then equals what was submitted, so rendering it verbatim adds
+  # nothing.
+  #
+  # Memoized because both the validation and the redisplay decision ask the same question about the
+  # same two objects in a single request, and the walk is over attacker-chosen structure.
+  def unsafe_submitted?(form, fields)
+    return @_cf_unsafe_submitted unless @_cf_unsafe_submitted.nil?
+
+    @_cf_unsafe_submitted = compute_unsafe_submitted?(form, fields)
+  end
+
+  # Fails closed on a missing form: there is nothing to judge the submission against, and the caller
+  # must not go on to stash it.
+  def compute_unsafe_submitted?(form, fields)
+    return true if form.blank?
+    return true unless fields.is_a?(Hash) || fields.is_a?(ActionController::Parameters)
+
+    form.fields.any? { |f| unsafe_submitted_field?(f, fields[f[:cid].to_sym]) }
+  end
+
+  # Two sinks, judged separately because they are different contexts:
+  #
+  #   The notification e-mail interpolates every submitted value into an author-written body and
+  #   renders the result with `raw`, so a value carrying active markup is refused whatever its type.
+  #   The test is deliberately narrow -- script, an event handler, a script URL -- and not a
+  #   sanitizer, which would reject ordinary prose: a visitor writing `Fish & Chips <today>` would be
+  #   told their message is not allowed, which is both wrong and infuriating.
+  #
+  #   The redisplayed form interpolates the value only for the types listed above, and only into a
+  #   double-quoted value attribute or into `<textarea>` content. A paragraph is RCDATA, where markup
+  #   is literal text and only the closing tag ends it, so quotes and angle brackets are ordinary
+  #   characters there.
+  def unsafe_submitted_field?(field, value)
+    return false if value.blank?
+    return true if submitted_leaves(value).any? { |leaf| active_markup?(leaf) }
+
+    type = field[:field_type].to_s
+    if ECHOED_TEXTAREA_FIELD_TYPES.include?(type)
+      echoed_value(value).downcase.include?('</textarea')
+    elsif ECHOED_ATTRIBUTE_FIELD_TYPES.include?(type)
+      echoed_value(value).include?('"')
+    else
+      false
+    end
+  end
+
+  # The exact string the renderer will emit. `values[cid]` is interpolated directly, so a non-String
+  # is judged by its `to_s` -- which is how an Array or a Hash supplies the double quote that closes
+  # the attribute without the payload needing one of its own. Judging the leaves instead of the whole
+  # missed that; judging `Array#to_s` for *every* type refused every checkbox and every file upload,
+  # because `Array#to_s` is `inspect` and always carries quotes.
+  def echoed_value(value)
+    value.is_a?(String) ? value : value.to_s
+  end
+
+  # An uploaded file is not redisplayed and has no string form worth inspecting; everything else is
+  # judged as the mail body will interpolate it.
+  def submitted_leaves(value)
+    case value
+    when ActionController::Parameters then submitted_leaves(value.to_unsafe_h)
+    when Hash then value.values.flat_map { |v| submitted_leaves(v) }
+    when Array then value.flat_map { |v| submitted_leaves(v) }
+    when ActionDispatch::Http::UploadedFile then []
+    else [value.to_s]
+    end
+  end
+
+  def active_markup?(string)
+    string = string.to_s
+    return false unless string.include?('<')
+
+    string.match?(ACTIVE_ELEMENT) || string.match?(EVENT_HANDLER_IN_TAG) || string.match?(URL_SCHEME_IN_TAG)
+  end
+
   # form validations
   def validate_to_save_form(form, fields, errors)
+    # Refuse outright and stop, before any other validation runs.
+    #
+    # Nothing is stored either way, so there is nothing to gain by continuing -- and continuing means
+    # running the rest of this method over input already known to be hostile, including a reCAPTCHA
+    # round-trip to an external service.
+    #
+    # The message names no field and quotes nothing back. The frontend flash partial renders with
+    # `raw`, so echoing the refused value there would make the refusal itself an injection sink --
+    # the same trap as the admin path.
+    if form.blank? || !(fields.is_a?(Hash) || fields.is_a?(ActionController::Parameters))
+      errors << t('.invalid_request_val', default: 'That form could not be submitted. Please try again.')
+      return false
+    end
+
+    if unsafe_submitted?(form, fields)
+      errors << form.the_message('invalid_content',
+                                 t('.invalid_content_val',
+                                   default: 'Your message contains characters that are not allowed. ' \
+                                            'Please remove any HTML or quotation marks and try again.'))
+      return false
+    end
+
     validate = true
+
     form.fields.each do |f|
       cid = f[:cid].to_sym
       label = f[:label].to_sym
@@ -53,8 +166,10 @@ module Plugins::CamaContactForm::ContactFormControllerConcern
             errors << "#{label.to_s.translate}: #{form.the_message('invalid_required', t('.error_validation_val', default: 'This value is required'))}"
             validate = false
           end
+          # `to_s` because the submitter chooses whether to send the key at all, and what shape to
+          # send it in: `nil.match` and `Hash#match` are both NoMethodError, on a public endpoint.
           if f[:field_type].to_s == 'email'
-            unless fields[cid].match(/@/)
+            unless fields[cid].to_s.match(/@/)
               errors << "#{label.to_s.translate}: #{form.the_message('invalid_email', t('.email_invalid_val', default: 'The e-mail address appears invalid'))}"
               validate = false
             end
@@ -86,10 +201,10 @@ module Plugins::CamaContactForm::ContactFormControllerConcern
       label = values.keys.include?(field[:label]) ? "#{field[:label]} (#{cid})" : field[:label].to_s.translate
       values[label] = []
       if ft == 'file'
-        nr_files = fields[cid].size
+        nr_files = Array(fields[cid]).size
         values[label] << "#{nr_files} #{"file".pluralize(nr_files)} (attached)" if fields[cid].present?
       elsif ft == 'radio' || ft == 'checkboxes'
-        values[label] << fields[cid].map { |f| f.to_s.translate }.join(', ') if fields[cid].present?
+        values[label] << Array(fields[cid]).map { |f| f.to_s.translate }.join(', ') if fields[cid].present?
       else
         values[label] << fields[cid] if fields[cid].present?
       end