camaleon_cms 2.9.0 → 2.9.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7bbfa67257bf8efd2830d5c4d20d1e00ce5db6293c145205326fc5c496a6ffd1
-  data.tar.gz: 848c0feddb8c6dbe3be7d992d1b116c9b438006cea66af150468576e8096eb9c
+  metadata.gz: 7fc3c9c70942e53b927d67366df21d19a549e0a349e8e87ca08f12977c3c5b08
+  data.tar.gz: d0b3948628d2c7c5d5efa55e6bc6c2ef1b90413d2a53764ac85ed281eceab630
 SHA512:
-  metadata.gz: 1ff798ffbe98e5906feed579e437f3da2b8636f99b2d22f508afbcc6981c70752ea464ac21af2457f73e94087fe4d88ee863ce3fadaca956d7570422710eebb3
-  data.tar.gz: 793bd8de6630499e71697966559066d74f38f1ccd225434fc2f4b101ce41fe1dbc62fbba94138bc57ca473a3abf9a9f48ecc820df1f0ec538b8ffed89b2268c4
+  metadata.gz: f6795ac94a6097bafa86c8336f209cb395f2b102db44da96d091ad55b5373bb6a1ed5af876f6facb72ba313d6fa803201d0605e2e55b0f699304dab2df470c6b
+  data.tar.gz: 6045503558fb4aa769b6d3bbd8dfac05357c9e6427134ed2670b3dc08aae94df7b865d69a80f6bdbe950492a439d79345b1f57b94808fbeb78f6acb5868ec90e

data/README.md

@@ -173,15 +173,22 @@ Owen Peredo Diaz
 https://camaleon.website/license.html
 
 ## Testing
-* Init DB
+> **Note:** Since this project is a gem, Rails commands (e.g., `rails routes`, `zeitwerk:check`) MUST be run from the `spec/dummy` folder. Use subshells to ensure you return to root: `(cd spec/dummy && bin/rails ...)`
+
+- Init DB
+
 ```bash
 RAILS_ENV=test bundle exec rake app:db:migrate
 RAILS_ENV=test bundle exec rake app:db:test:prepare
 ```
-* Run tests
-```bash
-bundle exec rspec
-```
+
+- Run the tests: `bin/rspec`
+  - If the `rspec` binstub is not present, generate it: `bundle binstubs rspec-core`
+    - And then still run `bin/rspec`
+
+## Permissions (Manager roles)
+
+See [docs/security/permissions.md](docs/security/permissions.md) for details on manager permissions, custom fields, and security considerations.
 
 ## Contributing
 * Fork it.

data/app/apps/plugins/front_cache/admin_controller.rb

@@ -2,6 +2,7 @@ module Plugins
   module FrontCache
     class AdminController < CamaleonCms::Apps::PluginsAdminController
       include Plugins::FrontCache::FrontCacheHelper
+
       def settings
         @caches = current_site.get_meta('front_cache_elements', { paths: [] })
         @caches[:paths] << '' unless @caches[:paths].present?

data/app/apps/plugins/front_cache/front_cache_helper.rb

@@ -1,14 +1,14 @@
 module Plugins
   module FrontCache
     module FrontCacheHelper
-      # save as cache all pages configured on settings of this plugin for public users
+      # cache all pages configured in this plugin's settings for public users
       def front_cache_front_before_load
         if current_site.get_option('refresh_cache') # clear cache every restart server unless option checked in settings
           front_cache_clean unless current_site.get_meta('front_cache_elements')[:preserve_cache_on_restart]
           current_site.set_option('refresh_cache', false)
         end
 
-        # avoid cache if current visitor is logged in or development
+        # avoid cache if the current visitor is logged in, or we're in the development or test environment
         return if signin? || Rails.env.development? || Rails.env.test? || !request.get?
 
         cache_key = front_cache_plugin_cache_key
@@ -45,9 +45,13 @@ module Plugins
         cache_key = front_cache_plugin_cache_key
         return unless @_plugin_do_cache && !flash.keys.present?
 
-        args = { data: response.body
-                               .gsub(/csrf-token" content="(.*?)"/, 'csrf-token" content="{{form_authenticity_token}}"')
-                               .gsub(/name="authenticity_token" value="(.*?)"/, 'name="authenticity_token" value="{{form_authenticity_token}}"') }
+        body =
+          response
+          .body.gsub(/csrf-token" content="(.*?)"/, 'csrf-token" content="{{form_authenticity_token}}"')
+          .gsub(
+            /name="authenticity_token" value="(.*?)"/, 'name="authenticity_token" value="{{form_authenticity_token}}"'
+          )
+        args = { data: body }
         hooks_run('front_cache_writing_cache', args)
         front_cache_plugin_cache_create(cache_key, args[:data])
         Rails.logger.info "Camaleon CMS - cache saved as: #{front_cache_plugin_get_path(cache_key)}"
@@ -57,22 +61,27 @@ module Plugins
       def front_cache_on_active(_plugin)
         return if current_site.get_meta('front_cache_elements', nil).present?
 
-        current_site.set_meta('front_cache_elements', { paths: [],
-                                                        posts: [],
-                                                        post_types: [current_site.post_types.where(slug: 'page').first.id],
-                                                        skip_posts: [],
-                                                        home: true,
-                                                        cache_login: true,
-                                                        cache_counter: 0 })
+        current_site.set_meta(
+          'front_cache_elements',
+          {
+            paths: [],
+            posts: [],
+            post_types: [current_site.post_types.where(slug: 'page').first.id],
+            skip_posts: [],
+            home: true,
+            cache_login: true,
+            cache_counter: 0
+          }
+        )
       end
 
       # on uninstall plugin
-      def front_cache_on_inactive(plugin)
+      def front_cache_on_inactive(_plugin)
         # current_site.delete_meta("front_cache_elements")
       end
 
       # cache actions (for logged users)
-      def front_cache_on_render(args); end
+      def front_cache_on_render(_args); end
 
       # expire cache for a page after comment registered or updated
       def front_cache_before_load; end

data/app/apps/plugins/visibility_post/visibility_post_helper.rb

@@ -57,7 +57,7 @@ module Plugins
                                  if ActiveRecord::Base.connection.adapter_name.downcase.include?('mysql')
                                    args[:active_record].where("visibility != 'private' or (visibility = 'private' and FIND_IN_SET(?, #{CamaleonCms::Post.table_name}.visibility_value))", current_site.visitor_role)
                                  else
-                                   args[:active_record].where("visibility != 'private' or (visibility = 'private' and (',' || #{CamaleonCms::Post.table_name}.visibility_value || ',') LIKE '%,#{current_site.visitor_role},%')")
+                                   args[:active_record].where("visibility != 'private' or (visibility = 'private' and (',' || #{CamaleonCms::Post.table_name}.visibility_value || ',') LIKE ?)", "%,#{current_site.visitor_role},%")
                                  end
                                else
                                  args[:active_record].where("visibility != 'private'")

data/app/apps/themes/default/views/category.html.erb

@@ -8,7 +8,7 @@
                 <% end %>
             </div>
             <%= content_tag("div", raw(ct('no_contents_found', default: 'No contents found')), class: "alert alert-warning") if @posts.empty? %>
-            <%= raw cama_do_pagination(@posts) %>
+            <%= cama_do_pagination(@posts) %>
         </div>
     </div>
 </article>

data/app/apps/themes/default/views/post_tag.html.erb

@@ -8,7 +8,7 @@
                 <% end %>
             </div>
             <%= content_tag("div", raw(ct('no_contents_found', default: 'No contents found')), class: "alert alert-warning") if @posts.empty? %>
-            <%= raw cama_do_pagination(@posts) %>
+            <%= cama_do_pagination(@posts) %>
         </div>
     </div>
 </article>

data/app/apps/themes/default/views/post_type.html.erb

@@ -24,7 +24,7 @@
                 <% end %>
             </div>
             <%= content_tag("div", raw(ct('no_contents_found', default: 'No contents found')), class: "alert alert-warning") if @posts.empty? %>
-            <%= raw cama_do_pagination(@posts) %>
+            <%= cama_do_pagination(@posts) %>
         </div>
     </div>
 

data/app/apps/themes/default/views/search.html.erb

@@ -11,7 +11,7 @@
                 <% end %>
             </div>
             <%= content_tag("div", raw(ct('no_contents_found', default: 'No contents found')), class: "alert alert-warning") if @posts.empty? %>
-            <%= raw cama_do_pagination(@posts) %>
+            <%= cama_do_pagination(@posts) %>
         </div>
     </div>
 </article>

data/app/apps/themes/new/views/category.html.erb

@@ -24,7 +24,7 @@
                 <% end %>
             </div>
             <%= content_tag("div", raw(ct('no_contents_found', default: 'No contents found')), class: "alert alert-warning") if @posts.empty? %>
-            <%= raw cama_do_pagination(@posts) %>
+            <%= cama_do_pagination(@posts) %>
         </div>
     </div>
 

data/app/apps/themes/new/views/post_tag.html.erb

@@ -15,7 +15,7 @@
                 <% end %>
             </div>
             <%= content_tag("div", raw(ct('no_contents_found', default: 'No contents found')), class: "alert alert-warning") if @posts.empty? %>
-            <%= raw cama_do_pagination(@posts) %>
+            <%= cama_do_pagination(@posts) %>
         </div>
     </div>
 

data/app/apps/themes/new/views/post_type.html.erb

@@ -24,7 +24,7 @@
                 <% end %>
             </div>
             <%= content_tag("div", raw(ct('no_contents_found', default: 'No contents found')), class: "alert alert-warning") if @posts.empty? %>
-            <%= raw cama_do_pagination(@posts) %>
+            <%= cama_do_pagination(@posts) %>
         </div>
     </div>
 

data/app/apps/themes/new/views/search.html.erb

@@ -12,7 +12,7 @@
                 <% end %>
             </div>
             <%= content_tag("div", raw(ct('no_contents_found', default: 'No contents found')), class: "alert alert-warning") if @posts.empty? %>
-            <%= raw cama_do_pagination(@posts) %>
+            <%= cama_do_pagination(@posts) %>
         </div>
     </div>
 </article>

data/app/controllers/camaleon_cms/admin/appearances/nav_menus_controller.rb

@@ -2,6 +2,7 @@ module CamaleonCms
   module Admin
     module Appearances
       class NavMenusController < CamaleonCms::AdminController
+        include CamaleonCms::Admin::CustomFieldsConcern
         include CamaleonCms::Frontend::NavMenuHelper
 
         add_breadcrumb I18n.t('camaleon_cms.admin.sidebar.appearance')
@@ -27,7 +28,7 @@ module CamaleonCms
         end
 
         def create
-          nav_menu = current_site.nav_menus.new(params.require(:nav_menu).permit!)
+          nav_menu = current_site.nav_menus.new(nav_menu_params)
           nav_menu.save
           flash[:notice] = t('.created_menu', default: 'Created Menu')
           redirect_to action: :index, id: nav_menu.id
@@ -35,7 +36,7 @@ module CamaleonCms
 
         def update
           nav_menu = current_site.nav_menus.find(params[:id])
-          nav_menu.update(params.require(:nav_menu).permit!)
+          nav_menu.update(nav_menu_params)
           flash[:notice] = t('.updated_menu', default: 'Menu updated')
           redirect_to action: :index, id: nav_menu.id
         end
@@ -59,7 +60,7 @@ module CamaleonCms
 
         def save_custom_settings
           @nav_menu_item = current_site.nav_menu_items.find(params[:id])
-          @nav_menu_item.set_field_values(params.require(:field_options).permit!)
+          @nav_menu_item.set_field_values(cama_permitted_field_options('NavMenuItem'))
           head :ok
         end
 
@@ -77,7 +78,7 @@ module CamaleonCms
           @nav_menu = current_site.nav_menus.find(params[:nav_menu_id])
           item = current_site.nav_menu_items.find(params[:id])
           item.update_menu_item(parse_external_menu(params))
-          item.set_options(params.require(:options).permit!) if params[:options].present?
+          item.set_options(permitted_external_options) if params[:options].present?
           render partial: 'menu_items', locals: { items: [item], nav_menu: @nav_menu }
         end
 
@@ -106,7 +107,7 @@ module CamaleonCms
           external_params = params[:external]
           if external_params.present?
             external_item = @nav_menu.append_menu_item(parse_external_menu(external_params))
-            external_item.set_options(external_params.require(:options).permit!) if external_params[:options].present?
+            external_item.set_options(permitted_external_options(external_params)) if external_params[:options].present?
             items << external_item
           end
 
@@ -136,6 +137,22 @@ module CamaleonCms
         def parse_external_menu(_params)
           { label: _params[:external_label], link: _params[:external_url], type: 'external', target: _params[:target] }
         end
+
+        # Strong parameters for nav_menu
+        def nav_menu_params
+          params.require(:nav_menu).permit(:name, :slug)
+        end
+
+        # Only permit external menu options that match registered custom field slug
+        def permitted_external_options(external_params = nil)
+          opts = external_params ? external_params[:options] : params[:options]
+          return {} unless opts.present?
+
+          allowed_keys = cama_custom_field_allowed_slugs('NavMenuItem')
+          return {} if allowed_keys.blank?
+
+          opts.permit(*allowed_keys).to_h
+        end
       end
     end
   end

data/app/controllers/camaleon_cms/admin/appearances/widgets/assign_controller.rb

@@ -3,6 +3,8 @@ module CamaleonCms
     module Appearances
       module Widgets
         class AssignController < CamaleonCms::AdminController
+          include CamaleonCms::Admin::CustomFieldsConcern
+
           before_action :check_permission_role
           before_action :find_sidebar
           before_action :find_assigned_sidebar, only: %i[update destroy]
@@ -15,8 +17,8 @@ module CamaleonCms
           end
 
           def update
-            if @assigned.update(params.require(:assign).permit!)
-              @assigned.set_field_values(params[:field_options])
+            if @assigned.update(params.require(:assign).permit(:title, :content, :widget_id, :sidebar_id, :item_order))
+              @assigned.set_field_values(cama_permitted_field_options('Widget::Main'))
               flash[:notice] = t('camaleon_cms.admin.widgets.assign.updated')
             else
               flash[:error] = t('camaleon_cms.admin.widgets.assign.error_updated')

data/app/controllers/camaleon_cms/admin/appearances/widgets/main_controller.rb

@@ -22,8 +22,8 @@ module CamaleonCms
           end
 
           def create
-            params[:widget_main][:status] = 'simple'
-            @widget = current_site.widgets.new(params.require(:widget_main).permit!)
+            @widget = current_site.widgets.new(params.require(:widget_main).permit(:name, :slug, :description, :excerpt, :renderer))
+            @widget.status = 'simple'
             if @widget.save!
               flash[:notice] = t('camaleon_cms.admin.widgets.message.created')
             else
@@ -33,7 +33,7 @@ module CamaleonCms
           end
 
           def update
-            if @widget.update!(params.require(:widget_main).permit!)
+            if @widget.update!(params.require(:widget_main).permit(:name, :slug, :description, :excerpt, :renderer))
               flash[:notice] = t('camaleon_cms.admin.widgets.message.updated')
             else
               flash[:error] = t('camaleon_cms.admin.widgets.message.error_updated')

data/app/controllers/camaleon_cms/admin/appearances/widgets/sidebar_controller.rb

@@ -12,7 +12,7 @@ module CamaleonCms
           end
 
           def create
-            @sidebar = current_site.sidebars.new(params.require(:widget_sidebar).permit!)
+            @sidebar = current_site.sidebars.new(params.require(:widget_sidebar).permit(:name, :slug, :description))
             if @sidebar.save
               flash[:notice] = t('camaleon_cms.admin.widgets.sidebar.created')
             else
@@ -26,7 +26,7 @@ module CamaleonCms
           end
 
           def update
-            if @sidebar.update(params.require(:widget_sidebar).permit!)
+            if @sidebar.update(params.require(:widget_sidebar).permit(:name, :slug, :description))
               flash[:notice] = t('camaleon_cms.admin.widgets.sidebar.updated')
             else
               flash[:error] = t('camaleon_cms.admin.widgets.sidebar.error_updated')

data/app/controllers/camaleon_cms/admin/categories_controller.rb

@@ -1,7 +1,10 @@
 module CamaleonCms
   module Admin
     class CategoriesController < CamaleonCms::AdminController
+      include CamaleonCms::Admin::CustomFieldsConcern
+
       add_breadcrumb I18n.t('camaleon_cms.admin.sidebar.contents')
+
       before_action :set_post_type
       before_action :set_category, only: %w[show edit update destroy]
 
@@ -20,9 +23,9 @@ module CamaleonCms
       def update
         hooks_run('update_category', { category: @category, post_type: @post_type })
 
-        if @category.update(params.require(:category).permit!)
+        if @category.update(params.require(:category).permit(:name, :slug, :description, :parent_id))
           @category.set_options(params[:meta])
-          @category.set_field_values(params[:field_options])
+          @category.set_field_values(cama_permitted_field_options('PostType_Category'))
           hooks_run('updated_category', { category: @category, post_type: @post_type })
           flash[:notice] = t('camaleon_cms.admin.post_type.message.updated')
           redirect_to action: :index
@@ -32,12 +35,12 @@ module CamaleonCms
       end
 
       def create
-        @category = @post_type.categories.new(params.require(:category).permit!)
+        @category = @post_type.categories.new(params.require(:category).permit(:name, :slug, :description, :parent_id))
         hooks_run('create_category', { category: @category, post_type: @post_type })
 
         if @category.save
           @category.set_options(params[:meta])
-          @category.set_field_values(params[:field_options])
+          @category.set_field_values(cama_permitted_field_options('PostType_Category'))
           hooks_run('created_category', { category: @category, post_type: @post_type })
           flash[:notice] = t('camaleon_cms.admin.post_type.message.created')
           redirect_to action: :index
@@ -73,7 +76,8 @@ module CamaleonCms
       end
 
       def set_category
-        @category = CamaleonCms::Category.find_by_id(params[:id])
+        @category = @post_type.categories.find_by_id(params[:id])
+        render_404 unless @category
       rescue StandardError
         flash[:error] = t('camaleon_cms.admin.post_type.message.error')
         redirect_to cama_admin_path

data/app/controllers/camaleon_cms/admin/media_controller.rb

@@ -5,10 +5,10 @@ module CamaleonCms
       skip_before_action :admin_logged_actions, except: %i[index download_private_file], raise: false
       skip_before_action :verify_authenticity_token, only: :upload, raise: false
       before_action :init_media_vars, except: :download_private_file
+      before_action :verify_media_authorization
 
       # render media section
       def index
-        authorize! :manage, :media
         @show_file_actions = true
         @files = @tree.paginate(page: params[:page], per_page: 100)
         @next_page = @files.current_page < @files.total_pages ? @files.current_page + 1 : nil
@@ -28,11 +28,14 @@ module CamaleonCms
       def download_private_file
         cama_uploader.enable_private_mode!
 
-        file = cama_uploader.fetch_file("private/#{params[:file]}")
+        sanitize_private_filename!
+        return render(plain: 'Invalid file', status: :forbidden) unless @private_file_path
+
+        fetched = cama_uploader.fetch_file(@private_file_path)
 
-        return render plain: helpers.sanitize(file[:error]) if file.is_a?(Hash) && file[:error].present?
+        return render plain: helpers.sanitize(fetched[:error]) if fetched.is_a?(Hash) && fetched[:error].present?
 
-        send_file file, disposition: 'inline'
+        send_file fetched, disposition: 'inline'
       end
 
       # render media for modal content
@@ -51,7 +54,6 @@ module CamaleonCms
 
       # do background actions in fog
       def actions
-        authorize! :manage, :media if params[:media_action] != 'crop_url'
         params[:folder] = params[:folder].gsub('//', '/') if params[:folder].present?
 
         case params[:media_action]
@@ -105,6 +107,17 @@ module CamaleonCms
 
       private
 
+      def verify_media_authorization
+        authorize! :manage, :media
+      end
+
+      # Sanitizes the private file parameter to prevent path traversal.
+      # Sets @private_file_path if valid, nil otherwise.
+      def sanitize_private_filename!
+        name = File.basename(params[:file].to_s)
+        @private_file_path = ("private/#{name}" if name.present? && name == params[:file].to_s)
+      end
+
       # init basic media variables
       def init_media_vars
         # @cama_uploader = CamaleonCmsLocalUploader.new({current_site: current_site, private: true})

data/app/controllers/camaleon_cms/admin/post_tags_controller.rb

@@ -1,7 +1,10 @@
 module CamaleonCms
   module Admin
     class PostTagsController < CamaleonCms::AdminController
+      include CamaleonCms::Admin::CustomFieldsConcern
+
       add_breadcrumb I18n.t('camaleon_cms.admin.sidebar.contents')
+
       before_action :set_post_type
       before_action :set_post_tag, only: %w[show edit update destroy]
 
@@ -27,9 +30,9 @@ module CamaleonCms
       def update
         args = { post_tag: @post_tag, post_type: @post_type }
         hooks_run('before_update_post_tag', args)
-        if @post_tag.update(params.require(:post_tag).permit!)
+        if @post_tag.update(params.require(:post_tag).permit(:name, :slug, :description, :parent_id))
           @post_tag.set_options(params[:meta]) if params[:meta].present?
-          @post_tag.set_field_values(params[:field_options])
+          @post_tag.set_field_values(cama_permitted_field_options('PostType_PostTag'))
           hooks_run('after_update_post_tag', args)
           flash[:notice] = t('camaleon_cms.admin.post_type.message.updated')
           redirect_to action: :index
@@ -40,12 +43,12 @@ module CamaleonCms
 
       # render post tag create form
       def create
-        @post_tag = @post_type.post_tags.new(params.require(:post_tag).permit!)
+        @post_tag = @post_type.post_tags.new(params.require(:post_tag).permit(:name, :slug, :description, :parent_id))
         args = { post_tag: @post_tag, post_type: @post_type }
         hooks_run('before_create_post_tag', args)
         if @post_tag.save
           @post_tag.set_options(params[:meta]) if params[:meta].present?
-          @post_tag.set_field_values(params[:field_options])
+          @post_tag.set_field_values(cama_permitted_field_options('PostType_PostTag'))
           hooks_run('after_create_post_tag', args)
           flash[:notice] = t('camaleon_cms.admin.post_type.message.created')
           redirect_to action: :index

data/app/controllers/camaleon_cms/admin/posts/drafts_controller.rb

@@ -52,7 +52,7 @@ module CamaleonCms
         private
 
         def set_post_data_params
-          post_data = params.require(:post).permit!
+          post_data = params.require(:post).permit(:title, :slug, :content, :excerpt, :status, :comment_status, :post_parent, :visibility, :visibility_value, :post_order, :published_at).to_h
           post_data.delete(:created_at) unless params[:post][:created_at].present?
           post_data.delete(:updated_at) unless params[:post][:updated_at].present?
           post_data[:status] = 'draft_child'

data/app/controllers/camaleon_cms/admin/posts_controller.rb

@@ -1,7 +1,10 @@
 module CamaleonCms
   module Admin
     class PostsController < CamaleonCms::AdminController
+      include CamaleonCms::Admin::CustomFieldsConcern
+
       add_breadcrumb I18n.t('camaleon_cms.admin.sidebar.contents')
+
       before_action :set_post_type, except: [:ajax]
       before_action :set_post, only: %w[show edit update destroy]
       skip_before_action :admin_logged_actions, only: %i[trash restore destroy ajax], raise: false
@@ -56,7 +59,7 @@ module CamaleonCms
         r = { posts: @posts, post_type: @post_type, btns: @btns, all_posts: posts_all, render: 'index',
               per_page: per_page }
         hooks_run('list_post', r)
-        add_breadcrumb (@btns[params[:s].to_sym]).to_s if params[:s].present?
+        add_breadcrumb(@btns[params[:s].to_sym].to_s) if params[:s].present?
         @posts = r[:posts].paginate(page: params[:page], per_page: r[:per_page])
         render r[:render]
       end
@@ -87,7 +90,7 @@ module CamaleonCms
         @post = r[:post]
         if @post.save
           @post.set_metas(params[:meta])
-          @post.set_field_values(params[:field_options])
+          @post.set_field_values(cama_permitted_field_options('PostType_Post'))
           @post.set_options(params[:options])
           flash[:notice] = t('camaleon_cms.admin.post.message.created', post_type: @post_type.decorate.the_title)
           r = { post: @post, post_type: @post_type }
@@ -129,7 +132,7 @@ module CamaleonCms
           # delete drafts only on successful update operation
           @post.drafts.destroy_all if delete_drafts
           @post.set_metas(params[:meta])
-          @post.set_field_values(params[:field_options])
+          @post.set_field_values(cama_permitted_field_options('PostType_Post'))
           @post.set_options(params[:options])
           hooks_run('updated_post', { post: @post, post_type: @post_type })
           flash[:notice] = t('camaleon_cms.admin.post.message.updated', post_type: @post_type.decorate.the_title)
@@ -213,7 +216,7 @@ module CamaleonCms
       # return common params data for posts
       # is_create: indicate if this info is for create a new post
       def get_post_data(is_create = false)
-        post_data = params.require(:post).permit!
+        post_data = params.require(:post).permit(:title, :slug, :content, :excerpt, :status, :comment_status, :post_parent, :visibility, :visibility_value, :post_order, :published_at).to_h
         post_data[:user_id] = cama_current_user.id if is_create
         post_data[:status] = 'pending' if post_data[:status] == 'published' && cannot?(:publish_post, @post_type)
         post_data[:data_tags] = params[:tags].to_s

data/app/controllers/camaleon_cms/admin/sessions_controller.rb

@@ -113,7 +113,7 @@ module CamaleonCms
           params[:user][:role] = PluginRoutes.system_info['default_user_role']
           params[:user][:is_valid_email] = false if current_site.need_validate_email?
           user_data = user_permit_data
-          result = cama_register_user(user_data, params[:meta])
+          result = cama_register_user(user_data, nil)
           if result[:result] == false && result[:type] == :captcha_error
             @user.errors.add(:captcha, t('camaleon_cms.admin.users.message.error_captcha'))
             render 'register'
@@ -171,7 +171,7 @@ module CamaleonCms
       end
 
       def user_permit_data
-        params.require(:user).permit!
+        params.require(:user).permit(:first_name, :last_name, :email, :username, :password, :password_confirmation, :is_valid_email)
       end
     end
   end

data/app/controllers/camaleon_cms/admin/settings/custom_fields_controller.rb

@@ -3,6 +3,8 @@ module CamaleonCms
     module Settings
       class CustomFieldsController < CamaleonCms::Admin::SettingsController
         add_breadcrumb I18n.t('camaleon_cms.admin.sidebar.custom_fields'), :cama_admin_settings_custom_fields_path
+
+        before_action :validate_role, only: %i[create update destroy]
         before_action :set_custom_field_group, only: %i[show edit update destroy]
         before_action :set_post_data, only: %i[create update]
 
@@ -66,15 +68,15 @@ module CamaleonCms
         end
 
         def list
-          p = params.permit(:post_type, :post_id, categories: [])
-          args = {}
-          if p[:post_id].present?
-            post = @current_site.the_post(p[:post_id].to_i)
-            post.update_categories(p[:categories])
+          p = params.permit(:post_type, :post_id)
+          cat_ids = current_site.full_categories.where(id: params[:categories]).pluck(:id)
+          if p[:post_id].present? && (post = current_site.the_post(p[:post_id].to_i)).present?
+            post.update_categories(cat_ids)
+            args = {}
           else
             post = CamaleonCms::Post.new
-            post.taxonomy_id = p[:post_type].to_i
-            args[:cat_ids] = p[:categories]
+            post.taxonomy_id = current_site.the_post_type(p[:post_type].to_i)&.id
+            args = { cat_ids: cat_ids }
           end
           render partial: 'camaleon_cms/admin/settings/custom_fields/render',
                  locals: { record: post, field_groups: post.get_field_groups(args),
@@ -84,11 +86,15 @@ module CamaleonCms
         private
 
         def set_post_data
-          @post_data = params.require(:custom_field_group).permit!
-          @post_data[:object_class], @post_data[:objectid] = @post_data.delete(:assign_group).split(',')
+          @post_data = params.require(:custom_field_group).permit(:name, :description, :assign_group, :caption)
+          @post_data[:object_class], @post_data[:objectid] = @post_data.delete(:assign_group).to_s.split(',')
           @caption = @post_data.delete(:caption)
         end
 
+        def validate_role
+          authorize! :manage, :custom_fields
+        end
+
         def set_custom_field_group
           @field_group = current_site.custom_field_groups.find(params[:id])
         rescue StandardError
@@ -96,10 +102,26 @@ module CamaleonCms
           redirect_to cama_admin_path
         end
 
+        def permitted_fields
+          return {} unless params[:fields].present?
+
+          params.require(:fields).permit(params[:fields].keys.index_with do
+            %i[id name slug description field_order]
+          end).to_h
+        end
+
+        def permitted_field_options
+          return {} unless params[:field_options].present?
+
+          params.require(:field_options).permit(params[:field_options].keys.index_with do
+            [:field_key, :multiple, :required, :translate, :default_value, :dimension, :width, :height, :class, :placeholder,
+             { default_values: [], multiple_options: %i[title value default] }]
+          end).to_h
+        end
+
         # return boolean: true if all fields were saved successfully
         def _save_fields(group)
-          errors_saved, _all_fields = group.add_fields(params[:fields] ? params.require(:fields).permit! : {},
-                                                       params[:field_options] ? params.require(:field_options).permit! : {})
+          errors_saved, _all_fields = group.add_fields(permitted_fields, permitted_field_options)
           group.set_option('caption', @caption)
           if errors_saved.present?
             flash[:error] = "<b>#{t('camaleon_cms.errors_found_msg', default: 'Several errors were found, please check.')}</b><br>#{errors_saved.map do |field|