camaleon_cms 2.9.0 → 2.9.2

data/app/models/camaleon_cms/custom_field_group.rb

@@ -30,7 +30,16 @@ module CamaleonCms
     # ****** check all options for each case in Admin::CustomFieldsHelper ****
     # SAMPLE: my_model.add_field({"name"=>"Sub Title", "slug"=>"subtitle"}, {"field_key"=>"text_box",
     #   "translate"=>true, default_value: "Get in Touch"})
+    # Adds a manual field to the group (used by admin UI)
+    # item: field attributes
+    # options: field options
     def add_manual_field(item, options)
+      # Prevent creation of dangerous field types (select_eval) unless the actor is allowed.
+      if options[:field_key] == 'select_eval'
+        can?(:manage, :select_eval) ||
+          raise(CanCan::AccessDenied, 'Not authorized to create select_eval fields')
+      end
+
       c = get_field(item[:slug] || item['slug'])
       return c if c.present?
 
@@ -50,6 +59,8 @@ module CamaleonCms
 
     # only used by form on admin panel (protected)
     # return array of failed_fields and full_fields [[failed fields], [all fields]]
+    # items: hash of field items
+    # item_options: hash of options for each item
     def add_fields(items, item_options)
       fields.where.not(id: items.to_h.map { |_k, obj| obj['id'] }.uniq).destroy_all
       cache_fields = []
@@ -57,12 +68,38 @@ module CamaleonCms
       errors_saved = []
       if items.present?
         items.each do |i, item|
+          # allow string or symbol keys for incoming params
+          id_val = item['id'] || item[:id]
+
           item[:field_order] = order_index
           options = item_options[i] || {}
-          if item[:id].present? && (field_item = fields.find_by(id: item[:id])).present?
+          if id_val.present? && (field_item = fields.find_by(id: id_val)).present?
+            # If this is an existing select_eval field (or the incoming data would
+            # make it a select_eval) ensure the current actor has explicit
+            # permission. For updates we preserve the form-like behavior by
+            # collecting an error-like non-persisted field in errors_saved and
+            # skipping the update when unauthorized.
+            existing_key = (field_item.options || {})[:field_key].to_s
+            # consider field_key coming from the per-item options (options) or the item itself
+            incoming_key = (options[:field_key] || item[:field_key]).to_s
+            if (existing_key == 'select_eval' || incoming_key == 'select_eval') && !can?(:manage, :select_eval)
+              field_item.errors.add(:base, 'Not authorized to modify select_eval field')
+              errors_saved << field_item
+              next
+            end
+
             saved = field_item.update(item)
             cache_fields << field_item
           else
+            # Check if the incoming options request creation of select_eval
+            incoming_key = (options[:field_key] || item[:field_key]).to_s
+            if incoming_key == 'select_eval' && !can?(:manage, :select_eval)
+              # Add an error-like non-persisted field to errors_saved to preserve behavior
+              field_item = fields.new(item)
+              field_item.errors.add(:base, 'Not authorized to create select_eval field')
+              errors_saved << field_item
+              next
+            end
             field_item = fields.new(item)
             cache_fields << field_item
             saved = field_item.save

data/app/models/camaleon_cms/custom_fields_relationship.rb

@@ -7,7 +7,7 @@ module CamaleonCms
     default_scope { order("#{CamaleonCms::CustomFieldsRelationship.table_name}.term_order ASC") }
 
     # relations
-    belongs_to :custom_field, required: false
+    belongs_to :custom_field, class_name: 'CamaleonCms::CustomField', required: false
 
     # validates :objectid, :custom_field_id, presence: true
     validates :custom_field_id, presence: true # error on clone model

data/app/models/camaleon_cms/meta.rb

@@ -2,5 +2,9 @@ module CamaleonCms
   class Meta < CamaleonRecord
     self.table_name = "#{PluginRoutes.static_system_info['db_prefix']}metas"
     # attr_accessible :objectid, :key, :value, :object_class
+
+    extend CamaleonCms::NormalizeAttrs
+
+    normalize_attrs(:value)
   end
 end

data/app/models/camaleon_cms/nav_menu.rb

@@ -1,5 +1,7 @@
 module CamaleonCms
   class NavMenu < CamaleonCms::TermTaxonomy
+    normalize_attrs(:name, :description)
+
     default_scope { where(taxonomy: :nav_menu).order(id: :asc) }
     alias_attribute :site_id, :parent_id
 

data/app/models/camaleon_cms/nav_menu_item.rb

@@ -1,5 +1,7 @@
 module CamaleonCms
   class NavMenuItem < CamaleonCms::TermTaxonomy
+    normalize_attrs(:name, :description)
+
     alias_attribute :site_id, :term_group
     alias_attribute :label, :name
     alias_attribute :url, :description

data/app/models/camaleon_cms/plugin.rb

@@ -1,5 +1,7 @@
 module CamaleonCms
   class Plugin < CamaleonCms::TermTaxonomy
+    normalize_attrs(:name, :description)
+
     # attrs:
     #   term_group => status active (1, nil)
     #   slug => plugin key

data/app/models/camaleon_cms/post.rb

@@ -83,7 +83,7 @@ module CamaleonCms
 
     # check if this is in draft status
     def draft?
-      status == 'draft' || status == 'draft_child'
+      %w[draft draft_child].include?(status)
     end
 
     def draft_child?

data/app/models/camaleon_cms/post_comment.rb

@@ -3,6 +3,8 @@ module CamaleonCms
     include CamaleonCms::Metas
     include CamaleonCms::CommonRelationships
 
+    extend CamaleonCms::NormalizeAttrs
+
     self.table_name = "#{PluginRoutes.static_system_info['db_prefix']}comments"
     # attr_accessible :user_id, :post_id, :content, :author, :author_email, :author_url, :author_IP, :approved, :agent, :agent, :typee, :comment_parent, :is_anonymous
     attr_accessor :is_anonymous
@@ -21,6 +23,8 @@ module CamaleonCms
     scope :comment_parent, -> { where(comment_parent: 'is not null') }
     scope :approveds, -> { where(approved: 'approved') }
 
+    normalize_attrs(:content)
+
     validates :content, presence: true
     validates_presence_of :author, :author_email, if: proc { |c| c.is_anonymous.present? }
     after_create :update_counter

data/app/models/camaleon_cms/post_tag.rb

@@ -1,5 +1,7 @@
 module CamaleonCms
   class PostTag < CamaleonCms::TermTaxonomy
+    normalize_attrs(:name, :description)
+
     default_scope { where(taxonomy: :post_tag) }
 
     has_many :posts, foreign_key: :objectid, through: :term_relationships, source: :object

data/app/models/camaleon_cms/post_type.rb

@@ -1,5 +1,7 @@
 module CamaleonCms
   class PostType < CamaleonCms::TermTaxonomy
+    normalize_attrs(:name, :description)
+
     alias_attribute :site_id, :parent_id
     default_scope { where(taxonomy: :post_type) }
 
@@ -179,7 +181,7 @@ module CamaleonCms
 
     # destroy all custom field groups assigned to this post type
     def destroy_field_groups
-      if !destroyed_by_association.present? && (slug == 'post' || slug == 'page')
+      if !destroyed_by_association.present? && %w[post page].include?(slug)
         errors.add(:base, 'This post type can not be deleted.')
         return false
       end

data/app/models/camaleon_cms/site.rb

@@ -1,5 +1,7 @@
 module CamaleonCms
   class Site < CamaleonCms::TermTaxonomy
+    normalize_attrs(:name, :description)
+
     include CamaleonCms::SiteDefaultSettings
 
     # attrs: [name, description, slug]

data/app/models/camaleon_cms/term_taxonomy.rb

@@ -3,11 +3,7 @@ module CamaleonCms
     include CamaleonCms::Metas
     include CamaleonCms::CustomFieldsRead
 
-    TRANSLATION_TAG_HIDE_MAP = { '<!--' => '!--', '-->' => '--!' }.freeze
-    TRANSLATION_TAG_HIDE_REGEX = Regexp.new(TRANSLATION_TAG_HIDE_MAP.keys.map { |x| Regexp.escape(x) }.join('|')).freeze
-    TRANSLATION_TAG_RESTORE_MAP = { '--!' => '-->', '!--' => '<!--' }.freeze
-    TRANSLATION_TAG_RESTORE_REGEX =
-      Regexp.new(TRANSLATION_TAG_RESTORE_MAP.keys.map { |x| Regexp.escape(x) }.join('|')).freeze
+    extend CamaleonCms::NormalizeAttrs
 
     def self.inherited(subclass)
       super
@@ -22,24 +18,6 @@ module CamaleonCms
     # attr_accessible :data_options
     # attr_accessible :data_metas
 
-    # TODO: Remove the 1st branch when support will be dropped of Rails < 7.1
-    if ::Rails::VERSION::STRING < '7.1.0'
-      before_validation(on: %i[create update]) do
-        %i[name description].each do |attr|
-          next unless new_record? || attribute_changed?(attr)
-
-          self[attr] = ActionController::Base.helpers.sanitize(
-            __send__(attr)&.gsub(TRANSLATION_TAG_HIDE_REGEX, TRANSLATION_TAG_HIDE_MAP)
-          )&.gsub(TRANSLATION_TAG_RESTORE_REGEX, TRANSLATION_TAG_RESTORE_MAP)
-        end
-      end
-    else
-      normalizes :name, :description, with: lambda { |field|
-        ActionController::Base.helpers.sanitize(field.gsub(TRANSLATION_TAG_HIDE_REGEX, TRANSLATION_TAG_HIDE_MAP))
-                              .gsub(TRANSLATION_TAG_RESTORE_REGEX, TRANSLATION_TAG_RESTORE_MAP)
-      }
-    end
-
     # callbacks
     before_validation :before_validating
     before_destroy :destroy_dependencies

data/app/models/camaleon_cms/theme.rb

@@ -1,5 +1,7 @@
 module CamaleonCms
   class Theme < CamaleonCms::TermTaxonomy
+    normalize_attrs(:name, :description)
+
     # attrs:
     #   slug => plugin key
     belongs_to :site, class_name: 'CamaleonCms::Site', foreign_key: :parent_id, required: false

data/app/models/camaleon_cms/user_role.rb

@@ -1,5 +1,7 @@
 module CamaleonCms
   class UserRole < CamaleonCms::TermTaxonomy
+    normalize_attrs(:name, :description)
+
     after_destroy :set_users_as_cilent
 
     default_scope { where(taxonomy: :user_roles) }
@@ -122,6 +124,17 @@ module CamaleonCms
           label: I18n.t('camaleon_cms.admin.sidebar.settings').to_s,
           description: I18n.t('camaleon_cms.admin.users.tool_tip.settings').to_s
         },
+        {
+          key: 'custom_fields',
+          label: I18n.t('camaleon_cms.admin.sidebar.custom_fields', default: 'Custom Fields').to_s,
+          description: I18n.t('camaleon_cms.admin.users.tool_tip.custom_fields',
+                              default: 'Manage custom field groups and fields, including the select_eval type.').to_s
+        },
+        {
+          key: 'select_eval',
+          label: I18n.t('camaleon_cms.admin.custom_field.select_eval', default: 'Select Eval').to_s,
+          description: I18n.t('camaleon_cms.admin.users.tool_tip.select_eval', default: 'Allow toggling and using select_eval custom fields in the admin UI.').to_s
+        },
         {
           key: 'theme_settings',
           label: I18n.t('camaleon_cms.admin.settings.theme_setting', default: 'Theme Settings').to_s,

data/app/models/camaleon_cms/widget/main.rb

@@ -1,6 +1,8 @@
 module CamaleonCms
   module Widget
     class Main < CamaleonCms::TermTaxonomy
+      normalize_attrs(:name)
+
       default_scope { where(taxonomy: :widget) }
       # attr_accessible :excerpt, :renderer
       # name: "title"

data/app/models/camaleon_cms/widget/sidebar.rb

@@ -1,6 +1,8 @@
 module CamaleonCms
   module Widget
     class Sidebar < CamaleonCms::TermTaxonomy
+      normalize_attrs(:name, :description)
+
       default_scope { where(taxonomy: :sidebar) }
 
       has_many :metas, lambda {

data/app/models/camaleon_record.rb

@@ -1,6 +1,12 @@
 # frozen_string_literal: true
 
 class CamaleonRecord < ActiveRecord::Base
+  TRANSLATION_TAG_HIDE_MAP = { '<!--' => '!--', '-->' => '--!' }.freeze
+  TRANSLATION_TAG_HIDE_REGEX = Regexp.new(TRANSLATION_TAG_HIDE_MAP.keys.map { |x| Regexp.escape(x) }.join('|')).freeze
+  TRANSLATION_TAG_RESTORE_MAP = { '--!' => '-->', '!--' => '<!--' }.freeze
+  TRANSLATION_TAG_RESTORE_REGEX =
+    Regexp.new(TRANSLATION_TAG_RESTORE_MAP.keys.map { |x| Regexp.escape(x) }.join('|')).freeze
+
   include ActiveRecordExtras::Relation
 
   self.abstract_class = true
@@ -43,4 +49,38 @@ class CamaleonRecord < ActiveRecord::Base
   def cama_build_cache_key(key)
     _key = "cama_cache_#{self.class.name}_#{id}_#{key}"
   end
+
+  # Return the current user for this thread/request context.
+  # Uses ActiveSupport::CurrentAttributes (CurrentRequest.user)
+  def current_user
+    return @current_user if defined?(@current_user)
+
+    @current_user = CurrentRequest.user
+  end
+
+  # Authorization helpers that delegate to central Ability (CanCan)
+  def can?(*args)
+    # Return false if no user or site context (e.g., background jobs, console)
+    return false if current_user.nil? || current_site.nil?
+
+    ability.can?(*args)
+  end
+
+  def ability
+    # Memoize Ability per request to avoid repeated DB queries and object instantiation.
+    # In tests that modify role meta mid-request, call reset_ability to invalidate cache.
+    @ability ||= CamaleonCms::Ability.new(current_user, current_site)
+  end
+
+  # Reset cached ability instance (useful in tests when role meta changes)
+  def reset_ability
+    @ability = nil
+  end
+
+  # current_site memoized from the CurrentRequest.site
+  def current_site
+    return @current_site if defined?(@current_site) && @current_site.present?
+
+    @current_site = CurrentRequest.site
+  end
 end

data/app/models/concerns/camaleon_cms/custom_fields_read.rb

@@ -95,9 +95,7 @@ module CamaleonCms
           f.custom_field_slug == _key && f.group_number == group_number
         end.map(&:value)
       else
-        custom_field_values.where(
-          custom_field_slug: _key, group_number: group_number
-        ).pluck(:value)
+        custom_field_values.where(custom_field_slug: _key, group_number: group_number).pluck(:value)
       end
     end
     alias get_fields get_field_values
@@ -137,7 +135,7 @@ module CamaleonCms
     def get_field_values_hash(include_options = false)
       fields = {}
       custom_field_values.to_a.uniq.each do |field_value|
-        custom_field = field_value.custom_fields
+        custom_field = field_value.custom_field
         values = custom_field.values.where(objectid: id).pluck(:value)
         unless include_options
           fields[field_value.custom_field_slug] =
@@ -157,8 +155,8 @@ module CamaleonCms
     # deprecated f attribute
     def get_fields_object(_f = true)
       fields = {}
-      custom_field_values.eager_load(:custom_fields).to_a.uniq.each do |field_value|
-        custom_field = field_value.custom_fields
+      custom_field_values.eager_load(:custom_field).to_a.uniq.each do |field_value|
+        custom_field = field_value.custom_field
         # if custom_field.options[:show_frontend].to_s.to_bool
         values = custom_field.values.where(objectid: id).pluck(:value)
         fields[field_value.custom_field_slug] =
@@ -304,7 +302,9 @@ module CamaleonCms
     private
 
     def fix_meta_value(value)
-      value = value.to_json if value.is_a?(Array) || value.is_a?(Hash) || value.is_a?(ActionController::Parameters)
+      return value.to_json if value.is_a?(ActionController::Parameters)
+      return JSON.generate(value) if value.is_a?(Array) || value.is_a?(Hash)
+
       value
     end
 

data/app/models/concerns/camaleon_cms/metas.rb

@@ -19,8 +19,7 @@ module CamaleonCms
     end
 
     # return value of meta with key: key,
-    # if meta not exist, return default
-    # return default if meta value == ""
+    # if meta not exist, or its value == "", return default
     def get_meta(key, default = nil)
       key_str = key.is_a?(Symbol) ? key.to_s : key
       cama_fetch_cache("meta_#{key_str}") do
@@ -70,8 +69,7 @@ module CamaleonCms
 
     # return configuration for current object
     # key: attribute name
-    # default: if attribute not exist, return default
-    # return default if option value == ""
+    # default: if the attribute doesn't exist, or its value == "", return default
     # return value for attribute
     def get_option(key = nil, default = nil, meta_key = '_default')
       values = cama_options(meta_key)
@@ -133,8 +131,14 @@ module CamaleonCms
 
     # fix to parse value
     def fix_meta_value(value)
-      value = value.to_json if value.is_a?(Array) || value.is_a?(Hash) || value.is_a?(ActionController::Parameters)
-      fix_meta_var(value)
+      changed_value = if value.is_a?(ActionController::Parameters)
+                        value.to_json
+                      elsif value.is_a?(Array) || value.is_a?(Hash)
+                        JSON.generate(value)
+                      else
+                        value
+                      end
+      fix_meta_var(changed_value)
     end
 
     # fix to detect type of the variable

data/app/models/concerns/camaleon_cms/normalize_attrs.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+module CamaleonCms
+  module NormalizeAttrs
+    def normalize_attrs(*args)
+      # TODO: Remove the 1st branch when support will be dropped of Rails < 7.1
+      if ::Rails::VERSION::STRING < '7.1.0'
+        before_validation(on: %i[create update]) do
+          args.each do |attr|
+            next unless new_record? || attribute_changed?(attr)
+
+            self[attr] = ActionController::Base.helpers.sanitize(
+              __send__(attr)&.gsub(CamaleonRecord::TRANSLATION_TAG_HIDE_REGEX, CamaleonRecord::TRANSLATION_TAG_HIDE_MAP)
+            )&.gsub(CamaleonRecord::TRANSLATION_TAG_RESTORE_REGEX, CamaleonRecord::TRANSLATION_TAG_RESTORE_MAP)
+          end
+        end
+      else
+        normalizes(*args, with: lambda { |field|
+          ActionController::Base.helpers.sanitize(
+            field.gsub(CamaleonRecord::TRANSLATION_TAG_HIDE_REGEX, CamaleonRecord::TRANSLATION_TAG_HIDE_MAP)
+          ).gsub(CamaleonRecord::TRANSLATION_TAG_RESTORE_REGEX, CamaleonRecord::TRANSLATION_TAG_RESTORE_MAP)
+        })
+      end
+    end
+  end
+end

data/app/models/concerns/camaleon_cms/user_methods.rb

@@ -6,17 +6,21 @@ module CamaleonCms
       include CamaleonCms::CustomFieldsRead
       include CamaleonCms::CommonRelationships
 
+      extend CamaleonCms::NormalizeAttrs
+
       validates_uniqueness_of :username, scope: [:site_id], case_sensitive: false,
                                          message: I18n.t('camaleon_cms.admin.users.message.requires_different_username', default: 'Requires different username')
       validates_uniqueness_of :email, scope: [:site_id], case_sensitive: false,
                                       message: I18n.t('camaleon_cms.admin.users.message.requires_different_email', default: 'Requires different email')
 
+      normalize_attrs(:first_name, :last_name, :username)
+
       # callbacks
       before_validation :cama_before_validation
       before_destroy :reassign_posts
       after_destroy :reassign_comments
       before_create { generate_token(:auth_token) }
-      # invaliidate sessions when changing password
+      # invalidate sessions when changing password
       before_update { generate_token :auth_token if will_save_change_to_password_digest? }
 
       # relations
@@ -117,7 +121,7 @@ module CamaleonCms
 
     # reassign all posts of this user to first admin
     # reassign all comments of this user to first admin
-    # if doesn't exist any other administrator, this will cancel the user destroy
+    # if it doesn't exist any other administrator, this will cancel the user destroy
     def reassign_posts
       all_posts.each do |p|
         s = p.post_type.site

data/app/models/current_request.rb

@@ -0,0 +1,16 @@
+# CurrentRequest holds per-request state (user, site) accessible to models
+# via ActiveSupport::CurrentAttributes (thread-safe, resets after each request).
+#
+# Usage in controllers:
+#   CurrentRequest.user = cama_current_user
+#   CurrentRequest.site = current_site
+#
+# Usage in models:
+#   current_user  # delegates to CurrentRequest.user via CamaleonRecord
+#   current_site  # delegates to CurrentRequest.site via CamaleonRecord
+#
+# Note: Rails automatically resets CurrentAttributes between requests, ensuring no leakage.
+# In specs, call CurrentRequest.reset in before/after hooks to avoid cross-test pollution.
+class CurrentRequest < ActiveSupport::CurrentAttributes
+  attribute :user, :site
+end

data/app/uploaders/camaleon_cms_aws_uploader.rb

@@ -37,6 +37,8 @@ class CamaleonCmsAwsUploader < CamaleonCmsUploader
   end
 
   def fetch_file(file_name)
+    return { error: 'Invalid file path' } unless valid_folder_path?(file_name)
+
     return file_name if file_exists?(file_name)
 
     return file_name if bucket.object(file_name).download_file(file_name) && file_exists?(file_name)
@@ -84,8 +86,9 @@ class CamaleonCmsAwsUploader < CamaleonCmsUploader
   #   - same_name: false => avoid to overwrite an existent file with same key and search for an available key
   #   - is_thumb: true => if this file is a thumbnail of an uploaded file
   def add_file(uploaded_io_or_file_path, key, args = {})
+    return { error: 'Invalid file path' } unless valid_folder_path?(key)
+
     args = { same_name: false, is_thumb: false }.merge(args)
-    res = nil
     key = "#{@aws_settings['inner_folder']}/#{key}" if @aws_settings['inner_folder'].present? && !args[:is_thumb]
     key = key.cama_fix_media_key
     key = search_new_key(key) unless args[:same_name]
@@ -117,6 +120,8 @@ class CamaleonCmsAwsUploader < CamaleonCmsUploader
 
   # delete a folder in AWS with :key
   def delete_folder(key)
+    return { error: 'Invalid folder path' } unless valid_folder_path?(key)
+
     key = "#{@aws_settings['inner_folder']}/#{key}" if @aws_settings['inner_folder'].present?
     key = key.cama_fix_media_key
     bucket.objects(prefix: key.slice(1..-1) << '/').delete
@@ -125,6 +130,8 @@ class CamaleonCmsAwsUploader < CamaleonCmsUploader
 
   # delete a file in AWS with :key
   def delete_file(key)
+    return { error: 'Invalid file path' } unless valid_folder_path?(key)
+
     key = "#{@aws_settings['inner_folder']}/#{key}" if @aws_settings['inner_folder'].present?
     key = key.cama_fix_media_key
     begin

data/app/validators/camaleon_cms/post_uniq_validator.rb

@@ -7,11 +7,23 @@ module CamaleonCms
       ptype = record.post_type
       return unless ptype.present? # only for posts that belongs to a post type model
 
+      post_table = CamaleonCms::Post.table_name
+
+      conditions = []
+      params = []
+
+      slug_array.each do |s|
+        conditions << "#{post_table}.slug LIKE ?"
+        params << "%-->#{s}<!--%"
+      end
+
+      conditions << "#{post_table}.slug = ?"
+      params << record.slug
+
+      where_clause = "(#{conditions.join(' OR ')})"
+
       posts = ptype.site.posts
-                   .where(
-                     "(#{slug_array.map { |s| "#{CamaleonCms::Post.table_name}.slug LIKE '%-->#{s}<!--%'" }
-                                        .join(' OR ')} ) OR #{CamaleonCms::Post.table_name}.slug = ?", record.slug
-                   )
+                   .where(where_clause, *params)
                    .where.not(id: record.id)
                    .where.not(status: %i[draft draft_child trash])
       unless posts.empty?
@@ -28,10 +40,11 @@ module CamaleonCms
       end
 
       # avoid recursive page parent
-      if record.post_parent.present? && ptype.manage_hierarchy? && record.parents.cama_pluck(:id).include?(record.id)
-        record.errors[:base] << I18n.t('camaleon_cms.admin.post.message.recursive_hierarchy',
-                                       default: 'Parent Post Recursive')
-      end
+      return unless record.post_parent.present? && ptype.manage_hierarchy? &&
+                    record.parents.cama_pluck(:id).include?(record.id)
+
+      record.errors[:base] << I18n.t('camaleon_cms.admin.post.message.recursive_hierarchy',
+                                     default: 'Parent Post Recursive')
     end
   end
 end

data/app/views/camaleon_cms/admin/appearances/nav_menus/_left_menu_items.html.erb

@@ -46,12 +46,12 @@
                         </div>
                         <% if pt.manage_categories? %>
                             <div class="tab-pane class_type" id="tab-<%= pt.slug %>-categories" data-type="category" data-post_type="<%= pt.slug %>">
-                                <%= raw post_type_html_inputs(pt, "categories", "categories", "checkbox", [], "categorychecklist") %>
+                                <%= post_type_html_inputs(pt, "categories", "categories", "checkbox", [], "categorychecklist") %>
                             </div>
                         <% end %>
                         <% if pt.manage_tags? %>
                             <div class="tab-pane class_type" id="tab-<%= pt.slug %>-tags" data-type="post_tag" data-post_type="<%= pt.slug %>">
-                                <%= raw post_type_html_inputs(pt, "post_tags", "post_tags", "checkbox", [], "categorychecklist") %>
+                                <%= post_type_html_inputs(pt, "post_tags", "post_tags", "checkbox", [], "categorychecklist") %>
                             </div>
                         <% end %>
                     </div>

data/app/views/camaleon_cms/admin/appearances/widgets/main/form.html.erb

@@ -1,3 +1,4 @@
+<div class="alert alert-warning"><%= t('camaleon_cms.admin.widgets.warning') %></div>
 <%= form_for @widget, as: "widget_main", url: { action: (@widget.new_record? ? "create" : "update"), controller: "camaleon_cms/admin/appearances/widgets/main", id: @widget }, html: { role: 'form', class: "validate cama_ajax_request", id: "widget_form" } do |f| %>
     <%= render partial: 'layouts/camaleon_cms/admin/form_error', locals: {data: @widget} %>
     <div class="form-group">
@@ -24,4 +25,3 @@
         jQuery(function(){ init_form_validations($("#widget_form")); });
     </script>
 <% end %>
-

data/app/views/camaleon_cms/admin/categories/index.html.erb

@@ -58,7 +58,7 @@
             </tbody>
           </table>
           <%= content_tag("div", raw(t('camaleon_cms.admin.message.data_found_list')), class: "alert alert-warning") if @categories.empty? %>
-            <%= raw cama_do_pagination(@categories) %>
+            <%= cama_do_pagination(@categories) %>
         </div>
       </div>
       <!-- END BASIC TABLE SAMPLE -->

data/app/views/camaleon_cms/admin/comments/index.html.erb

@@ -15,7 +15,7 @@
     <div class="panel-body">
         <div class="messages messages-img">
             <%= raw "<div class='alert alert-warning'>#{t('camaleon_cms.admin.comments.message.there_no_comments')}</div>" if @comments.size == 0 %>
-            <%= raw cama_comments_render_html(@comments) %>
+            <%= cama_comments_render_html(@comments) %>
         </div>
     </div>
-</div>
+</div>

data/app/views/camaleon_cms/admin/comments/list.html.erb

@@ -31,6 +31,6 @@
             </tbody>
         </table>
         <%= content_tag("div", raw(t('camaleon_cms.admin.message.data_found_list')), class: "alert alert-warning") if @posts.empty? %>
-        <%= raw cama_do_pagination(@posts) %>
+        <%= cama_do_pagination(@posts) %>
     </div>
 </div>

data/app/views/camaleon_cms/admin/post_tags/index.html.erb

@@ -46,7 +46,7 @@
             </tbody>
           </table>
           <%= content_tag("div", raw(t('camaleon_cms.admin.message.data_found_list')), class: "alert alert-warning") if @post_tags.empty? %>
-          <%= raw cama_do_pagination(@post_tags) %>
+          <%= cama_do_pagination(@post_tags) %>
         </div>
       </div>
       <!-- END BASIC TABLE SAMPLE -->

data/app/views/camaleon_cms/admin/posts/_sidebar.html.erb

@@ -101,7 +101,7 @@
             </div>
             <div class="panel-body ">
                 <div class="form-group list-categories">
-                    <%= raw post_type_html_inputs(@post_type, "categories", "categories" , @post_type.get_option('has_single_category', false) ? 'radio' : "checkbox" ,params[:categories] || (@post.new_record? ? [] : @post.categories.pluck("#{CamaleonCms::TermTaxonomy.table_name}.id")), "categorychecklist", true )%>
+                    <%= post_type_html_inputs(@post_type, "categories", "categories" , @post_type.get_option('has_single_category', false) ? 'radio' : "checkbox" ,params[:categories] || (@post.new_record? ? [] : @post.categories.pluck("#{CamaleonCms::TermTaxonomy.table_name}.id")), "categorychecklist", true )%>
                 </div>
             </div>
         </div>