camaleon_cms 2.9.0 → 2.9.2

data/config/locales/camaleon_cms/admin/uk.yml

@@ -574,7 +574,10 @@ uk:
          requires_different_email: 'Потрібні інші ел. пошта '
          created_pending_validate_email: "Користувач був створений, будь ласка, підтвердіть вашу електронну пошту"
         new_photo: 'Нова фотографія'
-        others_permissions: 'Інші роздільності'
+        other_permissions: 'Інші роздільності'
+        select_eval_modal:
+          title: 'Небезпечний дозвіл'
+          description: 'Дозвіл select_eval дозволяє виконувати динамічний код з параметрів користувацьких полів. Увімкнення може призвести до довільного виконання коду, витоку даних і повної компрометації сайту, якщо обробляється недовірений вміст.'
         profile: 'Профіль'
         slogan: 'Слоган'
         type_contents: 'Тип Контенту'
@@ -600,7 +603,7 @@ uk:
           media: 'Permission to the midsection'
           publish: 'Вам потрібен дозвіл на Створення, редагування, Редагування інших або Опублікувати щоб включити цей дозвіл'
           themes: 'Дозвіл тим на розділ'
-          widgets: 'Дозвіл віджетів на розділ'
+          widgets: 'Уможливлено редагування віджетів, зокрема збереження непродезінфікованого коду.'
           menus: 'Дозвіл на розділ Меню'
           plugins: 'Дозвіл на розділ Плагінів'
           users: 'Дозвіл на створення, редагування і видалення користувачів'
@@ -651,6 +654,7 @@ uk:
           error_created: "Бічна панель не створена."
           error_updated: "Бічна панель не оновлена."
           error_deleted: "Бічна панель видалена."
+        warning: "Попередження: Віджети можуть зберігати непродезінфіковані HTML та Javascript. Вводьте лише той код, який ви розумієте та якому довіряєте."
       intro:
         profile: "Тут ви можете побачити налаштування вашого профілю."
         content: "Цей блок містить всі групи контенту вашого сайту. Кожен контент може мати різну структуру, яких можна налаштувати в Налаштування => Група контентів"

data/config/locales/camaleon_cms/admin/zh-CH.yml

@@ -607,7 +607,10 @@ zh-CN:
           role_can_not_be_deleted: '无法删除此角色'
           user_can_not_delete_own_account: '用户不能删除自己的帐户'
         new_photo: '新建照片'
-        others_permissions: '其他权限'
+        other_permissions: '其他权限'
+        select_eval_modal:
+          title: '危险权限'
+          description: 'select_eval 权限允许从自定义字段选项中执行动态代码。启用后，如果评估不受信任的内容，可能导致任意代码执行、数据泄露以及站点被完全攻陷。'
         profile: '资料'
         slogan: '标语'
         type_contents: '内容的类型'
@@ -633,7 +636,7 @@ zh-CN:
           media: '媒体资源部分'
           publish: '开启该权限,允许创建,编辑, 或公开'
           themes: '主题部分'
-          widgets: '插件部分'
+          widgets: '允许编辑小部件，包括保存未经清理的代码。'
           menus: '菜单部分'
           plugins: '插件部分'
           users: '创建,编辑,删除用户'
@@ -684,6 +687,7 @@ zh-CN:
           error_created: '侧边栏创建失败'
           error_updated: '侧边栏更新失败'
           error_deleted: "侧边栏已删除."
+        warning: "警告：小组件可以存储未经清理的 HTML 和 Javascript。仅输入您理解和信任的代码。"
       intro:
         profile: "在这个地方，您可以看到您的个人资料选项."
         content: "此块包含您网站的所有内容组。 每个内容可以具有在 设置 => 内容组"

data/db/migrate/20150611161134_post_table_into_utf8.rb

@@ -1,12 +1,12 @@
 class PostTableIntoUtf8 < CamaManager.migration_class
   def change
     if table_exists? CamaleonCms::User.table_name
-      add_column(CamaleonCms::User.table_name, :email, :string) unless column_exists?(CamaleonCms::User.table_name, :email)
-      add_column(CamaleonCms::User.table_name, :username, :string) unless column_exists?(CamaleonCms::User.table_name, :username)
-      add_column(CamaleonCms::User.table_name, :role, :string, default: 'client', index: true) unless column_exists?(CamaleonCms::User.table_name, :role)
-      add_column(CamaleonCms::User.table_name, :parent_id, :integer) unless column_exists?(CamaleonCms::User.table_name, :parent_id)
-      add_column(CamaleonCms::User.table_name, :site_id, :integer, index: true, default: -1) unless column_exists?(CamaleonCms::User.table_name, :site_id)
-      add_column(CamaleonCms::User.table_name, :auth_token, :string) unless column_exists?(CamaleonCms::User.table_name, :auth_token)
+      add_column(CamaleonCms::User.table_name, :email, :string, if_not_exists: true)
+      add_column(CamaleonCms::User.table_name, :username, :string, if_not_exists: true)
+      add_column(CamaleonCms::User.table_name, :role, :string, default: 'client', index: true, if_not_exists: true)
+      add_column(CamaleonCms::User.table_name, :parent_id, :integer, if_not_exists: true)
+      add_column(CamaleonCms::User.table_name, :site_id, :integer, index: true, default: -1, if_not_exists: true)
+      add_column(CamaleonCms::User.table_name, :auth_token, :string, if_not_exists: true)
     else
       create_table CamaleonCms::User.table_name do |t|
         t.string   "username", index: true
@@ -26,7 +26,7 @@ class PostTableIntoUtf8 < CamaManager.migration_class
       end
     end
 
-    create_table "#{PluginRoutes.static_system_info["db_prefix"]}term_taxonomy" do |t|
+    create_table "#{PluginRoutes.static_system_info["db_prefix"]}term_taxonomy", if_not_exists: true do |t|
       t.string   "taxonomy", index: true
       t.text     "description", limit: 1073741823
       t.integer  "parent_id", index: true
@@ -41,7 +41,7 @@ class PostTableIntoUtf8 < CamaManager.migration_class
       t.belongs_to :user, index: true#, foreign_key: true
     end
 
-    create_table "#{PluginRoutes.static_system_info["db_prefix"]}posts" do |t|
+    create_table "#{PluginRoutes.static_system_info["db_prefix"]}posts", if_not_exists: true do |t|
       t.string   "title"
       t.string   "slug", index: true
       t.text     "content",          limit: 1073741823
@@ -58,13 +58,13 @@ class PostTableIntoUtf8 < CamaManager.migration_class
       t.belongs_to :user, index: true#, foreign_key: true
     end
 
-    create_table "#{PluginRoutes.static_system_info["db_prefix"]}term_relationships" do |t|
+    create_table "#{PluginRoutes.static_system_info["db_prefix"]}term_relationships", if_not_exists: true do |t|
       t.integer "objectid", index: true
       t.integer "term_order", index: true
       t.belongs_to :term_taxonomy, index: true
     end
 
-    create_table "#{PluginRoutes.static_system_info["db_prefix"]}user_relationships" do |t|
+    create_table "#{PluginRoutes.static_system_info["db_prefix"]}user_relationships", if_not_exists: true do |t|
       t.integer "term_order"
       t.integer "active", default: 1
 
@@ -72,7 +72,7 @@ class PostTableIntoUtf8 < CamaManager.migration_class
       t.belongs_to :user, index: true
     end
 
-    create_table "#{PluginRoutes.static_system_info["db_prefix"]}comments" do |t|
+    create_table "#{PluginRoutes.static_system_info["db_prefix"]}comments", if_not_exists: true do |t|
       t.string   "author"
       t.string   "author_email"
       t.string   "author_url"
@@ -87,7 +87,7 @@ class PostTableIntoUtf8 < CamaManager.migration_class
       t.timestamps null: false
     end
 
-    create_table "#{PluginRoutes.static_system_info["db_prefix"]}custom_fields" do |t|
+    create_table "#{PluginRoutes.static_system_info["db_prefix"]}custom_fields", if_not_exists: true do |t|
       t.string  "object_class", index: true
       t.string  "name"
       t.string  "slug", index: true
@@ -100,7 +100,7 @@ class PostTableIntoUtf8 < CamaManager.migration_class
       t.string  "status"
     end
 
-    create_table "#{PluginRoutes.static_system_info["db_prefix"]}custom_fields_relationships" do |t|
+    create_table "#{PluginRoutes.static_system_info["db_prefix"]}custom_fields_relationships", if_not_exists: true do |t|
       t.integer "objectid", index: true
       t.integer "custom_field_id", index: true
       t.integer "term_order"
@@ -109,7 +109,7 @@ class PostTableIntoUtf8 < CamaManager.migration_class
       t.string  "custom_field_slug", index: true
     end
 
-    create_table "#{PluginRoutes.static_system_info["db_prefix"]}metas" do |t|
+    create_table "#{PluginRoutes.static_system_info["db_prefix"]}metas", if_not_exists: true do |t|
       t.string  "key", index: true
       t.text    "value", limit: 1073741823
       t.integer "objectid", index: true

data/db/migrate/20150926095310_rename_column_posts.rb

@@ -1,9 +1,9 @@
 # change post structure to optimize query speed
 class RenameColumnPosts < CamaManager.migration_class
   def change
-    remove_column "#{PluginRoutes.static_system_info["db_prefix"]}posts", :comment_count
-    add_column "#{PluginRoutes.static_system_info["db_prefix"]}posts", :post_order, :integer, default: 0
-    add_column "#{PluginRoutes.static_system_info["db_prefix"]}posts", :taxonomy_id, :integer, default: nil, index: true
+    remove_column "#{PluginRoutes.static_system_info["db_prefix"]}posts", :comment_count, if_exists: true
+    add_column "#{PluginRoutes.static_system_info["db_prefix"]}posts", :post_order, :integer, default: 0, if_not_exists: true
+    add_column "#{PluginRoutes.static_system_info["db_prefix"]}posts", :taxonomy_id, :integer, default: nil, index: true, if_not_exists: true
     CamaleonCms::Post.all.each do |post|
       begin
         post_id = post.get_post_type_depre.id

data/db/migrate/20151212095328_add_confirm_token_to_users.rb

@@ -1,7 +1,7 @@
 class AddConfirmTokenToUsers < CamaManager.migration_class
   def change
-    add_column CamaleonCms::User.table_name, :confirm_email_token, :string, default: nil
-    add_column CamaleonCms::User.table_name, :confirm_email_sent_at, :datetime, default: nil
-    add_column CamaleonCms::User.table_name, :is_valid_email, :boolean, default: true
+    add_column CamaleonCms::User.table_name, :confirm_email_token, :string, default: nil, if_not_exists: true
+    add_column CamaleonCms::User.table_name, :confirm_email_sent_at, :datetime, default: nil, if_not_exists: true
+    add_column CamaleonCms::User.table_name, :is_valid_email, :boolean, default: true, if_not_exists: true
   end
 end

data/db/migrate/20160504155652_add_feature_to_posts.rb

@@ -1,5 +1,5 @@
 class AddFeatureToPosts < CamaManager.migration_class
   def change
-    add_column "#{PluginRoutes.static_system_info["db_prefix"]}posts", :is_feature, :boolean, default: false
+    add_column "#{PluginRoutes.static_system_info["db_prefix"]}posts", :is_feature, :boolean, default: false, if_not_exists: true
   end
 end

data/db/migrate/20160504155653_move_first_name_of_users.rb

@@ -1,7 +1,7 @@
 class MoveFirstNameOfUsers < CamaManager.migration_class
   def change
-    add_column CamaleonCms::User.table_name, :first_name, :string unless column_exists?(CamaleonCms::User.table_name, :first_name)
-    add_column CamaleonCms::User.table_name, :last_name, :string unless column_exists?(CamaleonCms::User.table_name, :last_name)
+    add_column CamaleonCms::User.table_name, :first_name, :string, if_not_exists: true
+    add_column CamaleonCms::User.table_name, :last_name, :string, if_not_exists: true
     CamaleonCms::User.all.each do |u|
       u.update_columns(first_name: u.get_meta('first_name'), last_name: u.get_meta('last_name')) if u.get_meta('first_name').present?
     end

data/db/migrate/20160609121449_add_group_to_custom_field_values.rb

@@ -1,5 +1,5 @@
 class AddGroupToCustomFieldValues < CamaManager.migration_class
   def change
-    add_column "#{PluginRoutes.static_system_info["db_prefix"]}custom_fields_relationships", :group_number, :integer, default: 0
+    add_column "#{PluginRoutes.static_system_info["db_prefix"]}custom_fields_relationships", :group_number, :integer, default: 0, if_not_exists: true
   end
 end

data/db/migrate/20161215202255_drop_user_relationship_table.rb

@@ -1,5 +1,5 @@
 class DropUserRelationshipTable < CamaManager.migration_class
   def change
-    drop_table "#{PluginRoutes.static_system_info["db_prefix"]}user_relationships"
+    drop_table "#{PluginRoutes.static_system_info["db_prefix"]}user_relationships", if_exists: true
   end
 end

data/db/migrate/20180124132318_create_media.rb

@@ -1,6 +1,6 @@
 class CreateMedia < CamaManager.migration_class
   def change
-    create_table "#{PluginRoutes.static_system_info["db_prefix"]}media" do |t|
+    create_table "#{PluginRoutes.static_system_info["db_prefix"]}media", if_not_exists: true do |t|
       t.references :site, index: true
       t.string :name, index: true
       t.boolean :is_folder, index: true, default: false

data/db/migrate/20180704211100_adjust_field_length.rb

@@ -2,7 +2,7 @@ class AdjustFieldLength < CamaManager.migration_class
   def change
     post_table = CamaleonCms::Post.table_name
     change_column post_table, :title, :text
-    remove_index(post_table, :slug) if index_exists?(post_table, :slug)
+    remove_index(post_table, :slug, if_exists: true)
     change_column post_table, :slug, :text
     add_index post_table, :slug, length: 255
     change_column "#{PluginRoutes.static_system_info["db_prefix"]}term_taxonomy", :name, :text

data/lib/camaleon_cms/version.rb

@@ -1,3 +1,3 @@
 module CamaleonCms
-  VERSION = '2.9.0'.freeze
+  VERSION = '2.9.2'.freeze
 end

data/lib/ext/string.rb

@@ -1,7 +1,7 @@
 class String
   def to_bool
-    return true if self == true || self =~ (/(true|t|yes|y|1)$/i)
-    return false if self == false || blank? || self =~ (/(false|f|no|n|0)$/i)
+    return true if self == true || self =~ /(true|t|yes|y|1)$/i
+    return false if self == false || blank? || self =~ /(false|f|no|n|0)$/i
 
     raise ArgumentError, "invalid value for Boolean: \"#{self}\""
   end
@@ -111,7 +111,7 @@ class String
     name = name.gsub(sanitize_regexp, '_')
     name = "_#{name}" if name =~ /\A\.+\z/
     name = 'unnamed' if name.empty?
-    name.mb_chars.to_s
+    name
   end
 
   # return cleaned model class name

data/lib/plugin_routes.rb

@@ -174,12 +174,12 @@ class PluginRoutes
     @@all_sites = nil
     @@_vars.each { |v| class_variable_set("@@cache_#{v}", nil) }
     Rails.application.reload_routes!
-    @@_after_reload.uniq.each { |r| eval(r) }
+    @@_after_reload.uniq.each(&:call)
   end
 
-  # permit to add extra actions for reload routes
+  # Add a callable (Proc/Lambda) to run after routes reload; strings are not supported.
   def self.add_after_reload_routes(command)
-    @@_after_reload << command
+    @@_after_reload << (command.is_a?(String) ? raise(ArgumentError, 'Expected a callable (Proc/Lambda), not a String') : command)
   end
 
   # return all enabled plugins []
@@ -275,7 +275,7 @@ class PluginRoutes
 
   def self.cache_variable(var_name, value = nil)
     @@_vars.push(var_name).uniq!
-    # if Rails.env != "development" # disable cache plugin routes for develoment mode
+    # if Rails.env != "development" # disable cache plugin routes for development mode
     cache = begin
       class_variable_get("@@cache_#{var_name}")
     rescue StandardError
@@ -376,9 +376,9 @@ class PluginRoutes
     return r unless r.nil? || r == []
 
     res = get_gem_themes
-    entries = ['.', '..']
+    entries = %w[. ..]
     res.each { |theme| entries << theme['key'] }
-    (Dir["#{apps_dir}/themes/*"]).each do |path|
+    Dir["#{apps_dir}/themes/*"].each do |path|
       entry = path.split('/').last
       config = File.join(path, 'config', 'config.json')
       next if entries.include?(entry) || !File.directory?(path) || !File.exist?(config)

data/lib/tasks/custom_fields_roles.rake

@@ -0,0 +1,56 @@
+namespace :camaleon_cms do
+  desc 'Backfill user roles to include custom_fields manager permission'
+  task backfill_custom_fields_permission: :environment do
+    Rails.logger.info 'Backfilling custom_fields manager permission for existing user roles...'
+    CamaleonCms::UserRole.find_each do |role|
+      key = "_manager_#{role.parent_id}"
+      begin
+        current_role = role.get_meta(key)
+        # if the role already has settings/managers, skip; otherwise add custom_fields => 1
+        if current_role.blank? || (!current_role.is_a?(Hash) || current_role['custom_fields'].blank?)
+          current_role = (current_role.is_a?(Hash) ? current_role : {}).merge!('custom_fields' => 1)
+          role.set_meta(key, current_role)
+          Rails.logger.info "Updated role=#{role.slug} site_id=#{role.parent_id}"
+        else
+          Rails.logger.info "Skipped role=#{role.slug} site_id=#{role.parent_id} (already has custom_fields)"
+        end
+      rescue StandardError => e
+        Rails.logger.info "Failed to update role=#{role.slug}: #{e.message}"
+      end
+    end
+    Rails.logger.info 'Done.'
+  end
+
+  desc 'Backfill admin user roles to include select_eval permission'
+  task backfill_select_eval_permission: :environment do
+    Rails.logger.info 'Backfilling select_eval permission for admin roles...'
+    updated_count = 0
+    skipped_count = 0
+
+    CamaleonCms::UserRole.where(slug: 'admin', term_group: -1).find_each do |role|
+      site_id = role.parent_id
+      key = "_manager_#{site_id}"
+      begin
+        current_meta = role.get_meta(key, {})
+
+        # Only update if role doesn't already have select_eval
+        if !current_meta[:select_eval]
+          updated_meta = current_meta.merge(select_eval: 1)
+          role.set_meta(key, updated_meta)
+          Rails.logger.info "✓ Updated admin role site_id=#{site_id}"
+          updated_count += 1
+        else
+          Rails.logger.info "  Skipped admin role site_id=#{site_id} (already has select_eval)"
+          skipped_count += 1
+        end
+      rescue StandardError => e
+        Rails.logger.info "✗ Failed to update admin role site_id=#{site_id}: #{e.message}"
+      end
+    end
+
+    Rails.logger.info "\nSummary:"
+    Rails.logger.info "  Updated: #{updated_count} admin roles"
+    Rails.logger.info "  Skipped: #{skipped_count} admin roles"
+    Rails.logger.info "\nDone! All admin roles now have select_eval permission."
+  end
+end

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: camaleon_cms
 version: !ruby/object:Gem::Version
-  version: 2.9.0
+  version: 2.9.2
 platform: ruby
 authors:
 - Owen Peredo Diaz
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-01-06 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: addressable
@@ -204,14 +203,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: '2.6'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: '2.6'
 - !ruby/object:Gem::Dependency
   name: sprockets-rails
   requirement: !ruby/object:Gem::Requirement
@@ -268,6 +267,34 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: net-http
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: tempfile
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: aws-sdk-s3
   requirement: !ruby/object:Gem::Requirement
@@ -282,6 +309,34 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '1'
+- !ruby/object:Gem::Dependency
+  name: brakeman
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: bundler-audit
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
@@ -730,6 +785,7 @@ files:
 - app/controllers/camaleon_cms/apps/themes_front_controller.rb
 - app/controllers/camaleon_cms/camaleon_controller.rb
 - app/controllers/camaleon_cms/frontend_controller.rb
+- app/controllers/concerns/camaleon_cms/admin/custom_fields_concern.rb
 - app/controllers/concerns/camaleon_cms/frontend_concern.rb
 - app/decorators/camaleon_cms/application_decorator.rb
 - app/decorators/camaleon_cms/category_decorator.rb
@@ -805,8 +861,10 @@ files:
 - app/models/concerns/camaleon_cms/common_relationships.rb
 - app/models/concerns/camaleon_cms/custom_fields_read.rb
 - app/models/concerns/camaleon_cms/metas.rb
+- app/models/concerns/camaleon_cms/normalize_attrs.rb
 - app/models/concerns/camaleon_cms/site_default_settings.rb
 - app/models/concerns/camaleon_cms/user_methods.rb
+- app/models/current_request.rb
 - app/models/plugins.rb
 - app/models/themes.rb
 - app/uploaders/camaleon_cms_aws_uploader.rb
@@ -1130,11 +1188,11 @@ files:
 - lib/plugin_routes.rb
 - lib/tasks/camaleon_cms/camaleon_tasks.rake
 - lib/tasks/camaleon_cms/rspec_test.rake
+- lib/tasks/custom_fields_roles.rake
 homepage: https://camaleon.website
 licenses:
 - MIT
 metadata: {}
-post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -1152,8 +1210,7 @@ requirements:
 - rails >= 6.1
 - ruby >= 3.0
 - imagemagick
-rubygems_version: 3.5.17
-signing_key:
+rubygems_version: 3.6.9
 specification_version: 4
 summary: Camaleon is a CMS for Ruby on Rails as an alternative to Wordpress.
 test_files: []