camaleon_cms 2.9.1 → 2.9.2

data/app/controllers/camaleon_cms/admin/settings/post_types_controller.rb

@@ -4,6 +4,7 @@ module CamaleonCms
       class PostTypesController < CamaleonCms::Admin::SettingsController
         before_action :set_post_type, only: %i[show edit update destroy]
         before_action :set_data_term, only: %i[create update]
+
         add_breadcrumb I18n.t('camaleon_cms.admin.sidebar.content_groups'), :cama_admin_settings_post_types_path
 
         def index
@@ -20,7 +21,7 @@ module CamaleonCms
 
         def update
           if @post_type.update(@data_term)
-            @post_type.set_field_values(params.require(:field_options).permit!) if params[:field_options].present?
+            @post_type.set_field_values(cama_permitted_field_options('PostType')) if params[:field_options].present?
             hooks_run('updated_post_type', { post_type: @post_type })
             flash[:notice] = t('camaleon_cms.admin.post_type.message.updated')
             redirect_to action: :index
@@ -32,7 +33,7 @@ module CamaleonCms
         def create
           @post_type = current_site.post_types.new(@data_term)
           if @post_type.save
-            @post_type.set_field_values(params.require(:field_options).permit!) if params[:field_options].present?
+            @post_type.set_field_values(cama_permitted_field_options('PostType')) if params[:field_options].present?
             hooks_run('created_post_type', { post_type: @post_type })
             flash[:notice] = t('camaleon_cms.admin.post_type.message.created')
             redirect_to action: :index
@@ -49,11 +50,19 @@ module CamaleonCms
         private
 
         def set_data_term
-          data_term = params.require(:post_type).permit!
-          data_term[:data_options] = params.require(:meta).permit!
+          data_term = params.require(:post_type).permit(:name, :slug, :description, :parent_id)
+          data_term[:data_options] = params[:meta].present? ? post_type_meta_params : {}
           @data_term = data_term
         end
 
+        def post_type_meta_params
+          params.require(:meta).permit(:icon, :has_layout, :default_layout, :has_template, :default_template,
+                                       :has_category, :has_single_category, :has_tags, :has_content, :has_summary,
+                                       :has_comments, :has_featured, :has_seo, :has_parent_structure, :has_picture,
+                                       :posts_image_dimension, :posts_thumb_versions, :posts_thumb_size,
+                                       :is_required_picture, :contents_route_format, :default_thumb)
+        end
+
         def set_post_type
           @post_type = current_site.post_types.find_by_id(params[:id])
         rescue StandardError

data/app/controllers/camaleon_cms/admin/settings/sites_controller.rb

@@ -23,11 +23,11 @@ module CamaleonCms
 
         def update
           tmp = @site.slug
-          if @site.update(params.require(:site).permit!)
+          if @site.update(site_params)
             save_metas(@site)
             flash[:notice] = t('camaleon_cms.admin.sites.message.updated')
             if @site.id == Cama::Site.main_site.id && tmp != @site.slug
-              redirect_to @site.the_admin_url
+              redirect_to(cama_admin_path)
             else
               redirect_to action: :index
             end
@@ -43,8 +43,7 @@ module CamaleonCms
         end
 
         def create
-          site_data = params.require(:site).permit!
-          @site = CamaleonCms::Site.new(site_data)
+          @site = CamaleonCms::Site.new(site_params)
           if @site.save
             save_metas(@site)
             site_after_install(@site, @site.get_theme_slug)
@@ -84,6 +83,10 @@ module CamaleonCms
           flash[:error] = t('camaleon_cms.admin.sites.message.unauthorized')
           redirect_to cama_admin_path
         end
+
+        def site_params
+          params.require(:site).permit(:name, :slug, :description)
+        end
       end
     end
   end

data/app/controllers/camaleon_cms/admin/settings_controller.rb

@@ -1,8 +1,11 @@
 module CamaleonCms
   module Admin
     class SettingsController < CamaleonCms::AdminController
+      include CamaleonCms::Admin::CustomFieldsConcern
+
       before_action :validate_role, except: %i[theme save_theme]
       before_action :validate_role_theme, only: %i[theme save_theme]
+
       add_breadcrumb I18n.t('camaleon_cms.admin.sidebar.settings')
 
       def index
@@ -19,10 +22,10 @@ module CamaleonCms
       def site_saved
         @site = current_site
         cache_slug = @site.slug
-        if @site.update(params.require(:site).permit!)
+        if @site.update(params.require(:site).permit(:name, :slug, :description))
           @site.set_options(params[:options]) if params[:options].present?
           @site.set_metas(params[:metas]) if params[:metas].present?
-          @site.set_field_values(params[:field_options])
+          @site.set_field_values(cama_permitted_field_options('Site'))
           flash[:notice] = t('camaleon_cms.admin.settings.message.site_updated')
           args = { action: :site }
           args[:host], args[:port] = @site.get_domain.to_s.split(':') if cache_slug != @site.slug
@@ -62,7 +65,7 @@ module CamaleonCms
         current_theme.set_field_values(params[:theme_fields]) if params[:theme_fields].present?
         current_theme.set_options(params[:theme_option]) if params[:theme_option].present?
         current_theme.set_metas(params[:theme_meta]) if params[:theme_meta].present?
-        current_theme.set_field_values(params[:field_options])
+        current_theme.set_field_values(cama_permitted_field_options('Theme'))
         hook_run(current_theme.settings, 'on_theme_settings', current_theme) # permit to save extra/custom values by this hook
         flash[:notice] = t('camaleon_cms.admin.message.updated_success', default: 'Theme updated successfully')
         redirect_to action: :theme
@@ -74,7 +77,7 @@ module CamaleonCms
         CamaleonCms::HtmlMailer.sender(params[:email], 'Test', data).deliver_now
         head :ok
       rescue StandardError => e
-        render inline: e.message, status: 502
+        render plain: e.message, status: 502
       end
 
       private

data/app/controllers/camaleon_cms/admin/user_roles_controller.rb

@@ -20,7 +20,7 @@ module CamaleonCms
       end
 
       def create
-        user_role_data = params.require(:user_role).permit!
+        user_role_data = params.require(:user_role).permit(:name, :slug, :description)
         @user_role = current_site.user_roles.new(user_role_data)
         if @user_role.save
           @user_role.set_meta("_post_type_#{current_site.id}",
@@ -40,7 +40,7 @@ module CamaleonCms
       end
 
       def update
-        if @user_role.update(params.require(:user_role).permit!)
+        if @user_role.update(params.require(:user_role).permit(:name, :slug, :description))
           if @user_role.editable?
             @user_role.set_meta("_post_type_#{current_site.id}",
                                 defined?(params[:rol_values][:post_type]) ? params[:rol_values][:post_type] : {})

data/app/controllers/camaleon_cms/admin/users_controller.rb

@@ -1,8 +1,12 @@
 module CamaleonCms
   module Admin
     class UsersController < CamaleonCms::AdminController
+      include CamaleonCms::Admin::CustomFieldsConcern
+
       before_action :validate_role, except: %i[profile profile_edit]
+
       add_breadcrumb I18n.t('camaleon_cms.admin.sidebar.users'), :cama_admin_users_url
+
       before_action :set_user, only: %i[show edit update destroy impersonate]
 
       def index
@@ -31,8 +35,8 @@ module CamaleonCms
         r = { user: @user }
         hooks_run('user_update', r)
         if @user.update(user_params)
-          @user.set_metas(params[:meta]) if params[:meta].present?
-          @user.set_field_values(params[:field_options])
+          @user.set_metas(user_meta_params) if params[:meta].present?
+          @user.set_field_values(cama_permitted_field_options('User')) if params[:field_options].present?
           r = { user: @user, message: t('camaleon_cms.admin.users.message.updated'), params: params }
           hooks_run('user_after_edited', r)
           flash[:notice] = r[:message]
@@ -93,13 +97,12 @@ module CamaleonCms
       end
 
       def create
-        user_data = params.require(:user).permit!
-        @user = current_site.users.new(user_data)
+        @user = current_site.users.new(user_params)
         r = { user: @user }
         hooks_run('user_create', r)
         if @user.save
-          @user.set_metas(params[:meta]) if params[:meta].present?
-          @user.set_field_values(params[:field_options])
+          @user.set_metas(user_meta_params) if params[:meta].present?
+          @user.set_field_values(cama_permitted_field_options('User')) if params[:field_options].present?
           r = { user: @user }
           hooks_run('user_created', r)
           flash[:notice] = t('camaleon_cms.admin.users.message.created')
@@ -138,12 +141,13 @@ module CamaleonCms
       end
 
       def user_params
-        parameters = params.require(:user)
-        if cama_current_user.role_grantor?(@user)
-          parameters.permit(:username, :email, :role, :first_name, :last_name)
-        else
-          parameters.permit(:username, :email, :first_name, :last_name)
-        end
+        p = params.require(:user).permit(:username, :email, :first_name, :last_name, :password, :password_confirmation)
+        p[:role] = params[:user][:role] if cama_current_user.role_grantor?(@user) && params[:user][:role].present?
+        p
+      end
+
+      def user_meta_params
+        params.require(:meta).permit(:avatar, :slogan)
       end
 
       def set_user

data/app/controllers/camaleon_cms/admin_controller.rb

@@ -7,6 +7,7 @@ module CamaleonCms
     include CamaleonCms::Admin::ApplicationHelper
     # layout 'camaleon_cms/admin'
     before_action :cama_authenticate
+    before_action :keep_request_attrs
     before_action :admin_init_actions
     before_action :admin_logged_actions
     before_action :admin_before_hooks
@@ -83,6 +84,13 @@ module CamaleonCms
       hooks_run('admin_before_load')
     end
 
+    # Set cama_current_user and current_site in CurrentRequest so models can access the current context.
+    # CurrentRequest is an ActiveSupport::CurrentAttributes subclass that auto-resets per request.
+    def keep_request_attrs
+      CurrentRequest.user = cama_current_user
+      CurrentRequest.site = current_site
+    end
+
     # trigger hooks for admin panel after admin load
     def admin_after_hooks
       hooks_run('admin_after_load')

data/app/controllers/camaleon_cms/apps/plugins_admin_controller.rb

@@ -2,6 +2,7 @@ module CamaleonCms
   module Apps
     class PluginsAdminController < CamaleonCms::AdminController
       before_action :init_plugin
+      before_action :authorize_plugin
 
       private
 
@@ -21,6 +22,10 @@ module CamaleonCms
         lookup_context.prefixes.prepend(params[:controller].sub("plugins/#{plugin_name}",
                                                                 "plugins/#{plugin_name}/views"))
       end
+
+      def authorize_plugin
+        authorize! :manage, :plugins
+      end
     end
   end
 end

data/app/controllers/concerns/camaleon_cms/admin/custom_fields_concern.rb

@@ -0,0 +1,29 @@
+module CamaleonCms
+  module Admin
+    module CustomFieldsConcern
+      extend ActiveSupport::Concern
+
+      private
+
+      # Only permit field_options that match registered custom field slugs
+      def cama_permitted_field_options(object_class)
+        return {} unless params[:field_options].present?
+
+        allowed_keys = cama_custom_field_allowed_slugs(object_class)
+        return {} if allowed_keys.blank?
+
+        field_options = params.require(:field_options)
+        field_options.permit(field_options.keys.select { |k| k.to_s =~ /\A\d+\z/ }.index_with do
+          allowed_keys.index_with { [:id, :group_number, { values: {} }] }
+        end).to_h
+      end
+
+      def cama_custom_field_allowed_slugs(object_class)
+        CamaleonCms::CustomField.where(
+          parent_id: CamaleonCms::CustomField.where(object_class: object_class).select(:id),
+          object_class: '_fields'
+        ).pluck(:slug).uniq
+      end
+    end
+  end
+end

data/app/decorators/camaleon_cms/post_decorator.rb

@@ -4,7 +4,7 @@ module CamaleonCms
     delegate_all
 
     def the_title(locale = nil)
-      r = { title: object.title.to_s.translate(get_locale(locale)), post: object }
+      r = { title: h.h(object.title.to_s.translate(get_locale(locale))), post: object }
       h.hooks_run('post_the_title', r)
       r[:title]
     end

data/app/decorators/camaleon_cms/user_decorator.rb

@@ -53,7 +53,7 @@ module CamaleonCms
     end
 
     def role_grantor?(other_user)
-      h.can?(:manage, :users) && id != other_user.id
+      h.can?(:manage, :users) && (other_user.nil? || id != other_user.id)
     end
 
     def self.object_class_name

data/app/helpers/camaleon_cms/admin/application_helper.rb

@@ -9,27 +9,27 @@ module CamaleonCms
 
       # render pagination for current items
       # items is a will pagination object
-      # sample: <%= raw cama_do_pagination(@posts) %>
+      # sample: <%= cama_do_pagination(@posts) %>
       def cama_do_pagination(items, *will_paginate_options)
         will_paginate_options = will_paginate_options.extract_options!
-        custom_class = will_paginate_options[:panel_class]
-        will_paginate_options.delete(:panel_class)
-        "<div class='row #{custom_class} pagination_panel cama_ajax_request'>
-        <div class='col-md-10'>
-          #{begin
+        custom_class = will_paginate_options.delete(:panel_class)
+        content_tag(:div, class: "row #{custom_class} pagination_panel cama_ajax_request") do
+          concat(content_tag(:div, class: 'col-md-10') do
             will_paginate(items, will_paginate_options)
           rescue StandardError
             ''
-          end}
-        </div>
-        <div class='col-md-2 text-right total-items'>
-          <strong>#{I18n.t('camaleon_cms.admin.table.total', default: 'Total')}: #{begin
-            items.total_entries
-          rescue StandardError
-            items.count
-          end} </strong>
-        </div>
-    </div>"
+          end)
+          concat(content_tag(:div, class: 'col-md-2 text-right total-items') do
+            content_tag(:strong) do
+              total = begin
+                items.total_entries
+              rescue StandardError
+                items.count
+              end
+              "#{I18n.t('camaleon_cms.admin.table.total', default: 'Total')}: #{total}"
+            end
+          end)
+        end
       end
 
       # return the locale for frontend translations initialized in admin controller
@@ -41,7 +41,7 @@ module CamaleonCms
 
       # print code with auto copy
       def cama_shortcode_print(code)
-        "<input onmousedown=\"this.clicked = 1;\" readonly onfocus=\"if (!this.clicked) this.select(); else this.clicked = 2;\" onclick=\"if (this.clicked == 2) this.select(); this.clicked = 0;\" class='code_style' tabindex='-1' value=\"#{code}\">"
+        content_tag(:input, nil, class: 'code_style', readonly: true, onmousedown: 'this.clicked = 1;', onfocus: 'if (!this.clicked) this.select(); else this.clicked = 2;', onclick: 'if (this.clicked == 2) this.select(); this.clicked = 0;', tabindex: '-1', value: code)
       end
     end
   end

data/app/helpers/camaleon_cms/admin/post_type_helper.rb

@@ -11,17 +11,16 @@ module CamaleonCms
       end
 
       def post_type_status(status, color = 'default')
-        "<span class='label label-#{color} label-form'>#{status}</span>"
+        content_tag(:span, status, class: "label label-#{color} label-form")
       end
 
       # taxonomies ->  (categories || post_tags)
       def post_type_list_taxonomy(taxonomies, color = 'primary')
-        html = ''
-        taxonomies.decorate.each do |f|
-          html += "<a class='cama_ajax_request' href='#{cama_admin_post_type_taxonomy_posts_path(@post_type.id,
-                                                                                                 f.taxonomy, f.id)}'><span class='label label-#{color} label-form'>#{f.the_title}</span></a> "
-        end
-        html
+        taxonomies.decorate.map do |f|
+          link_to(cama_admin_post_type_taxonomy_posts_path(@post_type.id, f.taxonomy, f.id), class: 'cama_ajax_request') do
+            content_tag(:span, f.the_title, class: "label label-#{color} label-form")
+          end
+        end.join(' ').html_safe
       end
 
       # sort array of posts to build post's tree
@@ -54,23 +53,27 @@ module CamaleonCms
                                    values = [], class_cat = '', required = false)
         if categories.count < 1
           return t('camaleon_cms.admin.post_type.message.no_created_html',
-                   taxonomy: taxonomy == 'categories' ? t('camaleon_cms.admin.table.categories') : t('camaleon_cms.admin.table.tags')).to_s
-        end
-
-        html = "<ul class='#{class_cat}'>"
-        categories.decorate.each do |f|
-          html += '<li>'
-          html +=  "<label class='class_slug' data-post_link_edit='#{f.the_edit_url}'> "
-          html +=  "<input data-error-place='#validation_error_list_#{name}' type='#{type}' name='#{name}[]' #{values.to_i.include?(f.id) ? 'checked' : ''} value='#{f.id}' class = '#{if required
-                                                                                                                                                                                         'required'
-                                                                                                                                                                                       end}' />"
-          html += "#{f.the_title} </label> "
-          html += post_type_html_inputs(f, 'children', name, type, values, 'children') if f.children.present?
-          html += '</li>'
+                   taxonomy: taxonomy == 'categories' ? t('camaleon_cms.admin.table.categories') : t('camaleon_cms.admin.table.tags'))
         end
 
-        html += "</ul><div id='validation_error_list_#{name}'></div>"
-        html
+        content_tag(:ul, class: class_cat) do
+          categories.decorate.map do |f|
+            content_tag(:li) do
+              is_checked = Array(values).map(&:to_s).include?(f.id.to_s)
+              input_options = { class: (required ? 'required' : ''), data: { error_place: "#validation_error_list_#{name}" } }
+              input_tag = if type == 'radio'
+                            radio_button_tag("#{name}[]", f.id, is_checked, input_options)
+                          else
+                            check_box_tag("#{name}[]", f.id, is_checked, input_options)
+                          end
+              res = content_tag(:label, class: 'class_slug', data: { post_link_edit: f.the_edit_url }) do
+                "#{input_tag} #{f.the_title} ".html_safe
+              end
+              res << post_type_html_inputs(f, 'children', name, type, values, 'children') if f.children.present?
+              res
+            end
+          end.join.html_safe
+        end + content_tag(:div, '', id: "validation_error_list_#{name}")
       end
     end
   end

data/app/helpers/camaleon_cms/comment_helper.rb

@@ -1,5 +1,7 @@
 module CamaleonCms
   module CommentHelper
+    LABELS = { 'approved' => 'success', 'pending' => 'warning', 'spam' => 'danger' }.freeze
+
     # return common data to save a new comment
     # user_id, author, aothor_email, author_ip, approved, :agent
     def cama_comments_get_common_data
@@ -16,47 +18,79 @@ module CamaleonCms
     # render as html content all comments recursively
     # comments: collection of comments
     def cama_comments_render_html(comments)
-      res = ''
-      labels = { 'approved' => 'success', 'pending' => 'warning', 'spam' => 'danger' }
-      comments.decorate.each do |comment|
+      comments.decorate.map do |comment|
         author = comment.the_author
-        res << "<div class='media'>
-                 <div class='media-left'>
-                    <a href='#{author.the_admin_profile_url}'>#{image_tag author.the_avatar, class: 'media-object',
-                                                                                             style: 'width: 64px; height: 64px;'}</a>
-                 </div>
-                 <div class='media-body'>
-                    <h4 class='media-heading'>#{author.the_name} <small>#{comment.the_created_at}</small> <span class='label label-#{labels[comment.approved]} pull-right'>#{t("camaleon_cms.admin.comments.message.#{comment.approved}")}</span></h4>
-                    <div class='comment_content'>#{sanitize comment.content}</div>
-                    <div class='comment_actions'>
-                        <div class='pull-left'>
-                            <a href='#{cama_admin_post_comment_answer_path(@post.id,
-                                                                           comment.id)}' data-comment-id='#{comment.id}' title='#{t('camaleon_cms.admin.comments.tooltip.reply_comment')}' class='btn btn-info reply btn-xs ajax_modal'><span class='fa fa-mail-reply'></span></a>
-                            #{link_to raw('<i class="fa fa-trash-o"></i>'), { action: :destroy, id: comment.id },
-                                      method: :delete, data: { confirm: t('camaleon_cms.admin.message.delete') }, class: 'btn btn-danger btn-xs cama_ajax_request', title: t('camaleon_cms.admin.comments.tooltip.delete_comment').to_s}
-                        </div>
-                        <div class='pull-right'>
-                            <a href='#{url_for({ action: :toggle_status, comment_id: comment.id,
-                                                 s: 'a' })}' title='#{t('camaleon_cms.admin.comments.tooltip.approved_comment')}' class='#{if comment.approved == 'approved'
-                                                                                                                                             'hidden'
-                                                                                                                                           end} btn btn-success approve btn-xs cama_ajax_request'><span class='fa fa-thumbs-o-up'></span></a>
-                            <a href='#{url_for({ action: :toggle_status, comment_id: comment.id,
-                                                 s: 'p' })}' title='#{t('camaleon_cms.admin.comments.tooltip.comment_pending')}' class='#{if comment.approved == 'pending'
-                                                                                                                                            'hidden'
-                                                                                                                                          end} btn btn-primary pending btn-xs cama_ajax_request'><span class='fa fa-warning'></span></a>
-                            <a href='#{url_for({ action: :toggle_status, comment_id: comment.id,
-                                                 s: 's' })}' title='#{t('camaleon_cms.admin.comments.tooltip.comment_spam')}' class='#{if comment.approved == 'spam'
-                                                                                                                                         'hidden'
-                                                                                                                                       end} btn btn-danger spam btn-xs cama_ajax_request'><span class='fa fa-bug'></span></a>
-                        </div>
-                    </div>
-                    <hr>
-                    <div class='clearfix'></div>
-                    #{cama_comments_render_html comment.children}
-                 </div>
-              </div>"
-      end
-      res
+        content_tag(:div, class: 'media') do
+          [
+            content_tag(:div, class: 'media-left') do
+              link_to(author.the_admin_profile_url) do
+                image_tag(author.the_avatar, class: 'media-object', style: 'width: 64px; height: 64px;')
+              end
+            end,
+            content_tag(:div, class: 'media-body') do
+              [
+                content_tag(:h4, class: 'media-heading') do
+                  [
+                    author.the_name,
+                    ' ',
+                    content_tag(:small, comment.the_created_at),
+                    ' ',
+                    content_tag(:span, t("camaleon_cms.admin.comments.message.#{comment.approved}"),
+                                class: "label label-#{LABELS[comment.approved]} pull-right")
+                  ].join.html_safe
+                end,
+                content_tag(:div, sanitize(comment.content), class: 'comment_content'),
+                content_tag(:div, class: 'comment_actions') do
+                  [
+                    content_tag(:div, class: 'pull-left') do
+                      [
+                        link_to(
+                          cama_admin_post_comment_answer_path(@post.id, comment.id),
+                          data: { comment_id: comment.id },
+                          title: t('camaleon_cms.admin.comments.tooltip.reply_comment'),
+                          class: 'btn btn-info reply btn-xs ajax_modal'
+                        ) { content_tag(:span, '', class: 'fa fa-mail-reply') },
+                        ' ',
+                        link_to(
+                          { action: :destroy, id: comment.id },
+                          method: :delete,
+                          data: { confirm: t('camaleon_cms.admin.message.delete') },
+                          class: 'btn btn-danger btn-xs cama_ajax_request',
+                          title: t('camaleon_cms.admin.comments.tooltip.delete_comment')
+                        ) { content_tag(:i, '', class: 'fa fa-trash-o') }
+                      ].join.html_safe
+                    end,
+                    content_tag(:div, class: 'pull-right') do
+                      [
+                        link_to(
+                          url_for({ action: :toggle_status, comment_id: comment.id, s: 'a' }),
+                          title: t('camaleon_cms.admin.comments.tooltip.approved_comment'),
+                          class: "#{comment.approved == 'approved' ? 'hidden' : ''} btn btn-success approve btn-xs cama_ajax_request"
+                        ) { content_tag(:span, '', class: 'fa fa-thumbs-o-up') },
+                        ' ',
+                        link_to(
+                          url_for({ action: :toggle_status, comment_id: comment.id, s: 'p' }),
+                          title: t('camaleon_cms.admin.comments.tooltip.comment_pending'),
+                          class: "#{comment.approved == 'pending' ? 'hidden' : ''} btn btn-primary pending btn-xs cama_ajax_request"
+                        ) { content_tag(:span, '', class: 'fa fa-warning') },
+                        ' ',
+                        link_to(
+                          url_for({ action: :toggle_status, comment_id: comment.id, s: 's' }),
+                          title: t('camaleon_cms.admin.comments.tooltip.comment_spam'),
+                          class: "#{comment.approved == 'spam' ? 'hidden' : ''} btn btn-danger spam btn-xs cama_ajax_request"
+                        ) { content_tag(:span, '', class: 'fa fa-bug') }
+                      ].join.html_safe
+                    end
+                  ].join.html_safe
+                end,
+                content_tag(:hr),
+                content_tag(:div, '', class: 'clearfix'),
+                cama_comments_render_html(comment.children)
+              ].join.html_safe
+            end
+          ].join.html_safe
+        end
+      end.join('').html_safe
     end
   end
 end

data/app/helpers/camaleon_cms/frontend/content_select_helper.rb

@@ -68,7 +68,7 @@ module CamaleonCms
       #   the_content
       # end
       def the_content
-        @object.the_content.html_safe if @object.present?
+        sanitize(@object.the_content) if @object.present?
       end
 
       # select url of post

data/app/helpers/camaleon_cms/frontend/nav_menu_helper.rb

@@ -23,7 +23,7 @@ module CamaleonCms
           item_class_parent: 'dropdown', # class for all menu items that contain sub items
           sub_container: 'ul', # type of container for sub items
           sub_class: 'dropdown-menu', # class for sub container
-          callback_item: ->(args) {}, # rubocop:disable Lint/ShadowingOuterLocalVariable
+          callback_item: ->(args) {},
           # callback executed for each item (args = { menu_item, link, level, settings, has_children, link_attrs = "", index}).
           #     menu_item: (Object) Menu object
           #     link: (Hash) link data: {link: '', name: ''}

data/app/helpers/camaleon_cms/html_helper.rb

@@ -140,7 +140,21 @@ module CamaleonCms
 
     # execute translation for value if this value is like: t(admin.my_text) ==> My Text
     def cama_print_i18n_value(value)
-      value.start_with?('t(') ? eval(value.sub('t(', 'I18n.t(')) : value
+      return value unless value.is_a?(String)
+      return value unless value.start_with?('t(') && value.end_with?(')')
+
+      # Use an exclusive end index to strip the trailing ')' without nil-coercion.
+      key = value[2...-1].strip
+      # If the expression uses matching single/double quotes, unwrap the key before translation;
+      # the quoted form still only accepts simple i18n key characters: a-z, A-Z, 0-9, _, ., and -.
+      quoted_key_match = key.match(/\A(['"])([a-zA-Z0-9_.-]+)\1\z/)
+      key = quoted_key_match[2] if quoted_key_match
+
+      # Only translate simple i18n keys so arbitrary Ruby is never evaluated.
+      # Allowed chars: a-z, A-Z, 0-9, _, ., and -.
+      return value unless key.match?(/\A[a-zA-Z0-9_.-]+\z/)
+
+      I18n.t(key)
     end
   end
 end

data/app/helpers/camaleon_cms/session_helper.rb

@@ -26,7 +26,7 @@ module CamaleonCms
       if redirect_url.present?
         redirect_to redirect_url
       elsif (return_to = cookies.delete(:return_to)).present?
-        redirect_to return_to
+        redirect_to safe_redirect_url(return_to) || cama_admin_dashboard_path
       else
         redirect_to cama_admin_dashboard_path
       end
@@ -167,6 +167,18 @@ module CamaleonCms
 
     private
 
+    # validate redirect url to prevent open redirect attacks
+    def safe_redirect_url(url)
+      return if url.blank?
+
+      uri = URI.parse(url)
+      return if uri.host.present? && uri.host != request.host
+
+      url
+    rescue URI::InvalidURIError
+      nil
+    end
+
     # calculate the current user for API
     def cama_calc_api_current_user
       begin