camaleon_cms 2.9.1 → 2.9.2

data/app/models/camaleon_cms/plugin.rb

@@ -1,5 +1,7 @@
 module CamaleonCms
   class Plugin < CamaleonCms::TermTaxonomy
+    normalize_attrs(:name, :description)
+
     # attrs:
     #   term_group => status active (1, nil)
     #   slug => plugin key

data/app/models/camaleon_cms/post_tag.rb

@@ -1,5 +1,7 @@
 module CamaleonCms
   class PostTag < CamaleonCms::TermTaxonomy
+    normalize_attrs(:name, :description)
+
     default_scope { where(taxonomy: :post_tag) }
 
     has_many :posts, foreign_key: :objectid, through: :term_relationships, source: :object

data/app/models/camaleon_cms/post_type.rb

@@ -1,5 +1,7 @@
 module CamaleonCms
   class PostType < CamaleonCms::TermTaxonomy
+    normalize_attrs(:name, :description)
+
     alias_attribute :site_id, :parent_id
     default_scope { where(taxonomy: :post_type) }
 

data/app/models/camaleon_cms/site.rb

@@ -1,5 +1,7 @@
 module CamaleonCms
   class Site < CamaleonCms::TermTaxonomy
+    normalize_attrs(:name, :description)
+
     include CamaleonCms::SiteDefaultSettings
 
     # attrs: [name, description, slug]

data/app/models/camaleon_cms/term_taxonomy.rb

@@ -18,8 +18,6 @@ module CamaleonCms
     # attr_accessible :data_options
     # attr_accessible :data_metas
 
-    normalize_attrs(:name, :description)
-
     # callbacks
     before_validation :before_validating
     before_destroy :destroy_dependencies

data/app/models/camaleon_cms/theme.rb

@@ -1,5 +1,7 @@
 module CamaleonCms
   class Theme < CamaleonCms::TermTaxonomy
+    normalize_attrs(:name, :description)
+
     # attrs:
     #   slug => plugin key
     belongs_to :site, class_name: 'CamaleonCms::Site', foreign_key: :parent_id, required: false

data/app/models/camaleon_cms/user_role.rb

@@ -1,5 +1,7 @@
 module CamaleonCms
   class UserRole < CamaleonCms::TermTaxonomy
+    normalize_attrs(:name, :description)
+
     after_destroy :set_users_as_cilent
 
     default_scope { where(taxonomy: :user_roles) }
@@ -122,6 +124,17 @@ module CamaleonCms
           label: I18n.t('camaleon_cms.admin.sidebar.settings').to_s,
           description: I18n.t('camaleon_cms.admin.users.tool_tip.settings').to_s
         },
+        {
+          key: 'custom_fields',
+          label: I18n.t('camaleon_cms.admin.sidebar.custom_fields', default: 'Custom Fields').to_s,
+          description: I18n.t('camaleon_cms.admin.users.tool_tip.custom_fields',
+                              default: 'Manage custom field groups and fields, including the select_eval type.').to_s
+        },
+        {
+          key: 'select_eval',
+          label: I18n.t('camaleon_cms.admin.custom_field.select_eval', default: 'Select Eval').to_s,
+          description: I18n.t('camaleon_cms.admin.users.tool_tip.select_eval', default: 'Allow toggling and using select_eval custom fields in the admin UI.').to_s
+        },
         {
           key: 'theme_settings',
           label: I18n.t('camaleon_cms.admin.settings.theme_setting', default: 'Theme Settings').to_s,

data/app/models/camaleon_cms/widget/main.rb

@@ -1,6 +1,8 @@
 module CamaleonCms
   module Widget
     class Main < CamaleonCms::TermTaxonomy
+      normalize_attrs(:name)
+
       default_scope { where(taxonomy: :widget) }
       # attr_accessible :excerpt, :renderer
       # name: "title"

data/app/models/camaleon_cms/widget/sidebar.rb

@@ -1,6 +1,8 @@
 module CamaleonCms
   module Widget
     class Sidebar < CamaleonCms::TermTaxonomy
+      normalize_attrs(:name, :description)
+
       default_scope { where(taxonomy: :sidebar) }
 
       has_many :metas, lambda {

data/app/models/camaleon_record.rb

@@ -49,4 +49,38 @@ class CamaleonRecord < ActiveRecord::Base
   def cama_build_cache_key(key)
     _key = "cama_cache_#{self.class.name}_#{id}_#{key}"
   end
+
+  # Return the current user for this thread/request context.
+  # Uses ActiveSupport::CurrentAttributes (CurrentRequest.user)
+  def current_user
+    return @current_user if defined?(@current_user)
+
+    @current_user = CurrentRequest.user
+  end
+
+  # Authorization helpers that delegate to central Ability (CanCan)
+  def can?(*args)
+    # Return false if no user or site context (e.g., background jobs, console)
+    return false if current_user.nil? || current_site.nil?
+
+    ability.can?(*args)
+  end
+
+  def ability
+    # Memoize Ability per request to avoid repeated DB queries and object instantiation.
+    # In tests that modify role meta mid-request, call reset_ability to invalidate cache.
+    @ability ||= CamaleonCms::Ability.new(current_user, current_site)
+  end
+
+  # Reset cached ability instance (useful in tests when role meta changes)
+  def reset_ability
+    @ability = nil
+  end
+
+  # current_site memoized from the CurrentRequest.site
+  def current_site
+    return @current_site if defined?(@current_site) && @current_site.present?
+
+    @current_site = CurrentRequest.site
+  end
 end

data/app/models/concerns/camaleon_cms/custom_fields_read.rb

@@ -135,7 +135,7 @@ module CamaleonCms
     def get_field_values_hash(include_options = false)
       fields = {}
       custom_field_values.to_a.uniq.each do |field_value|
-        custom_field = field_value.custom_fields
+        custom_field = field_value.custom_field
         values = custom_field.values.where(objectid: id).pluck(:value)
         unless include_options
           fields[field_value.custom_field_slug] =
@@ -155,8 +155,8 @@ module CamaleonCms
     # deprecated f attribute
     def get_fields_object(_f = true)
       fields = {}
-      custom_field_values.eager_load(:custom_fields).to_a.uniq.each do |field_value|
-        custom_field = field_value.custom_fields
+      custom_field_values.eager_load(:custom_field).to_a.uniq.each do |field_value|
+        custom_field = field_value.custom_field
         # if custom_field.options[:show_frontend].to_s.to_bool
         values = custom_field.values.where(objectid: id).pluck(:value)
         fields[field_value.custom_field_slug] =
@@ -303,7 +303,7 @@ module CamaleonCms
 
     def fix_meta_value(value)
       return value.to_json if value.is_a?(ActionController::Parameters)
-      return JSON.fast_generate(value) if value.is_a?(Array) || value.is_a?(Hash)
+      return JSON.generate(value) if value.is_a?(Array) || value.is_a?(Hash)
 
       value
     end

data/app/models/concerns/camaleon_cms/metas.rb

@@ -134,7 +134,7 @@ module CamaleonCms
       changed_value = if value.is_a?(ActionController::Parameters)
                         value.to_json
                       elsif value.is_a?(Array) || value.is_a?(Hash)
-                        JSON.fast_generate(value)
+                        JSON.generate(value)
                       else
                         value
                       end

data/app/models/current_request.rb

@@ -0,0 +1,16 @@
+# CurrentRequest holds per-request state (user, site) accessible to models
+# via ActiveSupport::CurrentAttributes (thread-safe, resets after each request).
+#
+# Usage in controllers:
+#   CurrentRequest.user = cama_current_user
+#   CurrentRequest.site = current_site
+#
+# Usage in models:
+#   current_user  # delegates to CurrentRequest.user via CamaleonRecord
+#   current_site  # delegates to CurrentRequest.site via CamaleonRecord
+#
+# Note: Rails automatically resets CurrentAttributes between requests, ensuring no leakage.
+# In specs, call CurrentRequest.reset in before/after hooks to avoid cross-test pollution.
+class CurrentRequest < ActiveSupport::CurrentAttributes
+  attribute :user, :site
+end

data/app/uploaders/camaleon_cms_aws_uploader.rb

@@ -37,6 +37,8 @@ class CamaleonCmsAwsUploader < CamaleonCmsUploader
   end
 
   def fetch_file(file_name)
+    return { error: 'Invalid file path' } unless valid_folder_path?(file_name)
+
     return file_name if file_exists?(file_name)
 
     return file_name if bucket.object(file_name).download_file(file_name) && file_exists?(file_name)
@@ -84,8 +86,9 @@ class CamaleonCmsAwsUploader < CamaleonCmsUploader
   #   - same_name: false => avoid to overwrite an existent file with same key and search for an available key
   #   - is_thumb: true => if this file is a thumbnail of an uploaded file
   def add_file(uploaded_io_or_file_path, key, args = {})
+    return { error: 'Invalid file path' } unless valid_folder_path?(key)
+
     args = { same_name: false, is_thumb: false }.merge(args)
-    res = nil
     key = "#{@aws_settings['inner_folder']}/#{key}" if @aws_settings['inner_folder'].present? && !args[:is_thumb]
     key = key.cama_fix_media_key
     key = search_new_key(key) unless args[:same_name]
@@ -117,6 +120,8 @@ class CamaleonCmsAwsUploader < CamaleonCmsUploader
 
   # delete a folder in AWS with :key
   def delete_folder(key)
+    return { error: 'Invalid folder path' } unless valid_folder_path?(key)
+
     key = "#{@aws_settings['inner_folder']}/#{key}" if @aws_settings['inner_folder'].present?
     key = key.cama_fix_media_key
     bucket.objects(prefix: key.slice(1..-1) << '/').delete
@@ -125,6 +130,8 @@ class CamaleonCmsAwsUploader < CamaleonCmsUploader
 
   # delete a file in AWS with :key
   def delete_file(key)
+    return { error: 'Invalid file path' } unless valid_folder_path?(key)
+
     key = "#{@aws_settings['inner_folder']}/#{key}" if @aws_settings['inner_folder'].present?
     key = key.cama_fix_media_key
     begin

data/app/validators/camaleon_cms/post_uniq_validator.rb

@@ -7,11 +7,23 @@ module CamaleonCms
       ptype = record.post_type
       return unless ptype.present? # only for posts that belongs to a post type model
 
+      post_table = CamaleonCms::Post.table_name
+
+      conditions = []
+      params = []
+
+      slug_array.each do |s|
+        conditions << "#{post_table}.slug LIKE ?"
+        params << "%-->#{s}<!--%"
+      end
+
+      conditions << "#{post_table}.slug = ?"
+      params << record.slug
+
+      where_clause = "(#{conditions.join(' OR ')})"
+
       posts = ptype.site.posts
-                   .where(
-                     "(#{slug_array.map { |s| "#{CamaleonCms::Post.table_name}.slug LIKE '%-->#{s}<!--%'" }
-                                        .join(' OR ')} ) OR #{CamaleonCms::Post.table_name}.slug = ?", record.slug
-                   )
+                   .where(where_clause, *params)
                    .where.not(id: record.id)
                    .where.not(status: %i[draft draft_child trash])
       unless posts.empty?

data/app/views/camaleon_cms/admin/appearances/nav_menus/_left_menu_items.html.erb

@@ -46,12 +46,12 @@
                         </div>
                         <% if pt.manage_categories? %>
                             <div class="tab-pane class_type" id="tab-<%= pt.slug %>-categories" data-type="category" data-post_type="<%= pt.slug %>">
-                                <%= raw post_type_html_inputs(pt, "categories", "categories", "checkbox", [], "categorychecklist") %>
+                                <%= post_type_html_inputs(pt, "categories", "categories", "checkbox", [], "categorychecklist") %>
                             </div>
                         <% end %>
                         <% if pt.manage_tags? %>
                             <div class="tab-pane class_type" id="tab-<%= pt.slug %>-tags" data-type="post_tag" data-post_type="<%= pt.slug %>">
-                                <%= raw post_type_html_inputs(pt, "post_tags", "post_tags", "checkbox", [], "categorychecklist") %>
+                                <%= post_type_html_inputs(pt, "post_tags", "post_tags", "checkbox", [], "categorychecklist") %>
                             </div>
                         <% end %>
                     </div>

data/app/views/camaleon_cms/admin/appearances/widgets/main/form.html.erb

@@ -1,3 +1,4 @@
+<div class="alert alert-warning"><%= t('camaleon_cms.admin.widgets.warning') %></div>
 <%= form_for @widget, as: "widget_main", url: { action: (@widget.new_record? ? "create" : "update"), controller: "camaleon_cms/admin/appearances/widgets/main", id: @widget }, html: { role: 'form', class: "validate cama_ajax_request", id: "widget_form" } do |f| %>
     <%= render partial: 'layouts/camaleon_cms/admin/form_error', locals: {data: @widget} %>
     <div class="form-group">
@@ -24,4 +25,3 @@
         jQuery(function(){ init_form_validations($("#widget_form")); });
     </script>
 <% end %>
-

data/app/views/camaleon_cms/admin/categories/index.html.erb

@@ -58,7 +58,7 @@
             </tbody>
           </table>
           <%= content_tag("div", raw(t('camaleon_cms.admin.message.data_found_list')), class: "alert alert-warning") if @categories.empty? %>
-            <%= raw cama_do_pagination(@categories) %>
+            <%= cama_do_pagination(@categories) %>
         </div>
       </div>
       <!-- END BASIC TABLE SAMPLE -->

data/app/views/camaleon_cms/admin/comments/index.html.erb

@@ -15,7 +15,7 @@
     <div class="panel-body">
         <div class="messages messages-img">
             <%= raw "<div class='alert alert-warning'>#{t('camaleon_cms.admin.comments.message.there_no_comments')}</div>" if @comments.size == 0 %>
-            <%= raw cama_comments_render_html(@comments) %>
+            <%= cama_comments_render_html(@comments) %>
         </div>
     </div>
-</div>
+</div>

data/app/views/camaleon_cms/admin/comments/list.html.erb

@@ -31,6 +31,6 @@
             </tbody>
         </table>
         <%= content_tag("div", raw(t('camaleon_cms.admin.message.data_found_list')), class: "alert alert-warning") if @posts.empty? %>
-        <%= raw cama_do_pagination(@posts) %>
+        <%= cama_do_pagination(@posts) %>
     </div>
 </div>

data/app/views/camaleon_cms/admin/post_tags/index.html.erb

@@ -46,7 +46,7 @@
             </tbody>
           </table>
           <%= content_tag("div", raw(t('camaleon_cms.admin.message.data_found_list')), class: "alert alert-warning") if @post_tags.empty? %>
-          <%= raw cama_do_pagination(@post_tags) %>
+          <%= cama_do_pagination(@post_tags) %>
         </div>
       </div>
       <!-- END BASIC TABLE SAMPLE -->

data/app/views/camaleon_cms/admin/posts/_sidebar.html.erb

@@ -101,7 +101,7 @@
             </div>
             <div class="panel-body ">
                 <div class="form-group list-categories">
-                    <%= raw post_type_html_inputs(@post_type, "categories", "categories" , @post_type.get_option('has_single_category', false) ? 'radio' : "checkbox" ,params[:categories] || (@post.new_record? ? [] : @post.categories.pluck("#{CamaleonCms::TermTaxonomy.table_name}.id")), "categorychecklist", true )%>
+                    <%= post_type_html_inputs(@post_type, "categories", "categories" , @post_type.get_option('has_single_category', false) ? 'radio' : "checkbox" ,params[:categories] || (@post.new_record? ? [] : @post.categories.pluck("#{CamaleonCms::TermTaxonomy.table_name}.id")), "categorychecklist", true )%>
                 </div>
             </div>
         </div>

data/app/views/camaleon_cms/admin/posts/index.html.erb

@@ -60,10 +60,10 @@
                     <td><%= link_to raw(f.the_status), {action: :index, s: f.status}, class: "cama_ajax_request" %>  </td>
                     <td><%= f.author.fullname %></td>
                     <% if @post_type.manage_categories? %>
-                        <td><%= raw post_type_list_taxonomy(f.categories, "success") %></td>
+                        <td><%= post_type_list_taxonomy(f.categories, "success") %></td>
                     <% end %>
                     <% if @post_type.manage_tags? %>
-                        <td><%= raw post_type_list_taxonomy(f.post_tags, "default") %></td>
+                        <td><%= post_type_list_taxonomy(f.post_tags, "default") %></td>
                     <% end %>
                     <% extra_column = {post: f, post_type: @post_type, content: "", from_body: true};  hooks_run("list_post_extra_columns", extra_column) %>
                     <%= raw extra_column[:content] %>
@@ -107,6 +107,6 @@
             </tbody>
         </table>
         <%= content_tag("div", raw(t('camaleon_cms.admin.message.data_found_list')), class: "alert alert-warning") if @posts.empty? %>
-        <%= raw cama_do_pagination(@posts) %>
+        <%= cama_do_pagination(@posts) %>
     </div>
 </div>

data/app/views/camaleon_cms/admin/search.html.erb

@@ -62,7 +62,7 @@
                                 </tbody>
                             </table>
                             <%= content_tag("div", raw(t('camaleon_cms.admin.message.data_found_list')), class: "alert alert-warning") if @items.empty? %>
-                            <%= raw cama_do_pagination(@items, panel_class: "cama_ajax_request") %>
+                            <%= cama_do_pagination(@items, panel_class: "cama_ajax_request") %>
                         </div>
                     </div>
                 </div>

data/app/views/camaleon_cms/admin/settings/custom_fields/_render.html.erb

@@ -23,7 +23,7 @@
                                 <%= field.name %>
                                 <%= raw "<em class='text-danger'>*</em>" if field.options[:required].to_s.to_bool %>
                                 <% if current_site.get_option('custom_fields_show_shortcodes') && ["post", "posttype", "category", "postTag", "site", "user", "navmenu", "theme"].include?(obj_class) %>
-                                    <small class="shortcode_field"><br><%= raw cama_shortcode_print("[data field='#{field.slug}' #{"object='#{obj_class}' #{"id='#{record.id}'" if obj_class != "Theme" }" unless record.new_record?}]") %></small>
+                                    <small class="shortcode_field"><br><%= cama_shortcode_print("[data field='#{field.slug}' #{"object='#{obj_class}' #{"id='#{record.id}'" if obj_class != "Theme" }" unless record.new_record?}]") %></small>
                                 <% end %>
                             </label>
                             <% if field.description.present? %>
@@ -40,7 +40,28 @@
                         </div>
                     <% end %>
                 </div>
-                <script> jQuery(function(){ build_custom_field_group(<%= raw(params[:field_options].present? ? (r = []; params[:field_options].each{|k, v| val = {}; v.each{|kk, vv| val["#{kk}"] = (vv['values'].values rescue vv['values']); }; r << val }; r.to_json) : record.get_fields_grouped(fields.pluck(:slug).uniq).to_json) %>, '<%= group.id %>', <%= raw group_field_data.to_json %>, <%= group.is_repeat %>, '<%= field_name %>'); }); </script>
+                <%
+                  field_options_json = if params[:field_options].present?
+                                         params[:field_options].to_unsafe_h.each_with_object([]) do |(_k, v), r|
+                                           r << v.each_with_object({}) do |(kk, vv), val|
+                                             val[kk.to_s] = (vv['values'].values rescue vv['values'])
+                                           end
+                                         end.to_json
+                                       else
+                                         record.get_fields_grouped(fields.pluck(:slug).uniq).to_json
+                                       end
+                %>
+                <script>
+                    jQuery(function () {
+                        build_custom_field_group(
+                            <%= json_escape(field_options_json).html_safe %>,
+                            '<%= group.id %>',
+                            <%= json_escape(group_field_data.to_json).html_safe %>,
+                            <%= group.is_repeat %>,
+                            '<%= field_name %>'
+                        );
+                    });
+                </script>
             </div>
         </div>
         <% if group.is_repeat %>

data/app/views/camaleon_cms/admin/settings/custom_fields/fields/_select_eval.html.erb

@@ -1,3 +1,3 @@
 <div class="group-input-fields-content">
-  <%= select_tag "#{field_name}[#{field.slug}][values][]", instance_eval(field.options[:command].to_s.strip), class: "form-control input-value #{'required' if field.options[:required].to_s.to_bool}"  %>
+  <%= select_tag "#{field_name}[#{field.slug}][values][]", instance_eval(field.options[:command].to_s.strip), class: "form-control input-value #{'required' if field.options[:required].to_s.to_bool}" %>
 </div>

data/app/views/camaleon_cms/admin/settings/custom_fields/form.html.erb

@@ -152,7 +152,7 @@
                     <div class="panel-body">
                         <div id="content-items-default" class="form-group input-group-sm">
                             <% cama_custom_field_elements.each do |i,item| %>
-                                <% next if item[:key] == "select_eval" %>
+                                <% next if item[:key] == 'select_eval' %>
                                 <a id="item-<%= item[:key] %>" class="btn btn-default" href="<%= get_items_cama_admin_settings_custom_fields_path(item[:key]) %>" style="margin-bottom: 4px"><%= item[:label] %></a>
                             <% end %>
                         </div>

data/app/views/camaleon_cms/admin/settings/custom_fields/index.html.erb

@@ -44,7 +44,7 @@
             </tbody>
           </table>
           <%= content_tag("div", raw(t('camaleon_cms.admin.message.data_found_list')), class: "alert alert-warning") if @field_groups.empty? %>
-            <%= raw cama_do_pagination(@field_groups) %>
+            <%= cama_do_pagination(@field_groups) %>
         </div>
       </div>
       <!-- END BASIC TABLE SAMPLE -->

data/app/views/camaleon_cms/admin/settings/post_types/index.html.erb

@@ -42,7 +42,7 @@
             </tbody>
           </table>
           <%= content_tag("div", raw(t('camaleon_cms.admin.message.data_found_list')), class: "alert alert-warning") if @post_types.empty? %>
-            <%= raw cama_do_pagination(@post_types) %>
+            <%= cama_do_pagination(@post_types) %>
         </div>
       </div>
       <!-- END BASIC TABLE SAMPLE -->

data/app/views/camaleon_cms/admin/settings/sites/index.html.erb

@@ -50,7 +50,7 @@
             </tbody>
           </table>
           <%= content_tag("div", raw(t('camaleon_cms.admin.message.data_found_list')), class: "alert alert-warning") if @sites.empty? %>
-            <%= raw cama_do_pagination(@sites) %>
+            <%= cama_do_pagination(@sites) %>
         </div>
       </div>
       <!-- END BASIC TABLE SAMPLE -->

data/app/views/camaleon_cms/admin/user_roles/form.html.erb

@@ -61,12 +61,12 @@
                 </div>
 
                 <div class="">
-                  <h5><%= t('camaleon_cms.admin.users.others_permissions')%></h5>
+                  <h5><%= t('camaleon_cms.admin.users.other_permissions')%></h5>
                   <div class="row">
                     <% values = rol_values_manager || {}  %>
                     <% cama_get_roles_values[:manager].each do |value|  %>
                         <div class="col-md-4">
-                          <label><input type="checkbox" name="rol_values[manager][<%= value[:key] %>]" value="1" <%= "checked" if values[value[:key].to_sym].present?  %> <%= "disabled" unless @user_role.editable?  %> >&nbsp; <%= raw value[:label] %></label>
+                          <label><input type="checkbox" name="rol_values[manager][<%= value[:key] %>]" value="1" <%= "checked" if values[value[:key].to_sym].present?  %> <%= "disabled" unless @user_role.editable?  %> <%= 'data-danger-select-eval=1' if value[:key].to_s == 'select_eval' %> >&nbsp; <%= raw value[:label] %></label>
                           &nbsp;<%= raw cama_html_tooltip(value[:description], 'right') if value[:description].present? %>
                         </div>
                     <% end %>
@@ -119,20 +119,94 @@
   <!-- END PAGE CONTENT WRAPPER -->
 </div>
 
+<div class="modal fade" id="select-eval-danger-modal" tabindex="-1" role="dialog" aria-labelledby="select-eval-danger-modal-title" aria-hidden="true">
+  <div class="modal-dialog" role="document">
+    <div class="modal-content">
+      <div class="modal-header">
+        <button type="button" class="close" data-dismiss="modal" aria-label="<%= t('camaleon_cms.admin.button.cancel') %>">
+          <span aria-hidden="true">&times;</span>
+        </button>
+        <h4 class="modal-title" id="select-eval-danger-modal-title"><%= t('camaleon_cms.admin.users.select_eval_modal.title') %></h4>
+      </div>
+      <div class="modal-body">
+        <p><%= t('camaleon_cms.admin.users.select_eval_modal.description') %></p>
+      </div>
+      <div class="modal-footer">
+        <button type="button" class="btn btn-default" data-role="select-eval-cancel" data-dismiss="modal"><%= t('camaleon_cms.admin.button.cancel') %></button>
+        <button type="button" class="btn btn-danger" data-role="select-eval-confirm"><%= t('camaleon_cms.admin.button.accept') %></button>
+      </div>
+    </div>
+  </div>
+</div>
+
 <script>
     jQuery(function($){
+      var pendingDangerSelectEval = null
+      var pendingDangerSelectEvalConfirmed = false
+      var $allCheckboxes = $("#contents-checkbox input[type='checkbox']")
+      var $selectEvalCheckbox = $("#contents-checkbox input[data-danger-select-eval='1']")
+      var $selectEvalModal = $("#select-eval-danger-modal")
+
+      function openSelectEvalDangerModal(checkbox){
+          pendingDangerSelectEval = checkbox
+          pendingDangerSelectEvalConfirmed = false
+          checkbox.prop("checked", false)
+          $selectEvalModal.modal("show")
+      }
+
+      function shouldWarnForSelectEvalEnable(wasChecked){
+          return $selectEvalCheckbox.length && !$selectEvalCheckbox.prop("disabled") && !wasChecked
+      }
+
       $("#contents-checkbox input:checked").each(function(){$(this).attr("data-checked", 1)})
+
+      $("#contents-checkbox").on("change", "input[data-danger-select-eval='1']", function(){
+          if($(this).prop("checked")){
+              openSelectEvalDangerModal($(this))
+          }
+      })
+
+      $selectEvalModal.find("[data-role='select-eval-confirm']").on("click", function(){
+          if(pendingDangerSelectEval){
+              pendingDangerSelectEval.prop("checked", true)
+              pendingDangerSelectEvalConfirmed = true
+          }
+          $selectEvalModal.modal("hide")
+      })
+
+      $(document).on("keydown", function(event){
+          if(event.which === 27 && $selectEvalModal.hasClass("in")){
+              $selectEvalModal.modal("hide")
+          }
+      })
+
+      $selectEvalModal.on("hidden.bs.modal", function(){
+          if(pendingDangerSelectEval && !pendingDangerSelectEvalConfirmed){
+              pendingDangerSelectEval.prop("checked", false)
+          }
+          pendingDangerSelectEval = null
+          pendingDangerSelectEvalConfirmed = false
+      })
+
       $("#checked-actions a[data-type]").click(function(){
           switch ($(this).attr("data-type")){
               case 'all':
-                  $("#contents-checkbox input[type='checkbox']").prop('checked', true);
+                  var wasSelectEvalChecked = $selectEvalCheckbox.prop('checked');
+                  $allCheckboxes.prop('checked', true);
+                  if(shouldWarnForSelectEvalEnable(wasSelectEvalChecked)){
+                      openSelectEvalDangerModal($selectEvalCheckbox)
+                  }
               break;
               case 'none':
-                  $("#contents-checkbox input[type='checkbox']").prop('checked', false);
+                  $allCheckboxes.prop('checked', false);
               break;
               case 'restore':
-                  $("#contents-checkbox input[type='checkbox']").prop('checked', false);
+                  var wasSelectEvalCheckedBeforeRestore = $selectEvalCheckbox.prop('checked');
+                  $allCheckboxes.prop('checked', false);
                   $("#contents-checkbox input[data-checked]").prop('checked', true);
+                  if(shouldWarnForSelectEvalEnable(wasSelectEvalCheckedBeforeRestore) && $selectEvalCheckbox.is("[data-checked]")){
+                      openSelectEvalDangerModal($selectEvalCheckbox)
+                  }
               break;
           }
           return false;

data/app/views/camaleon_cms/admin/user_roles/index.html.erb

@@ -45,7 +45,7 @@
             </tbody>
           </table>
           <%= content_tag("div", raw(t('camaleon_cms.admin.message.data_found_list')), class: "alert alert-warning") if @user_roles.empty? %>
-            <%= raw cama_do_pagination(@user_roles) %>
+            <%= cama_do_pagination(@user_roles) %>
 
         </div>
 

data/app/views/camaleon_cms/admin/users/index.html.erb

@@ -53,7 +53,7 @@
             </tbody>
           </table>
           <%= content_tag("div", raw(t('camaleon_cms.admin.message.data_found_list')), class: "alert alert-warning") if @users.empty? %>
-            <%= raw cama_do_pagination(@users) %>
+            <%= cama_do_pagination(@users) %>
         </div>
       </div>
       <!-- END BASIC TABLE SAMPLE -->

data/app/views/layouts/camaleon_cms/admin/_flash_messages.html.erb

@@ -6,11 +6,11 @@
         </div>
     </div>
 <% end %>
-<% if params[:info] %>
+<% if flash[:info].present? %>
     <div class="flash_messages">
         <div class="alert alert-info">
             <button type="button" class="close" data-dismiss="alert" aria-label="Close"><span aria-hidden="true">&times;</span></button>
-            <%= raw(params[:info]) %>
+            <%= flash[:info] %>
         </div>
     </div>
 <% end %>

data/config/initializers/custom_initializers.rb

@@ -4,10 +4,10 @@ Rails.application.config.to_prepare do |_config|
     next unless ap['path'].present?
 
     f = File.join(ap['path'], 'config', 'initializer.rb')
-    eval(File.read(f)) if File.exist?(f)
+    load f if File.exist?(f)
 
     f = File.join(ap['path'], 'config', 'custom_models.rb')
-    eval(File.read(f)) if File.exist?(f)
+    load f if File.exist?(f)
   end
 
   # This block can be overridden in the app initializer to wrap the sleep and delete_file in an async job,