camaleon_cms 2.9.1 → 2.9.3

data/app/helpers/camaleon_cms/admin/custom_fields_helper.rb

@@ -2,31 +2,19 @@ module CamaleonCms
   module Admin
     module CustomFieldsHelper
       def cama_custom_field_elements
-        return @_cama_custom_field_elements if @_cama_custom_field_elements.present?
+        return CurrentRequest.custom_field_elements if CurrentRequest.custom_field_elements.present?
 
         items = {}
         items[:text_box] = {
           key: 'text_box',
           label: t('camaleon_cms.admin.custom_field.fields.text_box'),
-          options: {
-            required: true,
-            multiple: true,
-            translate: true,
-            default_value: '',
-            show_frontend: true
-          }
+          options: { required: true, multiple: true, translate: true, default_value: '', show_frontend: true }
         }
 
         items[:text_area] = {
           key: 'text_area',
           label: t('camaleon_cms.admin.custom_field.fields.text_area'),
-          options: {
-            required: true,
-            multiple: true,
-            translate: true,
-            default_value: '',
-            show_frontend: true
-          }
+          options: { required: true, multiple: true, translate: true, default_value: '', show_frontend: true }
         }
         items[:select] = {
           key: 'select',
@@ -35,10 +23,7 @@ module CamaleonCms
             required: true,
             multiple: true,
             translate: true,
-            multiple_options: {
-              label: t('camaleon_cms.admin.settings.options_select'),
-              default: 'radio'
-            },
+            multiple_options: { label: t('camaleon_cms.admin.settings.options_select'), default: 'radio' },
             show_frontend: true
           }
         }
@@ -298,7 +283,8 @@ module CamaleonCms
         }
 
         # evaluate the content of command value on listing
-        # sample command: options_from_collection_for_select(current_site.the_posts("commerce").decorate, :id, :the_title)
+        # sample command:
+        # options_from_collection_for_select(current_site.the_posts("commerce").decorate, :id, :the_title)
         items[:select_eval] = {
           key: 'select_eval',
           label: t('camaleon_cms.admin.custom_field.fields.select_eval'),
@@ -344,17 +330,32 @@ module CamaleonCms
         }
         r = { fields: items }
         hooks_run('extra_custom_fields', r)
-        @_cama_custom_field_elements = r[:fields]
+        CurrentRequest.custom_field_elements = r[:fields]
       end
 
       # add your model class into custom fields editor
       # Note: to use custom fields on your model, you need the following:
-      # - add: belongs_to :site (in your model) //don't forget multi site support, i.e.: you need site_id attribute in your table
+      # - add: belongs_to :site (in your model)
+      #   //don't forget multi site support, i.e.: you need site_id attribute in your table
       # - add: include CamaleonCms::CustomFieldsRead (in your model)
       # ==> With this, you can manage your model like a plugin. Check api -> custom fields section into docs)
       # model_class: class name (Product)
       def cf_add_model(model_class)
-        @_extra_models_for_fields << model_class
+        CurrentRequest.extra_models_for_fields ||= []
+        CurrentRequest.extra_models_for_fields << model_class
+      end
+
+      # Models offered in the field-group placement dropdown: those registered via cf_add_model plus any
+      # a custom_field_custom_models hook appends. Seeded from the legacy @_extra_models_for_fields ivar
+      # so a controller still assigning it keeps working. The dropdown used to read that ivar while
+      # cf_add_model wrote CurrentRequest, so registered models never appeared. Regression M18.
+      # The seed and the hook payload are copies: hook appends must reach only this read, not
+      # accumulate in the request store or leak into the controller ivar.
+      def cf_extra_models_for_fields
+        CurrentRequest.extra_models_for_fields ||= (instance_variable_get(:@_extra_models_for_fields) || []).dup
+        f_args = { models: CurrentRequest.extra_models_for_fields.dup }
+        hooks_run('custom_field_custom_models', f_args)
+        f_args[:models]
       end
     end
   end

data/app/helpers/camaleon_cms/admin/menus_helper.rb

@@ -1,34 +1,35 @@
+# frozen_string_literal: true
+
 module CamaleonCms
   module Admin
     module MenusHelper
       include CamaleonCms::Admin::BreadcrumbHelper
+      include ActionView::Helpers::TagHelper
+      include ActionView::Helpers::OutputSafetyHelper
 
       def admin_menus_add_commons
-        admin_menu_add_menu('dashboard',
-                            { icon: 'dashboard', title: t('camaleon_cms.admin.sidebar.dashboard'),
-                              url: cama_admin_dashboard_path })
-        items = []
+        admin_menu_add_menu(
+          'dashboard',
+          { icon: 'dashboard', title: t('camaleon_cms.admin.sidebar.dashboard'), url: cama_admin_dashboard_path }
+        )
 
-        current_site.post_types.eager_load(:metas).visible_menu.all.each do |pt|
+        items = []
+        current_site.post_types.eager_load(:metas).visible_menu.find_each do |pt|
           pt = pt.decorate
           items_i = []
-          if can? :posts,
-                  pt
+          if can? :posts, pt
             items_i << { icon: 'list', title: t('camaleon_cms.admin.post_type.all').to_s,
                          url: cama_admin_post_type_posts_path(pt.id) }
           end
-          if can? :create_post,
-                  pt
+          if can? :create_post, pt
             items_i << { icon: 'plus', title: t('camaleon_cms.admin.post_type.add_new', type_title: pt.the_title).to_s,
                          url: new_cama_admin_post_type_post_path(pt.id) }
           end
-          if pt.manage_categories? && (can? :categories,
-                                            pt)
+          if pt.manage_categories? && (can? :categories, pt)
             items_i << { icon: 'folder-open', title: t('camaleon_cms.admin.post_type.categories'),
                          url: cama_admin_post_type_categories_path(pt.id) }
           end
-          if pt.manage_tags? && (can? :post_tags,
-                                      pt)
+          if pt.manage_tags? && (can? :post_tags, pt)
             items_i << { icon: 'tags', title: t('camaleon_cms.admin.post_type.tags'),
                          url: cama_admin_post_type_post_tags_path(pt.id) }
           end
@@ -36,58 +37,93 @@ module CamaleonCms
             items << { icon: pt.get_option('icon', 'copy'), title: pt.the_title, url: '', items: items_i }
           end
         end
+
         if items.present?
-          admin_menu_add_menu('content',
-                              { icon: 'database', title: t('camaleon_cms.admin.sidebar.contents'), url: '', items: items,
-                                datas: "data-intro='#{t('camaleon_cms.admin.intro.content')}' data-position='right' data-wait='600'" })
+          admin_menu_add_menu(
+            'content',
+            {
+              icon: 'database', title: t('camaleon_cms.admin.sidebar.contents'), url: '', items: items,
+              datas: "data-intro='#{t('camaleon_cms.admin.intro.content')}' data-position='right' data-wait='600'"
+            }
+          )
         end
         # end
 
-        if can? :manage,
-                :media
-          admin_menu_add_menu('media',
-                              { icon: 'picture-o', title: t('camaleon_cms.admin.sidebar.media'), url: cama_admin_media_path,
-                                datas: "data-intro='#{t('camaleon_cms.admin.intro.media')}' data-position='right'" })
+        if can? :manage, :media
+          admin_menu_add_menu(
+            'media',
+            {
+              icon: 'picture-o', title: t('camaleon_cms.admin.sidebar.media'), url: cama_admin_media_path,
+              datas: "data-intro='#{t('camaleon_cms.admin.intro.media')}' data-position='right'"
+            }
+          )
         end
-        if can? :manage,
-                :comments
-          admin_menu_add_menu('comments',
-                              { icon: 'comments', title: t('camaleon_cms.admin.sidebar.comments'), url: cama_admin_comments_path,
-                                datas: "data-intro='#{t('camaleon_cms.admin.intro.comments')}' data-position='right'" })
+        if can? :manage, :comments
+          admin_menu_add_menu(
+            'comments',
+            {
+              icon: 'comments', title: t('camaleon_cms.admin.sidebar.comments'), url: cama_admin_comments_path,
+              datas: "data-intro='#{t('camaleon_cms.admin.intro.comments')}' data-position='right'"
+            }
+          )
         end
 
         items = []
-        if can? :manage,
-                :themes
-          items << { icon: 'desktop', title: t('camaleon_cms.admin.sidebar.themes'), url: cama_admin_appearances_themes_path,
-                     datas: "data-intro='#{t('camaleon_cms.admin.intro.themes')}' data-position='right'" }
+        if can? :manage, :themes
+          items << {
+            icon: 'desktop', title: t('camaleon_cms.admin.sidebar.themes'), url: cama_admin_appearances_themes_path,
+            datas: "data-intro='#{t('camaleon_cms.admin.intro.themes')}' data-position='right'"
+          }
         end
-        if can? :manage,
-                :widgets
-          items << { icon: 'archive', title: t('camaleon_cms.admin.sidebar.widgets'),
-                     url: cama_admin_appearances_widgets_main_index_path, datas: "data-intro='#{t('camaleon_cms.admin.intro.widgets')}' data-position='right'" }
+        if can? :manage, :widgets
+          items << {
+            icon: 'archive', title: t('camaleon_cms.admin.sidebar.widgets'),
+            url: cama_admin_appearances_widgets_main_index_path,
+            datas: "data-intro='#{t('camaleon_cms.admin.intro.widgets')}' data-position='right'"
+          }
         end
-        if can? :manage,
-                :nav_menu
-          items << { icon: 'list', title: t('camaleon_cms.admin.sidebar.menus'), url: cama_admin_appearances_nav_menus_path,
-                     datas: "data-intro='#{t('camaleon_cms.admin.intro.menus', image: view_context.asset_path('camaleon_cms/admin/intro/menus.png'))}' data-position='right'" }
+        if can? :manage, :nav_menu
+          intro_menus_data =
+            t('camaleon_cms.admin.intro.menus', image: view_context.asset_path('camaleon_cms/admin/intro/menus.png'))
+          items << {
+            icon: 'list', title: t('camaleon_cms.admin.sidebar.menus'), url: cama_admin_appearances_nav_menus_path,
+            datas: "data-intro='#{intro_menus_data}' data-position='right'"
+          }
         end
-        if can? :manage,
-                :shortcodes
-          items << { icon: 'code', title: t('camaleon_cms.admin.sidebar.shortcodes', default: 'Shortcodes'),
-                     url: cama_admin_settings_shortcodes_path, datas: "data-intro='#{t('camaleon_cms.admin.intro.shortcodes')}' data-position='right'" }
+        if can? :manage, :shortcodes
+          items << {
+            icon: 'code', title: t('camaleon_cms.admin.sidebar.shortcodes', default: 'Shortcodes'),
+            url: cama_admin_settings_shortcodes_path,
+            datas: "data-intro='#{t('camaleon_cms.admin.intro.shortcodes')}' data-position='right'"
+          }
         end
         if items.present?
-          admin_menu_add_menu('appearance',
-                              { icon: 'paint-brush', title: t('camaleon_cms.admin.sidebar.appearance'), url: '', items: items,
-                                datas: "data-intro='#{t('camaleon_cms.admin.intro.appearance')}' data-position='right' data-wait='500'" })
+          admin_menu_add_menu(
+            'appearance',
+            {
+              icon: 'paint-brush', title: t('camaleon_cms.admin.sidebar.appearance'), url: '', items: items,
+              datas: "data-intro='#{t('camaleon_cms.admin.intro.appearance')}' data-position='right' data-wait='500'"
+            }
+          )
         end
 
-        if can? :manage,
-                :plugins
-          admin_menu_add_menu('plugins', { icon: 'plug', title: "#{t('camaleon_cms.admin.sidebar.plugins')} <small class='label label-primary'>#{PluginRoutes.all_plugins.clone.delete_if do |plugin|
-                                                                                                                                                   plugin[:domain].present? && !plugin[:domain].split(',').include?(current_site.the_slug)
-                                                                                                                                                 end.size}</small>", url: cama_admin_plugins_path, datas: "data-intro='#{t('camaleon_cms.admin.intro.plugins')}' data-position='right'" })
+        if can? :manage, :plugins
+          plugin_count = PluginRoutes.all_plugins.count do |plugin|
+            !(plugin[:domain].present? && !plugin[:domain].split(',').include?(current_site.the_slug))
+          end
+          admin_menu_add_menu(
+            'plugins',
+            {
+              icon: 'plug',
+              title: safe_join([
+                                 t('camaleon_cms.admin.sidebar.plugins'),
+                                 ' ',
+                                 content_tag(:small, plugin_count, class: 'label label-primary')
+                               ]),
+              url: cama_admin_plugins_path,
+              datas: "data-intro='#{t('camaleon_cms.admin.intro.plugins')}' data-position='right'"
+            }
+          )
         end
 
         if can? :manage, :users
@@ -95,117 +131,154 @@ module CamaleonCms
           items << { icon: 'list', title: t('camaleon_cms.admin.users.all_users'), url: cama_admin_users_path }
           items << { icon: 'plus', title: t('camaleon_cms.admin.users.add_user'), url: new_cama_admin_user_path }
           items << { icon: 'group', title: t('camaleon_cms.admin.users.user_roles'), url: cama_admin_user_roles_path }
-          admin_menu_add_menu('users',
-                              { icon: 'users', title: t('camaleon_cms.admin.sidebar.users'), url: '', items: items,
-                                datas: "data-intro='#{t('camaleon_cms.admin.intro.users')}' data-position='right' data-wait='500'" })
+          admin_menu_add_menu(
+            'users',
+            {
+              icon: 'users', title: t('camaleon_cms.admin.sidebar.users'), url: '', items: items,
+              datas: "data-intro='#{t('camaleon_cms.admin.intro.users')}' data-position='right' data-wait='500'"
+            }
+          )
         end
 
         items = []
         if can? :manage, :settings
-          items << { icon: 'desktop', title: t('camaleon_cms.admin.sidebar.general_site'),
-                     url: cama_admin_settings_site_path, datas: "data-intro='#{t('camaleon_cms.admin.intro.gral_site')}' data-position='right'" }
+          items << {
+            icon: 'desktop', title: t('camaleon_cms.admin.sidebar.general_site'),
+            url: cama_admin_settings_site_path,
+            datas: "data-intro='#{t('camaleon_cms.admin.intro.gral_site')}' data-position='right'"
+          }
           if current_site.manage_sites?
-            items << { icon: 'cog', title: t('camaleon_cms.admin.sidebar.sites'), url: cama_admin_settings_sites_path,
-                       datas: "data-intro='#{t('camaleon_cms.admin.intro.sites')}' data-position='right'" }
+            items << {
+              icon: 'cog', title: t('camaleon_cms.admin.sidebar.sites'),
+              url: cama_admin_settings_sites_path,
+              datas: "data-intro='#{t('camaleon_cms.admin.intro.sites')}' data-position='right'"
+            }
           end
-          items << { icon: 'files-o', title: t('camaleon_cms.admin.sidebar.content_groups'),
-                     url: cama_admin_settings_post_types_path, datas: "data-intro='#{t('camaleon_cms.admin.intro.post_type')}' data-position='right'" }
-          items << { icon: 'cog', title: t('camaleon_cms.admin.sidebar.custom_fields'),
-                     url: cama_admin_settings_custom_fields_path, datas: "data-intro='#{t('camaleon_cms.admin.intro.custom_fields')}' data-position='right'" }
-          items << { icon: 'language', title: t('camaleon_cms.admin.sidebar.languages'),
-                     url: cama_admin_settings_languages_path, datas: "data-intro='#{t('camaleon_cms.admin.intro.languages')}' data-position='right'" }
+          items << {
+            icon: 'files-o', title: t('camaleon_cms.admin.sidebar.content_groups'),
+            url: cama_admin_settings_post_types_path,
+            datas: "data-intro='#{t('camaleon_cms.admin.intro.post_type')}' data-position='right'"
+          }
+          items << {
+            icon: 'cog', title: t('camaleon_cms.admin.sidebar.custom_fields'),
+            url: cama_admin_settings_custom_fields_path,
+            datas: "data-intro='#{t('camaleon_cms.admin.intro.custom_fields')}' data-position='right'"
+          }
+          items << {
+            icon: 'language', title: t('camaleon_cms.admin.sidebar.languages'),
+            url: cama_admin_settings_languages_path,
+            datas: "data-intro='#{t('camaleon_cms.admin.intro.languages')}' data-position='right'"
+          }
         end
 
-        if can? :manage,
-                :theme_settings
-          items << { icon: 'windows', title: t('camaleon_cms.admin.settings.theme_setting', default: 'Theme Settings'),
-                     url: cama_admin_settings_theme_path }
+        if can? :manage, :theme_settings
+          items << {
+            icon: 'windows', title: t('camaleon_cms.admin.settings.theme_setting', default: 'Theme Settings'),
+            url: cama_admin_settings_theme_path
+          }
         end
-        return unless items.present?
+        return if items.blank?
 
-        admin_menu_add_menu('settings',
-                            { icon: 'cogs', title: t('camaleon_cms.admin.sidebar.settings'), url: '', items: items,
-                              datas: "data-intro='#{t('camaleon_cms.admin.intro.settings')}' data-position='right' data-wait='500'" })
+        admin_menu_add_menu(
+          'settings',
+          {
+            icon: 'cogs', title: t('camaleon_cms.admin.sidebar.settings'), url: '', items: items,
+            datas: "data-intro='#{t('camaleon_cms.admin.intro.settings')}' data-position='right' data-wait='500'"
+          }
+        )
       end
 
-      # add menu item to admin menu at the the end
-      # key: key for menu
-      # menu: is hash like this: {icon: "dashboard", title: "My title", url: my_path, items: [sub menus]}
+      # add a menu item to the menu at the end
+      # key: key for the menu
+      # menu: is hash like this: { icon: "dashboard", title: "My title", url: my_path, items: [sub menus] }
       # - icon: font-awesome icon (it is already included "fa fa-")
       # - title: title for the menu
       # - url: url for the menu
-      # - items: is an recursive array of the menus without a key
-      # - datas: html data text for this menu item
+      # - items: is a recursive array of the menus without a key
+      # - datas: HTML data text for this menu item
       def admin_menu_add_menu(key, menu)
-        @_admin_menus[key] = menu
+        CurrentRequest.admin_menu_items ||= {}
+        CurrentRequest.admin_menu_items[key] = menu
       end
 
-      # append sub menu to menu with key = key
+      # append sub menu to menu with a key = key
       # menu: is hash like this: {icon: "dashboard", title: "My title", url: my_path, items: [sub menus]}
       def admin_menu_append_menu_item(key, menu)
-        return unless @_admin_menus[key].present?
+        CurrentRequest.admin_menu_items ||= {}
+        return if CurrentRequest.admin_menu_items[key].blank?
 
-        @_admin_menus[key][:items] = [] unless @_admin_menus[key].key?(:items)
-        @_admin_menus[key][:items] << menu
+        CurrentRequest.admin_menu_items[key][:items] = [] unless CurrentRequest.admin_menu_items[key].key?(:items)
+        CurrentRequest.admin_menu_items[key][:items] << menu
       end
 
-      # prepend sub menu to menu with key = key
-      # menu: is hash like this: {icon: "dashboard", title: "My title", url: my_path, items: [sub menus]}
+      # prepend submenu to menu with key = key
+      # menu: is hash like this: { icon: "dashboard", title: "My title", url: my_path, items: [sub menus] }
       def admin_menu_prepend_menu_item(key, menu)
-        return unless @_admin_menus[key].present?
+        CurrentRequest.admin_menu_items ||= {}
+        return if CurrentRequest.admin_menu_items[key].blank?
 
-        @_admin_menus[key][:items] = [] unless @_admin_menus[key].key?(:items)
-        @_admin_menus[key][:items] = [menu] + @_admin_menus[key][:items]
+        CurrentRequest.admin_menu_items[key][:items] = [] unless CurrentRequest.admin_menu_items[key].key?(:items)
+        CurrentRequest.admin_menu_items[key][:items] = [menu] + CurrentRequest.admin_menu_items[key][:items]
       end
 
-      # add menu before menu with key = key_target
+      # add the menu before the menu with key = key_target
       # key_menu: key for menu
-      # menu: is hash like this: {icon: "dashboard", title: "My title", url: my_path, items: [sub menus]}
+      # menu: is hash like this: { icon: "dashboard", title: "My title", url: my_path, items: [sub menus] }
       def admin_menu_insert_menu_before(key_target, key_menu, menu)
-        res = {}
-        @_admin_menus.each do |key, val|
-          res[key_menu] = menu if key == key_target
-          res[key] = val
+        CurrentRequest.admin_menu_items ||= {}
+        res = CurrentRequest.admin_menu_items.each_with_object({}) do |(key, val), hsh|
+          hsh[key_menu] = menu if key == key_target
+          hsh[key] = val
         end
-        @_admin_menus = res
+        CurrentRequest.admin_menu_items.replace(res) # mutate in place so @_admin_menus stays a live alias (M19)
       end
 
       # add menu after menu with key = key_target
       # key_menu: key for menu
       # menu: is hash like this: {icon: "dashboard", title: "My title", url: my_path, items: [sub menus]}
       def admin_menu_insert_menu_after(key_target, key_menu, menu)
-        res = {}
-        @_admin_menus.each do |key, val|
-          res[key] = val
-          res[key_menu] = menu if key == key_target
+        CurrentRequest.admin_menu_items ||= {}
+        res = CurrentRequest.admin_menu_items.each_with_object({}) do |(key, val), hsh|
+          hsh[key] = val
+          hsh[key_menu] = menu if key == key_target
         end
-        @_admin_menus = res
+        CurrentRequest.admin_menu_items.replace(res) # mutate in place so @_admin_menus stays a live alias (M19)
       end
 
       # draw admin menu as html
       def admin_menu_draw
-        res = []
-        @_tmp_menu_parents = []
-        menus = _get_url_current
-        menus.each do |menu|
-          res << "<li data-key='#{menu[:key]}' class='#{if menu.key?(:items)
-                                                          'treeview'
-                                                        end} #{if is_active_menu(menu[:key])
-                                                                 'active'
-                                                               end}' #{menu[:datas]}>
-        <a href='#{menu[:url]}'><i class='fa fa-#{menu[:icon]}'></i> <span class=''>#{menu[:title]}</span> #{if menu.key?(:items)
-                                                                                                               '<i class="fa fa-angle-left pull-right"></i>'
-                                                                                                             end}</a>
-        #{_admin_menu_draw(menu[:items]) if menu.key?(:items)}
-      </li>"
-        end
-        res.join
+        CurrentRequest.admin_menu_items ||= {}
+        menu_parents = []
+        menus = _get_url_current(CurrentRequest.admin_menu_items, menu_parents)
+        safe_join(menus.map do |menu|
+          css_class = +''
+          css_class << 'treeview ' if menu.key?(:items)
+          css_class << 'active' if is_active_menu(menu[:key], menu_parents)
+          css_class.strip!
+          data_attrs = parse_datas(menu[:datas])
+          content_tag(
+            :li, ''.html_safe,
+            class: css_class.presence, data: { key: menu[:key] }.merge!(data_attrs.presence || {})
+          ) do
+            safe_join([
+              content_tag(:a, href: menu[:url]) do
+                safe_join([
+                  content_tag(:i, nil, class: "fa fa-#{menu[:icon]}"),
+                  ' ',
+                  content_tag(:span, cama_admin_menu_title(menu[:title])),
+                  (content_tag(:i, nil, class: 'fa fa-angle-left pull-right') if menu.key?(:items))
+                ].compact)
+              end,
+              (_admin_menu_draw(menu[:items], menu_parents) if menu.key?(:items))
+            ].compact)
+          end
+        end)
       end
 
       private
 
-      def _get_url_current
-        menus = @_admin_menus.map do |key, menu|
+      def _get_url_current(menus, menu_parents)
+        menus = menus.map do |key, menu|
           menu[:key] = key
           menu
         end
@@ -213,7 +286,7 @@ module CamaleonCms
         current_path_array = current_path.split('/')
         a_size = current_path_array.size
         (0..a_size).each do |i|
-          resp = _search_in_menus(menus, current_path_array[0..a_size - i].join('/'))
+          resp = _search_in_menus(menus, current_path_array[0..a_size - i].join('/'), 0, menu_parents)
           bool = resp[:bool]
           menus = resp[:menus]
           break if bool
@@ -221,11 +294,11 @@ module CamaleonCms
         menus
       end
 
-      def is_active_menu(key)
-        @_tmp_menu_parents.map { |item| item[:key] == key }.include?(true)
+      def is_active_menu(key, menu_parents)
+        menu_parents.map { |item| item[:key] == key }.include?(true)
       end
 
-      def _search_in_menus(menus, _url, parent_index = 0)
+      def _search_in_menus(menus, _url, parent_index = 0, menu_parents = [])
         bool = false
         menus.each_with_index do |menu, _index_menu|
           menu[:key] = "#{parent_index}__#{rand(999...99_999)}" if menu[:key].nil?
@@ -235,38 +308,75 @@ module CamaleonCms
           bool = url_path.to_s == _url.to_s && url_path.present?
           # params compare
           if url_query.present?
-            bool &&= Rack::Utils.parse_nested_query(url_query.to_s) == Rack::Utils.parse_nested_query(URI(site_current_url).query.to_s)
+            menu_params = Rack::Utils.parse_nested_query(url_query.to_s)
+            current_params = Rack::Utils.parse_nested_query(URI(site_current_url).query.to_s)
+            bool &&= menu_params == current_params
           end
           if menu.key?(:items)
-            resp = _search_in_menus(menu[:items], _url, parent_index + 1)
+            resp = _search_in_menus(menu[:items], _url, parent_index + 1, menu_parents)
             bool ||= resp[:bool]
             menu[:items] = resp[:menus]
           end
           if bool
-            @_tmp_menu_parents[parent_index] = { url: menu[:url], title: menu[:title], key: menu[:key] }
+            menu_parents[parent_index] = { url: menu[:url], title: menu[:title], key: menu[:key] }
             break
           end
         end
         { menus: menus, bool: bool }
       end
 
-      def _admin_menu_draw(items)
-        res = []
-        res << "<ul class='treeview-menu'>"
-        items.each_with_index do |item, index|
-          res << "<li class='#{if item.key?(:items)
-                                 'xn-openable'
-                               end} item_#{index + 1} #{if is_active_menu(item[:key])
-                                                          'active'
-                                                        end}' #{item[:datas]}>
-                <a href='#{item[:url]}'><i class='fa fa-#{item[:icon]}'></i> #{item[:title]} #{if item.key?(:items)
-                                                                                                 '<i class="fa fa-angle-left pull-right"></i>'
-                                                                                               end}</a>
-                #{_admin_menu_draw(item[:items]) if item.key?(:items)}
-              </li>"
+      def _admin_menu_draw(items, menu_parents)
+        return ''.html_safe if items.blank?
+
+        content_tag(:ul, class: 'treeview-menu') do
+          safe_join(items.each_with_index.map do |item, index|
+            css_class = +"item_#{index + 1} "
+            css_class << 'xn-openable ' if item.key?(:items)
+            css_class << 'active ' if is_active_menu(item[:key], menu_parents)
+            css_class.strip!
+            data_attrs = parse_datas(item[:datas])
+            content_tag(
+              :li, ''.html_safe,
+              class: css_class.presence,
+              data: { key: item[:key] }.merge!(data_attrs.presence || {})
+            ) do
+              safe_join([
+                content_tag(:a, href: item[:url]) do
+                  safe_join([
+                    content_tag(:i, nil, class: "fa fa-#{item[:icon]}"),
+                    ' ',
+                    cama_admin_menu_title(item[:title]),
+                    (content_tag(:i, nil, class: 'fa fa-angle-left pull-right') if item.key?(:items))
+                  ].compact)
+                end,
+                (item.key?(:items) ? _admin_menu_draw(item[:items], menu_parents) : nil)
+              ].compact)
+            end
+          end)
+        end
+      end
+
+      # Menu titles may carry inline formatting (e.g. camaleon-ecommerce's count badge). Core builds its
+      # titles as SafeBuffers via safe_join/content_tag and those pass through untouched; a plain-String
+      # title from a plugin is sanitized to a safe inline subset — the badge renders, scripts and event
+      # handlers are stripped — rather than escaped whole. Regression M22.
+      def cama_admin_menu_title(title)
+        return title if title.is_a?(ActiveSupport::SafeBuffer)
+
+        sanitize(title.to_s, tags: %w[span small i b strong em], attributes: %w[class])
+      end
+
+      def parse_datas(datas_string)
+        return {} if datas_string.blank?
+
+        result = {}
+        # Match single- or double-quoted values so a value may contain the other quote character. The
+        # old /['"]([^'"]*)['"]/ stopped at the first quote of either kind, truncating data-intro
+        # strings that carry HTML (e.g. the Menus tooltip's <img ... style="...">). Regression M22.
+        datas_string.scan(/data-([\w-]+)=(?:'([^']*)'|"([^"]*)")/).each do |key, single, double|
+          result[key.to_sym] = single || double
         end
-        res << '</ul>'
-        res.join
+        result
       end
     end
   end