camaleon_cms 2.9.1 → 2.9.3

data/app/helpers/camaleon_cms/admin/post_type_helper.rb

@@ -11,38 +11,45 @@ module CamaleonCms
       end
 
       def post_type_status(status, color = 'default')
-        "<span class='label label-#{color} label-form'>#{status}</span>"
+        content_tag(:span, status, class: "label label-#{color} label-form")
       end
 
       # taxonomies ->  (categories || post_tags)
-      def post_type_list_taxonomy(taxonomies, color = 'primary')
-        html = ''
-        taxonomies.decorate.each do |f|
-          html += "<a class='cama_ajax_request' href='#{cama_admin_post_type_taxonomy_posts_path(@post_type.id,
-                                                                                                 f.taxonomy, f.id)}'><span class='label label-#{color} label-form'>#{f.the_title}</span></a> "
-        end
-        html
+      def post_type_list_taxonomy(taxonomies, color = 'primary', post_type = nil)
+        # Legacy 2-arg call sites (e.g. overridden admin posts-index views, camaleon-ecommerce) omit
+        # post_type and expect the controller's @post_type. Restored from #1178; see regression M23.
+        post_type ||= controller.instance_variable_get(:@post_type) if respond_to?(:controller)
+        return safe_join([]) if post_type.blank?
+
+        safe_join(taxonomies.decorate.map do |f|
+          link_to(
+            cama_admin_post_type_taxonomy_posts_path(post_type.id, f.taxonomy, f.id), class: 'cama_ajax_request'
+          ) do
+            content_tag(:span, f.the_title, class: "label label-#{color} label-form")
+          end
+        end, ' ')
       end
 
       # sort array of posts to build post's tree
       # skip_non_parent_posts: don't include post's where root post doesn't exist
       # internal control for recursive items
-      def cama_hierarchy_post_list(posts_list, parent_id = nil, skip_non_parent_posts = false)
+      def cama_hierarchy_post_list(posts_list, parent_id = nil, skip_non_parent_posts = false,
+                                   no_parent_accumulator = nil)
+        no_parent_accumulator ||= posts_list.clone
         res = []
-        @_cama_hierarchy_post_list_no_parent ||= posts_list.clone
         posts_list.each do |element|
           next unless element.post_parent.to_s == parent_id.to_s
 
           res << element
-          @_cama_hierarchy_post_list_no_parent.delete_item(element)
-          res += cama_hierarchy_post_list(posts_list, element.id)
+          no_parent_accumulator.delete_item(element)
+          res += cama_hierarchy_post_list(posts_list, element.id, false, no_parent_accumulator)
         end
 
-        if !parent_id.present? && !skip_non_parent_posts
-          @_cama_hierarchy_post_list_no_parent.each do |element|
+        if parent_id.blank? && !skip_non_parent_posts
+          no_parent_accumulator.each do |element|
             element.show_title_with_parent = true
             res << element
-            res += cama_hierarchy_post_list(posts_list, element.id)
+            res += cama_hierarchy_post_list(posts_list, element.id, false, no_parent_accumulator)
           end
         end
         res
@@ -53,24 +60,37 @@ module CamaleonCms
       def post_type_taxonomy_html_(categories, taxonomy = 'categories', name = 'categories', type = 'checkbox',
                                    values = [], class_cat = '', required = false)
         if categories.count < 1
-          return t('camaleon_cms.admin.post_type.message.no_created_html',
-                   taxonomy: taxonomy == 'categories' ? t('camaleon_cms.admin.table.categories') : t('camaleon_cms.admin.table.tags')).to_s
+          # Interpolate the translated taxonomy label, not the raw 'categories'/'post_tags' slug
+          # (the label was computed here and discarded before).
+          taxonomy_label = if taxonomy == 'categories'
+                             t('camaleon_cms.admin.table.categories')
+                           else
+                             t('camaleon_cms.admin.table.tags')
+                           end
+          return t('camaleon_cms.admin.post_type.message.no_created_html', taxonomy: taxonomy_label)
         end
 
-        html = "<ul class='#{class_cat}'>"
-        categories.decorate.each do |f|
-          html += '<li>'
-          html +=  "<label class='class_slug' data-post_link_edit='#{f.the_edit_url}'> "
-          html +=  "<input data-error-place='#validation_error_list_#{name}' type='#{type}' name='#{name}[]' #{values.to_i.include?(f.id) ? 'checked' : ''} value='#{f.id}' class = '#{if required
-                                                                                                                                                                                         'required'
-                                                                                                                                                                                       end}' />"
-          html += "#{f.the_title} </label> "
-          html += post_type_html_inputs(f, 'children', name, type, values, 'children') if f.children.present?
-          html += '</li>'
-        end
-
-        html += "</ul><div id='validation_error_list_#{name}'></div>"
-        html
+        content_tag(:ul, class: class_cat) do
+          items = categories.decorate.map do |f|
+            content_tag(:li) do
+              is_checked = Array(values).map(&:to_s).include?(f.id.to_s)
+              input_options = {
+                class: (required ? 'required' : ''), data: { error_place: "#validation_error_list_#{name}" }
+              }
+              input_tag = if type == 'radio'
+                            radio_button_tag("#{name}[]", f.id, is_checked, input_options)
+                          else
+                            check_box_tag("#{name}[]", f.id, is_checked, input_options)
+                          end
+              res = content_tag(:label, class: 'class_slug', data: { post_link_edit: f.the_edit_url }) do
+                safe_join([input_tag, ' ', f.the_title.to_s, ' '])
+              end
+              res << post_type_html_inputs(f, 'children', name, type, values, 'children') if f.children.present?
+              res
+            end
+          end
+          safe_join(items)
+        end + content_tag(:div, '', id: "validation_error_list_#{name}")
       end
     end
   end

data/app/helpers/camaleon_cms/camaleon_helper.rb

@@ -4,31 +4,15 @@ module CamaleonCms
     # verify if current user is logged in, if not, then return nil
     # return html link
     def cama_edit_link(url, title = nil, attrs = {})
-      return '' unless cama_current_user.present?
+      return '' if cama_current_user.blank?
       return '' unless cama_current_user.admin?
 
       attrs = { target: '_blank', style: 'font-size:11px !important;cursor:pointer;' }.merge(attrs)
-      ActionController::Base.helpers.link_to("→ #{title || ct('edit', default: 'Edit')}".html_safe, url, attrs)
-    end
-
-    # execute controller action and return response
-    # NON USED
-    def cama_requestAction(controller, action, params = {})
-      controller.class_eval do
-        def params=(params)
-          @params = params
-        end
-
-        def params
-          @params
-        end
-      end
-      c = controller.new
-      c.request = @_request
-      c.response = @_response
-      c.params = params
-      c.send(action)
-      c.response.body
+      link_to(
+        safe_join(['→ ', title || ct('edit', default: 'Edit')]),
+        url,
+        attrs
+      )
     end
 
     # theme common translation text
@@ -44,26 +28,37 @@ module CamaleonCms
       I18n.translate("camaleon_cms.common.#{key}", **args)
     end
 
-    # check if current request was for admin panel
+    # Public compatibility API for plugins such as camaleon-ecommerce, which use
+    # this predicate to switch from visitor pricing/locale behavior to admin mode.
+    # This still matters while previewing frontend content from admin, for example
+    # a theme preview that renders ecommerce helpers before the request reaches the
+    # public frontend controller stack.
     def cama_is_admin_request?
-      @cama_i18n_frontend.present?
+      respond_to?(:cama_get_i18n_frontend) && cama_get_i18n_frontend.present?
     end
 
     # generate loop categories html sitemap links
     # this is a helper for sitemap generator to print categories, sub categories and post contents in html list format
-    def cama_sitemap_cats_generator(cats)
+    def cama_sitemap_cats_generator(cats, skip_config = {})
+      skip_config = {} unless skip_config.is_a?(Hash)
+      # merge! alone is not enough: an on_render_sitemap hook that sets one of these keys to nil
+      # overwrites the default with nil and brings back the very nil.include? crash the defaults
+      # exist to prevent. compact drops those before they win.
+      skip_config = { skip_cat_ids: [], skip_post_ids: [] }.merge!(skip_config.compact)
       res = []
       cats.decorate.each do |cat|
-        next if @r[:skip_cat_ids].include?(cat.id)
+        next if skip_config[:skip_cat_ids].include?(cat.id)
 
         res_posts = []
         cat.the_posts.decorate.each do |post|
-          next if @r[:skip_post_ids].include?(post.id)
+          next if skip_config[:skip_post_ids].include?(post.id)
 
-          res_posts << "<li><a href='#{post.the_url}'>#{post.the_title}</a></li>"
+          post_href = ERB::Util.html_escape(post.the_url)
+          res_posts << "<li><a href='#{post_href}'>#{post.the_title}</a></li>"
         end
-        res << "<li><h4><a href='#{cat.the_url}'>#{cat.the_title}</a></h4><ul>#{res_posts.join('')}</ul></li>"
-        res << cama_sitemap_cats_generator(cat.the_categories)
+        cat_href = ERB::Util.html_escape(cat.the_url)
+        res << "<li><h4><a href='#{cat_href}'>#{cat.the_title}</a></h4><ul>#{res_posts.join('')}</ul></li>"
+        res << cama_sitemap_cats_generator(cat.the_categories, skip_config)
       end
       res.join('')
     end
@@ -79,22 +74,19 @@ module CamaleonCms
       cache
     end
 
-    # =Deprecated
-    def cama_draw_timer
-      @_cama_timer ||= Time.current
-      puts "***************************************** timer: #{((Time.current - @_cama_timer) * 24 * 60 * 60).to_i}  (#{caller.first})"
-      @_cama_timer = Time.current
-    end
-
     # return normal translation with default value with translation of english
     def cama_t(key, args = {})
-      args[:default] = I18n.t(key, **args.dup.merge(locale: :en)) unless args[:default].present?
+      args[:default] = I18n.t(key, **args.dup.merge(locale: :en)) if args[:default].blank?
       I18n.t(key, **args)
     end
 
     # function that converts string into plural format
+    # `SafeBuffer#pluralize` returns a plain String, so callers composing the result with other
+    # markup lose the safe flag before they can use it. The safeness of the input is propagated --
+    # never added, so an unsafe input stays unsafe and no caller becomes less safe than before.
     def cama_pluralize_text(text)
-      text.try(:pluralize)
+      res = text.try(:pluralize)
+      text.try(:html_safe?) ? res.try(:html_safe) : res
     end
   end
 end

data/app/helpers/camaleon_cms/captcha_helper.rb

@@ -1,78 +1,112 @@
 module CamaleonCms
   module CaptchaHelper
-    # build a captcha image
-    # len: Number or characters to include in captcha (default 5)
-    def cama_captcha_build(len = 5)
-      img = MiniMagick::Image.open(File.join($camaleon_engine_dir.present? ? $camaleon_engine_dir : Rails.root.to_s,
-                                             'lib', 'captcha', "captcha_#{rand(12)}.jpg").to_s)
-      text = cama_rand_str(len)
-      session[:cama_captcha] = [] unless session[:cama_captcha].present?
-      session[:cama_captcha] << text
-      img.combine_options do |c|
-        c.gravity 'Center'
-        c.fill('#FFFFFF')
-        c.draw "text 0,5 #{text}"
-        c.font File.join($camaleon_engine_dir.present? ? $camaleon_engine_dir : Rails.root.to_s, 'lib', 'captcha',
-                         'bumpyroad.ttf')
-        c.pointsize '30'
-      end
-      img
-    end
+    # Challenge/image generation (including the length clamp and its constants) lives in
+    # CamaleonCms::CaptchaImageGeneration, shared with the controller-stack
+    # CamaleonCms::RuntimeCaptchaImageConcern; verification and the under-attack counters
+    # below exist only here.
+    include CamaleonCms::CaptchaImageGeneration
 
     # build a captcha tag (image with captcha)
     # img_args: attributes for image_tag
     # input_args: attributes for input field
     def cama_captcha_tag(len = 5, img_args = { alt: '' }, input_args = {}, bootstrap_group_mode = false)
-      unless input_args[:placeholder].present?
+      # Symbolize so string-keyed args work: the :placeholder / :style reads below use Symbol keys,
+      # so a caller's String key would be missed — the default placeholder would then be added under
+      # the Symbol key and render as a duplicate attribute.
+      img_args = img_args.to_h.symbolize_keys
+      input_args = input_args.to_h.symbolize_keys
+      if input_args[:placeholder].blank?
         input_args[:placeholder] =
-          I18n.t('camaleon_cms.captcha_placeholder',
-                 default: 'Please enter the text of the image')
+          I18n.t('camaleon_cms.captcha_placeholder', default: 'Please enter the text of the image')
       end
-      img_args['onclick'] = "this.src = \"#{cama_captcha_url(len: len)}\"+\"&t=\"+(new Date().getTime());"
-      img = "<img style='cursor: pointer;' src='#{cama_captcha_url(len: len,
-                                                                   t: Time.current.to_i)}' #{img_args.collect do |k, v|
-                                                                                               "#{k}='#{v}'"
-                                                                                             end.join(' ')} />"
-      input = "<input type='text' name='captcha' #{input_args.collect { |k, v| "#{k}='#{v}'" }.join(' ')} />"
+      img_args[:onclick] = "this.src = \"#{cama_captcha_url(len: len)}\"+\"&t=\"+(new Date().getTime());"
+      # Keep a caller-supplied style; the pointer cursor is required for click-to-refresh, so prepend it.
+      img_args[:style] = ['cursor: pointer;', img_args[:style].presence].compact.join(' ')
+
+      helpers = ActionController::Base.helpers
+      img = helpers.image_tag(cama_captcha_url(len: len, t: Time.current.to_i), img_args)
+      input = helpers.tag(:input, type: 'text', name: 'captcha', **input_args)
+
       if bootstrap_group_mode
-        "<div class='input-group input-group-captcha'><span class='input-group-btn' style='vertical-align: top;'>#{img}</span>#{input}</div>"
+        span = helpers.content_tag(:span, img, class: 'input-group-btn', style: 'vertical-align: top;')
+        helpers.content_tag(:div, helpers.safe_join([span, input]), class: 'input-group input-group-captcha')
       else
-        "<div class='input-group-captcha'>#{img}#{input}</div>"
+        helpers.content_tag(:div, helpers.safe_join([img, input]), class: 'input-group-captcha')
       end
     end
 
-    # verify captcha value
+    # verify captcha value against the single active challenge and consume it on success, so a solved
+    # captcha is single-use and a blank submission can never match (H3).
     def cama_captcha_verified?
-      (session[:cama_captcha] || []).include?((params[:cama_captcha] || params[:captcha]).to_s.upcase)
+      submitted = (params[:cama_captcha] || params[:captcha]).to_s.upcase
+      return false if submitted.blank?
+      return false unless Array(session[:cama_captcha]).include?(submitted)
+
+      session.delete(:cama_captcha)
+      true
     end
 
     # ************************* captcha in attack helpers ***************************#
+    # Failed attempts are counted BOTH per session and per client IP. The per-IP counter lives in
+    # Rails.cache and is the server-side signal an attacker cannot reset by dropping the session
+    # cookie (audit finding H1); it rolls off CAMA_ATTACK_WINDOW after the last failure.
+    CAMA_ATTACK_WINDOW = 15.minutes
+
     # check if the current visitor was submitted 5+ times
     # key: a string to represent a url or form view
     # key must be the same as the form "captcha_tags_if_under_attack(key, ...)"
     def cama_captcha_under_attack?(key)
       session["cama_captcha_#{key}"] ||= 0
-      session["cama_captcha_#{key}"].to_i > current_site.get_option('max_try_attack', 5).to_i
+      max = current_site.get_option('max_try_attack', 5).to_i
+      session["cama_captcha_#{key}"].to_i > max || cama_captcha_attack_ip_count(key) > max
     end
 
-    # verify captcha values if this key is under attack
-    # key: a string to represent a url or form view
+    # per-IP failed-attempt count for this key (0 when the counter is unset). Reads raw so the
+    # value round-trips as a bare integer on Redis/Memcached (see cama_captcha_increment_attack).
+    # Assumes a request + current_site context, which the admin login flow always has.
+    def cama_captcha_attack_ip_count(key)
+      Rails.cache.read(cama_captcha_attack_ip_key(key), raw: true).to_i
+    end
+
+    # verify the captcha only when this key is under attack; reports solely whether the
+    # current challenge was solved. The attack counter is cleared only by an explicit
+    # cama_captcha_reset_attack once the protected action itself succeeds (as the login
+    # flows do), so solving a captcha can no longer buy captcha-free attempts for an
+    # otherwise failing action. When the key is not under attack, the pending challenge
+    # is left unconsumed for whatever form it belongs to.
     def captcha_verify_if_under_attack(key)
-      res = cama_captcha_under_attack?(key) ? cama_captcha_verified? : true
-      session["cama_captcha_#{key}"] = 0 if cama_captcha_verified?
-      res
+      return true unless cama_captcha_under_attack?(key)
+
+      cama_captcha_verified?
     end
 
-    # increment attempts for key by 1
+    # increment attempts for key by 1 (both the per-session and the per-IP counter)
     def cama_captcha_increment_attack(key)
       session["cama_captcha_#{key}"] ||= 0
       session["cama_captcha_#{key}"] = session["cama_captcha_#{key}"].to_i + 1
+      # Per-IP counter: an ATOMIC cache increment, not a read-then-write. Concurrent failures from
+      # one IP would otherwise race on read+write and lose updates, undercounting a burst and
+      # deferring both the captcha gate and the hard lockout. `raw: true` keeps the value a bare
+      # integer so Redis/Memcached INCR operates on it (a no-op on Memory/File stores); refreshing
+      # the TTL on every increment keeps the rolling window alive during a sustained attack.
+      cache_key = cama_captcha_attack_ip_key(key)
+      counted = Rails.cache.increment(cache_key, 1, expires_in: CAMA_ATTACK_WINDOW, raw: true)
+      # Older FileStore/MemoryStore (Rails < 7.1) return nil for a missing key instead of seeding it;
+      # seed it then. This one-time seed's own race is harmless (count 1 vs 2 is far from any
+      # threshold) and every subsequent increment is atomic.
+      Rails.cache.write(cache_key, 1, expires_in: CAMA_ATTACK_WINDOW, raw: true) if counted.nil?
     end
 
-    # reset the attacks counter for key
+    # reset the attacks counter for key (both the per-session and the per-IP counter)
     # key: a string to represent a url or form view
     def cama_captcha_reset_attack(key)
       session["cama_captcha_#{key}"] = 0
+      Rails.cache.delete(cama_captcha_attack_ip_key(key))
+    end
+
+    # cache key for the per-IP attack counter, scoped to the site and the form key
+    def cama_captcha_attack_ip_key(key)
+      "cama_captcha_attack:#{current_site.id}:#{request.remote_ip}:#{key}"
     end
 
     # return a number of attempts for key
@@ -86,19 +120,5 @@ module CamaleonCms
     def cama_captcha_tags_if_under_attack(key, captcha_parmas = [5, {}, { class: 'form-control required' }])
       cama_captcha_tag(*captcha_parmas) if cama_captcha_under_attack?(key)
     end
-
-    private
-
-    # generate random string for captcha
-    # len: length of characters, default 6
-    def cama_rand_str(len = 6)
-      alphabets = [('A'..'Z').to_a].flatten!
-      alphanumerics = [('A'..'Z').to_a, ('1'..'9').to_a].flatten!
-      str = alphabets[rand(alphabets.size)]
-      (len.to_i - 1).times do
-        str << alphanumerics[rand(alphanumerics.size)]
-      end
-      str
-    end
   end
 end

data/app/helpers/camaleon_cms/comment_helper.rb

@@ -1,5 +1,7 @@
 module CamaleonCms
   module CommentHelper
+    LABELS = { 'approved' => 'success', 'pending' => 'warning', 'spam' => 'danger' }.freeze
+
     # return common data to save a new comment
     # user_id, author, aothor_email, author_ip, approved, :agent
     def cama_comments_get_common_data
@@ -15,48 +17,92 @@ module CamaleonCms
 
     # render as html content all comments recursively
     # comments: collection of comments
-    def cama_comments_render_html(comments)
-      res = ''
-      labels = { 'approved' => 'success', 'pending' => 'warning', 'spam' => 'danger' }
-      comments.decorate.each do |comment|
-        author = comment.the_author
-        res << "<div class='media'>
-                 <div class='media-left'>
-                    <a href='#{author.the_admin_profile_url}'>#{image_tag author.the_avatar, class: 'media-object',
-                                                                                             style: 'width: 64px; height: 64px;'}</a>
-                 </div>
-                 <div class='media-body'>
-                    <h4 class='media-heading'>#{author.the_name} <small>#{comment.the_created_at}</small> <span class='label label-#{labels[comment.approved]} pull-right'>#{t("camaleon_cms.admin.comments.message.#{comment.approved}")}</span></h4>
-                    <div class='comment_content'>#{sanitize comment.content}</div>
-                    <div class='comment_actions'>
-                        <div class='pull-left'>
-                            <a href='#{cama_admin_post_comment_answer_path(@post.id,
-                                                                           comment.id)}' data-comment-id='#{comment.id}' title='#{t('camaleon_cms.admin.comments.tooltip.reply_comment')}' class='btn btn-info reply btn-xs ajax_modal'><span class='fa fa-mail-reply'></span></a>
-                            #{link_to raw('<i class="fa fa-trash-o"></i>'), { action: :destroy, id: comment.id },
-                                      method: :delete, data: { confirm: t('camaleon_cms.admin.message.delete') }, class: 'btn btn-danger btn-xs cama_ajax_request', title: t('camaleon_cms.admin.comments.tooltip.delete_comment').to_s}
-                        </div>
-                        <div class='pull-right'>
-                            <a href='#{url_for({ action: :toggle_status, comment_id: comment.id,
-                                                 s: 'a' })}' title='#{t('camaleon_cms.admin.comments.tooltip.approved_comment')}' class='#{if comment.approved == 'approved'
-                                                                                                                                             'hidden'
-                                                                                                                                           end} btn btn-success approve btn-xs cama_ajax_request'><span class='fa fa-thumbs-o-up'></span></a>
-                            <a href='#{url_for({ action: :toggle_status, comment_id: comment.id,
-                                                 s: 'p' })}' title='#{t('camaleon_cms.admin.comments.tooltip.comment_pending')}' class='#{if comment.approved == 'pending'
-                                                                                                                                            'hidden'
-                                                                                                                                          end} btn btn-primary pending btn-xs cama_ajax_request'><span class='fa fa-warning'></span></a>
-                            <a href='#{url_for({ action: :toggle_status, comment_id: comment.id,
-                                                 s: 's' })}' title='#{t('camaleon_cms.admin.comments.tooltip.comment_spam')}' class='#{if comment.approved == 'spam'
-                                                                                                                                         'hidden'
-                                                                                                                                       end} btn btn-danger spam btn-xs cama_ajax_request'><span class='fa fa-bug'></span></a>
-                        </div>
-                    </div>
-                    <hr>
-                    <div class='clearfix'></div>
-                    #{cama_comments_render_html comment.children}
-                 </div>
-              </div>"
+    def cama_comments_render_html(comments, post_id = nil)
+      if post_id.nil? && respond_to?(:controller) && controller.respond_to?(:instance_variable_get)
+        post_id = controller.instance_variable_get(:@post)&.id
       end
-      res
+      comments.decorate.map do |comment|
+        author = comment.the_author
+        content_tag(:div, class: 'media') do
+          [
+            content_tag(:div, class: 'media-left') do
+              link_to(author.the_admin_profile_url) do
+                image_tag(author.the_avatar, class: 'media-object', style: 'width: 64px; height: 64px;')
+              end
+            end,
+            content_tag(:div, class: 'media-body') do
+              [
+                content_tag(:h4, class: 'media-heading') do
+                  [
+                    # Escape the author name: User first_name/last_name are no longer sanitized at
+                    # save time and this heading is marked html_safe below, so a commenter-controlled
+                    # name would otherwise be injected as raw HTML into the moderator's page.
+                    ERB::Util.html_escape(author.the_name),
+                    ' ',
+                    content_tag(:small, comment.the_created_at),
+                    ' ',
+                    content_tag(:span, t("camaleon_cms.admin.comments.message.#{comment.approved}"),
+                                class: "label label-#{LABELS[comment.approved]} pull-right")
+                  ].join.html_safe
+                end,
+                content_tag(:div, sanitize(comment.content), class: 'comment_content'),
+                content_tag(:div, class: 'comment_actions') do
+                  [
+                    content_tag(:div, class: 'pull-left') do
+                      [
+                        link_to(
+                          cama_admin_post_comment_answer_path(post_id, comment.id),
+                          data: { comment_id: comment.id },
+                          title: t('camaleon_cms.admin.comments.tooltip.reply_comment'),
+                          class: 'btn btn-info reply btn-xs ajax_modal'
+                        ) { content_tag(:span, '', class: 'fa fa-mail-reply') },
+                        ' ',
+                        link_to(
+                          { action: :destroy, id: comment.id },
+                          method: :delete,
+                          data: { confirm: t('camaleon_cms.admin.message.delete') },
+                          class: 'btn btn-danger btn-xs cama_ajax_request',
+                          title: t('camaleon_cms.admin.comments.tooltip.delete_comment')
+                        ) { content_tag(:i, '', class: 'fa fa-trash-o') }
+                      ].join.html_safe
+                    end,
+                    content_tag(:div, class: 'pull-right') do
+                      [
+                        link_to(
+                          url_for({ action: :toggle_status, comment_id: comment.id, s: 'a' }),
+                          method: :patch,
+                          title: t('camaleon_cms.admin.comments.tooltip.approved_comment'),
+                          class: "#{comment.approved == 'approved' ? 'hidden' : ''} " \
+                                 'btn btn-success approve btn-xs cama_ajax_request'
+                        ) { content_tag(:span, '', class: 'fa fa-thumbs-o-up') },
+                        ' ',
+                        link_to(
+                          url_for({ action: :toggle_status, comment_id: comment.id, s: 'p' }),
+                          method: :patch,
+                          title: t('camaleon_cms.admin.comments.tooltip.comment_pending'),
+                          class: "#{comment.approved == 'pending' ? 'hidden' : ''} " \
+                                 'btn btn-primary pending btn-xs cama_ajax_request'
+                        ) { content_tag(:span, '', class: 'fa fa-warning') },
+                        ' ',
+                        link_to(
+                          url_for({ action: :toggle_status, comment_id: comment.id, s: 's' }),
+                          method: :patch,
+                          title: t('camaleon_cms.admin.comments.tooltip.comment_spam'),
+                          class: "#{comment.approved == 'spam' ? 'hidden' : ''} " \
+                                 'btn btn-danger spam btn-xs cama_ajax_request'
+                        ) { content_tag(:span, '', class: 'fa fa-bug') }
+                      ].join.html_safe
+                    end
+                  ].join.html_safe
+                end,
+                content_tag(:hr),
+                content_tag(:div, '', class: 'clearfix'),
+                cama_comments_render_html(comment.children, post_id)
+              ].join.html_safe
+            end
+          ].join.html_safe
+        end
+      end.join('').html_safe
     end
   end
 end

data/app/helpers/camaleon_cms/content_helper.rb

@@ -2,34 +2,41 @@ module CamaleonCms
   module ContentHelper
     # initialize content variables
     def cama_content_init
-      @_before_content = []
-      @_after_content = []
+      state = cama_content_state
+      state[:before_content] = []
+      state[:after_content] = []
     end
 
     # prepend content for admin or frontend (after <body>)
     # sample: cama_content_prepend(<div>my prepend content</div>)
     def cama_content_prepend(content)
-      @_before_content << content
+      cama_content_state[:before_content] << content
     end
 
     # append content for admin or frontend (before </body>)
     # sample: cama_content_prepend(<div>my after content</div>)
     def cama_content_append(content)
-      @_after_content << content
+      cama_content_state[:after_content] << content
     end
 
     # draw all before contents registered by cama_content_prepend
     def cama_content_before_draw
-      @_before_content.join('')
+      cama_content_state[:before_content].join('')
     rescue StandardError
       ''
     end
 
     # draw all after contents registered by cama_content_append
     def cama_content_after_draw
-      @_after_content.join('')
+      cama_content_state[:after_content].join('')
     rescue StandardError
       ''
     end
+
+    private
+
+    def cama_content_state
+      CurrentRequest.content_helper_state ||= { before_content: [], after_content: [] }
+    end
   end
 end

data/app/helpers/camaleon_cms/email_helper.rb

@@ -1,7 +1,7 @@
 module CamaleonCms
   module EmailHelper
     include CamaleonCms::HooksHelper
-    # send and email
+    # send an email
     # email: email to
     # subject: Subject of the email
     # content: content of the email
@@ -20,7 +20,8 @@ module CamaleonCms
     end
 
     # short method of send_email
-    # args: content='', from=nil, attachs=[], url_base='', current_site, template_name, layout_name, extra_data, format, cc_to
+    # args: content='', from=nil, attachs=[], url_base='', current_site, template_name, layout_name, extra_data,
+    #         format, cc_to
     def cama_send_email(email_to, subject, args = {})
       args = { url_base: cama_root_url, current_site: current_site, subject: subject }.merge(args)
       args[:attachments] = args[:attachs] if args[:attachs].present?
@@ -42,7 +43,10 @@ module CamaleonCms
 
     def send_password_reset_email(user_to_send)
       user_to_send.send_password_reset
-      reset_url = cama_admin_forgot_url({ h: user_to_send.password_reset_token })
+      # Read the column, not the same-named method has_secure_password generates on Rails 7.1+ (which
+      # shadows it with a signed token the controller's column lookup never matches). read_attribute
+      # returns the stored column on every supported Rails version (6.1–8.1).
+      reset_url = cama_admin_forgot_url({ h: user_to_send.read_attribute(:password_reset_token) })
       extra_data = {
         url: reset_url,
         fullname: user_to_send.fullname,