camaleon_cms 2.9.1 → 2.9.3

data/app/helpers/camaleon_cms/frontend/site_helper.rb

@@ -9,48 +9,48 @@ module CamaleonCms
       # return current url visited as path
       # http://localhost:9001/category/cat-post-2  => /category/cat-post-2
       def site_current_path
-        @_site_current_path ||= site_current_url.sub(cama_root_url(locale: nil), '/')
+        CurrentRequest.frontend_site_current_path ||= site_current_url.sub(cama_root_url(locale: nil), '/')
       end
 
       # **************** section is a? ****************#
       # check if current section visited is home page
       def is_home?
-        @cama_visited_home.present?
+        camaleon_frontend_visited_state(:frontend_visited_home).present?
       end
 
       # check if current section visited is for post
       def is_page?
-        @cama_visited_post.present?
+        camaleon_frontend_visited_state(:frontend_visited_post).present?
       end
 
       # check if current section visited is for ajax
       def is_ajax?
-        @cama_visited_ajax.present?
+        camaleon_frontend_visited_state(:frontend_visited_ajax).present?
       end
 
       # check if current section visited is for search
       def is_search?
-        @cama_visited_search.present?
+        camaleon_frontend_visited_state(:frontend_visited_search).present?
       end
 
       # check if current section visited is for post type
       def is_post_type?
-        @cama_visited_post_type.present?
+        camaleon_frontend_visited_state(:frontend_visited_post_type).present?
       end
 
       # check if current section visited is for post tag
       def is_post_tag?
-        @cama_visited_tag.present?
+        camaleon_frontend_visited_state(:frontend_visited_tag).present?
       end
 
       # check if current section visited is for category
       def is_category?
-        @cama_visited_category.present?
+        camaleon_frontend_visited_state(:frontend_visited_category).present?
       end
 
       # check if visited page is user profile (frontend)
       def is_profile?
-        @cama_visited_profile == true
+        camaleon_frontend_visited_state(:frontend_visited_profile) == true
       end
 
       # **************** end section is a? ****************#
@@ -60,9 +60,29 @@ module CamaleonCms
       # seo_attrs: Custom attributes for seo in Hash format
       # show_seo: (Boolean) control to append or not the seo attributes
       def the_head(seo_attrs = {}, _show_seo = true)
-        js = "<script>var ROOT_URL = '#{cama_root_url}'; var LANGUAGE = '#{I18n.locale}'; </script>".html_safe
-        js += cama_draw_pre_asset_contents
-        "#{csrf_meta_tag || ''}\n#{display_meta_tags(cama_the_seo(seo_attrs))}\n#{js}\n#{cama_draw_custom_assets}"
+        js = javascript_tag("var ROOT_URL = #{cama_root_url.to_json}; var LANGUAGE = #{I18n.locale.to_s.to_json};")
+        safe_join(
+          [
+            csrf_meta_tag.presence,
+            display_meta_tags(cama_the_seo(seo_attrs)).presence,
+            js,
+            cama_draw_pre_asset_contents.presence,
+            cama_draw_custom_assets.presence
+          ].compact,
+          "\n"
+        )
+      end
+
+      private
+
+      def camaleon_frontend_visited_state(current_request_attr)
+        value = CurrentRequest.public_send(current_request_attr)
+        return value unless value.nil?
+
+        # Fall back to a legacy @cama_visited_* ivar a plugin front controller may have set directly;
+        # core writes both stores, so stock flows never reach here. Regression M20.
+        legacy_ivar = CamaleonCms::FrontendVisitedStateConcern::LEGACY_VISITED_IVAR_BY_ATTR[current_request_attr]
+        instance_variable_get(legacy_ivar) if legacy_ivar && instance_variable_defined?(legacy_ivar)
       end
     end
   end

data/app/helpers/camaleon_cms/hooks_helper.rb

@@ -16,7 +16,8 @@ module CamaleonCms
     # hook_key: hook key
     # params: params for hook
     def hooks_run(hook_key, params = nil)
-      PluginRoutes.enabled_apps(current_site).each do |plugin|
+      theme_slug = current_theme&.slug.presence || current_site.get_theme_slug
+      PluginRoutes.enabled_apps(current_site, theme_slug).each do |plugin|
         _do_hook(plugin, hook_key, params)
       end
 
@@ -28,16 +29,16 @@ module CamaleonCms
 
     # skip hook function with name: hook_function_name
     def hook_skip(hook_function_name)
-      @_hooks_skip << hook_function_name
+      hook_skip_list << hook_function_name
     end
 
     private
 
     def _do_hook(plugin, hook_key, params = nil)
-      return if !plugin.present? || !plugin['hooks'].present? || !plugin['hooks'][hook_key].present?
+      return if plugin.blank? || plugin['hooks'].blank? || plugin['hooks'][hook_key].blank?
 
       plugin['hooks'][hook_key].each do |hook|
-        next if @_hooks_skip.present? && @_hooks_skip.include?(hook)
+        next if hook_skip_list.include?(hook)
 
         begin
           if params.nil?
@@ -60,5 +61,14 @@ module CamaleonCms
         end
       end
     end
+
+    def hook_skip_list
+      state = camaleon_hooks_state
+      state[:hooks_skip] ||= []
+    end
+
+    def camaleon_hooks_state
+      CurrentRequest.hooks_helper_state ||= {}
+    end
   end
 end

data/app/helpers/camaleon_cms/html_helper.rb

@@ -1,9 +1,10 @@
 module CamaleonCms
   module HtmlHelper
     def cama_html_helpers_init
-      @_pre_assets_content = [] # Assets contents before the libraries import
-      @_assets_libraries = {}
-      @_assets_content = []
+      state = camaleon_html_helper_state
+      state[:pre_assets_content] = [] # Assets contents before the libraries import
+      state[:assets_libraries] = {}
+      state[:assets_content] = []
     end
 
     # register a new asset library to be included on demand calling by: cama_load_libraries(...)
@@ -12,36 +13,47 @@ module CamaleonCms
     def cama_assets_library_register(key, assets = {})
       key = key.to_sym
       cama_assets_libraries
-      @_cama_assets_libraries[key] = { css: [], js: [] } unless @_cama_assets_libraries[key].present?
-      @_cama_assets_libraries[key][:css] += assets[:css] if assets[:css].present?
-      @_cama_assets_libraries[key][:js] += assets[:js] if assets[:js].present?
+      state = camaleon_html_helper_state
+      state[:cama_assets_libraries][key] = { css: [], js: [] } if state[:cama_assets_libraries][key].blank?
+      state[:cama_assets_libraries][key][:css] += assets[:css] if assets[:css].present?
+      state[:cama_assets_libraries][key][:js] += assets[:js] if assets[:js].present?
     end
 
     # enable to load admin or registered libraries (colorpicker, datepicker, tinymce, form_ajax, cropper)
     # sample: add_asset_library("datepicker", "colorpicker")
     # This will add this assets library in the admin head or in a custom place by calling: cama_draw_custom_assets()
     def cama_load_libraries(*keys)
+      state = camaleon_html_helper_state
       keys.each do |key|
         library = cama_assets_libraries[key.to_sym]
-        @_assets_libraries[key.to_sym] = library if library.present?
+        state[:assets_libraries][key.to_sym] = library if library.present?
       end
     end
 
     alias add_asset_library cama_load_libraries
 
-    # add custom asset libraries (js, css or both) for the current request, also you can add extra css or js files for existent libraries
-    # sample: (add new library)
-    #   append_asset_libraries({"my_library_key"=> { js: [plugin_asset("js/my_js"), "plugins/myplugin/assets/js/my_js2"], css: [plugin_asset("css/my_css"), "plugins/myplugin/assets/css/my_css2"] }})
+    # add custom asset libraries (js, css or both) for the current request, also you can add extra css or js files for
+    # existent libraries
+    # sample: (add a new library)
+    #   append_asset_libraries(
+    #     {
+    #       "my_library_key"=> {
+    #         js: [plugin_asset("js/my_js"), "plugins/myplugin/assets/js/my_js2"],
+    #         css: [plugin_asset("css/my_css"), "plugins/myplugin/assets/css/my_css2"]
+    #       }
+    #     }
+    #   )
     # sample: (update existent library)
     #   append_asset_libraries({"colorpicker"=>{js: [plugin_asset("js/my_custom_js")] } })
     # return nil
     def append_asset_libraries(libraries)
+      state = camaleon_html_helper_state
       libraries.each do |key, library|
-        @_assets_libraries[key.to_sym] = if @_assets_libraries.include?(key)
-                                           @_assets_libraries[key.to_sym].merge(library)
-                                         else
-                                           library
-                                         end
+        state[:assets_libraries][key.to_sym] = if state[:assets_libraries].include?(key)
+                                                 state[:assets_libraries][key.to_sym].merge(library)
+                                               else
+                                                 library
+                                               end
       end
     end
     alias cama_load_custom_assets append_asset_libraries
@@ -51,7 +63,7 @@ module CamaleonCms
     # content may be: <style>a{color: red;}</style>
     # this will be printed with <%raw cama_draw_custom_assets %>
     def append_asset_content(content)
-      @_assets_content << content
+      camaleon_html_helper_state[:assets_content] << content
     end
 
     # add pre asset content into custom assets
@@ -59,27 +71,30 @@ module CamaleonCms
     # content may be: <style>a{color: red;}</style>
     # this will be printed before assets_library with <%raw cama_draw_pre_asset_contents %>
     def append_pre_asset_content(content)
-      @_pre_assets_content << content
+      camaleon_html_helper_state[:pre_assets_content] << content
     end
 
     # return all scripts to be executed before import the js libraries(cama_draw_custom_assets)
     def cama_draw_pre_asset_contents
-      (@_pre_assets_content || []).join('').html_safe
+      # rubocop:disable Rails/OutputSafety -- Callers append trusted script/style fragments that must render as markup.
+      camaleon_html_helper_state[:pre_assets_content].join('').html_safe
+      # rubocop:enable Rails/OutputSafety
     end
 
     # return all js libraries added [aa.js, bb,js, ..]
     # def get_assets_js
     def cama_draw_custom_assets
-      cama_html_helpers_init unless @_assets_libraries.present?
+      state = camaleon_html_helper_state
+      cama_html_helpers_init if state[:assets_libraries].blank?
       libs = []
-      @_assets_libraries.each_value do |assets|
+      state[:assets_libraries].each_value do |assets|
         libs += assets[:css] if assets[:css].present?
       end
       stylesheets = libs.uniq
       css = stylesheet_link_tag(*stylesheets, media: 'all')
 
       libs = []
-      @_assets_libraries.each_value do |assets|
+      state[:assets_libraries].each_value do |assets|
         libs += assets[:js] if assets[:js].present?
       end
       javascripts = libs.uniq
@@ -87,33 +102,31 @@ module CamaleonCms
 
       args = { stylesheets: stylesheets, javascripts: javascripts, js_html: js, css_html: css }
       hooks_run('draw_custom_assets', args)
-      "#{args[:css_html]}\n#{args[:js_html]}\n#{@_assets_content.join('').html_safe}"
-    end
+      # rubocop:disable Rails/OutputSafety -- Asset helper output and appended fragments are trusted framework/plugin markup.
+      trusted_fragments = [args[:css_html], args[:js_html], *state[:assets_content]].filter_map do |fragment|
+        next if fragment.blank?
 
-    # return category tree for category dropdown
-    # each level is prefixed with -
-    # level: internal recursive control
-    def cama_get_options_html_from_items(terms, level = 0)
-      options = []
-      terms.all.each do |term|
-        options << [('—' * level) + term.name, term.id] unless @term.id == term.id
-        children = term.children
-        options += cama_get_options_html_from_items(children, level + 1) unless children.empty?
+        fragment.is_a?(ActiveSupport::SafeBuffer) ? fragment : fragment.to_s.html_safe
       end
-      options
+      # rubocop:enable Rails/OutputSafety
+
+      safe_join(trusted_fragments, "\n")
     end
 
-    # create a html tooltip to include anywhere
+    # create an HTML tooltip to include anywhere
     # text: text of the tooltip
     # location: location of the tooltip (left | right | top |bottom)
     def cama_html_tooltip(text = 'Tooltip', location = 'left')
-      "<a href='javascript:;' title='#{text}' data-toggle='tooltip' data-placement='#{location}'><i class='fa fa-info-circle'></i></a>"
+      tag.a(href: 'javascript:;', title: text, data: { toggle: 'tooltip', placement: location }) do
+        tag.i(class: 'fa fa-info-circle')
+      end
     end
 
     private
 
     def cama_assets_libraries
-      return @_cama_assets_libraries if @_cama_assets_libraries.present?
+      state = camaleon_html_helper_state
+      return state[:cama_assets_libraries] if state[:cama_assets_libraries].present?
 
       libs = {}
       libs[:colorpicker] =
@@ -135,12 +148,34 @@ module CamaleonCms
           js: %w[camaleon_cms/admin/jquery.nestable camaleon_cms/admin/nav_menu] }
       libs[:admin_intro] =
         { js: ['camaleon_cms/admin/introjs/intro.min'], css: ['camaleon_cms/admin/introjs/introjs.min'] }
-      @_cama_assets_libraries = libs
+      state[:cama_assets_libraries] = libs
+    end
+
+    def camaleon_html_helper_state
+      state = CurrentRequest.html_helper_state ||= {}
+      state[:pre_assets_content] ||= []
+      state[:assets_libraries] ||= {}
+      state[:assets_content] ||= []
+      state
     end
 
     # execute translation for value if this value is like: t(admin.my_text) ==> My Text
     def cama_print_i18n_value(value)
-      value.start_with?('t(') ? eval(value.sub('t(', 'I18n.t(')) : value
+      return value unless value.is_a?(String)
+      return value unless value.start_with?('t(') && value.end_with?(')')
+
+      # Use an exclusive end index to strip the trailing ')' without nil-coercion.
+      key = value[2...-1].strip
+      # If the expression uses matching single/double quotes, unwrap the key before translation;
+      # the quoted form still only accepts simple i18n key characters: a-z, A-Z, 0-9, _, ., and -.
+      quoted_key_match = key.match(/\A(['"])([a-zA-Z0-9_.-]+)\1\z/)
+      key = quoted_key_match[2] if quoted_key_match
+
+      # Only translate simple i18n keys so arbitrary Ruby is never evaluated.
+      # Allowed chars: a-z, A-Z, 0-9, _, ., and -.
+      return value unless key.match?(/\A[a-zA-Z0-9_.-]+\z/)
+
+      I18n.t(key)
     end
   end
 end

data/app/helpers/camaleon_cms/plugins_helper.rb

@@ -2,21 +2,19 @@ module CamaleonCms
   module PluginsHelper
     include CamaleonCms::SiteHelper
     # load all plugins + theme installed for current site
-    # METHOD IGNORED (is a partial solution to avoid load helpers and cache it for all sites)
-    # this method try to load helpers for each request without caching
+    # METHOD IGNORED (is a partial solution to avoid loading helpers and cache it for all sites)
+    # this method tries to load helpers for each request without caching
     def plugins_initialize(klass = nil)
       mod = Module.new
       PluginRoutes.enabled_apps(current_site).each do |plugin|
-        next if !plugin.present? || !plugin['helpers'].present?
+        next if plugin.blank? || plugin['helpers'].blank?
 
-        plugin['helpers'].each do |h|
-          mod.send :include, h.constantize
-        end
+        plugin['helpers'].each { |h| mod.send :include, h.constantize }
       end
       (klass || self).send :extend, mod
     end
 
-    # upgrade installed plugin in current site for a new version
+    # upgrade the installed plugin in the current site for a new version
     # plugin_key: key of the plugin
     # trigger hook "on_upgrade"
     # return model of the plugin
@@ -29,7 +27,7 @@ module CamaleonCms
       plugin_model
     end
 
-    # install a plugin for current site
+    # install a plugin for the current site
     # plugin_key: key of the plugin
     # return model of the plugin
     def plugin_install(plugin_key)
@@ -50,7 +48,7 @@ module CamaleonCms
       end
     end
 
-    # uninstall a plugin from current site
+    # uninstall a plugin from the current site
     # plugin_key: key of the plugin
     # return model of the plugin
     def plugin_uninstall(plugin_key)
@@ -66,7 +64,7 @@ module CamaleonCms
       plugin_model
     end
 
-    # remove a plugin from current site
+    # remove a plugin from the current site
     # plugin_key: key of the plugin
     # return model of the plugin removed
     # DEPRECATED: PLUGINS AND THEMES CANNOT BE DESTROYED
@@ -105,8 +103,10 @@ module CamaleonCms
     # return plugin full asset path
     # plugin_key: plugin name
     # asset: (String) asset name
-    # sample: <script src="<%= plugin_asset_path("admin.js") %>"></script> => /assets/plugins/my_plugin/admin-54505620f.js
-    # sample: <script src="<%= plugin_asset_path("admin.js", 'my_plugin') %>"></script> => /assets/plugins/my_plugin/admin-54505620f.js
+    # sample: <script src="<%= plugin_asset_path("admin.js") %>"></script> =>
+    #           /assets/plugins/my_plugin/admin-54505620f.js
+    # sample: <script src="<%= plugin_asset_path("admin.js", 'my_plugin') %>"></script> =>
+    #           /assets/plugins/my_plugin/admin-54505620f.js
     def plugin_asset_path(asset, plugin_key = nil)
       if plugin_key.present? && plugin_key.include?('/')
         return plugin_asset_url(plugin_key,
@@ -123,11 +123,12 @@ module CamaleonCms
     alias plugin_asset plugin_asset_path
     alias plugin_gem_asset plugin_asset_path
 
-    # return the full url for asset of current plugin:
+    # return the full url for asset of the current plugin:
     # asset: (String) asset name
     # plugin_key: (optional) plugin name, default (current plugin caller to this function)
     # sample:
-    #   plugin_asset_url("css/main.css") => return: https://myhost.com/assets/plugins/my_plugin/assets/css/main-54505620f.css
+    #   plugin_asset_url("css/main.css") =>
+    #     return: https://myhost.com/assets/plugins/my_plugin/assets/css/main-54505620f.css
     def plugin_asset_url(asset, plugin_key = nil)
       key = plugin_key || self_plugin_key(1)
       p = PluginRoutes.plugin_info(key)['gem_mode'] ? "plugins/#{key}/#{asset}" : "plugins/#{key}/assets/#{asset}"
@@ -138,22 +139,22 @@ module CamaleonCms
       end
     end
 
-    # auto load all helpers of this plugin
+    # Autoload all helpers of this plugin
     def plugin_load_helpers(plugin)
-      return if !plugin.present? || !plugin['helpers'].present?
+      return if plugin.blank? || plugin['helpers'].blank?
 
       plugin['helpers'].each do |h|
         next if self.class.include?(h.constantize)
 
-        class_eval do
-          include h.constantize
-        end
+        class_eval { include h.constantize }
       rescue StandardError => e
-        Rails.logger.debug "Camaleon CMS - App loading error for #{h}: #{e.message}. Please check the plugins and themes presence"
+        Rails.logger.debug do
+          "Camaleon CMS - App loading error for #{h}: #{e.message}. Please check the plugins and themes presence"
+        end
       end
     end
 
-    # return plugin key for current plugin file (helper|controller|view)
+    # return the plugin key for the current plugin file (helper|controller|view)
     # index: internal control (ignored)
     def self_plugin_key(index = 0)
       f = caller[index]
@@ -175,9 +176,7 @@ module CamaleonCms
     # return the plugin model for current site calculated according to the file caller location
     def current_plugin(plugin_key = nil)
       _key = plugin_key || self_plugin_key(1)
-      cama_cache_fetch("current_plugin_#{_key}") do
-        current_site.get_plugin(_key)
-      end
+      cama_cache_fetch("current_plugin_#{_key}") { current_site.get_plugin(_key) }
     end
   end
 end