camaleon_cms 2.9.1 → 2.9.3

data/app/models/camaleon_cms/ability.rb

@@ -12,9 +12,16 @@ module CamaleonCms
         can :read, :all
       else
         # conditions:
-        current_user_role = user.get_role(current_site) || current_site.user_roles.new
-        @roles_manager ||= current_user_role.get_meta("_manager_#{current_site.id}", {}) || {}
-        @roles_post_type ||= current_user_role.get_meta("_post_type_#{current_site.id}", {}) || {}
+        # Fetch the role record fresh from the database for the current site to
+        # ensure up-to-date role meta (avoid stale cached role objects during
+        # tests or runtime meta updates).
+        current_user_role = if current_site.present?
+                              current_site.user_roles.where(slug: user.role).first
+                            else
+                              user.get_role(current_site)
+                            end || current_site.user_roles.new
+        @roles_manager = current_user_role.get_meta("_manager_#{current_site.id}", {}) || {}
+        @roles_post_type = current_user_role.get_meta("_post_type_#{current_site.id}", {}) || {}
 
         ids_publish = @roles_post_type[:publish] || []
         ids_edit = @roles_post_type[:edit] || []
@@ -24,83 +31,49 @@ module CamaleonCms
         ids_delete_other = @roles_post_type[:delete_other] || []
         ids_delete_publish = @roles_post_type[:delete_publish] || []
 
-        can :posts, CamaleonCms::PostType do |pt|
+        safe_can :posts, CamaleonCms::PostType do |pt|
           (ids_edit + ids_edit_other + ids_edit_publish).to_i.include?(pt.id)
-        rescue StandardError
-          false
         end
 
-        can :create_post, CamaleonCms::PostType do |pt|
+        safe_can :create_post, CamaleonCms::PostType do |pt|
           ids_edit.to_i.include?(pt.id)
-        rescue StandardError
-          false
         end
-        can :publish_post, CamaleonCms::PostType do |pt|
+        safe_can :publish_post, CamaleonCms::PostType do |pt|
           ids_publish.to_i.include?(pt.id)
-        rescue StandardError
-          false
         end
-        can :edit_other, CamaleonCms::PostType do |pt|
+        safe_can :edit_other, CamaleonCms::PostType do |pt|
           ids_edit_other.to_i.include?(pt.id)
-        rescue StandardError
-          false
         end
-        can :edit_publish, CamaleonCms::PostType do |pt|
+        safe_can :edit_publish, CamaleonCms::PostType do |pt|
           ids_edit_publish.to_i.include?(pt.id)
-        rescue StandardError
-          false
         end
 
-        can :categories, CamaleonCms::PostType do |pt|
+        safe_can :categories, CamaleonCms::PostType do |pt|
           @roles_post_type[:manage_categories].to_i.include?(pt.id)
-        rescue StandardError
-          false
         end
-        can :post_tags, CamaleonCms::PostType do |pt|
+        safe_can :post_tags, CamaleonCms::PostType do |pt|
           @roles_post_type[:manage_tags].to_i.include?(pt.id)
-        rescue StandardError
-          false
+        end
+        safe_can :post_content_unfiltered_html, CamaleonCms::PostType do |pt|
+          ids_unfiltered = @roles_post_type[:post_content_unfiltered_html] || []
+          ids_unfiltered.to_i.include?(pt.id)
         end
 
-        can :update, CamaleonCms::Post do |post|
+        safe_can :update, CamaleonCms::Post do |post|
           pt_id = post.post_type.id
           r = false
-          r ||= begin
-            ids_edit.to_i.include?(pt_id) && post.user_id == user.id
-          rescue StandardError
-            false
-          end
-          r ||= begin
-            ids_edit_publish.to_i.include?(pt_id) && post.published?
-          rescue StandardError
-            false
-          end
-          r ||= begin
-            ids_edit_other.to_i.include?(pt_id) && post.user_id != user.id
-          rescue StandardError
-            false
-          end
+          r ||= ids_edit.to_i.include?(pt_id) && post.user_id == user.id
+          r ||= ids_edit_publish.to_i.include?(pt_id) && post.published?
+          r ||= ids_edit_other.to_i.include?(pt_id) && post.user_id != user.id
           r
         end
 
-        can :destroy, CamaleonCms::Post do |post|
+        safe_can :destroy, CamaleonCms::Post do |post|
           pt_id = post.post_type.id
           r = false
-          r ||= begin
-            ids_delete.to_i.include?(pt_id) && post.user_id == user.id
-          rescue StandardError
-            false
-          end
-          r ||= begin
-            ids_delete_publish.to_i.include?(pt_id) && post.published?
-          rescue StandardError
-            false
-          end
-          r ||= begin
-            ids_delete_other.to_i.include?(pt_id) && post.user_id != user.id
-          rescue StandardError
-            false
-          end
+          r ||= ids_delete.to_i.include?(pt_id) && post.user_id == user.id
+          r ||= ids_delete_publish.to_i.include?(pt_id) && post.published?
+          r ||= ids_delete_other.to_i.include?(pt_id) && post.user_id != user.id
           r
         end
 
@@ -109,60 +82,13 @@ module CamaleonCms
         @roles_post_type.each do |k, v|
           next if %w[edit edit_other edit_publish publish manage_categories].include?(k.to_s)
 
-          can k.to_sym, CamaleonCms::PostType do |pt|
+          safe_can k.to_sym, CamaleonCms::PostType do |pt|
             v.include?(pt.id.to_s)
-          rescue StandardError
-            false
           end
         end
 
         # others
-        begin
-          can :manage, :media if @roles_manager[:media]
-        rescue StandardError
-          false
-        end
-        begin
-          can :manage, :comments if @roles_manager[:comments]
-        rescue StandardError
-          false
-        end
-        # can :manage, :forms     if @roles_manager[:forms] rescue false
-        begin
-          can :manage, :themes if @roles_manager[:themes]
-        rescue StandardError
-          false
-        end
-        begin
-          can :manage, :widgets if @roles_manager[:widgets]
-        rescue StandardError
-          false
-        end
-        begin
-          can :manage, :nav_menu if @roles_manager[:nav_menu]
-        rescue StandardError
-          false
-        end
-        begin
-          can :manage, :plugins if @roles_manager[:plugins]
-        rescue StandardError
-          false
-        end
-        begin
-          can :manage, :users if @roles_manager[:users]
-        rescue StandardError
-          false
-        end
-        begin
-          can :manage, :settings if @roles_manager[:settings]
-        rescue StandardError
-          false
-        end
-        @roles_manager.try(:each) do |rol_manage_key, val_role|
-          can :manage, rol_manage_key.to_sym if val_role.to_s.cama_true?
-        rescue StandardError
-          false
-        end
+        define_manage_rules
       end
       cannot :impersonate, CamaleonCms::User do |u|
         u.id == user.id
@@ -182,5 +108,39 @@ module CamaleonCms
     def cannot?(*args)
       !can?(*args)
     end
+
+    private
+
+    # Wraps a can rule with block-level exception handling.
+    # Blocks are evaluated later during authorization checks (can? calls), so exceptions
+    # from accessing post properties, role metadata, etc. must be caught here to fail closed.
+    # Non-block calls (e.g., can :manage, :symbol) do not need wrapping; can itself is safe.
+    def safe_can(action, subject, &block)
+      if block_given?
+        can(action, subject) do |resource|
+          safely_false { yield(resource) }
+        end
+      else
+        # No block: can(action, subject) does not evaluate user logic; safe to call directly.
+        can(action, subject)
+      end
+    end
+
+    # Fails closed for permission checks when role/post metadata is malformed.
+    # Used by safe_can to guard block evaluation during authorization checks.
+    def safely_false
+      yield
+    rescue StandardError
+      false
+    end
+
+    def define_manage_rules
+      %i[media comments themes widgets nav_menu plugins users settings custom_fields select_eval].each do |resource|
+        safe_can :manage, resource if @roles_manager[resource]
+      end
+      @roles_manager.each do |rol_manage_key, val_role|
+        safe_can :manage, rol_manage_key.to_sym if val_role.to_s.cama_true?
+      end
+    end
   end
 end

data/app/models/camaleon_cms/category.rb

@@ -1,19 +1,21 @@
 module CamaleonCms
   class Category < CamaleonCms::TermTaxonomy
+    normalize_attrs(:description)
+
     alias_attribute :site_id, :term_group
     alias_attribute :post_type_id, :status
 
-    default_scope { where(taxonomy: :category) }
     scope :no_empty, -> { where('count > 0') } # return all categories that contains at least one post
     scope :empty, -> { where(count: [0, nil]) } # return all categories that does not contain any post
     # scope :parents, -> { where("term_taxonomy.parent_id IS NULL") }
 
     has_many :posts, foreign_key: :objectid, through: :term_relationships, source: :object
-    has_many :children, class_name: 'CamaleonCms::Category', foreign_key: :parent_id, dependent: :destroy
-    belongs_to :parent, class_name: 'CamaleonCms::Category', foreign_key: :parent_id, required: false
+    has_many :children, class_name: 'CamaleonCms::Category', foreign_key: :parent_id, dependent: :destroy,
+                        inverse_of: :parent
+    belongs_to :parent, class_name: 'CamaleonCms::Category', optional: true
     belongs_to :post_type_parent, class_name: 'CamaleonCms::PostType', foreign_key: :parent_id,
-                                  inverse_of: :categories, required: false
-    belongs_to :site, required: false
+                                  inverse_of: :categories, optional: true
+    belongs_to :site, optional: true
 
     before_save :set_site
     before_destroy :set_posts_in_default_category

data/app/models/camaleon_cms/custom_field.rb

@@ -14,17 +14,27 @@ module CamaleonCms
     # status: nil -> visible on list group fields
     # attr_accessible :object_class, :objectid, :description, :parent_id, :count, :name, :slug,
     # :field_order, :status, :is_repeat
+
+    # Scope metas by object_class. Meta rows are keyed by (objectid, object_class), so a custom
+    # field whose numeric id collides with another model's id (e.g. a Post) would otherwise read
+    # the wrong "_default" meta and lose its field_key. See regression: TinyMCE editor field
+    # rendered as a plain text_box on Theme settings.
+    # rubocop:disable Rails/InverseOf
     has_many :metas, -> { where(object_class: 'CustomField') }, foreign_key: :objectid, dependent: :destroy
-    has_many :values, class_name: 'CamaleonCms::CustomFieldsRelationship',
-                      foreign_key: :custom_field_id, dependent: :destroy
-    belongs_to :custom_field_group, required: false
-    belongs_to :parent, class_name: 'CamaleonCms::CustomField', foreign_key: :parent_id, required: false
+    # rubocop:enable Rails/InverseOf
+    has_many :values, class_name: 'CamaleonCms::CustomFieldsRelationship', dependent: :destroy
+
+    belongs_to :custom_field_group, class_name: 'CamaleonCms::CustomFieldGroup', foreign_key: :parent_id,
+                                    optional: true, inverse_of: :fields
+    belongs_to :parent, class_name: 'CamaleonCms::CustomField', optional: true
+    belongs_to :owner, polymorphic: true, foreign_key: :objectid, foreign_type: :object_class, optional: true
 
     validates :name, :object_class, presence: true
-    validates_uniqueness_of :slug, scope: %i[parent_id object_class],
-                                   unless: ->(o) { o.is_a?(CamaleonCms::CustomFieldGroup) }
+    validates :slug, uniqueness: { scope: %i[parent_id object_class],
+                                   unless: ->(o) { o.is_a?(CamaleonCms::CustomFieldGroup) } }
 
     before_validation :before_validating
+    before_update :check_select_eval_authorization
 
     private
 
@@ -32,5 +42,18 @@ module CamaleonCms
       self.slug ||= name
       self.slug = slug.to_s.parameterize
     end
+
+    # Prevent unauthorized modification of field_key to select_eval
+    def check_select_eval_authorization
+      return unless respond_to?(:options) && options.present?
+
+      # Check if field_key is being changed to select_eval
+      return unless options[:field_key] == 'select_eval'
+      # Allow if user has explicit permission
+      return if can?(:manage, :select_eval)
+
+      errors.add(:base, 'Not authorized to create or modify select_eval fields')
+      throw :abort
+    end
   end
 end

data/app/models/camaleon_cms/custom_field_group.rb

@@ -5,16 +5,22 @@ module CamaleonCms
     alias_attribute :site_id, :parent_id
 
     default_scope do
-      where("object_class != '_fields'")
-        .reorder("#{CamaleonCms::CustomField.table_name}.field_order ASC")
+      where("object_class != '_fields'").reorder("#{CamaleonCms::CustomField.table_name}.field_order ASC")
     end
 
+    # Scope metas by object_class so a group's numeric id colliding with another model's id does
+    # not read the wrong meta rows (meta rows are keyed by both objectid and object_class).
+    # rubocop:disable Rails/InverseOf
     has_many :metas, -> { where(object_class: 'CustomFieldGroup') }, foreign_key: :objectid, dependent: :destroy
+    # rubocop:enable Rails/InverseOf
+
     has_many :fields, -> { where(object_class: '_fields') }, class_name: 'CamaleonCms::CustomField',
-                                                             foreign_key: :parent_id, dependent: :destroy
-    belongs_to :site, foreign_key: :parent_id, required: false
+                                                             foreign_key: :parent_id, dependent: :destroy,
+                                                             inverse_of: :custom_field_group
+    belongs_to :site, foreign_key: :parent_id, optional: true, inverse_of: :custom_field_groups
+    belongs_to :owner, polymorphic: true, foreign_key: :objectid, foreign_type: :object_class, optional: true
 
-    validates_uniqueness_of :slug, scope: %i[object_class objectid parent_id]
+    validates :slug, uniqueness: { scope: %i[object_class objectid parent_id] }
 
     before_validation :before_validating
 
@@ -30,7 +36,16 @@ module CamaleonCms
     # ****** check all options for each case in Admin::CustomFieldsHelper ****
     # SAMPLE: my_model.add_field({"name"=>"Sub Title", "slug"=>"subtitle"}, {"field_key"=>"text_box",
     #   "translate"=>true, default_value: "Get in Touch"})
+    # Adds a manual field to the group (used by admin UI)
+    # item: field attributes
+    # options: field options
     def add_manual_field(item, options)
+      # Prevent creation of dangerous field types (select_eval) unless the actor is allowed.
+      if options[:field_key] == 'select_eval'
+        can?(:manage, :select_eval) ||
+          raise(CanCan::AccessDenied, 'Not authorized to create select_eval fields')
+      end
+
       c = get_field(item[:slug] || item['slug'])
       return c if c.present?
 
@@ -43,13 +58,15 @@ module CamaleonCms
     end
     alias add_field add_manual_field
 
-    # return a field with slug = slug from current group
+    # return a field with slug = slug from the current group
     def get_field(slug)
-      fields.find_by(slug: slug)
+      fields.find_by_slug(slug) # rubocop:disable Rails/DynamicFindBy
     end
 
     # only used by form on admin panel (protected)
     # return array of failed_fields and full_fields [[failed fields], [all fields]]
+    # items: hash of field items
+    # item_options: hash of options for each item
     def add_fields(items, item_options)
       fields.where.not(id: items.to_h.map { |_k, obj| obj['id'] }.uniq).destroy_all
       cache_fields = []
@@ -57,12 +74,38 @@ module CamaleonCms
       errors_saved = []
       if items.present?
         items.each do |i, item|
+          # allow string or symbol keys for incoming params
+          id_val = item['id'] || item[:id]
+
           item[:field_order] = order_index
           options = item_options[i] || {}
-          if item[:id].present? && (field_item = fields.find_by(id: item[:id])).present?
+          if id_val.present? && (field_item = fields.find_by(id: id_val)).present?
+            # If this is an existing select_eval field (or the incoming data would
+            # make it a select_eval) ensure the current actor has explicit
+            # permission. For updates, we preserve the form-like behaviour by
+            # collecting an error-like non-persisted field in errors_saved and
+            # skipping the update when unauthorized.
+            existing_key = (field_item.options || {})[:field_key].to_s
+            # consider field_key coming from the per-item options (options) or the item itself
+            incoming_key = (options[:field_key] || item[:field_key]).to_s
+            if (existing_key == 'select_eval' || incoming_key == 'select_eval') && !can?(:manage, :select_eval)
+              field_item.errors.add(:base, 'Not authorized to modify select_eval field')
+              errors_saved << field_item
+              next
+            end
+
             saved = field_item.update(item)
             cache_fields << field_item
           else
+            # Check if the incoming options request creation of select_eval
+            incoming_key = (options[:field_key] || item[:field_key]).to_s
+            if incoming_key == 'select_eval' && !can?(:manage, :select_eval)
+              # Add an error-like non-persisted field to errors_saved to preserve behaviour
+              field_item = fields.new(item)
+              field_item.errors.add(:base, 'Not authorized to create select_eval field')
+              errors_saved << field_item
+              next
+            end
             field_item = fields.new(item)
             cache_fields << field_item
             saved = field_item.save
@@ -79,6 +122,11 @@ module CamaleonCms
     end
 
     # generate the caption for this group
+    # The caption is rendered with `raw` by admin/settings/custom_fields/index.html.erb, so every
+    # interpolated value is escaped here, at the source: `the_title` already returns an escaped
+    # SafeBuffer, and the plain attributes below are escaped explicitly. `object_class` is included
+    # because the placement check admits any class name paired with the current site's id, so it is
+    # attacker-settable text like the model names are.
     def get_caption
       caption = ''
       begin
@@ -89,16 +137,19 @@ module CamaleonCms
           caption = "Fields for Categories in <b>#{site.post_types.find(objectid).decorate.the_title}</b>"
         when 'PostType_PostTag'
           caption = "Fields for Post tags in <b>#{site.post_types.find(objectid).decorate.the_title}</b>"
-        when 'Widget::Main'
-          caption = "Fields for Widget <b>(#{CamaleonCms::Widget::Main.find(objectid).name.translate})</b>"
+        when 'Main'
+          widget_name = CamaleonCms::Widget::Main.find(objectid).name.translate
+          caption = "Fields for Widget <b>(#{ERB::Util.html_escape(widget_name)})</b>"
         when 'Theme'
-          caption = "Field settings for Theme <b>(#{begin
+          theme_name = begin
             site.themes.find(objectid).name
           rescue StandardError
             objectid
-          end})</b>"
+          end
+          caption = "Field settings for Theme <b>(#{ERB::Util.html_escape(theme_name)})</b>"
         when 'NavMenu'
-          caption = "Field settings for Menus <b>(#{CamaleonCms::NavMenu.find(objectid).name})</b>"
+          menu_name = CamaleonCms::NavMenu.find(objectid).name
+          caption = "Field settings for Menus <b>(#{ERB::Util.html_escape(menu_name)})</b>"
         when 'Site'
           caption = 'Field settings the site'
         when 'PostType'
@@ -107,25 +158,28 @@ module CamaleonCms
           p = CamaleonCms::Post.find(objectid).decorate
           caption = "Fields for content <b>(#{p.the_title})</b>"
         else # 'Plugin' or other class
-          caption = "Fields for <b>#{object_class}</b>"
+          caption = "Fields for <b>#{ERB::Util.html_escape(object_class)}</b>"
         end
       rescue StandardError => e
         Rails.logger.debug "Camaleon CMS - Menu Item Error: #{e.message} ==> Attrs: #{attributes}"
       end
-      caption
+      # rubocop:disable Rails/OutputSafety -- every interpolated value above is escaped at the source
+      caption.html_safe
+      # rubocop:enable Rails/OutputSafety
     end
 
     private
 
     def before_validating
-      self.slug = "_group-#{name.to_s.parameterize}" unless slug.present?
+      self.slug = "_group-#{name.to_s.parameterize}" if slug.blank?
     end
 
     # auto save the default field values
     def auto_save_default_values(field, options)
       class_name = object_class.split('_').first
-      return unless %w[Post Category Plugin
-                       Theme].include?(class_name) && objectid && (options[:default_value].present? || options[:default_values].present?)
+      return unless %w[Post Category Plugin Theme].include?(class_name) &&
+                    objectid &&
+                    (options[:default_value].present? || options[:default_values].present?)
 
       owner = if class_name == 'Theme'
                 "CamaleonCms::#{class_name}".constantize.find(objectid) # owner model
@@ -133,13 +187,13 @@ module CamaleonCms
                 begin
                   "CamaleonCms::#{class_name}".constantize.find(objectid)
                 rescue StandardError
-                  "CamaleonCms::#{class_name}".constantize.find_by(slug: objectid)
+                  "CamaleonCms::#{class_name}".constantize.find_by_slug(objectid) # rubocop:disable Rails/DynamicFindBy
                 end
               end
       (options[:default_values] || [options[:default_value]] || []).each do |value|
         if owner.present?
-          owner.custom_field_values.create!(custom_field_id: field.id, custom_field_slug: field.slug,
-                                            value: fix_meta_value(value))
+          owner.custom_field_values
+               .create!(custom_field_id: field.id, custom_field_slug: field.slug, value: fix_meta_value(value))
         end
       end
     end

data/app/models/camaleon_cms/custom_fields_relationship.rb

@@ -7,23 +7,154 @@ module CamaleonCms
     default_scope { order("#{CamaleonCms::CustomFieldsRelationship.table_name}.term_order ASC") }
 
     # relations
-    belongs_to :custom_field, required: false
+    belongs_to :custom_field, class_name: 'CamaleonCms::CustomField', optional: true
+    belongs_to :owner, polymorphic: true, foreign_key: :objectid, foreign_type: :object_class, optional: true
 
     # validates :objectid, :custom_field_id, presence: true
     validates :custom_field_id, presence: true # error on clone model
 
+    # Rendered positions that need a save-time gate (audit M17, scan-and-reject policy). An
+    # `editor` value is emitted as markup (`raw`); a `field_attrs` value is a JSON pair whose
+    # members are emitted as markup; the URI field types are emitted into href/src. Every other
+    # field type's value renders through escaping ERB as element content, where markup cannot
+    # execute, so it needs no gate.
+    MARKUP_FIELD_KEYS = %w[editor].freeze
+    JSON_MARKUP_FIELD_KEYS = %w[field_attrs].freeze
+    URI_FIELD_KEYS = %w[url image audio video file].freeze
+    GATED_FIELD_KEYS = (MARKUP_FIELD_KEYS + JSON_MARKUP_FIELD_KEYS + URI_FIELD_KEYS).freeze
+
+    validate :reject_untrusted_dangerous_value
+
     after_save :set_parent_slug
     after_save :update_model_owner # TODO: convert this model into polymorphic
 
+    # Opt-out for trusted server-side pipelines (imports, seeds, plugin code), mirroring
+    # Post#unfiltered_content!: a reader plus a bang enabler and NO writer, so mass assignment
+    # cannot reach it. Sticky for the lifetime of the instance.
+    attr_reader :unfiltered_value
+
+    def unfiltered_value!
+      @unfiltered_value = true
+      self
+    end
+
+    class << self
+      # Whether this field type's value is emitted into a markup or URL position (so it is gated).
+      def gated_field_key?(field_key)
+        GATED_FIELD_KEYS.include?(field_key.to_s)
+      end
+
+      # Why the save-time gate would refuse this value for the field type, or nil if it passes:
+      # :too_large (over the parse ceiling), :html (disallowed markup), :uri (script-capable URL).
+      # Ignores author trust, so the validation (trust-gated) and the scan_content rake task (which
+      # reports every stored row) share one dispatch and cannot drift.
+      def gate_rejection_reason(field_key, value)
+        return if value.blank?
+
+        key = field_key.to_s
+        if MARKUP_FIELD_KEYS.include?(key)
+          markup_rejection_reason(value)
+        elsif JSON_MARKUP_FIELD_KEYS.include?(key)
+          return :too_large if CamaleonCms::UnsafeMarkup.too_large?(value)
+
+          :html if json_member_values(value).any? { |member| markup_unsafe?(member) }
+        elsif URI_FIELD_KEYS.include?(key)
+          :uri if CamaleonCms::UnsafeMarkup.dangerous_uri?(value)
+        end
+      end
+
+      private
+
+      def markup_rejection_reason(value)
+        return :too_large if CamaleonCms::UnsafeMarkup.too_large?(value)
+
+        :html if markup_unsafe?(value)
+      end
+
+      def markup_unsafe?(value)
+        CamaleonCms::UnsafeMarkup.unsafe_html?(
+          value, tags: CamaleonCms::Post::CONTENT_ALLOWED_TAGS,
+                 attributes: CamaleonCms::Post::CONTENT_ALLOWED_ATTRIBUTES
+        )
+      end
+
+      # A field_attrs value stores JSON whose string members render verbatim. Scan every DECODED
+      # member (Hash, Array or nested), not the stored bytes: the Rails JSON encoder unicode-escapes
+      # angle brackets (storing the escape instead of a literal bracket), so a byte-level scan of the
+      # stored string would pass markup that JSON.parse restores at render. Unparseable values are
+      # scanned as-is (fail closed on whatever the renderer would fall back to).
+      def json_member_values(value)
+        flatten_json_strings(JSON.parse(value))
+      rescue JSON::ParserError
+        [value.to_s]
+      end
+
+      def flatten_json_strings(node)
+        case node
+        when Hash then node.values.flat_map { |member| flatten_json_strings(member) }
+        when Array then node.flat_map { |member| flatten_json_strings(member) }
+        else [node.to_s]
+        end
+      end
+    end
+
     private
 
+    # Security (audit M17): the frontend renders an `editor`/`field_attrs` value verbatim and
+    # URI-type values into URL positions, so a value an untrusted author may not write is refused --
+    # never rewritten. Stored values therefore always equal authored values. The scan/dispatch lives
+    # in the class-level gate_rejection_reason so the scan_content rake task reuses it verbatim.
+    def reject_untrusted_dangerous_value
+      return if value.blank? || unfiltered_value
+
+      field_key = custom_field&.options&.[](:field_key).to_s
+      return unless self.class.gated_field_key?(field_key)
+      return if author_trusted_for_unfiltered_value?
+
+      reason = self.class.gate_rejection_reason(field_key, value)
+      return unless reason
+
+      errors.add(:base, cama_rejection_message(rejection_message_key(reason)))
+    end
+
+    def rejection_message_key(reason)
+      case reason
+      when :too_large then 'value_too_large'
+      when :uri then 'value_rejected_uri'
+      else 'value_rejected_html'
+      end
+    end
+
+    # The message must never be swallowed by a missing translation: only en.yml carries these keys,
+    # while the process locale follows the current admin/site language — fall back to English.
+    def cama_rejection_message(key)
+      full_key = "camaleon_cms.admin.custom_field.message.#{key}"
+      I18n.t(full_key, slug: custom_field_slug,
+                       default: I18n.t(full_key, slug: custom_field_slug, locale: :en))
+    end
+
+    # Trust follows the post-content model: an admin may write anything; a post's field values may
+    # skip the gate when the saver holds post_content_unfiltered_html for the post type. Fails
+    # closed (the gate applies) without a request context — benign values still pass the scan.
+    def author_trusted_for_unfiltered_value?
+      user = CurrentRequest.user
+      site = CurrentRequest.site
+      return false if user.blank? || site.blank?
+      return true if user.admin?
+
+      parent = owner
+      return false unless parent.is_a?(CamaleonCms::Post) && parent.post_type.present?
+
+      CamaleonCms::Ability.new(user, site).can?(:post_content_unfiltered_html, parent.post_type)
+    end
+
     def set_parent_slug
       # self.update_column('custom_field_slug', self.custom_fields.slug)
     end
 
     # touch owner model
     def update_model_owner
-      "CamaleonCms::#{object_class}".constantize.find(objectid).touch
+      "CamaleonCms::#{object_class}".constantize.find(objectid).touch # rubocop:disable Rails/SkipsModelValidations
     rescue StandardError
       nil
     end