camaleon_cms 2.9.1 → 2.9.3

data/app/models/camaleon_cms/media.rb

@@ -2,7 +2,7 @@ module CamaleonCms
   class Media < CamaleonRecord
     self.table_name = "#{PluginRoutes.static_system_info['db_prefix']}media"
 
-    belongs_to :site, required: false
+    belongs_to :site, optional: true
     validates :name, uniqueness: {
       scope: %i[site_id is_folder folder_path is_public],
       message: 'Duplicates not allowed'
@@ -23,7 +23,7 @@ module CamaleonCms
     end
 
     # search file or folder by key
-    def self.find_by_key(key)
+    def self.by_key(key)
       key = key.cama_fix_media_key
       if key == '/'
         where(folder_path: File.dirname(key))
@@ -32,6 +32,12 @@ module CamaleonCms
       end
     end
 
+    # legacy public name (pre-rename callers); the media table has no `key` column, so
+    # without the alias this falls through to Rails' dynamic finder and raises
+    class << self
+      alias find_by_key by_key
+    end
+
     # return all items of current folder
     def items
       coll = is_public ? site.public_media : site.private_media

data/app/models/camaleon_cms/meta.rb

@@ -3,8 +3,8 @@ module CamaleonCms
     self.table_name = "#{PluginRoutes.static_system_info['db_prefix']}metas"
     # attr_accessible :objectid, :key, :value, :object_class
 
-    extend CamaleonCms::NormalizeAttrs
+    belongs_to :owner, polymorphic: true, foreign_key: :objectid, foreign_type: :object_class, optional: true
 
-    normalize_attrs(:value)
+    extend CamaleonCms::NormalizeAttrs
   end
 end

data/app/models/camaleon_cms/nav_menu.rb

@@ -1,11 +1,15 @@
 module CamaleonCms
   class NavMenu < CamaleonCms::TermTaxonomy
-    default_scope { where(taxonomy: :nav_menu).order(id: :asc) }
+    normalize_attrs(:description)
+
+    # deterministic external iteration order (2.9.2 parity); render paths reorder(:term_order)
+    default_scope { order(id: :asc) }
+
     alias_attribute :site_id, :parent_id
 
     has_many :children, class_name: 'CamaleonCms::NavMenuItem', foreign_key: :parent_id, dependent: :destroy,
                         inverse_of: :parent
-    belongs_to :site, foreign_key: :parent_id, inverse_of: :nav_menus, required: false
+    belongs_to :site, foreign_key: :parent_id, inverse_of: :nav_menus, optional: true
 
     # add menu item for current menu
     # value: (Hash) is a hash object that contains label, type, link

data/app/models/camaleon_cms/nav_menu_item.rb

@@ -1,17 +1,25 @@
 module CamaleonCms
   class NavMenuItem < CamaleonCms::TermTaxonomy
+    # NavMenuItem#name (the menu label) is the one "name" field that is rendered as raw/trusted HTML
+    # (see CamaleonCms::Frontend::NavMenuHelper#cama_menu_draw_items), unlike other model names which are
+    # ERB-auto-escaped. It therefore keeps save-time sanitization: safe formatting (icons, spans) is preserved
+    # while scripts and event handlers are stripped, preventing stored XSS from menu managers.
+    normalize_attrs(:name, :description)
+
+    # deterministic external iteration order (2.9.2 parity); render paths reorder(:term_order)
+    default_scope { order(id: :asc) }
+
     alias_attribute :site_id, :term_group
     alias_attribute :label, :name
     alias_attribute :url, :description
     alias_attribute :kind, :slug
     alias_attribute :target, :status
+
     # attr_accessible :label, :url, :kind
-    #
-    default_scope { where(taxonomy: :nav_menu_item).order(id: :asc) }
 
-    belongs_to :parent, class_name: 'CamaleonCms::NavMenu', inverse_of: :children, required: false
+    belongs_to :parent, class_name: 'CamaleonCms::NavMenu', inverse_of: :children, optional: true
     belongs_to :parent_item, class_name: 'CamaleonCms::NavMenuItem', foreign_key: :parent_id, inverse_of: :children,
-                             required: false
+                             optional: true
     has_many :children, class_name: 'CamaleonCms::NavMenuItem', foreign_key: :parent_id, dependent: :destroy,
                         inverse_of: :parent_item
 
@@ -54,10 +62,12 @@ module CamaleonCms
     private
 
     def update_count
-      parent&.update_column('count', parent.children.size)
-      parent_item&.update_column('count', parent_item.children.size)
-      update_column(:term_group, main_menu.parent_id)
-      update_column(:term_order, CamaleonCms::NavMenuItem.where(parent_id: parent_id).count) # update position
+      parent&.update_column(:count, parent.children.size) # rubocop:disable Rails/SkipsModelValidations
+      parent_item&.update_column(:count, parent_item.children.size) # rubocop:disable Rails/SkipsModelValidations
+      # update group and position
+      update_columns( # rubocop:disable Rails/SkipsModelValidations
+        term_group: main_menu.parent_id, term_order: CamaleonCms::NavMenuItem.where(parent_id: parent_id).count
+      )
     end
 
     # fast access from site to menu items

data/app/models/camaleon_cms/plugin.rb

@@ -1,5 +1,7 @@
 module CamaleonCms
   class Plugin < CamaleonCms::TermTaxonomy
+    normalize_attrs(:description)
+
     # attrs:
     #   term_group => status active (1, nil)
     #   slug => plugin key
@@ -7,9 +9,8 @@ module CamaleonCms
 
     attr_accessor :error
 
-    belongs_to :site, foreign_key: :parent_id, required: false
+    belongs_to :site, foreign_key: :parent_id, optional: true, inverse_of: :plugins
 
-    default_scope { where(taxonomy: :plugin) }
     scope :active, -> { where(term_group: 1) }
 
     before_validation :set_default
@@ -69,7 +70,7 @@ module CamaleonCms
     private
 
     def set_default
-      self.name = slug unless name.present?
+      self.name = slug if name.blank?
     end
 
     def destroy_custom_fields

data/app/models/camaleon_cms/post.rb

@@ -2,9 +2,44 @@ module CamaleonCms
   class Post < CamaleonCms::PostDefault
     include CamaleonCms::CategoriesTagsForPosts
 
+    # Structural, non-executable markup that long-form post content legitimately uses but the
+    # sanitizer default drops. Superset of the default so upstream security additions are inherited.
+    SANITIZE_EXTRA_TAGS = %w[table thead tbody tfoot tr td th caption col colgroup
+                             figure figcaption u s hr].freeze
+    # These attributes are allowed knowing what they cost, none of which is script execution:
+    # `style` is CSS-scrubbed by the gate's scrubber (expression(), url(javascript:) and friends
+    # register as removals) but permits absolutely-positioned overlays; `id` widens DOM clobbering,
+    # which the scrubber's own default `name` already opened; and `target` without a forced
+    # `rel=noopener` is reverse tabnabbing on browsers predating the implicit default. The trade
+    # is deliberate: an untrusted author whose content needs more than this list has the save
+    # refused, and the role that wants more grants post_content_unfiltered_html.
+    SANITIZE_EXTRA_ATTRIBUTES = %w[id style target rel colspan rowspan].freeze
+    CONTENT_ALLOWED_TAGS = (ActionController::Base.helpers.sanitizer_vendor.safe_list_sanitizer
+                              .allowed_tags.to_a + SANITIZE_EXTRA_TAGS).uniq.freeze
+    CONTENT_ALLOWED_ATTRIBUTES = (ActionController::Base.helpers.sanitizer_vendor.safe_list_sanitizer
+                                    .allowed_attributes.to_a + SANITIZE_EXTRA_ATTRIBUTES).uniq.freeze
+
+    # Opt-out for trusted server-side pipelines (imports, seeds, plugin code) that would otherwise
+    # be sanitized by the fail-closed default. Exposed as a reader plus a bang enabler and NO
+    # `unfiltered_content=` writer, so `assign_attributes`/mass assignment cannot reach it — only
+    # explicit server-side code calling `post.unfiltered_content!` can.
+    #
+    # It is sticky for the lifetime of the object, not for one save: an instance that has been
+    # opted out stays opted out for every subsequent save of that instance. That is what a
+    # pipeline staging a record over several steps wants; code that needs the opt-out to apply
+    # once should not reuse the instance afterwards.
+    attr_reader :unfiltered_content
+
+    def unfiltered_content!
+      @unfiltered_content = true
+      self
+    end
+
     alias_attribute :post_type_id, :taxonomy_id
     default_scope -> { where(post_class: 'Post').order(post_order: :asc, created_at: :desc) }
 
+    validate :reject_untrusted_dangerous_content, on: %i[create update]
+
     # DEPRECATED
     has_many :post_relationships, class_name: 'CamaleonCms::PostRelationship', foreign_key: :objectid,
                                   dependent: :destroy, inverse_of: :post
@@ -14,16 +49,17 @@ module CamaleonCms
     has_many :term_relationships, foreign_key: :objectid, dependent: :destroy, inverse_of: :object
     has_many :categories, class_name: 'CamaleonCms::Category', through: :term_relationships, source: :term_taxonomy
     has_many :post_tags, class_name: 'CamaleonCms::PostTag', through: :term_relationships, source: :term_taxonomy
-    has_many :comments, class_name: 'CamaleonCms::PostComment', foreign_key: :post_id, dependent: :destroy
-    has_many :drafts, lambda {
-                        where(status: 'draft_child')
-                      }, class_name: 'CamaleonCms::Post', foreign_key: :post_parent, dependent: :destroy
+    has_many :comments, class_name: 'CamaleonCms::PostComment', dependent: :destroy
+    has_many :drafts, -> { where(status: 'draft_child') }, class_name: 'CamaleonCms::Post', inverse_of: :parent,
+                                                           foreign_key: :post_parent, dependent: :destroy
     has_many :children, class_name: 'CamaleonCms::Post', foreign_key: :post_parent, dependent: :destroy,
-                        primary_key: :id
+                        primary_key: :id, inverse_of: :parent
 
-    belongs_to :owner, class_name: CamaManager.get_user_class_name, foreign_key: :user_id, required: false
-    belongs_to :parent, class_name: 'CamaleonCms::Post', foreign_key: :post_parent, required: false
-    belongs_to :post_type, foreign_key: :taxonomy_id, inverse_of: :posts, required: false
+    belongs_to :owner, class_name: CamaManager.get_user_class_name.to_s, foreign_key: :user_id, optional: true,
+                       inverse_of: :all_posts
+    belongs_to :parent, class_name: 'CamaleonCms::Post', foreign_key: :post_parent, optional: true,
+                        inverse_of: :children
+    belongs_to :post_type, foreign_key: :taxonomy_id, inverse_of: :posts, optional: true
 
     scope :visible_frontend, -> { where(status: 'published') }
     scope :public_posts, lambda {
@@ -42,7 +78,7 @@ module CamaleonCms
     validates_with CamaleonCms::PostUniqValidator
     attr_accessor :show_title_with_parent
 
-    before_create :fix_post_order, if: ->(p) { !p.post_order.present? || p.post_order == 0 }
+    before_create :fix_post_order, if: ->(p) { p.post_order.blank? || p.post_order == 0 }
 
     # return all parents for current page hierarchy ordered bottom to top
     def parents
@@ -66,22 +102,22 @@ module CamaleonCms
       end
     end
 
-    # return the post type of this post (DEPRECATED)
+    # Return the post type of this post (DEPRECATED), though used yet in migration, so let it stay
     def get_post_type_depre
       post_types.reorder(nil).first
     end
 
-    # check if this post was published
+    # Check if this post was published
     def published?
       status == 'published'
     end
 
-    # check if this is in pending status
+    # Check if this post is in the pending status
     def pending?
       status == 'pending'
     end
 
-    # check if this is in draft status
+    # Check if this post is in the draft status
     def draft?
       %w[draft draft_child].include?(status)
     end
@@ -90,12 +126,12 @@ module CamaleonCms
       status == 'draft_child'
     end
 
-    # check if this is in trash status
+    # Check if this post is in the trash status
     def trash?
       status == 'trash'
     end
 
-    # check if current post can manage content
+    # Check if the current post can manage content
     # return boolean
     def manage_content?(posttype = nil)
       get_option('has_content', (posttype || post_type).get_option('has_content', true))
@@ -106,34 +142,35 @@ module CamaleonCms
       get_option('has_layout', (posttype || post_type).get_option('has_layout', false))
     end
 
-    # check if current post can manage template
+    # Check if current post can manage template
     # return boolean
     def manage_template?(posttype = nil)
       get_option('has_template', (posttype || post_type).get_option('has_template', true))
     end
 
-    # check if current post can manage summary
+    # Check if the current post can manage summary
     # return boolean
     def manage_summary?(posttype = nil)
       get_option('has_summary', (posttype || post_type).get_option('has_summary', true))
     end
 
-    # check if current post can manage picture
+    # Check if the current post can manage picture
     # return boolean
     def manage_picture?(posttype = nil)
       get_option('has_picture', (posttype || post_type).get_option('has_picture', true))
     end
 
-    # check if current post can manage comments
+    # Check if the current post can manage comments
     # return boolean
     def manage_comments?(posttype = nil)
       get_option('has_comments', (posttype || post_type).get_option('has_comments', false))
     end
 
-    # check if the post can be commented
+    # Check if the post can be commented
     # sample: @post.can_commented?
-    # return Boolean (true/false)
-    # to enable comments for current post, use this: post.set_meta('has_comments', '1'). Note: Parent PostType should be enabled for comments too: post_type.set_option('has_comments', true)
+    # to enable comments for current post, use this: post.set_meta('has_comments', '1').
+    # Note: Parent PostType should be enabled for comments too: post_type.set_option('has_comments', true)
+    # @return [TrueClass, FalseClass]
     def can_commented?
       manage_comments? && get_meta('has_comments').to_s == '1'
     end
@@ -151,10 +188,15 @@ module CamaleonCms
     #   has_picture, boolean (default true)
     #   has_template, boolean (default false)
     #   has_comments, boolean (default false)
-    #   default_layout:  (string) (default layout) # this is still used if post type was inactivated layout and overwritten by dropdown in post view
-    #   default_template:  (string) (default template) # this is still used if post type was inactivated template and overwritten by dropdown in post view
+    #
+    #   the following is still used if post type was inactivated layout and overwritten by dropdown in post view
+    #   default_layout:  (string) (default layout)
+    #
+    #   the following is still used if post type was inactivated template and overwritten by dropdown in post view
+    #   default_template:  (string) (default template)
     #   has_layout:  (boolean) (default false)
-    #   skip_fields:  (array) (default empty) array of custom field keys to avoid for this post, sample: ["subtitle", "icon"]
+    #   skip_fields:  (array) (default empty) array of custom field keys to avoid for this post,
+    #     sample: ["subtitle", "icon"]
     # val: value for the setting
     def set_setting(key, val)
       set_option(key, val)
@@ -171,7 +213,7 @@ module CamaleonCms
     # new_order_position: (Integer) position number
     # return nil
     def set_position(new_order_position)
-      update_column('post_order', new_order_position)
+      update_column(:post_order, new_order_position) # rubocop:disable Rails/SkipsModelValidations
     end
 
     # save the summary for current post
@@ -247,10 +289,54 @@ module CamaleonCms
 
     private
 
+    def trusted_for_unfiltered_html?
+      user = CurrentRequest.user
+      site = CurrentRequest.site
+      # Fail closed (sanitize) when either user or site context is missing - e.g. background jobs, rake tasks
+      # or the console. Guarding the site too avoids a NoMethodError from Ability#initialize (which dereferences
+      # the site for non-admin users) that would otherwise abort the whole save.
+      return false if user.blank? || site.blank?
+
+      CamaleonCms::Ability.new(user, site).can?(:post_content_unfiltered_html, post_type)
+    end
+
+    # Security (scan-and-reject policy): content an untrusted author is not permitted to write is
+    # refused with a validation error -- never sanitized or rewritten -- so stored content always
+    # equals authored content and the frontend may render it verbatim. The guard on
+    # `content_changed?` deliberately leaves pre-gate stored content editable (a title fix on an
+    # old post must not brick it); `rake camaleon_cms:security:scan_content` lists such content.
+    def reject_untrusted_dangerous_content
+      return unless new_record? || content_changed?
+      return if content.blank?
+      # The explicit pipeline opt-out short-circuits before the Ability lookup below.
+      return if unfiltered_content
+      # Check trust only once we know there is content to gate, so unchanged/blank updates never pay for
+      # building an Ability (a role-meta DB lookup) on every save.
+      return if trusted_for_unfiltered_html?
+
+      # Distinguish an over-size refusal from a disallowed-markup refusal (audit M16): an over-size
+      # value can be perfectly clean, so the markup message (scripts/handlers/embeds) would misdescribe
+      # it and send the author hunting for markup that is not there.
+      if CamaleonCms::UnsafeMarkup.too_large?(content)
+        errors.add(:content, cama_content_rejection_message('content_too_large'))
+      elsif CamaleonCms::UnsafeMarkup.unsafe_html?(
+        content, tags: CONTENT_ALLOWED_TAGS, attributes: CONTENT_ALLOWED_ATTRIBUTES
+      )
+        errors.add(:content, cama_content_rejection_message('content_rejected'))
+      end
+    end
+
+    # Only en.yml carries these keys while the process locale follows the current admin/site
+    # language — fall back to English rather than emit "translation missing".
+    def cama_content_rejection_message(key)
+      full_key = "camaleon_cms.admin.post.message.#{key}"
+      I18n.t(full_key, default: I18n.t(full_key, locale: :en))
+    end
+
     # calculate a post order when it is empty
     def fix_post_order
       last_post = post_type.posts.where.not(id: nil).last
-      self.post_order = last_post.present? ? last_post.post_order + 1 : 1
+      self.post_order = last_post.present? ? (last_post.post_order || 0) + 1 : 1
     end
   end
 end

data/app/models/camaleon_cms/post_comment.rb

@@ -6,16 +6,20 @@ module CamaleonCms
     extend CamaleonCms::NormalizeAttrs
 
     self.table_name = "#{PluginRoutes.static_system_info['db_prefix']}comments"
-    # attr_accessible :user_id, :post_id, :content, :author, :author_email, :author_url, :author_IP, :approved, :agent, :agent, :typee, :comment_parent, :is_anonymous
+    # attr_accessible :user_id, :post_id, :content, :author, :author_email, :author_url, :author_IP, :approved, :agent,
+    #                 :agent, :typee, :comment_parent, :is_anonymous
     attr_accessor :is_anonymous
 
     # default_scope order('comments.created_at ASC')
     # approved: approved | pending | spam
 
-    has_many :children, class_name: 'CamaleonCms::PostComment', foreign_key: :comment_parent, dependent: :destroy
-    belongs_to :post, required: false
-    belongs_to :parent, class_name: 'CamaleonCms::PostComment', foreign_key: :comment_parent, required: false
-    belongs_to :user, class_name: CamaManager.get_user_class_name, foreign_key: :user_id, required: false
+    has_many :children, class_name: 'CamaleonCms::PostComment', foreign_key: :comment_parent, dependent: :destroy,
+                        inverse_of: :parent
+
+    belongs_to :post, optional: true
+    belongs_to :parent, class_name: 'CamaleonCms::PostComment', foreign_key: :comment_parent, optional: true,
+                        inverse_of: :children
+    belongs_to :user, class_name: CamaManager.get_user_class_name.to_s, optional: true
 
     default_scope { order("#{CamaleonCms::PostComment.table_name}.created_at DESC") }
 
@@ -26,7 +30,7 @@ module CamaleonCms
     normalize_attrs(:content)
 
     validates :content, presence: true
-    validates_presence_of :author, :author_email, if: proc { |c| c.is_anonymous.present? }
+    validates :author, :author_email, presence: { if: proc { |c| c.is_anonymous.present? } }
     after_create :update_counter
     after_destroy :update_counter
 

data/app/models/camaleon_cms/post_default.rb

@@ -11,9 +11,42 @@ module CamaleonCms
       end
     end
 
+    # Point Rails to use the post_class column for Native STI
+    self.inheritance_column = :post_class
+
+    # Controls Writing: Strip 'CamaleonCms::' when saving to DB
+    # "CamaleonCms::Widget::Assigned" -> "Widget::Assigned"
+    # "CamaleonCms::Post" -> "Post"
+    def self.sti_name
+      name.sub(/^CamaleonCms::/, '')
+    end
+
+    # Controls Reading: Prepend 'CamaleonCms::' when pulling from DB
+    # "Widget::Assigned" -> "CamaleonCms::Widget::Assigned"
+    # "Post" -> "CamaleonCms::Post"
+    def self.find_sti_class(type_name)
+      full_class_name = type_name.start_with?('CamaleonCms::') ? type_name : "CamaleonCms::#{type_name}"
+      klass = begin
+        full_class_name.constantize
+      rescue NameError
+        nil
+      end
+      return klass if klass && klass <= base_class
+
+      # `super` resolves fully-qualified external classes (plugin STI outside the
+      # CamaleonCms namespace) and enforces ancestry; values it cannot place load as
+      # the base class, as every row did before native STI.
+      begin
+        super
+      rescue ActiveRecord::SubclassNotFound
+        base_class
+      end
+    end
+
     self.table_name = "#{PluginRoutes.static_system_info['db_prefix']}posts"
 
-    # attr_accessible :user_id, :title, :slug, :content, :content_filtered, :status,  :visibility, :visibility_value, :post_order, :post_type_key, :taxonomy_id, :published_at, :post_parent, :post_order, :is_feature
+    # attr_accessible :user_id, :title, :slug, :content, :content_filtered, :status,  :visibility, :visibility_value,
+    #                 :post_order, :post_type_key, :taxonomy_id, :published_at, :post_parent, :post_order, :is_feature
     attr_accessor :draft_id
 
     # attr_accessible :data_options
@@ -21,10 +54,12 @@ module CamaleonCms
     cattr_accessor :current_user
     cattr_accessor :current_site
 
-    has_many :term_relationships, foreign_key: :objectid, dependent: :destroy, primary_key: :id
-    has_many :children, lambda {
-                          where(post_class: 'PostDefault')
-                        }, class_name: 'CamaleonCms::PostDefault', foreign_key: :post_parent, dependent: :destroy, primary_key: :id
+    has_many :children, -> { where(post_class: 'PostDefault') },
+             class_name: 'CamaleonCms::PostDefault', foreign_key: :post_parent, dependent: :destroy, inverse_of: :parent
+
+    belongs_to :parent, class_name: 'CamaleonCms::PostDefault', foreign_key: :post_parent, optional: true,
+                        inverse_of: :children
+
     scope :featured, -> { where(is_feature: true) }
 
     validates :title, :slug, presence: true
@@ -45,11 +80,6 @@ module CamaleonCms
       res.take
     end
 
-    # return the parent of a post (support for sub contents or tree of posts)
-    def parent
-      CamaleonCms::Post.where(id: post_parent).first
-    end
-
     # return the author of this Content
     def author
       CamaleonCms::User.find(user_id)
@@ -62,7 +92,7 @@ module CamaleonCms
       CamaleonCms::NavMenuItem.where(url: id, kind: 'post')
     end
 
-    # Set the meta, field values and the post keywords here
+    # Set the meta-field values and the post keywords here
     def set_params(meta, custom_fields, options)
       set_metas(meta)
       set_field_values(custom_fields)
@@ -78,7 +108,7 @@ module CamaleonCms
 
     # do all before actions to save the content
     def before_saved
-      self.title = 'Untitled' unless title.present?
+      self.title = 'Untitled' if title.blank?
       self.content_filtered = if content.to_s.include?('<!--:-->')
                                 content.translations.transform_values do |value|
                                   value.squish.strip_tags

data/app/models/camaleon_cms/post_relationship.rb

@@ -5,11 +5,11 @@ module CamaleonCms
     # attr_accessible :objectid, :term_taxonomy_id, :term_order
     default_scope -> { order(term_order: :asc) }
 
-    belongs_to :post_type, class_name: 'CamaleonCms::PostType', foreign_key: :term_taxonomy_id,
-                           inverse_of: :post_relationships, required: false
+    belongs_to :post_type, class_name: 'CamaleonCms::PostType', foreign_key: :term_taxonomy_id, inverse_of: false,
+                           optional: true
     belongs_to :post, lambda {
                         order("#{CamaleonCms::Post.table_name}.id DESC")
-                      }, foreign_key: :objectid, inverse_of: :post_relationships, dependent: :destroy, required: false
+                      }, foreign_key: :objectid, inverse_of: :post_relationships, optional: true
 
     # callbacks
     after_create :update_count
@@ -18,7 +18,9 @@ module CamaleonCms
     private
 
     def update_count
-      post_type.update_column('count', post_type.posts.size) if post_type.present?
+      return if post_type.blank?
+
+      post_type.update_column(:count, post_type.posts.size) # rubocop:disable Rails/SkipsModelValidations
     end
   end
 end

data/app/models/camaleon_cms/post_tag.rb

@@ -1,9 +1,10 @@
 module CamaleonCms
   class PostTag < CamaleonCms::TermTaxonomy
-    default_scope { where(taxonomy: :post_tag) }
+    normalize_attrs(:description)
 
     has_many :posts, foreign_key: :objectid, through: :term_relationships, source: :object
-    belongs_to :post_type, foreign_key: :parent_id, inverse_of: :post_tags, required: false
-    belongs_to :owner, class_name: CamaManager.get_user_class_name, foreign_key: :user_id, required: false
+    belongs_to :post_type, foreign_key: :parent_id, inverse_of: :post_tags, optional: true
+    belongs_to :owner, class_name: CamaManager.get_user_class_name.to_s, foreign_key: :user_id, optional: true,
+                       inverse_of: false
   end
 end

data/app/models/camaleon_cms/post_type.rb

@@ -1,7 +1,8 @@
 module CamaleonCms
   class PostType < CamaleonCms::TermTaxonomy
+    normalize_attrs(:description)
+
     alias_attribute :site_id, :parent_id
-    default_scope { where(taxonomy: :post_type) }
 
     has_many :categories, foreign_key: :parent_id, dependent: :destroy, inverse_of: :post_type_parent
     has_many :post_tags, foreign_key: :parent_id, dependent: :destroy, inverse_of: :post_type
@@ -10,12 +11,12 @@ module CamaleonCms
     has_many :posts_through_categories, foreign_key: :objectid, through: :term_relationships, source: :object
     has_many :posts_draft, class_name: 'CamaleonCms::Post', foreign_key: :taxonomy_id, dependent: :destroy,
                            inverse_of: :post_type
-    has_many :field_group_taxonomy, lambda {
-                                      where('object_class LIKE ?', 'PostType_%')
-                                    }, class_name: 'CamaleonCms::CustomField', foreign_key: :objectid, dependent: :destroy
+    has_many :field_group_taxonomy, -> { where('object_class LIKE ?', 'PostType_%') },
+             class_name: 'CamaleonCms::CustomField', foreign_key: :objectid, dependent: :destroy, inverse_of: :owner
 
-    belongs_to :owner, class_name: CamaManager.get_user_class_name, foreign_key: :user_id, required: false
-    belongs_to :site, foreign_key: :parent_id, required: false
+    belongs_to :owner, class_name: CamaManager.get_user_class_name.to_s, foreign_key: :user_id, optional: true,
+                       inverse_of: false
+    belongs_to :site, foreign_key: :parent_id, optional: true, inverse_of: :post_types
 
     scope :visible_menu, -> { where(term_group: nil) }
     scope :hidden_menu, -> { where(term_group: -1) }
@@ -90,7 +91,7 @@ module CamaleonCms
     def default_category
       return unless manage_categories?
 
-      cat = categories.find_by_slug('uncategorized')
+      cat = categories.find_by_slug('uncategorized') # rubocop:disable Rails/DynamicFindBy
       unless cat
         cat = categories.create({ name: 'Uncategorized', slug: 'uncategorized', parent_id: id })
         cat.set_option('not_deleted', true)
@@ -108,10 +109,17 @@ module CamaleonCms
     #   summary: String resume (optional)  => default (empty)
     #   post_order: Integer to define the order position in the list (optional)
     #   fields: Hash of values for custom fields, sample => fields: {subtitle: 'abc', icon: 'test' } (optional)
-    #   settings: Hash of post settings, sample => settings:
-    #     {has_content: false, has_summary: true, default_layout: 'my_layout', default_template: 'my_template' } (optional, see more in post.set_setting(...))
+    #   settings: Hash of post settings, sample => settings: (optional, see more in post.set_setting(...))
+    #     {has_content: false, has_summary: true, default_layout: 'my_layout', default_template: 'my_template' }
     #   data_metas: {template: "", layout: ""}
-    # sample: my_posttype.add_post(title: "My Title", post_order: 5, content: 'lorem_ipsum', settings: {default_template: "home/counters", has_content: false, has_seo: false, skip_fields: ["sub_tite", 'banner']}, fields: {pattern: true, bg: 'https://www.reallusion.com/de/images/3dx5/whatsnew/3dx5_features_banner_bg_02.jpg'})
+    # sample:
+    # my_posttype.add_post(
+    #   title: "My Title", post_order: 5, content: 'lorem_ipsum',
+    #   settings: {
+    #     default_template: "home/counters", has_content: false, has_seo: false, skip_fields: ["sub_tite", 'banner']
+    #   },
+    #   fields: { pattern: true, bg: 'https://www.reallusion.com/de/images/3dx5/whatsnew/3dx5_features_banner_bg_02.jpg' }
+    # )
     #   More samples here: https://gist.github.com/owen2345/eba9691585ed78ad6f7b52e9591357bf
     # return created post if it was created, else return errors
     def add_post(args)
@@ -123,7 +131,7 @@ module CamaleonCms
       args[:data_tags] = args.delete(:tags)
       _thumb = args.delete(:thumb)
       p = posts.new(args)
-      p.slug = site.get_valid_post_slug(p.title.parameterize) unless p.slug.present?
+      p.slug = site.get_valid_post_slug(p.title.parameterize) if p.slug.blank?
       if p.save!
         _settings.each { |k, v| p.set_setting(k, v) } if _settings.present?
         p.set_position(_order_position) if _order_position.present?
@@ -137,6 +145,7 @@ module CamaleonCms
     end
 
     # return all available route formats of this post type for content posts
+    # rubocop:disable Layout/LineLength
     def contents_route_formats
       {
         'post_of_post_type' => '<code>/group/:post_type_id-:title/:slug</code><br>  (Sample: https://localhost.com/group/17-services/myservice.html)',
@@ -147,6 +156,7 @@ module CamaleonCms
         'hierarchy_post' => '<code>/:parent1_slug/:parent2_slug/.../:slug</code><br>  (Sample: https://localhost.com/item-1/item-1-1/item-111.html)'
       }
     end
+    # rubocop:enable Layout/LineLength
 
     # return the configuration of routes for post contents
     def contents_route_format
@@ -179,7 +189,7 @@ module CamaleonCms
 
     # destroy all custom field groups assigned to this post type
     def destroy_field_groups
-      if !destroyed_by_association.present? && %w[post page].include?(slug)
+      if destroyed_by_association.blank? && %w[post page].include?(slug)
         errors.add(:base, 'This post type can not be deleted.')
         return false
       end