camaleon_cms 2.9.1 → 2.9.3

data/app/models/concerns/camaleon_cms/site_default_settings.rb

@@ -4,10 +4,20 @@ module CamaleonCms
     # default structure for each new site
     def default_settings
       default_post_type = [
-        { name: 'Post', description: 'Posts',
-          options: { has_category: true, has_tags: true, not_deleted: true, has_summary: true, has_content: true, has_comments: true, has_picture: true, has_template: true } },
-        { name: 'Page', description: 'Pages',
-          options: { has_category: false, has_tags: false, not_deleted: true, has_summary: false, has_content: true, has_comments: false, has_picture: true, has_template: true, has_layout: true } }
+        {
+          name: 'Post', description: 'Posts',
+          options: {
+            has_category: true, has_tags: true, not_deleted: true, has_summary: true, has_content: true,
+            has_comments: true, has_picture: true, has_template: true
+          }
+        },
+        {
+          name: 'Page', description: 'Pages',
+          options: {
+            has_category: false, has_tags: false, not_deleted: true, has_summary: false, has_content: true,
+            has_comments: false, has_picture: true, has_template: true, has_layout: true
+          }
+        }
       ]
       default_post_type.each do |pt|
         post_types.create({ name: pt[:name], slug: pt[:name].to_s.parameterize, description: pt[:description],
@@ -17,20 +27,101 @@ module CamaleonCms
       # nav menus
       @nav_menu = nav_menus.new({ name: 'Main Menu', slug: 'main_menu' })
       if @nav_menu.save
-        post_types.all.each do |pt|
+        post_types.find_each do |pt|
           if pt.slug == 'post'
             title = 'Sample Post'
             slug = 'sample-post'
-            content = '<p>Lorem ipsum dolor sit amet, consectetur adipiscing elit. Integer pharetra ut augue in posuere. Nulla non malesuada dui. Sed egestas tortor ut purus tempor sodales. Duis non sollicitudin nulla, quis mollis neque. Integer sit amet augue ac neque varius auctor. Vestibulum malesuada leo leo, at semper libero efficitur nec. Etiam semper nisi ac nisi ullamcorper, sed tincidunt purus elementum. Mauris ac congue nibh. Quisque pretium eget leo nec suscipit. </p> <p> Vestibulum ultrices orci ut congue interdum. Morbi dolor nunc, imperdiet vel risus semper, tempor dapibus urna. Phasellus luctus pharetra enim quis volutpat. Integer tristique urna nec malesuada ullamcorper. Curabitur dictum, lectus id ultrices rhoncus, ante neque auctor erat, ut sodales nisi odio sit amet lorem. In hac habitasse platea dictumst. Quisque orci orci, hendrerit at luctus tristique, lobortis in diam. Curabitur ligula enim, rhoncus ut vestibulum a, consequat sit amet nisi. Aliquam bibendum fringilla ultrices. Aliquam erat volutpat. Vestibulum ante ipsum primis in faucibus orci luctus et ultrices posuere cubilia Curae; In justo mi, congue in rhoncus lobortis, facilisis in est. Nam et rhoncus purus. </p> <p> Sed sagittis auctor lectus at rutrum. Morbi ultricies felis mi, ut scelerisque augue facilisis eu. In molestie quam ex. Quisque ut sapien sed odio tempus imperdiet. In id accumsan massa. Morbi quis nunc ullamcorper, interdum enim eu, finibus purus. Vestibulum ac fermentum augue, at tempus ante. Aliquam ultrices, purus ut porttitor gravida, dui augue dignissim massa, ac tempor ante dolor at arcu. Pellentesque habitant morbi tristique senectus et netus et malesuada fames ac turpis egestas. Suspendisse placerat risus est, eget varius mi ultricies in. Duis non odio ut felis dapibus eleifend. In fringilla enim lobortis placerat efficitur. </p> <p> Nulla sodales faucibus urna, quis viverra dolor facilisis sollicitudin. Aenean ac egestas nibh. Nam non tortor eget nibh scelerisque fermentum. Etiam ornare, nunc ut luctus mollis, ante dolor consectetur augue, non scelerisque odio est a nulla. Nullam cursus egestas nulla, nec commodo nibh suscipit ut. Mauris ut felis sem. Aenean at mi at nisi dictum blandit sit amet at erat. Etiam eget lobortis tellus. Curabitur in commodo arcu, at vehicula tortor. </p>'
+            content_parts = []
+            content_parts << helpers.content_tag(
+              :p, 'Lorem ipsum dolor sit amet, consectetur adipiscing elit. Integer pharetra ut augue in posuere. ' \
+                  'Nulla non malesuada dui. Sed egestas tortor ut purus tempor sodales. ' \
+                  'Duis non sollicitudin nulla, quis mollis neque. Integer sit amet augue ac neque varius auctor. ' \
+                  'Vestibulum malesuada leo leo, at semper libero efficitur nec. ' \
+                  'Etiam semper nisi ac nisi ullamcorper, sed tincidunt purus elementum. ' \
+                  'Mauris ac congue nibh. Quisque pretium eget leo nec suscipit.'
+            )
+            content_parts << helpers.content_tag(
+              :p, 'Vestibulum ultrices orci ut congue interdum. ' \
+                   'Morbi dolor nunc, imperdiet vel risus semper, tempor dapibus urna. ' \
+                   'Phasellus luctus pharetra enim quis volutpat. Integer tristique urna nec malesuada ullamcorper. ' \
+                   'Curabitur dictum, lectus id ultrices rhoncus, ante neque auctor erat, ' \
+                   'ut sodales nisi odio sit amet lorem. In hac habitasse platea dictumst. ' \
+                   'Quisque orci orci, hendrerit at luctus tristique, lobortis in diam. ' \
+                   'Curabitur ligula enim, rhoncus ut vestibulum a, consequat sit amet nisi. ' \
+                   'Aliquam bibendum fringilla ultrices. Aliquam erat volutpat. ' \
+                   'Vestibulum ante ipsum primis in faucibus orci luctus et ultrices posuere cubilia Curae; ' \
+                   'In justo mi, congue in rhoncus lobortis, facilisis in est. Nam et rhoncus purus.'
+            )
+            content_parts << helpers.content_tag(
+              :p, 'Sed sagittis auctor lectus at rutrum. ' \
+                  'Morbi ultricies felis mi, ut scelerisque augue facilisis eu. In molestie quam ex. ' \
+                  'Quisque ut sapien sed odio tempus imperdiet. In id accumsan massa. ' \
+                  'Morbi quis nunc ullamcorper, interdum enim eu, finibus purus. ' \
+                  'Vestibulum ac fermentum augue, at tempus ante. ' \
+                  'Aliquam ultrices, purus ut porttitor gravida, dui augue dignissim massa, ' \
+                  'ac tempor ante dolor at arcu. ' \
+                  'Pellentesque habitant morbi tristique senectus et netus et malesuada fames ac turpis egestas. ' \
+                  'Suspendisse placerat risus est, eget varius mi ultricies in. ' \
+                  'Duis non odio ut felis dapibus eleifend. In fringilla enim lobortis placerat efficitur.'
+            )
+            content_parts << helpers.content_tag(
+              :p, 'Nulla sodales faucibus urna, quis viverra dolor facilisis sollicitudin. Aenean ac egestas nibh. ' \
+                  'Nam non tortor eget nibh scelerisque fermentum. ' \
+                  'Etiam ornare, nunc ut luctus mollis, ante dolor consectetur augue, ' \
+                  'non scelerisque odio est a nulla. Nullam cursus egestas nulla, nec commodo nibh suscipit ut. ' \
+                  'Mauris ut felis sem. Aenean at mi at nisi dictum blandit sit amet at erat. ' \
+                  'Etiam eget lobortis tellus. Curabitur in commodo arcu, at vehicula tortor.'
+            )
+            content = helpers.safe_join(content_parts)
           else
             title = 'Welcome'
             slug = 'welcome'
-            content = "<p style='text-align: center;'><img width='155' height='155' src='https://camaleon.website/media/132/logo2.png' alt='logo' /></p><p><strong>Camaleon CMS</strong>&nbsp;is a free and open-source tool and a fexible content management system (CMS) based on <a href='https://rubyonrails.org'>Ruby on Rails</a>.</p> <p>With Camaleon you can do the following:</p> <ul> <li>Create instantly a lot of sites&nbsp;in the same installation</li> <li>Manage your content information in several languages</li> <li>Extend current functionality by&nbsp;plugins (MVC structure and no more echo or prints anywhere)</li> <li>Create or install different themes for each site</li> <li>Create your own structure without coding anything (adapt Camaleon as you want&nbsp;and not you for Camaleon)</li> <li>Create your store and start to sell your products using our plugins</li> <li>Avoid web attacks</li> <li>Compare the speed and enjoy the speed of your new Camaleon site</li> <li>Customize or create your themes for mobile support</li> <li>Support&nbsp;more visitors at the same time</li> <li>Manage your information with a panel like wordpress&nbsp;</li> <li>All urls are oriented for SEO</li> <li>Multiples roles of users</li> </ul>"
+            welcome_parts = []
+            logo_img = helpers
+                       .image_tag('https://camaleon.website/media/132/logo2.png', width: 155, height: 155, alt: 'logo')
+            welcome_parts << helpers.content_tag(:p, logo_img, style: 'text-align: center;')
+            cms_strong = helpers.content_tag(:strong, 'Camaleon CMS')
+            rails_link = helpers.link_to('Ruby on Rails', 'https://rubyonrails.org')
+            part2_text = helpers.safe_join(
+              [
+                cms_strong,
+                ' is a free and open-source tool and a fexible content management system (CMS) based on ',
+                rails_link
+              ]
+            )
+            welcome_parts << helpers.content_tag(:p, part2_text)
+            welcome_parts << helpers.content_tag(:p, 'With Camaleon you can do the following:')
+            li_texts = [
+              'Create instantly a lot of sites in the same installation',
+              'Manage your content information in several languages',
+              'Extend current functionality by plugins (MVC structure and no more echo or prints anywhere)',
+              'Create or install different themes for each site',
+              'Create your own structure without coding anything (adapt Camaleon as you want and not you for Camaleon)',
+              'Create your store and start to sell your products using our plugins',
+              'Avoid web attacks',
+              'Compare the speed and enjoy the speed of your new Camaleon site',
+              'Customize or create your themes for mobile support',
+              'Support more visitors at the same time',
+              'Manage your information with a panel like wordpress ',
+              'All urls are oriented for SEO',
+              'Multiples roles of users'
+            ]
+            li_tags = li_texts.map { |text| helpers.content_tag(:li, text) }
+            welcome_parts << helpers.content_tag(:ul, helpers.safe_join(li_tags))
+            content = helpers.safe_join(welcome_parts)
           end
           user = users.admin_scope.first
-          unless user.present?
-            user = users.admin_scope.create({ email: 'admin@local.com', username: 'admin', password: 'admin123',
-                                              password_confirmation: 'admin123', first_name: 'Administrator' })
+          if user.blank?
+            # Never mint a known default password. Generate a random one, force a change on first
+            # login, and stash the plaintext transiently so the provisioning controller can surface
+            # it once. See harden-installer-default-admin.
+            generated_password = SecureRandom.alphanumeric(16)
+            user = users.admin_scope.create({ email: 'admin@local.com', username: 'admin',
+                                              password: generated_password,
+                                              password_confirmation: generated_password,
+                                              first_name: 'Administrator' })
+            user.set_meta('must_change_password', true)
+            self.generated_admin_password = generated_password
           end
           post = pt.add_post({ title: title, slug: slug, content: content, user_id: user.id, status: 'published' })
           @nav_menu.append_menu_item({ label: title, type: 'post', link: post.id })
@@ -60,18 +151,26 @@ module CamaleonCms
         if post_type.present?
           d = user_role.get_meta("_post_type_#{id}", {})
           CamaleonCms::UserRole::ROLES[:post_type].each do |value|
+            # post_content_unfiltered_html lets a role store unsanitized HTML in post content; it must not be
+            # granted to the default Editor role (only admins, via `can :manage, :all`, are trusted for it).
+            next if value[:key].to_s == 'post_content_unfiltered_html'
+
             value_old = d[value[:key].to_sym] || []
             d[value[:key].to_sym] = value_old + [post_type.id]
           end
         else
           pts = post_types.all.pluck(:id)
-          CamaleonCms::UserRole::ROLES[:post_type].each { |value| d[value[:key]] = pts }
+          CamaleonCms::UserRole::ROLES[:post_type].each do |value|
+            next if value[:key].to_s == 'post_content_unfiltered_html'
+
+            d[value[:key]] = pts
+          end
         end
         user_role.set_meta("_post_type_#{id}", d || {})
       end
 
-      user_role = user_roles.where({ slug: 'contributor' }).first_or_create({ name: 'Contributor',
-                                                                              description: 'Contributor Role' })
+      user_role = user_roles.where({ slug: 'contributor' })
+                            .first_or_create({ name: 'Contributor', description: 'Contributor Role' })
       if user_role.valid?
         d = {}
         if post_type.present?
@@ -89,13 +188,18 @@ module CamaleonCms
 
       return if post_type.present?
 
-      user_role = user_roles.where({ slug: 'client',
-                                     term_group: -1 }).first_or_create({ name: 'Client',
-                                                                         description: 'Default roles client' })
+      user_role = user_roles.where({ slug: 'client', term_group: -1 })
+                            .first_or_create({ name: 'Client', description: 'Default roles client' })
       return unless user_role.valid?
 
       user_role.set_meta("_post_type_#{id}", {})
       user_role.set_meta("_manager_#{id}", {})
     end
+
+    private
+
+    def helpers
+      ActionController::Base.helpers
+    end
   end
 end

data/app/models/concerns/camaleon_cms/user_methods.rb

@@ -8,12 +8,20 @@ module CamaleonCms
 
       extend CamaleonCms::NormalizeAttrs
 
-      validates_uniqueness_of :username, scope: [:site_id], case_sensitive: false,
-                                         message: I18n.t('camaleon_cms.admin.users.message.requires_different_username', default: 'Requires different username')
-      validates_uniqueness_of :email, scope: [:site_id], case_sensitive: false,
-                                      message: I18n.t('camaleon_cms.admin.users.message.requires_different_email', default: 'Requires different email')
-
-      normalize_attrs(:first_name, :last_name, :username)
+      validates(
+        :username, uniqueness: { scope: [:site_id], case_sensitive: false,
+                                 message: I18n.t(
+                                   'camaleon_cms.admin.users.message.requires_different_username',
+                                   default: 'Requires different username'
+                                 ) }
+      )
+      validates(
+        :email, uniqueness: { scope: [:site_id], case_sensitive: false,
+                              message: I18n.t(
+                                'camaleon_cms.admin.users.message.requires_different_email',
+                                default: 'Requires different email'
+                              ) }
+      )
 
       # callbacks
       before_validation :cama_before_validation
@@ -24,8 +32,12 @@ module CamaleonCms
       before_update { generate_token :auth_token if will_save_change_to_password_digest? }
 
       # relations
-      has_many :all_posts, class_name: 'CamaleonCms::Post', foreign_key: :user_id
-      has_many :all_comments, class_name: 'CamaleonCms::PostComment'
+      has_many :all_posts, class_name: 'CamaleonCms::Post', foreign_key: :user_id, inverse_of: :owner,
+                           dependent: :nullify
+      # No `dependent:` — the rows must still carry this user_id when the
+      # `after_destroy :reassign_comments` callback moves them to the anonymous user.
+      has_many :all_comments, class_name: 'CamaleonCms::PostComment' # rubocop:disable Rails/HasManyOrHasOneDependent
+
       belongs_to :site, class_name: 'CamaleonCms::Site', optional: true
 
       # scopes
@@ -64,9 +76,9 @@ module CamaleonCms
       @_user_role ||= site.user_roles.where(slug: role).first
     end
 
-    # assign a new site for current user
+    # Assign a new site for the current user
     def assign_site(site)
-      update_column(:site_id, site.id)
+      update_column(:site_id, site.id) # rubocop:disable Rails/SkipsModelValidations
     end
 
     def sites
@@ -93,6 +105,14 @@ module CamaleonCms
       end
     end
 
+    # Rotate the auth token and persist it (audit 2026-08-11 M3): called on logout so a cookie copied
+    # before logout can no longer authenticate. Skips validations/callbacks -- it only replaces the
+    # token column and must work even for a record that would not otherwise pass validation.
+    def cama_reset_auth_token!
+      generate_token(:auth_token)
+      update_column(:auth_token, auth_token) # rubocop:disable Rails/SkipsModelValidations
+    end
+
     def send_password_reset
       generate_token(:password_reset_token)
       self.password_reset_sent_at = Time.zone.now
@@ -126,20 +146,25 @@ module CamaleonCms
       all_posts.each do |p|
         s = p.post_type.site
         u = s.users.admin_scope.where.not(id: id).first
-        next unless u.present?
+        next if u.blank?
 
-        p.update_column(:user_id, u.id)
-        p.comments.where(user_id: id).each do |c|
-          c.update_column(:user_id, u.id)
-        end
+        p.update_column(:user_id, u.id) # rubocop:disable Rails/SkipsModelValidations
+        p.comments.where(user_id: id).update_all(user_id: u.id) # rubocop:disable Rails/SkipsModelValidations
       end
     end
 
+    # Until the dependent: :nullify on all_comments was removed this loop never ran — the
+    # association was already empty by the time after_destroy fired — so the unguarded chain
+    # below was never exercised. It runs now, and a comment whose post, post type or site cannot
+    # be resolved would raise inside after_destroy and roll the whole user deletion back. Such a
+    # comment is skipped instead; `rake camaleon_cms:reassign_orphaned_comments` reports the same
+    # rows, and it already guarded the identical chain.
     def reassign_comments
-      all_comments.includes(post: { post_type: :site }).each do |comment|
-        site = comment.post.post_type.site
-        user = site.get_anonymous_user
-        comment.update_column(:user_id, user.id)
+      all_comments.includes(post: { post_type: :site }).find_each do |comment|
+        site = comment.post&.post_type&.site
+        next if site.nil?
+
+        comment.update_column(:user_id, site.get_anonymous_user.id) # rubocop:disable Rails/SkipsModelValidations
       end
     end
   end

data/app/models/current_request.rb

@@ -0,0 +1,23 @@
+# CurrentRequest holds per-request state (user, site) accessible to models
+# via ActiveSupport::CurrentAttributes (thread-safe, resets after each request).
+#
+# Usage in controllers:
+#   CurrentRequest.user = cama_current_user
+#   CurrentRequest.site = current_site
+#
+# Usage in models:
+#   current_user  # delegates to CurrentRequest.user via CamaleonRecord
+#   current_site  # delegates to CurrentRequest.site via CamaleonRecord
+#
+# Note: Rails automatically resets CurrentAttributes between requests, ensuring no leakage.
+# In specs, call CurrentRequest.reset in before/after hooks to avoid cross-test pollution.
+class CurrentRequest < ActiveSupport::CurrentAttributes
+  attribute :user, :user_resolved, :site, :content_helper_state, :hooks_helper_state, :html_helper_state,
+            :theme_helper_state,
+            :frontend_object, :frontend_seo_settings, :frontend_current_theme, :frontend_site_current_path,
+            :frontend_visited_home, :frontend_visited_post, :frontend_visited_ajax, :frontend_visited_search,
+            :frontend_visited_post_type, :frontend_visited_tag, :frontend_visited_category,
+            :frontend_visited_profile, :frontend_user,
+            :admin_menu_items, :custom_field_elements, :extra_models_for_fields,
+            :shortcodes, :shortcodes_template, :shortcodes_descr
+end

data/app/uploaders/camaleon_cms_aws_uploader.rb

@@ -37,6 +37,8 @@ class CamaleonCmsAwsUploader < CamaleonCmsUploader
   end
 
   def fetch_file(file_name)
+    return { error: 'Invalid file path' } unless valid_folder_path?(file_name)
+
     return file_name if file_exists?(file_name)
 
     return file_name if bucket.object(file_name).download_file(file_name) && file_exists?(file_name)
@@ -70,9 +72,7 @@ class CamaleonCmsAwsUploader < CamaleonCmsUploader
       'dimension' => ''
     }.with_indifferent_access
     if res['file_type'] == 'image' && File.extname(res['name']).downcase != '.gif'
-      res['thumb'] =
-        version_path(res['url']).sub('.svg',
-                                     '.jpg')
+      res['thumb'] = version_path(res['url']).sub(SVG_EXT_PATTERN, '.jpg')
     end
     res['key'] = File.join(res['folder_path'], res['name'])
     @aws_settings[:aws_file_read_settings].call(res, s3_file)
@@ -84,8 +84,9 @@ class CamaleonCmsAwsUploader < CamaleonCmsUploader
   #   - same_name: false => avoid to overwrite an existent file with same key and search for an available key
   #   - is_thumb: true => if this file is a thumbnail of an uploaded file
   def add_file(uploaded_io_or_file_path, key, args = {})
+    return { error: 'Invalid file path' } unless valid_folder_path?(key)
+
     args = { same_name: false, is_thumb: false }.merge(args)
-    res = nil
     key = "#{@aws_settings['inner_folder']}/#{key}" if @aws_settings['inner_folder'].present? && !args[:is_thumb]
     key = key.cama_fix_media_key
     key = search_new_key(key) unless args[:same_name]
@@ -97,14 +98,20 @@ class CamaleonCmsAwsUploader < CamaleonCmsUploader
     end
 
     s3_file = bucket.object(key.slice(1..-1))
+    # Security (audit 2026-08-11 M5): a private-mode upload must be owner-only. Storing it 'public-read'
+    # (like a public file) left it world-readable at a guessable s3://bucket/private/<name> URL,
+    # bypassing the download_private_file gate. That gate fetches via the authenticated S3 API, so a
+    # 'private' ACL does not affect legitimate serving.
+    acl = is_private_uploader? ? 'private' : 'public-read'
     s3_file.upload_file(
-      uploaded_io_or_file_path.is_a?(String) ? uploaded_io_or_file_path : uploaded_io_or_file_path.path, @aws_settings[:aws_file_upload_settings].call({ acl: 'public-read' })
+      uploaded_io_or_file_path.is_a?(String) ? uploaded_io_or_file_path : uploaded_io_or_file_path.path,
+      @aws_settings[:aws_file_upload_settings].call({ acl: acl })
     )
     res = cache_item(file_parse(s3_file)) unless args[:is_thumb]
     res
   end
 
-  # add new folder to AWS with :key
+  # Add a new folder to AWS with :key
   def add_folder(key)
     return { error: 'Invalid folder path' } unless valid_folder_path?(key)
 
@@ -115,16 +122,20 @@ class CamaleonCmsAwsUploader < CamaleonCmsUploader
     cache_item(file_parse(s3_file))
   end
 
-  # delete a folder in AWS with :key
+  # Delete a folder in AWS with :key
   def delete_folder(key)
+    return { error: 'Invalid folder path' } unless valid_folder_path?(key)
+
     key = "#{@aws_settings['inner_folder']}/#{key}" if @aws_settings['inner_folder'].present?
     key = key.cama_fix_media_key
     bucket.objects(prefix: key.slice(1..-1) << '/').delete
-    get_media_collection.find_by_key(key).take.destroy
+    get_media_collection.by_key(key).take.destroy
   end
 
-  # delete a file in AWS with :key
+  # Delete the `:key` file in AWS
   def delete_file(key)
+    return { error: 'Invalid file path' } unless valid_folder_path?(key)
+
     key = "#{@aws_settings['inner_folder']}/#{key}" if @aws_settings['inner_folder'].present?
     key = key.cama_fix_media_key
     begin
@@ -133,10 +144,27 @@ class CamaleonCmsAwsUploader < CamaleonCmsUploader
       ''
     end
     @instance.hooks_run('after_delete', key)
-    get_media_collection.find_by_key(key).take.destroy
+    get_media_collection.by_key(key).take.destroy
+  end
+
+  # Security (audit 2026-08-11 M5 follow-up): uploads stored before the private-ACL fix kept a
+  # world-readable ACL under the private prefix. Sweep them back to owner-only and return the count.
+  # The prefix mirrors setup_private_folder -- <inner_folder>/private/ -- normalized exactly like
+  # add_file keys (leading slash added by cama_fix_media_key, then stripped for S3), with a trailing
+  # slash so a sibling folder such as private_x is not swept.
+  def repair_private_acls!
+    inner_folder = @aws_settings['inner_folder'].to_s
+    inner_folder = "#{inner_folder}/#{PRIVATE_DIRECTORY}" unless is_private_uploader?
+    prefix = "#{inner_folder.cama_fix_media_key.slice(1..-1)}/"
+    repaired = 0
+    bucket.objects(prefix: prefix).each do |object|
+      object.acl.put(acl: 'private')
+      repaired += 1
+    end
+    repaired
   end
 
-  # initialize a bucket with AWS configurations
+  # Initialize a bucket with AWS configurations
   # return: (AWS Bucket object)
   def bucket
     @bucket ||= lambda {

data/app/uploaders/camaleon_cms_local_uploader.rb

@@ -2,13 +2,13 @@ class CamaleonCmsLocalUploader < CamaleonCmsUploader
   def after_initialize
     @root_folder = @current_site.upload_directory
 
-    FileUtils.mkdir_p(@root_folder) unless Dir.exist?(@root_folder)
+    FileUtils.mkdir_p(@root_folder)
   end
 
   def setup_private_folder
     @root_folder = Rails.root.join(self.class::PRIVATE_DIRECTORY).to_s
 
-    FileUtils.mkdir_p(@root_folder) unless Dir.exist?(@root_folder)
+    FileUtils.mkdir_p(@root_folder)
   end
 
   def browser_files(prefix = '/', _objects = {})
@@ -32,6 +32,17 @@ class CamaleonCmsLocalUploader < CamaleonCmsUploader
     { error: 'File not found' }
   end
 
+  # Repairs legacy thumbnail URLs (see #cama_compat_legacy_thumb) for one rendered page of
+  # media items. The cache (media DB records) may still hold thumb URLs computed from the
+  # source extension (sample: ".jpg") while the on-disk thumbnail is a legacy ".png"; without
+  # this the admin media browser would render 404 thumbnails for such files. Applied by the
+  # media controller to the paginated page only — #objects stays a lazy relation so the browser
+  # paginates at the database instead of materializing (and stat-ing) the whole folder.
+  def cama_prepare_browser_page(items)
+    items.each { |item| cama_fix_legacy_thumb_item(item) }
+    items
+  end
+
   def file_parse(key)
     file_path = File.join(@root_folder, key)
     url_path = file_path.sub(Rails.root.join('public').to_s, '')
@@ -41,16 +52,13 @@ class CamaleonCmsLocalUploader < CamaleonCmsUploader
       'folder_path' => File.dirname(key),
       'url' => if is_dir
                  ''
+               elsif is_private_uploader?
+                 url_path.sub("#{@root_folder}/", '')
                else
-                 (if is_private_uploader?
-                    url_path.sub("#{@root_folder}/",
-                                 '')
-                  else
-                    File.join(
-                      @current_site.decorate.the_url(as_path: true, locale: false,
-                                                     skip_relative_url_root: true), url_path
-                    )
-                  end)
+                 File.join(
+                   @current_site.decorate.the_url(as_path: true, locale: false,
+                                                  skip_relative_url_root: true), url_path
+                 )
                end,
       'is_folder' => is_dir,
       'file_size' => is_dir ? 0 : File.size(file_path).round(2),
@@ -60,11 +68,16 @@ class CamaleonCmsLocalUploader < CamaleonCmsUploader
     }.with_indifferent_access
     res['key'] = File.join(res['folder_path'], res['name'])
     if res['file_type'] == 'image' && File.extname(file_path).downcase != '.gif'
-      res['thumb'] =
-        (is_private_uploader? ? "/admin/media/download_private_file?file=#{version_path(key).slice(1..-1)}" : version_path(res['url']))
+      res['thumb'] = if is_private_uploader?
+                       "/admin/media/download_private_file?file=#{version_path(key).slice(1..-1)}"
+                     else
+                       version_path(res['url'])
+                     end
     end
     if res['file_type'] == 'image'
-      res['thumb'].sub! '.svg', '.jpg'
+      res['thumb'].sub!(SVG_EXT_PATTERN, '.jpg')
+      res['thumb'] = cama_compat_legacy_thumb(res['thumb'], version_path(key).sub(SVG_EXT_PATTERN, '.jpg'),
+                                              res['url'])
       im = MiniMagick::Image.open(file_path)
       res['dimension'] = begin
         "#{im[:width]}x#{im[:height]}"
@@ -109,27 +122,71 @@ class CamaleonCmsLocalUploader < CamaleonCmsUploader
     f
   end
 
-  # remove an existent folder
+  # Remove an existent folder
   def delete_folder(key)
     return { error: 'Invalid folder path' } if key.include?('..')
 
     folder = File.join(@root_folder, key)
     FileUtils.rm_rf(folder) if Dir.exist? folder
-    get_media_collection.find_by_key(key).take.destroy
+    get_media_collection.by_key(key).take.destroy
   end
 
-  # remove an existent file
+  # Remove an existent file
   def delete_file(key)
     return { error: 'Invalid file path' } if key.include?('..')
 
     file = File.join(@root_folder, key)
     FileUtils.rm(file) if File.exist? file
     @instance.hooks_run('after_delete', key)
-    get_media_collection.find_by_key(key).take.destroy
+    get_media_collection.by_key(key).take.destroy
   end
 
-  # convert a real file path into file key
+  # Convert a real file path into a file key
   def parse_key(file_path)
     file_path.sub(@root_folder, '').cama_fix_media_key
   end
+
+  private
+
+  # Applies the legacy-thumbnail fallback (see #cama_compat_legacy_thumb) to a
+  # single cached media item in place, so the admin media browser renders the
+  # on-disk ".png" thumbnail instead of a 404ing ".jpg" one. No-op for folders,
+  # non-image files and items without a thumb.
+  # item: (CamaleonCms::Media | Hash) cached media object
+  def cama_fix_legacy_thumb_item(item)
+    return if item['is_folder'] || item['file_type'] != 'image' || item['thumb'].blank?
+
+    thumb_key = version_path(File.join(item['folder_path'].to_s, item['name'].to_s))
+    item['thumb'] = cama_compat_legacy_thumb(item['thumb'], thumb_key, item['url'])
+  end
+
+  # Backwards-compatibility for legacy thumbnails.
+  # Older Camaleon releases stored raster thumbnails as PNG regardless of the
+  # source extension (sample: "photo.jpg" => "thumb/photo-jpg.png"). The thumb
+  # URL is normally derived from the source extension, so for such legacy files
+  # the computed (sample: ".jpg") thumb URL would 404. Resolution order when the
+  # computed thumb is missing on disk:
+  #   1. a ".png" sibling exists  => point the thumb at the PNG;
+  #   2. no thumbnail exists at all (sample: ".ico" favicons are never
+  #      thumbnailed) => fall back to the original file url so the browser does
+  #      not request a 404 thumb (the original lives one level above /thumb).
+  # Otherwise the computed thumb url is returned unchanged (new uploads, PNG
+  # sources and S3 are unaffected).
+  # thumb_url: (String) computed public/private thumb url
+  # thumb_key: (String) computed thumb media key (relative to @root_folder)
+  # original_url: (String) url of the original (non-thumb) file
+  def cama_compat_legacy_thumb(thumb_url, thumb_key, original_url = nil)
+    return thumb_url if thumb_url.blank?
+
+    ext = File.extname(thumb_key)
+    return thumb_url if ext.blank?
+    return thumb_url if file_exists?(File.join(@root_folder, thumb_key))
+
+    unless ext.casecmp?('.png')
+      png_key = thumb_key.sub(/#{Regexp.escape(ext)}\z/, '.png')
+      return thumb_url.sub(/#{Regexp.escape(ext)}\z/, '.png') if file_exists?(File.join(@root_folder, png_key))
+    end
+
+    original_url.presence || thumb_url
+  end
 end

data/app/uploaders/camaleon_cms_uploader.rb

@@ -1,5 +1,8 @@
 class CamaleonCmsUploader
   PRIVATE_DIRECTORY = 'private'.freeze
+  # Case-insensitive terminal-`.svg` matcher, borrowed from the thumb/crop rename convention it
+  # must stay in lockstep with (defined beside that convention in UploaderImageProcessing).
+  SVG_EXT_PATTERN = CamaleonCms::UploaderImageProcessing::SVG_EXT_PATTERN
 
   attr_accessor :thumb
 
@@ -25,10 +28,11 @@ class CamaleonCmsUploader
               ''].include?(prefix)
             get_media_collection.where(folder_path: '/')
           else
-            get_media_collection.find_by_key(prefix).take.try(:items)
+            get_media_collection.by_key(prefix).take.try(:items)
           end
-    # Private hook to recover custom files to include in current list where data can be modified to add custom{files, folders}
-    # Note: this hooks doesn't have access to public vars like params. requests, ...
+    # Private hook to recover custom files to include into the current list where
+    # data can be modified to add custom{files, folders}.
+    # Note: these hooks don't have access to public vars like params. requests, ...
     if @instance
       args = { data: res, prefix: prefix }
       @instance.hooks_run('uploader_list_objects', args)
@@ -37,6 +41,15 @@ class CamaleonCmsUploader
     res
   end
 
+  # Post-process one *rendered page* of media items for display. Base and S3 need nothing;
+  # the local uploader overrides this to repair legacy thumbnail URLs (see its override), so
+  # that per-image filesystem check runs over the paginated page rather than the whole folder.
+  # Kept out of #objects on purpose: #objects must stay a lazy relation so the media browser
+  # paginates at the database.
+  def cama_prepare_browser_page(items)
+    items
+  end
+
   # clean cached of files structure saved into DB
   def clear_cache
     get_media_collection.destroy_all
@@ -94,7 +107,7 @@ class CamaleonCmsUploader
   # support for multiples formats, sample: image,audio
   def self.get_file_format_extensions(format)
     res = []
-    format.downcase.gsub(' ', '').split(',').each do |f|
+    format.downcase.delete(' ').split(',').each do |f|
       res << case f
              when 'image', 'images'
                'jpg,jpeg,png,gif,bmp,ico,svg'
@@ -116,12 +129,12 @@ class CamaleonCmsUploader
   # verify permitted formats (return boolean true | false)
   # true: if format is accepted
   # false: if format is not accepted
-  # sample: validate_file_format('/var/www/myfile.xls', 'image,audio,docx,xls') => return true if the file extension is in formats
+  # sample: validate_file_format('/var/www/myfile.xls', 'image,audio,docx,xls') => return true if the file extension
+  # is in formats
   def self.validate_file_format(key, valid_formats = '*')
-    return true if valid_formats == '*' || !valid_formats.present?
+    return true if valid_formats == '*' || valid_formats.blank?
 
-    valid_formats = valid_formats.gsub(' ',
-                                       '').downcase.split(',') + get_file_format_extensions(valid_formats).split(',')
+    valid_formats = valid_formats.delete(' ').downcase.split(',') + get_file_format_extensions(valid_formats).split(',')
     valid_formats.include?(File.extname(key).sub('.', '').split('?').first.try(:downcase))
   end
 
@@ -136,10 +149,10 @@ class CamaleonCmsUploader
   # sample: search_new_key("my_file/file.txt")
   def search_new_key(key)
     _key = key
-    if get_media_collection.find_by_key(key).any?
+    if get_media_collection.by_key(key).any?
       (1..999).each do |i|
         _key = key.cama_add_postfix_file_name("_#{i}")
-        break unless get_media_collection.find_by_key(_key).any?
+        break unless get_media_collection.by_key(_key).any?
       end
     end
     _key