camaleon_cms 2.9.1 → 2.9.3

data/app/views/camaleon_cms/admin/posts/index.html.erb

@@ -60,10 +60,10 @@
                     <td><%= link_to raw(f.the_status), {action: :index, s: f.status}, class: "cama_ajax_request" %>  </td>
                     <td><%= f.author.fullname %></td>
                     <% if @post_type.manage_categories? %>
-                        <td><%= raw post_type_list_taxonomy(f.categories, "success") %></td>
+                        <td><%= post_type_list_taxonomy(f.categories, "success", @post_type) %></td>
                     <% end %>
                     <% if @post_type.manage_tags? %>
-                        <td><%= raw post_type_list_taxonomy(f.post_tags, "default") %></td>
+                        <td><%= post_type_list_taxonomy(f.post_tags, "default", @post_type) %></td>
                     <% end %>
                     <% extra_column = {post: f, post_type: @post_type, content: "", from_body: true};  hooks_run("list_post_extra_columns", extra_column) %>
                     <%= raw extra_column[:content] %>
@@ -88,18 +88,18 @@
                         <% end %>
 
                         <% if f.trash? %>
-                            <%= link_to raw('<i class="fa fa-check"></i>'), {action: :restore, post_id: f.id, s: params[:s]}, class: "btn btn-success btn-xs", title: "#{t('camaleon_cms.admin.button.restore')}" if can? :update, f %>
+                            <%= link_to raw('<i class="fa fa-check"></i>'), {action: :restore, post_id: f.id, s: params[:s]}, method: :patch, class: "btn btn-success btn-xs", title: "#{t('camaleon_cms.admin.button.restore')}" if can? :update, f %>
                             <%= link_to raw('<i class="fa fa-times"></i>'), {action: :destroy, id: f.id, s: params[:s]},
                                         method: :delete, data: {confirm: t('camaleon_cms.admin.message.delete_item')}, class: "btn btn-danger btn-xs cama_ajax_request", title: "#{t('camaleon_cms.admin.button.delete_complete', default: 'Delete completely')}" if can? :destroy, f %>
                         <% elsif f.draft? %>
                             <%#= link_to raw('<i class="fa fa-check"></i>'), {action: :edit, id: f.id, recover_draft: 'true' }, class: "btn btn-success btn-xs", title: "#{t('camaleon_cms.admin.button.recover')}" if can? :update, f %>
                             <%= link_to raw('<i class="fa fa-pencil"></i>'), {action: :edit, id: f.id}, class: "btn btn-default btn-xs cama_ajax_request", title: "#{t('camaleon_cms.admin.button.edit')}" if can? :update, f %>
                             <%= link_to raw('<i class="fa fa-trash"></i>'), {action: :trash, post_id: f.id, s: params[:s]},
-                                        data: {confirm: t('camaleon_cms.admin.message.delete')}, class: "btn btn-danger btn-xs cama_ajax_request", title: "#{t('camaleon_cms.admin.button.move_trash')}" if can? :destroy, f %>
+                                        method: :patch, data: {confirm: t('camaleon_cms.admin.message.delete')}, class: "btn btn-danger btn-xs cama_ajax_request", title: "#{t('camaleon_cms.admin.button.move_trash')}" if can? :destroy, f %>
                         <% else %>
                             <%= link_to raw('<i class="fa fa-pencil"></i>'), {action: :edit, id: f.id}, class: "btn btn-default btn-xs cama_ajax_request", title: "#{t('camaleon_cms.admin.button.edit')}" if can? :update, f %>
                             <%= link_to raw('<i class="fa fa-trash"></i>'), {action: :trash, post_id: f.id, s: params[:s]},
-                                        data: {confirm: t('camaleon_cms.admin.message.delete')}, class: "btn btn-danger btn-xs cama_ajax_request", title: "#{t('camaleon_cms.admin.button.move_trash')}" if can? :destroy, f %>
+                                        method: :patch, data: {confirm: t('camaleon_cms.admin.message.delete')}, class: "btn btn-danger btn-xs cama_ajax_request", title: "#{t('camaleon_cms.admin.button.move_trash')}" if can? :destroy, f %>
                         <% end %>
                     </td>
                 </tr>
@@ -107,6 +107,6 @@
             </tbody>
         </table>
         <%= content_tag("div", raw(t('camaleon_cms.admin.message.data_found_list')), class: "alert alert-warning") if @posts.empty? %>
-        <%= raw cama_do_pagination(@posts) %>
+        <%= cama_do_pagination(@posts) %>
     </div>
 </div>

data/app/views/camaleon_cms/admin/search.html.erb

@@ -62,7 +62,7 @@
                                 </tbody>
                             </table>
                             <%= content_tag("div", raw(t('camaleon_cms.admin.message.data_found_list')), class: "alert alert-warning") if @items.empty? %>
-                            <%= raw cama_do_pagination(@items, panel_class: "cama_ajax_request") %>
+                            <%= cama_do_pagination(@items, panel_class: "cama_ajax_request") %>
                         </div>
                     </div>
                 </div>

data/app/views/camaleon_cms/admin/sessions/back_to_parent.html.erb

@@ -0,0 +1,39 @@
+<div class="login-body">
+    <h3 class="login-box-msg"><%= t('camaleon_cms.admin.login.back_to_parent.title', default: 'Return to your account') %></h3>
+    <%= render "camaleon_cms/flash_messages" %>
+    <p>
+        <%# The parent admin's username is deliberately not shown: whoever holds an abandoned
+            impersonation must not learn which admin account to attack (or phish). %>
+        <%= t('camaleon_cms.admin.login.back_to_parent.instructions',
+              default: 'You are currently working as %{impersonated}. Enter the password for your own account to return to it, or log out completely.',
+              impersonated: @impersonated_user.username) %>
+    </p>
+    <%= form_tag cama_admin_back_to_parent_path, method: "post", role: "form", id: "back_to_parent", class: "form-horizontal cama_form_validate" do %>
+        <div class="form-group">
+            <div class="col-md-12">
+                <%= password_field_tag :password, nil, class: "form-control required", autofocus: true,
+                                       placeholder: t('camaleon_cms.admin.login.password', default: 'Password') %>
+            </div>
+        </div>
+        <div class="form-group">
+            <div class="col-md-12">
+                <%= raw cama_captcha_tags_if_under_attack("login") %>
+            </div>
+        </div>
+    <% end %>
+    <%# Security (audit M6): the full-logout button is its OWN button_to form, a sibling of the
+        re-auth form above -- never nested inside it. A nested <form> is dropped by the HTML parser
+        (the button would submit the outer form), and with per-form CSRF tokens the two tokens would
+        collide, breaking both submits. The "Return to my account" button stays a submit of the
+        re-auth form via the HTML5 `form` attribute. %>
+    <div class="row">
+        <div class="col-xs-6">
+            <%= button_to t('camaleon_cms.admin.login.back_to_parent.logout', default: 'Log out completely'),
+                          cama_admin_logout_path(full: 1), method: :post,
+                          class: 'btn btn-default btn-block btn-flat' %>
+        </div>
+        <div class="col-xs-6">
+            <button type="submit" form="back_to_parent" class="btn btn-primary btn-block btn-flat"><%= t('camaleon_cms.admin.login.back_to_parent.submit', default: 'Return to my account') %></button>
+        </div>
+    </div>
+</div>

data/app/views/camaleon_cms/admin/sessions/logout_confirm.html.erb

@@ -0,0 +1,27 @@
+<div class="login-body">
+    <h3 class="login-box-msg"><%= t('camaleon_cms.admin.logout.confirm_title', default: 'Log out?') %></h3>
+    <%= render "camaleon_cms/flash_messages" %>
+    <p>
+        <%# Security (audit M6): reached over GET (an old bookmark, or a theme still linking the
+            path) — the session ends only through the POST below, so a forged GET cannot end it. %>
+        <%= t('camaleon_cms.admin.logout.confirm_instructions',
+              default: 'You are about to end your session. Continue?') %>
+    </p>
+    <div class="row">
+        <div class="col-xs-6">
+            <%# Cancel returns to the vetted return_to when a theme supplied one (see
+                #prepare_logout_confirmation), else the dashboard -- never blindly into the admin. %>
+            <a href="<%= @logout_cancel_url %>" class="btn btn-default btn-block btn-flat"><%= t('camaleon_cms.admin.button.cancel', default: 'Cancel') %></a>
+        </div>
+        <div class="col-xs-6">
+            <%# `full` (impersonation), `return_to` (ecosystem themes link logout with a return-to-site
+                destination) and `locale` are carried through to the POST -- precomputed as scalars in
+                the controller so a hash-shaped param cannot crash url generation; return_to is then
+                vetted by cama_logout_user's safe-redirect check like on any logout. %>
+            <%= button_to t('camaleon_cms.admin.logout.logout', default: 'Logout'),
+                          cama_admin_logout_path(full: @logout_full, return_to: @logout_return_to,
+                                                 locale: @logout_locale),
+                          method: :post, class: 'btn btn-danger btn-block btn-flat' %>
+        </div>
+    </div>
+</div>

data/app/views/camaleon_cms/admin/settings/_email_settings.html.erb

@@ -49,7 +49,10 @@
                 var form = modal.find('form');
                 form.validate({submitHandler: function(){
                     showLoading();
-                    $.get(link.attr('href'), form.serialize(), function(){ hideLoading(); }).complete(function(){ modal.modal('hide'); }).error(function(r){ $.fn.alert({title: r.responseText, type: 'error'}) });
+                    // Security (audit M6): test_email sends mail, so the route is POST-only;
+                    // jquery_ujs' prefilter attaches the CSRF token to non-GET ajax.
+                    // .always/.fail (not the .complete/.error jqXHR aliases removed in jQuery 3).
+                    $.post(link.attr('href'), form.serialize(), function(){ hideLoading(); }).always(function(){ modal.modal('hide'); }).fail(function(r){ $.fn.alert({title: r.responseText, type: 'error'}) });
                 }});
             }});
             return false;

data/app/views/camaleon_cms/admin/settings/custom_fields/_get_items.html.erb

@@ -3,7 +3,7 @@
    @item_options_value = @item_options_value || {}
    @item_id = @item_value[:id] || ''
    @index = "#{@item_id}_#{Time.now.to_i}_#{rand(999...99999)}"
-   @field_config = cama_custom_field_elements[@key.to_sym]
+   @field_config = @key.present? ? cama_custom_field_elements[@key.to_sym] : nil
    @panel_id = "panel-field#{@index}"
    colors = ['primary','success','warning','colorful','info','danger']
    unless @field_config.nil?

data/app/views/camaleon_cms/admin/settings/custom_fields/_render.html.erb

@@ -15,15 +15,26 @@
                     </div>
                 <% end %>
                 <div class="fields_container">
-                    <% fields.decorate.each do |field| is_disabled = field.options[:disabled].present? || field.options[:readonly].present?; group_field_data[field.slug] = {default_value: field.options[:default_value], is_disabled: is_disabled, id: field.id, multiple: field.options[:multiple].to_s.to_bool && !is_disabled, kind: field.get_option('field_key')} %>
-                        <div class="item-custom-field c-field-<%= field.options[:field_key] %>" data-field-key="<%= field.slug %>">
+                    <% fields.decorate.each do |field|
+                         field_key = field.get_option('field_key').presence || field.options[:field_key].presence || field.options['field_key'].presence
+                         normalized_field_key = field_key.presence || 'text_box'
+                         is_disabled = field.get_option('disabled').present? || field.get_option('readonly').present?
+                         required_field = field.get_option('required').to_s.to_bool
+                         group_field_data[field.slug] = {
+                           default_value: field.get_option('default_value'),
+                           is_disabled: is_disabled,
+                           id: field.id,
+                           multiple: field.get_option('multiple').to_s.to_bool && !is_disabled,
+                           kind: normalized_field_key
+                         } %>
+                        <div class="item-custom-field c-field-<%= normalized_field_key %>" data-field-key="<%= field.slug %>">
                             <input name="<%= field_name %>[<%= field.slug %>][id]" type="hidden" value="<%= field.id %>"/>
                             <input name="<%= field_name %>[<%= field.slug %>][group_number]" class="cama_custom_group_number" type="hidden" value="0"/>
                             <label>
                                 <%= field.name %>
-                                <%= raw "<em class='text-danger'>*</em>" if field.options[:required].to_s.to_bool %>
+                                <%= raw "<em class='text-danger'>*</em>" if required_field %>
                                 <% if current_site.get_option('custom_fields_show_shortcodes') && ["post", "posttype", "category", "postTag", "site", "user", "navmenu", "theme"].include?(obj_class) %>
-                                    <small class="shortcode_field"><br><%= raw cama_shortcode_print("[data field='#{field.slug}' #{"object='#{obj_class}' #{"id='#{record.id}'" if obj_class != "Theme" }" unless record.new_record?}]") %></small>
+                                    <small class="shortcode_field"><br><%= cama_shortcode_print("[data field='#{field.slug}' #{"object='#{obj_class}' #{"id='#{record.id}'" if obj_class != "Theme" }" unless record.new_record?}]") %></small>
                                 <% end %>
                             </label>
                             <% if field.description.present? %>
@@ -31,7 +42,11 @@
                             <% end  %>
                             <div class="editor-custom-fields content-field-<%= field.id %>" data-add_field_title="<%= t('camaleon_cms.admin.button.add_new_field', default: 'Add new field')%>">
                                 <%= begin
-                                      render(field.get_option('render') || (cama_custom_field_elements[field.get_option('field_key').to_sym][:render] rescue nil) || "camaleon_cms/admin/settings/custom_fields/fields/#{field.options[:field_key]}", field: field, values: nil, is_disabled: is_disabled, default_use: default_use, field_name: field_name)
+                                      custom_field_render = (cama_custom_field_elements[normalized_field_key.to_sym][:render] rescue nil)
+                                      render(
+                                        field.get_option('render') || custom_field_render || "camaleon_cms/admin/settings/custom_fields/fields/#{normalized_field_key}",
+                                        field: field, values: nil, is_disabled: is_disabled, default_use: default_use, field_name: field_name
+                                      )
                                     rescue => e
                                       Rails.logger.error "Camaleon CMS - Render Custom Fields Error: Custom field template was not found => #{e.message}: #{$!.backtrace}".cama_log_style(:red)
                                       e.message
@@ -40,7 +55,28 @@
                         </div>
                     <% end %>
                 </div>
-                <script> jQuery(function(){ build_custom_field_group(<%= raw(params[:field_options].present? ? (r = []; params[:field_options].each{|k, v| val = {}; v.each{|kk, vv| val["#{kk}"] = (vv['values'].values rescue vv['values']); }; r << val }; r.to_json) : record.get_fields_grouped(fields.pluck(:slug).uniq).to_json) %>, '<%= group.id %>', <%= raw group_field_data.to_json %>, <%= group.is_repeat %>, '<%= field_name %>'); }); </script>
+                <%
+                  field_options_json = if params[:field_options].present?
+                                         params[:field_options].to_unsafe_h.each_with_object([]) do |(_k, v), r|
+                                           r << v.each_with_object({}) do |(kk, vv), val|
+                                             val[kk.to_s] = (vv['values'].values rescue vv['values'])
+                                           end
+                                         end.to_json
+                                       else
+                                         record.get_fields_grouped(fields.pluck(:slug).uniq).to_json
+                                       end
+                %>
+                <script>
+                    jQuery(function () {
+                        build_custom_field_group(
+                            <%= json_escape(field_options_json).html_safe %>,
+                            '<%= group.id %>',
+                            <%= json_escape(group_field_data.to_json).html_safe %>,
+                            <%= group.is_repeat %>,
+                            '<%= field_name %>'
+                        );
+                    });
+                </script>
             </div>
         </div>
         <% if group.is_repeat %>

data/app/views/camaleon_cms/admin/settings/custom_fields/_render_category_simple.html.erb

@@ -2,7 +2,7 @@
 def _render_category_option_html(item, pos = 0)
   category = item.decorate
   value = "Category_Post,#{category.id}" %>
-  <option value="<%= value %>" data-help="<%= "#{t('camaleon_cms.admin.settings.tooltip.add_custom_field_posts')}"+ category.the_title %>"><%=  "#{('—' * pos)} #{category.the_title}" %></option>
+  <option value="<%= value %>" data-help="<%= safe_join([t('camaleon_cms.admin.settings.tooltip.add_custom_field_posts'), category.the_title]) %>"><%= safe_join([('—' * pos), ' ', category.the_title]) %></option>
 <% end
 
    def _render_categories(categories, _level = 0)

data/app/views/camaleon_cms/admin/settings/custom_fields/fields/_select_eval.html.erb

@@ -1,3 +1,3 @@
 <div class="group-input-fields-content">
-  <%= select_tag "#{field_name}[#{field.slug}][values][]", instance_eval(field.options[:command].to_s.strip), class: "form-control input-value #{'required' if field.options[:required].to_s.to_bool}"  %>
+  <%= select_tag "#{field_name}[#{field.slug}][values][]", instance_eval(field.options[:command].to_s.strip), class: "form-control input-value #{'required' if field.options[:required].to_s.to_bool}" %>
 </div>

data/app/views/camaleon_cms/admin/settings/custom_fields/form.html.erb

@@ -64,13 +64,14 @@
                                 </optgroup>
 
                                 <optgroup label="<%= t('camaleon_cms.admin.settings.others') %>">
-                                    <% value = "#{PluginRoutes.static_system_info['user_model'].presence || 'User'},#{current_site.id}" %>
+                                    <%# Demodulized: user groups are stored and read under the association's scope name %>
+                                    <% value = "#{PluginRoutes.get_user_class_name.demodulize},#{current_site.id}" %>
                                     <option value="<%= value %>" data-help="<%= t('camaleon_cms.admin.settings.tooltip.add_custom_field_users') %>"><%= t('camaleon_cms.admin.sidebar.users') %></option>
                                     <% value = "Site,#{current_site.id}" %>
                                     <option value="<%= value %>" data-help="<%= t('camaleon_cms.admin.settings.tooltip.add_custom_field_sites') %>"><%= t('camaleon_cms.admin.sidebar.site_settings') %></option>
-                                    <% f_args={models: @_extra_models_for_fields || []}; hooks_run('custom_field_custom_models', f_args); f_args[:models].each do |model| %>
+                                    <% cf_extra_models_for_fields.each do |model| %>
                                         <% value = "#{model.name},#{current_site.id}" %>
-                                        <option value="<%= value %>" data-help=""><%= model.name %></option><%= model.name %>
+                                        <option value="<%= value %>" data-help=""><%= model.name %></option>
                                     <% end %>
                                 </optgroup>
 
@@ -152,7 +153,7 @@
                     <div class="panel-body">
                         <div id="content-items-default" class="form-group input-group-sm">
                             <% cama_custom_field_elements.each do |i,item| %>
-                                <% next if item[:key] == "select_eval" %>
+                                <% next if item[:key] == 'select_eval' %>
                                 <a id="item-<%= item[:key] %>" class="btn btn-default" href="<%= get_items_cama_admin_settings_custom_fields_path(item[:key]) %>" style="margin-bottom: 4px"><%= item[:label] %></a>
                             <% end %>
                         </div>

data/app/views/camaleon_cms/admin/settings/custom_fields/index.html.erb

@@ -44,7 +44,7 @@
             </tbody>
           </table>
           <%= content_tag("div", raw(t('camaleon_cms.admin.message.data_found_list')), class: "alert alert-warning") if @field_groups.empty? %>
-            <%= raw cama_do_pagination(@field_groups) %>
+            <%= cama_do_pagination(@field_groups) %>
         </div>
       </div>
       <!-- END BASIC TABLE SAMPLE -->

data/app/views/camaleon_cms/admin/settings/post_types/index.html.erb

@@ -42,7 +42,7 @@
             </tbody>
           </table>
           <%= content_tag("div", raw(t('camaleon_cms.admin.message.data_found_list')), class: "alert alert-warning") if @post_types.empty? %>
-            <%= raw cama_do_pagination(@post_types) %>
+            <%= cama_do_pagination(@post_types) %>
         </div>
       </div>
       <!-- END BASIC TABLE SAMPLE -->

data/app/views/camaleon_cms/admin/settings/shortcodes.html.erb

@@ -13,17 +13,17 @@
                     </tr>
                     </thead>
                     <tbody>
-                    <% @_shortcodes.each do |code| %>
+                    <% shortcodes_list.each do |code| %>
                         <tr>
                             <td>
                                 <code>[<%= code %>]</code>
                             </td>
-                            <td class="col_descr"><%= @_shortcodes_descr[code] %></td>
+                            <td class="col_descr"><%= shortcodes_descriptions[code] %></td>
                         </tr>
                     <% end %>
                     </tbody>
                 </table>
-                <%= content_tag("div", t('camaleon_cms.admin.message.data_found_list'), class: "alert alert-warning") if @_shortcodes.empty? %>
+                <%= content_tag("div", t('camaleon_cms.admin.message.data_found_list'), class: "alert alert-warning") if shortcodes_list.empty? %>
             </div>
         </div>
     </div>
@@ -34,4 +34,4 @@
             $(this).html($(this).html().replace(/\n/g, "<br>"));
         });
     })
-</script>
+</script>

data/app/views/camaleon_cms/admin/settings/site.html.erb

@@ -3,7 +3,7 @@
 <div class="page-content-wrap">
   <div class="panel panel-default">
     <div class="panel-heading">
-      <h4><span class="fa fa-cog"></span> <%= "#{t('camaleon_cms.admin.settings.configuration_site')}: #{@site.the_title} " %> </h4>
+      <h4><span class="fa fa-cog"></span> <%= safe_join([t('camaleon_cms.admin.settings.configuration_site'), ': ', @site.the_title, ' ']) %> </h4>
     </div>
     <%= form_for @site, as: "site", url: {action: :site_saved}, html: {id: "site_settings_form", class: "panel-body cama_ajax_request validate"} do |f| %>
         <div class="tabs">

data/app/views/camaleon_cms/admin/settings/sites/form.html.erb

@@ -5,7 +5,7 @@
         <div class="col-md-8 col-md-offset-2">
           <div class="panel panel-default">
             <div class="panel-heading">
-                <h4><span class="fa fa-cog"></span> <%= @site.new_record? ? t('camaleon_cms.admin.page_title.new_site') : "#{t('camaleon_cms.admin.page_title.edit_site')}: #{@site.the_title} "%> </h4>
+                <h4><span class="fa fa-cog"></span> <%= @site.new_record? ? t('camaleon_cms.admin.page_title.new_site') : safe_join([t('camaleon_cms.admin.page_title.edit_site'), ': ', @site.the_title, ' ']) %> </h4>
             </div>
             <div class="panel-body">
               <%= render partial: 'layouts/camaleon_cms/admin/form_error', locals: {data: @site} %>

data/app/views/camaleon_cms/admin/settings/sites/index.html.erb

@@ -50,7 +50,7 @@
             </tbody>
           </table>
           <%= content_tag("div", raw(t('camaleon_cms.admin.message.data_found_list')), class: "alert alert-warning") if @sites.empty? %>
-            <%= raw cama_do_pagination(@sites) %>
+            <%= cama_do_pagination(@sites) %>
         </div>
       </div>
       <!-- END BASIC TABLE SAMPLE -->

data/app/views/camaleon_cms/admin/user_roles/form.html.erb

@@ -17,6 +17,26 @@
               <%= render partial: 'layouts/camaleon_cms/admin/form_error', locals: {data: @user_role} %>
                 <% rol_values_post_type = @user_role.new_record? ? {} : @user_role.get_meta("_post_type_#{current_site.id.to_s}") %>
                 <% rol_values_manager = @user_role.new_record? ? {} : @user_role.get_meta("_manager_#{current_site.id.to_s}") %>
+                <%# A role whose users are administrators holds every permission through `Ability`'s   %>
+                <%# `can :manage, :all`, which returns before either meta above is read. Their stored  %>
+                <%# metas are only what `set_default_user_roles` seeded when the site was created, so  %>
+                <%# every key added to ROLES afterwards rendered unchecked on existing sites and read  %>
+                <%# as "denied to administrators", which it never was. Deriving the state from the     %>
+                <%# role keeps it true for keys added later, with no backfill task to run and none to  %>
+                <%# write again next time.                                                            %>
+                <%#                                                                                    %>
+                <%# Such a role's boxes are also locked, and `UserRolesController` declines to write   %>
+                <%# its metas — the two conditions are the same predicate, so a locked box, which the  %>
+                <%# browser never submits, cannot silently clear what is stored.                      %>
+                <% grants_all = @user_role.grants_all_permissions? %>
+                <% permissions_editable = @user_role.permissions_editable? %>
+                <%# Without this the locked, all-checked boxes look like a bug rather than a statement %>
+                <%# about what an administrator is. %>
+                <% if grants_all %>
+                    <div class="alert alert-info">
+                      <span class="fa fa-info-circle"></span>&nbsp;<%= t('camaleon_cms.admin.users.admin_holds_all_permissions', default: 'Users with this role are administrators, so they hold every permission below regardless of what is selected. These settings cannot be changed.') %>
+                    </div>
+                <% end %>
               <div id="contents-checkbox" class="form-horizontal">
                 <div class="">
                    <table class="table table-responsive table-hover table-striped">
@@ -49,7 +69,7 @@
                                 values = [] if values == 0
                                 %>
                                 <% if visible %>
-                                    <input type="checkbox" name="rol_values[post_type][<%= value[:key] %>][]" value="<%= pt.id %>" <%= "checked" if values.include?(pt.id)  %> <%= "disabled" unless @user_role.editable?  %> onclick="<%= "cama_user_roles_do_all_publish(this, '#{value[:color]}', '#{value[:key]}')" %>" >
+                                    <input type="checkbox" name="rol_values[post_type][<%= value[:key] %>][]" value="<%= pt.id %>" <%= "checked" if grants_all || values.include?(pt.id)  %> <%= "disabled" unless permissions_editable  %> onclick="<%= "cama_user_roles_do_all_publish(this, '#{value[:color]}', '#{value[:key]}')" %>" >
                                 <% end %>
                               </td>
                           <% end %>
@@ -61,12 +81,13 @@
                 </div>
 
                 <div class="">
-                  <h5><%= t('camaleon_cms.admin.users.others_permissions')%></h5>
+                  <h5><%= t('camaleon_cms.admin.users.other_permissions')%></h5>
                   <div class="row">
                     <% values = rol_values_manager || {}  %>
+                    <%# Same rule as the grid above: see `grants_all` where it is assigned. %>
                     <% cama_get_roles_values[:manager].each do |value|  %>
                         <div class="col-md-4">
-                          <label><input type="checkbox" name="rol_values[manager][<%= value[:key] %>]" value="1" <%= "checked" if values[value[:key].to_sym].present?  %> <%= "disabled" unless @user_role.editable?  %> >&nbsp; <%= raw value[:label] %></label>
+                          <label><input type="checkbox" name="rol_values[manager][<%= value[:key] %>]" value="1" <%= "checked" if grants_all || values[value[:key].to_sym].present?  %> <%= "disabled" unless permissions_editable  %> <%= 'data-danger-select-eval=1' if value[:key].to_s == 'select_eval' %> >&nbsp; <%= raw value[:label] %></label>
                           &nbsp;<%= raw cama_html_tooltip(value[:description], 'right') if value[:description].present? %>
                         </div>
                     <% end %>
@@ -77,7 +98,7 @@
 
 
             </div>
-            <% if @user_role.editable? %>
+            <% if permissions_editable %>
                 <div id="checked-actions" class="panel-footer text-right">
                   <a class="btn btn-default btn-sm" data-type="all" href="#"><%= t('camaleon_cms.admin.button.select_all') %></a>
                   <a class="btn btn-default btn-sm" data-type="none" href="#"><%= t('camaleon_cms.admin.button.select_none') %></a>
@@ -119,20 +140,94 @@
   <!-- END PAGE CONTENT WRAPPER -->
 </div>
 
+<div class="modal fade" id="select-eval-danger-modal" tabindex="-1" role="dialog" aria-labelledby="select-eval-danger-modal-title" aria-hidden="true">
+  <div class="modal-dialog" role="document">
+    <div class="modal-content">
+      <div class="modal-header">
+        <button type="button" class="close" data-dismiss="modal" aria-label="<%= t('camaleon_cms.admin.button.cancel') %>">
+          <span aria-hidden="true">&times;</span>
+        </button>
+        <h4 class="modal-title" id="select-eval-danger-modal-title"><%= t('camaleon_cms.admin.users.select_eval_modal.title') %></h4>
+      </div>
+      <div class="modal-body">
+        <p><%= t('camaleon_cms.admin.users.select_eval_modal.description') %></p>
+      </div>
+      <div class="modal-footer">
+        <button type="button" class="btn btn-default" data-role="select-eval-cancel" data-dismiss="modal"><%= t('camaleon_cms.admin.button.cancel') %></button>
+        <button type="button" class="btn btn-danger" data-role="select-eval-confirm"><%= t('camaleon_cms.admin.button.accept') %></button>
+      </div>
+    </div>
+  </div>
+</div>
+
 <script>
     jQuery(function($){
+      var pendingDangerSelectEval = null
+      var pendingDangerSelectEvalConfirmed = false
+      var $allCheckboxes = $("#contents-checkbox input[type='checkbox']")
+      var $selectEvalCheckbox = $("#contents-checkbox input[data-danger-select-eval='1']")
+      var $selectEvalModal = $("#select-eval-danger-modal")
+
+      function openSelectEvalDangerModal(checkbox){
+          pendingDangerSelectEval = checkbox
+          pendingDangerSelectEvalConfirmed = false
+          checkbox.prop("checked", false)
+          $selectEvalModal.modal("show")
+      }
+
+      function shouldWarnForSelectEvalEnable(wasChecked){
+          return $selectEvalCheckbox.length && !$selectEvalCheckbox.prop("disabled") && !wasChecked
+      }
+
       $("#contents-checkbox input:checked").each(function(){$(this).attr("data-checked", 1)})
+
+      $("#contents-checkbox").on("change", "input[data-danger-select-eval='1']", function(){
+          if($(this).prop("checked")){
+              openSelectEvalDangerModal($(this))
+          }
+      })
+
+      $selectEvalModal.find("[data-role='select-eval-confirm']").on("click", function(){
+          if(pendingDangerSelectEval){
+              pendingDangerSelectEval.prop("checked", true)
+              pendingDangerSelectEvalConfirmed = true
+          }
+          $selectEvalModal.modal("hide")
+      })
+
+      $(document).on("keydown", function(event){
+          if(event.which === 27 && $selectEvalModal.hasClass("in")){
+              $selectEvalModal.modal("hide")
+          }
+      })
+
+      $selectEvalModal.on("hidden.bs.modal", function(){
+          if(pendingDangerSelectEval && !pendingDangerSelectEvalConfirmed){
+              pendingDangerSelectEval.prop("checked", false)
+          }
+          pendingDangerSelectEval = null
+          pendingDangerSelectEvalConfirmed = false
+      })
+
       $("#checked-actions a[data-type]").click(function(){
           switch ($(this).attr("data-type")){
               case 'all':
-                  $("#contents-checkbox input[type='checkbox']").prop('checked', true);
+                  var wasSelectEvalChecked = $selectEvalCheckbox.prop('checked');
+                  $allCheckboxes.prop('checked', true);
+                  if(shouldWarnForSelectEvalEnable(wasSelectEvalChecked)){
+                      openSelectEvalDangerModal($selectEvalCheckbox)
+                  }
               break;
               case 'none':
-                  $("#contents-checkbox input[type='checkbox']").prop('checked', false);
+                  $allCheckboxes.prop('checked', false);
               break;
               case 'restore':
-                  $("#contents-checkbox input[type='checkbox']").prop('checked', false);
+                  var wasSelectEvalCheckedBeforeRestore = $selectEvalCheckbox.prop('checked');
+                  $allCheckboxes.prop('checked', false);
                   $("#contents-checkbox input[data-checked]").prop('checked', true);
+                  if(shouldWarnForSelectEvalEnable(wasSelectEvalCheckedBeforeRestore) && $selectEvalCheckbox.is("[data-checked]")){
+                      openSelectEvalDangerModal($selectEvalCheckbox)
+                  }
               break;
           }
           return false;

data/app/views/camaleon_cms/admin/user_roles/index.html.erb

@@ -45,7 +45,7 @@
             </tbody>
           </table>
           <%= content_tag("div", raw(t('camaleon_cms.admin.message.data_found_list')), class: "alert alert-warning") if @user_roles.empty? %>
-            <%= raw cama_do_pagination(@user_roles) %>
+            <%= cama_do_pagination(@user_roles) %>
 
         </div>
 

data/app/views/camaleon_cms/admin/users/form.html.erb

@@ -13,6 +13,9 @@
 
     <div class="row">
         <%= form_for @user, as: "user", url:{action: @user.new_record? ? :create : :update, id: @user.id}, html:{class: 'validate-user  form-horizontal cama_ajax_request', id: "user_form"} do |f| %>
+            <%# A non-admin may not change an admin's password or recovery identifiers (email/username), so
+                the enforcement in UsersController#user_params/#updated_ajax is mirrored here (H10). %>
+            <% credentials_locked = !cama_current_user.may_edit_credentials?(@user) %>
             <div class="col-md-3">
                 <div class="panel panel-default">
                     <div class="panel-body">
@@ -35,11 +38,11 @@
                         </div>
                         <div class="">
                             <label class="control-label"><%= t('camaleon_cms.admin.table.login')%></label>
-                            <%= f.text_field :username, :class => "form-control required" %>
+                            <%= f.text_field :username, :class => "form-control required", disabled: credentials_locked %>
                         </div>
                         <div class="">
                             <label class="control-label"><%= t('camaleon_cms.admin.table.e_mail')%></label>
-                            <%= f.email_field :email, :class => "form-control required email"%>
+                            <%= f.email_field :email, :class => "form-control required email", disabled: credentials_locked %>
                         </div>
                         <% if @user.new_record? %>
                             <div class="">
@@ -54,14 +57,15 @@
                         <div class="">
                             <%= f.label "#{t('camaleon_cms.admin.table.role')}", class: "control-label" %>
                             <div class="">
-                                <%= f.select :role,current_site.user_roles.reorder(:name).decorate.map{|role| [role.the_title, role.slug]}, {}, {:class => "form-control required", disabled: !cama_current_user.role_grantor?(@user)}%>
+                                <%# Only offer the admin role to someone who may actually grant it (H10); keep it listed when editing a user who already holds it so their role still displays. %>
+                                <%= f.select :role, current_site.user_roles.reorder(:name).decorate.reject { |role| role.slug == 'admin' && !cama_current_user.role_grantor?(@user, 'admin') && @user&.role.to_s != 'admin' }.map{|role| [role.the_title, role.slug]}, {}, {:class => "form-control required", disabled: !cama_current_user.role_grantor?(@user)}%>
                             </div>
                         </div>
                         <hr>
                         <div class="">
                             <button type="submit" class="btn btn-success btn-block" ><%= @user.new_record? ? t('camaleon_cms.admin.button.create') : t('camaleon_cms.admin.button.update') %></button>
                         </div>
-                        <% if !@user.new_record? %>
+                        <% if !@user.new_record? && !credentials_locked %>
                             <div class="">
                                 <a href="#" class="btn btn-warning btn-block btn-rounded" data-toggle="modal" data-target="#modal_change_password"><%= t('camaleon_cms.admin.button.change_password') %></a>
                             </div>

data/app/views/camaleon_cms/admin/users/index.html.erb

@@ -45,7 +45,7 @@
                         <%= link_to raw('<i class="fa fa-times"></i>'), { action: :destroy, id: f.id },
                                 method: :delete, data: { confirm: t('camaleon_cms.admin.message.delete_item') }, class: "btn btn-danger btn-xs cama_ajax_request", title: "#{t('camaleon_cms.admin.button.delete')}" %>
                     <% end %>
-                    <%= link_to raw('<i class="fa fa-retweet"></i>'), {action: :impersonate, id: f.id }, class: "btn btn-default btn-xs cama_ajax_request", title: "#{cama_t('camaleon_cms.admin.users.impersonate')}" if can? :impersonate, f %>
+                    <%= link_to raw('<i class="fa fa-retweet"></i>'), {action: :impersonate, id: f.id }, method: :post, class: "btn btn-default btn-xs cama_ajax_request", title: "#{cama_t('camaleon_cms.admin.users.impersonate')}" if can? :impersonate, f %>
                   </td>
                 </tr>
             <% end %>
@@ -53,7 +53,7 @@
             </tbody>
           </table>
           <%= content_tag("div", raw(t('camaleon_cms.admin.message.data_found_list')), class: "alert alert-warning") if @users.empty? %>
-            <%= raw cama_do_pagination(@users) %>
+            <%= cama_do_pagination(@users) %>
         </div>
       </div>
       <!-- END BASIC TABLE SAMPLE -->

data/app/views/camaleon_cms/default_theme/partials/_render_custom_field.html.erb

@@ -41,9 +41,15 @@
                 %>
                     <p><%= post.decorate.the_title if post.present? %></p>
                 <% when 'field_attrs'
-                    post = JSON.parse(value) rescue {}
+                    attrs = JSON.parse(value) rescue nil
                 %>
-                    <p><%= raw("<strong>#{post['attr']}: </strong>#{post['attr']}") if post.present? %></p>
+                    <% if attrs.is_a?(Hash) && attrs.present? %>
+                      <%# Security (scan-and-reject policy): attr/value are gated at save like editor %>
+                      <%# values -- CustomFieldsRelationship scans the DECODED JSON members (any shape) -- %>
+                      <%# so stored values equal authored values and render verbatim. Guard on Hash so a %>
+                      <%# non-object JSON value (array/scalar) renders nothing instead of raising a 500. %>
+                      <p><strong><%= raw attrs['attr'] %>: </strong><%= raw attrs['value'] %></p>
+                    <% end %>
                 <% else %>
                     <p><%= value %></p>
             <% end %>