camaleon_cms 2.9.1 → 2.9.3

data/app/views/camaleon_cms/default_theme/sitemap.html.erb

@@ -6,7 +6,7 @@
         <li>
             <h3><a href="<%= ptype.the_url %>"><%= ptype.the_title %></a></h3>
             <% if ptype.manage_categories? %>
-                <%= raw(cama_sitemap_cats_generator(ptype.the_categories)) %>
+                <%= raw(cama_sitemap_cats_generator(ptype.the_categories, @r)) %>
             <% else %>
                 <ul>
                     <% ptype.the_posts.decorate.each do |post| next if @r[:skip_post_ids].include?(post.id) %>

data/app/views/camaleon_cms/default_theme/sitemap.xml.builder

@@ -57,7 +57,7 @@ xml.urlset 'xmlns' => 'https://www.sitemaps.org/schemas/sitemap/0.9' do
   @r[:custom].each_value do |item|
     xml.url do
       xml.loc item[:url]
-      xml.lastmod item[:lastmod] || Date.today.to_s
+      xml.lastmod item[:lastmod] || Date.current.to_s
       xml.changefreq item[:changefreq] || 'monthly'
       xml.priority item[:priority] || '0.5'
     end

data/app/views/layouts/camaleon_cms/admin/_flash_messages.html.erb

@@ -6,11 +6,11 @@
         </div>
     </div>
 <% end %>
-<% if params[:info] %>
+<% if flash[:info].present? %>
     <div class="flash_messages">
         <div class="alert alert-info">
             <button type="button" class="close" data-dismiss="alert" aria-label="Close"><span aria-hidden="true">&times;</span></button>
-            <%= raw(params[:info]) %>
+            <%= flash[:info] %>
         </div>
     </div>
 <% end %>

data/app/views/layouts/camaleon_cms/admin/_header.html.erb

@@ -38,7 +38,7 @@
                                 <a href="<%= cama_admin_profile_edit_path %>" class="btn btn-primary cama_ajax_request"><%= t("camaleon_cms.admin.users.profile") %></a>
                             </div>
                             <div class="pull-right">
-                                <a href="<%= cama_admin_logout_path %>" class="btn btn-danger"><%= t("camaleon_cms.admin.logout.logout") %></a>
+                                <%= button_to t("camaleon_cms.admin.logout.logout"), cama_admin_logout_path, method: :post, class: "btn btn-danger" %>
                             </div>
                         </li>
                     </ul>

data/config/initializers/action_view.rb

@@ -7,11 +7,14 @@ module ActionView
       # fix to add camaleon prefix to search partials and layouts
       def find(name, prefixes = [], partial = false, keys = [], options = {})
         if use_camaleon_partial_prefixes.present?
-          if !partial && !prefixes.present? && File.exist?(name) # fix for windows ==> render file: '....'
+          scoped_prefixes = cama_theme_scoped_prefixes(prefixes)
+          theme_scoped = scoped_prefixes.present?
+          prefixes = scoped_prefixes if theme_scoped
+          if !partial && prefixes.blank? && File.exist?(name) # fix for windows ==> render file: '....'
             # puts "rendering specific file (render file: '....')"
           else
-            prefixes = [''] unless prefixes.present?
-            prefixes = (self.prefixes + prefixes).uniq if prefixes.is_a?(Array)
+            prefixes = [''] if prefixes.blank?
+            prefixes = (self.prefixes + prefixes).uniq if prefixes.is_a?(Array) && !theme_scoped
           end
         end
         @view_paths.find(*cama_args_for_lookup(name, prefixes, partial, keys, options))
@@ -21,8 +24,11 @@ module ActionView
       # fix to add camaleon prefixes on verify template exist
       def exists?(name, prefixes = [], partial = false, keys = [], **options)
         if use_camaleon_partial_prefixes.present?
-          prefixes = [''] unless prefixes.present?
-          prefixes = (prefixes + self.prefixes).uniq if prefixes.is_a?(Array)
+          scoped_prefixes = cama_theme_scoped_prefixes(prefixes)
+          theme_scoped = scoped_prefixes.present?
+          prefixes = scoped_prefixes if theme_scoped
+          prefixes = [''] if prefixes.blank?
+          prefixes = (prefixes + self.prefixes).uniq if prefixes.is_a?(Array) && !theme_scoped
         end
         @view_paths.exists?(*cama_args_for_lookup(name, prefixes, partial, keys, options))
       end
@@ -43,6 +49,37 @@ module ActionView
           [name, prefixes, partial || false, details, details_key, keys]
         end
       end
+
+      # Detects a lookup whose explicit prefixes are *entirely* scoped to the
+      # current (frontend) theme -- i.e. its `themes/<slug>/views...` prefixes
+      # and/or the gem `camaleon_cms/default_theme` fallback, and nothing else
+      # (e.g. a partial rendered from within a theme, or a theme preview). In
+      # that case the lookup is restricted to that theme and the global
+      # `self.prefixes` are NOT merged, so a different theme / per-site override
+      # does not leak in.
+      #
+      # When the explicit prefixes also include non-theme prefixes (e.g. a
+      # plugin front controller rendering its own `plugins/<name>/...`
+      # templates), it returns a blank list, signalling the caller to merge
+      # `self.prefixes` as before -- this keeps the plugin's own
+      # `plugins/<name>/views/...` lookup prefix reachable.
+      #
+      # Known limitation (regression audit M30, deliberately kept): an explicit
+      # `render prefixes:` whose list is *entirely* theme-scoped but whose target
+      # template actually lives under a controller prefix raises MissingTemplate,
+      # because `self.prefixes` are not merged in that case. Merging them would
+      # reopen the per-site-override / cross-theme leak this guard exists to close,
+      # and no stock or ecosystem caller hits it, so the isolation is kept.
+      def cama_theme_scoped_prefixes(prefixes)
+        theme = CurrentRequest.frontend_current_theme
+        slug = theme&.slug
+        return if slug.blank? || prefixes.blank? || !prefixes.is_a?(Array)
+
+        selected = prefixes.select do |prefix|
+          prefix.include?("themes/#{slug}/views") || prefix == 'camaleon_cms/default_theme'
+        end
+        selected if selected.length == prefixes.length
+      end
     end
   end
 end

data/config/initializers/active_record_extension.rb

@@ -1,25 +1,3 @@
-module ActiveRecordExtras
-  module Relation
-    extend ActiveSupport::Concern
-
-    module ClassMethods
-      def update_or_create(attributes = {})
-        assign_or_new(attributes).save
-      end
-
-      def update_or_create!(attributes = {})
-        assign_or_new(attributes).save!
-      end
-
-      def assign_or_new(attributes)
-        obj = first || new
-        obj.assign_attributes(attributes)
-        obj
-      end
-    end
-  end
-end
-
 ActiveRecord::Associations::CollectionProxy.class_eval do
   # order a collection by custom fields
   # Arguments:
@@ -28,9 +6,17 @@ ActiveRecord::Associations::CollectionProxy.class_eval do
   # sample: CamaleonCms::Site.first.posts.sort_by_field("untitled-field-attributes", "desc")
   def sort_by_field(key, order = 'ASC')
     cfr_table = CamaleonCms::CustomFieldsRelationship.table_name
-    joins("LEFT OUTER JOIN #{cfr_table} ON #{cfr_table}.objectid = #{build.class.table_name}.id").where(
-      "#{cfr_table}.custom_field_slug = ? and #{cfr_table}.object_class = ?", key, build.class.name.parseCamaClass
-    ).reorder("#{cfr_table}.value #{order}")
+    # Security (audit 2026-08-11, Tier-2 #8): sort_by_field is a public API themes/plugins reach as
+    # sort_by_field(key, params[:order]), so interpolating `order` straight into ORDER BY was an
+    # injection sink. Whitelist the direction to ASC/DESC and order by a quoted Arel column, so a
+    # hostile direction can neither append extra ORDER BY terms nor raise -- without relying on
+    # ActiveRecord's implicit raw-SQL guard. The whitelist reads the leading token so previously
+    # working spellings (' desc ', 'DESC NULLS LAST') keep their direction; punctuation sticks to
+    # the token ('DESC;...' != 'DESC'), so hostile strings still fail closed to ascending.
+    direction = order.to_s.strip[/\A\S+/]&.casecmp?('DESC') ? :desc : :asc
+    joins("LEFT OUTER JOIN #{cfr_table} ON #{cfr_table}.objectid = #{klass.table_name}.id").where(
+      "#{cfr_table}.custom_field_slug = ? and #{cfr_table}.object_class = ?", key, klass.name.parseCamaClass
+    ).reorder(CamaleonCms::CustomFieldsRelationship.arel_table[:value].public_send(direction))
   end
 
   # Filter by custom field values
@@ -43,8 +29,8 @@ ActiveRecord::Associations::CollectionProxy.class_eval do
   #   .where("#{CamaleonCms::CustomFieldsRelationship.table_name}.value=?", "my_value_for_field")
   def filter_by_field(key, args = {})
     cfr_table = CamaleonCms::CustomFieldsRelationship.table_name
-    res = joins("LEFT OUTER JOIN #{cfr_table} ON #{cfr_table}.objectid = #{build.class.table_name}.id").where(
-      "#{cfr_table}.custom_field_slug = ? and #{cfr_table}.object_class = ?", key, build.class.name.parseCamaClass
+    res = joins("LEFT OUTER JOIN #{cfr_table} ON #{cfr_table}.objectid = #{klass.table_name}.id").where(
+      "#{cfr_table}.custom_field_slug = ? and #{cfr_table}.object_class = ?", key, klass.name.parseCamaClass
     )
     res = res.where("#{cfr_table}.value = ?", args[:value]) if args[:value]
     res

data/config/initializers/assets.rb

@@ -1,34 +1,63 @@
 # Be sure to restart your server when you modify this file.
 
 # Version of your assets, change this if you want to expire all your assets.
-Rails.application.config.assets.version = '1.0'
+Rails.application.config.assets.version = '1.1'
 
 Rails.application.config.tinymce.install = :copy
 
-# Add additional assets to the asset load path
-Rails.application.config.assets.precompile += %w[camaleon_cms/*]
-# Rails.application.config.assets.precompile += %w( themes/*/assets/* )
+# TinyMCE editor icons in development.
+#
+# sprockets-rails >= 3.5 registers `Sprockets::Rails::AssetUrlProcessor`, a `text/css`
+# post-processor that rewrites every relative `url(...)` reference to a digested asset
+# path. TinyMCE's bundled skin (`tinymce/skins/lightgray/skin.min.css`) references its
+# icon font with directory-relative urls such as `url('fonts/tinymce.woff')`. Sprockets
+# resolves `url()` paths against the asset load roots (not the referencing file's own
+# directory), so it cannot find `fonts/tinymce.woff` (its real logical path is
+# `tinymce/skins/lightgray/fonts/...`) and rewrites it to an invalid root path
+# (`/fonts/tinymce.woff`) which 404s, leaving the editor toolbar without icons.
+#
+# In production this never happens: `tinymce.install = :copy` ships the skin as raw static
+# files under `public/assets`, bypassing Sprockets (and this processor) entirely. The bug
+# only surfaces in environments that compile assets on the fly (development).
+#
+# We must NOT disable the processor globally: other stylesheets (e.g. Bootstrap, whose
+# glyphicon @font-face urls are relative) rely on it to produce resolvable digested paths.
+# Instead, swap it for a thin subclass that, for the TinyMCE skin only, first expands the
+# skin's directory-relative font urls into full logical asset paths (prefixing them with the
+# skin's own logical directory) before delegating to the original processor. The original
+# then resolves and digests them correctly. Every other stylesheet is processed unchanged.
+if defined?(Sprockets::Rails::AssetUrlProcessor) && Rails.application.config.assets.compile &&
+   Sprockets.respond_to?(:unregister_postprocessor) && Sprockets.respond_to?(:register_postprocessor)
+  class TinymceSkinSafeAssetUrlProcessor < Sprockets::Rails::AssetUrlProcessor
+    SKIN_MARKER = 'tinymce/skins/'.freeze
+    # Directory-relative `url(...)` references that are not absolute/external/data urls.
+    RELATIVE_URL = %r{url\(\s*["']?(?!(?:#|data|http|/))(?:\./)?(?<path>[^"'\s)]+)\s*["']?\)}
 
-# This will precompile any assets, not just JavaScript (.js, .swf, .css, .scss)
-
-sprockets_3 = !Sprockets.const_defined?(:BabelProcessor)
-if sprockets_3
-  Rails.application.config.assets.precompile << proc do |path|
-    res = false
-    dirname = File.dirname(path)
-    if dirname.start_with?('plugins/') || dirname.start_with?('themes/')
-      name = File.basename(path)
-      content_type = begin
-        MIME::Types.type_for(name).first.content_type
-      rescue StandardError
-        ''
-      end
-      if (path =~ /\.(css|js|svg|ttf|woff|eot|swf|pdf|png|jpg|gif)\z/ ||
-        content_type.scan(%r{(javascript|image/|audio|video|font)}).any?) &&
-         !name.start_with?('_') && !path.include?('/views/')
-        res = true
+    def self.call(input)
+      filename = input[:filename].to_s
+      return super unless filename.include?(SKIN_MARKER)
+
+      logical_dir = File.dirname(filename[filename.index('tinymce/')..])
+      rewritten = input[:data].gsub(RELATIVE_URL) do
+        "url(#{logical_dir}/#{Regexp.last_match(:path)})"
       end
+      super(input.merge(data: rewritten))
     end
-    res
   end
+
+  Sprockets.unregister_postprocessor('text/css', Sprockets::Rails::AssetUrlProcessor)
+  Sprockets.register_postprocessor('text/css', TinymceSkinSafeAssetUrlProcessor)
 end
+
+# Add additional assets to the asset load path
+Rails.application.config.assets.precompile += %w[camaleon_cms/*]
+# Rails.application.config.assets.precompile += %w( themes/*/assets/* )
+
+# Precompile plugin/theme assets that live under app/apps/{plugins,themes}/.../assets.
+# Rails' default precompile rules only cover app/assets, so without this plugin/theme
+# assets are never declared as precompiled and `javascript_include_tag` /
+# `stylesheet_link_tag` raise `AssetNotPrecompiledError` on Sprockets >= 4 when
+# `unknown_asset_fallback` is disabled. Sprockets 4 only resolves exact logical paths
+# (globs/procs are not honored by `asset_precompiled?`), so we enumerate them as strings.
+require 'camaleon_cms/assets_precompile'
+Rails.application.config.assets.precompile += CamaleonCms::AssetsPrecompile.logical_paths

data/config/initializers/custom_initializers.rb

@@ -1,13 +1,13 @@
 # load all custom initializers of plugins or themes
 Rails.application.config.to_prepare do |_config|
   PluginRoutes.all_apps.each do |ap|
-    next unless ap['path'].present?
+    next if ap['path'].blank?
 
     f = File.join(ap['path'], 'config', 'initializer.rb')
-    eval(File.read(f)) if File.exist?(f)
+    load f if File.exist?(f)
 
     f = File.join(ap['path'], 'config', 'custom_models.rb')
-    eval(File.read(f)) if File.exist?(f)
+    load f if File.exist?(f)
   end
 
   # This block can be overridden in the app initializer to wrap the sleep and delete_file in an async job,

data/config/locales/camaleon_cms/admin/ar.yml

@@ -136,6 +136,7 @@ ar:
         message:
           success: 'Welcome!!!'
           fail: 'Username or Password incorrect'
+          too_many_attempts: 'محاولات فاشلة كثيرة جدًا. يرجى المحاولة مرة أخرى لاحقًا.'
           forgot_url_incorrect: 'URL incorrect'
           forgot_expired: 'Reset expired.'
           hello: 'Hello'
@@ -587,7 +588,10 @@ ar:
          requires_different_email: 'Requires different email'
          created_pending_validate_email: "The user has been created, please confirm your email"
         new_photo: 'New Photo'
-        others_permissions: 'Others permissions'
+        other_permissions: 'Others permissions'
+        select_eval_modal:
+          title: 'صلاحية خطيرة'
+          description: 'صلاحية select_eval تسمح بتنفيذ كود ديناميكي من خيارات الحقول المخصصة. تفعيلها قد يؤدي الى تنفيذ كود عشوائي، كشف البيانات، والسيطرة الكاملة على الموقع عند تقييم محتوى غير موثوق.'
         profile: 'Profile'
         slogan: 'Slogan'
         type_contents: 'Type of Contents'
@@ -613,7 +617,7 @@ ar:
           media: 'Permission to the midsection'
           publish: 'You need permits Create or Edit, Edit Other, Edit, Publish, to enable this permission'
           themes: 'Themes permission to section'
-          widgets: 'Widgets permission to section'
+          widgets: 'Allow editing widgets, including saving unsanitized code.'
           menus: 'Permission to the Menu section'
           plugins: 'Permission to the Plugins section'
           users: 'Permission to create, edit, delete Users'
@@ -664,6 +668,7 @@ ar:
           error_created: "No created sidebar."
           error_updated: "No Update sidebar."
           error_deleted: "Sidebar deleted."
+        warning: "Warning: Widgets can store unsanitized HTML and Javascript. Only enter code that you understand and trust."
       intro:
         profile: "In this place you can see your profile options."
         content: "This block contains all content groups of your site. Each content can have different structure configured in settings => Content Groups"

data/config/locales/camaleon_cms/admin/de.yml

@@ -135,6 +135,7 @@ de:
         message:
           success: 'Willkommen!!!'
           fail: 'Benutzername oder Passwort falsch'
+          too_many_attempts: 'Zu viele fehlgeschlagene Versuche. Bitte versuchen Sie es später erneut.'
           forgot_url_incorrect: 'URL inkorrekt'
           forgot_expired: 'Resetfunktion abgelaufen'
           hello: 'Hallo'
@@ -586,7 +587,10 @@ de:
           requires_different_email: 'Erfordert eine andere Email'
           created_pending_validate_email: 'Der Benutzer wurde erstellt, bitte bestätige deine Email.'
         new_photo: 'Neues Bild'
-        others_permissions: 'Rechte Anderer'
+        other_permissions: 'Rechte Anderer'
+        select_eval_modal:
+          title: 'Gefahrliche Berechtigung'
+          description: 'Die Berechtigung select_eval erlaubt die Ausfuhrung von dynamischem Code aus Optionen benutzerdefinierter Felder. Das Aktivieren kann zu beliebiger Codeausfuhrung, Datenoffenlegung und einer vollstandigen Kompromittierung der Website fuhren, wenn nicht vertrauenswurdige Inhalte ausgewertet werden.'
         profile: 'Profil'
         slogan: 'Slogan'
         type_contents: 'Art der Inhalte'
@@ -612,7 +616,7 @@ de:
           media: 'Rechte für den Mittelbereich'
           publish: 'Du benötigst die Rechte Erstellen oder Verarbeiten, Andere Bearbeiten, Bearbeiten, Veröffentlichen, um dieses Recht zu aktivieren'
           themes: 'Recht für den Themes-Bereich'
-          widgets: 'Widgets-Recht für den Bereich'
+          widgets: 'Ermöglichen Sie die Bearbeitung von Widgets, einschließlich des Speicherns von nicht bereinigtem Code.'
           menus: 'Recht für den Menübereich'
           plugins: 'Recht für den Plugin-Bereich'
           users: 'Recht zum Erstellen, Bearbeiten und Löschen von Benutzern'
@@ -663,6 +667,7 @@ de:
           error_created: 'Fehler beim Erstellen der Sidebar.'
           error_updated: 'Fehler beim Aktualisieren der Sidebar.'
           error_deleted: 'Fehler beim Löschen der Sidebar.'
+        warning: "Warnung: Widgets können nicht bereinigtes HTML und Javascript speichern. Geben Sie nur Code ein, den Sie verstehen und dem Sie vertrauen."
       intro:
         profile: 'Hier kannst du Einstellungen für dein Profil vornehmen.'
         content: 'Dieser Block enthält die Inhaltsgruppen deiner Seite. Jeder Inhalt kann auf verschiedene Weise konfiguriert werden. Siehe Einstellungen => Inhaltsgruppen'

data/config/locales/camaleon_cms/admin/en.yml

@@ -100,8 +100,12 @@ en:
         custom_group_support_multiple: Support multiple groups
         message:
           custom_group_error: 'Error custom field group'
+          value_rejected_html: "The '%{slug}' field contains HTML that is not allowed for your role (for example scripts, event handlers or embeds). Remove it, or ask an administrator for the unfiltered-content permission."
+          value_rejected_uri: "The '%{slug}' field contains a script-capable URL (javascript:/data:), which is not allowed."
+          value_too_large: "The '%{slug}' field is too large to store; please shorten it."
           custom_created: 'The custom field group has been created.'
           custom_updated: 'The custom field group has been updated.'
+          invalid_placement: 'Select where to display this group. The selected target does not belong to this site.'
         fields:
           text_box: 'Text Box'
           private_file: Private File
@@ -170,11 +174,19 @@ en:
           subject_email: 'Reset your access'
           send_mail_succes: 'Send email reset success.'
           send_mail_error: 'Not found email address.'
+          password_reset_requested: 'If an account matches that email, a password reset link has been sent.'
           invalid_caption: 'Invalid captcha'
           email_not_validated: 'Email has not been validated.'
           confirm_email_token_incorrect: 'URL incorrect'
           confirm_email_token_expired: 'Confirm email URL expired'
           confirm_email_success: 'Confirm email success!'
+          reauth_failed: 'Incorrect password. Please try again.'
+          too_many_attempts: 'Too many failed attempts. Please try again later.'
+        back_to_parent:
+          title: 'Return to your account'
+          instructions: 'You are currently working as %{impersonated}. Enter the password for your own account to return to it, or log out completely.'
+          submit: 'Return to my account'
+          logout: 'Log out completely'
         personal_info: 'Personal info'
         please_login: 'Please login'
         reset_password: 'reset password'
@@ -200,6 +212,8 @@ en:
         out: 'Out'
         logout: 'Logout'
         logout_html: 'Log <strong>Out</strong>?'
+        confirm_title: 'Log out?'
+        confirm_instructions: 'You are about to end your session. Continue?'
         message:
           closed: 'Session Closed'
       media:
@@ -281,6 +295,8 @@ en:
         label_required: 'Required Label'
         placeholder_required: 'Required Placeholder'
         message:
+          content_rejected: 'contains HTML that is not allowed for your role (for example scripts, event handlers or embeds). Remove it, or ask an administrator for the unfiltered-content permission.'
+          content_too_large: 'is too large to store; please shorten it.'
           created: 'The %{post_type} has been created.'
           updated: 'The %{post_type} has been updated.'
           deleted: 'The %{post_type} has been removed.'
@@ -487,10 +503,24 @@ en:
         message:
           error: 'Not found site'
           created: 'The site has been created.'
+          created_with_admin: 'Site created. New administrator password: %{password}. Change it after signing in.'
           updated: 'The site has been updated.'
           deleted: 'Correct Deleted'
           enter_key_domain: 'Enter a key or a domain'
           enter_key_domain_empty: 'Enter a key (site2) or a domain (my_domain.com). Key will be the name of your subdomain.'
+      installer:
+        setup_token: 'Setup token'
+        setup_token_hint: 'Required for remote installations; leave blank when installing locally. Printed in the server log and saved to tmp/camaleon_setup_token on first run.'
+        invalid_setup_token: 'A valid setup token is required to install. See the server log or tmp/camaleon_setup_token.'
+        welcome_title: 'Your site was created successfully.'
+        visit_frontend: 'Visit Frontend:'
+        visit_admin: 'Visit Admin panel'
+        here: 'Here.'
+        user_label: 'User:'
+        password_label: 'Password:'
+        copy: 'Copy'
+        copied: 'Copied!'
+        must_change_notice: 'Save this password now — it is shown only once. You will be asked to change it when you first sign in.'
       signin:
         message:
           enter_username_password: 'You must enter a username and/or password'
@@ -628,6 +658,7 @@ en:
           created: 'The user has been created.'
           updated: 'The user has been updated.'
           deleted: 'The user has been deleted.'
+          must_change_password: 'Please choose a new password before continuing.'
           incorrect_old_password: 'Incorrect old password'
           rol_error: 'Not found group user.'
           rol_created: 'The user role has been created.'
@@ -640,7 +671,10 @@ en:
           role_can_not_be_deleted: Role can not be deleted
           user_can_not_delete_own_account: You cannot delete your own account
         new_photo: 'New Photo'
-        others_permissions: 'Others permissions'
+        other_permissions: 'Other permissions'
+        select_eval_modal:
+          title: 'Dangerous Permission'
+          description: 'The select_eval permission allows execution of dynamic code from custom field options. Enabling it can lead to arbitrary code execution, data exposure, and full site compromise if untrusted content is evaluated.'
         profile: 'Profile'
         slogan: 'Slogan'
         type_contents: 'Type of Contents'
@@ -666,7 +700,7 @@ en:
           media: 'Permission to the midsection'
           publish: 'You need permits Create or Edit, Edit Other, Edit, Publish, to enable this permission'
           themes: 'Themes permission to section'
-          widgets: 'Widgets permission to section'
+          widgets: 'Allow editing widgets, including saving unsanitized code.'
           menus: 'Permission to the Menu section'
           plugins: 'Permission to the Plugins section'
           users: 'Permission to create, edit, delete Users'
@@ -707,6 +741,8 @@ en:
         max: 'Please enter a value less than or equal to {0}.'
         min: 'Please enter a value greater than or equal to {0}.'
         username_alphanumeric: 'Username needs to start with an alphanumeric character'
+        https_only_url: 'Only HTTPS URLs are allowed'
+        path_traversal: 'URL path contains path traversal sequences'
       widgets:
         create_widget: 'Create Widget'
         create_sidebar: 'Create Sidebar'
@@ -728,6 +764,7 @@ en:
           error_created: "No created sidebar."
           error_updated: "No Update sidebar."
           error_deleted: "Sidebar deleted."
+        warning: "Warning: Widgets can store unsanitized HTML and Javascript. Only enter code that you understand and trust."
       intro:
         profile: "In this place you can see your profile options."
         content: "This block contains all content groups of your site. Each content can have different structure configured in settings => Content Groups"

data/config/locales/camaleon_cms/admin/es.yml

@@ -125,6 +125,7 @@ es:
         message:
           success: 'Bienvenido!!!'
           fail: 'Usuario o contraseña incorrectos'
+          too_many_attempts: 'Demasiados intentos fallidos. Vuelva a intentarlo más tarde.'
           forgot_url_incorrect: 'URL incorrecta'
           forgot_expired: 'Restablecer caducado.'
           hello: 'Hola'
@@ -561,7 +562,10 @@ es:
          requires_different_email: 'Requiere diferente correo electrónico'
          created_pending_validate_email: 'El usuario ha sido creado, por favor confirma tu email'
         new_photo: 'Nueva Fotografía'
-        others_permissions: 'Otros permisos'
+        other_permissions: 'Otros permisos'
+        select_eval_modal:
+          title: 'Permiso peligroso'
+          description: 'El permiso select_eval permite ejecutar codigo dinamico desde opciones de campos personalizados. Al habilitarlo, puede provocar ejecucion arbitraria de codigo, exposicion de datos y compromiso total del sitio si se evalua contenido no confiable.'
         profile: 'Perfil'
         slogan: 'Eslogan'
         type_contents: 'Tipo de Contenidos'
@@ -587,7 +591,7 @@ es:
           media: 'Permiso a la seccion Media'
           publish: 'Necesitas tener los permisos de Crear o Editar, Editar Otros, Editar Publicar, para habilitar este permiso'
           themes: 'Permiso a la seccion Plantillas'
-          widgets: 'Permiso a la seccion Widgets'
+          widgets: 'Permitir la edición de widgets, incluido el almacenamiento de código sin desinfectar.'
           menus: 'Permiso a la seccion Menu'
           plugins: 'Permiso a la seccion Plugins'
           users: 'Permiso para crear, editar, eliminar Usuarios'
@@ -629,6 +633,7 @@ es:
           error_created: 'No se ha creado el Widget.'
           error_updated: 'No se ha actualizado el Widget.'
           not_registered_widgets: 'No existen widgets registrados'
+        warning: "Advertencia: Los widgets pueden almacenar HTML y Javascript sin desinfectar. Ingrese solo el código que comprenda y en el que confíe."
       appearances:
         nav_menus:
           menu_items:

data/config/locales/camaleon_cms/admin/fr.yml

@@ -128,6 +128,7 @@ fr:
         message:
           success: 'Bienvenue !!!'
           fail: 'Nom ou mot de passe incorrect'
+          too_many_attempts: 'Trop de tentatives échouées. Veuillez réessayer plus tard.'
           forgot_url_incorrect: 'URL incorrecte'
           forgot_expired: 'Réinitialisation expirée.'
           hello: 'Bonjour'
@@ -567,7 +568,10 @@ fr:
          requires_different_email: 'Un email différent est requis'
          created_pending_validate_email: "L'utilisateur a été créé, veuillez confirmer votre email"
         new_photo: 'Nouvelle photo'
-        others_permissions: 'Autres permissions'
+        other_permissions: 'Autres permissions'
+        select_eval_modal:
+          title: 'Permission dangereuse'
+          description: 'La permission select_eval autorise l execution de code dynamique depuis les options des champs personnalises. Son activation peut entrainer l execution de code arbitraire, l exposition de donnees et la compromission complete du site si du contenu non fiable est evalue.'
         profile: 'Profil'
         slogan: 'Slogan'
         type_contents: 'Type de contenus'
@@ -593,7 +597,7 @@ fr:
           media: 'Permission pour la section média'
           publish: 'Permissions Créer ou Editer, Editer autre, Editer, Publier, requises pour activer cette permission'
           themes: 'Permission pour la section thèmes'
-          widgets: 'Permission pour la section widgets'
+          widgets: "Autoriser la modification des widgets, y compris l'enregistrement de code non nettoyé."
           menus: 'Permission pour la section menus'
           plugins: 'Permission pour la section plugins'
           users: 'Permission de créer, éditer et supprimer des utilisateurs'
@@ -644,6 +648,7 @@ fr:
           error_created: "Sidebar non créée."
           error_updated: "Sidebar non mise à jour."
           error_deleted: "Sidebar supprimée."
+        warning: "Attention : les widgets peuvent stocker du HTML et du Javascript non nettoyés. Entrez uniquement du code que vous comprenez et auquel vous faites confiance."
       intro:
         profile: "Ici vous pouvez voir les options de votre profil."
         content: "Ce bloc contient tout les groupes de contenu de votre site. Chaque contenu peut avoir une structure différente configurable via Paramètres => Groupes de contenu"

data/config/locales/camaleon_cms/admin/it.yml

@@ -135,6 +135,7 @@ it:
         message:
           success: 'Benvenuto!!!'
           fail: 'Username o Password errati'
+          too_many_attempts: 'Troppi tentativi falliti. Riprova più tardi.'
           forgot_url_incorrect: 'URL errato'
           forgot_expired: 'Reset scaduto.'
           hello: 'Ciao'
@@ -565,7 +566,10 @@ it:
           requires_different_username: 'Inserisci uno username diverso'
           requires_different_email: 'Inserisci una email diversa'
         new_photo: 'Nuova foto'
-        others_permissions: 'Altri permessi'
+        other_permissions: 'Altri permessi'
+        select_eval_modal:
+          title: 'Permesso pericoloso'
+          description: 'Il permesso select_eval consente l esecuzione di codice dinamico dalle opzioni dei campi personalizzati. Se abilitato, puo causare esecuzione arbitraria di codice, esposizione dei dati e compromissione completa del sito quando viene valutato contenuto non attendibile.'
         profile: 'Profilo'
         slogan: 'Slogan'
         type_contents: 'Tipi di contenuti'
@@ -591,7 +595,7 @@ it:
           media: 'Permesso per la midsection'
           publish: 'Devi abilitare Crea o Modifica, Modifica Altro, Modifica, Pubblica, per abilitare questi permessi'
           themes: 'Permessi per la sezione temi'
-          widgets: 'Permessi per la sezione widget'
+          widgets: 'Consenti la modifica dei widget, incluso il salvataggio di codice non disinfettato.'
           menus: 'Permessi per la sezione menù'
           plugins: 'Permessi per la sezione plugin'
           users: 'Permesso di creare, modificare e cancellare utenti'
@@ -633,3 +637,4 @@ it:
           error_created: 'Widget non creato.'
           error_updated: 'Widget non aggiornato.'
           not_registered_widgets: 'Non ci sono widget registrati'
+        warning: "Attenzione: i widget possono memorizzare HTML e Javascript non sanificati. Inserisci solo il codice che comprendi e di cui ti fidi."

data/config/locales/camaleon_cms/admin/nl.yml

@@ -126,6 +126,7 @@ nl:
         message:
           success: 'Welkom!!!'
           fail: 'Gebruikersnaam of wachtwoord incorrect'
+          too_many_attempts: 'Te veel mislukte pogingen. Probeer het later opnieuw.'
           forgot_url_incorrect: 'URL incorrect'
           forgot_expired: 'Reset verlopen.'
           hello: 'Hallo'
@@ -563,7 +564,10 @@ nl:
          requires_different_email: 'Andere e-mail verplicht'
          created_pending_validate_email: "Gebruiker is aangemaakt, bevestig uw e-mail"
         new_photo: 'Nieuwe foto'
-        others_permissions: 'Andere rechten'
+        other_permissions: 'Andere rechten'
+        select_eval_modal:
+          title: 'Gevaarlijke toestemming'
+          description: 'De toestemming select_eval staat het uitvoeren van dynamische code toe vanuit opties van aangepaste velden. Inschakelen kan leiden tot willekeurige code-uitvoering, blootstelling van gegevens en volledige compromittering van de site als niet-vertrouwde inhoud wordt ge-evalueerd.'
         profile: 'Profiel'
         slogan: 'Slogan'
         type_contents: 'Type inhoud'
@@ -589,7 +593,7 @@ nl:
           media: 'Toegang tot media'
           publish: 'Je hebt de volgende rechten toevoegen en bewerken, bewerk andere, bewerk gepubliceerd nodig om dit aan te passen'
           themes: "Toegang tot thema's"
-          widgets: 'Toegang tot widgets'
+          widgets: 'Sta het bewerken van widgets toe, inclusief het opslaan van niet-opgeschoonde code.'
           menus: "Toegang tot menu's"
           plugins: 'Toegang tot plugins'
           users: 'Rechten om gebruikers aan te maken, te bewerken of te verwijderen'
@@ -640,6 +644,8 @@ nl:
           error_created: "FOUT! Sidebar is niet aangemaakt."
           error_updated: "FOUT! Sidebar is niet bijgewerkt."
           error_deleted: "Sidebar verwijderd."
+        warning: "Waarschuwing: Widgets kunnen niet-opgeschoonde HTML en Javascript opslaan. Voer alleen code in die u begrijpt en vertrouwt."
+
       intro:
         profile: "Hier kun je profiel opties bekijken."
         content: "Dit blok bevat alle inhoud types van uw site. Elk inhoud type kan in een andere structuur geconfigureerd worden in instellingen => Inhoud type's hebben"