camaleon_cms 2.9.1 → 2.9.3

data/config/locales/camaleon_cms/admin/pt-BR.yml

@@ -126,6 +126,7 @@ pt-BR:
         message:
           success: 'Bem-vindo!!!'
           fail: 'Usuário ou senha incorreta'
+          too_many_attempts: 'Muitas tentativas malsucedidas. Tente novamente mais tarde.'
           forgot_url_incorrect: 'URL incorreta'
           forgot_expired: 'Expirou o prazo para redefinir a senha.'
           hello: 'Olá'
@@ -555,7 +556,10 @@ pt-BR:
          requires_different_username: 'Requer usuário diferente'
          requires_different_email: 'Requer email diferente'
         new_photo: 'Nova foto'
-        others_permissions: 'Outras permissões'
+        other_permissions: 'Outras permissões'
+        select_eval_modal:
+          title: 'Permissao perigosa'
+          description: 'A permissao select_eval permite executar codigo dinamico a partir das opcoes de campos personalizados. Ao habilitar, pode causar execucao arbitraria de codigo, exposicao de dados e comprometimento total do site caso conteudo nao confiavel seja avaliado.'
         profile: 'Perfil'
         slogan: 'Slogan'
         type_contents: 'TIpo de conteúdos'
@@ -581,7 +585,7 @@ pt-BR:
           media: 'Permissão para o meio'
           publish: 'Você precisa permitir Criar ou Editar, Editar Outro, Editar, Publicar , para habilitar esta permissão'
           themes: 'Permissão para a seção Temas'
-          widgets: 'Permissão para a seção Widgets'
+          widgets: 'Permitir a edição de widgets, incluindo salvar código não higienizado.'
           menus: 'Permissão para a seção Menu'
           plugins: 'Permissão para a seção Plugins'
           users: 'Permissão to criar, editar, excluir Usuários'
@@ -623,6 +627,7 @@ pt-BR:
           error_created: 'Nenhum Widget criado.'
           error_updated: 'Nenhum Widget atualizado.'
           not_registered_widgets: 'Não há widgets registrados'
+        warning: "Aviso: Os widgets podem armazenar HTML e Javascript não higienizados. Insira apenas o código que você entende e confia."
       intro:
         profile: "Neste lugar você pode ver suas opções de perfis."
         content: "Este bloco contém todo o grupo de conteúdo de seu site. Cada conteúdo pode ter uma estrutura diferente configurada em Configurações => Grupos de conteúdo"

data/config/locales/camaleon_cms/admin/pt.yml

@@ -124,6 +124,7 @@ pt:
         message:
           success: 'Benvindo!!!'
           fail: 'Utilizador ou password incorreta'
+          too_many_attempts: 'Demasiadas tentativas falhadas. Tente novamente mais tarde.'
           forgot_url_incorrect: 'Endereço incorreto'
           forgot_expired: 'Expirou o prazo para redefinir a password.'
           hello: 'Olá'
@@ -553,7 +554,10 @@ pt:
          requires_different_username: 'Requer utilizador diferente'
          requires_different_email: 'Requer email diferente'
         new_photo: 'Nova foto'
-        others_permissions: 'Outras permissões'
+        other_permissions: 'Outras permissões'
+        select_eval_modal:
+          title: 'Permissao perigosa'
+          description: 'A permissao select_eval permite executar codigo dinamico a partir das opcoes dos campos personalizados. Ao ativar, pode causar execucao arbitraria de codigo, exposicao de dados e comprometimento total do site se conteudo nao confiavel for avaliado.'
         profile: 'Perfil'
         slogan: 'Slogan'
         type_contents: 'TIpo de conteúdos'
@@ -579,7 +583,7 @@ pt:
           media: 'Permissão para o meio'
           publish: 'Permissão para Criar ou Editar, Editar Outro, Editar, Publicar, para habilitar esta permissão'
           themes: 'Permissão para a secção Temas'
-          widgets: 'Permissão para a secção Widgets'
+          widgets: 'Permite a edição de widgets, incluindo salvar código não higienizado.'
           menus: 'Permissão para a secção Menu'
           plugins: 'Permissão para a secção Plugins'
           users: 'Permissão para criar, editar, apagar utilizadores'
@@ -621,6 +625,7 @@ pt:
           error_created: 'Nenhum Widget criado.'
           error_updated: 'Nenhum Widget atualizado.'
           not_registered_widgets: 'Não há widgets registados'
+        warning: "Aviso: Os widgets podem armazenar HTML e Javascript não higienizados. Introduza apenas o código que compreende e em que confia."
       intro:
         profile: "Neste lugar pode ver suas opções de perfis."
         content: "Este bloco contém todo o grupo de conteúdo de seu site. Cada conteúdo pode ter uma estrutura diferente configurada em Configurações => Grupos de conteúdo"

data/config/locales/camaleon_cms/admin/ru.yml

@@ -137,6 +137,7 @@ ru:
         message:
           success: 'Добро пожаловать!!!'
           fail: 'Неверное имя пользователя или пароль'
+          too_many_attempts: 'Слишком много неудачных попыток. Повторите попытку позже.'
           forgot_url_incorrect: 'Неверный URL'
           forgot_expired: 'Сброс истек.'
           hello: 'Привет'
@@ -574,7 +575,10 @@ ru:
          requires_different_email: 'Требуется другая эл. почта'
          created_pending_validate_email: "Пользователь был создан, пожалуйста, подтвердите вашу электронную почту"
         new_photo: 'Новая фотография'
-        others_permissions: 'Другие разрешения'
+        other_permissions: 'Другие разрешения'
+        select_eval_modal:
+          title: 'Опасное право доступа'
+          description: 'Поле типа select_eval позволяет выполнять динамический код из параметров, введённых пользователем. Это может привести к произвольному выполнению кода, утечке данных (в том числе паролей и ключей авторизации) и полной компрометации сайта. Включайте это правл доступа только для доверенных пользователей!'
         profile: 'Профиль'
         slogan: 'Слоган'
         type_contents: 'Тип контента'
@@ -600,7 +604,7 @@ ru:
           media: 'Permission to the midsection'
           publish: 'Вам требуется разрешение на Создание, Редактирование, Редактирование других или Опубликовать чтобы включить это разрешение'
           themes: 'Разрешение тем на раздел'
-          widgets: 'Разрешение виджетов на раздел'
+          widgets: 'Разрешите редактирование виджетов, в том числе сохранение неочищенного кода.'
           menus: 'Разрешение на раздел Меню'
           plugins: 'Разрешение на раздел Плагинов'
           users: 'Разрешение на создание, редактирование и удаление Пользователей'
@@ -651,6 +655,7 @@ ru:
           error_created: "Боковая панель не создана."
           error_updated: "Боковая панель не обновлена."
           error_deleted: "Боковая панель удалена."
+        warning: "Предупреждение: Виджеты могут хранить неочищенный HTML и Javascript. Вводите только тот код, который вы понимаете и которому доверяете."
       intro:
         profile: "Здесь вы можете увидеть настройки вашего профиля."
         content: "Этот блок содержит все группы контента вашего сайта. Каждый контент может иметь различную структуру, их можно настроить в Настройки => Группа контентов"

data/config/locales/camaleon_cms/admin/uk.yml

@@ -134,6 +134,7 @@ uk:
         message:
           success: 'Ласкаво просимо !!!'
           fail: "Неправильне ім'я користувача або пароль"
+          too_many_attempts: 'Забагато невдалих спроб. Спробуйте пізніше.'
           forgot_url_incorrect: 'Неправильний URL'
           forgot_expired: 'Скидання закінчилось.'
           hello: 'Привіт'
@@ -574,7 +575,10 @@ uk:
          requires_different_email: 'Потрібні інші ел. пошта '
          created_pending_validate_email: "Користувач був створений, будь ласка, підтвердіть вашу електронну пошту"
         new_photo: 'Нова фотографія'
-        others_permissions: 'Інші роздільності'
+        other_permissions: 'Інші роздільності'
+        select_eval_modal:
+          title: 'Небезпечний дозвіл'
+          description: 'Дозвіл select_eval дозволяє виконувати динамічний код з параметрів користувацьких полів. Увімкнення може призвести до довільного виконання коду, витоку даних і повної компрометації сайту, якщо обробляється недовірений вміст.'
         profile: 'Профіль'
         slogan: 'Слоган'
         type_contents: 'Тип Контенту'
@@ -600,7 +604,7 @@ uk:
           media: 'Permission to the midsection'
           publish: 'Вам потрібен дозвіл на Створення, редагування, Редагування інших або Опублікувати щоб включити цей дозвіл'
           themes: 'Дозвіл тим на розділ'
-          widgets: 'Дозвіл віджетів на розділ'
+          widgets: 'Уможливлено редагування віджетів, зокрема збереження непродезінфікованого коду.'
           menus: 'Дозвіл на розділ Меню'
           plugins: 'Дозвіл на розділ Плагінів'
           users: 'Дозвіл на створення, редагування і видалення користувачів'
@@ -651,6 +655,7 @@ uk:
           error_created: "Бічна панель не створена."
           error_updated: "Бічна панель не оновлена."
           error_deleted: "Бічна панель видалена."
+        warning: "Попередження: Віджети можуть зберігати непродезінфіковані HTML та Javascript. Вводьте лише той код, який ви розумієте та якому довіряєте."
       intro:
         profile: "Тут ви можете побачити налаштування вашого профілю."
         content: "Цей блок містить всі групи контенту вашого сайту. Кожен контент може мати різну структуру, яких можна налаштувати в Налаштування => Група контентів"

data/config/locales/camaleon_cms/admin/zh-CH.yml

@@ -143,6 +143,7 @@ zh-CN:
         message:
           success: '欢迎登录!!!'
           fail: '用户名或密码不正确'
+          too_many_attempts: '尝试次数过多，请稍后再试。'
           forgot_url_incorrect: '链接错误'
           forgot_expired: '重置链接已过期。'
           hello: '您好'
@@ -607,7 +608,10 @@ zh-CN:
           role_can_not_be_deleted: '无法删除此角色'
           user_can_not_delete_own_account: '用户不能删除自己的帐户'
         new_photo: '新建照片'
-        others_permissions: '其他权限'
+        other_permissions: '其他权限'
+        select_eval_modal:
+          title: '危险权限'
+          description: 'select_eval 权限允许从自定义字段选项中执行动态代码。启用后，如果评估不受信任的内容，可能导致任意代码执行、数据泄露以及站点被完全攻陷。'
         profile: '资料'
         slogan: '标语'
         type_contents: '内容的类型'
@@ -633,7 +637,7 @@ zh-CN:
           media: '媒体资源部分'
           publish: '开启该权限,允许创建,编辑, 或公开'
           themes: '主题部分'
-          widgets: '插件部分'
+          widgets: '允许编辑小部件，包括保存未经清理的代码。'
           menus: '菜单部分'
           plugins: '插件部分'
           users: '创建,编辑,删除用户'
@@ -684,6 +688,7 @@ zh-CN:
           error_created: '侧边栏创建失败'
           error_updated: '侧边栏更新失败'
           error_deleted: "侧边栏已删除."
+        warning: "警告：小组件可以存储未经清理的 HTML 和 Javascript。仅输入您理解和信任的代码。"
       intro:
         profile: "在这个地方，您可以看到您的个人资料选项."
         content: "此块包含您网站的所有内容组。 每个内容可以具有在 设置 => 内容组"

data/config/routes/admin.rb

@@ -8,17 +8,22 @@ Rails.application.routes.draw do
         get 'search'
         get 'login' => 'sessions#login'
         post 'login' => 'sessions#login_post'
-        get 'logout' => 'sessions#logout'
+        # Security (audit M6): logout changes state, so it acts only over POST. The GET renders a
+        # confirmation page instead of 404ing -- frontend themes across the ecosystem link this
+        # path -- and the impersonation flow keeps its redirect (see SessionsController#logout).
+        match 'logout' => 'sessions#logout', via: %i[get post]
+        match 'back_to_parent' => 'sessions#back_to_parent', via: %i[get post]
         match 'forgot' => 'sessions#forgot', via: %i[get post patch]
-        match 'confirm_email' => 'sessions#confirm_email', via: %i[get post path]
+        match 'confirm_email' => 'sessions#confirm_email', via: %i[get post patch]
         match 'register' => 'sessions#register', via: %i[get post patch]
         match 'api/:method', action: :api, via: %i[get post], as: :api
 
         resources :post_type, as: :post_type do
           resources :posts, controller: 'posts' do
             # resources :comments
-            get :trash
-            get :restore
+            # Security (audit M6): state-changing member actions must not ride GET links.
+            patch :trash
+            patch :restore
             collection do
               match 'ajax', via: %i[get post patch]
             end
@@ -41,7 +46,8 @@ Rails.application.routes.draw do
         match 'profile/edit' => 'users#profile_edit', via: %i[get post patch]
         resources :users, controller: 'users' do
           patch 'updated_ajax'
-          get :impersonate, on: :member
+          # Security (audit M6): forces a session switch -- the highest-value CSRF target here.
+          post :impersonate, on: :member
         end
 
         resources :user_roles, controller: 'user_roles' do
@@ -53,11 +59,11 @@ Rails.application.routes.draw do
             collection do
               post 'get_items/:key', action: :get_items, as: :get_items
               post 'reorder'
-              get 'list'
+              match 'list', via: %i[get post]
             end
           end
           get 'site'
-          get 'test_email'
+          post 'test_email' # Security (audit M6): sends mail; must not be a CSRF-able GET
           get 'theme'
           post 'save_theme'
           get 'languages'
@@ -73,25 +79,33 @@ Rails.application.routes.draw do
           resources :comments, controller: 'comments' do
             get 'answer'
             post 'save_answer'
-            get 'toggle_status'
+            patch 'toggle_status' # Security (audit M6): flips moderation state
           end
         end
 
         namespace :appearances do
-          match 'widgets', via: %i[get delete]
+          # Security (audit M6): this legacy widgets surface predates the widgets/{main,sidebar,
+          # assign} controllers (its target controller is long gone) but still declared delete
+          # endpoints reachable over CSRF-exempt GET. The non-GET verbs keep the paths and helpers
+          # routable for any external binding.
+          delete 'widgets'
           match 'widgets_save', via: %i[post patch]
-          match 'widget_delete', via: %i[get patch]
+          patch 'widget_delete'
           get 'render_form'
 
           resources :themes, only: [:index] do
             collection do
               get 'preview'
               # match "settings", via: [:get, :post, :patch]
-              match 'load_data', via: %i[get post patch]
+              # Security (audit M6): load_data clears and re-imports post types, nav menus and sliders
+              # -- a state change that must not ride a CSRF-exempt GET link.
+              match 'load_data', via: %i[post patch]
             end
           end
           resources :nav_menus, except: :show do
-            get 'item_delete/:id' => :delete_menu_item, as: :delete_menu_item
+            # Security (audit M6): destroys a menu item -- must not ride a CSRF-exempt GET. The
+            # admin JS sends a token-bearing DELETE (nav_menu.js).
+            delete 'item_delete/:id' => :delete_menu_item, as: :delete_menu_item
             get 'custom_settings/:id' => :custom_settings, as: :custom_settings
             post 'save_custom_settings/:id' => :save_custom_settings, as: :save_custom_settings
             get 'edit_menu_item/:id' => :edit_menu_item, as: :edit_menu_item
@@ -114,8 +128,10 @@ Rails.application.routes.draw do
         end
 
         resources :plugins, only: %i[index destroy] do
-          get 'toggle', on: :collection
-          get 'upgrade'
+          # Security (audit M6): activating/deactivating and upgrading a plugin run install and
+          # upgrade hooks -- state changes, not reads.
+          patch 'toggle', on: :collection
+          post 'upgrade'
         end
 
         # installer
@@ -125,7 +141,9 @@ Rails.application.routes.draw do
         end
 
         resources :media, only: [:index] do
-          match 'crop', via: :all, on: :collection
+          # Security (audit M6): crop writes a cropped upload and can rewrite a user avatar
+          # (saved_avatar); via: :all admitted every verb, the CSRF-exempt GET/HEAD included.
+          post 'crop', on: :collection
           get 'ajax', on: :collection
           get 'download_private_file', on: :collection
           post 'upload', on: :collection

data/config/routes/frontend.rb

@@ -29,11 +29,12 @@ Rails.application.routes.draw do
           multilingual_segment = PluginRoutes.all_translations('routes.category', default: 'category')
           request.params[:category_id].match(/[0-9]+/) && request.params[:label_cat].in?(multilingual_segment)
         }
-        get ':post_type_title/:label_cat/:category_id-:title/:slug' => :post, as: 'post_of_category_post_type', constraints: lambda { |request|
-          multilingual_segment = PluginRoutes.all_translations('routes.category', default: 'category')
-          request.params[:post_type_title].match(/^(?!(#{PluginRoutes.all_locales})$)[\w.-]+$/) &&
-            request.params[:category_id].match(/[0-9]+/) && request.params[:label_cat].in?(multilingual_segment)
-        }
+        get ':post_type_title/:label_cat/:category_id-:title/:slug' => :post, as: 'post_of_category_post_type',
+            constraints: lambda { |request|
+              multilingual_segment = PluginRoutes.all_translations('routes.category', default: 'category')
+              request.params[:post_type_title].match(/^(?!(#{PluginRoutes.all_locales})$)[\w.-]+$/) &&
+                request.params[:category_id].match(/[0-9]+/) && request.params[:label_cat].in?(multilingual_segment)
+            }
         get ':label/:post_tag_id-:title' => :post_tag, as: 'post_tag', constraints: lambda { |request|
           multilingual_segment = PluginRoutes.all_translations('routes.tag', default: 'tag')
           request.params[:post_tag_id].match(/[0-9]+/) && request.params[:label].in?(multilingual_segment)
@@ -44,12 +45,14 @@ Rails.application.routes.draw do
         }
         get ':label/:post_tag_slug' => :post_tag, as: 'post_tag_simple', constraints: lambda { |request|
           multilingual_segment = PluginRoutes.all_translations('routes.tag', default: 'tag')
-          request.params[:post_tag_slug].match(%r{[a-zA-Z0-9_=\s\-/]+}) && request.params[:label].in?(multilingual_segment)
-        }
-        get ':label/:user_id-:user_name' => :profile, as: :profile, defaults: { label: 'profile' }, constraints: lambda { |request|
-          multilingual_segment = PluginRoutes.all_translations('routes.profile', default: 'profile') | %w[profile]
-          request.params[:user_id].match(/[0-9]+/) && request.params[:label].in?(multilingual_segment)
+          request.params[:post_tag_slug].match(%r{[a-zA-Z0-9_=\s\-/]+}) &&
+            request.params[:label].in?(multilingual_segment)
         }
+        get ':label/:user_id-:user_name' => :profile, as: :profile, defaults: { label: 'profile' },
+            constraints: lambda { |request|
+              multilingual_segment = PluginRoutes.all_translations('routes.profile', default: 'profile') | %w[profile]
+              request.params[:user_id].match(/[0-9]+/) && request.params[:label].in?(multilingual_segment)
+            }
         get ':label' => :search, as: :search, defaults: { label: 'search' }, constraints: lambda { |request|
           multilingual_segment = PluginRoutes.all_translations('routes.search', default: 'search') | %w[search]
           request.params[:label].in?(multilingual_segment)
@@ -71,11 +74,14 @@ Rails.application.routes.draw do
         # post types
         controller 'camaleon_cms/frontend' do
           PluginRoutes.get_sites.each do |s|
-            s.post_types.pluck(:slug, :id).each do |pt_slug, pt_id|
-              get ':post_type_slug' => :post_type, as: "post_type_#{pt_id}", post_type_id: pt_id, constraints: lambda { |request|
-                multilingual_segment = PluginRoutes.all_translations("routes.post_types.#{pt_slug}", default: pt_slug)
-                request.params[:post_type_slug].in?(multilingual_segment)
-              }
+            # get_sites eager-loads :post_types, so map in memory instead of a per-site pluck query.
+            s.post_types.map { |pt| [pt.slug, pt.id] }.each do |pt_slug, pt_id|
+              get ':post_type_slug' => :post_type, as: "post_type_#{pt_id}", post_type_id: pt_id,
+                  constraints: lambda { |request|
+                    multilingual_segment =
+                      PluginRoutes.all_translations("routes.post_types.#{pt_slug}", default: pt_slug)
+                    request.params[:post_type_slug].in?(multilingual_segment)
+                  }
             end
           end
         end

data/db/migrate/20150611161134_post_table_into_utf8.rb

@@ -1,12 +1,12 @@
 class PostTableIntoUtf8 < CamaManager.migration_class
   def change
     if table_exists? CamaleonCms::User.table_name
-      add_column(CamaleonCms::User.table_name, :email, :string) unless column_exists?(CamaleonCms::User.table_name, :email)
-      add_column(CamaleonCms::User.table_name, :username, :string) unless column_exists?(CamaleonCms::User.table_name, :username)
-      add_column(CamaleonCms::User.table_name, :role, :string, default: 'client', index: true) unless column_exists?(CamaleonCms::User.table_name, :role)
-      add_column(CamaleonCms::User.table_name, :parent_id, :integer) unless column_exists?(CamaleonCms::User.table_name, :parent_id)
-      add_column(CamaleonCms::User.table_name, :site_id, :integer, index: true, default: -1) unless column_exists?(CamaleonCms::User.table_name, :site_id)
-      add_column(CamaleonCms::User.table_name, :auth_token, :string) unless column_exists?(CamaleonCms::User.table_name, :auth_token)
+      add_column(CamaleonCms::User.table_name, :email, :string, if_not_exists: true)
+      add_column(CamaleonCms::User.table_name, :username, :string, if_not_exists: true)
+      add_column(CamaleonCms::User.table_name, :role, :string, default: 'client', index: true, if_not_exists: true)
+      add_column(CamaleonCms::User.table_name, :parent_id, :integer, if_not_exists: true)
+      add_column(CamaleonCms::User.table_name, :site_id, :integer, index: true, default: -1, if_not_exists: true)
+      add_column(CamaleonCms::User.table_name, :auth_token, :string, if_not_exists: true)
     else
       create_table CamaleonCms::User.table_name do |t|
         t.string   "username", index: true
@@ -26,7 +26,7 @@ class PostTableIntoUtf8 < CamaManager.migration_class
       end
     end
 
-    create_table "#{PluginRoutes.static_system_info["db_prefix"]}term_taxonomy" do |t|
+    create_table "#{PluginRoutes.static_system_info["db_prefix"]}term_taxonomy", if_not_exists: true do |t|
       t.string   "taxonomy", index: true
       t.text     "description", limit: 1073741823
       t.integer  "parent_id", index: true
@@ -41,7 +41,7 @@ class PostTableIntoUtf8 < CamaManager.migration_class
       t.belongs_to :user, index: true#, foreign_key: true
     end
 
-    create_table "#{PluginRoutes.static_system_info["db_prefix"]}posts" do |t|
+    create_table "#{PluginRoutes.static_system_info["db_prefix"]}posts", if_not_exists: true do |t|
       t.string   "title"
       t.string   "slug", index: true
       t.text     "content",          limit: 1073741823
@@ -58,13 +58,13 @@ class PostTableIntoUtf8 < CamaManager.migration_class
       t.belongs_to :user, index: true#, foreign_key: true
     end
 
-    create_table "#{PluginRoutes.static_system_info["db_prefix"]}term_relationships" do |t|
+    create_table "#{PluginRoutes.static_system_info["db_prefix"]}term_relationships", if_not_exists: true do |t|
       t.integer "objectid", index: true
       t.integer "term_order", index: true
       t.belongs_to :term_taxonomy, index: true
     end
 
-    create_table "#{PluginRoutes.static_system_info["db_prefix"]}user_relationships" do |t|
+    create_table "#{PluginRoutes.static_system_info["db_prefix"]}user_relationships", if_not_exists: true do |t|
       t.integer "term_order"
       t.integer "active", default: 1
 
@@ -72,7 +72,7 @@ class PostTableIntoUtf8 < CamaManager.migration_class
       t.belongs_to :user, index: true
     end
 
-    create_table "#{PluginRoutes.static_system_info["db_prefix"]}comments" do |t|
+    create_table "#{PluginRoutes.static_system_info["db_prefix"]}comments", if_not_exists: true do |t|
       t.string   "author"
       t.string   "author_email"
       t.string   "author_url"
@@ -87,7 +87,7 @@ class PostTableIntoUtf8 < CamaManager.migration_class
       t.timestamps null: false
     end
 
-    create_table "#{PluginRoutes.static_system_info["db_prefix"]}custom_fields" do |t|
+    create_table "#{PluginRoutes.static_system_info["db_prefix"]}custom_fields", if_not_exists: true do |t|
       t.string  "object_class", index: true
       t.string  "name"
       t.string  "slug", index: true
@@ -100,7 +100,7 @@ class PostTableIntoUtf8 < CamaManager.migration_class
       t.string  "status"
     end
 
-    create_table "#{PluginRoutes.static_system_info["db_prefix"]}custom_fields_relationships" do |t|
+    create_table "#{PluginRoutes.static_system_info["db_prefix"]}custom_fields_relationships", if_not_exists: true do |t|
       t.integer "objectid", index: true
       t.integer "custom_field_id", index: true
       t.integer "term_order"
@@ -109,7 +109,7 @@ class PostTableIntoUtf8 < CamaManager.migration_class
       t.string  "custom_field_slug", index: true
     end
 
-    create_table "#{PluginRoutes.static_system_info["db_prefix"]}metas" do |t|
+    create_table "#{PluginRoutes.static_system_info["db_prefix"]}metas", if_not_exists: true do |t|
       t.string  "key", index: true
       t.text    "value", limit: 1073741823
       t.integer "objectid", index: true

data/db/migrate/20150926095310_rename_column_posts.rb

@@ -1,9 +1,9 @@
 # change post structure to optimize query speed
 class RenameColumnPosts < CamaManager.migration_class
   def change
-    remove_column "#{PluginRoutes.static_system_info["db_prefix"]}posts", :comment_count
-    add_column "#{PluginRoutes.static_system_info["db_prefix"]}posts", :post_order, :integer, default: 0
-    add_column "#{PluginRoutes.static_system_info["db_prefix"]}posts", :taxonomy_id, :integer, default: nil, index: true
+    remove_column "#{PluginRoutes.static_system_info["db_prefix"]}posts", :comment_count, if_exists: true
+    add_column "#{PluginRoutes.static_system_info["db_prefix"]}posts", :post_order, :integer, default: 0, if_not_exists: true
+    add_column "#{PluginRoutes.static_system_info["db_prefix"]}posts", :taxonomy_id, :integer, default: nil, index: true, if_not_exists: true
     CamaleonCms::Post.all.each do |post|
       begin
         post_id = post.get_post_type_depre.id

data/db/migrate/20151212095328_add_confirm_token_to_users.rb

@@ -1,7 +1,7 @@
 class AddConfirmTokenToUsers < CamaManager.migration_class
   def change
-    add_column CamaleonCms::User.table_name, :confirm_email_token, :string, default: nil
-    add_column CamaleonCms::User.table_name, :confirm_email_sent_at, :datetime, default: nil
-    add_column CamaleonCms::User.table_name, :is_valid_email, :boolean, default: true
+    add_column CamaleonCms::User.table_name, :confirm_email_token, :string, default: nil, if_not_exists: true
+    add_column CamaleonCms::User.table_name, :confirm_email_sent_at, :datetime, default: nil, if_not_exists: true
+    add_column CamaleonCms::User.table_name, :is_valid_email, :boolean, default: true, if_not_exists: true
   end
 end

data/db/migrate/20160504155652_add_feature_to_posts.rb

@@ -1,5 +1,5 @@
 class AddFeatureToPosts < CamaManager.migration_class
   def change
-    add_column "#{PluginRoutes.static_system_info["db_prefix"]}posts", :is_feature, :boolean, default: false
+    add_column "#{PluginRoutes.static_system_info["db_prefix"]}posts", :is_feature, :boolean, default: false, if_not_exists: true
   end
 end

data/db/migrate/20160504155653_move_first_name_of_users.rb

@@ -1,7 +1,7 @@
 class MoveFirstNameOfUsers < CamaManager.migration_class
   def change
-    add_column CamaleonCms::User.table_name, :first_name, :string unless column_exists?(CamaleonCms::User.table_name, :first_name)
-    add_column CamaleonCms::User.table_name, :last_name, :string unless column_exists?(CamaleonCms::User.table_name, :last_name)
+    add_column CamaleonCms::User.table_name, :first_name, :string, if_not_exists: true
+    add_column CamaleonCms::User.table_name, :last_name, :string, if_not_exists: true
     CamaleonCms::User.all.each do |u|
       u.update_columns(first_name: u.get_meta('first_name'), last_name: u.get_meta('last_name')) if u.get_meta('first_name').present?
     end

data/db/migrate/20160609121449_add_group_to_custom_field_values.rb

@@ -1,5 +1,5 @@
 class AddGroupToCustomFieldValues < CamaManager.migration_class
   def change
-    add_column "#{PluginRoutes.static_system_info["db_prefix"]}custom_fields_relationships", :group_number, :integer, default: 0
+    add_column "#{PluginRoutes.static_system_info["db_prefix"]}custom_fields_relationships", :group_number, :integer, default: 0, if_not_exists: true
   end
 end

data/db/migrate/20161215202255_drop_user_relationship_table.rb

@@ -1,5 +1,5 @@
 class DropUserRelationshipTable < CamaManager.migration_class
   def change
-    drop_table "#{PluginRoutes.static_system_info["db_prefix"]}user_relationships"
+    drop_table "#{PluginRoutes.static_system_info["db_prefix"]}user_relationships", if_exists: true
   end
 end

data/db/migrate/20180124132318_create_media.rb

@@ -1,6 +1,6 @@
 class CreateMedia < CamaManager.migration_class
   def change
-    create_table "#{PluginRoutes.static_system_info["db_prefix"]}media" do |t|
+    create_table "#{PluginRoutes.static_system_info["db_prefix"]}media", if_not_exists: true do |t|
       t.references :site, index: true
       t.string :name, index: true
       t.boolean :is_folder, index: true, default: false

data/db/migrate/20180704211100_adjust_field_length.rb

@@ -2,7 +2,7 @@ class AdjustFieldLength < CamaManager.migration_class
   def change
     post_table = CamaleonCms::Post.table_name
     change_column post_table, :title, :text
-    remove_index(post_table, :slug) if index_exists?(post_table, :slug)
+    remove_index(post_table, :slug, if_exists: true)
     change_column post_table, :slug, :text
     add_index post_table, :slug, length: 255
     change_column "#{PluginRoutes.static_system_info["db_prefix"]}term_taxonomy", :name, :text

data/lib/camaleon_cms/assets_precompile.rb

@@ -0,0 +1,86 @@
+module CamaleonCms
+  # Helper used by config/initializers/assets.rb to declare plugin/theme assets as
+  # precompiled.
+  #
+  # Plugin and theme assets can live in three different layouts:
+  #   * host app:               <app>/app/apps/{plugins,themes}/<key>/assets/...
+  #   * the camaleon_cms gem:   <gem>/app/apps/{plugins,themes}/<key>/assets/...
+  #   * separate "gem_mode" gems: <gem>/app/assets/<type>/{plugins,themes}/<key>/...
+  #     (e.g. cama_contact_form ships app/assets/javascripts/plugins/cama_contact_form/...)
+  #
+  # Rails' default Sprockets precompile rules only cover the app/assets top level, so none
+  # of these are declared as precompiled. On modern Sprockets (>= 4) with
+  # `config.assets.unknown_asset_fallback = false`, requesting such an asset (e.g. via
+  # `javascript_include_tag "plugins/visibility_post/assets/js/form.js"`) raises
+  # `Sprockets::Rails::Helper::AssetNotPrecompiledError` unless it is declared.
+  #
+  # We enumerate the concrete asset files from the *real* Sprockets load paths and declare
+  # their exact logical paths as strings. Strings are the canonical, Sprockets-version
+  # agnostic form (work on both 3.x and 4.x). Scanning `config.assets.paths` (instead of a
+  # couple of hardcoded directories) ensures host, gem-bundled and separately gem-packaged
+  # (gem_mode) plugins/themes are all covered, matching the reach of the old precompile
+  # `proc` this replaced. Because the declaration is computed from the on-disk files, every
+  # installed plugin/theme is declared regardless of whether it is currently active, so
+  # switching themes / enabling-disabling plugins (DB-only operations) never requires a
+  # recompile.
+  module AssetsPrecompile
+    PRECOMPILE_EXTENSIONS = /\.(css|js|svg|ttf|woff|woff2|eot|otf|swf|pdf|png|jpe?g|gif|ico|mp3|mp4|webm|ogg|webp)\z/i
+    PRECOMPILE_CONTENT_TYPES = %r{(javascript|image/|audio|video|font)}
+
+    module_function
+
+    # path: logical asset path relative to an asset load path, e.g.
+    #   "plugins/visibility_post/assets/js/form.js", "themes/my_theme/assets/css/app.css"
+    #   or "plugins/cama_contact_form/admin_editor.js" (gem_mode layout).
+    # Returns true when the asset must be precompiled.
+    def match?(path)
+      dirname = File.dirname(path)
+      return false unless dirname.start_with?('plugins/', 'themes/')
+
+      name = File.basename(path)
+      return false if name.start_with?('_') || path.include?('/views/')
+
+      PRECOMPILE_EXTENSIONS.match?(path) || content_type_for(name).scan(PRECOMPILE_CONTENT_TYPES).any?
+    end
+
+    def content_type_for(name)
+      MIME::Types.type_for(name).first.content_type
+    rescue StandardError
+      ''
+    end
+
+    # Enumerate the logical paths of every plugin/theme asset found under the given asset
+    # roots. For each root, only the `plugins/` and `themes/` subtrees are scanned, and each
+    # file is converted to its logical path (relative to the root) and filtered by `match?`.
+    def logical_paths(asset_roots = default_asset_roots)
+      asset_roots.flat_map do |root|
+        root = root.to_s
+        next [] if root.empty? || !Dir.exist?(root)
+
+        prefix = "#{root.chomp('/')}/"
+        Dir.glob(File.join(root, '{plugins,themes}', '**', '*')).filter_map do |file|
+          next unless File.file?(file)
+
+          logical = file.delete_prefix(prefix)
+          logical if match?(logical)
+        end
+      end.uniq
+    end
+
+    # Asset roots to scan: the configured Sprockets load paths (which cover host,
+    # gem-bundled and gem_mode plugin/theme assets), plus the host and camaleon_cms gem
+    # `app/apps` folders as a fallback in case the asset paths are not yet populated when
+    # this is called during initialization.
+    def default_asset_roots
+      roots = []
+      if defined?(Rails) && Rails.respond_to?(:application) && Rails.application
+        roots.concat(Array(Rails.application.config.assets.paths).map(&:to_s))
+      end
+      roots << Rails.root.join('app/apps').to_s if defined?(Rails) && Rails.respond_to?(:root) && Rails.root
+      # rubocop:disable Style/GlobalVars
+      roots << File.join($camaleon_engine_dir, 'app', 'apps') if defined?($camaleon_engine_dir) && $camaleon_engine_dir
+      # rubocop:enable Style/GlobalVars
+      roots.uniq
+    end
+  end
+end