camaleon_cms 2.9.1 → 2.9.3

data/app/assets/javascripts/camaleon_cms/admin/_post.js

@@ -236,10 +236,13 @@ function cama_init_post(obj) {
             return false;
         });
 
-        /* Disabled until fix to reload only category fields and not all
+        /* Disabled until fix to reload only category fields and not all.
+           NOTE (M6): custom_fields#list performs its category write only on a CSRF-verified POST, so
+           this must stay $.post when re-enabled (jquery_ujs attaches the CSRF token) — with $.get the
+           fields would still render but the post's categories would silently not be saved.
         $form.on("change", ".list-categories input", function () {
           showLoading();
-          $.get(
+          $.post(
             $form.find("#post_add_new_category").data('fields-reload-url'), {
               categories: $form.find("#post_right_bar .list-categories input[name='categories[]']:checked").map(function(i, el){ return $(this).val(); }).get(),
               post_id: post_id

data/app/assets/javascripts/camaleon_cms/admin/nav_menu.js

@@ -111,9 +111,20 @@ $(function() {
       return false
 
     showLoading()
-    $.get(link.attr('href'), function() {
-      link.closest('.dd-item').remove()
-      hideLoading()
+    // Security (audit M6): the route is DELETE-only. jquery_ujs' ajax prefilter attaches the
+    // X-CSRF-Token header to every same-origin request (it gates on crossDomain, not the verb), so
+    // this DELETE carries the token.
+    $.ajax({
+      url: link.attr('href'),
+      type: 'DELETE',
+      success() {
+        link.closest('.dd-item').remove()
+      },
+      // Hide the overlay on every outcome -- a failed DELETE (e.g. a stale CSRF token after the
+      // session rotated) would otherwise leave the full-screen spinner blocking the admin.
+      complete() {
+        hideLoading()
+      }
     })
     return false
   })

data/app/assets/javascripts/camaleon_cms/admin/uploader/_media_manager.js

@@ -143,6 +143,11 @@ window.cama_init_media = function(mediaPanel) {
   const customFileData = function() {
     const r = window.cama_media_get_custom_params()
     r.skip_auto_crop = true
+    // Security (audit M7): the uploadFile plugin posts multipart data outside the UJS ajax
+    // prefilter, so the CSRF token must ride as a form field (media#upload no longer skips it).
+    // Read the meta tag directly so this does not depend on any UJS library being loaded.
+    const csrfMeta = document.querySelector('meta[name="csrf-token"]')
+    r.authenticity_token = csrfMeta && csrfMeta.getAttribute('content')
     return r
   }
 

data/app/controllers/camaleon_cms/admin/appearances/nav_menus_controller.rb

@@ -2,7 +2,7 @@ module CamaleonCms
   module Admin
     module Appearances
       class NavMenusController < CamaleonCms::AdminController
-        include CamaleonCms::Frontend::NavMenuHelper
+        include CamaleonCms::Admin::CustomFieldsConcern
 
         add_breadcrumb I18n.t('camaleon_cms.admin.sidebar.appearance')
         add_breadcrumb I18n.t('camaleon_cms.admin.sidebar.menus')
@@ -10,9 +10,9 @@ module CamaleonCms
 
         def index
           @nav_menu = if params[:id].present?
-                        current_site.nav_menus.find_by_id(params[:id])
+                        current_site.nav_menus.find_by(id: params[:id])
                       elsif params[:slug].present?
-                        current_site.nav_menus.find_by_slug(params[:slug])
+                        current_site.nav_menus.find_by_slug(params[:slug]) # rubocop:disable Rails/DynamicFindBy
                       else
                         current_site.nav_menus.first
                       end
@@ -27,7 +27,7 @@ module CamaleonCms
         end
 
         def create
-          nav_menu = current_site.nav_menus.new(params.require(:nav_menu).permit!)
+          nav_menu = current_site.nav_menus.new(nav_menu_params)
           nav_menu.save
           flash[:notice] = t('.created_menu', default: 'Created Menu')
           redirect_to action: :index, id: nav_menu.id
@@ -35,7 +35,7 @@ module CamaleonCms
 
         def update
           nav_menu = current_site.nav_menus.find(params[:id])
-          nav_menu.update(params.require(:nav_menu).permit!)
+          nav_menu.update(nav_menu_params)
           flash[:notice] = t('.updated_menu', default: 'Menu updated')
           redirect_to action: :index, id: nav_menu.id
         end
@@ -59,7 +59,7 @@ module CamaleonCms
 
         def save_custom_settings
           @nav_menu_item = current_site.nav_menu_items.find(params[:id])
-          @nav_menu_item.set_field_values(params.require(:field_options).permit!)
+          @nav_menu_item.set_field_values(cama_permitted_field_options('NavMenuItem'))
           head :ok
         end
 
@@ -77,7 +77,7 @@ module CamaleonCms
           @nav_menu = current_site.nav_menus.find(params[:nav_menu_id])
           item = current_site.nav_menu_items.find(params[:id])
           item.update_menu_item(parse_external_menu(params))
-          item.set_options(params.require(:options).permit!) if params[:options].present?
+          item.set_options(permitted_external_options) if params[:options].present?
           render partial: 'menu_items', locals: { items: [item], nav_menu: @nav_menu }
         end
 
@@ -90,7 +90,10 @@ module CamaleonCms
         # update the reorder of items
         def reorder_items(items = nil, parent_id = nil, is_root = true)
           items = params[:items] if items.nil?
-          parent_id = params[:nav_menu_id] if parent_id.nil?
+          # Security (audit M10): resolve the destination menu through the current site (like
+          # #add_items) -- a raw params[:nav_menu_id] let an item be re-homed under another site's
+          # nav menu. Nested calls pass an explicit parent item id, so only the root needs scoping.
+          parent_id = current_site.nav_menus.find(params[:nav_menu_id]).id if parent_id.nil?
           items.each do |index, _item|
             item = current_site.nav_menu_items.find(_item['id'])
             item.update(parent_id: parent_id, term_order: index)
@@ -106,13 +109,13 @@ module CamaleonCms
           external_params = params[:external]
           if external_params.present?
             external_item = @nav_menu.append_menu_item(parse_external_menu(external_params))
-            external_item.set_options(external_params.require(:options).permit!) if external_params[:options].present?
+            external_item.set_options(permitted_external_options(external_params)) if external_params[:options].present?
             items << external_item
           end
 
           if params[:custom_items].present? # custom menu items
             params[:custom_items].each_value do |custom_item|
-              type = custom_item['kind'].present? ? custom_item['kind'] : 'external'
+              type = custom_item['kind'].presence || 'external'
               items << @nav_menu.append_menu_item({ label: custom_item['label'], link: custom_item['url'], type: type })
             end
           end
@@ -136,6 +139,22 @@ module CamaleonCms
         def parse_external_menu(_params)
           { label: _params[:external_label], link: _params[:external_url], type: 'external', target: _params[:target] }
         end
+
+        # Strong parameters for nav_menu
+        def nav_menu_params
+          params.require(:nav_menu).permit(:name, :slug)
+        end
+
+        # Only permit external menu options that match registered custom field slug
+        def permitted_external_options(external_params = nil)
+          opts = external_params ? external_params[:options] : params[:options]
+          return {} if opts.blank?
+
+          allowed_keys = cama_custom_field_allowed_slugs('NavMenuItem')
+          return {} if allowed_keys.blank?
+
+          opts.permit(*allowed_keys).to_h
+        end
       end
     end
   end

data/app/controllers/camaleon_cms/admin/appearances/themes_controller.rb

@@ -7,9 +7,8 @@ module CamaleonCms
         add_breadcrumb I18n.t('camaleon_cms.admin.sidebar.appearance')
         def index
           add_breadcrumb I18n.t('camaleon_cms.admin.sidebar.themes')
-          PluginRoutes.reload
           authorize! :manage, :themes
-          return unless params[:set].present?
+          return if params[:set].blank?
 
           site_install_theme(params[:set])
           flash.now[:notice] = t('camaleon_cms.admin.themes.message.updated')
@@ -18,9 +17,13 @@ module CamaleonCms
 
         def load_data
           file = Rails.root.join('app', 'apps', 'themes', current_site.get_theme_slug, 'data.json')
-          @messages = load_file_content_to_db(file,
-                                              { post_types: 1, clear_post_type: 1, nav_menus: 1, clear_nav_menus: 1, slider_basic: 1, clear_slider_basic: 1,
-                                                theme_import: 1 })
+          @messages = load_file_content_to_db(
+            file,
+            {
+              post_types: 1, clear_post_type: 1, nav_menus: 1, clear_nav_menus: 1, slider_basic: 1,
+              clear_slider_basic: 1, theme_import: 1
+            }
+          )
         end
 
         def preview

data/app/controllers/camaleon_cms/admin/appearances/widgets/assign_controller.rb

@@ -3,6 +3,8 @@ module CamaleonCms
     module Appearances
       module Widgets
         class AssignController < CamaleonCms::AdminController
+          include CamaleonCms::Admin::CustomFieldsConcern
+
           before_action :check_permission_role
           before_action :find_sidebar
           before_action :find_assigned_sidebar, only: %i[update destroy]
@@ -15,8 +17,13 @@ module CamaleonCms
           end
 
           def update
-            if @assigned.update(params.require(:assign).permit!)
-              @assigned.set_field_values(params[:field_options])
+            # sidebar_id (post_parent) and widget_id (visibility) identify the tenant-scoped sidebar and
+            # widget this assignment belongs to; they are set from @sidebar/@widget on create and must
+            # not be reassigned from the request, or the assignment could be re-pointed into another
+            # site's sidebar or widget (audit finding H9). Reordering has its own current-site-scoped
+            # action (sidebar#reorder).
+            if @assigned.update(params.require(:assign).permit(:title, :content, :item_order))
+              @assigned.set_field_values(cama_permitted_field_options('Main'))
               flash[:notice] = t('camaleon_cms.admin.widgets.assign.updated')
             else
               flash[:error] = t('camaleon_cms.admin.widgets.assign.error_updated')

data/app/controllers/camaleon_cms/admin/appearances/widgets/main_controller.rb

@@ -22,8 +22,9 @@ module CamaleonCms
           end
 
           def create
-            params[:widget_main][:status] = 'simple'
-            @widget = current_site.widgets.new(params.require(:widget_main).permit!)
+            @widget = current_site
+                      .widgets.new(params.require(:widget_main).permit(:name, :slug, :description, :excerpt, :renderer))
+            @widget.status = 'simple'
             if @widget.save!
               flash[:notice] = t('camaleon_cms.admin.widgets.message.created')
             else
@@ -33,7 +34,7 @@ module CamaleonCms
           end
 
           def update
-            if @widget.update!(params.require(:widget_main).permit!)
+            if @widget.update!(params.require(:widget_main).permit(:name, :slug, :description, :excerpt, :renderer))
               flash[:notice] = t('camaleon_cms.admin.widgets.message.updated')
             else
               flash[:error] = t('camaleon_cms.admin.widgets.message.error_updated')

data/app/controllers/camaleon_cms/admin/appearances/widgets/sidebar_controller.rb

@@ -12,7 +12,7 @@ module CamaleonCms
           end
 
           def create
-            @sidebar = current_site.sidebars.new(params.require(:widget_sidebar).permit!)
+            @sidebar = current_site.sidebars.new(params.require(:widget_sidebar).permit(:name, :slug, :description))
             if @sidebar.save
               flash[:notice] = t('camaleon_cms.admin.widgets.sidebar.created')
             else
@@ -26,7 +26,7 @@ module CamaleonCms
           end
 
           def update
-            if @sidebar.update(params.require(:widget_sidebar).permit!)
+            if @sidebar.update(params.require(:widget_sidebar).permit(:name, :slug, :description))
               flash[:notice] = t('camaleon_cms.admin.widgets.sidebar.updated')
             else
               flash[:error] = t('camaleon_cms.admin.widgets.sidebar.error_updated')

data/app/controllers/camaleon_cms/admin/categories_controller.rb

@@ -1,9 +1,13 @@
 module CamaleonCms
   module Admin
     class CategoriesController < CamaleonCms::AdminController
+      include CamaleonCms::Admin::CustomFieldsConcern
+
       add_breadcrumb I18n.t('camaleon_cms.admin.sidebar.contents')
+
       before_action :set_post_type
       before_action :set_category, only: %w[show edit update destroy]
+      before_action :validate_category_parent, only: %w[create update]
 
       def index
         @categories = @post_type.categories
@@ -20,9 +24,9 @@ module CamaleonCms
       def update
         hooks_run('update_category', { category: @category, post_type: @post_type })
 
-        if @category.update(params.require(:category).permit!)
+        if @category.update(params.require(:category).permit(:name, :slug, :description, :parent_id))
           @category.set_options(params[:meta])
-          @category.set_field_values(params[:field_options])
+          @category.set_field_values(cama_permitted_field_options('PostType_Category'))
           hooks_run('updated_category', { category: @category, post_type: @post_type })
           flash[:notice] = t('camaleon_cms.admin.post_type.message.updated')
           redirect_to action: :index
@@ -32,12 +36,12 @@ module CamaleonCms
       end
 
       def create
-        @category = @post_type.categories.new(params.require(:category).permit!)
+        @category = @post_type.categories.new(params.require(:category).permit(:name, :slug, :description, :parent_id))
         hooks_run('create_category', { category: @category, post_type: @post_type })
 
         if @category.save
           @category.set_options(params[:meta])
-          @category.set_field_values(params[:field_options])
+          @category.set_field_values(cama_permitted_field_options('PostType_Category'))
           hooks_run('created_category', { category: @category, post_type: @post_type })
           flash[:notice] = t('camaleon_cms.admin.post_type.message.created')
           redirect_to action: :index
@@ -48,8 +52,11 @@ module CamaleonCms
 
       # return html category list used to reload categories list in post editor form
       def list
-        render inline: post_type_html_inputs(@post_type, 'categories', 'categories',
-                                             @post_type.get_option('has_single_category', false) ? 'radio' : 'checkbox', params[:categories] || [], 'categorychecklist', true)
+        render inline: post_type_html_inputs(
+          @post_type, 'categories', 'categories',
+          @post_type.get_option('has_single_category', false) ? 'radio' : 'checkbox',
+          params[:categories] || [], 'categorychecklist', true
+        )
       end
 
       def destroy
@@ -59,10 +66,21 @@ module CamaleonCms
 
       private
 
+      # The parent dropdown offers the post type itself or one of its own categories. A parent_id naming
+      # anything else would re-home the category under another post type or site, so it is rejected
+      # (audit finding H8). full_categories is scoped to this post type's site and id.
+      def validate_category_parent
+        submitted = params.dig(:category, :parent_id)
+        return if submitted.blank? || submitted.to_s == @post_type.id.to_s
+        return if @post_type.full_categories.exists?(id: submitted)
+
+        raise CanCan::AccessDenied, t('camaleon_cms.admin.post_type.message.error')
+      end
+
       # define parent post type
       def set_post_type
         begin
-          @post_type = current_site.post_types.find_by_id(params[:post_type_id]).decorate
+          @post_type = current_site.post_types.find_by(id: params[:post_type_id]).decorate
         rescue StandardError
           flash[:error] = t('camaleon_cms.admin.request_error_message')
           redirect_to cama_admin_path, { error: 'Error Post Type' }
@@ -73,7 +91,8 @@ module CamaleonCms
       end
 
       def set_category
-        @category = CamaleonCms::Category.find_by_id(params[:id])
+        @category = @post_type.categories.find_by(id: params[:id])
+        render_404 unless @category
       rescue StandardError
         flash[:error] = t('camaleon_cms.admin.post_type.message.error')
         redirect_to cama_admin_path

data/app/controllers/camaleon_cms/admin/comments_controller.rb

@@ -2,7 +2,6 @@ require 'will_paginate/array'
 module CamaleonCms
   module Admin
     class CommentsController < CamaleonCms::AdminController
-      include CamaleonCms::CommentHelper
       add_breadcrumb I18n.t('camaleon_cms.admin.sidebar.comments'), :cama_admin_comments_url
       before_action :validate_role
       before_action :set_post, except: :list

data/app/controllers/camaleon_cms/admin/installers_controller.rb

@@ -5,9 +5,13 @@ module CamaleonCms
       skip_before_action :cama_before_actions
       skip_after_action :cama_after_actions
       before_action :installer_verification, except: :welcome
+      before_action :require_setup_token, only: :save
       layout 'camaleon_cms/login'
 
       def index
+        # Ensure the setup token exists (and is logged) so a remote operator can read it and enter it
+        # below. Local installs are exempt (require_setup_token), so no token is generated for them.
+        CamaleonCms::SetupToken.value if CamaleonCms::SetupToken.required? && !request.local?
         @site ||= CamaleonCms::Site.new
         @site.slug = request.original_url.to_s.parse_domain
         render 'form'
@@ -17,6 +21,10 @@ module CamaleonCms
         @site = CamaleonCms::Site.new(params[:site].permit(:slug, :name)).decorate
         if @site.save
           site_after_install(@site, params[:theme])
+          CamaleonCms::SetupToken.clear! # single-use: the installer is closed now that a site exists
+          # Carry the generated admin password to the welcome page for a single, session-scoped display.
+          flash[:generated_admin_password] = @site.generated_admin_password
+          session[:cama_installer_welcome] = true
           flash[:notice] = t('camaleon_cms.admin.sites.message.created')
           redirect_to action: :welcome
         else
@@ -24,11 +32,34 @@ module CamaleonCms
         end
       end
 
-      def welcome; end
+      def welcome
+        # Only the operator who just completed setup may see the credentials; the marker is one-time.
+        return redirect_to cama_admin_login_url unless session.delete(:cama_installer_welcome)
+
+        @generated_admin_password = flash[:generated_admin_password]
+      end
 
       def installer_verification
         redirect_to cama_root_url unless CamaleonCms::Site.count == 0
       end
+
+      # Refuse to provision unless the request carries the setup token (readable only from the server's
+      # environment or filesystem). Only enforced while no site exists; afterwards installer_verification
+      # has already closed the installer.
+      def require_setup_token
+        return unless CamaleonCms::SetupToken.required?
+        # Loopback requests (a local console/dev install, or an SSH tunnel) already prove host access,
+        # so the token is required only for remote requests. request.local? is true only when the
+        # computed client IP is loopback, so a real remote client behind a proxy that forwards
+        # X-Forwarded-For is still gated. See harden-installer-default-admin.
+        return if request.local?
+        return if CamaleonCms::SetupToken.valid?(params[:setup_token])
+
+        flash[:error] = t('camaleon_cms.admin.installer.invalid_setup_token',
+                          default: 'A valid setup token is required to install. See the server log or ' \
+                                   'tmp/camaleon_setup_token.')
+        redirect_to cama_admin_installers_path
+      end
     end
   end
 end

data/app/controllers/camaleon_cms/admin/media_controller.rb

@@ -3,55 +3,101 @@ module CamaleonCms
   module Admin
     class MediaController < CamaleonCms::AdminController
       skip_before_action :admin_logged_actions, except: %i[index download_private_file], raise: false
-      skip_before_action :verify_authenticity_token, only: :upload, raise: false
+      # Security (audit M6/M7): upload writes files (and, via saved_avatar-style flows, model state),
+      # so it must not skip CSRF. The multipart uploader (jQuery uploadFile) posts outside jquery_ujs'
+      # ajax prefilter, so it carries the token as an authenticity_token form field instead (see
+      # _media_manager.js). The url-upload path posts through media#actions, already CSRF-protected.
       before_action :init_media_vars, except: :download_private_file
+      before_action :verify_media_authorization
 
       # render media section
       def index
-        authorize! :manage, :media
         @show_file_actions = true
-        @files = @tree.paginate(page: params[:page], per_page: 100)
+        @files = cama_uploader.cama_prepare_browser_page(@tree.paginate(page: params[:page], per_page: 100))
         @next_page = @files.current_page < @files.total_pages ? @files.current_page + 1 : nil
         add_breadcrumb I18n.t('camaleon_cms.admin.sidebar.media')
       end
 
       # crop a image to save as a new file
+      #
+      # Unlike crop_url (which is URL-only and prefixes the site URL onto relative
+      # inputs), crop accepts three cp_img_path shapes: an http(s) URL, a data:
+      # URI, or a server filesystem path (see the cama_tmp_upload examples). Only
+      # http(s) URLs are validated here; data: URIs and filesystem paths pass
+      # through to cama_tmp_upload, whose cama_canonical_upload_path guard confines
+      # them to the public/tmp roots. A bare relative path is therefore treated as
+      # a filesystem path, not prefixed with the site URL — intentional divergence.
       def crop
-        path_image = cama_tmp_upload(params[:cp_img_path])[:file_path]
+        cp_img_path = params[:cp_img_path].to_s
+        if (url_error = cama_upload_url_error(cp_img_path))
+          return render(plain: helpers.sanitize(url_error))
+        end
+
+        # Security (object-level authorization): setting another user's avatar is a user-management
+        # write, so gate a non-self saved_avatar target on :manage, :users -- the same capability
+        # UsersController#update already requires. Decide from the parameter, before resolving the
+        # target (so a denied caller cannot use the response as a same-site existence oracle) and
+        # before the upload/crop (so no file work happens on a denied request). A caller may always
+        # set their own avatar with the media permission the endpoint already requires.
+        # (Mirrors UsersController#profile's self-vs-other gate. The .to_s compare and the blank-
+        # saved_avatar skip -- a plain crop, not a user write -- are intentional and fail-closed; do
+        # not "align" this to users_controller's .to_i, which coerces non-canonical ids.)
+        if params[:saved_avatar].present? && params[:saved_avatar].to_s != cama_current_user.id.to_s
+          authorize! :manage, :users
+        end
+
+        tmp = cama_tmp_upload(cp_img_path, formats: params[:formats], name: params[:name])
+        return render(plain: helpers.sanitize(tmp[:error])) if tmp[:error].present?
+
+        path_image = tmp[:file_path]
         crop_path = cama_crop_image(path_image, params[:ic_w], params[:ic_h], params[:ic_x], params[:ic_y])
         res = upload_file(crop_path, { remove_source: true })
-        CamaleonCms::User.find(params[:saved_avatar]).set_meta('avatar', res['url']) if params[:saved_avatar].present?
-        render html: res['url'].html_safe
+        # A failed upload returns { error: ... } with no url. Surface it like the action's other
+        # error paths instead of writing a nil avatar meta and rendering an empty 200 body (which
+        # let the avatar flow store "").
+        return render(plain: helpers.sanitize(res[:error])) if res[:error].present?
+
+        # Security (audit Low): resolve the avatar target through the current site and nil-safely.
+        # The object-level gate above (:manage, :users for a non-self target) is the primary control
+        # that stops a media manager from writing another user's avatar; this site-scoping is defense
+        # in depth -- for an authorized :manage,:users holder a foreign id is a no-op here, where an
+        # unscoped User.find would reach across sites and 500 on a bad id.
+        if params[:saved_avatar].present?
+          current_site.users.find_by(id: params[:saved_avatar])&.set_meta('avatar', res['url'])
+        end
+        render plain: res['url'].to_s
       end
 
       # download private files
       def download_private_file
         cama_uploader.enable_private_mode!
 
-        file = cama_uploader.fetch_file("private/#{params[:file]}")
+        sanitize_private_filename!
+        return render(plain: 'Invalid file', status: :forbidden) unless @private_file_path
+
+        fetched = cama_uploader.fetch_file(@private_file_path)
 
-        return render plain: helpers.sanitize(file[:error]) if file.is_a?(Hash) && file[:error].present?
+        return render plain: helpers.sanitize(fetched[:error]) if fetched.is_a?(Hash) && fetched[:error].present?
 
-        send_file file, disposition: 'inline'
+        send_file fetched, disposition: 'inline'
       end
 
       # render media for modal content
       def ajax
         @show_file_actions = true if current_site.get_option('file_actions_in_modals') == 'yes'
         @tree = cama_uploader.search(params[:search]) if params[:search].present?
-        @files = @tree.paginate(page: params[:page], per_page: 100)
+        @files = cama_uploader.cama_prepare_browser_page(@tree.paginate(page: params[:page], per_page: 100))
         @next_page = @files.current_page < @files.total_pages ? @files.current_page + 1 : nil
         if params[:partial].present?
           render json: { next_page: @next_page,
                          html: render_to_string(partial: 'render_file_item', locals: { files: @files }) }
-        else
-          render 'index', layout: false unless params[:partial].present?
+        elsif params[:partial].blank?
+          render 'index', layout: false
         end
       end
 
       # do background actions in fog
       def actions
-        authorize! :manage, :media if params[:media_action] != 'crop_url'
         params[:folder] = params[:folder].gsub('//', '/') if params[:folder].present?
 
         case params[:media_action]
@@ -66,9 +112,9 @@ module CamaleonCms
         when 'crop_url'
           user_url = params[:url].to_s
           user_url = "#{current_site.the_url(locale: nil)}#{user_url}" unless user_url.start_with?('data:', 'http')
-          url_validation_result = UserUrlValidator.validate(user_url)
-          r = if url_validation_result.is_a?(Array)
-                { error: url_validation_result.join(', ') }
+          url_error = cama_upload_url_error(user_url)
+          r = if url_error
+                { error: url_error }
               else
                 cama_tmp_upload(user_url, formats: params[:formats], name: params[:name])
               end
@@ -91,9 +137,17 @@ module CamaleonCms
         params[:dimension] = nil if params[:skip_auto_crop].present?
         f = { error: 'File not found.' }
         if params[:file_upload].present?
-          f = upload_file(params[:file_upload],
-                          { folder: params[:folder], dimension: params['dimension'], formats: params[:formats], versions: params[:versions],
-                            thumb_size: params[:thumb_size] }.merge(settings))
+          if params[:file_upload].is_a?(String) && (url_error = cama_upload_url_error(params[:file_upload]))
+            return render plain: helpers.sanitize(url_error)
+          end
+
+          f = upload_file(
+            params[:file_upload],
+            {
+              folder: params[:folder], dimension: params['dimension'], formats: params[:formats],
+              versions: params[:versions], thumb_size: params[:thumb_size]
+            }.merge!(settings)
+          )
         end
 
         if f[:error].present?
@@ -105,6 +159,17 @@ module CamaleonCms
 
       private
 
+      def verify_media_authorization
+        authorize! :manage, :media
+      end
+
+      # Sanitizes the private file parameter to prevent path traversal.
+      # Sets @private_file_path if valid, nil otherwise.
+      def sanitize_private_filename!
+        name = File.basename(params[:file].to_s)
+        @private_file_path = ("private/#{name}" if name.present? && name == params[:file].to_s)
+      end
+
       # init basic media variables
       def init_media_vars
         # @cama_uploader = CamaleonCmsLocalUploader.new({current_site: current_site, private: true})

data/app/controllers/camaleon_cms/admin/plugins_controller.rb

@@ -3,9 +3,7 @@ module CamaleonCms
     class PluginsController < CamaleonCms::AdminController
       before_action :validate_role
       add_breadcrumb I18n.t('camaleon_cms.admin.sidebar.plugins')
-      def index
-        PluginRoutes.reload
-      end
+      def index; end
 
       def toggle
         status = params[:status].to_bool

data/app/controllers/camaleon_cms/admin/post_tags_controller.rb

@@ -1,7 +1,10 @@
 module CamaleonCms
   module Admin
     class PostTagsController < CamaleonCms::AdminController
+      include CamaleonCms::Admin::CustomFieldsConcern
+
       add_breadcrumb I18n.t('camaleon_cms.admin.sidebar.contents')
+
       before_action :set_post_type
       before_action :set_post_tag, only: %w[show edit update destroy]
 
@@ -27,9 +30,9 @@ module CamaleonCms
       def update
         args = { post_tag: @post_tag, post_type: @post_type }
         hooks_run('before_update_post_tag', args)
-        if @post_tag.update(params.require(:post_tag).permit!)
+        if @post_tag.update(post_tag_params)
           @post_tag.set_options(params[:meta]) if params[:meta].present?
-          @post_tag.set_field_values(params[:field_options])
+          @post_tag.set_field_values(cama_permitted_field_options('PostType_PostTag'))
           hooks_run('after_update_post_tag', args)
           flash[:notice] = t('camaleon_cms.admin.post_type.message.updated')
           redirect_to action: :index
@@ -40,12 +43,12 @@ module CamaleonCms
 
       # render post tag create form
       def create
-        @post_tag = @post_type.post_tags.new(params.require(:post_tag).permit!)
+        @post_tag = @post_type.post_tags.new(post_tag_params)
         args = { post_tag: @post_tag, post_type: @post_type }
         hooks_run('before_create_post_tag', args)
         if @post_tag.save
           @post_tag.set_options(params[:meta]) if params[:meta].present?
-          @post_tag.set_field_values(params[:field_options])
+          @post_tag.set_field_values(cama_permitted_field_options('PostType_PostTag'))
           hooks_run('after_create_post_tag', args)
           flash[:notice] = t('camaleon_cms.admin.post_type.message.created')
           redirect_to action: :index
@@ -70,15 +73,21 @@ module CamaleonCms
 
       private
 
+      # parent_id is the owning post type's id, set from the @post_type association on create; it is not
+      # accepted from the request so a tag cannot be moved under another post type or site (H8).
+      def post_tag_params
+        params.require(:post_tag).permit(:name, :slug, :description)
+      end
+
       def set_post_type
-        @post_type = current_site.post_types.find_by_id(params[:post_type_id]).decorate
+        @post_type = current_site.post_types.find_by(id: params[:post_type_id]).decorate
         authorize! :post_tags, @post_type
         add_breadcrumb @post_type.the_title, @post_type.the_admin_url
         add_breadcrumb t('camaleon_cms.admin.post_type.post_tags'), url_for({ action: :index })
       end
 
       def set_post_tag
-        @post_tag = @post_type.post_tags.find_by_id(params[:id])
+        @post_tag = @post_type.post_tags.find_by(id: params[:id])
       rescue StandardError
         flash[:error] = t('camaleon_cms.admin.post_type.message.error')
         redirect_to cama_admin_path