camaleon_cms 2.9.1 → 2.9.3

data/lib/tasks/camaleon_cms/camaleon_tasks.rake

@@ -10,7 +10,8 @@ namespace :camaleon_cms do
     include Rails.application.routes.url_helpers
     $current_site = CamaleonCms::Site.find(ENV['site_id'].to_i)
     cama_uploader_init_connection
-    @fog_connection_bucket_dir.files.all.each do |file|
+    # TODO: The `fog` gem isn't used anymore - this whole task should be refactored
+    @fog_connection_bucket_dir.files.all.each do |file| # rubocop:disable Rails/FindEach
       puts file.inspect
       cama_uploader_generate_thumbnail(file.key, file.key, '')
     end

data/lib/tasks/cross_site_field_groups.rake

@@ -0,0 +1,74 @@
+namespace :camaleon_cms do
+  # A custom field group carries tenancy in `parent_id` (which site owns and administers it) and
+  # placement in `object_class` + `objectid` (which record's admin page displays it). Placement reads
+  # are not scoped by site, so a group whose two disagree renders on the site owning the placement
+  # target while staying invisible in that site's own field group list, which is tenancy-scoped.
+  #
+  # Re-home rather than delete: a mismatch is not proof of an injection -- a plugin stamping
+  # parent_id from the wrong site produces the same shape -- and deleting would take the group's
+  # field definitions and their values with it. Setting parent_id to the site that already renders
+  # the group restores the invariant and surfaces it where an administrator can judge and remove it.
+  desc 'Re-home custom field groups whose owning site differs from the site owning their placement'
+  task rehome_cross_site_field_groups: :environment do
+    report = CamaleonCms::TaskReporter
+    report.call 'Re-homing cross-site custom field groups...'
+    rehomed_count = 0
+    skipped_count = 0
+
+    CamaleonCms::CustomFieldGroup.unscoped.where.not(object_class: '_fields').find_each do |group|
+      site_id = cama_placement_site_id(group)
+
+      if site_id.blank?
+        report.call "  Skipped group id=#{group.id} slug=#{group.slug} " \
+                    "(#{group.object_class}/#{group.objectid} does not resolve to a site)"
+        skipped_count += 1
+        next
+      end
+
+      next if site_id == group.parent_id
+
+      begin
+        report.call "✓ Re-homed group id=#{group.id} slug=#{group.slug} " \
+                    "from site_id=#{group.parent_id} to site_id=#{site_id} " \
+                    "(placement #{group.object_class}/#{group.objectid})"
+        group.update_column(:parent_id, site_id) # rubocop:disable Rails/SkipsModelValidations
+        rehomed_count += 1
+      rescue StandardError => e
+        report.call "✗ Failed to re-home group id=#{group.id}: #{e.message}"
+        skipped_count += 1
+      end
+    end
+
+    report.call "\nSummary:"
+    report.call "  Re-homed: #{rehomed_count} field groups"
+    report.call "  Skipped:  #{skipped_count} field groups"
+    report.call "\nDone. Review the field group list of any site that gained a group."
+  end
+end
+
+# Resolve the site owning a group's placement target, or nil when it cannot be determined.
+# Best-effort by design: a placement naming a record that no longer exists is left alone rather
+# than guessed at or deleted.
+def cama_placement_site_id(group)
+  objectid = group.objectid
+  return nil if objectid.blank?
+
+  case group.object_class
+  when 'PostType', 'PostType_Post', 'PostType_Category', 'PostType_PostTag'
+    CamaleonCms::PostType.find_by(id: objectid)&.parent_id
+  when 'Theme' then CamaleonCms::Theme.find_by(id: objectid)&.parent_id
+  when 'Plugin' then CamaleonCms::Plugin.find_by(id: objectid)&.parent_id
+  when 'NavMenu' then CamaleonCms::NavMenu.find_by(id: objectid)&.parent_id
+  when 'Widget::Main' then CamaleonCms::Widget::Main.find_by(id: objectid)&.parent_id
+  when 'Post' then CamaleonCms::Post.find_by(id: objectid)&.post_type&.parent_id
+  when 'Category', 'Category_Post' then CamaleonCms::Category.find_by(id: objectid)&.post_type_parent&.parent_id
+  when 'PostTag' then CamaleonCms::PostTag.find_by(id: objectid)&.post_type&.parent_id
+  else
+    # Site, the configured user model, and models registered through the custom_field_custom_models
+    # hook are all placed with the site's own id, so the placement target is the site itself.
+    CamaleonCms::Site.find_by(id: objectid)&.id
+  end
+rescue StandardError => e
+  CamaleonCms::TaskReporter.call "  Could not resolve placement for group id=#{group.id}: #{e.message}"
+  nil
+end

data/lib/tasks/custom_fields_roles.rake

@@ -0,0 +1,58 @@
+namespace :camaleon_cms do
+  desc 'Backfill user roles to include custom_fields manager permission'
+  task backfill_custom_fields_permission: :environment do
+    report = CamaleonCms::TaskReporter
+    report.call 'Backfilling custom_fields manager permission for existing user roles...'
+    CamaleonCms::UserRole.find_each do |role|
+      key = "_manager_#{role.parent_id}"
+      begin
+        current_role = role.get_meta(key)
+        # if the role already has settings/managers, skip; otherwise add custom_fields => 1
+        if current_role.blank? || (!current_role.is_a?(Hash) || current_role['custom_fields'].blank?)
+          current_role = (current_role.is_a?(Hash) ? current_role : {}).merge!('custom_fields' => 1)
+          role.set_meta(key, current_role)
+          report.call "Updated role=#{role.slug} site_id=#{role.parent_id}"
+        else
+          report.call "Skipped role=#{role.slug} site_id=#{role.parent_id} (already has custom_fields)"
+        end
+      rescue StandardError => e
+        report.call "Failed to update role=#{role.slug}: #{e.message}"
+      end
+    end
+    report.call 'Done.'
+  end
+
+  desc 'Backfill admin user roles to include select_eval permission'
+  task backfill_select_eval_permission: :environment do
+    report = CamaleonCms::TaskReporter
+    report.call 'Backfilling select_eval permission for admin roles...'
+    updated_count = 0
+    skipped_count = 0
+
+    CamaleonCms::UserRole.where(slug: 'admin', term_group: -1).find_each do |role|
+      site_id = role.parent_id
+      key = "_manager_#{site_id}"
+      begin
+        current_meta = role.get_meta(key, {})
+
+        # Only update if role doesn't already have select_eval
+        if !current_meta[:select_eval]
+          updated_meta = current_meta.merge(select_eval: 1)
+          role.set_meta(key, updated_meta)
+          report.call "✓ Updated admin role site_id=#{site_id}"
+          updated_count += 1
+        else
+          report.call "  Skipped admin role site_id=#{site_id} (already has select_eval)"
+          skipped_count += 1
+        end
+      rescue StandardError => e
+        report.call "✗ Failed to update admin role site_id=#{site_id}: #{e.message}"
+      end
+    end
+
+    report.call "\nSummary:"
+    report.call "  Updated: #{updated_count} admin roles"
+    report.call "  Skipped: #{skipped_count} admin roles"
+    report.call "\nDone! All admin roles now have select_eval permission."
+  end
+end

data/lib/tasks/orphaned_comments.rake

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+namespace :camaleon_cms do
+  desc 'Reassign comments whose user no longer exists to the owning site\'s anonymous user'
+  task reassign_orphaned_comments: :environment do
+    user_table = CamaManager.get_user_class_name.constantize.table_name
+    comment_table = CamaleonCms::PostComment.table_name
+
+    # `user_id IS NULL` on its own does not mean "orphaned": guest comments are a first-class
+    # shape — user_id is nullable and the row carries author/author_email/author_url instead —
+    # and they have always had a null user_id. The regression nulled the user_id of *registered*
+    # users' comments, and those never carry an author string, which is exactly why
+    # PostCommentDecorator#the_author_name falls back to the user's name. Requiring a blank
+    # author therefore separates the rows this task exists to repair from the ones it must not
+    # touch. Rows with a dangling (non-null, non-existent) user_id are repaired regardless.
+    orphans = CamaleonCms::PostComment
+              .where("(#{comment_table}.user_id IS NULL AND " \
+                     "(#{comment_table}.author IS NULL OR #{comment_table}.author = '')) " \
+                     "OR (#{comment_table}.user_id IS NOT NULL AND #{comment_table}.user_id NOT IN " \
+                     "(SELECT id FROM #{user_table}))")
+    reassigned = 0
+    skipped = 0
+
+    orphans.find_each do |comment|
+      site = comment.post&.post_type&.site
+      if site.nil?
+        skipped += 1
+        next
+      end
+
+      comment.update_column(:user_id, site.get_anonymous_user.id) # rubocop:disable Rails/SkipsModelValidations
+      reassigned += 1
+    end
+
+    summary = "camaleon_cms:reassign_orphaned_comments reassigned #{reassigned} comment(s)" \
+              "#{skipped > 0 ? ", skipped #{skipped} without a resolvable site" : ''}"
+    Rails.logger.info(summary)
+    # An operator runs this from a terminal, where Rails.logger writes to a file they are not
+    # watching. Without this the task looks like it did nothing.
+    puts summary
+  end
+end

data/lib/tasks/private_upload_acls.rake

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+namespace :camaleon_cms do
+  desc 'Re-apply the owner-only ACL to S3 objects under each AWS site\'s private upload prefix ' \
+       '(uploads stored before the private-ACL fix were world-readable). ' \
+       'Set CAMA_S3_INNER_FOLDER for setups whose uploader hook configures an inner_folder.'
+  task repair_private_upload_acls: :environment do
+    inner_folder = ENV['CAMA_S3_INNER_FOLDER'].to_s
+    repaired_total = 0
+    swept_sites = 0
+
+    CamaleonCms::Site.find_each do |site_record|
+      site = site_record.decorate
+      next unless %w[aws s3].include?(site.get_option('filesystem_type', 'local').to_s.downcase)
+
+      uploader = CamaleonCmsAwsUploader.new({ current_site: site,
+                                              aws_settings: { 'inner_folder' => inner_folder } }, nil)
+      repaired = uploader.repair_private_acls!
+      swept_sites += 1
+      repaired_total += repaired
+      puts "  #{site.the_slug}: #{repaired} object(s) re-ACLed"
+    end
+
+    summary = "camaleon_cms:repair_private_upload_acls re-ACLed #{repaired_total} object(s) " \
+              "across #{swept_sites} AWS site(s)"
+    Rails.logger.info(summary)
+    # An operator runs this from a terminal, where Rails.logger writes to a file they are not
+    # watching. Without this the task looks like it did nothing.
+    puts summary
+  end
+end

data/lib/tasks/site_custom_field_groups.rake

@@ -0,0 +1,36 @@
+namespace :camaleon_cms do
+  # Site#get_field_groups matches a group's placement (object_class + objectid) instead of its
+  # tenancy (parent_id). `objectid` has no presence validation, so a group could be persisted with
+  # object_class 'Site' and a NULL objectid by bypassing add_custom_field_group. Those rows are
+  # invisible on the site settings page under the placement-scoped read, so give them the objectid
+  # they should always have had: the site that owns them.
+  desc 'Backfill objectid for site custom field groups that were saved without one'
+  task backfill_site_field_group_objectid: :environment do
+    report = CamaleonCms::TaskReporter
+    report.call 'Backfilling objectid for site custom field groups...'
+    updated_count = 0
+    skipped_count = 0
+
+    CamaleonCms::CustomField.unscoped.where(object_class: 'Site', objectid: nil).find_each do |group|
+      if group.parent_id.blank?
+        report.call "  Skipped group id=#{group.id} slug=#{group.slug} (no owning site)"
+        skipped_count += 1
+        next
+      end
+
+      begin
+        group.update_column(:objectid, group.parent_id) # rubocop:disable Rails/SkipsModelValidations
+        report.call "✓ Updated group id=#{group.id} slug=#{group.slug} site_id=#{group.parent_id}"
+        updated_count += 1
+      rescue StandardError => e
+        report.call "✗ Failed to update group id=#{group.id}: #{e.message}"
+        skipped_count += 1
+      end
+    end
+
+    report.call "\nSummary:"
+    report.call "  Updated: #{updated_count} field groups"
+    report.call "  Skipped: #{skipped_count} field groups"
+    report.call "\nDone."
+  end
+end

data/lib/tasks/unsafe_stored_content.rake

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+namespace :camaleon_cms do
+  namespace :security do
+    # The scan-and-reject gates refuse dangerous content at save time but never rewrite what is
+    # already stored (nothing is ever rewritten under this model). This task lists the stored
+    # content that would fail today's gates -- post content and gated custom-field values -- so an
+    # operator can review and clean it up by hand. Read-only: it changes nothing.
+    desc 'List stored post content and custom-field values that would fail the scan-and-reject gates'
+    task scan_content: :environment do
+      report = CamaleonCms::TaskReporter
+      report.call 'Scanning stored content against the scan-and-reject gates (read-only)...'
+      flagged = 0
+
+      CamaleonCms::Post.unscoped.where.not(content: [nil, '']).find_each do |post|
+        next unless CamaleonCms::UnsafeMarkup.unsafe_html?(
+          post.content, tags: CamaleonCms::Post::CONTENT_ALLOWED_TAGS,
+                        attributes: CamaleonCms::Post::CONTENT_ALLOWED_ATTRIBUTES
+        )
+
+        flagged += 1
+        report.call "✗ Post id=#{post.id} (#{post.post_class}) '#{post.slug.to_s.truncate(60)}': " \
+                    'content would be rejected'
+      end
+
+      # Reuse the model's own gate dispatch (which covers editor, field_attrs and URI field types),
+      # so the scan can never diverge from what the save-time validation would refuse.
+      CamaleonCms::CustomFieldsRelationship.unscoped.where.not(value: [nil, ''])
+                                           .includes(:custom_field).find_each do |row|
+        field_key = row.custom_field&.options&.[](:field_key).to_s
+        next unless CamaleonCms::CustomFieldsRelationship.gate_rejection_reason(field_key, row.value)
+
+        flagged += 1
+        report.call "✗ Custom-field value id=#{row.id} field='#{row.custom_field_slug}' " \
+                    "(#{field_key}) on #{row.object_class} ##{row.objectid}: value would be rejected"
+      end
+
+      report.call "Done. #{flagged} stored item(s) would be rejected by today's gates."
+      report.call 'Nothing was modified; review and clean up the listed items by hand.'
+    end
+  end
+end

data/lib/tasks/unsafe_stored_uploads.rake

@@ -0,0 +1,70 @@
+# frozen_string_literal: true
+
+namespace :camaleon_cms do
+  namespace :security do
+    # The upload rules refuse dangerous content at upload time but never re-examine what is already
+    # stored (nothing is ever rewritten under this model). This task lists the stored files today's
+    # rules would refuse, so an operator can review them by hand. Read-only: it changes nothing.
+    #
+    # The companion for authored content is camaleon_cms:security:scan_content.
+    desc 'List stored media files that would fail the upload scan rules'
+    task scan_uploads: :environment do
+      report = CamaleonCms::TaskReporter
+      # Reuse the real scanner rather than reimplementing its rules, so the report can never
+      # disagree with what an upload of the same bytes would be told today.
+      scanner = Class.new { include CamaleonCms::UploaderContentSecurity }.new
+      flagged = 0
+      scanned = 0
+
+      report.call 'Scanning stored media against the upload scan rules (read-only)...'
+
+      # Scans every file under `root`, reporting those today's rules would refuse. `label` names the
+      # location and `base` anchors the reported path. Closes over the counters so the public and
+      # private roots share one pass rather than duplicating the scan logic (and risking drift).
+      # FNM_DOTMATCH so dotfiles are scanned: a basename that is entirely an extension (`.svg`, `.js`)
+      # is exactly what the scanner fail-closes on. `.`/`..` are directory entries File.file? drops.
+      scan_tree = lambda do |root, base, label|
+        next unless root.directory?
+
+        Dir.glob(root.join('**', '*'), File::FNM_DOTMATCH).sort.each do |path|
+          next unless File.file?(path)
+
+          scanned += 1
+          relative = Pathname.new(path).relative_path_from(base)
+          reason = begin
+            scanner.content_unsafe?(File.binread(path), filename: File.basename(path))
+          rescue StandardError => e
+            # A file the scan cannot read at all is reported rather than skipped: an unreadable
+            # entry is exactly what an operator wants to know about, and swallowing it would hand
+            # them a false all-clear.
+            "unreadable (#{e.class})"
+          end
+          next unless reason
+
+          flagged += 1
+          report.call "✗ #{label} /#{relative}: would be rejected (#{reason})"
+        end
+      end
+
+      CamaleonCms::Site.unscoped.find_each do |site|
+        # Site#upload_directory honours the `media_slug_folder` config, which stores uploads under
+        # media/<slug> instead of media/<id>. Hardcoding the id scanned nothing on a slug-configured
+        # install and printed a clean "0 would be rejected" -- a false all-clear.
+        scan_tree.call(Pathname.new(site.upload_directory), Rails.public_path, "Site #{site.id}")
+      end
+
+      # Private media is scanned at upload time exactly like public media, so files stored before
+      # these rules apply are equally worth surfacing. It lives outside the public root, under its
+      # own directory, so it is scanned separately and reported relative to the app root.
+      scan_tree.call(Rails.root.join(CamaleonCmsUploader::PRIVATE_DIRECTORY), Rails.root, 'Private media')
+
+      report.call "Done. #{scanned} stored file(s) scanned, #{flagged} would be rejected by today's rules."
+      report.call 'Nothing was modified.'
+      if flagged > 0
+        report.call 'A finding is not by itself evidence of compromise: these rules are newer than ' \
+                    'the files, so content uploaded legitimately under the previous rules is ' \
+                    'listed too. Review each one before acting.'
+      end
+    end
+  end
+end

data/lib/tasks/user_field_groups.rake

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+namespace :camaleon_cms do
+  # Through 2.9.2 the custom-fields settings form emitted the raw `user_model` config string as
+  # the users placement option, so a namespaced host user model (e.g. 'Admin::User') stored its
+  # user field groups under the qualified name — which the demodulized association scope and the
+  # 2.9.2 allowed-slugs save filter cannot see. Re-key those group placements to the demodulized
+  # contract. Only the group rows move: their fields hang off parent_id under '_fields', group
+  # metas key off 'CustomFieldGroup', and value rows were always written under the demodulized
+  # name. Keyed to the current config: a host that renamed its user model after writing groups
+  # should temporarily restore the historical value while running the task.
+  desc 'Re-key user custom field groups stored under a namespaced user_model name'
+  task demodulize_user_field_groups: :environment do
+    configured = PluginRoutes.static_system_info['user_model'].presence.to_s
+    demodulized = configured.demodulize
+
+    if configured.blank? || configured == demodulized
+      puts 'Nothing to re-key: the configured user model is not namespaced.'
+      next
+    end
+
+    count = CamaleonCms::CustomField.unscoped
+                                    .where(object_class: configured)
+                                    .update_all(object_class: demodulized) # rubocop:disable Rails/SkipsModelValidations
+    puts "Re-keyed #{count} user field group(s) from '#{configured}' to '#{demodulized}'."
+  end
+end