camaleon_cms 2.9.1 → 2.9.3

data/app/controllers/camaleon_cms/admin/posts/drafts_controller.rb

@@ -5,22 +5,37 @@ module CamaleonCms
         before_action :set_post_data_params, only: %i[create update]
 
         def index
+          # Security (audit 2026-08-11 M12): this action had no authorization, so any signed-in user
+          # could read a post type's JSON. Gate it on the same permission the post listing requires.
+          authorize! :posts, @post_type
           render json: @post_type
         end
 
         def create
-          if params[:post_id].present?
-            @post_draft = CamaleonCms::Post.drafts.where(post_parent: params[:post_id]).first
+          if @draft_parent_post.present?
+            # A draft buffer is an artifact of editing its parent post — authorize that post,
+            # and only ever touch the current user's own buffer
+            authorize! :update, @draft_parent_post
+            @post_draft = @post_type.posts.drafts.where(post_parent: @draft_parent_post.id,
+                                                        user_id: cama_current_user.id).first
             if @post_draft.present?
               @post_draft.set_option('draft_status', @post_draft.status)
               @post_draft.attributes = @post_data
             end
+          else
+            authorize! :create_post, @post_type
+          end
+          if @post_draft.blank?
+            @post_draft = @post_type.posts.new(@post_data)
+            @post_draft.user_id = cama_current_user.id
           end
-          @post_draft = @post_type.posts.new(@post_data) unless @post_draft.present?
           r = { post: @post_draft, post_type: @post_type }
           hooks_run('create_post_draft', r)
           if @post_draft.save(validate: false)
-            @post_draft.set_params(params[:meta], params[:field_options], @post_data[:keywords])
+            # Security (audit M8): confine field values to slugs actually registered on the post type,
+            # like PostsController#save_post_with_fields -- raw params[:field_options] let a caller
+            # write custom_field_values with attacker-chosen slugs/ids/group numbers.
+            @post_draft.set_params(params[:meta], cama_permitted_field_options('PostType_Post'), @post_data[:keywords])
             msg = { draft: { id: @post_draft.id },
                     _drafts_path: cama_admin_post_type_draft_path(@post_type.id, @post_draft) }
             r = { post: @post_draft, post_type: @post_type }
@@ -33,18 +48,25 @@ module CamaleonCms
         end
 
         def update
-          @post_draft = CamaleonCms::Post.drafts.find(params[:id])
+          @post_draft = @post_type.posts.drafts.where(user_id: cama_current_user.id).find(params[:id])
+          authorize! :update, @post_draft.parent || @post_draft
           @post_draft.attributes = @post_data
           r = { post: @post_draft, post_type: @post_type }
           hooks_run('update_post_draft', r)
           if @post_draft.save(validate: false)
-            @post_draft.set_params(params[:meta], params[:field_options], params[:options])
+            # Security (audit M8): confine field values to the post type's registered slugs (see #create).
+            @post_draft.set_params(params[:meta], cama_permitted_field_options('PostType_Post'), params[:options])
             hooks_run('updated_post_draft', { post: @post_draft, post_type: @post_type })
             msg = { draft: { id: @post_draft.id } }
           else
             msg = { error: @post_draft.errors.full_messages }
           end
           render json: msg
+        rescue ActiveRecord::RecordNotFound
+          # Another user's buffer answers exactly like a nonexistent draft id (same rescue
+          # behavior as PostsController#set_post) — no existence oracle for foreign buffers
+          flash[:error] = t('camaleon_cms.admin.post.message.error', post_type: @post_type.decorate.the_title)
+          redirect_to cama_admin_path
         end
 
         def destroy; end
@@ -52,12 +74,19 @@ module CamaleonCms
         private
 
         def set_post_data_params
-          post_data = params.require(:post).permit!
-          post_data.delete(:created_at) unless params[:post][:created_at].present?
-          post_data.delete(:updated_at) unless params[:post][:updated_at].present?
+          post_data = params
+                      .require(:post).permit(
+                        :title, :slug, :content, :excerpt, :status, :comment_status, :visibility,
+                        :visibility_value, :post_order, :published_at
+                      ).to_h
+          post_data.delete(:created_at) if params[:post][:created_at].blank?
+          post_data.delete(:updated_at) if params[:post][:updated_at].blank?
           post_data[:status] = 'draft_child'
-          post_data[:post_parent] = params[:post_id]
-          post_data[:user_id] = cama_current_user.id unless post_data[:user_id].present?
+          if action_name == 'create'
+            @draft_parent_post = current_site.posts.find_by(id: params[:post_id]) if params[:post_id].present?
+            # post_parent is create-only and always overwritten — never client-writable via post[post_parent]
+            post_data[:post_parent] = @draft_parent_post&.id
+          end
           post_data[:data_tags] = params[:tags].to_s
           post_data[:data_categories] = params[:categories] || []
           @post_data = post_data

data/app/controllers/camaleon_cms/admin/posts_controller.rb

@@ -1,7 +1,10 @@
 module CamaleonCms
   module Admin
     class PostsController < CamaleonCms::AdminController
+      include CamaleonCms::Admin::CustomFieldsConcern
+
       add_breadcrumb I18n.t('camaleon_cms.admin.sidebar.contents')
+
       before_action :set_post_type, except: [:ajax]
       before_action :set_post, only: %w[show edit update destroy]
       skip_before_action :admin_logged_actions, only: %i[trash restore destroy ajax], raise: false
@@ -9,19 +12,28 @@ module CamaleonCms
 
       def index
         authorize! :posts, @post_type
+        # Array/hash-typed query params (?q[]=x, ?s[]=published, ?taxonomy_id[]=1) have no meaning here
+        # and 500ed the action (Array#downcase / Array#to_sym / find(Array).decorate); treat them as absent.
+        %i[q s taxonomy taxonomy_id].each { |k| params[k] = nil unless params[k].nil? || params[k].is_a?(String) }
         per_page = current_site.admin_per_page
         posts_all = @post_type.posts.eager_load(:parent, :post_type)
         if params[:taxonomy].present? && params[:taxonomy_id].present?
+          # Security (audit 2026-08-11 M11): keep the listing scoped to @post_type. The taxonomy is
+          # resolved within the authorized post type -- a foreign category/tag id raises RecordNotFound
+          # instead of rendering that taxonomy's title/edit URL in the breadcrumb (a name/existence
+          # oracle across the very boundary `authorize! :posts, @post_type` draws). The listing then
+          # intersects with the post type's posts, so a filter can only ever narrow the authorized set.
           if params[:taxonomy] == 'category'
-            cat_owner = current_site.full_categories.find(params[:taxonomy_id]).decorate
-            posts_all = cat_owner.posts
+            cat_owner = @post_type.full_categories.find(params[:taxonomy_id]).decorate
+            # reorder(nil): the relation becomes an IN subquery, where its default-scope ORDER BY is dead sort work
+            posts_all = posts_all.where(id: cat_owner.posts.reorder(nil))
             add_breadcrumb t('camaleon_cms.admin.post_type.category'), @post_type.the_admin_url('category')
             add_breadcrumb cat_owner.the_title, cat_owner.the_edit_url
           end
 
           if params[:taxonomy] == 'post_tag'
-            tag_owner = current_site.post_tags.find(params[:taxonomy_id]).decorate
-            posts_all = tag_owner.posts
+            tag_owner = @post_type.post_tags.find(params[:taxonomy_id]).decorate
+            posts_all = posts_all.where(id: tag_owner.posts.reorder(nil))
             add_breadcrumb t('camaleon_cms.admin.post_type.tags'), @post_type.the_admin_url('tag')
             add_breadcrumb tag_owner.the_title, tag_owner.the_edit_url
           end
@@ -36,10 +48,10 @@ module CamaleonCms
           )
         end
 
-        posts_all = posts_all.where(user_id: cama_current_user) if cannot?(:edit_other, @post_type)
+        posts_all = cama_admin_visible_posts(posts_all, [@post_type])
 
         @posts = posts_all
-        params[:s] = 'published' unless params[:s].present?
+        params[:s] = 'published' if params[:s].blank?
         @lists_tab = params[:s]
         case params[:s]
         when 'published', 'pending', 'trash'
@@ -50,8 +62,13 @@ module CamaleonCms
           @posts = @posts.no_trash
         end
 
-        @btns = { published: "#{t('camaleon_cms.admin.post_type.published')} (#{posts_all.published.size})",
-                  all: "#{t('camaleon_cms.admin.post_type.all')} (#{posts_all.no_trash.size})", pending: "#{t('camaleon_cms.admin.post_type.pending')} (#{posts_all.pending.size})", draft: "#{t('camaleon_cms.admin.post_type.draft')} (#{posts_all.drafts.size})", trash: "#{t('camaleon_cms.admin.post_type.trash')} (#{posts_all.trash.size})" }
+        @btns = {
+          published: "#{t('camaleon_cms.admin.post_type.published')} (#{posts_all.published.size})",
+          all: "#{t('camaleon_cms.admin.post_type.all')} (#{posts_all.no_trash.size})",
+          pending: "#{t('camaleon_cms.admin.post_type.pending')} (#{posts_all.pending.size})",
+          draft: "#{t('camaleon_cms.admin.post_type.draft')} (#{posts_all.drafts.size})",
+          trash: "#{t('camaleon_cms.admin.post_type.trash')} (#{posts_all.trash.size})"
+        }
         per_page = 9_999_999 if @post_type.manage_hierarchy?
         r = { posts: @posts, post_type: @post_type, btns: @btns, all_posts: posts_all, render: 'index',
               per_page: per_page }
@@ -85,10 +102,7 @@ module CamaleonCms
         r = { post: @post, post_type: @post_type }
         hooks_run('create_post', r)
         @post = r[:post]
-        if @post.save
-          @post.set_metas(params[:meta])
-          @post.set_field_values(params[:field_options])
-          @post.set_options(params[:options])
+        if save_post_with_fields(@post)
           flash[:notice] = t('camaleon_cms.admin.post.message.created', post_type: @post_type.decorate.the_title)
           r = { post: @post, post_type: @post_type }
           hooks_run('created_post', r)
@@ -114,7 +128,7 @@ module CamaleonCms
         if @post.draft_child? && @post.parent.present?
           # This is a draft (as a child of the original post)
           original_parent = @post.parent.parent
-          post_data[:post_parent] = original_parent.present? ? original_parent.id : nil
+          post_data[:post_parent] = original_parent&.id
           @post = @post.parent
           delete_drafts = true
         elsif @post.draft?
@@ -125,12 +139,9 @@ module CamaleonCms
         r = { post: @post, post_type: @post_type }
         hooks_run('update_post', r)
         @post = r[:post]
-        if @post.update(post_data)
+        if save_post_with_fields(@post, post_data)
           # delete drafts only on successful update operation
           @post.drafts.destroy_all if delete_drafts
-          @post.set_metas(params[:meta])
-          @post.set_field_values(params[:field_options])
-          @post.set_options(params[:options])
           hooks_run('updated_post', { post: @post, post_type: @post_type })
           flash[:notice] = t('camaleon_cms.admin.post.message.updated', post_type: @post_type.decorate.the_title)
           redirect_to action: :edit, id: @post.id
@@ -144,7 +155,7 @@ module CamaleonCms
         authorize! :destroy, @post
         @post.set_option('status_default', @post.status)
         # @post.children.destroy_all unless @post.draft? TODO: why delete children?
-        @post.update_column('status', 'trash')
+        @post.update_column(:status, 'trash') # rubocop:disable Rails/SkipsModelValidations
         @post.update_extra_data
         hooks_run('trashed_post', { post: @post, post_type: @post_type })
         flash[:notice] = t('camaleon_cms.admin.post.message.trash', post_type: @post_type.decorate.the_title)
@@ -154,7 +165,9 @@ module CamaleonCms
       def restore
         @post = @post_type.posts.find(params[:post_id])
         authorize! :update, @post
-        @post.update_column('status', @post.options[:status_default] || 'pending')
+        # rubocop:disable Rails/SkipsModelValidations
+        @post.update_column(:status, @post.options[:status_default] || 'pending')
+        # rubocop:enable Rails/SkipsModelValidations
         @post.update_extra_data
         hooks_run('restored_post', { post: @post, post_type: @post_type })
         flash[:notice] = t('camaleon_cms.admin.post.message.restore', post_type: @post_type.decorate.the_title)
@@ -190,10 +203,29 @@ module CamaleonCms
 
       private
 
+      # Persist the post together with its metas, field values and options atomically (audit M10).
+      # Before this, the parent was saved and its metas committed before set_field_values ran, so a
+      # field value the scan-and-reject gate refused (CustomFieldsRelationship RecordInvalid) left a
+      # half-applied post -- an orphan on create, skipped options, only a redirect explaining why.
+      # Wrapping the whole sequence in one transaction rolls the parent save back with the refused
+      # value, and the RecordInvalid propagates to AdminController's rescue_from (flash + redirect
+      # back) with nothing persisted. Returns true on success, false on a parent validation failure.
+      def save_post_with_fields(post, update_attrs = nil)
+        ActiveRecord::Base.transaction do
+          saved = update_attrs ? post.update(update_attrs) : post.save
+          raise ActiveRecord::Rollback unless saved
+
+          post.set_metas(params[:meta])
+          post.set_field_values(cama_permitted_field_options('PostType_Post'))
+          post.set_options(params[:options])
+          true
+        end
+      end
+
       # define post type parent
       def set_post_type
-        @post_type = current_site.post_types.find_by_id(params[:post_type_id])
-        unless @post_type.present?
+        @post_type = current_site.post_types.find_by(id: params[:post_type_id])
+        if @post_type.blank?
           flash[:error] = t('camaleon_cms.admin.request_error_message')
           redirect_to cama_admin_path
           return
@@ -213,7 +245,11 @@ module CamaleonCms
       # return common params data for posts
       # is_create: indicate if this info is for create a new post
       def get_post_data(is_create = false)
-        post_data = params.require(:post).permit!
+        post_data = params
+                    .require(:post).permit(
+                      :title, :slug, :content, :excerpt, :status, :comment_status, :post_parent, :visibility,
+                      :visibility_value, :post_order, :published_at
+                    ).to_h
         post_data[:user_id] = cama_current_user.id if is_create
         post_data[:status] = 'pending' if post_data[:status] == 'published' && cannot?(:publish_post, @post_type)
         post_data[:data_tags] = params[:tags].to_s

data/app/controllers/camaleon_cms/admin/sessions_controller.rb

@@ -7,9 +7,31 @@ module CamaleonCms
       before_action :verificate_register_permission, only: [:register]
       layout 'camaleon_cms/login'
 
-      # you can pass return_to as a param (mysite.com/admin/login?return_to=my-url) and this will be used after user logged in
+      # Security (audit M6): logout acts only over POST, so a logout submitted with a stale CSRF token
+      # (a second tab that already reset the session, or a cached theme page) would otherwise render a
+      # raw 422 instead of ending the session. For logout alone, fall back to the GET confirmation so
+      # the user gets a fresh token and one extra click; every other action keeps the strict failure.
+      rescue_from ActionController::InvalidAuthenticityToken do |error|
+        raise error unless action_name == 'logout'
+
+        redirect_to cama_admin_logout_path
+      end
+
+      # A precomputed bcrypt digest spent only to equalize login timing when the username does not exist,
+      # so a missing username is not distinguishable from a wrong password by response time (audit finding
+      # M14: username enumeration by login timing). Computed once at load, at this environment's cost.
+      TIMING_EQUALIZER_DIGEST = BCrypt::Password.create('cama-login-timing-equalizer').to_s.freeze
+
+      # Minimum interval between password-reset emails to the same account, so the forgot-password
+      # endpoint cannot be used to flood a known address (audit finding M13). Within the window a
+      # reset request is accepted (and answered identically) but sends no new email; the previously
+      # issued token stays valid for its 2h lifetime (see #forgot).
+      PASSWORD_RESET_EMAIL_COOLDOWN = 5.minutes
+
+      # you can pass return_to as a param (mysite.com/admin/login?return_to=my-url) and
+      # this will be used after user logged in
       def login
-        return redirect_to(params[:return_to].present? ? params[:return_to] : cama_admin_dashboard_path) if signin?
+        return cama_safe_redirect(params[:return_to], cama_admin_dashboard_path) if signin?
 
         cookies[:return_to] = params[:return_to] if params[:return_to].present?
         @user ||= current_site.users.new
@@ -18,21 +40,28 @@ module CamaleonCms
       end
 
       def login_post
+        return if cama_halt_when_login_locked_out('login')
+
         data_user = user_permit_data
-        @user = current_site.users.find_by_username(data_user[:username])
+        # Custom class finder (not the dynamic finder): usernames are stored downcased,
+        # so the lookup must lower-case both sides regardless of DB collation.
+        @user = current_site.users.find_by_username(data_user[:username]) # rubocop:disable Rails/DynamicFindBy
         captcha_validate = captcha_verify_if_under_attack('login')
         r = { user: @user, params: params, password: data_user[:password], captcha_validate: captcha_validate,
               stop_process: false }
         hooks_run('user_before_login', r)
         return if r[:stop_process] # permit to redirect for data completion
 
-        if captcha_validate && @user&.authenticate(data_user[:password])
+        if captcha_validate && cama_password_matches?(@user, data_user[:password])
           # Email validation if is necessary
           if @user.is_valid_email? || !current_site.need_validate_email?
             cama_captcha_reset_attack('login')
             r = { user: @user, redirect_to: params[:format] == 'json' ? false : nil }
             hooks_run('after_login', r)
-            login_user(@user, params[:remember_me].present?, r[:redirect_to])
+            # An after_login hook may set r[:allow_external_redirect] to vouch for an off-site r[:redirect_to]
+            # (SSO/payment); without it the destination is same-host/allowlist-only. See login_user.
+            login_user(@user, params[:remember_me].present?, r[:redirect_to],
+                       allow_external: r[:allow_external_redirect].present?)
             render(json: flash.discard.to_hash) if params[:format] == 'json'
             return
           else
@@ -54,75 +83,161 @@ module CamaleonCms
       end
 
       def logout
-        if session[:parent_auth_token].present? && cama_sign_in?
-          session_back_to_parent(cama_admin_dashboard_path)
-        else
+        # A request that is no longer authenticated has nothing to confirm and nothing a forged GET
+        # could end -- but it may still carry session leftovers (a stale impersonation stash, H6),
+        # so it goes through cama_logout_user's cleanup on any verb, exactly as before.
+        return cama_logout_user unless cama_sign_in?
+
+        # While impersonating, the ordinary Logout link must not silently hand the admin account back
+        # to whoever holds the session — returning to the parent now requires the admin's password
+        # (see #back_to_parent). `?full=1` forces a real logout of the impersonated session instead.
+        if session[:parent_auth_token].present? && params[:full].blank?
+          redirect_to cama_admin_back_to_parent_path
+        elsif request.post?
           cama_logout_user
+        else
+          # Security (audit M6): logging out changes state, so only the POST above performs it —
+          # keyed on request.post?, not !request.get?, because Rails exempts HEAD from CSRF exactly
+          # like GET. The GET renders a confirmation instead of 404ing: frontend themes across the
+          # ecosystem link this path, and their visitors get one extra click, not a broken link.
+          prepare_logout_confirmation
+          # Force the HTML template/layout: the confirmation is HTML-only, so a non-HTML GET (an ajax
+          # `/admin/logout.json`) renders the same confirmation instead of raising MissingTemplate (500),
+          # still leaving the session untouched.
+          render :logout_confirm, formats: [:html], content_type: 'text/html'
         end
       end
 
+      # Re-authenticate the impersonating admin before restoring their session (H6 residual). Reachable
+      # only while an impersonation is active; a GET renders the confirmation form, a POST checks the
+      # admin's password and only then returns to the parent session.
+      def back_to_parent
+        return redirect_to(cama_admin_login_path) unless session[:parent_auth_token].present? && cama_sign_in?
+
+        @parent_user = cama_impersonation_parent_user
+        # A stash that no longer resolves to a user — or resolves to an account with no password
+        # digest, which #authenticate would raise on and which cannot prove the holder is the admin —
+        # cannot be returned to; fail closed and end the session.
+        return cama_logout_user if @parent_user.blank? || @parent_user.password_digest.blank?
+
+        @impersonated_user = cama_current_user
+        if request.post?
+          return if cama_halt_when_login_locked_out('back_to_parent')
+
+          # Failed guesses feed the login form's attack counter (same 'login' key), so this endpoint is
+          # not an unthrottled oracle for the admin password: past the threshold a captcha is also
+          # required, and because the parent stash lives in this same session, resetting the counter
+          # (new session / full logout) destroys the stash being attacked.
+          captcha_validate = captcha_verify_if_under_attack('login')
+          if captcha_validate && @parent_user.authenticate(params[:password].to_s)
+            cama_captcha_reset_attack('login')
+            return session_back_to_parent(cama_admin_dashboard_path)
+          end
+
+          cama_captcha_increment_attack('login')
+          flash.now[:error] = if captcha_validate
+                                t('camaleon_cms.admin.login.message.reauth_failed',
+                                  default: 'Incorrect password. Please try again.')
+                              else
+                                t('camaleon_cms.admin.login.message.invalid_caption')
+                              end
+        end
+        render 'back_to_parent'
+      end
+
       def forgot
         @user = current_site.users.new
         # get form reset password
-        if params[:h]
+        if params[:h].present?
+          # Look up by the DB column (a `where` clause is never shadowed by the Rails 7.1+
+          # has_secure_password method), scoped to the current site so a token cannot be redeemed
+          # against a site that does not own the account.
           @user = current_site.users.where(password_reset_token: params[:h]).first
           if @user.nil?
             flash[:error] = t('camaleon_cms.admin.login.message.forgot_url_incorrect')
-            redirect_to cama_admin_forgot_path
-            return
-          elsif @user.password_reset_sent_at < 2.hours.ago
+            return redirect_to cama_admin_forgot_path
+          end
+          # nil timestamp (or one past the window) is expired, not a NoMethodError.
+          if @user.password_reset_sent_at.blank? || @user.password_reset_sent_at < 2.hours.ago
             flash[:error] = t('camaleon_cms.admin.login.message.forgot_expired')
-            redirect_to cama_admin_login_path
-          else
-            # saved new password
-            if params[:user].present?
-              if @user.update(params[:user].permit(:password, :password_confirmation))
-                flash[:notice] = t('camaleon_cms.admin.login.message.reset_password_succes')
-                redirect_to cama_admin_login_path
-                return
-              else
-                flash[:error] = t('camaleon_cms.admin.login.message.reset_password_error')
-              end
+            return redirect_to cama_admin_login_path
+          end
+
+          if params[:user].present?
+            # Blank-check the *permitted* password: permit drops a non-scalar value (e.g.
+            # `user[password][]=x`), and has_secure_password only validates presence on create —
+            # either way `update` would be a silent no-op reported as success, consuming the token.
+            # A scalar `user` param (`?user=foo`) has no .permit: treat it as an empty submission.
+            reset_params = params[:user].try(:permit, :password, :password_confirmation) || {}
+            if reset_params[:password].blank?
+              flash[:error] = t('camaleon_cms.admin.login.message.reset_password_error')
+            elsif @user.update(reset_params)
+              # Single-use: clear the token so the same link cannot be replayed.
+              @user.update_columns(password_reset_token: nil, password_reset_sent_at: nil) # rubocop:disable Rails/SkipsModelValidations
+              flash[:notice] = t('camaleon_cms.admin.login.message.reset_password_succes')
+              return redirect_to cama_admin_login_path
+            else
+              flash[:error] = t('camaleon_cms.admin.login.message.reset_password_error')
             end
-            @form_reset = true
-            render 'forgot'
-            return
           end
+          @form_reset = true
+          return render 'forgot'
         end
 
         # TODO: Move this out of the controller
         # send email reset password
-        return unless params[:user].present?
+        return if params[:user].blank?
 
         data_user = user_permit_data
-        @user = current_site.users.find_by_email(data_user[:email])
-        if @user.present?
-          send_password_reset_email(@user)
-          flash[:notice] = t('camaleon_cms.admin.login.message.send_mail_succes')
-          redirect_to cama_admin_login_path
-          nil
-        else
-          flash[:error] = t('camaleon_cms.admin.login.message.send_mail_error')
-          @user = current_site.users.new(data_user)
-        end
+        # Custom class finder: emails are stored downcased, so the lookup must
+        # lower-case both sides regardless of DB collation.
+        @user = current_site.users.find_by_email(data_user[:email]) # rubocop:disable Rails/DynamicFindBy
+        # Security (audit 2026-08-11 M13): do not reveal whether an account exists, and do not let the
+        # endpoint mail-bomb a known address. Send at most one reset email per cooldown window, and
+        # always answer with the same neutral message whether or not the email matched an account.
+        send_password_reset_email(@user) if @user.present? && cama_password_reset_email_allowed?(@user)
+        # Only en.yml carries this key while the process locale follows the current admin/site
+        # language (audit M15) -- fall back to English rather than emit "translation missing".
+        flash[:notice] = t('camaleon_cms.admin.login.message.password_reset_requested',
+                           default: t('camaleon_cms.admin.login.message.password_reset_requested', locale: :en))
+        redirect_to cama_admin_login_path
       end
 
       def register
         @user ||= current_site.users.new
-        if params[:user].present?
+        # A scalar `user` param has no .permit — only a form-shaped submission enters this branch.
+        if params[:user].respond_to?(:permit)
           params[:user][:role] = PluginRoutes.system_info['default_user_role']
           params[:user][:is_valid_email] = false if current_site.need_validate_email?
           user_data = user_permit_data
-          result = cama_register_user(user_data, params[:meta])
+          result = cama_register_user(user_data, nil)
           if result[:result] == false && result[:type] == :captcha_error
-            @user.errors.add(:captcha, t('camaleon_cms.admin.users.message.error_captcha'))
+            @user.errors.add(:captcha, result[:message])
             render 'register'
+          elsif result[:result] == false && result[:type] == :stopped
+            # A vetoing user_before_register handler may take over the response itself (render/redirect,
+            # the user_before_login convention) or add its own errors to r[:user]; rendering again would
+            # raise DoubleRenderError, so re-render only when it did not — and show a generic reason so the
+            # visitor is not left with a silently re-rendered form.
+            unless performed?
+              if @user.errors.empty?
+                @user.errors.add(:base, t('camaleon_cms.admin.users.message.registration_stopped',
+                                          default: 'Registration could not be completed.'))
+              end
+              render 'register'
+            end
           elsif result[:result]
+            @user = result[:user] if result[:user].present?
             flash[:notice] = result[:message]
             send_user_confirm_email(@user) if current_site.need_validate_email?
             r = { user: @user, redirect_url: result[:redirect_url] }
             hooks_run('user_registered', r)
-            redirect_to r[:redirect_url]
+            # Host-check the post-registration destination for the same reason login_user host-checks its
+            # explicit redirect_url: the user_registered hook is caller-controlled (downstream plugins), so
+            # an off-site value falls back to the safe default unless the hook vouches for it via
+            # r[:allow_external_redirect] (or its host is allowlisted).
+            cama_safe_redirect(r[:redirect_url], cama_admin_login_path,
+                               allow_external: r[:allow_external_redirect].present?)
           else
             render 'register'
           end
@@ -143,6 +258,9 @@ module CamaleonCms
             flash[:notice] = t('camaleon_cms.admin.login.message.confirm_email_success')
             @user.is_valid_email = true
             @user.save!
+            # Security (audit M16): single-use, like the password-reset token -- clear it so the same
+            # confirmation link cannot be replayed.
+            @user.update_columns(confirm_email_token: nil, confirm_email_sent_at: nil) # rubocop:disable Rails/SkipsModelValidations
           end
         end
         redirect_to cama_admin_login_path
@@ -150,13 +268,83 @@ module CamaleonCms
 
       private
 
+      # Data for the GET logout confirmation page (see #logout). Carries the caller's own logout
+      # parameters into the POST button, but only scalar values -- a hash-shaped ?full[x]= or
+      # ?return_to[x]= would otherwise crash URL generation with UnfilteredParameters (500). The
+      # Cancel destination is the vetted return_to when present (frontend themes link logout with a
+      # return-to-site URL) so cancelling goes back to the site, not into the admin panel.
+      def prepare_logout_confirmation
+        @logout_full = params[:full].presence if params[:full].is_a?(String)
+        @logout_return_to = params[:return_to] if params[:return_to].is_a?(String)
+        @logout_locale = params[:locale] if params[:locale].is_a?(String)
+        @logout_cancel_url = safe_redirect_url(@logout_return_to).presence || cama_admin_dashboard_path
+      end
+
+      # Hard brute-force lockout (audit finding H1): once the per-IP failed-login counter reaches the
+      # limit, refuse every attempt from that IP (renders the given template with 429) for the cooldown
+      # window, regardless of credentials or captcha. Re-counting the blocked attempt keeps the window
+      # fresh so a persistent attacker stays locked. Returns true when it halted the action.
+      def cama_halt_when_login_locked_out(template)
+        return false unless cama_captcha_attack_ip_count('login') >= cama_login_lockout_limit
+
+        cama_captcha_increment_attack('login')
+        msg = t('camaleon_cms.admin.login.message.too_many_attempts',
+                default: 'Too many failed attempts. Please try again later.')
+        if params[:format] == 'json'
+          render json: { error: msg }, status: :too_many_requests
+        else
+          flash.now[:error] = msg
+          @user ||= current_site.users.new
+          render template, status: :too_many_requests
+        end
+        true
+      end
+
+      # Failures past this per-IP threshold trigger the hard lockout; defaults to 4x the captcha
+      # (soft) threshold and is configurable per site.
+      def cama_login_lockout_limit
+        soft = current_site.get_option('max_try_attack', 5).to_i
+        current_site.get_option('login_lockout_attempts', soft * 4).to_i
+      end
+
+      # Verify the password while spending one bcrypt comparison whether or not the username exists, so
+      # an unknown username takes about as long as a wrong password (audit M14). The dummy comparison on
+      # the missing-user branch does the same work the real path does (BCrypt::Password#is_password?).
+      def cama_password_matches?(user, password)
+        return user.authenticate(password) if user
+
+        BCrypt::Password.new(TIMING_EQUALIZER_DIGEST).is_password?(password.to_s)
+        false
+      end
+
+      # Whether a fresh reset email may be sent to this account, throttled per account so the endpoint
+      # cannot flood a known inbox (M13). Reads the column directly (not shadowed, unlike the token).
+      def cama_password_reset_email_allowed?(user)
+        sent_at = user.password_reset_sent_at
+        sent_at.blank? || sent_at < PASSWORD_RESET_EMAIL_COOLDOWN.ago
+      end
+
       def before_hook_session
-        session[:cama_current_language] = params[:cama_set_language].to_sym if params[:cama_set_language].present?
-        session[:cama_current_language] = nil if current_site.get_languages.exclude?(session[:cama_current_language])
-        I18n.locale = params[:locale] || session[:cama_current_language] || current_site.get_languages.first
+        # NOTE: session[:cama_current_language] is for FRONTEND only (user's site language choice)
+        # Admin should use admin language setting, not frontend language
+        # This prevents language mixing when switching between frontend and admin contexts
+        set_login_locale
         hooks_run('session_before_load')
       end
 
+      # These pages render before authentication, so the site's languages — not a user
+      # preference — pick the locale; ?locale= applies only when scalar (?locale[]=
+      # would crash to_sym) and offered by the site
+      def set_login_locale
+        site_languages = current_site.get_languages
+        requested = (params[:locale].presence&.to_sym if params[:locale].is_a?(String))
+        I18n.locale = if site_languages.include?(requested)
+                        requested
+                      else
+                        site_languages.first || I18n.default_locale
+                      end
+      end
+
       def after_hook_session
         hooks_run('session_after_load')
       end
@@ -171,7 +359,12 @@ module CamaleonCms
       end
 
       def user_permit_data
-        params.require(:user).permit!
+        user_params = params.require(:user)
+        # A scalar `user` param (`?user=foo`) has no .permit: treat it as an empty submission.
+        return {} unless user_params.respond_to?(:permit)
+
+        user_params.permit(:first_name, :last_name, :email, :username, :password, :password_confirmation,
+                           :is_valid_email)
       end
     end
   end