camaleon_cms 2.9.1 → 2.9.3

data/app/controllers/camaleon_cms/admin/settings/custom_fields_controller.rb

@@ -3,6 +3,8 @@ module CamaleonCms
     module Settings
       class CustomFieldsController < CamaleonCms::Admin::SettingsController
         add_breadcrumb I18n.t('camaleon_cms.admin.sidebar.custom_fields'), :cama_admin_settings_custom_fields_path
+
+        before_action :validate_role, only: %i[create update destroy]
         before_action :set_custom_field_group, only: %i[show edit update destroy]
         before_action :set_post_data, only: %i[create update]
 
@@ -59,22 +61,38 @@ module CamaleonCms
         # reorder custom fields group
         def reorder
           params[:values].to_a.each_with_index do |value, index|
-            current_site.custom_field_groups.find(value).update_column('field_order', index)
+            current_site.custom_field_groups.find(value)
+                        .update_column(:field_order, index) # rubocop:disable Rails/SkipsModelValidations
           end
           json = { size: params[:values].size }
           render json: json
         end
 
         def list
-          p = params.permit(:post_type, :post_id, categories: [])
-          args = {}
-          if p[:post_id].present?
-            post = @current_site.the_post(p[:post_id].to_i)
-            post.update_categories(p[:categories])
+          p = params.permit(:post_type, :post_id)
+          cat_ids = current_site.full_categories.where(id: params[:categories]).pluck(:id)
+          if p[:post_id].present? && (post = current_site.the_post(p[:post_id].to_i)).present?
+            # The action carries no before_action, so authorize against the resolved post: a caller who
+            # cannot update it may neither read its custom-field values (GET) nor rewrite its categories
+            # (POST). This scopes an otherwise any-signed-in-user endpoint to the post's own editors.
+            authorize! :update, post
+            # The category write is state-changing, so it runs only on a POST — the sole verb on this
+            # route that protect_from_forgery verifies, because Rails exempts HEAD from CSRF checks
+            # just like GET (an `unless request.get?` guard would let a CSRF-exempt HEAD through). A GET
+            # or HEAD renders the current fields without mutating the post. Otherwise a bare
+            # GET .../custom_fields/list?post_id=N (CSRF through a top-level navigation, which carries
+            # the SameSite=Lax auth cookie) wipes the post's categories, because an omitted `categories`
+            # param resolves to [] and update_categories then deletes them all (audit finding M6).
+            post.update_categories(cat_ids) if request.post?
+            args = {}
           else
+            # The render-only branch builds a new post of the requested type; gate it on the ability to
+            # create posts of that type so the field-group structure is not disclosed to other roles.
+            post_type = current_site.the_post_type(p[:post_type].to_i)
+            authorize! :create_post, post_type if post_type
             post = CamaleonCms::Post.new
-            post.taxonomy_id = p[:post_type].to_i
-            args[:cat_ids] = p[:categories]
+            post.taxonomy_id = post_type&.id
+            args = { cat_ids: cat_ids }
           end
           render partial: 'camaleon_cms/admin/settings/custom_fields/render',
                  locals: { record: post, field_groups: post.get_field_groups(args),
@@ -84,9 +102,58 @@ module CamaleonCms
         private
 
         def set_post_data
-          @post_data = params.require(:custom_field_group).permit!
-          @post_data[:object_class], @post_data[:objectid] = @post_data.delete(:assign_group).split(',')
+          @post_data = params.require(:custom_field_group).permit(:name, :description, :assign_group, :caption)
+          @post_data[:object_class], @post_data[:objectid] = @post_data.delete(:assign_group).to_s.split(',')
+          # A Site placement has exactly one legal target, and the form only ever offers
+          # "Site,<current_site.id>". Pinning it keeps a crafted objectid from producing a group that
+          # Site#get_field_groups can never return, which would leave it stranded and unreachable.
+          @post_data[:objectid] = current_site.id if @post_data[:object_class] == 'Site'
           @caption = @post_data.delete(:caption)
+          reject_foreign_placement unless placement_owned_by_current_site?
+        end
+
+        # A group's placement (object_class + objectid) decides which record's admin page renders it,
+        # and those reads are not scoped by the owning site. Without this check a user who can manage
+        # custom fields on one site could stamp a group with another site's theme, menu or post type
+        # id and have it render there -- invisible in that site's own field group list, which is
+        # scoped by parent_id, so its administrators could neither find nor delete it.
+        def placement_owned_by_current_site?
+          object_class = @post_data[:object_class].to_s
+          objectid = @post_data[:objectid].to_s
+          return false if object_class.blank? || objectid !~ /\A\d+\z/
+
+          owned_placement_ids(object_class).include?(objectid.to_i)
+        end
+
+        # Every "other" option the form emits is "<Class>,<current_site.id>" -- Site, the configured
+        # user model, and any model contributed through the custom_field_custom_models hook. Keying
+        # the default arm on the id rather than on an allow-list of class names admits those hook
+        # models without this controller having to know their names.
+        def owned_placement_ids(object_class)
+          case object_class
+          when 'PostType', 'PostType_Post', 'PostType_Category', 'PostType_PostTag'
+            current_site.post_types.pluck(:id)
+          when 'Theme' then current_site.themes.pluck(:id)
+          when 'NavMenu' then current_site.nav_menus.pluck(:id)
+          when 'Plugin' then current_site.plugins.pluck(:id)
+          when 'Post' then current_site.posts.pluck(:id)
+          when 'Category', 'Category_Post' then current_site.full_categories.pluck(:id)
+          else [current_site.id]
+          end
+        end
+
+        def reject_foreign_placement
+          @field_group ||= current_site.custom_field_groups.new(@post_data.except(:object_class, :objectid))
+          @field_group.errors.add(
+            :base,
+            t('camaleon_cms.admin.custom_field.message.invalid_placement',
+              default: 'Select where to display this group. The selected target does not belong to this site.')
+          )
+          render 'form'
+        end
+
+        def validate_role
+          authorize! :manage, :custom_fields
         end
 
         def set_custom_field_group
@@ -96,21 +163,39 @@ module CamaleonCms
           redirect_to cama_admin_path
         end
 
+        def permitted_fields
+          return {} if params[:fields].blank?
+
+          params.require(:fields).permit(params[:fields].keys.index_with do
+            %i[id name slug description field_order]
+          end).to_h
+        end
+
+        def permitted_field_options
+          return {} if params[:field_options].blank?
+
+          params.require(:field_options).permit(params[:field_options].keys.index_with do
+            [:field_key, :multiple, :required, :translate, :default_value, :dimension, :width, :height, :class,
+             :placeholder, { default_values: [], multiple_options: %i[title value default] }]
+          end).to_h
+        end
+
         # return boolean: true if all fields were saved successfully
         def _save_fields(group)
-          errors_saved, _all_fields = group.add_fields(params[:fields] ? params.require(:fields).permit! : {},
-                                                       params[:field_options] ? params.require(:field_options).permit! : {})
+          errors_saved, _all_fields = group.add_fields(permitted_fields, permitted_field_options)
           group.set_option('caption', @caption)
           if errors_saved.present?
-            flash[:error] = "<b>#{t('camaleon_cms.errors_found_msg', default: 'Several errors were found, please check.')}</b><br>#{errors_saved.map do |field|
-                                                                                                                                      "#{field.name}: " + field.errors.messages.map do |k, v|
-                                                                                                                                                            "#{k.to_s.titleize}: #{v.join('|')}"
-                                                                                                                                                          end.join(', ').to_s
-                                                                                                                                    end.join('<br>')}"
+            errors_found_msg = t('camaleon_cms.errors_found_msg', default: 'Several errors were found, please check.')
+            errors_saved_all_text = errors_saved.map do |field|
+              "#{field.name}: " + field.errors.messages.map do |k, v|
+                "#{k.to_s.titleize}: #{v.join('|')}"
+              end.join(', ').to_s
+            end.join('<br>')
+            flash[:error] = "<b>#{errors_found_msg}</b><br>#{errors_saved_all_text}"
+            false
           else
             flash[:notice] = t('camaleon_cms.admin.custom_field.message.custom_updated')
           end
-          true
         end
       end
     end

data/app/controllers/camaleon_cms/admin/settings/post_types_controller.rb

@@ -4,6 +4,7 @@ module CamaleonCms
       class PostTypesController < CamaleonCms::Admin::SettingsController
         before_action :set_post_type, only: %i[show edit update destroy]
         before_action :set_data_term, only: %i[create update]
+
         add_breadcrumb I18n.t('camaleon_cms.admin.sidebar.content_groups'), :cama_admin_settings_post_types_path
 
         def index
@@ -20,7 +21,7 @@ module CamaleonCms
 
         def update
           if @post_type.update(@data_term)
-            @post_type.set_field_values(params.require(:field_options).permit!) if params[:field_options].present?
+            @post_type.set_field_values(cama_permitted_field_options('PostType')) if params[:field_options].present?
             hooks_run('updated_post_type', { post_type: @post_type })
             flash[:notice] = t('camaleon_cms.admin.post_type.message.updated')
             redirect_to action: :index
@@ -32,7 +33,7 @@ module CamaleonCms
         def create
           @post_type = current_site.post_types.new(@data_term)
           if @post_type.save
-            @post_type.set_field_values(params.require(:field_options).permit!) if params[:field_options].present?
+            @post_type.set_field_values(cama_permitted_field_options('PostType')) if params[:field_options].present?
             hooks_run('created_post_type', { post_type: @post_type })
             flash[:notice] = t('camaleon_cms.admin.post_type.message.created')
             redirect_to action: :index
@@ -49,13 +50,24 @@ module CamaleonCms
         private
 
         def set_data_term
-          data_term = params.require(:post_type).permit!
-          data_term[:data_options] = params.require(:meta).permit!
+          # parent_id is the post type's site_id (alias_attribute). It is set from the site association
+          # on create and must never be reassigned, so it is not accepted from the request; otherwise a
+          # settings manager could re-home the post type onto another site (audit finding H8).
+          data_term = params.require(:post_type).permit(:name, :slug, :description)
+          data_term[:data_options] = params[:meta].present? ? post_type_meta_params : {}
           @data_term = data_term
         end
 
+        def post_type_meta_params
+          params.require(:meta).permit(:icon, :has_layout, :default_layout, :has_template, :default_template,
+                                       :has_category, :has_single_category, :has_tags, :has_content, :has_summary,
+                                       :has_comments, :has_featured, :has_seo, :has_parent_structure, :has_picture,
+                                       :posts_image_dimension, :posts_thumb_versions, :posts_thumb_size,
+                                       :is_required_picture, :contents_route_format, :default_thumb)
+        end
+
         def set_post_type
-          @post_type = current_site.post_types.find_by_id(params[:id])
+          @post_type = current_site.post_types.find_by(id: params[:id])
         rescue StandardError
           flash[:error] = t('camaleon_cms.admin.post_type.message.error')
           redirect_to cama_admin_path

data/app/controllers/camaleon_cms/admin/settings/sites_controller.rb

@@ -23,11 +23,11 @@ module CamaleonCms
 
         def update
           tmp = @site.slug
-          if @site.update(params.require(:site).permit!)
+          if @site.update(site_params)
             save_metas(@site)
             flash[:notice] = t('camaleon_cms.admin.sites.message.updated')
             if @site.id == Cama::Site.main_site.id && tmp != @site.slug
-              redirect_to @site.the_admin_url
+              redirect_to(cama_admin_path)
             else
               redirect_to action: :index
             end
@@ -43,12 +43,11 @@ module CamaleonCms
         end
 
         def create
-          site_data = params.require(:site).permit!
-          @site = CamaleonCms::Site.new(site_data)
+          @site = CamaleonCms::Site.new(site_params)
           if @site.save
             save_metas(@site)
             site_after_install(@site, @site.get_theme_slug)
-            flash[:notice] = t('camaleon_cms.admin.sites.message.created')
+            flash[:notice] = site_created_notice(@site)
             redirect_to action: :index
           else
             new
@@ -63,7 +62,7 @@ module CamaleonCms
         private
 
         def save_metas(site)
-          return unless params[:metas].present?
+          return if params[:metas].blank?
 
           params[:metas].each do |meta, val|
             site.set_meta(meta, val)
@@ -71,7 +70,7 @@ module CamaleonCms
         end
 
         def set_site
-          @site = CamaleonCms::Site.find_by_id(params[:id]).decorate
+          @site = CamaleonCms::Site.find_by(id: params[:id]).decorate
         rescue StandardError
           flash[:error] = t('camaleon_cms.admin.sites.message.error')
           redirect_to cama_admin_path
@@ -84,6 +83,33 @@ module CamaleonCms
           flash[:error] = t('camaleon_cms.admin.sites.message.unauthorized')
           redirect_to cama_admin_path
         end
+
+        def site_params
+          params.require(:site).permit(:name, :slug, :description)
+        end
+
+        # When creating an additional site provisions a fresh administrator (only when users are not
+        # shared across sites), surface its generated password once to the authenticated creator, with
+        # a copy control. Otherwise a plain confirmation. See harden-installer-default-admin.
+        def site_created_notice(site)
+          password = site.generated_admin_password
+          return t('camaleon_cms.admin.sites.message.created') if password.blank?
+
+          # rubocop:disable Style/FormatStringToken -- Rails i18n interpolation requires %{...} syntax
+          message = t(
+            'camaleon_cms.admin.sites.message.created_with_admin',
+            password: password,
+            default: 'Site created. New administrator password: %{password}. Change it after signing in.'
+          )
+          # rubocop:enable Style/FormatStringToken
+          copy = helpers.tag.button(
+            t('camaleon_cms.admin.installer.copy', default: 'Copy'),
+            type: 'button',
+            class: 'btn btn-xs btn-default',
+            onclick: "navigator.clipboard&&navigator.clipboard.writeText('#{password}')"
+          )
+          helpers.safe_join([message, ' ', copy])
+        end
       end
     end
   end

data/app/controllers/camaleon_cms/admin/settings_controller.rb

@@ -1,8 +1,11 @@
 module CamaleonCms
   module Admin
     class SettingsController < CamaleonCms::AdminController
+      include CamaleonCms::Admin::CustomFieldsConcern
+
       before_action :validate_role, except: %i[theme save_theme]
       before_action :validate_role_theme, only: %i[theme save_theme]
+
       add_breadcrumb I18n.t('camaleon_cms.admin.sidebar.settings')
 
       def index
@@ -19,10 +22,10 @@ module CamaleonCms
       def site_saved
         @site = current_site
         cache_slug = @site.slug
-        if @site.update(params.require(:site).permit!)
+        if @site.update(params.require(:site).permit(:name, :slug, :description))
           @site.set_options(params[:options]) if params[:options].present?
           @site.set_metas(params[:metas]) if params[:metas].present?
-          @site.set_field_values(params[:field_options])
+          @site.set_field_values(cama_permitted_field_options('Site'))
           flash[:notice] = t('camaleon_cms.admin.settings.message.site_updated')
           args = { action: :site }
           args[:host], args[:port] = @site.get_domain.to_s.split(':') if cache_slug != @site.slug
@@ -59,11 +62,13 @@ module CamaleonCms
       end
 
       def save_theme
-        current_theme.set_field_values(params[:theme_fields]) if params[:theme_fields].present?
+        current_theme.set_field_values(cama_permitted_field_options('Theme', param_key: :theme_fields))
         current_theme.set_options(params[:theme_option]) if params[:theme_option].present?
         current_theme.set_metas(params[:theme_meta]) if params[:theme_meta].present?
-        current_theme.set_field_values(params[:field_options])
-        hook_run(current_theme.settings, 'on_theme_settings', current_theme) # permit to save extra/custom values by this hook
+        current_theme.set_field_values(cama_permitted_field_options('Theme'))
+
+        # permit saving extra/custom values by this hook
+        hook_run(current_theme.settings, 'on_theme_settings', current_theme)
         flash[:notice] = t('camaleon_cms.admin.message.updated_success', default: 'Theme updated successfully')
         redirect_to action: :theme
       end
@@ -74,7 +79,7 @@ module CamaleonCms
         CamaleonCms::HtmlMailer.sender(params[:email], 'Test', data).deliver_now
         head :ok
       rescue StandardError => e
-        render inline: e.message, status: 502
+        render plain: e.message, status: :bad_gateway
       end
 
       private

data/app/controllers/camaleon_cms/admin/user_roles_controller.rb

@@ -20,13 +20,15 @@ module CamaleonCms
       end
 
       def create
-        user_role_data = params.require(:user_role).permit!
+        user_role_data = params.require(:user_role).permit(:name, :slug, :description)
         @user_role = current_site.user_roles.new(user_role_data)
         if @user_role.save
-          @user_role.set_meta("_post_type_#{current_site.id}",
-                              defined?(params[:rol_values][:post_type]) ? params[:rol_values][:post_type] : {})
-          @user_role.set_meta("_manager_#{current_site.id}",
-                              defined?(params[:rol_values][:post_type]) ? params[:rol_values][:manager] : {})
+          if @user_role.permissions_editable?
+            @user_role.set_meta("_post_type_#{current_site.id}",
+                                defined?(params[:rol_values][:post_type]) ? params[:rol_values][:post_type] : {})
+            @user_role.set_meta("_manager_#{current_site.id}",
+                                defined?(params[:rol_values][:post_type]) ? params[:rol_values][:manager] : {})
+          end
           flash[:notice] = t('camaleon_cms.admin.users.message.rol_created')
           redirect_to action: :edit, id: @user_role.id
         else
@@ -40,8 +42,8 @@ module CamaleonCms
       end
 
       def update
-        if @user_role.update(params.require(:user_role).permit!)
-          if @user_role.editable?
+        if @user_role.update(params.require(:user_role).permit(:name, :slug, :description))
+          if @user_role.permissions_editable?
             @user_role.set_meta("_post_type_#{current_site.id}",
                                 defined?(params[:rol_values][:post_type]) ? params[:rol_values][:post_type] : {})
             @user_role.set_meta("_manager_#{current_site.id}",

data/app/controllers/camaleon_cms/admin/users_controller.rb

@@ -1,8 +1,17 @@
 module CamaleonCms
   module Admin
     class UsersController < CamaleonCms::AdminController
+      include CamaleonCms::Admin::CustomFieldsConcern
+
+      # Member actions resolve a single target user, so a caller acting on their own record is
+      # legitimately exempt from :manage, :users. The collection actions (index/new/create) resolve
+      # no such target, so a self-referential ?user_id= must not exempt them from the capability check.
+      SELF_TARGET_ACTIONS = %w[show edit update destroy impersonate updated_ajax].freeze
+
       before_action :validate_role, except: %i[profile profile_edit]
+
       add_breadcrumb I18n.t('camaleon_cms.admin.sidebar.users'), :cama_admin_users_url
+
       before_action :set_user, only: %i[show edit update destroy impersonate]
 
       def index
@@ -12,7 +21,16 @@ module CamaleonCms
 
       def profile
         add_breadcrumb I18n.t('camaleon_cms.admin.users.profile')
-        @user = params[:user_id].present? ? current_site.the_user(params[:user_id].to_i).object : cama_current_user.object
+        user_id = params[:user_id]
+        # Authorize from the parameter before loading, so a denied caller cannot tell
+        # whether the requested user exists from the shape of the response.
+        authorize! :manage, :users if user_id.present? && user_id.to_i != cama_current_user.id
+        @user = user_id.present? ? current_site.the_user(user_id.to_i)&.object : cama_current_user.object
+        if @user.blank?
+          flash[:error] = t('camaleon_cms.admin.users.message.error')
+          return redirect_to(cama_admin_path)
+        end
+
         edit
       end
 
@@ -31,8 +49,8 @@ module CamaleonCms
         r = { user: @user }
         hooks_run('user_update', r)
         if @user.update(user_params)
-          @user.set_metas(params[:meta]) if params[:meta].present?
-          @user.set_field_values(params[:field_options])
+          @user.set_metas(user_meta_params) if params[:meta].present?
+          @user.set_field_values(cama_permitted_field_options(user_field_scope)) if params[:field_options].present?
           r = { user: @user, message: t('camaleon_cms.admin.users.message.updated'), params: params }
           hooks_run('user_after_edited', r)
           flash[:notice] = r[:message]
@@ -50,17 +68,33 @@ module CamaleonCms
 
       # update some ajax requests from profile or user form
       def updated_ajax
-        @user = current_site.users.find(params[:user_id])
+        @user = current_site.users.find(user_id_param)
+        # Only an admin may reset an admin's password; a `:manage, :users` holder who could would sign in
+        # as that admin (H10). Self-service and non-admin targets are unaffected.
+        unless cama_current_user.may_edit_credentials?(@user)
+          return render plain: t('camaleon_cms.admin.users.message.error'), status: :forbidden
+        end
+
         update_session = current_user_is?(@user)
         attrs = params.require(:password).permit(%i[password password_confirmation])
         @user.update(password: attrs.require(:password), password_confirmation: attrs.require(:password_confirmation))
 
-        return render inline: @user.errors.full_messages.join(', '), status: :unprocessable_entity if @user.errors.any?
+        return render plain: @user.errors.full_messages.join(', '), status: :unprocessable_entity if @user.errors.any?
+
+        # A newly provisioned admin (see harden-installer-default-admin) owes a password change; clearing
+        # the marker on a real change lets them past the enforce_password_change gate.
+        @user.delete_meta('must_change_password') if @user.saved_change_to_password_digest?
 
         # keep user logged in when changing their own password
         update_auth_token_in_cookie @user.auth_token if update_session && @user.saved_change_to_password_digest?
+      rescue ActiveRecord::RecordNotFound
+        # The other failure paths of this action answer with a status and a short text body, so an
+        # unresolvable target does too rather than falling through to the framework's HTML error
+        # page. Catch this class only, never StandardError, so a genuine lookup failure still
+        # surfaces instead of being reported as a missing user.
+        render plain: t('camaleon_cms.admin.users.message.error'), status: :not_found
       rescue ActionController::ParameterMissing => e
-        render inline: "ERROR: #{e.class.name}, #{e.message}", status: :bad_request
+        render plain: "ERROR: #{e.class.name}, #{e.message}", status: :bad_request
       end
 
       def update_auth_token_in_cookie(token)
@@ -68,7 +102,10 @@ module CamaleonCms
 
         current_token = cookie_split_auth_token
         updated_token = [token, *current_token[1..]]
-        cookies[:auth_token] = updated_token.join('&')
+        # Route through the shared hardened-cookie options (audit M3/M4): a bare assignment here
+        # re-issued the auth cookie without HttpOnly/Secure/domain/expiry when a user changed their
+        # own password, undoing the M3 hardening for that session.
+        cookies[:auth_token] = cama_auth_cookie_options(updated_token.join('&'))
       end
 
       def current_user_is?(user)
@@ -93,13 +130,12 @@ module CamaleonCms
       end
 
       def create
-        user_data = params.require(:user).permit!
-        @user = current_site.users.new(user_data)
+        @user = current_site.users.new(user_params)
         r = { user: @user }
         hooks_run('user_create', r)
         if @user.save
-          @user.set_metas(params[:meta]) if params[:meta].present?
-          @user.set_field_values(params[:field_options])
+          @user.set_metas(user_meta_params) if params[:meta].present?
+          @user.set_field_values(cama_permitted_field_options(user_field_scope)) if params[:field_options].present?
           r = { user: @user }
           hooks_run('user_created', r)
           flash[:notice] = t('camaleon_cms.admin.users.message.created')
@@ -130,20 +166,55 @@ module CamaleonCms
       private
 
       def validate_role
-        (user_id_param.present? && cama_current_user.id.to_s == user_id_param) || authorize!(:manage, :users)
+        return if self_target_own_record?
+
+        authorize! :manage, :users
       end
 
+      # The self-exemption applies only to member actions that resolve a single target user; a
+      # collection action (index/new/create) has no such target, so a self-referential ?user_id=
+      # never exempts it (audit finding H7).
+      def self_target_own_record?
+        return false unless SELF_TARGET_ACTIONS.include?(action_name)
+
+        user_id = user_id_param
+        user_id.present? && cama_current_user.id.to_s == user_id.to_s
+      end
+
+      # Only a scalar user_id participates in target resolution (?user_id[]= would
+      # crash the record lookup and flip authorization); otherwise the route id wins
       def user_id_param
-        params[:id] || params[:user_id]
+        user_id = params[:user_id]
+        return params[:id] unless user_id.is_a?(String)
+
+        user_id
       end
 
       def user_params
-        parameters = params.require(:user)
-        if cama_current_user.role_grantor?(@user)
-          parameters.permit(:username, :email, :role, :first_name, :last_name)
-        else
-          parameters.permit(:username, :email, :first_name, :last_name)
+        fields = %i[username email first_name last_name password password_confirmation]
+        # Only an admin may change an admin's password or recovery identifiers (email/username); drop them
+        # for anyone else editing an admin, the same fail-safe the role permit below uses (H10).
+        unless cama_current_user.may_edit_credentials?(@user)
+          fields -= %i[username email password password_confirmation]
         end
+        p = params.require(:user).permit(*fields)
+        # role is a scalar slug; coerce anything else (e.g. a nested user[role][x] param) to nil so it is
+        # never mass-assigned — assigning an unpermitted nested Parameters would raise and 500 the request.
+        requested_role = params[:user][:role]
+        requested_role = nil unless requested_role.is_a?(String)
+        p[:role] = requested_role if requested_role.present? && cama_current_user.role_grantor?(@user, requested_role)
+        p
+      end
+
+      def user_meta_params
+        params.require(:meta).permit(:avatar, :slogan)
+      end
+
+      # Allowed field slugs must be keyed on the demodulized placement name the settings form
+      # emits and get_user_field_groups queries; keyed on a hardcoded 'User' the lookup finds no
+      # groups for a host user model that demodulizes to another name, discarding every value.
+      def user_field_scope
+        PluginRoutes.get_user_class_name.demodulize
       end
 
       def set_user