camaleon_cms 2.9.1 → 2.9.3

data/app/controllers/camaleon_cms/admin_controller.rb

@@ -4,10 +4,25 @@ module CamaleonCms
       flash[:error] = "Error: #{exception.message}"
       redirect_to cama_admin_dashboard_path
     end
-    include CamaleonCms::Admin::ApplicationHelper
+    # Security (scan-and-reject policy, audit M17): custom-field values save after their parent
+    # through `custom_field_values.create!`, so a value the gate refuses arrives here as
+    # RecordInvalid. Surface the refusal as a flash error naming the field instead of a 500; the
+    # parent's own attributes were already saved, only the refused value rows are rolled back.
+    rescue_from ActiveRecord::RecordInvalid do |exception|
+      raise exception unless exception.record.is_a?(CamaleonCms::CustomFieldsRelationship)
+
+      flash[:error] = exception.record.errors.full_messages.to_sentence
+      redirect_back fallback_location: cama_admin_dashboard_path
+    end
     # layout 'camaleon_cms/admin'
+    # Admin responses are user-specific and must never be served from a browser or shared cache;
+    # without this a stale render (e.g. an editor that failed to initialize on a cold boot) can
+    # reappear after a restart until a manual reload. Set first so it applies to auth redirects too.
+    before_action :cama_prevent_response_caching
     before_action :cama_authenticate
+    before_action :keep_request_attrs
     before_action :admin_init_actions
+    before_action :enforce_password_change
     before_action :admin_logged_actions
     before_action :admin_before_hooks
     after_action :admin_after_hooks
@@ -15,6 +30,7 @@ module CamaleonCms
              params[:cama_ajax_request].present? ? 'camaleon_cms/admin/_ajax' : 'camaleon_cms/admin'
            }
     add_breadcrumb I18n.t('camaleon_cms.admin.sidebar.dashboard', default: 'Dashboard'), :cama_admin_path
+    helper_method :cama_get_i18n_frontend
 
     # render admin dashboard
     def index
@@ -41,55 +57,157 @@ module CamaleonCms
     # render search results
     # receive params[:q]
     # receive params[:kind]: define de type of the results type (content|category|tag) => default content
-    # if this is receive a param[:ajax], then will render only results view
+    # if this is receiving a param[:ajax], then will render only results view
     def search
       add_breadcrumb I18n.t('camaleon_cms.admin.button.search')
-      params[:kind] = 'content' unless params[:kind].present?
-      params[:q] = (params[:q] || '').downcase
-      @items = case params[:kind]
-               when 'post_type'
-                 current_site.post_types.where(
-                   "LOWER(#{Cama::PostType.table_name}.name) LIKE ? OR LOWER(#{Cama::PostType.table_name}.slug) LIKE ? OR LOWER(#{Cama::PostType.table_name}.description) LIKE ?", "%#{params[:q]}%", "%#{params[:q]}%", "%#{params[:q]}%"
-                 )
-               when 'category'
-                 current_site.full_categories.where(
-                   "LOWER(#{Cama::Category.table_name}.name) LIKE ? OR LOWER(#{Cama::Category.table_name}.slug) LIKE ? OR LOWER(#{Cama::Category.table_name}.description) LIKE ?", "%#{params[:q]}%", "%#{params[:q]}%", "%#{params[:q]}%"
-                 )
-               when 'tag'
-                 current_site.post_tags.where(
-                   "LOWER(#{Cama::PostTag.table_name}.name) LIKE ? OR LOWER(#{Cama::PostTag.table_name}.slug) LIKE ? OR LOWER(#{Cama::PostTag.table_name}.description) LIKE ?", "%#{params[:q]}%", "%#{params[:q]}%", "%#{params[:q]}%"
-                 )
-               else
-                 current_site.posts.where(
-                   "LOWER(#{Cama::Post.table_name}.title) LIKE ? OR LOWER(#{Cama::Post.table_name}.slug) LIKE ? OR LOWER(#{Cama::Post.table_name}.content_filtered) LIKE ?", "%#{params[:q]}%", "%#{params[:q]}%", "%#{params[:q]}%"
-                 )
-               end
+      params[:kind] = 'content' if params[:kind].blank?
+      # A crafted ?q[]=x / ?q[a]=b arrives as an Array / Parameters, which has no #downcase; treat any
+      # non-String q as an empty query instead of 500ing.
+      params[:q] = params[:q].is_a?(String) ? params[:q].downcase : ''
+      # Security (audit 2026-08-11 M12): the action had no authorization and no status filter, so any
+      # admin-area user (e.g. a client with no content rights) could enumerate every post title/slug in
+      # every status -- draft, pending, private, trash -- plus post types, categories and tags they
+      # cannot access. Scope every kind to the post types the caller may manage: content and post types
+      # by :posts, categories and tags by their own :categories / :post_tags abilities (the roles UI
+      # grants manage_categories / manage_tags independently of any post edit right).
+      table_name = case params[:kind]
+                   when 'post_type'
+                     base_query = current_site.post_types.where(id: cama_admin_searchable_post_type_ids)
+                     Cama::PostType.table_name
+                   when 'category'
+                     pt_ids = cama_admin_searchable_post_type_ids(:categories)
+                     # A category's post type lives in post_type_id (the status column) at every nesting
+                     # level; parent_id points at the parent *category* for children, so filtering by it
+                     # would drop every nested category.
+                     base_query = current_site.full_categories.where(post_type_id: pt_ids)
+                     Cama::Category.table_name
+                   when 'tag'
+                     pt_ids = cama_admin_searchable_post_type_ids(:post_tags)
+                     base_query = current_site.post_tags.where(parent_id: pt_ids)
+                     Cama::PostTag.table_name
+                   else
+                     base_query = cama_admin_searchable_posts
+                     Cama::Post.table_name
+                   end
+      @items = base_query.where(
+        items_sql_by_name(table_name), "%#{params[:q]}%", "%#{params[:q]}%", "%#{params[:q]}%"
+      )
+
       @items = @items.paginate(page: params[:page], per_page: current_site.admin_per_page)
     end
 
+    # Decorators use this helper while rendering admin pages to keep public URLs in
+    # the site's frontend language instead of the admin interface language.
+    def cama_get_i18n_frontend
+      @cama_i18n_frontend
+    end
+
     private
 
+    # Send `Cache-Control: no-store` on every admin response so no admin page is ever cached by the
+    # browser or an intermediary. Admin pages are per-user and dynamic; caching them risks a stale
+    # render being reused (the cold-boot blank-editor symptom is one such case).
+    def cama_prevent_response_caching
+      response.headers['Cache-Control'] = 'no-store'
+    end
+
+    # Actions reachable while an administrator still owes a password change: the profile screen, its
+    # submit, and the AJAX password-change endpoint. Everything else in the admin panel is redirected
+    # to the change-password screen until the marker is cleared. Sign-out lives on SessionsController
+    # (not an AdminController subclass), so it is out of this gate's reach and always reachable.
+    PASSWORD_CHANGE_EXEMPT = { 'camaleon_cms/admin/users' => %w[profile profile_edit update updated_ajax] }.freeze
+
+    # Force a newly provisioned administrator (minted with a generated password, see
+    # harden-installer-default-admin) to set their own password before using the admin panel.
+    def enforce_password_change
+      return if cama_current_user.blank?
+      return if cama_current_user.get_meta('must_change_password').blank?
+      return if PASSWORD_CHANGE_EXEMPT[controller_path]&.include?(action_name)
+
+      flash[:alert] = t('camaleon_cms.admin.users.message.must_change_password',
+                        default: 'Please choose a new password before continuing.')
+      redirect_to cama_admin_profile_edit_path
+    end
+
     # initialize all vars and methods for admin panel
     def admin_init_actions
       I18n.locale = current_site.get_admin_language
-      @_admin_menus = {}
+      # Alias the legacy @_admin_menus ivar onto the live menu store so a hook using the WordPress-style
+      # `@_admin_menus.delete('comments')` removal idiom mutates the same hash admin_menu_draw reads. The
+      # menu-insert methods mutate in place (.replace), so this reference stays valid. Regression M19.
+      @_admin_menus = CurrentRequest.admin_menu_items = {}
       @_admin_breadcrumb = []
       @_extra_models_for_fields = []
+      # Cache the site's frontend language for decorators and plugins that still
+      # need to distinguish admin requests from frontend visitor requests.
       @cama_i18n_frontend = current_site.get_languages.first
     end
 
     # trigger hooks for admin panel before admin load
     def admin_before_hooks
-      hooks_run('admin_before_load')
+      run_hook_lifecycle('admin_before_load')
+    end
+
+    # Set cama_current_user and current_site in CurrentRequest so models can access the current context.
+    # CurrentRequest is an ActiveSupport::CurrentAttributes subclass that auto-resets per request.
+    def keep_request_attrs
+      CurrentRequest.user = cama_current_user
+      CurrentRequest.site = current_site
     end
 
     # trigger hooks for admin panel after admin load
     def admin_after_hooks
-      hooks_run('admin_after_load')
+      run_hook_lifecycle('admin_after_load')
     end
 
     def admin_logged_actions
-      admin_menus_add_commons if !request.xhr? || !params[:cama_ajax_request].present? # initialize admin sidebar menus
+      admin_menus_add_commons if !request.xhr? || params[:cama_ajax_request].blank? # initialize admin sidebar menus
+    end
+
+    # Post types on which the caller holds `action`: :posts for content and the post-type kind,
+    # :categories / :post_tags for the taxonomy kinds. Admins hold every ability on every type, so
+    # skip the per-record sweep (and the redundant IN filter it would feed) for them.
+    def cama_admin_searchable_post_type_ids(action = :posts)
+      return current_site.post_types.ids if can?(:manage, :all)
+
+      cama_admin_searchable_post_types(action).map(&:id)
+    end
+
+    def cama_admin_searchable_post_types(action)
+      current_site.post_types.select { |pt| can?(action, pt) }
+    end
+
+    # Posts the caller may see in admin search: the accessible post types narrowed by the shared
+    # admin visibility rule. edit_other implies :posts, so the visibility sweep only rechecks the
+    # already-loaded listable subset; admins skip the scoping entirely.
+    def cama_admin_searchable_posts
+      return current_site.posts if can?(:manage, :all)
+
+      listable = cama_admin_searchable_post_types(:posts)
+      cama_admin_visible_posts(current_site.posts.where(post_type_id: listable.map(&:id)), listable)
+    end
+
+    # Restrict `scope` to the posts the caller may see in admin listings across `post_types`: every
+    # post on the types where they hold edit_other, only their own elsewhere. Admins see everything.
+    # Single source of the visibility rule for PostsController#index (per post type) and admin search
+    # (across types) -- these drifting apart is how the M12 disclosure shipped, so change it here, not
+    # at a call site.
+    def cama_admin_visible_posts(scope, post_types)
+      return scope if can?(:manage, :all)
+
+      edit_other_ids = post_types.select { |pt| can?(:edit_other, pt) }.map(&:id)
+      return scope if edit_other_ids.length == post_types.length
+
+      scope.where(post_type_id: edit_other_ids).or(scope.where(user_id: cama_current_user.id))
+    end
+
+    def items_sql_by_name(table_name)
+      lower_name = "LOWER(#{table_name}"
+      if table_name == Cama::Post.table_name
+        return "#{lower_name}.title) LIKE ? OR #{lower_name}.slug) LIKE ? OR #{lower_name}.content_filtered) LIKE ?"
+      end
+
+      "#{lower_name}.name) LIKE ? OR #{lower_name}.slug) LIKE ? OR #{lower_name}.description) LIKE ?"
     end
   end
 end

data/app/controllers/camaleon_cms/apps/plugins_admin_controller.rb

@@ -2,6 +2,7 @@ module CamaleonCms
   module Apps
     class PluginsAdminController < CamaleonCms::AdminController
       before_action :init_plugin
+      before_action :authorize_plugin
 
       private
 
@@ -21,6 +22,10 @@ module CamaleonCms
         lookup_context.prefixes.prepend(params[:controller].sub("plugins/#{plugin_name}",
                                                                 "plugins/#{plugin_name}/views"))
       end
+
+      def authorize_plugin
+        authorize! :manage, :plugins
+      end
     end
   end
 end

data/app/controllers/camaleon_cms/camaleon_controller.rb

@@ -5,21 +5,24 @@ module CamaleonCms
     add_flash_types :notice
     add_flash_types :info
 
+    # Controller-context helper surface (ct, cama_t, cama_cache_fetch, ...): plugin hook
+    # functions run on the controller and actions like FrontendController#search call these.
     include CamaleonCms::CamaleonHelper
-    include CamaleonCms::SessionHelper
-    include CamaleonCms::SiteHelper
-    include CamaleonCms::HtmlHelper
-    include CamaleonCms::UserRolesHelper
-    include CamaleonCms::ShortCodeHelper
-    include CamaleonCms::PluginsHelper
-    include CamaleonCms::ThemeHelper
-    include CamaleonCms::HooksHelper
-    include CamaleonCms::ContentHelper
-    include CamaleonCms::CaptchaHelper
-    include CamaleonCms::UploaderHelper
-    include CamaleonCms::EmailHelper
+    include CamaleonCms::SessionRuntimeConcern
+    include CamaleonCms::RequestContextConcern
+    include CamaleonCms::HookLifecycleConcern
+    include CamaleonCms::RuntimeShortcodeThemeConcern
+    include CamaleonCms::RuntimeHtmlContentConcern
+    include CamaleonCms::RuntimeAdminMenuConcern
+    include CamaleonCms::RuntimeCaptchaImageConcern
+    include CamaleonCms::RuntimeUploaderConcern
     include Mobu::DetectMobile
+    delegate :tag, :content_tag, :safe_join, :image_tag, :link_to, :sanitize, to: :helpers
 
+    # Preserve backwards-compatible plugin helper inclusion: any helper module a
+    # plugin declares in its config.json is mixed in here so plugins can call
+    # those methods from controllers (not only from views). Documented in
+    # `docs/ai/plans/helper-concern-architecture-refactor.md`.
     PluginRoutes.all_helpers.each { |h| include h.constantize }
 
     before_action :cama_site_check_existence, except: [:captcha]
@@ -35,13 +38,24 @@ module CamaleonCms
 
     # show page error
     def render_error(status = 404, exception = nil, message = '')
-      Rails.logger.debug "Camaleon CMS - 404 url: #{begin
-        request.original_url
-      rescue StandardError
-        nil
-      end} ==> message: #{exception.message if exception.present?} ==> #{params[:error_msg]} ==> #{caller.inspect}"
-      @message = "#{message} #{params[:error_msg] || (exception.present? ? "#{exception.message}<br><br>#{caller.inspect}" : '')}"
-      @message = '' if Rails.env == 'production'
+      error_msg = params[:error_msg]
+      Rails.logger.debug do
+        original_url = begin
+          request.original_url
+        rescue StandardError
+          nil
+        end
+        'Camaleon CMS - 404 url: ' \
+          "#{original_url} ==> message: #{exception&.message} ==> #{error_msg} ==> #{caller.inspect}"
+      end
+
+      @message = if Rails.env.production?
+                   ''
+                 else
+                   "#{message} " \
+                     "#{error_msg || (exception.present? ? "#{exception.message}<br><br>#{caller.inspect}" : '')}"
+                 end
+
       respond_to do |format|
         format.html { render "camaleon_cms/#{status}", status: status }
         format.any { head status }
@@ -69,18 +83,9 @@ module CamaleonCms
       # initializing before and after contents
       cama_content_init
 
-      @_hooks_skip = []
-      # trigger all hooks before_load_app
-      hooks_run('app_before_load')
-
-      request.env.except!('HTTP_X_FORWARDED_HOST') if request.env['HTTP_X_FORWARDED_HOST'] # just drop the variable
-
-      views_dir = 'app/apps/'
-      prepend_view_path(File.join($camaleon_engine_dir, views_dir).to_s)
-      prepend_view_path(Rails.root.join(views_dir).to_s)
-
-      CamaleonCms::PostDefault.current_user = cama_current_user
-      CamaleonCms::PostDefault.current_site = current_site
+      initialize_hook_skip_list
+      run_app_before_load_hooks
+      configure_runtime_request_context
     end
 
     # initialize ability for current user
@@ -89,67 +94,7 @@ module CamaleonCms
     end
 
     def cama_after_actions
-      # trigger all actions app after load
-      hooks_run('app_after_load')
-    end
-
-    # redirect to sessions login form when the session was expired.
-    def auth_session_error
-      redirect_to cama_root_path
-    end
-
-    # check if current site exist, if not, this will be redirected to main domain
-    # Also, check current site status
-    def cama_site_check_existence
-      if !current_site.present?
-        if Cama::Site.main_site.present?
-          url = Cama::Site.main_site.decorate.the_url
-          # TODO: Remove this condition when Rails 6.x won't be supported
-          if Rails.gem_version >= Gem::Version.new('7.0.0')
-            redirect_to url, allow_other_host: true
-          else
-            redirect_to url
-          end
-        else
-          redirect_to cama_admin_installers_path
-        end
-      elsif (cama_current_user.present? && !cama_current_user.admin?) || !cama_current_user.present?
-        # inactive page control
-        if current_site.is_inactive?
-          if request.original_url.to_s.match(%r{\A#{current_site.the_url}admin(/|\z)})
-            if cama_current_user.present?
-              cama_logout_user
-              flash[:error] = 'Site is Inactive'
-            end
-          else
-            p = current_site.posts.find_by_id(current_site.get_option('page_inactive')).try(:decorate)
-            if p
-              redirect_to(p.the_url) unless params == { 'controller' => 'camaleon_cms/frontend', 'action' => 'post',
-                                                        'slug' => p.the_slug }
-            else
-              render html: 'This site was inactivated. Please contact to administrator.'
-            end
-          end
-        end
-
-        # maintenance page and IP's control
-        if current_site.is_maintenance? && !current_site.get_option('maintenance_ips',
-                                                                    '').split(',').include?(request.remote_ip)
-          p = current_site.posts.find_by_id(current_site.get_option('page_maintenance')).try(:decorate)
-          if p
-            redirect_to(p.the_url) if params != { 'controller' => 'camaleon_cms/frontend', 'action' => 'post',
-                                                  'slug' => p.the_slug }
-          else
-            render html: 'This site is in maintenance mode. Please contact to administrator.'
-          end
-        end
-      end
-    end
-
-    unless ApplicationController.method_defined?(:current_user)
-      def current_user
-        cama_current_user
-      end
+      run_app_after_load_hooks
     end
   end
 end