camaleon_cms 2.9.1 → 2.9.3

data/app/controllers/camaleon_cms/frontend_controller.rb

@@ -1,22 +1,22 @@
 module CamaleonCms
   class FrontendController < CamaleonCms::CamaleonController
     before_action :init_frontent
+    include CamaleonCms::FrontendVisitedStateConcern
     include CamaleonCms::FrontendConcern
     include CamaleonCms::Frontend::ApplicationHelper
     layout proc { |controller|
-             args = {
-               layout: (params[:cama_ajax_request].present? ? 'cama_ajax' : PluginRoutes.static_system_info['default_layout']), controller: controller
-             }
-             hooks_run('front_default_layout', args)
-             args[:layout]
-           }
+      args = {
+        layout: (params[:cama_ajax_request].present? ? 'cama_ajax' : PluginRoutes.static_system_info['default_layout']),
+        controller: controller
+      }
+      hooks_run('front_default_layout', args)
+      args[:layout]
+    }
     before_action :before_hooks
     after_action :after_hooks
-    # rescue_from ActiveRecord::RecordNotFound, with: :page_not_found
-
     # home page for frontend
     def index
-      @cama_visited_home = true
+      mark_frontend_home_visited
       if @_site_options[:home_page].present?
         render_post(@_site_options[:home_page].to_i)
       else
@@ -29,28 +29,38 @@ module CamaleonCms
     # render category list
     def category
       begin
-        @category ||= current_site.the_full_categories.find_by_slug(params[:category_slug]).decorate if params[:category_slug].present?
+        if params[:category_slug].present?
+          @category ||= current_site.the_full_categories.find_by_slug(params[:category_slug]).decorate # rubocop:disable Rails/DynamicFindBy
+        end
         @category ||= current_site.the_full_categories.find(params[:category_id]).decorate
         @post_type = @category.the_post_type
       rescue StandardError
         return page_not_found
       end
-      @cama_visited_category = @category
+      mark_frontend_category_visited(@category)
       @children = @category.children.no_empty.decorate
       @posts = @category.the_posts.paginate(page: params[:page],
                                             per_page: current_site.front_per_page).eager_load(:metas)
-      r_file = lookup_context.template_exists?("category_#{@category.the_slug}") ? "category_#{@category.the_slug}" : nil # specific template category with specific slug within a posttype
-      unless r_file.present?
-        r_file = lookup_context.template_exists?("post_types/#{@post_type.the_slug}/category") ? "post_types/#{@post_type.the_slug}/category" : nil
+      category_slug = @category.the_slug
+
+      # specific template category with specific slug within a post-type
+      r_file = lookup_context.template_exists?("category_#{category_slug}") ? "category_#{category_slug}" : nil
+      post_type_slug = "post_types/#{@post_type.the_slug}"
+      if r_file.blank?
+        r_file = lookup_context.template_exists?("#{post_type_slug}/category") ? "#{post_type_slug}/category" : nil
       end
-      unless r_file.present?
-        r_file = lookup_context.template_exists?("categories/#{@category.the_slug}") ? "categories/#{@category.the_slug}" : 'category'
+      if r_file.blank?
+        r_file = if lookup_context.template_exists?("categories/#{category_slug}")
+                   "categories/#{category_slug}"
+                 else
+                   'category'
+                 end
       end
 
-      layout_ = if lookup_context.template_exists?("layouts/post_types/#{@post_type.the_slug}/category")
-                  "post_types/#{@post_type.the_slug}/category"
-                elsif lookup_context.template_exists?("layouts/categories/#{@category.the_slug}")
-                  "categories/#{@category.the_slug}"
+      layout_ = if lookup_context.template_exists?("layouts/#{post_type_slug}/category")
+                  "#{post_type_slug}/category"
+                elsif lookup_context.template_exists?("layouts/categories/#{category_slug}")
+                  "categories/#{category_slug}"
                 end
       r = { category: @category, layout: layout_, render: r_file }
       hooks_run('on_render_category', r)
@@ -60,18 +70,20 @@ module CamaleonCms
     # render contents from post type
     def post_type
       begin
-        @post_type = current_site.post_types.find_by_slug(params[:post_type_slug]).decorate
+        @post_type = current_site.post_types.find_by_slug(params[:post_type_slug]).decorate # rubocop:disable Rails/DynamicFindBy
       rescue StandardError
         return page_not_found
       end
       @object = @post_type
-      @cama_visited_post_type = @post_type
+      CurrentRequest.frontend_object = @object
+      mark_frontend_post_type_visited(@post_type)
       @posts = @post_type.the_posts.paginate(page: params[:page],
                                              per_page: current_site.front_per_page).eager_load(:metas)
       @categories = @post_type.categories.no_empty.eager_load(:metas).decorate
       @post_tags = @post_type.post_tags.eager_load(:metas)
-      r_file = lookup_context.template_exists?("post_types/#{@post_type.the_slug}") ? "post_types/#{@post_type.the_slug}" : 'post_type'
-      layout_ = lookup_context.template_exists?("layouts/post_types/#{@post_type.the_slug}") ? "post_types/#{@post_type.the_slug}" : nil
+      post_type_slug = "post_types/#{@post_type.the_slug}"
+      r_file = lookup_context.template_exists?(post_type_slug) ? post_type_slug : 'post_type'
+      layout_ = lookup_context.template_exists?("layouts/#{post_type_slug}") ? post_type_slug : nil
       r = { post_type: @post_type, layout: layout_, render: r_file }
       hooks_run('on_render_post_type', r)
       render r[:render], (!r[:layout].nil? ? { layout: r[:layout] } : {})
@@ -81,7 +93,7 @@ module CamaleonCms
     def post_tag
       begin
         @post_tag = if params[:post_tag_slug].present?
-                      current_site.post_tags.find_by_slug(params[:post_tag_slug]).decorate
+                      current_site.post_tags.find_by_slug(params[:post_tag_slug]).decorate # rubocop:disable Rails/DynamicFindBy
                     else
                       current_site.post_tags.find(params[:post_tag_id]).decorate
                     end
@@ -90,10 +102,12 @@ module CamaleonCms
         return page_not_found
       end
       @object = @post_tag
-      @cama_visited_tag = @post_tag
+      CurrentRequest.frontend_object = @object
+      mark_frontend_tag_visited(@post_tag)
       @posts = @post_tag.the_posts.paginate(page: params[:page],
                                             per_page: current_site.front_per_page).eager_load(:metas)
-      r_file = lookup_context.template_exists?("post_types/#{@post_type.the_slug}/post_tag") ? "post_types/#{@post_type.the_slug}/post_tag" : 'post_tag'
+      slug_post_tag = "post_types/#{@post_type.the_slug}/post_tag"
+      r_file = lookup_context.template_exists?(slug_post_tag) ? slug_post_tag : 'post_tag'
       layout_ = lookup_context.template_exists?('layouts/post_tag') ? 'post_tag' : nil
       r = { post_tag: @post_tag, layout: layout_, render: r_file }
       hooks_run('on_render_post_tag', r)
@@ -103,19 +117,17 @@ module CamaleonCms
     # search contents
     def search
       breadcrumb_add(ct('search'))
-      items = params[:post_type_slugs].present? ? current_site.the_posts(params[:post_type_slugs].split(',')) : current_site.the_posts
-      @cama_visited_search = true
+      post_type_slugs = params[:post_type_slugs]
+      items = post_type_slugs.present? ? current_site.the_posts(post_type_slugs.split(',')) : current_site.the_posts
+      mark_frontend_search_visited
       @param_search = params[:q]
       layout_ = lookup_context.template_exists?('layouts/search') ? 'search' : nil
       r = { layout: layout_, render: 'search', posts: nil }
       hooks_run('on_render_search', r)
-      params[:q] = (params[:q] || '').downcase
-      @posts = if !r[:posts].nil?
-                 r[:posts]
-               else
-                 items.where('LOWER(title) LIKE ? OR LOWER(content_filtered) LIKE ?',
-                             "%#{params[:q]}%", "%#{params[:q]}%")
-               end
+      q_params = params[:q].to_s.downcase
+      params[:q] = q_params
+      @posts = r[:posts] ||
+               items.where('LOWER(title) LIKE ? OR LOWER(content_filtered) LIKE ?', "%#{q_params}%", "%#{q_params}%")
       @posts_size = @posts.size
       @posts = @posts.paginate(page: params[:page], per_page: current_site.front_per_page)
       render r[:render], (!r[:layout].nil? ? { layout: r[:layout] } : {})
@@ -124,7 +136,7 @@ module CamaleonCms
     # ajax requests
     def ajax
       r = { render_file: nil, render_text: '', layout: nil }
-      @cama_visited_ajax = true
+      mark_frontend_ajax_visited
       hooks_run('on_ajax', r)
       if r[:render_file]
         render r[:render_file], (!r[:layout].nil? ? { layout: r[:layout] } : {})
@@ -150,7 +162,8 @@ module CamaleonCms
         return page_not_found
       end
       @object = @user
-      @cama_visited_profile = true
+      CurrentRequest.frontend_object = @object
+      mark_frontend_profile_visited(@user)
       layout_ = lookup_context.template_exists?('layouts/profile') ? 'profile' : nil
       r = { user: @user, layout: layout_, render: 'profile' }
       hooks_run('on_render_profile', r)
@@ -168,6 +181,7 @@ module CamaleonCms
     def draft_render
       post_draft = current_site.posts.drafts.find(params[:draft_id])
       @object = post_draft
+      CurrentRequest.frontend_object = @object
 
       # let a hook override the ability for certain roles see drafts
       args = { permitted: false }
@@ -186,7 +200,9 @@ module CamaleonCms
     def render_post(post_or_slug_or_id, from_url = false, status = nil, force_visit = false)
       @post = case post_or_slug_or_id
               when String # slug
-                current_site.the_posts.find_by_slug(post_or_slug_or_id)
+                # find_by_slug is multi-language aware (matches localized slugs like
+                # "<!--:en-->sample-post<!--:-->..."), unlike find_by(slug:)
+                current_site.the_posts.find_by_slug(post_or_slug_or_id) # rubocop:disable Rails/DynamicFindBy
               when Integer # id
                 current_site.the_posts.where(id: post_or_slug_or_id).first
               else # model
@@ -194,15 +210,16 @@ module CamaleonCms
               end
 
       @post = @post.try(:decorate)
-      if !@post.present? || !(force_visit || @post.can_visit?)
-        if params[:format] == 'html' || !params[:format].present?
+      if @post.blank? || !(force_visit || @post.can_visit?)
+        if params[:format] == 'html' || params[:format].blank?
           page_not_found
         else
-          head 404
+          head :not_found
         end
       else
         @object = @post
-        @cama_visited_post = @post
+        CurrentRequest.frontend_object = @object
+        mark_frontend_post_visited(@post)
         @post_type = @post.the_post_type
         @comments = @post.the_comments
         @categories = @post.the_categories
@@ -213,10 +230,11 @@ module CamaleonCms
         rescue StandardError
           nil
         end
+        post_template = @post.get_template(@post_type)
         r_file = if lookup_context.template_exists?("page_#{@post.id}")
                    "page_#{@post.id}"
-                 elsif @post.get_template(@post_type).present? && lookup_context.template_exists?(@post.get_template(@post_type))
-                   @post.get_template(@post_type)
+                 elsif post_template.present? && lookup_context.template_exists?(post_template)
+                   post_template
                  elsif home_page.present? && @post.id.to_s == home_page
                    'index'
                  elsif lookup_context.template_exists?("post_types/#{@post_type.the_slug}/single")
@@ -261,17 +279,54 @@ module CamaleonCms
     # if url hasn't a locale, then it will use default locale set on application.rb
     def init_frontent
       # preview theme initializing
-      @_current_theme = current_site.themes.where(slug: params[:ccc_theme_preview]).first_or_create!.decorate if cama_sign_in? && params[:ccc_theme_preview].present? && can?(
-        :manage, :themes
-      )
+      previewing_theme = cama_sign_in? && params[:ccc_theme_preview].present? && can?(:manage, :themes)
+      if previewing_theme
+        preview_theme = current_site.themes.where(slug: params[:ccc_theme_preview]).first_or_create!.decorate
+        @_current_theme = preview_theme
+        CurrentRequest.frontend_current_theme = preview_theme
+        ensure_preview_site_defaults
+      end
 
       @_site_options = current_site.options
-      session[:cama_current_language] = params[:cama_set_language].to_sym if params[:cama_set_language].present?
+      # Only a scalar language param participates in locale resolution — a non-scalar
+      # (?locale[]= / ?cama_set_language[]=) would crash to_sym and 500 the request
+      set_language = params[:cama_set_language]
+      session[:cama_current_language] = set_language.to_sym if set_language.is_a?(String) && set_language.present?
       session[:cama_current_language] = nil if current_site.get_languages.exclude?(session[:cama_current_language])
-      I18n.locale = params[:locale] || session[:cama_current_language] || current_site.get_languages.first
-      return page_not_found unless current_site.get_languages.include?(I18n.locale.to_sym)
+      requested_locale = params[:locale] if params[:locale].is_a?(String)
+      I18n.locale = requested_locale || session[:cama_current_language] || current_site.get_languages.first
+      # The availability gate renders the site's 404 (directly or via a custom error_404
+      # post), so the theme lookup prefixes must already be registered when it fires
+      configure_frontend_lookup_prefixes
+      theme_init
+      return if current_site.get_languages.include?(I18n.locale.to_sym)
+
+      # The unoffered locale must not style the 404 page or leak into its links
+      I18n.locale = current_site.get_languages.first
+      page_not_found
+    end
+
+    # initialize hooks before to execute action
+    def before_hooks
+      hooks_run('front_before_load')
+    end
+
+    # initialize hooks after executed action
+    def after_hooks
+      hooks_run('front_after_load')
+    end
+
+    # define default options for url helpers
+    # control for default locale
+    def default_url_options(options = {})
+      return options if current_site.get_languages.first.to_s == I18n.locale.to_s
 
-      # define render paths
+      { locale: I18n.locale }.merge!(options)
+    rescue StandardError
+      options
+    end
+
+    def configure_frontend_lookup_prefixes
       lookup_context.prefixes.delete('frontend')
       lookup_context.prefixes.delete('application')
       lookup_context.prefixes.delete('camaleon_cms/frontend')
@@ -282,36 +337,51 @@ module CamaleonCms
         t =~ %r{themes/(.*)/views}i || t == 'camaleon_cms/default_theme' || t == "themes/#{current_site.id}/views"
       end
 
-      lookup_context.prefixes.append("themes/#{current_site.id}/views") if Dir.exist?(Rails.root.join('app', 'apps',
-                                                                                                      'themes', current_site.id.to_s).to_s)
+      # Per-site theme override: views placed under app/apps/themes/<site_id>/views
+      # take precedence over the active theme's views (it is appended first).
+      if Dir.exist?(Rails.root.join('app', 'apps', 'themes', current_site.id.to_s).to_s)
+        lookup_context.prefixes.append("themes/#{current_site.id}/views")
+      end
       lookup_context.prefixes.append("themes/#{current_theme.slug}/views")
       lookup_context.prefixes.append('camaleon_cms/default_theme')
 
       lookup_context.prefixes = lookup_context.prefixes.uniq
       lookup_context.use_camaleon_partial_prefixes = true
-      theme_init
     end
 
-    # initialize hooks before to execute action
-    def before_hooks
-      hooks_run('front_before_load')
+    def ensure_preview_site_defaults
+      preview_required_menu_slugs.each do |slug|
+        current_site.nav_menus.where(slug: slug).first_or_create! do |menu|
+          menu.name = slug.to_s.humanize
+        end
+      end
     end
 
-    # initialize hooks after executed action
-    def after_hooks
-      hooks_run('front_after_load')
+    def preview_required_menu_slugs
+      slugs = ['main_menu']
+      slugs.concat(extract_theme_menu_slugs(current_theme.settings['path']))
+      slugs.uniq
     end
 
-    # define default options for url helpers
-    # control for default locale
-    def default_url_options(options = {})
-      if current_site.get_languages.first.to_s == I18n.locale.to_s
-        options
-      else
-        { locale: I18n.locale }.merge options
+    def extract_theme_menu_slugs(theme_path)
+      return [] if theme_path.blank?
+
+      views_path = File.join(theme_path, 'views')
+      return [] unless Dir.exist?(views_path)
+
+      Dir.glob(File.join(views_path, '**', '*.erb')).flat_map do |file_path|
+        extract_menu_slugs_from_template(File.read(file_path))
+      end.uniq
+    end
+
+    def extract_menu_slugs_from_template(content)
+      slugs = []
+      slugs.concat(content.scan(/nav_menus\.where\(\s*slug:\s*'([^']+)'\s*\)/).flatten)
+      slugs.concat(content.scan(/nav_menus\.where\(\s*slug:\s*"([^"]+)"\s*\)/).flatten)
+      content.scan(/nav_menus\.where\(\s*slug:\s*\[([^\]]+)\]\s*\)/).flatten.each do |array_content|
+        slugs.concat(array_content.scan(/['"]([^'"]+)['"]/).flatten)
       end
-    rescue StandardError
-      options
+      slugs
     end
   end
 end

data/app/controllers/concerns/camaleon_cms/admin/custom_fields_concern.rb

@@ -0,0 +1,44 @@
+module CamaleonCms
+  module Admin
+    module CustomFieldsConcern
+      extend ActiveSupport::Concern
+
+      private
+
+      # Only permit field values whose slug is registered under object_class. param_key selects
+      # which request param carries the payload, so sibling params (the theme form's
+      # theme_fields) get the same allowed-slugs permit as the default field_options.
+      def cama_permitted_field_options(object_class, param_key: :field_options)
+        field_options = params[param_key]
+        # A non-hash payload (a scalar `field_options=foo`, or an array) carries no groups to permit,
+        # so treat it as empty instead of calling #keys/#permit on it. Guarding here rather than
+        # `params.require` avoids a NoMethodError -> 500 an authenticated caller could trigger with a
+        # malformed param (the same crash every set_field_values caller shared).
+        return {} unless field_options.is_a?(ActionController::Parameters)
+
+        allowed_keys = cama_custom_field_allowed_slugs(object_class)
+        return {} if allowed_keys.blank?
+
+        permitted = field_options.permit(field_options.keys.select { |k| k.to_s =~ /\A\d+\z/ }.index_with do
+          allowed_keys.index_with { [:id, :group_number, { values: {} }] }
+        end).to_h
+        # Drop groups left empty after filtering. set_field_values deletes every existing value
+        # before writing, so handing it a non-blank-but-empty payload (a group whose submitted
+        # slugs were all unregistered) would wipe the object's stored values and write nothing.
+        permitted.reject { |_group, fields| fields.blank? }
+      end
+
+      # The allow-list covers fields registered directly under object_class. For a post
+      # ('PostType_Post') this intentionally spans only the post type's own groups -- not per-post
+      # ('Post') or category-inherited ('Category_Post') groups the edit form also renders. It
+      # matches PostsController#save_post_with_fields, so the main post save and drafts confine field
+      # writes identically; values for those sibling scopes are deliberately not written this way.
+      def cama_custom_field_allowed_slugs(object_class)
+        CamaleonCms::CustomField.where(
+          parent_id: CamaleonCms::CustomField.where(object_class: object_class).select(:id),
+          object_class: '_fields'
+        ).pluck(:slug).uniq
+      end
+    end
+  end
+end

data/app/controllers/concerns/camaleon_cms/frontend_concern.rb

@@ -4,7 +4,8 @@ module CamaleonCms
     # visiting sitemap.xml
     # With hook "on_render_sitemap" you can skip post_types, categories, tags or posts
     #   you can change render file and layout
-    #   you can add custom sitemap elements in the attr "custom", like: https://github.com/owen2345/camaleon-cms/issues/106#issuecomment-146232211
+    #   you can add custom sitemap elements in the attr "custom",
+    #     like: https://github.com/owen2345/camaleon-cms/issues/106#issuecomment-146232211
     #   you can customize your content for html or xml format
     def sitemap
       r = { layout: (params[:format] == 'html' ? nil : false), render: 'sitemap', custom: {}, format: params[:format],
@@ -31,21 +32,33 @@ module CamaleonCms
     # save comment from a post
     def save_comment
       flash[:comment_submit] = {}
-      @post = current_site.posts.find_by_id(params[:post_id]).decorate
+      # Security (audit Low): this is a public endpoint. A post id naming no post used to reach
+      # `.decorate` on nil (500), and the anonymous branch indexed a missing post_comment param.
+      # Fail closed with a graceful error instead of a 500 an attacker can trigger at will.
+      @post = current_site.posts.find_by(id: params[:post_id])&.decorate
       user = cama_current_user
       comment_data = {}
-      unless @post.can_commented?
-        flash[:comment_submit][:error] =
-          t('.comments_not_enabled', default: 'This post can not be commented')
+      if @post.nil?
+        flash[:comment_submit][:error] = t('.post_not_found', default: 'Post not found')
+      elsif !@post.can_commented?
+        flash[:comment_submit][:error] = t('.comments_not_enabled', default: 'This post can not be commented')
       end
+
+      # Security (audit Low): params[:post_comment] is attacker-controlled and may arrive as a scalar
+      # or array, not the expected hash. `|| {}` only covered nil; indexing a String/Array with a
+      # symbol key raises TypeError (500). Coerce anything not hash-shaped to an empty hash so every
+      # post_comment[...] read below is safe.
+      post_comment = params[:post_comment]
+      post_comment = {} unless post_comment.is_a?(ActionController::Parameters) || post_comment.is_a?(Hash)
+
       if user.present?
         comment_data[:author] = user.fullname
         comment_data[:author_email] = user.email
       elsif current_site.get_option('permit_anonimos_comment', false)
         user = current_site.get_anonymous_user
         comment_data[:is_anonymous] = true
-        comment_data[:author] = params[:post_comment][:name]
-        comment_data[:author_email] = params[:post_comment][:email]
+        comment_data[:author] = post_comment[:name]
+        comment_data[:author_email] = post_comment[:email]
         if current_site.is_enable_captcha_for_comments? && !cama_captcha_verified?
           flash[:comment_submit][:error] =
             t('camaleon_cms.admin.users.message.error_captcha',
@@ -56,24 +69,40 @@ module CamaleonCms
       unless flash[:comment_submit][:error]
         if user.present?
           comment_data[:user_id] = user.id
-          comment_data[:author_url] = params[:post_comment][:url] || ''
+          comment_data[:author_url] = post_comment[:url] || ''
           comment_data[:author_IP] = request.remote_ip.to_s
           comment_data[:approved] = current_site.front_comment_status
-          comment_data[:agent] = request.user_agent.force_encoding('ISO-8859-1').encode('UTF-8')
-          comment_data[:content] = params[:post_comment][:content]
-          @comment = params[:post_comment][:parent_id].present? ? @post.comments.find_by_id(params[:post_comment][:parent_id]).children.new(comment_data) : @post.comments.main.new(comment_data)
-          if @comment.save
-            flash[:comment_submit][:notice] = t('camaleon_cms.admin.comments.message.created')
+          # Browsers always send a User-Agent but API clients/bots may not; record it nil-safely
+          # and without mutating the request's header string in place.
+          comment_data[:agent] = request.user_agent.to_s.encode('UTF-8', 'ISO-8859-1')
+          comment_data[:content] = post_comment[:content]
+          # Security (audit Low): a crafted parent_id naming no comment on this post made find_by
+          # return nil and the chained `.children` raise (500). Resolve the parent first and fail
+          # closed with a graceful error when a supplied parent_id matches nothing.
+          parent_id = post_comment[:parent_id]
+          parent = @post.comments.find_by(id: parent_id) if parent_id.present?
+          if parent_id.present? && parent.nil?
+            flash[:comment_submit][:error] = t('.parent_comment_not_found', default: 'Parent comment not found')
           else
-            flash[:comment_submit][:error] =
-              "#{t('camaleon_cms.common.comment_error',
-                   default: 'An error was occurred on save comment')}:<br> #{@comment.errors.full_messages.join(', ')}"
+            @comment = parent ? parent.children.new(comment_data) : @post.comments.main.new(comment_data)
+            if @comment.save
+              flash[:comment_submit][:notice] = t('camaleon_cms.admin.comments.message.created')
+            else
+              base = t('camaleon_cms.common.comment_error', default: 'An error was occurred on save comment')
+              flash[:comment_submit][:error] = "#{base}:<br> #{@comment.errors.full_messages.join(', ')}"
+            end
           end
         else
           flash[:comment_submit][:error] = t('camaleon_cms.admin.message.unauthorized')
         end
       end
-      params[:format] == 'json' ? render(json: flash.discard(:comment_submit).to_hash) : redirect_to(request.referer || @post.the_url(as_path: true))
+
+      return render(json: flash.discard(:comment_submit).to_hash) if params[:format] == 'json'
+
+      # Security (audit Low): the Referer header is attacker-controlled; redirecting to it raw is an
+      # open redirect (Rails < 7) or an UnsafeRedirectError 500 (Rails >= 7). Vet it through the shared
+      # same-host/allowlist redirect helper, falling back to the post URL (or root).
+      cama_safe_redirect(request.referer, @post&.the_url(as_path: true) || '/')
     end
   end
 end

data/app/controllers/concerns/camaleon_cms/frontend_visited_state_concern.rb

@@ -0,0 +1,72 @@
+module CamaleonCms
+  module FrontendVisitedStateConcern
+    extend ActiveSupport::Concern
+
+    LEGACY_VISITED_IVAR_BY_ATTR = {
+      frontend_visited_home: :@cama_visited_home,
+      frontend_visited_post: :@cama_visited_post,
+      frontend_visited_ajax: :@cama_visited_ajax,
+      frontend_visited_search: :@cama_visited_search,
+      frontend_visited_post_type: :@cama_visited_post_type,
+      frontend_visited_tag: :@cama_visited_tag,
+      frontend_visited_category: :@cama_visited_category,
+      frontend_visited_profile: :@cama_visited_profile
+    }.freeze
+
+    private
+
+    def mark_frontend_home_visited
+      set_frontend_visited_state(:frontend_visited_home, true)
+    end
+
+    def mark_frontend_post_visited(post)
+      set_frontend_visited_state(:frontend_visited_post, post)
+    end
+
+    def mark_frontend_ajax_visited
+      set_frontend_visited_state(:frontend_visited_ajax, true)
+    end
+
+    def mark_frontend_search_visited
+      set_frontend_visited_state(:frontend_visited_search, true)
+    end
+
+    def mark_frontend_post_type_visited(post_type)
+      set_frontend_visited_state(:frontend_visited_post_type, post_type)
+    end
+
+    def mark_frontend_tag_visited(post_tag)
+      set_frontend_visited_state(:frontend_visited_tag, post_tag)
+    end
+
+    def mark_frontend_category_visited(category)
+      set_frontend_visited_state(:frontend_visited_category, category)
+    end
+
+    def mark_frontend_profile_visited(user = nil)
+      set_frontend_visited_state(:frontend_visited_profile, true)
+      CurrentRequest.frontend_user = user if user.present?
+    end
+
+    def set_frontend_visited_state(current_request_attr, value)
+      CurrentRequest.public_send("#{current_request_attr}=", value)
+      legacy_ivar = LEGACY_VISITED_IVAR_BY_ATTR[current_request_attr]
+      return if legacy_ivar.blank?
+
+      instance_variable_set(legacy_ivar, value)
+      warn_frontend_legacy_visited_ivar(legacy_ivar, current_request_attr)
+    end
+
+    def warn_frontend_legacy_visited_ivar(legacy_ivar, current_request_attr)
+      warned_legacy_ivars = self.class.instance_variable_get(:@_warned_frontend_legacy_visited_ivars) || {}
+      return if warned_legacy_ivars[legacy_ivar]
+
+      ActiveSupport::Deprecation._instance.warn(
+        "Controller compatibility ivar #{legacy_ivar} is deprecated and will be removed in a future major release. " \
+        "Use CurrentRequest.#{current_request_attr} instead."
+      )
+      warned_legacy_ivars[legacy_ivar] = true
+      self.class.instance_variable_set(:@_warned_frontend_legacy_visited_ivars, warned_legacy_ivars)
+    end
+  end
+end