camaleon_cms 2.9.2 → 2.9.3

data/app/models/camaleon_cms/post.rb

@@ -2,9 +2,44 @@ module CamaleonCms
   class Post < CamaleonCms::PostDefault
     include CamaleonCms::CategoriesTagsForPosts
 
+    # Structural, non-executable markup that long-form post content legitimately uses but the
+    # sanitizer default drops. Superset of the default so upstream security additions are inherited.
+    SANITIZE_EXTRA_TAGS = %w[table thead tbody tfoot tr td th caption col colgroup
+                             figure figcaption u s hr].freeze
+    # These attributes are allowed knowing what they cost, none of which is script execution:
+    # `style` is CSS-scrubbed by the gate's scrubber (expression(), url(javascript:) and friends
+    # register as removals) but permits absolutely-positioned overlays; `id` widens DOM clobbering,
+    # which the scrubber's own default `name` already opened; and `target` without a forced
+    # `rel=noopener` is reverse tabnabbing on browsers predating the implicit default. The trade
+    # is deliberate: an untrusted author whose content needs more than this list has the save
+    # refused, and the role that wants more grants post_content_unfiltered_html.
+    SANITIZE_EXTRA_ATTRIBUTES = %w[id style target rel colspan rowspan].freeze
+    CONTENT_ALLOWED_TAGS = (ActionController::Base.helpers.sanitizer_vendor.safe_list_sanitizer
+                              .allowed_tags.to_a + SANITIZE_EXTRA_TAGS).uniq.freeze
+    CONTENT_ALLOWED_ATTRIBUTES = (ActionController::Base.helpers.sanitizer_vendor.safe_list_sanitizer
+                                    .allowed_attributes.to_a + SANITIZE_EXTRA_ATTRIBUTES).uniq.freeze
+
+    # Opt-out for trusted server-side pipelines (imports, seeds, plugin code) that would otherwise
+    # be sanitized by the fail-closed default. Exposed as a reader plus a bang enabler and NO
+    # `unfiltered_content=` writer, so `assign_attributes`/mass assignment cannot reach it — only
+    # explicit server-side code calling `post.unfiltered_content!` can.
+    #
+    # It is sticky for the lifetime of the object, not for one save: an instance that has been
+    # opted out stays opted out for every subsequent save of that instance. That is what a
+    # pipeline staging a record over several steps wants; code that needs the opt-out to apply
+    # once should not reuse the instance afterwards.
+    attr_reader :unfiltered_content
+
+    def unfiltered_content!
+      @unfiltered_content = true
+      self
+    end
+
     alias_attribute :post_type_id, :taxonomy_id
     default_scope -> { where(post_class: 'Post').order(post_order: :asc, created_at: :desc) }
 
+    validate :reject_untrusted_dangerous_content, on: %i[create update]
+
     # DEPRECATED
     has_many :post_relationships, class_name: 'CamaleonCms::PostRelationship', foreign_key: :objectid,
                                   dependent: :destroy, inverse_of: :post
@@ -14,16 +49,17 @@ module CamaleonCms
     has_many :term_relationships, foreign_key: :objectid, dependent: :destroy, inverse_of: :object
     has_many :categories, class_name: 'CamaleonCms::Category', through: :term_relationships, source: :term_taxonomy
     has_many :post_tags, class_name: 'CamaleonCms::PostTag', through: :term_relationships, source: :term_taxonomy
-    has_many :comments, class_name: 'CamaleonCms::PostComment', foreign_key: :post_id, dependent: :destroy
-    has_many :drafts, lambda {
-                        where(status: 'draft_child')
-                      }, class_name: 'CamaleonCms::Post', foreign_key: :post_parent, dependent: :destroy
+    has_many :comments, class_name: 'CamaleonCms::PostComment', dependent: :destroy
+    has_many :drafts, -> { where(status: 'draft_child') }, class_name: 'CamaleonCms::Post', inverse_of: :parent,
+                                                           foreign_key: :post_parent, dependent: :destroy
     has_many :children, class_name: 'CamaleonCms::Post', foreign_key: :post_parent, dependent: :destroy,
-                        primary_key: :id
+                        primary_key: :id, inverse_of: :parent
 
-    belongs_to :owner, class_name: CamaManager.get_user_class_name, foreign_key: :user_id, required: false
-    belongs_to :parent, class_name: 'CamaleonCms::Post', foreign_key: :post_parent, required: false
-    belongs_to :post_type, foreign_key: :taxonomy_id, inverse_of: :posts, required: false
+    belongs_to :owner, class_name: CamaManager.get_user_class_name.to_s, foreign_key: :user_id, optional: true,
+                       inverse_of: :all_posts
+    belongs_to :parent, class_name: 'CamaleonCms::Post', foreign_key: :post_parent, optional: true,
+                        inverse_of: :children
+    belongs_to :post_type, foreign_key: :taxonomy_id, inverse_of: :posts, optional: true
 
     scope :visible_frontend, -> { where(status: 'published') }
     scope :public_posts, lambda {
@@ -42,7 +78,7 @@ module CamaleonCms
     validates_with CamaleonCms::PostUniqValidator
     attr_accessor :show_title_with_parent
 
-    before_create :fix_post_order, if: ->(p) { !p.post_order.present? || p.post_order == 0 }
+    before_create :fix_post_order, if: ->(p) { p.post_order.blank? || p.post_order == 0 }
 
     # return all parents for current page hierarchy ordered bottom to top
     def parents
@@ -66,22 +102,22 @@ module CamaleonCms
       end
     end
 
-    # return the post type of this post (DEPRECATED)
+    # Return the post type of this post (DEPRECATED), though used yet in migration, so let it stay
     def get_post_type_depre
       post_types.reorder(nil).first
     end
 
-    # check if this post was published
+    # Check if this post was published
     def published?
       status == 'published'
     end
 
-    # check if this is in pending status
+    # Check if this post is in the pending status
     def pending?
       status == 'pending'
     end
 
-    # check if this is in draft status
+    # Check if this post is in the draft status
     def draft?
       %w[draft draft_child].include?(status)
     end
@@ -90,12 +126,12 @@ module CamaleonCms
       status == 'draft_child'
     end
 
-    # check if this is in trash status
+    # Check if this post is in the trash status
     def trash?
       status == 'trash'
     end
 
-    # check if current post can manage content
+    # Check if the current post can manage content
     # return boolean
     def manage_content?(posttype = nil)
       get_option('has_content', (posttype || post_type).get_option('has_content', true))
@@ -106,34 +142,35 @@ module CamaleonCms
       get_option('has_layout', (posttype || post_type).get_option('has_layout', false))
     end
 
-    # check if current post can manage template
+    # Check if current post can manage template
     # return boolean
     def manage_template?(posttype = nil)
       get_option('has_template', (posttype || post_type).get_option('has_template', true))
     end
 
-    # check if current post can manage summary
+    # Check if the current post can manage summary
     # return boolean
     def manage_summary?(posttype = nil)
       get_option('has_summary', (posttype || post_type).get_option('has_summary', true))
     end
 
-    # check if current post can manage picture
+    # Check if the current post can manage picture
     # return boolean
     def manage_picture?(posttype = nil)
       get_option('has_picture', (posttype || post_type).get_option('has_picture', true))
     end
 
-    # check if current post can manage comments
+    # Check if the current post can manage comments
     # return boolean
     def manage_comments?(posttype = nil)
       get_option('has_comments', (posttype || post_type).get_option('has_comments', false))
     end
 
-    # check if the post can be commented
+    # Check if the post can be commented
     # sample: @post.can_commented?
-    # return Boolean (true/false)
-    # to enable comments for current post, use this: post.set_meta('has_comments', '1'). Note: Parent PostType should be enabled for comments too: post_type.set_option('has_comments', true)
+    # to enable comments for current post, use this: post.set_meta('has_comments', '1').
+    # Note: Parent PostType should be enabled for comments too: post_type.set_option('has_comments', true)
+    # @return [TrueClass, FalseClass]
     def can_commented?
       manage_comments? && get_meta('has_comments').to_s == '1'
     end
@@ -151,10 +188,15 @@ module CamaleonCms
     #   has_picture, boolean (default true)
     #   has_template, boolean (default false)
     #   has_comments, boolean (default false)
-    #   default_layout:  (string) (default layout) # this is still used if post type was inactivated layout and overwritten by dropdown in post view
-    #   default_template:  (string) (default template) # this is still used if post type was inactivated template and overwritten by dropdown in post view
+    #
+    #   the following is still used if post type was inactivated layout and overwritten by dropdown in post view
+    #   default_layout:  (string) (default layout)
+    #
+    #   the following is still used if post type was inactivated template and overwritten by dropdown in post view
+    #   default_template:  (string) (default template)
     #   has_layout:  (boolean) (default false)
-    #   skip_fields:  (array) (default empty) array of custom field keys to avoid for this post, sample: ["subtitle", "icon"]
+    #   skip_fields:  (array) (default empty) array of custom field keys to avoid for this post,
+    #     sample: ["subtitle", "icon"]
     # val: value for the setting
     def set_setting(key, val)
       set_option(key, val)
@@ -171,7 +213,7 @@ module CamaleonCms
     # new_order_position: (Integer) position number
     # return nil
     def set_position(new_order_position)
-      update_column('post_order', new_order_position)
+      update_column(:post_order, new_order_position) # rubocop:disable Rails/SkipsModelValidations
     end
 
     # save the summary for current post
@@ -247,10 +289,54 @@ module CamaleonCms
 
     private
 
+    def trusted_for_unfiltered_html?
+      user = CurrentRequest.user
+      site = CurrentRequest.site
+      # Fail closed (sanitize) when either user or site context is missing - e.g. background jobs, rake tasks
+      # or the console. Guarding the site too avoids a NoMethodError from Ability#initialize (which dereferences
+      # the site for non-admin users) that would otherwise abort the whole save.
+      return false if user.blank? || site.blank?
+
+      CamaleonCms::Ability.new(user, site).can?(:post_content_unfiltered_html, post_type)
+    end
+
+    # Security (scan-and-reject policy): content an untrusted author is not permitted to write is
+    # refused with a validation error -- never sanitized or rewritten -- so stored content always
+    # equals authored content and the frontend may render it verbatim. The guard on
+    # `content_changed?` deliberately leaves pre-gate stored content editable (a title fix on an
+    # old post must not brick it); `rake camaleon_cms:security:scan_content` lists such content.
+    def reject_untrusted_dangerous_content
+      return unless new_record? || content_changed?
+      return if content.blank?
+      # The explicit pipeline opt-out short-circuits before the Ability lookup below.
+      return if unfiltered_content
+      # Check trust only once we know there is content to gate, so unchanged/blank updates never pay for
+      # building an Ability (a role-meta DB lookup) on every save.
+      return if trusted_for_unfiltered_html?
+
+      # Distinguish an over-size refusal from a disallowed-markup refusal (audit M16): an over-size
+      # value can be perfectly clean, so the markup message (scripts/handlers/embeds) would misdescribe
+      # it and send the author hunting for markup that is not there.
+      if CamaleonCms::UnsafeMarkup.too_large?(content)
+        errors.add(:content, cama_content_rejection_message('content_too_large'))
+      elsif CamaleonCms::UnsafeMarkup.unsafe_html?(
+        content, tags: CONTENT_ALLOWED_TAGS, attributes: CONTENT_ALLOWED_ATTRIBUTES
+      )
+        errors.add(:content, cama_content_rejection_message('content_rejected'))
+      end
+    end
+
+    # Only en.yml carries these keys while the process locale follows the current admin/site
+    # language — fall back to English rather than emit "translation missing".
+    def cama_content_rejection_message(key)
+      full_key = "camaleon_cms.admin.post.message.#{key}"
+      I18n.t(full_key, default: I18n.t(full_key, locale: :en))
+    end
+
     # calculate a post order when it is empty
     def fix_post_order
       last_post = post_type.posts.where.not(id: nil).last
-      self.post_order = last_post.present? ? last_post.post_order + 1 : 1
+      self.post_order = last_post.present? ? (last_post.post_order || 0) + 1 : 1
     end
   end
 end

data/app/models/camaleon_cms/post_comment.rb

@@ -6,16 +6,20 @@ module CamaleonCms
     extend CamaleonCms::NormalizeAttrs
 
     self.table_name = "#{PluginRoutes.static_system_info['db_prefix']}comments"
-    # attr_accessible :user_id, :post_id, :content, :author, :author_email, :author_url, :author_IP, :approved, :agent, :agent, :typee, :comment_parent, :is_anonymous
+    # attr_accessible :user_id, :post_id, :content, :author, :author_email, :author_url, :author_IP, :approved, :agent,
+    #                 :agent, :typee, :comment_parent, :is_anonymous
     attr_accessor :is_anonymous
 
     # default_scope order('comments.created_at ASC')
     # approved: approved | pending | spam
 
-    has_many :children, class_name: 'CamaleonCms::PostComment', foreign_key: :comment_parent, dependent: :destroy
-    belongs_to :post, required: false
-    belongs_to :parent, class_name: 'CamaleonCms::PostComment', foreign_key: :comment_parent, required: false
-    belongs_to :user, class_name: CamaManager.get_user_class_name, foreign_key: :user_id, required: false
+    has_many :children, class_name: 'CamaleonCms::PostComment', foreign_key: :comment_parent, dependent: :destroy,
+                        inverse_of: :parent
+
+    belongs_to :post, optional: true
+    belongs_to :parent, class_name: 'CamaleonCms::PostComment', foreign_key: :comment_parent, optional: true,
+                        inverse_of: :children
+    belongs_to :user, class_name: CamaManager.get_user_class_name.to_s, optional: true
 
     default_scope { order("#{CamaleonCms::PostComment.table_name}.created_at DESC") }
 
@@ -26,7 +30,7 @@ module CamaleonCms
     normalize_attrs(:content)
 
     validates :content, presence: true
-    validates_presence_of :author, :author_email, if: proc { |c| c.is_anonymous.present? }
+    validates :author, :author_email, presence: { if: proc { |c| c.is_anonymous.present? } }
     after_create :update_counter
     after_destroy :update_counter
 

data/app/models/camaleon_cms/post_default.rb

@@ -11,9 +11,42 @@ module CamaleonCms
       end
     end
 
+    # Point Rails to use the post_class column for Native STI
+    self.inheritance_column = :post_class
+
+    # Controls Writing: Strip 'CamaleonCms::' when saving to DB
+    # "CamaleonCms::Widget::Assigned" -> "Widget::Assigned"
+    # "CamaleonCms::Post" -> "Post"
+    def self.sti_name
+      name.sub(/^CamaleonCms::/, '')
+    end
+
+    # Controls Reading: Prepend 'CamaleonCms::' when pulling from DB
+    # "Widget::Assigned" -> "CamaleonCms::Widget::Assigned"
+    # "Post" -> "CamaleonCms::Post"
+    def self.find_sti_class(type_name)
+      full_class_name = type_name.start_with?('CamaleonCms::') ? type_name : "CamaleonCms::#{type_name}"
+      klass = begin
+        full_class_name.constantize
+      rescue NameError
+        nil
+      end
+      return klass if klass && klass <= base_class
+
+      # `super` resolves fully-qualified external classes (plugin STI outside the
+      # CamaleonCms namespace) and enforces ancestry; values it cannot place load as
+      # the base class, as every row did before native STI.
+      begin
+        super
+      rescue ActiveRecord::SubclassNotFound
+        base_class
+      end
+    end
+
     self.table_name = "#{PluginRoutes.static_system_info['db_prefix']}posts"
 
-    # attr_accessible :user_id, :title, :slug, :content, :content_filtered, :status,  :visibility, :visibility_value, :post_order, :post_type_key, :taxonomy_id, :published_at, :post_parent, :post_order, :is_feature
+    # attr_accessible :user_id, :title, :slug, :content, :content_filtered, :status,  :visibility, :visibility_value,
+    #                 :post_order, :post_type_key, :taxonomy_id, :published_at, :post_parent, :post_order, :is_feature
     attr_accessor :draft_id
 
     # attr_accessible :data_options
@@ -21,10 +54,12 @@ module CamaleonCms
     cattr_accessor :current_user
     cattr_accessor :current_site
 
-    has_many :term_relationships, foreign_key: :objectid, dependent: :destroy, primary_key: :id
-    has_many :children, lambda {
-                          where(post_class: 'PostDefault')
-                        }, class_name: 'CamaleonCms::PostDefault', foreign_key: :post_parent, dependent: :destroy, primary_key: :id
+    has_many :children, -> { where(post_class: 'PostDefault') },
+             class_name: 'CamaleonCms::PostDefault', foreign_key: :post_parent, dependent: :destroy, inverse_of: :parent
+
+    belongs_to :parent, class_name: 'CamaleonCms::PostDefault', foreign_key: :post_parent, optional: true,
+                        inverse_of: :children
+
     scope :featured, -> { where(is_feature: true) }
 
     validates :title, :slug, presence: true
@@ -45,11 +80,6 @@ module CamaleonCms
       res.take
     end
 
-    # return the parent of a post (support for sub contents or tree of posts)
-    def parent
-      CamaleonCms::Post.where(id: post_parent).first
-    end
-
     # return the author of this Content
     def author
       CamaleonCms::User.find(user_id)
@@ -62,7 +92,7 @@ module CamaleonCms
       CamaleonCms::NavMenuItem.where(url: id, kind: 'post')
     end
 
-    # Set the meta, field values and the post keywords here
+    # Set the meta-field values and the post keywords here
     def set_params(meta, custom_fields, options)
       set_metas(meta)
       set_field_values(custom_fields)
@@ -78,7 +108,7 @@ module CamaleonCms
 
     # do all before actions to save the content
     def before_saved
-      self.title = 'Untitled' unless title.present?
+      self.title = 'Untitled' if title.blank?
       self.content_filtered = if content.to_s.include?('<!--:-->')
                                 content.translations.transform_values do |value|
                                   value.squish.strip_tags

data/app/models/camaleon_cms/post_relationship.rb

@@ -5,11 +5,11 @@ module CamaleonCms
     # attr_accessible :objectid, :term_taxonomy_id, :term_order
     default_scope -> { order(term_order: :asc) }
 
-    belongs_to :post_type, class_name: 'CamaleonCms::PostType', foreign_key: :term_taxonomy_id,
-                           inverse_of: :post_relationships, required: false
+    belongs_to :post_type, class_name: 'CamaleonCms::PostType', foreign_key: :term_taxonomy_id, inverse_of: false,
+                           optional: true
     belongs_to :post, lambda {
                         order("#{CamaleonCms::Post.table_name}.id DESC")
-                      }, foreign_key: :objectid, inverse_of: :post_relationships, dependent: :destroy, required: false
+                      }, foreign_key: :objectid, inverse_of: :post_relationships, optional: true
 
     # callbacks
     after_create :update_count
@@ -18,7 +18,9 @@ module CamaleonCms
     private
 
     def update_count
-      post_type.update_column('count', post_type.posts.size) if post_type.present?
+      return if post_type.blank?
+
+      post_type.update_column(:count, post_type.posts.size) # rubocop:disable Rails/SkipsModelValidations
     end
   end
 end

data/app/models/camaleon_cms/post_tag.rb

@@ -1,11 +1,10 @@
 module CamaleonCms
   class PostTag < CamaleonCms::TermTaxonomy
-    normalize_attrs(:name, :description)
-
-    default_scope { where(taxonomy: :post_tag) }
+    normalize_attrs(:description)
 
     has_many :posts, foreign_key: :objectid, through: :term_relationships, source: :object
-    belongs_to :post_type, foreign_key: :parent_id, inverse_of: :post_tags, required: false
-    belongs_to :owner, class_name: CamaManager.get_user_class_name, foreign_key: :user_id, required: false
+    belongs_to :post_type, foreign_key: :parent_id, inverse_of: :post_tags, optional: true
+    belongs_to :owner, class_name: CamaManager.get_user_class_name.to_s, foreign_key: :user_id, optional: true,
+                       inverse_of: false
   end
 end

data/app/models/camaleon_cms/post_type.rb

@@ -1,9 +1,8 @@
 module CamaleonCms
   class PostType < CamaleonCms::TermTaxonomy
-    normalize_attrs(:name, :description)
+    normalize_attrs(:description)
 
     alias_attribute :site_id, :parent_id
-    default_scope { where(taxonomy: :post_type) }
 
     has_many :categories, foreign_key: :parent_id, dependent: :destroy, inverse_of: :post_type_parent
     has_many :post_tags, foreign_key: :parent_id, dependent: :destroy, inverse_of: :post_type
@@ -12,12 +11,12 @@ module CamaleonCms
     has_many :posts_through_categories, foreign_key: :objectid, through: :term_relationships, source: :object
     has_many :posts_draft, class_name: 'CamaleonCms::Post', foreign_key: :taxonomy_id, dependent: :destroy,
                            inverse_of: :post_type
-    has_many :field_group_taxonomy, lambda {
-                                      where('object_class LIKE ?', 'PostType_%')
-                                    }, class_name: 'CamaleonCms::CustomField', foreign_key: :objectid, dependent: :destroy
+    has_many :field_group_taxonomy, -> { where('object_class LIKE ?', 'PostType_%') },
+             class_name: 'CamaleonCms::CustomField', foreign_key: :objectid, dependent: :destroy, inverse_of: :owner
 
-    belongs_to :owner, class_name: CamaManager.get_user_class_name, foreign_key: :user_id, required: false
-    belongs_to :site, foreign_key: :parent_id, required: false
+    belongs_to :owner, class_name: CamaManager.get_user_class_name.to_s, foreign_key: :user_id, optional: true,
+                       inverse_of: false
+    belongs_to :site, foreign_key: :parent_id, optional: true, inverse_of: :post_types
 
     scope :visible_menu, -> { where(term_group: nil) }
     scope :hidden_menu, -> { where(term_group: -1) }
@@ -92,7 +91,7 @@ module CamaleonCms
     def default_category
       return unless manage_categories?
 
-      cat = categories.find_by_slug('uncategorized')
+      cat = categories.find_by_slug('uncategorized') # rubocop:disable Rails/DynamicFindBy
       unless cat
         cat = categories.create({ name: 'Uncategorized', slug: 'uncategorized', parent_id: id })
         cat.set_option('not_deleted', true)
@@ -110,10 +109,17 @@ module CamaleonCms
     #   summary: String resume (optional)  => default (empty)
     #   post_order: Integer to define the order position in the list (optional)
     #   fields: Hash of values for custom fields, sample => fields: {subtitle: 'abc', icon: 'test' } (optional)
-    #   settings: Hash of post settings, sample => settings:
-    #     {has_content: false, has_summary: true, default_layout: 'my_layout', default_template: 'my_template' } (optional, see more in post.set_setting(...))
+    #   settings: Hash of post settings, sample => settings: (optional, see more in post.set_setting(...))
+    #     {has_content: false, has_summary: true, default_layout: 'my_layout', default_template: 'my_template' }
     #   data_metas: {template: "", layout: ""}
-    # sample: my_posttype.add_post(title: "My Title", post_order: 5, content: 'lorem_ipsum', settings: {default_template: "home/counters", has_content: false, has_seo: false, skip_fields: ["sub_tite", 'banner']}, fields: {pattern: true, bg: 'https://www.reallusion.com/de/images/3dx5/whatsnew/3dx5_features_banner_bg_02.jpg'})
+    # sample:
+    # my_posttype.add_post(
+    #   title: "My Title", post_order: 5, content: 'lorem_ipsum',
+    #   settings: {
+    #     default_template: "home/counters", has_content: false, has_seo: false, skip_fields: ["sub_tite", 'banner']
+    #   },
+    #   fields: { pattern: true, bg: 'https://www.reallusion.com/de/images/3dx5/whatsnew/3dx5_features_banner_bg_02.jpg' }
+    # )
     #   More samples here: https://gist.github.com/owen2345/eba9691585ed78ad6f7b52e9591357bf
     # return created post if it was created, else return errors
     def add_post(args)
@@ -125,7 +131,7 @@ module CamaleonCms
       args[:data_tags] = args.delete(:tags)
       _thumb = args.delete(:thumb)
       p = posts.new(args)
-      p.slug = site.get_valid_post_slug(p.title.parameterize) unless p.slug.present?
+      p.slug = site.get_valid_post_slug(p.title.parameterize) if p.slug.blank?
       if p.save!
         _settings.each { |k, v| p.set_setting(k, v) } if _settings.present?
         p.set_position(_order_position) if _order_position.present?
@@ -139,6 +145,7 @@ module CamaleonCms
     end
 
     # return all available route formats of this post type for content posts
+    # rubocop:disable Layout/LineLength
     def contents_route_formats
       {
         'post_of_post_type' => '<code>/group/:post_type_id-:title/:slug</code><br>  (Sample: https://localhost.com/group/17-services/myservice.html)',
@@ -149,6 +156,7 @@ module CamaleonCms
         'hierarchy_post' => '<code>/:parent1_slug/:parent2_slug/.../:slug</code><br>  (Sample: https://localhost.com/item-1/item-1-1/item-111.html)'
       }
     end
+    # rubocop:enable Layout/LineLength
 
     # return the configuration of routes for post contents
     def contents_route_format
@@ -181,7 +189,7 @@ module CamaleonCms
 
     # destroy all custom field groups assigned to this post type
     def destroy_field_groups
-      if !destroyed_by_association.present? && %w[post page].include?(slug)
+      if destroyed_by_association.blank? && %w[post page].include?(slug)
         errors.add(:base, 'This post type can not be deleted.')
         return false
       end

data/app/models/camaleon_cms/site.rb

@@ -1,32 +1,45 @@
 module CamaleonCms
   class Site < CamaleonCms::TermTaxonomy
-    normalize_attrs(:name, :description)
+    normalize_attrs(:description)
 
     include CamaleonCms::SiteDefaultSettings
 
     # attrs: [name, description, slug]
     attr_accessor :site_domain
 
-    default_scope { where(taxonomy: :site).reorder(term_group: :desc) }
+    # Transient (never persisted): when default_settings auto-provisions the
+    # administrator, it stashes the randomly generated plaintext password here so
+    # the provisioning controller can surface it once. nil when no admin was minted
+    # (e.g. a shared admin already existed). See harden-installer-default-admin.
+    attr_accessor :generated_admin_password
 
-    has_many :post_types, class_name: 'CamaleonCms::PostType', foreign_key: :parent_id, dependent: :destroy
+    has_many :post_types, class_name: 'CamaleonCms::PostType', foreign_key: :parent_id, dependent: :destroy,
+                          inverse_of: :site
     has_many :nav_menus, class_name: 'CamaleonCms::NavMenu', foreign_key: :parent_id, dependent: :destroy,
                          inverse_of: :site
-    has_many :nav_menu_items, class_name: 'CamaleonCms::NavMenuItem', foreign_key: :term_group
-    has_many :widgets, class_name: 'CamaleonCms::Widget::Main', foreign_key: :parent_id, dependent: :destroy
-    has_many :sidebars, class_name: 'CamaleonCms::Widget::Sidebar', foreign_key: :parent_id, dependent: :destroy
-    has_many :user_roles_rel, class_name: 'CamaleonCms::UserRole', foreign_key: :parent_id, dependent: :destroy
+    # inverse_of: false — this joins by term_group (the site id), while NavMenuItem#parent
+    # reads parent_id (the menu id); an inverse here overwrites items' real menu parent.
+    has_many :nav_menu_items, class_name: 'CamaleonCms::NavMenuItem', foreign_key: :term_group, inverse_of: false,
+                              dependent: :destroy
+    has_many :widgets, class_name: 'CamaleonCms::Widget::Main', foreign_key: :parent_id, dependent: :destroy,
+                       inverse_of: :site
+    has_many :sidebars, class_name: 'CamaleonCms::Widget::Sidebar', foreign_key: :parent_id, dependent: :destroy,
+                        inverse_of: :site
+    has_many :user_roles_rel, class_name: 'CamaleonCms::UserRole', foreign_key: :parent_id, dependent: :destroy,
+                              inverse_of: :site
     has_many :custom_field_groups, class_name: 'CamaleonCms::CustomFieldGroup', foreign_key: :parent_id,
-                                   dependent: :destroy
-    has_many :term_taxonomies, class_name: 'CamaleonCms::TermTaxonomy', foreign_key: :parent_id
+                                   dependent: :destroy, inverse_of: :parent
+    has_many :term_taxonomies, class_name: 'CamaleonCms::TermTaxonomy', foreign_key: :parent_id, inverse_of: :parent,
+                               dependent: :destroy
 
     has_many :posts, through: :post_types, source: :posts
-    has_many :plugins, class_name: 'CamaleonCms::Plugin', foreign_key: :parent_id, dependent: :destroy
-    has_many :themes, class_name: 'CamaleonCms::Theme', foreign_key: :parent_id, dependent: :destroy
-    has_many :public_media, -> { where(is_public: true) },
-             class_name: 'CamaleonCms::Media', foreign_key: :site_id, dependent: :destroy
-    has_many :private_media, -> { where(is_public: false) },
-             class_name: 'CamaleonCms::Media', foreign_key: :site_id, dependent: :destroy
+    has_many :plugins, class_name: 'CamaleonCms::Plugin', foreign_key: :parent_id, dependent: :destroy,
+                       inverse_of: :site
+    has_many :themes, class_name: 'CamaleonCms::Theme', foreign_key: :parent_id, dependent: :destroy, inverse_of: :site
+    has_many :public_media, -> { where(is_public: true) }, class_name: 'CamaleonCms::Media', foreign_key: :site_id,
+                                                           dependent: :destroy, inverse_of: :site
+    has_many :private_media, -> { where(is_public: false) }, class_name: 'CamaleonCms::Media', foreign_key: :site_id,
+                                                             dependent: :destroy, inverse_of: :site
 
     after_create :default_settings
     after_create :set_default_user_roles
@@ -35,7 +48,7 @@ module CamaleonCms
     before_destroy :destroy_site
     after_destroy :refresh_routes
 
-    validates_uniqueness_of :slug, scope: :taxonomy
+    validates :slug, uniqueness: { scope: :taxonomy }
 
     # all user roles for this site
     def user_roles
@@ -79,7 +92,7 @@ module CamaleonCms
       options[:_admin_theme] || 'en'
     end
 
-    # set current admin language for this site
+    # Set the current admin language for this site
     def set_admin_language(language)
       set_option('_admin_theme', language)
     end
@@ -149,11 +162,9 @@ module CamaleonCms
 
     # list all users of current site
     def users
-      if PluginRoutes.system_info['users_share_sites']
-        CamaleonCms::User.all
-      else
-        CamaleonCms::User.where(site_id: id)
-      end
+      return CamaleonCms::User.all if PluginRoutes.system_info['users_share_sites']
+
+      CamaleonCms::User.where(site_id: id)
     end
     alias users_include_admins users
 
@@ -176,15 +187,13 @@ module CamaleonCms
     def get_valid_post_slug(slug, post_id = nil)
       slugs = slug.translations
       if slugs.present?
-        slugs.each do |k, v|
-          slugs[k] = get_valid_post_slug(v)
-        end
+        slugs.each { |k, v| slugs[k] = get_valid_post_slug(v) }
         slugs.to_translate
       else
         res = slug
         (1..9999).each do |i|
-          p = posts.find_by_slug(res)
-          break if !p.present? || (p.present? && p.id == post_id)
+          p = posts.find_by_slug(res) # rubocop:disable Rails/DynamicFindBy
+          break if p.blank? || (p.present? && p.id == post_id)
 
           res = "#{slug}-#{i}"
         end
@@ -211,7 +220,7 @@ module CamaleonCms
     # if the anonymous user not exist, will create one
     def get_anonymous_user
       user = users.where(username: 'anonymous').first
-      unless user.present?
+      if user.blank?
         pass = "anonymous#{rand(9999)}"
         user = users.create({ email: 'anonymous_user@local.com', username: 'anonymous', password: pass,
                               password_confirmation: pass, first_name: 'Anonymous' })
@@ -221,7 +230,8 @@ module CamaleonCms
 
     # return the domain for current site
     # sample: mysite.com | sample.mysite.com
-    # also, you can define custom domain for this site by: my_site.site_domain = 'my_site.com' # used for sites with different domains to call from console or task
+    # also, you can define custom domain for this site by: my_site.site_domain = 'my_site.com'
+    # used for sites with different domains to call from console or task
     def get_domain
       @site_domain || (if main_site?
                          slug