camaleon_cms 2.9.2 → 2.9.3

data/app/models/camaleon_cms/term_relationship.rb

@@ -1,23 +1,26 @@
 module CamaleonCms
   class TermRelationship < CamaleonRecord
     self.table_name = "#{PluginRoutes.static_system_info['db_prefix']}term_relationships"
+
     default_scope -> { order(term_order: :asc) }
 
-    belongs_to :term_taxonomy, inverse_of: :term_relationships, required: false
-    belongs_to :object, lambda {
-                          order("#{CamaleonCms::Post.table_name}.id DESC")
-                        }, class_name: 'CamaleonCms::Post', foreign_key: :objectid, inverse_of: :term_relationships, required: false
+    belongs_to :term_taxonomy, inverse_of: :term_relationships, optional: true
+    belongs_to :object, -> { order("#{CamaleonCms::Post.table_name}.id DESC") },
+               class_name: 'CamaleonCms::Post', foreign_key: :objectid, inverse_of: :term_relationships,
+               optional: true
 
-    # callbacks
     after_create :update_count
     before_destroy :update_count
 
     private
 
-    # update counter of post published items
+    # Update the counter of post-published items
     # TODO verify counter
     def update_count
-      term_taxonomy.update_column('count', term_taxonomy.posts.published.size) if term_taxonomy&.try(:posts)
+      return unless term_taxonomy&.try(:posts)
+
+      term_taxonomy
+        .update_column(:count, term_taxonomy.posts.published.size) # rubocop:disable Rails/SkipsModelValidations
     end
   end
 end

data/app/models/camaleon_cms/term_taxonomy.rb

@@ -14,10 +14,57 @@ module CamaleonCms
     end
 
     self.table_name = "#{PluginRoutes.static_system_info['db_prefix']}term_taxonomy"
-    # attr_accessible :taxonomy, :description, :parent_id, :count, :name, :slug, :term_group, :status, :term_order, :user_id
+    # attr_accessible :taxonomy, :description, :parent_id, :count, :name, :slug, :term_group, :status, :term_order,
+    #                 :user_id
     # attr_accessible :data_options
     # attr_accessible :data_metas
 
+    self.inheritance_column = :taxonomy
+
+    def self.sti_name
+      name.demodulize.underscore
+    end
+
+    def self.polymorphic_name
+      name.demodulize
+    end
+
+    def self.find_sti_class(type_name)
+      # Handle explicit exceptions where database string doesn't match namespacing layout
+      case type_name.to_s
+      when 'widget'
+        return CamaleonCms::Widget::Main
+      when 'sidebar'
+        return CamaleonCms::Widget::Sidebar
+      end
+
+      # Standard conversion for "site" -> "CamaleonCms::Site"
+      # or "nav_menu_item" -> "CamaleonCms::NavMenuItem"
+      klass = begin
+        "CamaleonCms::#{type_name.camelize}".constantize
+      rescue NameError
+        nil
+      end
+      # The ancestry guard keeps a value like "meta" from instantiating an unrelated
+      # CamaleonCms class against the term_taxonomy table.
+      return klass if klass && klass <= base_class
+
+      # Runtime scan across loaded taxonomy models.
+      found = CamaleonCms::TermTaxonomy.descendants.find { |k| k.sti_name == type_name.to_s }
+      return found if found
+
+      # `super` resolves fully-qualified external classes (plugin STI outside the CamaleonCms
+      # namespace) and enforces ancestry — the scan above only sees classes already loaded, so
+      # without this an unloaded plugin taxonomy silently degraded to the base class. Same
+      # fallback PostDefault.find_sti_class keeps. Values it cannot place load as the base class,
+      # as every row did before native STI.
+      begin
+        super
+      rescue ActiveRecord::SubclassNotFound
+        base_class
+      end
+    end
+
     # callbacks
     before_validation :before_validating
     before_destroy :destroy_dependencies
@@ -27,11 +74,12 @@ module CamaleonCms
     validates_with CamaleonCms::UniqValidator
 
     # relations
-    has_many :term_relationships, class_name: 'CamaleonCms::TermRelationship', foreign_key: :term_taxonomy_id,
+    has_many :term_relationships, class_name: 'CamaleonCms::TermRelationship',
                                   dependent: :destroy
     # has_many :posts, foreign_key: :objectid, through: :term_relationships, :source => :objects
-    belongs_to :parent, class_name: 'CamaleonCms::TermTaxonomy', foreign_key: :parent_id, required: false
-    belongs_to :owner, class_name: CamaManager.get_user_class_name, foreign_key: :user_id, required: false
+    belongs_to :parent, class_name: 'CamaleonCms::TermTaxonomy', optional: true
+    belongs_to :owner, class_name: CamaManager.get_user_class_name.to_s, foreign_key: :user_id, optional: true,
+                       inverse_of: false
 
     # return all children taxonomy
     # sample: sub categories of a category

data/app/models/camaleon_cms/theme.rb

@@ -1,12 +1,10 @@
 module CamaleonCms
   class Theme < CamaleonCms::TermTaxonomy
-    normalize_attrs(:name, :description)
+    normalize_attrs(:description)
 
     # attrs:
     #   slug => plugin key
-    belongs_to :site, class_name: 'CamaleonCms::Site', foreign_key: :parent_id, required: false
-
-    default_scope { where(taxonomy: :theme) }
+    belongs_to :site, class_name: 'CamaleonCms::Site', foreign_key: :parent_id, optional: true, inverse_of: :themes
 
     before_validation :fix_name
     before_destroy :destroy_custom_fields

data/app/models/camaleon_cms/user.rb

@@ -1,22 +1,34 @@
-unless PluginRoutes.static_system_info['user_model'].present?
+if PluginRoutes.static_system_info['user_model'].blank?
   module CamaleonCms
     class User < CamaleonRecord
       include CamaleonCms::UserMethods
 
-      self.table_name = PluginRoutes.static_system_info['cama_users_db_table'] || "#{PluginRoutes.static_system_info['db_prefix']}users"
+      self.table_name = PluginRoutes.static_system_info['cama_users_db_table'] ||
+                        "#{PluginRoutes.static_system_info['db_prefix']}users"
 
       default_scope { order(role: :asc) }
 
+      # No `dependent:` — a deleted user's widgets keep rendering; only the owner is gone.
+      has_many :widgets, class_name: 'CamaleonCms::Widget::Main', # rubocop:disable Rails/HasManyOrHasOneDependent
+                         inverse_of: :owner
+
       validates :username, presence: true
-      validates :email, presence: true, format: { with: /\A[\w+\-.]+@[a-z\d\-.]+\.[a-z]+\z/i } # , :unless => Proc.new { |a| a.auth_social.present? }
+      # The following might be continued wit: , :unless => Proc.new { |a| a.auth_social.present? }
+      validates :email, presence: true, format: { with: /\A[\w+\-.]+@[a-z\d\-.]+\.[a-z]+\z/i }
       has_secure_password
+      # Security (audit 2026-08-11 M15): has_secure_password only validates presence (on create) and the
+      # 72-byte bcrypt maximum, so a trivially short password was accepted. Enforce a minimum length
+      # whenever a password is actually set (create, reset, change). allow_blank leaves an update that
+      # submits no password untouched (a blank field is not a change), and lets has_secure_password's own
+      # presence check own the empty-on-create case.
+      validates :password, length: { minimum: 8 }, allow_blank: true
 
       def self.find_by_email(email)
-        where(['lower(email) = ?', email.to_s.downcase]).take
+        find_by(['lower(email) = ?', email.to_s.downcase])
       end
 
       def self.find_by_username(username)
-        where(['lower(username) = ?', username.to_s.downcase]).take
+        find_by(['lower(username) = ?', username.to_s.downcase])
       end
     end
   end

data/app/models/camaleon_cms/user_role.rb

@@ -1,12 +1,15 @@
 module CamaleonCms
   class UserRole < CamaleonCms::TermTaxonomy
-    normalize_attrs(:name, :description)
+    normalize_attrs(:description)
 
-    after_destroy :set_users_as_cilent
+    def self.sti_name
+      'user_roles'
+    end
 
-    default_scope { where(taxonomy: :user_roles) }
+    after_destroy :set_users_as_cilent
 
-    belongs_to :site, class_name: 'CamaleonCms::Site', foreign_key: :parent_id, required: false
+    belongs_to :site, class_name: 'CamaleonCms::Site', foreign_key: :parent_id, optional: true,
+                      inverse_of: :user_roles_rel
 
     def roles_post_type
       get_meta('_post_type')
@@ -20,6 +23,23 @@ module CamaleonCms
       term_group.nil?
     end
 
+    # Users in a role slugged `admin` are administrators: `User#admin?` tests exactly this, and
+    # `Ability#initialize` answers `can :manage, :all` for them and returns before this role's
+    # `_post_type_`/`_manager_` metas are read. Those metas therefore describe nothing — every
+    # permission is held whatever they say.
+    def grants_all_permissions?
+      slug == 'admin'
+    end
+
+    # Whether the permission checkboxes mean anything. False for the default admin role, which is not
+    # editable at all, and false for any other role slugged `admin`, whose permissions cannot be
+    # withheld from its users. The editor renders them locked and the controller declines to write
+    # them, so the two cannot disagree — and a locked checkbox, which the browser does not submit,
+    # can never silently clear what is stored.
+    def permissions_editable?
+      editable? && !grants_all_permissions?
+    end
+
     ROLES = {
       post_type: [
         {
@@ -81,6 +101,14 @@ module CamaleonCms
           label: I18n.t('camaleon_cms.admin.users.roles_values.html_manage_tags').to_s,
           color: 'warning',
           description: I18n.t('camaleon_cms.admin.users.tool_tip.manage_tags').to_s
+        },
+        {
+          key: 'post_content_unfiltered_html',
+          label: I18n.t('camaleon_cms.admin.users.roles_values.post_content_unfiltered_html',
+                        default: 'Allow unfiltered HTML in post content').to_s,
+          color: 'danger',
+          description: I18n.t('camaleon_cms.admin.users.tool_tip.post_content_unfiltered_html',
+                              default: 'Permit users with this role to save raw/unfiltered HTML in post content').to_s
         }
       ],
       manager: [
@@ -133,12 +161,44 @@ module CamaleonCms
         {
           key: 'select_eval',
           label: I18n.t('camaleon_cms.admin.custom_field.select_eval', default: 'Select Eval').to_s,
-          description: I18n.t('camaleon_cms.admin.users.tool_tip.select_eval', default: 'Allow toggling and using select_eval custom fields in the admin UI.').to_s
+          description: I18n.t(
+            'camaleon_cms.admin.users.tool_tip.select_eval',
+            default: 'Allow toggling and using select_eval custom fields in the admin UI.'
+          ).to_s
         },
         {
           key: 'theme_settings',
           label: I18n.t('camaleon_cms.admin.settings.theme_setting', default: 'Theme Settings').to_s,
           description: I18n.t('camaleon_cms.admin.users.tool_tip.themes').to_s
+        },
+        {
+          key: 'contact_form_unfiltered_html',
+          label: I18n.t('camaleon_cms.admin.users.roles_values.contact_form_unfiltered_html',
+                        default: 'Allow unfiltered HTML in contact forms').to_s,
+          color: 'danger',
+          description: I18n.t(
+            'camaleon_cms.admin.users.tool_tip.contact_form_unfiltered_html',
+            default: 'Permit users with this role to save raw/unfiltered HTML anywhere in a contact form: the ' \
+                     'markup wrapping a form, field labels, descriptions, templates, CSS classes, default ' \
+                     'values, custom attributes, option labels and response messages. Without it, a save ' \
+                     'carrying such content is refused rather than cleaned up. Distinct from the per-post-type ' \
+                     '"Allow unfiltered HTML in post content" permission.'
+          ).to_s
+        },
+        {
+          key: 'media_unfiltered_upload',
+          label: I18n.t('camaleon_cms.admin.users.roles_values.media_unfiltered_upload',
+                        default: 'Allow unscanned media uploads').to_s,
+          color: 'danger',
+          description: I18n.t(
+            'camaleon_cms.admin.users.tool_tip.media_unfiltered_upload',
+            default: 'Permit users with this role to upload files without the malicious-content scan. Without ' \
+                     'it, every upload is scanned whatever its source, and a file carrying scripts, event ' \
+                     'handlers, blocked elements or blocked URI schemes is refused rather than cleaned up. ' \
+                     'Uploaded files are served from the site origin, so this grants the ability to publish ' \
+                     'active content there. Site-wide, unlike the per-post-type "Allow unfiltered HTML in post ' \
+                     'content" permission.'
+          ).to_s
         }
       ]
     }.freeze
@@ -146,7 +206,7 @@ module CamaleonCms
     private
 
     def set_users_as_cilent
-      site.users.where(role: slug).update_all(role: 'client')
+      site.users.where(role: slug).update_all(role: 'client') # rubocop:disable Rails/SkipsModelValidations
     end
   end
 end

data/app/models/camaleon_cms/widget/assigned.rb

@@ -1,7 +1,12 @@
 module CamaleonCms
   module Widget
     class Assigned < CamaleonCms::PostDefault
-      default_scope -> { where(post_class: name).order(:taxonomy_id) }
+      default_scope -> { order(:taxonomy_id) }
+
+      def self.type_condition(table = arel_table)
+        super.or(table[inheritance_column].eq(name))
+      end
+
       # post_parent: sidebar_id
       # visibility: widget_id
       # comment_count: item_order
@@ -12,11 +17,11 @@ module CamaleonCms
 
       # attr_accessible :widget_id, :sidebar_id, :item_order
 
-      has_many :metas, lambda {
-                         where(object_class: 'Widget::Assigned')
-                       }, class_name: 'CamaleonCms::Meta', foreign_key: :objectid, dependent: :destroy
-      belongs_to :sidebar, class_name: 'CamaleonCms::Widget::Sidebar', foreign_key: :post_parent
-      belongs_to :widget, class_name: 'CamaleonCms::Widget::Main', foreign_key: :visibility
+      belongs_to :sidebar, class_name: 'CamaleonCms::Widget::Sidebar', foreign_key: :post_parent, inverse_of: :assigned,
+                           optional: true
+      belongs_to :widget, class_name: 'CamaleonCms::Widget::Main', foreign_key: :visibility, inverse_of: :assigned,
+                          optional: true
+
       after_initialize :fix_slug2
       before_create :set_order
 

data/app/models/camaleon_cms/widget/main.rb

@@ -1,9 +1,10 @@
 module CamaleonCms
   module Widget
     class Main < CamaleonCms::TermTaxonomy
-      normalize_attrs(:name)
+      def self.sti_name
+        'widget'
+      end
 
-      default_scope { where(taxonomy: :widget) }
       # attr_accessible :excerpt, :renderer
       # name: "title"
       # description: "content for this"
@@ -12,14 +13,17 @@ module CamaleonCms
       # excerpt: string for message
       # renderer: string (path to the template for render this widget)
 
-      has_many :metas, lambda {
-                         where(object_class: 'Widget::Main')
-                       }, class_name: 'CamaleonCms::Meta', foreign_key: :objectid, dependent: :destroy
-      belongs_to :owner, class_name: CamaManager.get_user_class_name, foreign_key: :user_id
-      belongs_to :site, class_name: 'CamaleonCms::Site', foreign_key: :parent_id
+      # inverse_of: false — custom `user_model` classes get only UserMethods, which
+      # defines no `widgets` collection the inverse could point at.
+      belongs_to :owner, class_name: CamaManager.get_user_class_name.to_s, foreign_key: :user_id, inverse_of: false,
+                         optional: true
+      belongs_to :site, class_name: 'CamaleonCms::Site', foreign_key: :parent_id, inverse_of: :widgets, optional: true
+
+      has_many :assigned, class_name: 'CamaleonCms::Widget::Assigned', foreign_key: :visibility, dependent: :destroy,
+                          inverse_of: :widget
 
-      has_many :assigned, class_name: 'CamaleonCms::Widget::Assigned', foreign_key: :visibility, dependent: :destroy
       before_save :check_excerpt
+
       def is_simple?
         status == 'simple'
       end

data/app/models/camaleon_cms/widget/sidebar.rb

@@ -1,15 +1,10 @@
 module CamaleonCms
   module Widget
     class Sidebar < CamaleonCms::TermTaxonomy
-      normalize_attrs(:name, :description)
+      normalize_attrs(:description)
 
-      default_scope { where(taxonomy: :sidebar) }
-
-      has_many :metas, lambda {
-                         where(object_class: 'Widget::Sidebar')
-                       }, class_name: 'CamaleonCms::Meta', foreign_key: :objectid, dependent: :destroy
-      has_many :assigned, foreign_key: :post_parent, dependent: :destroy
-      belongs_to :site, class_name: 'CamaleonCms::Site', foreign_key: :parent_id
+      has_many :assigned, foreign_key: :post_parent, dependent: :destroy, inverse_of: :sidebar
+      belongs_to :site, class_name: 'CamaleonCms::Site', foreign_key: :parent_id, inverse_of: :sidebars, optional: true
 
       # scopes
       scope :default_sidebar, -> { where(slug: 'default-sidebar') }

data/app/models/camaleon_record.rb

@@ -1,16 +1,60 @@
 # frozen_string_literal: true
 
-class CamaleonRecord < ActiveRecord::Base
-  TRANSLATION_TAG_HIDE_MAP = { '<!--' => '!--', '-->' => '--!' }.freeze
+class CamaleonRecord < ActiveRecord::Base # rubocop:disable Rails/ApplicationRecord
+  # Sentinels used to shield HTML comment delimiters (the translation locale markers such as `<!--:en-->`)
+  # from ActionController's sanitize(), which strips HTML comments. Private-Use-Area code points are used so
+  # that plain text typed by a user can never be rewritten into a comment delimiter after sanitization: the
+  # previous `!--`/`--!` tokens collided with ordinary text (e.g. "Read more !--"), so the restore pass would
+  # inject stray `<!--`/`-->` into the output. The hide map also strips any raw sentinel characters supplied
+  # in the input, so they cannot be smuggled through to become delimiters on restore.
+  TRANSLATION_TAG_HIDE_SENTINELS = { open: "\u{E000}", close: "\u{E001}" }.freeze
+  TRANSLATION_TAG_HIDE_MAP = {
+    '<!--' => TRANSLATION_TAG_HIDE_SENTINELS[:open],
+    '-->' => TRANSLATION_TAG_HIDE_SENTINELS[:close],
+    TRANSLATION_TAG_HIDE_SENTINELS[:open] => '',
+    TRANSLATION_TAG_HIDE_SENTINELS[:close] => ''
+  }.freeze
   TRANSLATION_TAG_HIDE_REGEX = Regexp.new(TRANSLATION_TAG_HIDE_MAP.keys.map { |x| Regexp.escape(x) }.join('|')).freeze
-  TRANSLATION_TAG_RESTORE_MAP = { '--!' => '-->', '!--' => '<!--' }.freeze
+  TRANSLATION_TAG_RESTORE_MAP = {
+    TRANSLATION_TAG_HIDE_SENTINELS[:open] => '<!--',
+    TRANSLATION_TAG_HIDE_SENTINELS[:close] => '-->'
+  }.freeze
   TRANSLATION_TAG_RESTORE_REGEX =
     Regexp.new(TRANSLATION_TAG_RESTORE_MAP.keys.map { |x| Regexp.escape(x) }.join('|')).freeze
 
-  include ActiveRecordExtras::Relation
-
   self.abstract_class = true
 
+  # Sanitize a value with ActionController's sanitize() while preserving translation locale markers
+  # (<!--:xx-->). Shared by Post#sanitize_content and the NormalizeAttrs concern so the transform lives in
+  # one place. Returns nil unchanged. `tags:`/`attributes:` default to nil, i.e. the sanitizer's own
+  # allowlist, so NormalizeAttrs and other callers are unaffected; Post#content passes a widened list.
+  def self.cama_sanitize_translatable(value, tags: nil, attributes: nil)
+    return value if value.nil?
+
+    options = {}
+    options[:tags] = tags if tags
+    options[:attributes] = attributes if attributes
+    ActionController::Base.helpers.sanitize(
+      value.to_s.gsub(TRANSLATION_TAG_HIDE_REGEX, TRANSLATION_TAG_HIDE_MAP), **options
+    ).gsub(TRANSLATION_TAG_RESTORE_REGEX, TRANSLATION_TAG_RESTORE_MAP)
+  end
+
+  def self.polymorphic_name
+    return super unless name.to_s.start_with?('CamaleonCms::')
+
+    name.demodulize
+  end
+
+  def self.polymorphic_class_for(name)
+    super
+  rescue NameError
+    legacy_class = legacy_camaleon_polymorphic_class(name)
+    return legacy_class if legacy_class
+    return nil if legacy_polymorphic_marker?(name)
+
+    raise
+  end
+
   # save cache value for this key
   def cama_set_cache(key, val)
     @cama_cache_vars ||= {}
@@ -20,6 +64,8 @@ class CamaleonRecord < ActiveRecord::Base
 
   # remove cache value for this key
   def cama_remove_cache(key)
+    return unless @cama_cache_vars
+
     @cama_cache_vars.delete(cama_build_cache_key(key))
   end
 
@@ -83,4 +129,42 @@ class CamaleonRecord < ActiveRecord::Base
 
     @current_site = CurrentRequest.site
   end
+
+  def self.legacy_camaleon_polymorphic_class(name)
+    class_name = name.to_s
+    return if class_name.blank?
+
+    candidates = []
+
+    unless class_name.include?('::')
+      candidates << "CamaleonCms::#{class_name}"
+
+      if class_name.include?('_')
+        base_name = class_name.split('_').first
+        candidates << "CamaleonCms::#{base_name}" if base_name.present?
+      end
+
+      candidates << CamaManager.get_user_class_name.to_s if class_name == 'User'
+    end
+
+    candidates << "CamaleonCms::#{class_name}" if class_name.include?('::') && !class_name.start_with?('CamaleonCms::')
+
+    candidates.uniq.each do |candidate|
+      next unless valid_constant_name?(candidate)
+
+      klass = candidate.safe_constantize
+      return klass if klass
+    end
+
+    nil
+  end
+  private_class_method def self.legacy_polymorphic_marker?(name)
+    name.to_s.start_with?('_')
+  end
+
+  private_class_method def self.valid_constant_name?(name)
+    name.to_s.match?(/\A[A-Z]\w*(::[A-Z]\w*)*\z/)
+  end
+
+  private_class_method :legacy_camaleon_polymorphic_class
 end

data/app/models/concerns/camaleon_cms/categories_tags_for_posts.rb

@@ -24,7 +24,7 @@ module CamaleonCms
     # update category assignations for this post
     # remove assignations that no longer exist
     # add new assignations
-    # cats: (Array) array of category ids assigned for this post, sample: [1,2,3]
+    # cats: (Array) array of category ids assigned for this post, sample: [1, 2, 3]
     def update_categories(cats = [])
       rescue_extra_data
       cats = cats.to_i
@@ -35,7 +35,7 @@ module CamaleonCms
       news_categories.each do |key|
         term_relationships.create(term_taxonomy_id: key)
       end
-      update_counters('categories')
+      update_counts('categories')
     end
 
     # update tags assignations for this post
@@ -53,7 +53,7 @@ module CamaleonCms
         post_tag = post_type.post_tags.where({ name: f }).first_or_create(slug: f.parameterize)
         term_relationships.where({ term_taxonomy_id: post_tag.id }).first_or_create
       end
-      update_counters('tags')
+      update_counts('tags')
     end
 
     # Assign this post for category with id: category_id
@@ -64,43 +64,25 @@ module CamaleonCms
       categories_id.each do |key|
         term_relationships.where(term_taxonomy_id: key).first_or_create!
       end
-      update_counters('categories')
+      update_counts('categories')
     end
 
-    # Assign this post for category with id: category_id
-    # categories_id: (Array) array of category ids assigned for this post, sample: [1,2,3]
+    # Unassign this post from categories with ids: categories_id
+    # categories_id: (Array) array of category ids to unassign from this post, sample: [1,2,3]
     def unassign_category(categories_id)
       categories_id = [categories_id] if categories_id.is_a?(Integer)
+      # a loaded (stale) categories association would hide the removed ids from the
+      # counter refresh below — check_default_category loads it on every save
+      categories.reset
       rescue_extra_data
       term_relationships.where(term_taxonomy_id: categories_id).destroy_all
-      update_counters('categories')
-    end
-
-    # Assign new tags to this post
-    # tags_title: (String) tags name separated by commas, sample: "Tag1,Tag two,tag new"
-    def assign_tags(tag_titles)
-      update_counters_before
-      tags = tag_titles.split(',').strip
-      tags.each do |t|
-        post_tag = post_type.post_tags.where(name: t).first_or_create!
-        term_relationships.where({ term_taxonomy_id: post_tag.id }).first_or_create!
-      end
-      update_counters('tags')
-    end
-
-    # Unassign tags from this post
-    # tags_title: (String) tags name separated by commas, sample: "Tag1,Tag two,tag new"
-    def unassign_tags(tag_titles)
-      update_counters_before
-      tags = tag_titles.split(',').strip
-      term_relationships.where({ term_taxonomy_id: post_type.post_tags.where(name: tags).pluck(:id) }).destroy_all
-      update_counters('tags')
+      update_counts('categories')
     end
 
-    # update quantity of posts assigned for tags and categories assigned to this post
+    # Update the quantity of posts assigned for tags and categories assigned to this post
     def update_extra_data
       rescue_extra_data
-      update_counters
+      update_counts
     end
 
     private
@@ -113,23 +95,23 @@ module CamaleonCms
       @tags_before = post_tags.pluck(:id) if manage_tags?
     end
 
-    # update quantity of posts assigned for tags and categories assigned to this post
+    # Update the quantity of posts assigned for tags and categories assigned to this post
     # if kind is empty, then this will update both: cats and tags
     # kind: (string) tags | categories
-    def update_counters(kind = '')
+    def update_counts(kind = '')
       if ['', 'categories'].include?(kind) && manage_categories?
-        post_type.full_categories.where(id: (@cats_before + categories.pluck(:id)).uniq).each do |c|
-          c.update_column('count', c.posts.published.size)
+        post_type.full_categories.where(id: (@cats_before + categories.pluck(:id)).uniq).find_each do |c|
+          c.update_column(:count, c.posts.published.size) # rubocop:disable Rails/SkipsModelValidations
         end
       end
       return unless ['', 'tags'].include?(kind) && manage_tags?
 
-      post_type.post_tags.where(id: (@tags_before + post_tags.pluck(:id)).uniq).each do |tag|
-        tag.update_column('count', tag.posts.published.size)
+      post_type.post_tags.where(id: (@tags_before + post_tags.pluck(:id)).uniq).find_each do |tag|
+        tag.update_column(:count, tag.posts.published.size) # rubocop:disable Rails/SkipsModelValidations
       end
     end
 
-    # save extra data such as: categories and tags assigned to this post
+    # Save extra data such as categories and tags assigned to this post
     def save_extra_data
       update_categories(data_categories) if manage_categories? && !data_categories.nil?
       update_tags(data_tags) if manage_tags? && !data_tags.nil?
@@ -139,7 +121,7 @@ module CamaleonCms
     def check_default_category
       return unless manage_categories?
 
-      assign_category([post_type.default_category.id]) unless categories.present?
+      assign_category([post_type.default_category.id]) if categories.blank?
     end
   end
 end

data/app/models/concerns/camaleon_cms/common_relationships.rb

@@ -3,22 +3,35 @@
 module CamaleonCms
   module CommonRelationships
     extend ActiveSupport::Concern
+    # rubocop:disable Rails/InverseOf
 
     included do
-      class_name = name.demodulize
-      has_many :metas, -> { where(object_class: class_name) },
+      # Scopes use the demodulized class name (the 2.9.2 contract every install's rows were
+      # written under): 'Post', 'Main' for Widget::Main, and 'User' for a host Admin::User.
+      # to_s tolerates anonymous subclasses (STI specs build them), whose name is nil.
+      object_class_name = name.to_s.demodulize
+      has_many :metas, -> { where(object_class: object_class_name) },
                class_name: 'CamaleonCms::Meta', foreign_key: :objectid, dependent: :destroy
 
-      has_many :custom_field_values, -> { where(object_class: class_name) },
+      has_many :custom_field_values, -> { where(object_class: object_class_name) },
                class_name: 'CamaleonCms::CustomFieldsRelationship', foreign_key: :objectid, dependent: :delete_all
 
-      has_many :custom_fields, -> { where(object_class: class_name) },
+      # No dependent: on the definition associations (2.9.2 behavior). Teardown is owned by
+      # CustomFieldsRead#_destroy_custom_field_groups, which runs first and destroys groups WITH
+      # callbacks; a dependent here is inert at best, and on hook-less includers (PostComment) a
+      # delete_all removed group rows while orphaning their fields and option metas. A :destroy
+      # cascade is no alternative: custom_fields matches group rows too (same table, same scope)
+      # but its CustomField typing would skip group teardown.
+      # rubocop:disable Rails/HasManyOrHasOneDependent
+      has_many :custom_fields, -> { where(object_class: object_class_name) },
                class_name: 'CamaleonCms::CustomField', foreign_key: :objectid
 
       # valid only for simple groups and not for complex like: posts, post, ... where the group is for individual or
       # children groups
-      has_many :custom_field_groups, -> { where(object_class: class_name) },
+      has_many :custom_field_groups, -> { where(object_class: object_class_name) },
                class_name: 'CamaleonCms::CustomFieldGroup', foreign_key: :objectid
+      # rubocop:enable Rails/HasManyOrHasOneDependent
     end
+    # rubocop:enable Rails/InverseOf
   end
 end