camaleon_cms 2.9.2 → 2.9.3

data/app/models/concerns/camaleon_cms/custom_fields_read.rb

@@ -35,21 +35,29 @@ module CamaleonCms
       when 'Post'
         if term_relationships.empty? && args[:cat_ids].nil?
           CamaleonCms::CustomFieldGroup.where(
-            '(objectid = ? AND object_class = ?) OR (objectid = ? AND object_class = ?)', id || -1, class_name, post_type.id, "PostType_#{class_name}"
+            '(objectid = ? AND object_class = ?) OR (objectid = ? AND object_class = ?)',
+            id || -1, class_name, post_type.id, "PostType_#{class_name}"
           )
         else
           cat_ids = categories.map(&:id)
           cat_ids += args[:cat_ids] unless args[:cat_ids].nil?
           cat_ids += CamaleonCms::Category.find(cat_ids).map { |category| _category_parents_ids(category) }.flatten.uniq
-          CamaleonCms::CustomFieldGroup.where("(objectid = ? AND object_class = ?) OR
-                                               (objectid = ? AND object_class = ?) OR
-                                               (objectid IN (?) AND object_class = ?)",
-                                              id || -1, class_name,
-                                              post_type.id, "PostType_#{class_name}",
-                                              cat_ids, "Category_#{class_name}")
+          CamaleonCms::CustomFieldGroup.where(
+            "(objectid = ? AND object_class = ?) OR
+             (objectid = ? AND object_class = ?) OR
+             (objectid IN (?) AND object_class = ?)",
+            id || -1, class_name, post_type.id, "PostType_#{class_name}", cat_ids, "Category_#{class_name}"
+          )
         end
       when 'NavMenuItem'
         main_menu.custom_field_groups
+      when 'Site'
+        # Site overrides `custom_field_groups` to mean "every group this site owns" (foreign key
+        # parent_id), unlike the object_class + objectid association every other model receives from
+        # CommonRelationships. Scoping by placement here keeps groups meant for post types, themes or
+        # menus off the site settings form, where their required fields blocked the submit and their
+        # values were discarded on save anyway.
+        custom_field_groups.where(object_class: 'Site', objectid: id)
       when 'PostType'
         case args[:kind]
         when 'all'
@@ -69,7 +77,9 @@ module CamaleonCms
     # return collections CustomFieldGroup
     # site: site object
     def get_user_field_groups(site)
-      site.custom_field_groups.where(object_class: self.class.to_s.parseCamaClass)
+      # Demodulized to match the association scope and the placement the settings form stores
+      # ('User' for a host Admin::User); parseCamaClass still strips a Draper Decorator suffix.
+      site.custom_field_groups.where(object_class: self.class.to_s.parseCamaClass.demodulize)
     end
 
     # get custom field value
@@ -82,7 +92,7 @@ module CamaleonCms
       rescue StandardError
         _default
       end
-      v.present? ? v : _default
+      v.presence || _default
     end
     alias get_field get_field_value
     alias get_field! get_field_value
@@ -117,12 +127,12 @@ module CamaleonCms
     #   puts res[0]['my_slug1'].first ==> "val 1"
     def get_fields_grouped(field_keys)
       res = []
-      custom_field_values.where(custom_field_slug: field_keys).order(group_number: :asc).group_by(&:group_number).each_value do |group_fields|
-        group = {}
-        field_keys.each do |field_key|
-          _tmp = []
-          group_fields.each { |field| _tmp << field.value if field_key == field.custom_field_slug }
-          group[field_key] = _tmp if _tmp.present?
+      custom_field_values.where(custom_field_slug: field_keys)
+                         .order(group_number: :asc).group_by(&:group_number).each_value do |group_fields|
+        group = field_keys.each_with_object({}) do |field_key, hsh|
+          _tmp = group_fields
+                 .each_with_object([]) { |field, ary| ary << field.value if field_key == field.custom_field_slug }
+          hsh[field_key] = _tmp if _tmp.present?
         end
         res << group
       end
@@ -131,7 +141,8 @@ module CamaleonCms
 
     # return all values
     # {key1: "single value", key2: [multiple, values], key3: value4} if include_options = false
-    # {key1: {values: "single value", options: {a:1, b: 4}}, key2: {values: [multiple, values], options: {a=1, b=2} }} if include_options = true
+    # {key1: {values: "single value", options: {a:1, b: 4}}, key2: {values: [multiple, values], options: {a=1, b=2} }}
+    # if include_options = true
     def get_field_values_hash(include_options = false)
       fields = {}
       custom_field_values.to_a.uniq.each do |field_value|
@@ -159,9 +170,10 @@ module CamaleonCms
         custom_field = field_value.custom_field
         # if custom_field.options[:show_frontend].to_s.to_bool
         values = custom_field.values.where(objectid: id).pluck(:value)
-        fields[field_value.custom_field_slug] =
-          custom_field.attributes.merge(options: custom_field.cama_options,
-                                        values: custom_field.cama_options[:multiple].to_s.to_bool ? values : values.first)
+        fields[field_value.custom_field_slug] = custom_field.attributes.merge(
+          options: custom_field.cama_options,
+          values: custom_field.cama_options[:multiple].to_s.to_bool ? values : values.first
+        )
         # end
       end
       fields.to_sym
@@ -179,10 +191,11 @@ module CamaleonCms
     #     post_type.add_custom_field_group(values, kind = "Category")
     # Note 2: If you need add fields for only the Post_type, you have to use options or metas
     # return: CustomFieldGroup object
-    # kind: argument only for PostType model: (Post | Category | PostTag), default => Post. If kind = "" this will add group for all post_types
+    # kind: argument only for PostType model: (Post | Category | PostTag), default => Post.
+    # If kind = "" this will add group for all post_types
     def add_custom_field_group(values, kind = 'Post')
       values = values.with_indifferent_access
-      group = get_field_groups(kind).find_by(slug: values[:slug])
+      group = get_field_groups(kind).find_by_slug(values[:slug]) # rubocop:disable Rails/DynamicFindBy
       unless group
         site = _cama_get_field_site
         values[:parent_id] = site.id if site.present?
@@ -202,7 +215,7 @@ module CamaleonCms
     # more details in add_manual_field(item, options) from custom field groups
     # kind: argument only for PostType model: (Post | Category | PostTag), default => Post
     def add_custom_field_to_default_group(item, options, kind = 'Post')
-      g = get_field_groups(kind).find_by(slug: '_default')
+      g = get_field_groups(kind).find_by_slug('_default') # rubocop:disable Rails/DynamicFindBy
       g ||= add_custom_field_group({ name: 'Default Field Group', slug: '_default' }, kind)
       g.add_manual_field(item, options)
     end
@@ -210,13 +223,8 @@ module CamaleonCms
 
     # return field object for current model
     def get_field_object(slug)
-      CamaleonCms::CustomField.where(
-        slug: slug,
-        parent_id: get_field_groups.pluck(:id)
-      ).first || CamaleonCms::CustomField.where(
-        slug: slug,
-        parent_id: get_field_groups({ include_parent: true })
-      ).first
+      CamaleonCms::CustomField.where(slug: slug, parent_id: get_field_groups.pluck(:id)).first ||
+        CamaleonCms::CustomField.where(slug: slug, parent_id: get_field_groups({ include_parent: true })).first
     end
 
     # save all fields sent from browser (reservated for browser request)
@@ -226,28 +234,57 @@ module CamaleonCms
     #   "1"=>{ "untitled-text-box"=>{"id"=>"262", "values"=>{"0"=>"33333"}}}
     # }
     def set_field_values(datas = {})
-      return unless datas.present?
+      return if datas.blank?
 
       ActiveRecord::Base.transaction do
+        # A value identical to one already stored is not newly authored, so it must not be re-gated on
+        # an unrelated edit (audit M8): the admin form round-trips every value and this method
+        # delete/recreates them all, so without this skip a single pre-gate dangerous value would fail
+        # the whole save and brick every later edit -- the trap Post#reject_untrusted_dangerous_content
+        # avoids via content_changed?. Snapshot the stored pairs before clearing; skip the gate for any
+        # recreated value that matches one.
+        previously_stored = custom_field_values.pluck(:custom_field_slug, :value).to_set
         custom_field_values.delete_all
         datas.each_value do |fields_data|
           fields_data.each do |field_key, values|
-            next unless values[:values].present?
+            next if values[:values].blank?
+
+            # Resolve the field id from the trusted slug, not the client-supplied values[:id]: a
+            # forged custom_field_id points the row at a different field definition, and the
+            # scan-and-reject gate keys off custom_field.options[:field_key] -- so a forged non-gated
+            # id would slip markup past the gate for a gated (editor/uri/field_attrs) slug. Fall back
+            # to values[:id] only when the slug names no field here (trusted/internal callers that
+            # pass slugs outside this object's registered groups; permitted browser payloads never do).
+            field_id = get_field_object(field_key)&.id || fallback_field_id_for(field_key) || values[:id]
+            group_number = [values[:group_number].to_i, 0].max
 
             order_value = -1
-            (values[:values].is_a?(Hash) || values[:values].is_a?(ActionController::Parameters) ? values[:values].values : values[:values]).each do |value|
-              custom_field_values.create!({ custom_field_id: values[:id], custom_field_slug: field_key,
-                                            value: fix_meta_value(value), term_order: order_value += 1, group_number: values[:group_number] || 0 })
+            (
+              if values[:values].is_a?(Hash) || values[:values].is_a?(ActionController::Parameters)
+                values[:values].values
+              else
+                values[:values]
+              end
+            ).each do |value|
+              row = custom_field_values.new(
+                custom_field_id: field_id, custom_field_slug: field_key,
+                value: fix_meta_value(value), term_order: order_value += 1, group_number: group_number
+              )
+              row.unfiltered_value! if previously_stored.include?([field_key.to_s, row.value])
+              row.save!
             end
           end
         end
       end
     end
 
-    # update new value for field with slug _key
+    # Update the value for the field with slug _key
     # Sample: my_posy.update_field_value('sub_title', 'Test Sub Title')
-    def update_field_value(_key, value = nil, group_number = 0)
-      custom_field_values.find_by(custom_field_slug: _key, group_number: group_number)&.update_column('value', value)
+    def update_field_value(key, value = nil, group_number = 0)
+      # Route through validations so the scan-and-reject gate applies (audit M5): update_column
+      # skipped it, letting a dangerous value an untrusted caller supplies reach the frontend verbatim.
+      custom_field_values.find_by(custom_field_slug: key, group_number: group_number)
+                         &.update(value: value)
     rescue StandardError
       nil
     end
@@ -262,45 +299,65 @@ module CamaleonCms
 
     # Set custom field values for current model (support for multiple group values)
     # key: (string required) slug of the custom field
-    # value: (array | string) array: array of values for multiple values support, string: uniq value for the custom field
+    # value: (array | string) array: array of values for multiple values support,
+    #                         string: uniq value for the custom field
     # args:
     #   field_id: (integer optional) identifier of the custom field
     #   order: order or position of the field value
     #   group_number: number of the group (only for custom field group with is_repeat enabled)
-    #   clear: (boolean, default true) if true, will remove previous values and set these values, if not will append values
+    #   clear: (boolean, default true) if true, will remove previous values and set these values,
+    #                                  if not will append values
     # return false if the was not saved because there is not present the field with slug: key
     # sample: my_post.set_field_value('subtitle', 'Sub Title')
-    # sample: my_post.set_field_value('subtitle', ['Sub Title1', 'Sub Title2']) # set values for a field (for fields that support multiple values)
+    # sample: set values for a field (for fields that support multiple values)
+    # my_post.set_field_value('subtitle', ['Sub Title1', 'Sub Title2'])
     # sample: my_post.set_field_value('subtitle', 'Sub Title', {group_number: 1})
-    # sample: my_post.set_field_value('subtitle', 'Sub Title', {group_number: 1, group_number: 1}) # add field values for fields in group 1
+    # sample: add field values for fields in group 1
+    # my_post.set_field_value('subtitle', 'Sub Title', {group_number: 1, group_number: 1})
     def set_field_value(key, value, args = {})
       args = { order: 0, group_number: 0, field_id: nil, clear: true }.merge!(args)
-      unless args[:field_id].present?
+      if args[:field_id].blank?
         args[:field_id] = begin
           get_field_object(key).id
         rescue StandardError
           nil
         end
       end
-      raise ArgumentError, "There is no custom field configured for #{key}" unless args[:field_id].present?
+      args[:field_id] ||= fallback_field_id_for(key)
 
-      if args[:clear]
-        custom_field_values.where({ custom_field_slug: key,
-                                    group_number: args[:group_number] }).delete_all
-      end
-      v = { custom_field_id: args[:field_id], custom_field_slug: key, value: fix_meta_value(value),
-            term_order: args[:order], group_number: args[:group_number] }
-      if value.is_a?(Array)
-        value.each do |val|
-          custom_field_values.create!(v.merge({ value: fix_meta_value(val) }))
+      raise ArgumentError, "There is no custom field configured for #{key}" if args[:field_id].blank?
+
+      v = {
+        custom_field_id: args[:field_id], custom_field_slug: key, value: fix_meta_value(value),
+        term_order: args[:order], group_number: args[:group_number]
+      }
+      # Atomic (audit M7): clear the previous value and write the new one in one transaction, so a
+      # value the scan-and-reject gate refuses (create! -> RecordInvalid) rolls the delete back and
+      # the previously stored value survives instead of being destroyed.
+      ActiveRecord::Base.transaction do
+        if args[:clear]
+          custom_field_values.where({ custom_field_slug: key, group_number: args[:group_number] }).delete_all
+        end
+        if value.is_a?(Array)
+          value.each { |val| custom_field_values.create!(v.merge({ value: fix_meta_value(val) })) }
+        else
+          custom_field_values.create!(v)
         end
-      else
-        custom_field_values.create!(v)
       end
     end
 
     private
 
+    def fallback_field_id_for(key)
+      return unless self.class.to_s.parseCamaClass == 'Post'
+      return unless respond_to?(:post_type_id) && post_type_id.present?
+
+      group_ids = CamaleonCms::CustomFieldGroup.where(object_class: 'PostType_Post', objectid: post_type_id).pluck(:id)
+      return if group_ids.blank?
+
+      CamaleonCms::CustomField.where(slug: key, parent_id: group_ids).pick(:id)
+    end
+
     def fix_meta_value(value)
       return value.to_json if value.is_a?(ActionController::Parameters)
       return JSON.generate(value) if value.is_a?(Array) || value.is_a?(Hash)

data/app/models/concerns/camaleon_cms/metas.rb

@@ -14,7 +14,25 @@ module CamaleonCms
     # Add meta with value or Update meta with key: key
     # return true or false
     def set_meta(key, value)
-      metas.where(key: key).update_or_create({ value: fix_meta_value(value) })
+      fixed_value = fix_meta_value(value)
+
+      # Check if the parent object has been saved to the database yet
+      if persisted?
+        # Safe to use database-driven lookups and updates
+        meta_record = metas.find_or_create_by(key: key.to_s)
+        meta_record.update(value: fixed_value)
+      else
+        # In-Memory Fallback: Find an existing unsaved item in the array collection,
+        # or build a brand new unsaved record on the association.
+        meta_record = metas.find { |m| m.key == key.to_s }
+
+        if meta_record
+          meta_record.value = fixed_value
+        else
+          metas.build(key: key.to_s, value: fixed_value)
+        end
+      end
+
       cama_set_cache("meta_#{key}", value)
     end
 
@@ -23,7 +41,7 @@ module CamaleonCms
     def get_meta(key, default = nil)
       key_str = key.is_a?(Symbol) ? key.to_s : key
       cama_fetch_cache("meta_#{key_str}") do
-        option = metas.loaded? ? metas.select { |m| m.key == key }.first : metas.where(key: key_str).first
+        option = metas.loaded? ? metas.find { |m| m.key == key_str } : metas.where(key: key_str).first
         res = ''
         if option.present?
           value = begin
@@ -73,12 +91,16 @@ module CamaleonCms
     # return value for attribute
     def get_option(key = nil, default = nil, meta_key = '_default')
       values = cama_options(meta_key)
+      return default if key.nil?
+
       key = key.to_sym
       values.key?(key) && values[key] != '' ? values[key] : default
     end
 
     # delete attribute from configuration
     def delete_option(key, meta_key = '_default')
+      return if key.nil?
+
       values = cama_options(meta_key)
       key = key.to_sym
       values.delete(key) if values.key?(key)
@@ -88,7 +110,7 @@ module CamaleonCms
     # set multiple configurations
     # h: {ket1: "sdsds", ff: "fdfdfdfd"}
     def set_options(h = {}, meta_key = '_default')
-      return unless h.present?
+      return if h.blank?
 
       data = cama_options(meta_key)
       PluginRoutes.fixActionParameter(h).to_sym.each do |key, value|
@@ -116,11 +138,14 @@ module CamaleonCms
       save_metas_options # unless self.changed?
     end
 
-    # save all settings for this post type received in data_options and data_metas attribute (options and metas)
-    # sample: Site.first.post_types.create({name: "owen", slug: "my_post_type", data_options: { has_category: true, default_layout: "my_layout" }})
+    # Save all settings for this post type - received in data_options and data_metas attribute (options and metas)
+    # sample:
+    # Site.first.post_types.create(
+    #   {name: "owen", slug: "my_post_type", data_options: { has_category: true, default_layout: "my_layout" }}
+    # )
     def save_metas_options
       set_multiple_options(data_options)
-      return unless data_metas.present?
+      return if data_metas.blank?
 
       data_metas.each do |key, val|
         set_meta(key, val)

data/app/models/concerns/camaleon_cms/normalize_attrs.rb

@@ -9,17 +9,11 @@ module CamaleonCms
           args.each do |attr|
             next unless new_record? || attribute_changed?(attr)
 
-            self[attr] = ActionController::Base.helpers.sanitize(
-              __send__(attr)&.gsub(CamaleonRecord::TRANSLATION_TAG_HIDE_REGEX, CamaleonRecord::TRANSLATION_TAG_HIDE_MAP)
-            )&.gsub(CamaleonRecord::TRANSLATION_TAG_RESTORE_REGEX, CamaleonRecord::TRANSLATION_TAG_RESTORE_MAP)
+            self[attr] = CamaleonRecord.cama_sanitize_translatable(__send__(attr))
           end
         end
       else
-        normalizes(*args, with: lambda { |field|
-          ActionController::Base.helpers.sanitize(
-            field.gsub(CamaleonRecord::TRANSLATION_TAG_HIDE_REGEX, CamaleonRecord::TRANSLATION_TAG_HIDE_MAP)
-          ).gsub(CamaleonRecord::TRANSLATION_TAG_RESTORE_REGEX, CamaleonRecord::TRANSLATION_TAG_RESTORE_MAP)
-        })
+        normalizes(*args, with: ->(field) { CamaleonRecord.cama_sanitize_translatable(field) })
       end
     end
   end

data/app/models/concerns/camaleon_cms/site_default_settings.rb

@@ -4,10 +4,20 @@ module CamaleonCms
     # default structure for each new site
     def default_settings
       default_post_type = [
-        { name: 'Post', description: 'Posts',
-          options: { has_category: true, has_tags: true, not_deleted: true, has_summary: true, has_content: true, has_comments: true, has_picture: true, has_template: true } },
-        { name: 'Page', description: 'Pages',
-          options: { has_category: false, has_tags: false, not_deleted: true, has_summary: false, has_content: true, has_comments: false, has_picture: true, has_template: true, has_layout: true } }
+        {
+          name: 'Post', description: 'Posts',
+          options: {
+            has_category: true, has_tags: true, not_deleted: true, has_summary: true, has_content: true,
+            has_comments: true, has_picture: true, has_template: true
+          }
+        },
+        {
+          name: 'Page', description: 'Pages',
+          options: {
+            has_category: false, has_tags: false, not_deleted: true, has_summary: false, has_content: true,
+            has_comments: false, has_picture: true, has_template: true, has_layout: true
+          }
+        }
       ]
       default_post_type.each do |pt|
         post_types.create({ name: pt[:name], slug: pt[:name].to_s.parameterize, description: pt[:description],
@@ -17,20 +27,101 @@ module CamaleonCms
       # nav menus
       @nav_menu = nav_menus.new({ name: 'Main Menu', slug: 'main_menu' })
       if @nav_menu.save
-        post_types.all.each do |pt|
+        post_types.find_each do |pt|
           if pt.slug == 'post'
             title = 'Sample Post'
             slug = 'sample-post'
-            content = '<p>Lorem ipsum dolor sit amet, consectetur adipiscing elit. Integer pharetra ut augue in posuere. Nulla non malesuada dui. Sed egestas tortor ut purus tempor sodales. Duis non sollicitudin nulla, quis mollis neque. Integer sit amet augue ac neque varius auctor. Vestibulum malesuada leo leo, at semper libero efficitur nec. Etiam semper nisi ac nisi ullamcorper, sed tincidunt purus elementum. Mauris ac congue nibh. Quisque pretium eget leo nec suscipit. </p> <p> Vestibulum ultrices orci ut congue interdum. Morbi dolor nunc, imperdiet vel risus semper, tempor dapibus urna. Phasellus luctus pharetra enim quis volutpat. Integer tristique urna nec malesuada ullamcorper. Curabitur dictum, lectus id ultrices rhoncus, ante neque auctor erat, ut sodales nisi odio sit amet lorem. In hac habitasse platea dictumst. Quisque orci orci, hendrerit at luctus tristique, lobortis in diam. Curabitur ligula enim, rhoncus ut vestibulum a, consequat sit amet nisi. Aliquam bibendum fringilla ultrices. Aliquam erat volutpat. Vestibulum ante ipsum primis in faucibus orci luctus et ultrices posuere cubilia Curae; In justo mi, congue in rhoncus lobortis, facilisis in est. Nam et rhoncus purus. </p> <p> Sed sagittis auctor lectus at rutrum. Morbi ultricies felis mi, ut scelerisque augue facilisis eu. In molestie quam ex. Quisque ut sapien sed odio tempus imperdiet. In id accumsan massa. Morbi quis nunc ullamcorper, interdum enim eu, finibus purus. Vestibulum ac fermentum augue, at tempus ante. Aliquam ultrices, purus ut porttitor gravida, dui augue dignissim massa, ac tempor ante dolor at arcu. Pellentesque habitant morbi tristique senectus et netus et malesuada fames ac turpis egestas. Suspendisse placerat risus est, eget varius mi ultricies in. Duis non odio ut felis dapibus eleifend. In fringilla enim lobortis placerat efficitur. </p> <p> Nulla sodales faucibus urna, quis viverra dolor facilisis sollicitudin. Aenean ac egestas nibh. Nam non tortor eget nibh scelerisque fermentum. Etiam ornare, nunc ut luctus mollis, ante dolor consectetur augue, non scelerisque odio est a nulla. Nullam cursus egestas nulla, nec commodo nibh suscipit ut. Mauris ut felis sem. Aenean at mi at nisi dictum blandit sit amet at erat. Etiam eget lobortis tellus. Curabitur in commodo arcu, at vehicula tortor. </p>'
+            content_parts = []
+            content_parts << helpers.content_tag(
+              :p, 'Lorem ipsum dolor sit amet, consectetur adipiscing elit. Integer pharetra ut augue in posuere. ' \
+                  'Nulla non malesuada dui. Sed egestas tortor ut purus tempor sodales. ' \
+                  'Duis non sollicitudin nulla, quis mollis neque. Integer sit amet augue ac neque varius auctor. ' \
+                  'Vestibulum malesuada leo leo, at semper libero efficitur nec. ' \
+                  'Etiam semper nisi ac nisi ullamcorper, sed tincidunt purus elementum. ' \
+                  'Mauris ac congue nibh. Quisque pretium eget leo nec suscipit.'
+            )
+            content_parts << helpers.content_tag(
+              :p, 'Vestibulum ultrices orci ut congue interdum. ' \
+                   'Morbi dolor nunc, imperdiet vel risus semper, tempor dapibus urna. ' \
+                   'Phasellus luctus pharetra enim quis volutpat. Integer tristique urna nec malesuada ullamcorper. ' \
+                   'Curabitur dictum, lectus id ultrices rhoncus, ante neque auctor erat, ' \
+                   'ut sodales nisi odio sit amet lorem. In hac habitasse platea dictumst. ' \
+                   'Quisque orci orci, hendrerit at luctus tristique, lobortis in diam. ' \
+                   'Curabitur ligula enim, rhoncus ut vestibulum a, consequat sit amet nisi. ' \
+                   'Aliquam bibendum fringilla ultrices. Aliquam erat volutpat. ' \
+                   'Vestibulum ante ipsum primis in faucibus orci luctus et ultrices posuere cubilia Curae; ' \
+                   'In justo mi, congue in rhoncus lobortis, facilisis in est. Nam et rhoncus purus.'
+            )
+            content_parts << helpers.content_tag(
+              :p, 'Sed sagittis auctor lectus at rutrum. ' \
+                  'Morbi ultricies felis mi, ut scelerisque augue facilisis eu. In molestie quam ex. ' \
+                  'Quisque ut sapien sed odio tempus imperdiet. In id accumsan massa. ' \
+                  'Morbi quis nunc ullamcorper, interdum enim eu, finibus purus. ' \
+                  'Vestibulum ac fermentum augue, at tempus ante. ' \
+                  'Aliquam ultrices, purus ut porttitor gravida, dui augue dignissim massa, ' \
+                  'ac tempor ante dolor at arcu. ' \
+                  'Pellentesque habitant morbi tristique senectus et netus et malesuada fames ac turpis egestas. ' \
+                  'Suspendisse placerat risus est, eget varius mi ultricies in. ' \
+                  'Duis non odio ut felis dapibus eleifend. In fringilla enim lobortis placerat efficitur.'
+            )
+            content_parts << helpers.content_tag(
+              :p, 'Nulla sodales faucibus urna, quis viverra dolor facilisis sollicitudin. Aenean ac egestas nibh. ' \
+                  'Nam non tortor eget nibh scelerisque fermentum. ' \
+                  'Etiam ornare, nunc ut luctus mollis, ante dolor consectetur augue, ' \
+                  'non scelerisque odio est a nulla. Nullam cursus egestas nulla, nec commodo nibh suscipit ut. ' \
+                  'Mauris ut felis sem. Aenean at mi at nisi dictum blandit sit amet at erat. ' \
+                  'Etiam eget lobortis tellus. Curabitur in commodo arcu, at vehicula tortor.'
+            )
+            content = helpers.safe_join(content_parts)
           else
             title = 'Welcome'
             slug = 'welcome'
-            content = "<p style='text-align: center;'><img width='155' height='155' src='https://camaleon.website/media/132/logo2.png' alt='logo' /></p><p><strong>Camaleon CMS</strong>&nbsp;is a free and open-source tool and a fexible content management system (CMS) based on <a href='https://rubyonrails.org'>Ruby on Rails</a>.</p> <p>With Camaleon you can do the following:</p> <ul> <li>Create instantly a lot of sites&nbsp;in the same installation</li> <li>Manage your content information in several languages</li> <li>Extend current functionality by&nbsp;plugins (MVC structure and no more echo or prints anywhere)</li> <li>Create or install different themes for each site</li> <li>Create your own structure without coding anything (adapt Camaleon as you want&nbsp;and not you for Camaleon)</li> <li>Create your store and start to sell your products using our plugins</li> <li>Avoid web attacks</li> <li>Compare the speed and enjoy the speed of your new Camaleon site</li> <li>Customize or create your themes for mobile support</li> <li>Support&nbsp;more visitors at the same time</li> <li>Manage your information with a panel like wordpress&nbsp;</li> <li>All urls are oriented for SEO</li> <li>Multiples roles of users</li> </ul>"
+            welcome_parts = []
+            logo_img = helpers
+                       .image_tag('https://camaleon.website/media/132/logo2.png', width: 155, height: 155, alt: 'logo')
+            welcome_parts << helpers.content_tag(:p, logo_img, style: 'text-align: center;')
+            cms_strong = helpers.content_tag(:strong, 'Camaleon CMS')
+            rails_link = helpers.link_to('Ruby on Rails', 'https://rubyonrails.org')
+            part2_text = helpers.safe_join(
+              [
+                cms_strong,
+                ' is a free and open-source tool and a fexible content management system (CMS) based on ',
+                rails_link
+              ]
+            )
+            welcome_parts << helpers.content_tag(:p, part2_text)
+            welcome_parts << helpers.content_tag(:p, 'With Camaleon you can do the following:')
+            li_texts = [
+              'Create instantly a lot of sites in the same installation',
+              'Manage your content information in several languages',
+              'Extend current functionality by plugins (MVC structure and no more echo or prints anywhere)',
+              'Create or install different themes for each site',
+              'Create your own structure without coding anything (adapt Camaleon as you want and not you for Camaleon)',
+              'Create your store and start to sell your products using our plugins',
+              'Avoid web attacks',
+              'Compare the speed and enjoy the speed of your new Camaleon site',
+              'Customize or create your themes for mobile support',
+              'Support more visitors at the same time',
+              'Manage your information with a panel like wordpress ',
+              'All urls are oriented for SEO',
+              'Multiples roles of users'
+            ]
+            li_tags = li_texts.map { |text| helpers.content_tag(:li, text) }
+            welcome_parts << helpers.content_tag(:ul, helpers.safe_join(li_tags))
+            content = helpers.safe_join(welcome_parts)
           end
           user = users.admin_scope.first
-          unless user.present?
-            user = users.admin_scope.create({ email: 'admin@local.com', username: 'admin', password: 'admin123',
-                                              password_confirmation: 'admin123', first_name: 'Administrator' })
+          if user.blank?
+            # Never mint a known default password. Generate a random one, force a change on first
+            # login, and stash the plaintext transiently so the provisioning controller can surface
+            # it once. See harden-installer-default-admin.
+            generated_password = SecureRandom.alphanumeric(16)
+            user = users.admin_scope.create({ email: 'admin@local.com', username: 'admin',
+                                              password: generated_password,
+                                              password_confirmation: generated_password,
+                                              first_name: 'Administrator' })
+            user.set_meta('must_change_password', true)
+            self.generated_admin_password = generated_password
           end
           post = pt.add_post({ title: title, slug: slug, content: content, user_id: user.id, status: 'published' })
           @nav_menu.append_menu_item({ label: title, type: 'post', link: post.id })
@@ -60,18 +151,26 @@ module CamaleonCms
         if post_type.present?
           d = user_role.get_meta("_post_type_#{id}", {})
           CamaleonCms::UserRole::ROLES[:post_type].each do |value|
+            # post_content_unfiltered_html lets a role store unsanitized HTML in post content; it must not be
+            # granted to the default Editor role (only admins, via `can :manage, :all`, are trusted for it).
+            next if value[:key].to_s == 'post_content_unfiltered_html'
+
             value_old = d[value[:key].to_sym] || []
             d[value[:key].to_sym] = value_old + [post_type.id]
           end
         else
           pts = post_types.all.pluck(:id)
-          CamaleonCms::UserRole::ROLES[:post_type].each { |value| d[value[:key]] = pts }
+          CamaleonCms::UserRole::ROLES[:post_type].each do |value|
+            next if value[:key].to_s == 'post_content_unfiltered_html'
+
+            d[value[:key]] = pts
+          end
         end
         user_role.set_meta("_post_type_#{id}", d || {})
       end
 
-      user_role = user_roles.where({ slug: 'contributor' }).first_or_create({ name: 'Contributor',
-                                                                              description: 'Contributor Role' })
+      user_role = user_roles.where({ slug: 'contributor' })
+                            .first_or_create({ name: 'Contributor', description: 'Contributor Role' })
       if user_role.valid?
         d = {}
         if post_type.present?
@@ -89,13 +188,18 @@ module CamaleonCms
 
       return if post_type.present?
 
-      user_role = user_roles.where({ slug: 'client',
-                                     term_group: -1 }).first_or_create({ name: 'Client',
-                                                                         description: 'Default roles client' })
+      user_role = user_roles.where({ slug: 'client', term_group: -1 })
+                            .first_or_create({ name: 'Client', description: 'Default roles client' })
       return unless user_role.valid?
 
       user_role.set_meta("_post_type_#{id}", {})
       user_role.set_meta("_manager_#{id}", {})
     end
+
+    private
+
+    def helpers
+      ActionController::Base.helpers
+    end
   end
 end