camaleon_cms 2.9.2 → 2.9.3

data/app/models/concerns/camaleon_cms/user_methods.rb

@@ -8,12 +8,20 @@ module CamaleonCms
 
       extend CamaleonCms::NormalizeAttrs
 
-      validates_uniqueness_of :username, scope: [:site_id], case_sensitive: false,
-                                         message: I18n.t('camaleon_cms.admin.users.message.requires_different_username', default: 'Requires different username')
-      validates_uniqueness_of :email, scope: [:site_id], case_sensitive: false,
-                                      message: I18n.t('camaleon_cms.admin.users.message.requires_different_email', default: 'Requires different email')
-
-      normalize_attrs(:first_name, :last_name, :username)
+      validates(
+        :username, uniqueness: { scope: [:site_id], case_sensitive: false,
+                                 message: I18n.t(
+                                   'camaleon_cms.admin.users.message.requires_different_username',
+                                   default: 'Requires different username'
+                                 ) }
+      )
+      validates(
+        :email, uniqueness: { scope: [:site_id], case_sensitive: false,
+                              message: I18n.t(
+                                'camaleon_cms.admin.users.message.requires_different_email',
+                                default: 'Requires different email'
+                              ) }
+      )
 
       # callbacks
       before_validation :cama_before_validation
@@ -24,8 +32,12 @@ module CamaleonCms
       before_update { generate_token :auth_token if will_save_change_to_password_digest? }
 
       # relations
-      has_many :all_posts, class_name: 'CamaleonCms::Post', foreign_key: :user_id
-      has_many :all_comments, class_name: 'CamaleonCms::PostComment'
+      has_many :all_posts, class_name: 'CamaleonCms::Post', foreign_key: :user_id, inverse_of: :owner,
+                           dependent: :nullify
+      # No `dependent:` — the rows must still carry this user_id when the
+      # `after_destroy :reassign_comments` callback moves them to the anonymous user.
+      has_many :all_comments, class_name: 'CamaleonCms::PostComment' # rubocop:disable Rails/HasManyOrHasOneDependent
+
       belongs_to :site, class_name: 'CamaleonCms::Site', optional: true
 
       # scopes
@@ -64,9 +76,9 @@ module CamaleonCms
       @_user_role ||= site.user_roles.where(slug: role).first
     end
 
-    # assign a new site for current user
+    # Assign a new site for the current user
     def assign_site(site)
-      update_column(:site_id, site.id)
+      update_column(:site_id, site.id) # rubocop:disable Rails/SkipsModelValidations
     end
 
     def sites
@@ -93,6 +105,14 @@ module CamaleonCms
       end
     end
 
+    # Rotate the auth token and persist it (audit 2026-08-11 M3): called on logout so a cookie copied
+    # before logout can no longer authenticate. Skips validations/callbacks -- it only replaces the
+    # token column and must work even for a record that would not otherwise pass validation.
+    def cama_reset_auth_token!
+      generate_token(:auth_token)
+      update_column(:auth_token, auth_token) # rubocop:disable Rails/SkipsModelValidations
+    end
+
     def send_password_reset
       generate_token(:password_reset_token)
       self.password_reset_sent_at = Time.zone.now
@@ -126,20 +146,25 @@ module CamaleonCms
       all_posts.each do |p|
         s = p.post_type.site
         u = s.users.admin_scope.where.not(id: id).first
-        next unless u.present?
+        next if u.blank?
 
-        p.update_column(:user_id, u.id)
-        p.comments.where(user_id: id).each do |c|
-          c.update_column(:user_id, u.id)
-        end
+        p.update_column(:user_id, u.id) # rubocop:disable Rails/SkipsModelValidations
+        p.comments.where(user_id: id).update_all(user_id: u.id) # rubocop:disable Rails/SkipsModelValidations
       end
     end
 
+    # Until the dependent: :nullify on all_comments was removed this loop never ran — the
+    # association was already empty by the time after_destroy fired — so the unguarded chain
+    # below was never exercised. It runs now, and a comment whose post, post type or site cannot
+    # be resolved would raise inside after_destroy and roll the whole user deletion back. Such a
+    # comment is skipped instead; `rake camaleon_cms:reassign_orphaned_comments` reports the same
+    # rows, and it already guarded the identical chain.
     def reassign_comments
-      all_comments.includes(post: { post_type: :site }).each do |comment|
-        site = comment.post.post_type.site
-        user = site.get_anonymous_user
-        comment.update_column(:user_id, user.id)
+      all_comments.includes(post: { post_type: :site }).find_each do |comment|
+        site = comment.post&.post_type&.site
+        next if site.nil?
+
+        comment.update_column(:user_id, site.get_anonymous_user.id) # rubocop:disable Rails/SkipsModelValidations
       end
     end
   end

data/app/models/current_request.rb

@@ -12,5 +12,12 @@
 # Note: Rails automatically resets CurrentAttributes between requests, ensuring no leakage.
 # In specs, call CurrentRequest.reset in before/after hooks to avoid cross-test pollution.
 class CurrentRequest < ActiveSupport::CurrentAttributes
-  attribute :user, :site
+  attribute :user, :user_resolved, :site, :content_helper_state, :hooks_helper_state, :html_helper_state,
+            :theme_helper_state,
+            :frontend_object, :frontend_seo_settings, :frontend_current_theme, :frontend_site_current_path,
+            :frontend_visited_home, :frontend_visited_post, :frontend_visited_ajax, :frontend_visited_search,
+            :frontend_visited_post_type, :frontend_visited_tag, :frontend_visited_category,
+            :frontend_visited_profile, :frontend_user,
+            :admin_menu_items, :custom_field_elements, :extra_models_for_fields,
+            :shortcodes, :shortcodes_template, :shortcodes_descr
 end

data/app/uploaders/camaleon_cms_aws_uploader.rb

@@ -72,9 +72,7 @@ class CamaleonCmsAwsUploader < CamaleonCmsUploader
       'dimension' => ''
     }.with_indifferent_access
     if res['file_type'] == 'image' && File.extname(res['name']).downcase != '.gif'
-      res['thumb'] =
-        version_path(res['url']).sub('.svg',
-                                     '.jpg')
+      res['thumb'] = version_path(res['url']).sub(SVG_EXT_PATTERN, '.jpg')
     end
     res['key'] = File.join(res['folder_path'], res['name'])
     @aws_settings[:aws_file_read_settings].call(res, s3_file)
@@ -100,14 +98,20 @@ class CamaleonCmsAwsUploader < CamaleonCmsUploader
     end
 
     s3_file = bucket.object(key.slice(1..-1))
+    # Security (audit 2026-08-11 M5): a private-mode upload must be owner-only. Storing it 'public-read'
+    # (like a public file) left it world-readable at a guessable s3://bucket/private/<name> URL,
+    # bypassing the download_private_file gate. That gate fetches via the authenticated S3 API, so a
+    # 'private' ACL does not affect legitimate serving.
+    acl = is_private_uploader? ? 'private' : 'public-read'
     s3_file.upload_file(
-      uploaded_io_or_file_path.is_a?(String) ? uploaded_io_or_file_path : uploaded_io_or_file_path.path, @aws_settings[:aws_file_upload_settings].call({ acl: 'public-read' })
+      uploaded_io_or_file_path.is_a?(String) ? uploaded_io_or_file_path : uploaded_io_or_file_path.path,
+      @aws_settings[:aws_file_upload_settings].call({ acl: acl })
     )
     res = cache_item(file_parse(s3_file)) unless args[:is_thumb]
     res
   end
 
-  # add new folder to AWS with :key
+  # Add a new folder to AWS with :key
   def add_folder(key)
     return { error: 'Invalid folder path' } unless valid_folder_path?(key)
 
@@ -118,17 +122,17 @@ class CamaleonCmsAwsUploader < CamaleonCmsUploader
     cache_item(file_parse(s3_file))
   end
 
-  # delete a folder in AWS with :key
+  # Delete a folder in AWS with :key
   def delete_folder(key)
     return { error: 'Invalid folder path' } unless valid_folder_path?(key)
 
     key = "#{@aws_settings['inner_folder']}/#{key}" if @aws_settings['inner_folder'].present?
     key = key.cama_fix_media_key
     bucket.objects(prefix: key.slice(1..-1) << '/').delete
-    get_media_collection.find_by_key(key).take.destroy
+    get_media_collection.by_key(key).take.destroy
   end
 
-  # delete a file in AWS with :key
+  # Delete the `:key` file in AWS
   def delete_file(key)
     return { error: 'Invalid file path' } unless valid_folder_path?(key)
 
@@ -140,10 +144,27 @@ class CamaleonCmsAwsUploader < CamaleonCmsUploader
       ''
     end
     @instance.hooks_run('after_delete', key)
-    get_media_collection.find_by_key(key).take.destroy
+    get_media_collection.by_key(key).take.destroy
   end
 
-  # initialize a bucket with AWS configurations
+  # Security (audit 2026-08-11 M5 follow-up): uploads stored before the private-ACL fix kept a
+  # world-readable ACL under the private prefix. Sweep them back to owner-only and return the count.
+  # The prefix mirrors setup_private_folder -- <inner_folder>/private/ -- normalized exactly like
+  # add_file keys (leading slash added by cama_fix_media_key, then stripped for S3), with a trailing
+  # slash so a sibling folder such as private_x is not swept.
+  def repair_private_acls!
+    inner_folder = @aws_settings['inner_folder'].to_s
+    inner_folder = "#{inner_folder}/#{PRIVATE_DIRECTORY}" unless is_private_uploader?
+    prefix = "#{inner_folder.cama_fix_media_key.slice(1..-1)}/"
+    repaired = 0
+    bucket.objects(prefix: prefix).each do |object|
+      object.acl.put(acl: 'private')
+      repaired += 1
+    end
+    repaired
+  end
+
+  # Initialize a bucket with AWS configurations
   # return: (AWS Bucket object)
   def bucket
     @bucket ||= lambda {

data/app/uploaders/camaleon_cms_local_uploader.rb

@@ -2,13 +2,13 @@ class CamaleonCmsLocalUploader < CamaleonCmsUploader
   def after_initialize
     @root_folder = @current_site.upload_directory
 
-    FileUtils.mkdir_p(@root_folder) unless Dir.exist?(@root_folder)
+    FileUtils.mkdir_p(@root_folder)
   end
 
   def setup_private_folder
     @root_folder = Rails.root.join(self.class::PRIVATE_DIRECTORY).to_s
 
-    FileUtils.mkdir_p(@root_folder) unless Dir.exist?(@root_folder)
+    FileUtils.mkdir_p(@root_folder)
   end
 
   def browser_files(prefix = '/', _objects = {})
@@ -32,6 +32,17 @@ class CamaleonCmsLocalUploader < CamaleonCmsUploader
     { error: 'File not found' }
   end
 
+  # Repairs legacy thumbnail URLs (see #cama_compat_legacy_thumb) for one rendered page of
+  # media items. The cache (media DB records) may still hold thumb URLs computed from the
+  # source extension (sample: ".jpg") while the on-disk thumbnail is a legacy ".png"; without
+  # this the admin media browser would render 404 thumbnails for such files. Applied by the
+  # media controller to the paginated page only — #objects stays a lazy relation so the browser
+  # paginates at the database instead of materializing (and stat-ing) the whole folder.
+  def cama_prepare_browser_page(items)
+    items.each { |item| cama_fix_legacy_thumb_item(item) }
+    items
+  end
+
   def file_parse(key)
     file_path = File.join(@root_folder, key)
     url_path = file_path.sub(Rails.root.join('public').to_s, '')
@@ -41,16 +52,13 @@ class CamaleonCmsLocalUploader < CamaleonCmsUploader
       'folder_path' => File.dirname(key),
       'url' => if is_dir
                  ''
+               elsif is_private_uploader?
+                 url_path.sub("#{@root_folder}/", '')
                else
-                 (if is_private_uploader?
-                    url_path.sub("#{@root_folder}/",
-                                 '')
-                  else
-                    File.join(
-                      @current_site.decorate.the_url(as_path: true, locale: false,
-                                                     skip_relative_url_root: true), url_path
-                    )
-                  end)
+                 File.join(
+                   @current_site.decorate.the_url(as_path: true, locale: false,
+                                                  skip_relative_url_root: true), url_path
+                 )
                end,
       'is_folder' => is_dir,
       'file_size' => is_dir ? 0 : File.size(file_path).round(2),
@@ -60,11 +68,16 @@ class CamaleonCmsLocalUploader < CamaleonCmsUploader
     }.with_indifferent_access
     res['key'] = File.join(res['folder_path'], res['name'])
     if res['file_type'] == 'image' && File.extname(file_path).downcase != '.gif'
-      res['thumb'] =
-        (is_private_uploader? ? "/admin/media/download_private_file?file=#{version_path(key).slice(1..-1)}" : version_path(res['url']))
+      res['thumb'] = if is_private_uploader?
+                       "/admin/media/download_private_file?file=#{version_path(key).slice(1..-1)}"
+                     else
+                       version_path(res['url'])
+                     end
     end
     if res['file_type'] == 'image'
-      res['thumb'].sub! '.svg', '.jpg'
+      res['thumb'].sub!(SVG_EXT_PATTERN, '.jpg')
+      res['thumb'] = cama_compat_legacy_thumb(res['thumb'], version_path(key).sub(SVG_EXT_PATTERN, '.jpg'),
+                                              res['url'])
       im = MiniMagick::Image.open(file_path)
       res['dimension'] = begin
         "#{im[:width]}x#{im[:height]}"
@@ -109,27 +122,71 @@ class CamaleonCmsLocalUploader < CamaleonCmsUploader
     f
   end
 
-  # remove an existent folder
+  # Remove an existent folder
   def delete_folder(key)
     return { error: 'Invalid folder path' } if key.include?('..')
 
     folder = File.join(@root_folder, key)
     FileUtils.rm_rf(folder) if Dir.exist? folder
-    get_media_collection.find_by_key(key).take.destroy
+    get_media_collection.by_key(key).take.destroy
   end
 
-  # remove an existent file
+  # Remove an existent file
   def delete_file(key)
     return { error: 'Invalid file path' } if key.include?('..')
 
     file = File.join(@root_folder, key)
     FileUtils.rm(file) if File.exist? file
     @instance.hooks_run('after_delete', key)
-    get_media_collection.find_by_key(key).take.destroy
+    get_media_collection.by_key(key).take.destroy
   end
 
-  # convert a real file path into file key
+  # Convert a real file path into a file key
   def parse_key(file_path)
     file_path.sub(@root_folder, '').cama_fix_media_key
   end
+
+  private
+
+  # Applies the legacy-thumbnail fallback (see #cama_compat_legacy_thumb) to a
+  # single cached media item in place, so the admin media browser renders the
+  # on-disk ".png" thumbnail instead of a 404ing ".jpg" one. No-op for folders,
+  # non-image files and items without a thumb.
+  # item: (CamaleonCms::Media | Hash) cached media object
+  def cama_fix_legacy_thumb_item(item)
+    return if item['is_folder'] || item['file_type'] != 'image' || item['thumb'].blank?
+
+    thumb_key = version_path(File.join(item['folder_path'].to_s, item['name'].to_s))
+    item['thumb'] = cama_compat_legacy_thumb(item['thumb'], thumb_key, item['url'])
+  end
+
+  # Backwards-compatibility for legacy thumbnails.
+  # Older Camaleon releases stored raster thumbnails as PNG regardless of the
+  # source extension (sample: "photo.jpg" => "thumb/photo-jpg.png"). The thumb
+  # URL is normally derived from the source extension, so for such legacy files
+  # the computed (sample: ".jpg") thumb URL would 404. Resolution order when the
+  # computed thumb is missing on disk:
+  #   1. a ".png" sibling exists  => point the thumb at the PNG;
+  #   2. no thumbnail exists at all (sample: ".ico" favicons are never
+  #      thumbnailed) => fall back to the original file url so the browser does
+  #      not request a 404 thumb (the original lives one level above /thumb).
+  # Otherwise the computed thumb url is returned unchanged (new uploads, PNG
+  # sources and S3 are unaffected).
+  # thumb_url: (String) computed public/private thumb url
+  # thumb_key: (String) computed thumb media key (relative to @root_folder)
+  # original_url: (String) url of the original (non-thumb) file
+  def cama_compat_legacy_thumb(thumb_url, thumb_key, original_url = nil)
+    return thumb_url if thumb_url.blank?
+
+    ext = File.extname(thumb_key)
+    return thumb_url if ext.blank?
+    return thumb_url if file_exists?(File.join(@root_folder, thumb_key))
+
+    unless ext.casecmp?('.png')
+      png_key = thumb_key.sub(/#{Regexp.escape(ext)}\z/, '.png')
+      return thumb_url.sub(/#{Regexp.escape(ext)}\z/, '.png') if file_exists?(File.join(@root_folder, png_key))
+    end
+
+    original_url.presence || thumb_url
+  end
 end

data/app/uploaders/camaleon_cms_uploader.rb

@@ -1,5 +1,8 @@
 class CamaleonCmsUploader
   PRIVATE_DIRECTORY = 'private'.freeze
+  # Case-insensitive terminal-`.svg` matcher, borrowed from the thumb/crop rename convention it
+  # must stay in lockstep with (defined beside that convention in UploaderImageProcessing).
+  SVG_EXT_PATTERN = CamaleonCms::UploaderImageProcessing::SVG_EXT_PATTERN
 
   attr_accessor :thumb
 
@@ -25,10 +28,11 @@ class CamaleonCmsUploader
               ''].include?(prefix)
             get_media_collection.where(folder_path: '/')
           else
-            get_media_collection.find_by_key(prefix).take.try(:items)
+            get_media_collection.by_key(prefix).take.try(:items)
           end
-    # Private hook to recover custom files to include in current list where data can be modified to add custom{files, folders}
-    # Note: this hooks doesn't have access to public vars like params. requests, ...
+    # Private hook to recover custom files to include into the current list where
+    # data can be modified to add custom{files, folders}.
+    # Note: these hooks don't have access to public vars like params. requests, ...
     if @instance
       args = { data: res, prefix: prefix }
       @instance.hooks_run('uploader_list_objects', args)
@@ -37,6 +41,15 @@ class CamaleonCmsUploader
     res
   end
 
+  # Post-process one *rendered page* of media items for display. Base and S3 need nothing;
+  # the local uploader overrides this to repair legacy thumbnail URLs (see its override), so
+  # that per-image filesystem check runs over the paginated page rather than the whole folder.
+  # Kept out of #objects on purpose: #objects must stay a lazy relation so the media browser
+  # paginates at the database.
+  def cama_prepare_browser_page(items)
+    items
+  end
+
   # clean cached of files structure saved into DB
   def clear_cache
     get_media_collection.destroy_all
@@ -94,7 +107,7 @@ class CamaleonCmsUploader
   # support for multiples formats, sample: image,audio
   def self.get_file_format_extensions(format)
     res = []
-    format.downcase.gsub(' ', '').split(',').each do |f|
+    format.downcase.delete(' ').split(',').each do |f|
       res << case f
              when 'image', 'images'
                'jpg,jpeg,png,gif,bmp,ico,svg'
@@ -116,12 +129,12 @@ class CamaleonCmsUploader
   # verify permitted formats (return boolean true | false)
   # true: if format is accepted
   # false: if format is not accepted
-  # sample: validate_file_format('/var/www/myfile.xls', 'image,audio,docx,xls') => return true if the file extension is in formats
+  # sample: validate_file_format('/var/www/myfile.xls', 'image,audio,docx,xls') => return true if the file extension
+  # is in formats
   def self.validate_file_format(key, valid_formats = '*')
-    return true if valid_formats == '*' || !valid_formats.present?
+    return true if valid_formats == '*' || valid_formats.blank?
 
-    valid_formats = valid_formats.gsub(' ',
-                                       '').downcase.split(',') + get_file_format_extensions(valid_formats).split(',')
+    valid_formats = valid_formats.delete(' ').downcase.split(',') + get_file_format_extensions(valid_formats).split(',')
     valid_formats.include?(File.extname(key).sub('.', '').split('?').first.try(:downcase))
   end
 
@@ -136,10 +149,10 @@ class CamaleonCmsUploader
   # sample: search_new_key("my_file/file.txt")
   def search_new_key(key)
     _key = key
-    if get_media_collection.find_by_key(key).any?
+    if get_media_collection.by_key(key).any?
       (1..999).each do |i|
         _key = key.cama_add_postfix_file_name("_#{i}")
-        break unless get_media_collection.find_by_key(_key).any?
+        break unless get_media_collection.by_key(_key).any?
       end
     end
     _key

data/app/validators/camaleon_cms/post_uniq_validator.rb

@@ -5,7 +5,7 @@ module CamaleonCms
 
       slug_array = record.slug.to_s.translations_array
       ptype = record.post_type
-      return unless ptype.present? # only for posts that belongs to a post type model
+      return if ptype.blank? # only for posts that belongs to a post type model
 
       post_table = CamaleonCms::Post.table_name
 
@@ -27,7 +27,7 @@ module CamaleonCms
                    .where.not(id: record.id)
                    .where.not(status: %i[draft draft_child trash])
       unless posts.empty?
-        record.errors[:base] <<
+        message =
           if slug_array.size > 1
             "#{I18n.t('camaleon_cms.admin.post.message.requires_different_slug')}: #{posts.pluck(:slug).map do |slug|
               record.slug.to_s.translations.map do |lng, r_slug|
@@ -37,14 +37,15 @@ module CamaleonCms
           else
             "#{I18n.t('camaleon_cms.admin.post.message.requires_different_slug')}: #{record.slug} "
           end
+        record.errors.add(:base, message)
       end
 
       # avoid recursive page parent
       return unless record.post_parent.present? && ptype.manage_hierarchy? &&
                     record.parents.cama_pluck(:id).include?(record.id)
 
-      record.errors[:base] << I18n.t('camaleon_cms.admin.post.message.recursive_hierarchy',
-                                     default: 'Parent Post Recursive')
+      record.errors.add(:base, I18n.t('camaleon_cms.admin.post.message.recursive_hierarchy',
+                                      default: 'Parent Post Recursive'))
     end
   end
 end

data/app/validators/camaleon_cms/uniq_validator.rb

@@ -11,7 +11,7 @@ module CamaleonCms
 
       return unless slug_exists
 
-      record.errors[:base] << I18n.t('camaleon_cms.admin.post.message.requires_different_slug').to_s
+      record.errors.add(:base, I18n.t('camaleon_cms.admin.post.message.requires_different_slug').to_s)
     end
   end
 end