camaleon_cms 2.9.2 → 2.9.3

data/app/controllers/camaleon_cms/admin/settings/custom_fields_controller.rb

@@ -61,7 +61,8 @@ module CamaleonCms
         # reorder custom fields group
         def reorder
           params[:values].to_a.each_with_index do |value, index|
-            current_site.custom_field_groups.find(value).update_column('field_order', index)
+            current_site.custom_field_groups.find(value)
+                        .update_column(:field_order, index) # rubocop:disable Rails/SkipsModelValidations
           end
           json = { size: params[:values].size }
           render json: json
@@ -71,11 +72,26 @@ module CamaleonCms
           p = params.permit(:post_type, :post_id)
           cat_ids = current_site.full_categories.where(id: params[:categories]).pluck(:id)
           if p[:post_id].present? && (post = current_site.the_post(p[:post_id].to_i)).present?
-            post.update_categories(cat_ids)
+            # The action carries no before_action, so authorize against the resolved post: a caller who
+            # cannot update it may neither read its custom-field values (GET) nor rewrite its categories
+            # (POST). This scopes an otherwise any-signed-in-user endpoint to the post's own editors.
+            authorize! :update, post
+            # The category write is state-changing, so it runs only on a POST — the sole verb on this
+            # route that protect_from_forgery verifies, because Rails exempts HEAD from CSRF checks
+            # just like GET (an `unless request.get?` guard would let a CSRF-exempt HEAD through). A GET
+            # or HEAD renders the current fields without mutating the post. Otherwise a bare
+            # GET .../custom_fields/list?post_id=N (CSRF through a top-level navigation, which carries
+            # the SameSite=Lax auth cookie) wipes the post's categories, because an omitted `categories`
+            # param resolves to [] and update_categories then deletes them all (audit finding M6).
+            post.update_categories(cat_ids) if request.post?
             args = {}
           else
+            # The render-only branch builds a new post of the requested type; gate it on the ability to
+            # create posts of that type so the field-group structure is not disclosed to other roles.
+            post_type = current_site.the_post_type(p[:post_type].to_i)
+            authorize! :create_post, post_type if post_type
             post = CamaleonCms::Post.new
-            post.taxonomy_id = current_site.the_post_type(p[:post_type].to_i)&.id
+            post.taxonomy_id = post_type&.id
             args = { cat_ids: cat_ids }
           end
           render partial: 'camaleon_cms/admin/settings/custom_fields/render',
@@ -88,7 +104,52 @@ module CamaleonCms
         def set_post_data
           @post_data = params.require(:custom_field_group).permit(:name, :description, :assign_group, :caption)
           @post_data[:object_class], @post_data[:objectid] = @post_data.delete(:assign_group).to_s.split(',')
+          # A Site placement has exactly one legal target, and the form only ever offers
+          # "Site,<current_site.id>". Pinning it keeps a crafted objectid from producing a group that
+          # Site#get_field_groups can never return, which would leave it stranded and unreachable.
+          @post_data[:objectid] = current_site.id if @post_data[:object_class] == 'Site'
           @caption = @post_data.delete(:caption)
+          reject_foreign_placement unless placement_owned_by_current_site?
+        end
+
+        # A group's placement (object_class + objectid) decides which record's admin page renders it,
+        # and those reads are not scoped by the owning site. Without this check a user who can manage
+        # custom fields on one site could stamp a group with another site's theme, menu or post type
+        # id and have it render there -- invisible in that site's own field group list, which is
+        # scoped by parent_id, so its administrators could neither find nor delete it.
+        def placement_owned_by_current_site?
+          object_class = @post_data[:object_class].to_s
+          objectid = @post_data[:objectid].to_s
+          return false if object_class.blank? || objectid !~ /\A\d+\z/
+
+          owned_placement_ids(object_class).include?(objectid.to_i)
+        end
+
+        # Every "other" option the form emits is "<Class>,<current_site.id>" -- Site, the configured
+        # user model, and any model contributed through the custom_field_custom_models hook. Keying
+        # the default arm on the id rather than on an allow-list of class names admits those hook
+        # models without this controller having to know their names.
+        def owned_placement_ids(object_class)
+          case object_class
+          when 'PostType', 'PostType_Post', 'PostType_Category', 'PostType_PostTag'
+            current_site.post_types.pluck(:id)
+          when 'Theme' then current_site.themes.pluck(:id)
+          when 'NavMenu' then current_site.nav_menus.pluck(:id)
+          when 'Plugin' then current_site.plugins.pluck(:id)
+          when 'Post' then current_site.posts.pluck(:id)
+          when 'Category', 'Category_Post' then current_site.full_categories.pluck(:id)
+          else [current_site.id]
+          end
+        end
+
+        def reject_foreign_placement
+          @field_group ||= current_site.custom_field_groups.new(@post_data.except(:object_class, :objectid))
+          @field_group.errors.add(
+            :base,
+            t('camaleon_cms.admin.custom_field.message.invalid_placement',
+              default: 'Select where to display this group. The selected target does not belong to this site.')
+          )
+          render 'form'
         end
 
         def validate_role
@@ -103,7 +164,7 @@ module CamaleonCms
         end
 
         def permitted_fields
-          return {} unless params[:fields].present?
+          return {} if params[:fields].blank?
 
           params.require(:fields).permit(params[:fields].keys.index_with do
             %i[id name slug description field_order]
@@ -111,11 +172,11 @@ module CamaleonCms
         end
 
         def permitted_field_options
-          return {} unless params[:field_options].present?
+          return {} if params[:field_options].blank?
 
           params.require(:field_options).permit(params[:field_options].keys.index_with do
-            [:field_key, :multiple, :required, :translate, :default_value, :dimension, :width, :height, :class, :placeholder,
-             { default_values: [], multiple_options: %i[title value default] }]
+            [:field_key, :multiple, :required, :translate, :default_value, :dimension, :width, :height, :class,
+             :placeholder, { default_values: [], multiple_options: %i[title value default] }]
           end).to_h
         end
 
@@ -124,15 +185,17 @@ module CamaleonCms
           errors_saved, _all_fields = group.add_fields(permitted_fields, permitted_field_options)
           group.set_option('caption', @caption)
           if errors_saved.present?
-            flash[:error] = "<b>#{t('camaleon_cms.errors_found_msg', default: 'Several errors were found, please check.')}</b><br>#{errors_saved.map do |field|
-                                                                                                                                      "#{field.name}: " + field.errors.messages.map do |k, v|
-                                                                                                                                                            "#{k.to_s.titleize}: #{v.join('|')}"
-                                                                                                                                                          end.join(', ').to_s
-                                                                                                                                    end.join('<br>')}"
+            errors_found_msg = t('camaleon_cms.errors_found_msg', default: 'Several errors were found, please check.')
+            errors_saved_all_text = errors_saved.map do |field|
+              "#{field.name}: " + field.errors.messages.map do |k, v|
+                "#{k.to_s.titleize}: #{v.join('|')}"
+              end.join(', ').to_s
+            end.join('<br>')
+            flash[:error] = "<b>#{errors_found_msg}</b><br>#{errors_saved_all_text}"
+            false
           else
             flash[:notice] = t('camaleon_cms.admin.custom_field.message.custom_updated')
           end
-          true
         end
       end
     end

data/app/controllers/camaleon_cms/admin/settings/post_types_controller.rb

@@ -50,7 +50,10 @@ module CamaleonCms
         private
 
         def set_data_term
-          data_term = params.require(:post_type).permit(:name, :slug, :description, :parent_id)
+          # parent_id is the post type's site_id (alias_attribute). It is set from the site association
+          # on create and must never be reassigned, so it is not accepted from the request; otherwise a
+          # settings manager could re-home the post type onto another site (audit finding H8).
+          data_term = params.require(:post_type).permit(:name, :slug, :description)
           data_term[:data_options] = params[:meta].present? ? post_type_meta_params : {}
           @data_term = data_term
         end
@@ -64,7 +67,7 @@ module CamaleonCms
         end
 
         def set_post_type
-          @post_type = current_site.post_types.find_by_id(params[:id])
+          @post_type = current_site.post_types.find_by(id: params[:id])
         rescue StandardError
           flash[:error] = t('camaleon_cms.admin.post_type.message.error')
           redirect_to cama_admin_path

data/app/controllers/camaleon_cms/admin/settings/sites_controller.rb

@@ -47,7 +47,7 @@ module CamaleonCms
           if @site.save
             save_metas(@site)
             site_after_install(@site, @site.get_theme_slug)
-            flash[:notice] = t('camaleon_cms.admin.sites.message.created')
+            flash[:notice] = site_created_notice(@site)
             redirect_to action: :index
           else
             new
@@ -62,7 +62,7 @@ module CamaleonCms
         private
 
         def save_metas(site)
-          return unless params[:metas].present?
+          return if params[:metas].blank?
 
           params[:metas].each do |meta, val|
             site.set_meta(meta, val)
@@ -70,7 +70,7 @@ module CamaleonCms
         end
 
         def set_site
-          @site = CamaleonCms::Site.find_by_id(params[:id]).decorate
+          @site = CamaleonCms::Site.find_by(id: params[:id]).decorate
         rescue StandardError
           flash[:error] = t('camaleon_cms.admin.sites.message.error')
           redirect_to cama_admin_path
@@ -87,6 +87,29 @@ module CamaleonCms
         def site_params
           params.require(:site).permit(:name, :slug, :description)
         end
+
+        # When creating an additional site provisions a fresh administrator (only when users are not
+        # shared across sites), surface its generated password once to the authenticated creator, with
+        # a copy control. Otherwise a plain confirmation. See harden-installer-default-admin.
+        def site_created_notice(site)
+          password = site.generated_admin_password
+          return t('camaleon_cms.admin.sites.message.created') if password.blank?
+
+          # rubocop:disable Style/FormatStringToken -- Rails i18n interpolation requires %{...} syntax
+          message = t(
+            'camaleon_cms.admin.sites.message.created_with_admin',
+            password: password,
+            default: 'Site created. New administrator password: %{password}. Change it after signing in.'
+          )
+          # rubocop:enable Style/FormatStringToken
+          copy = helpers.tag.button(
+            t('camaleon_cms.admin.installer.copy', default: 'Copy'),
+            type: 'button',
+            class: 'btn btn-xs btn-default',
+            onclick: "navigator.clipboard&&navigator.clipboard.writeText('#{password}')"
+          )
+          helpers.safe_join([message, ' ', copy])
+        end
       end
     end
   end

data/app/controllers/camaleon_cms/admin/settings_controller.rb

@@ -62,11 +62,13 @@ module CamaleonCms
       end
 
       def save_theme
-        current_theme.set_field_values(params[:theme_fields]) if params[:theme_fields].present?
+        current_theme.set_field_values(cama_permitted_field_options('Theme', param_key: :theme_fields))
         current_theme.set_options(params[:theme_option]) if params[:theme_option].present?
         current_theme.set_metas(params[:theme_meta]) if params[:theme_meta].present?
         current_theme.set_field_values(cama_permitted_field_options('Theme'))
-        hook_run(current_theme.settings, 'on_theme_settings', current_theme) # permit to save extra/custom values by this hook
+
+        # permit saving extra/custom values by this hook
+        hook_run(current_theme.settings, 'on_theme_settings', current_theme)
         flash[:notice] = t('camaleon_cms.admin.message.updated_success', default: 'Theme updated successfully')
         redirect_to action: :theme
       end
@@ -77,7 +79,7 @@ module CamaleonCms
         CamaleonCms::HtmlMailer.sender(params[:email], 'Test', data).deliver_now
         head :ok
       rescue StandardError => e
-        render plain: e.message, status: 502
+        render plain: e.message, status: :bad_gateway
       end
 
       private

data/app/controllers/camaleon_cms/admin/user_roles_controller.rb

@@ -23,10 +23,12 @@ module CamaleonCms
         user_role_data = params.require(:user_role).permit(:name, :slug, :description)
         @user_role = current_site.user_roles.new(user_role_data)
         if @user_role.save
-          @user_role.set_meta("_post_type_#{current_site.id}",
-                              defined?(params[:rol_values][:post_type]) ? params[:rol_values][:post_type] : {})
-          @user_role.set_meta("_manager_#{current_site.id}",
-                              defined?(params[:rol_values][:post_type]) ? params[:rol_values][:manager] : {})
+          if @user_role.permissions_editable?
+            @user_role.set_meta("_post_type_#{current_site.id}",
+                                defined?(params[:rol_values][:post_type]) ? params[:rol_values][:post_type] : {})
+            @user_role.set_meta("_manager_#{current_site.id}",
+                                defined?(params[:rol_values][:post_type]) ? params[:rol_values][:manager] : {})
+          end
           flash[:notice] = t('camaleon_cms.admin.users.message.rol_created')
           redirect_to action: :edit, id: @user_role.id
         else
@@ -41,7 +43,7 @@ module CamaleonCms
 
       def update
         if @user_role.update(params.require(:user_role).permit(:name, :slug, :description))
-          if @user_role.editable?
+          if @user_role.permissions_editable?
             @user_role.set_meta("_post_type_#{current_site.id}",
                                 defined?(params[:rol_values][:post_type]) ? params[:rol_values][:post_type] : {})
             @user_role.set_meta("_manager_#{current_site.id}",

data/app/controllers/camaleon_cms/admin/users_controller.rb

@@ -3,6 +3,11 @@ module CamaleonCms
     class UsersController < CamaleonCms::AdminController
       include CamaleonCms::Admin::CustomFieldsConcern
 
+      # Member actions resolve a single target user, so a caller acting on their own record is
+      # legitimately exempt from :manage, :users. The collection actions (index/new/create) resolve
+      # no such target, so a self-referential ?user_id= must not exempt them from the capability check.
+      SELF_TARGET_ACTIONS = %w[show edit update destroy impersonate updated_ajax].freeze
+
       before_action :validate_role, except: %i[profile profile_edit]
 
       add_breadcrumb I18n.t('camaleon_cms.admin.sidebar.users'), :cama_admin_users_url
@@ -16,7 +21,16 @@ module CamaleonCms
 
       def profile
         add_breadcrumb I18n.t('camaleon_cms.admin.users.profile')
-        @user = params[:user_id].present? ? current_site.the_user(params[:user_id].to_i).object : cama_current_user.object
+        user_id = params[:user_id]
+        # Authorize from the parameter before loading, so a denied caller cannot tell
+        # whether the requested user exists from the shape of the response.
+        authorize! :manage, :users if user_id.present? && user_id.to_i != cama_current_user.id
+        @user = user_id.present? ? current_site.the_user(user_id.to_i)&.object : cama_current_user.object
+        if @user.blank?
+          flash[:error] = t('camaleon_cms.admin.users.message.error')
+          return redirect_to(cama_admin_path)
+        end
+
         edit
       end
 
@@ -36,7 +50,7 @@ module CamaleonCms
         hooks_run('user_update', r)
         if @user.update(user_params)
           @user.set_metas(user_meta_params) if params[:meta].present?
-          @user.set_field_values(cama_permitted_field_options('User')) if params[:field_options].present?
+          @user.set_field_values(cama_permitted_field_options(user_field_scope)) if params[:field_options].present?
           r = { user: @user, message: t('camaleon_cms.admin.users.message.updated'), params: params }
           hooks_run('user_after_edited', r)
           flash[:notice] = r[:message]
@@ -54,17 +68,33 @@ module CamaleonCms
 
       # update some ajax requests from profile or user form
       def updated_ajax
-        @user = current_site.users.find(params[:user_id])
+        @user = current_site.users.find(user_id_param)
+        # Only an admin may reset an admin's password; a `:manage, :users` holder who could would sign in
+        # as that admin (H10). Self-service and non-admin targets are unaffected.
+        unless cama_current_user.may_edit_credentials?(@user)
+          return render plain: t('camaleon_cms.admin.users.message.error'), status: :forbidden
+        end
+
         update_session = current_user_is?(@user)
         attrs = params.require(:password).permit(%i[password password_confirmation])
         @user.update(password: attrs.require(:password), password_confirmation: attrs.require(:password_confirmation))
 
-        return render inline: @user.errors.full_messages.join(', '), status: :unprocessable_entity if @user.errors.any?
+        return render plain: @user.errors.full_messages.join(', '), status: :unprocessable_entity if @user.errors.any?
+
+        # A newly provisioned admin (see harden-installer-default-admin) owes a password change; clearing
+        # the marker on a real change lets them past the enforce_password_change gate.
+        @user.delete_meta('must_change_password') if @user.saved_change_to_password_digest?
 
         # keep user logged in when changing their own password
         update_auth_token_in_cookie @user.auth_token if update_session && @user.saved_change_to_password_digest?
+      rescue ActiveRecord::RecordNotFound
+        # The other failure paths of this action answer with a status and a short text body, so an
+        # unresolvable target does too rather than falling through to the framework's HTML error
+        # page. Catch this class only, never StandardError, so a genuine lookup failure still
+        # surfaces instead of being reported as a missing user.
+        render plain: t('camaleon_cms.admin.users.message.error'), status: :not_found
       rescue ActionController::ParameterMissing => e
-        render inline: "ERROR: #{e.class.name}, #{e.message}", status: :bad_request
+        render plain: "ERROR: #{e.class.name}, #{e.message}", status: :bad_request
       end
 
       def update_auth_token_in_cookie(token)
@@ -72,7 +102,10 @@ module CamaleonCms
 
         current_token = cookie_split_auth_token
         updated_token = [token, *current_token[1..]]
-        cookies[:auth_token] = updated_token.join('&')
+        # Route through the shared hardened-cookie options (audit M3/M4): a bare assignment here
+        # re-issued the auth cookie without HttpOnly/Secure/domain/expiry when a user changed their
+        # own password, undoing the M3 hardening for that session.
+        cookies[:auth_token] = cama_auth_cookie_options(updated_token.join('&'))
       end
 
       def current_user_is?(user)
@@ -102,7 +135,7 @@ module CamaleonCms
         hooks_run('user_create', r)
         if @user.save
           @user.set_metas(user_meta_params) if params[:meta].present?
-          @user.set_field_values(cama_permitted_field_options('User')) if params[:field_options].present?
+          @user.set_field_values(cama_permitted_field_options(user_field_scope)) if params[:field_options].present?
           r = { user: @user }
           hooks_run('user_created', r)
           flash[:notice] = t('camaleon_cms.admin.users.message.created')
@@ -133,16 +166,43 @@ module CamaleonCms
       private
 
       def validate_role
-        (user_id_param.present? && cama_current_user.id.to_s == user_id_param) || authorize!(:manage, :users)
+        return if self_target_own_record?
+
+        authorize! :manage, :users
       end
 
+      # The self-exemption applies only to member actions that resolve a single target user; a
+      # collection action (index/new/create) has no such target, so a self-referential ?user_id=
+      # never exempts it (audit finding H7).
+      def self_target_own_record?
+        return false unless SELF_TARGET_ACTIONS.include?(action_name)
+
+        user_id = user_id_param
+        user_id.present? && cama_current_user.id.to_s == user_id.to_s
+      end
+
+      # Only a scalar user_id participates in target resolution (?user_id[]= would
+      # crash the record lookup and flip authorization); otherwise the route id wins
       def user_id_param
-        params[:id] || params[:user_id]
+        user_id = params[:user_id]
+        return params[:id] unless user_id.is_a?(String)
+
+        user_id
       end
 
       def user_params
-        p = params.require(:user).permit(:username, :email, :first_name, :last_name, :password, :password_confirmation)
-        p[:role] = params[:user][:role] if cama_current_user.role_grantor?(@user) && params[:user][:role].present?
+        fields = %i[username email first_name last_name password password_confirmation]
+        # Only an admin may change an admin's password or recovery identifiers (email/username); drop them
+        # for anyone else editing an admin, the same fail-safe the role permit below uses (H10).
+        unless cama_current_user.may_edit_credentials?(@user)
+          fields -= %i[username email password password_confirmation]
+        end
+        p = params.require(:user).permit(*fields)
+        # role is a scalar slug; coerce anything else (e.g. a nested user[role][x] param) to nil so it is
+        # never mass-assigned — assigning an unpermitted nested Parameters would raise and 500 the request.
+        requested_role = params[:user][:role]
+        requested_role = nil unless requested_role.is_a?(String)
+        p[:role] = requested_role if requested_role.present? && cama_current_user.role_grantor?(@user, requested_role)
         p
       end
 
@@ -150,6 +210,13 @@ module CamaleonCms
         params.require(:meta).permit(:avatar, :slogan)
       end
 
+      # Allowed field slugs must be keyed on the demodulized placement name the settings form
+      # emits and get_user_field_groups queries; keyed on a hardcoded 'User' the lookup finds no
+      # groups for a host user model that demodulizes to another name, discarding every value.
+      def user_field_scope
+        PluginRoutes.get_user_class_name.demodulize
+      end
+
       def set_user
         @user = current_site.users.find(user_id_param)
       rescue StandardError

data/app/controllers/camaleon_cms/admin_controller.rb

@@ -4,11 +4,25 @@ module CamaleonCms
       flash[:error] = "Error: #{exception.message}"
       redirect_to cama_admin_dashboard_path
     end
-    include CamaleonCms::Admin::ApplicationHelper
+    # Security (scan-and-reject policy, audit M17): custom-field values save after their parent
+    # through `custom_field_values.create!`, so a value the gate refuses arrives here as
+    # RecordInvalid. Surface the refusal as a flash error naming the field instead of a 500; the
+    # parent's own attributes were already saved, only the refused value rows are rolled back.
+    rescue_from ActiveRecord::RecordInvalid do |exception|
+      raise exception unless exception.record.is_a?(CamaleonCms::CustomFieldsRelationship)
+
+      flash[:error] = exception.record.errors.full_messages.to_sentence
+      redirect_back fallback_location: cama_admin_dashboard_path
+    end
     # layout 'camaleon_cms/admin'
+    # Admin responses are user-specific and must never be served from a browser or shared cache;
+    # without this a stale render (e.g. an editor that failed to initialize on a cold boot) can
+    # reappear after a restart until a manual reload. Set first so it applies to auth redirects too.
+    before_action :cama_prevent_response_caching
     before_action :cama_authenticate
     before_action :keep_request_attrs
     before_action :admin_init_actions
+    before_action :enforce_password_change
     before_action :admin_logged_actions
     before_action :admin_before_hooks
     after_action :admin_after_hooks
@@ -16,6 +30,7 @@ module CamaleonCms
              params[:cama_ajax_request].present? ? 'camaleon_cms/admin/_ajax' : 'camaleon_cms/admin'
            }
     add_breadcrumb I18n.t('camaleon_cms.admin.sidebar.dashboard', default: 'Dashboard'), :cama_admin_path
+    helper_method :cama_get_i18n_frontend
 
     # render admin dashboard
     def index
@@ -42,46 +57,95 @@ module CamaleonCms
     # render search results
     # receive params[:q]
     # receive params[:kind]: define de type of the results type (content|category|tag) => default content
-    # if this is receive a param[:ajax], then will render only results view
+    # if this is receiving a param[:ajax], then will render only results view
     def search
       add_breadcrumb I18n.t('camaleon_cms.admin.button.search')
-      params[:kind] = 'content' unless params[:kind].present?
-      params[:q] = (params[:q] || '').downcase
-      @items = case params[:kind]
-               when 'post_type'
-                 current_site.post_types.where(
-                   "LOWER(#{Cama::PostType.table_name}.name) LIKE ? OR LOWER(#{Cama::PostType.table_name}.slug) LIKE ? OR LOWER(#{Cama::PostType.table_name}.description) LIKE ?", "%#{params[:q]}%", "%#{params[:q]}%", "%#{params[:q]}%"
-                 )
-               when 'category'
-                 current_site.full_categories.where(
-                   "LOWER(#{Cama::Category.table_name}.name) LIKE ? OR LOWER(#{Cama::Category.table_name}.slug) LIKE ? OR LOWER(#{Cama::Category.table_name}.description) LIKE ?", "%#{params[:q]}%", "%#{params[:q]}%", "%#{params[:q]}%"
-                 )
-               when 'tag'
-                 current_site.post_tags.where(
-                   "LOWER(#{Cama::PostTag.table_name}.name) LIKE ? OR LOWER(#{Cama::PostTag.table_name}.slug) LIKE ? OR LOWER(#{Cama::PostTag.table_name}.description) LIKE ?", "%#{params[:q]}%", "%#{params[:q]}%", "%#{params[:q]}%"
-                 )
-               else
-                 current_site.posts.where(
-                   "LOWER(#{Cama::Post.table_name}.title) LIKE ? OR LOWER(#{Cama::Post.table_name}.slug) LIKE ? OR LOWER(#{Cama::Post.table_name}.content_filtered) LIKE ?", "%#{params[:q]}%", "%#{params[:q]}%", "%#{params[:q]}%"
-                 )
-               end
+      params[:kind] = 'content' if params[:kind].blank?
+      # A crafted ?q[]=x / ?q[a]=b arrives as an Array / Parameters, which has no #downcase; treat any
+      # non-String q as an empty query instead of 500ing.
+      params[:q] = params[:q].is_a?(String) ? params[:q].downcase : ''
+      # Security (audit 2026-08-11 M12): the action had no authorization and no status filter, so any
+      # admin-area user (e.g. a client with no content rights) could enumerate every post title/slug in
+      # every status -- draft, pending, private, trash -- plus post types, categories and tags they
+      # cannot access. Scope every kind to the post types the caller may manage: content and post types
+      # by :posts, categories and tags by their own :categories / :post_tags abilities (the roles UI
+      # grants manage_categories / manage_tags independently of any post edit right).
+      table_name = case params[:kind]
+                   when 'post_type'
+                     base_query = current_site.post_types.where(id: cama_admin_searchable_post_type_ids)
+                     Cama::PostType.table_name
+                   when 'category'
+                     pt_ids = cama_admin_searchable_post_type_ids(:categories)
+                     # A category's post type lives in post_type_id (the status column) at every nesting
+                     # level; parent_id points at the parent *category* for children, so filtering by it
+                     # would drop every nested category.
+                     base_query = current_site.full_categories.where(post_type_id: pt_ids)
+                     Cama::Category.table_name
+                   when 'tag'
+                     pt_ids = cama_admin_searchable_post_type_ids(:post_tags)
+                     base_query = current_site.post_tags.where(parent_id: pt_ids)
+                     Cama::PostTag.table_name
+                   else
+                     base_query = cama_admin_searchable_posts
+                     Cama::Post.table_name
+                   end
+      @items = base_query.where(
+        items_sql_by_name(table_name), "%#{params[:q]}%", "%#{params[:q]}%", "%#{params[:q]}%"
+      )
+
       @items = @items.paginate(page: params[:page], per_page: current_site.admin_per_page)
     end
 
+    # Decorators use this helper while rendering admin pages to keep public URLs in
+    # the site's frontend language instead of the admin interface language.
+    def cama_get_i18n_frontend
+      @cama_i18n_frontend
+    end
+
     private
 
+    # Send `Cache-Control: no-store` on every admin response so no admin page is ever cached by the
+    # browser or an intermediary. Admin pages are per-user and dynamic; caching them risks a stale
+    # render being reused (the cold-boot blank-editor symptom is one such case).
+    def cama_prevent_response_caching
+      response.headers['Cache-Control'] = 'no-store'
+    end
+
+    # Actions reachable while an administrator still owes a password change: the profile screen, its
+    # submit, and the AJAX password-change endpoint. Everything else in the admin panel is redirected
+    # to the change-password screen until the marker is cleared. Sign-out lives on SessionsController
+    # (not an AdminController subclass), so it is out of this gate's reach and always reachable.
+    PASSWORD_CHANGE_EXEMPT = { 'camaleon_cms/admin/users' => %w[profile profile_edit update updated_ajax] }.freeze
+
+    # Force a newly provisioned administrator (minted with a generated password, see
+    # harden-installer-default-admin) to set their own password before using the admin panel.
+    def enforce_password_change
+      return if cama_current_user.blank?
+      return if cama_current_user.get_meta('must_change_password').blank?
+      return if PASSWORD_CHANGE_EXEMPT[controller_path]&.include?(action_name)
+
+      flash[:alert] = t('camaleon_cms.admin.users.message.must_change_password',
+                        default: 'Please choose a new password before continuing.')
+      redirect_to cama_admin_profile_edit_path
+    end
+
     # initialize all vars and methods for admin panel
     def admin_init_actions
       I18n.locale = current_site.get_admin_language
-      @_admin_menus = {}
+      # Alias the legacy @_admin_menus ivar onto the live menu store so a hook using the WordPress-style
+      # `@_admin_menus.delete('comments')` removal idiom mutates the same hash admin_menu_draw reads. The
+      # menu-insert methods mutate in place (.replace), so this reference stays valid. Regression M19.
+      @_admin_menus = CurrentRequest.admin_menu_items = {}
       @_admin_breadcrumb = []
       @_extra_models_for_fields = []
+      # Cache the site's frontend language for decorators and plugins that still
+      # need to distinguish admin requests from frontend visitor requests.
       @cama_i18n_frontend = current_site.get_languages.first
     end
 
     # trigger hooks for admin panel before admin load
     def admin_before_hooks
-      hooks_run('admin_before_load')
+      run_hook_lifecycle('admin_before_load')
     end
 
     # Set cama_current_user and current_site in CurrentRequest so models can access the current context.
@@ -93,11 +157,57 @@ module CamaleonCms
 
     # trigger hooks for admin panel after admin load
     def admin_after_hooks
-      hooks_run('admin_after_load')
+      run_hook_lifecycle('admin_after_load')
     end
 
     def admin_logged_actions
-      admin_menus_add_commons if !request.xhr? || !params[:cama_ajax_request].present? # initialize admin sidebar menus
+      admin_menus_add_commons if !request.xhr? || params[:cama_ajax_request].blank? # initialize admin sidebar menus
+    end
+
+    # Post types on which the caller holds `action`: :posts for content and the post-type kind,
+    # :categories / :post_tags for the taxonomy kinds. Admins hold every ability on every type, so
+    # skip the per-record sweep (and the redundant IN filter it would feed) for them.
+    def cama_admin_searchable_post_type_ids(action = :posts)
+      return current_site.post_types.ids if can?(:manage, :all)
+
+      cama_admin_searchable_post_types(action).map(&:id)
+    end
+
+    def cama_admin_searchable_post_types(action)
+      current_site.post_types.select { |pt| can?(action, pt) }
+    end
+
+    # Posts the caller may see in admin search: the accessible post types narrowed by the shared
+    # admin visibility rule. edit_other implies :posts, so the visibility sweep only rechecks the
+    # already-loaded listable subset; admins skip the scoping entirely.
+    def cama_admin_searchable_posts
+      return current_site.posts if can?(:manage, :all)
+
+      listable = cama_admin_searchable_post_types(:posts)
+      cama_admin_visible_posts(current_site.posts.where(post_type_id: listable.map(&:id)), listable)
+    end
+
+    # Restrict `scope` to the posts the caller may see in admin listings across `post_types`: every
+    # post on the types where they hold edit_other, only their own elsewhere. Admins see everything.
+    # Single source of the visibility rule for PostsController#index (per post type) and admin search
+    # (across types) -- these drifting apart is how the M12 disclosure shipped, so change it here, not
+    # at a call site.
+    def cama_admin_visible_posts(scope, post_types)
+      return scope if can?(:manage, :all)
+
+      edit_other_ids = post_types.select { |pt| can?(:edit_other, pt) }.map(&:id)
+      return scope if edit_other_ids.length == post_types.length
+
+      scope.where(post_type_id: edit_other_ids).or(scope.where(user_id: cama_current_user.id))
+    end
+
+    def items_sql_by_name(table_name)
+      lower_name = "LOWER(#{table_name}"
+      if table_name == Cama::Post.table_name
+        return "#{lower_name}.title) LIKE ? OR #{lower_name}.slug) LIKE ? OR #{lower_name}.content_filtered) LIKE ?"
+      end
+
+      "#{lower_name}.name) LIKE ? OR #{lower_name}.slug) LIKE ? OR #{lower_name}.description) LIKE ?"
     end
   end
 end