camaleon_cms 2.9.2 → 2.9.3

data/app/controllers/concerns/camaleon_cms/frontend_concern.rb

@@ -4,7 +4,8 @@ module CamaleonCms
     # visiting sitemap.xml
     # With hook "on_render_sitemap" you can skip post_types, categories, tags or posts
     #   you can change render file and layout
-    #   you can add custom sitemap elements in the attr "custom", like: https://github.com/owen2345/camaleon-cms/issues/106#issuecomment-146232211
+    #   you can add custom sitemap elements in the attr "custom",
+    #     like: https://github.com/owen2345/camaleon-cms/issues/106#issuecomment-146232211
     #   you can customize your content for html or xml format
     def sitemap
       r = { layout: (params[:format] == 'html' ? nil : false), render: 'sitemap', custom: {}, format: params[:format],
@@ -31,21 +32,33 @@ module CamaleonCms
     # save comment from a post
     def save_comment
       flash[:comment_submit] = {}
-      @post = current_site.posts.find_by_id(params[:post_id]).decorate
+      # Security (audit Low): this is a public endpoint. A post id naming no post used to reach
+      # `.decorate` on nil (500), and the anonymous branch indexed a missing post_comment param.
+      # Fail closed with a graceful error instead of a 500 an attacker can trigger at will.
+      @post = current_site.posts.find_by(id: params[:post_id])&.decorate
       user = cama_current_user
       comment_data = {}
-      unless @post.can_commented?
-        flash[:comment_submit][:error] =
-          t('.comments_not_enabled', default: 'This post can not be commented')
+      if @post.nil?
+        flash[:comment_submit][:error] = t('.post_not_found', default: 'Post not found')
+      elsif !@post.can_commented?
+        flash[:comment_submit][:error] = t('.comments_not_enabled', default: 'This post can not be commented')
       end
+
+      # Security (audit Low): params[:post_comment] is attacker-controlled and may arrive as a scalar
+      # or array, not the expected hash. `|| {}` only covered nil; indexing a String/Array with a
+      # symbol key raises TypeError (500). Coerce anything not hash-shaped to an empty hash so every
+      # post_comment[...] read below is safe.
+      post_comment = params[:post_comment]
+      post_comment = {} unless post_comment.is_a?(ActionController::Parameters) || post_comment.is_a?(Hash)
+
       if user.present?
         comment_data[:author] = user.fullname
         comment_data[:author_email] = user.email
       elsif current_site.get_option('permit_anonimos_comment', false)
         user = current_site.get_anonymous_user
         comment_data[:is_anonymous] = true
-        comment_data[:author] = params[:post_comment][:name]
-        comment_data[:author_email] = params[:post_comment][:email]
+        comment_data[:author] = post_comment[:name]
+        comment_data[:author_email] = post_comment[:email]
         if current_site.is_enable_captcha_for_comments? && !cama_captcha_verified?
           flash[:comment_submit][:error] =
             t('camaleon_cms.admin.users.message.error_captcha',
@@ -56,24 +69,40 @@ module CamaleonCms
       unless flash[:comment_submit][:error]
         if user.present?
           comment_data[:user_id] = user.id
-          comment_data[:author_url] = params[:post_comment][:url] || ''
+          comment_data[:author_url] = post_comment[:url] || ''
           comment_data[:author_IP] = request.remote_ip.to_s
           comment_data[:approved] = current_site.front_comment_status
-          comment_data[:agent] = request.user_agent.force_encoding('ISO-8859-1').encode('UTF-8')
-          comment_data[:content] = params[:post_comment][:content]
-          @comment = params[:post_comment][:parent_id].present? ? @post.comments.find_by_id(params[:post_comment][:parent_id]).children.new(comment_data) : @post.comments.main.new(comment_data)
-          if @comment.save
-            flash[:comment_submit][:notice] = t('camaleon_cms.admin.comments.message.created')
+          # Browsers always send a User-Agent but API clients/bots may not; record it nil-safely
+          # and without mutating the request's header string in place.
+          comment_data[:agent] = request.user_agent.to_s.encode('UTF-8', 'ISO-8859-1')
+          comment_data[:content] = post_comment[:content]
+          # Security (audit Low): a crafted parent_id naming no comment on this post made find_by
+          # return nil and the chained `.children` raise (500). Resolve the parent first and fail
+          # closed with a graceful error when a supplied parent_id matches nothing.
+          parent_id = post_comment[:parent_id]
+          parent = @post.comments.find_by(id: parent_id) if parent_id.present?
+          if parent_id.present? && parent.nil?
+            flash[:comment_submit][:error] = t('.parent_comment_not_found', default: 'Parent comment not found')
           else
-            flash[:comment_submit][:error] =
-              "#{t('camaleon_cms.common.comment_error',
-                   default: 'An error was occurred on save comment')}:<br> #{@comment.errors.full_messages.join(', ')}"
+            @comment = parent ? parent.children.new(comment_data) : @post.comments.main.new(comment_data)
+            if @comment.save
+              flash[:comment_submit][:notice] = t('camaleon_cms.admin.comments.message.created')
+            else
+              base = t('camaleon_cms.common.comment_error', default: 'An error was occurred on save comment')
+              flash[:comment_submit][:error] = "#{base}:<br> #{@comment.errors.full_messages.join(', ')}"
+            end
           end
         else
           flash[:comment_submit][:error] = t('camaleon_cms.admin.message.unauthorized')
         end
       end
-      params[:format] == 'json' ? render(json: flash.discard(:comment_submit).to_hash) : redirect_to(request.referer || @post.the_url(as_path: true))
+
+      return render(json: flash.discard(:comment_submit).to_hash) if params[:format] == 'json'
+
+      # Security (audit Low): the Referer header is attacker-controlled; redirecting to it raw is an
+      # open redirect (Rails < 7) or an UnsafeRedirectError 500 (Rails >= 7). Vet it through the shared
+      # same-host/allowlist redirect helper, falling back to the post URL (or root).
+      cama_safe_redirect(request.referer, @post&.the_url(as_path: true) || '/')
     end
   end
 end

data/app/controllers/concerns/camaleon_cms/frontend_visited_state_concern.rb

@@ -0,0 +1,72 @@
+module CamaleonCms
+  module FrontendVisitedStateConcern
+    extend ActiveSupport::Concern
+
+    LEGACY_VISITED_IVAR_BY_ATTR = {
+      frontend_visited_home: :@cama_visited_home,
+      frontend_visited_post: :@cama_visited_post,
+      frontend_visited_ajax: :@cama_visited_ajax,
+      frontend_visited_search: :@cama_visited_search,
+      frontend_visited_post_type: :@cama_visited_post_type,
+      frontend_visited_tag: :@cama_visited_tag,
+      frontend_visited_category: :@cama_visited_category,
+      frontend_visited_profile: :@cama_visited_profile
+    }.freeze
+
+    private
+
+    def mark_frontend_home_visited
+      set_frontend_visited_state(:frontend_visited_home, true)
+    end
+
+    def mark_frontend_post_visited(post)
+      set_frontend_visited_state(:frontend_visited_post, post)
+    end
+
+    def mark_frontend_ajax_visited
+      set_frontend_visited_state(:frontend_visited_ajax, true)
+    end
+
+    def mark_frontend_search_visited
+      set_frontend_visited_state(:frontend_visited_search, true)
+    end
+
+    def mark_frontend_post_type_visited(post_type)
+      set_frontend_visited_state(:frontend_visited_post_type, post_type)
+    end
+
+    def mark_frontend_tag_visited(post_tag)
+      set_frontend_visited_state(:frontend_visited_tag, post_tag)
+    end
+
+    def mark_frontend_category_visited(category)
+      set_frontend_visited_state(:frontend_visited_category, category)
+    end
+
+    def mark_frontend_profile_visited(user = nil)
+      set_frontend_visited_state(:frontend_visited_profile, true)
+      CurrentRequest.frontend_user = user if user.present?
+    end
+
+    def set_frontend_visited_state(current_request_attr, value)
+      CurrentRequest.public_send("#{current_request_attr}=", value)
+      legacy_ivar = LEGACY_VISITED_IVAR_BY_ATTR[current_request_attr]
+      return if legacy_ivar.blank?
+
+      instance_variable_set(legacy_ivar, value)
+      warn_frontend_legacy_visited_ivar(legacy_ivar, current_request_attr)
+    end
+
+    def warn_frontend_legacy_visited_ivar(legacy_ivar, current_request_attr)
+      warned_legacy_ivars = self.class.instance_variable_get(:@_warned_frontend_legacy_visited_ivars) || {}
+      return if warned_legacy_ivars[legacy_ivar]
+
+      ActiveSupport::Deprecation._instance.warn(
+        "Controller compatibility ivar #{legacy_ivar} is deprecated and will be removed in a future major release. " \
+        "Use CurrentRequest.#{current_request_attr} instead."
+      )
+      warned_legacy_ivars[legacy_ivar] = true
+      self.class.instance_variable_set(:@_warned_frontend_legacy_visited_ivars, warned_legacy_ivars)
+    end
+  end
+end

data/app/controllers/concerns/camaleon_cms/hook_lifecycle_concern.rb

@@ -0,0 +1,104 @@
+module CamaleonCms
+  module HookLifecycleConcern
+    extend ActiveSupport::Concern
+
+    def hook_run(plugin, hook_key, params = nil)
+      _do_hook(plugin, hook_key, params)
+    end
+
+    def hooks_run(hook_key, params = nil)
+      theme_slug = current_theme&.slug.presence || current_site.get_theme_slug
+      PluginRoutes.enabled_apps(current_site, theme_slug).each do |plugin|
+        _do_hook(plugin, hook_key, params)
+      end
+
+      PluginRoutes.get_anonymous_hooks(hook_key).each do |_hook|
+        _hook.call(params)
+      end
+    end
+
+    def hook_skip(hook_function_name)
+      hook_skip_list << hook_function_name
+    end
+
+    private
+
+    def initialize_hook_skip_list
+      hooks_skip = []
+      CurrentRequest.hooks_helper_state ||= {}
+      CurrentRequest.hooks_helper_state[:hooks_skip] = hooks_skip
+      @_hooks_skip = hooks_skip
+    end
+
+    def run_hook_lifecycle(hook_name, payload = nil)
+      payload.nil? ? hooks_run(hook_name) : hooks_run(hook_name, payload)
+    end
+
+    def run_app_before_load_hooks
+      run_hook_lifecycle('app_before_load')
+    end
+
+    def run_app_after_load_hooks
+      run_hook_lifecycle('app_after_load')
+    end
+
+    def _do_hook(plugin, hook_key, params = nil)
+      return if plugin.blank? || plugin['hooks'].blank? || plugin['hooks'][hook_key].blank?
+
+      plugin['hooks'][hook_key].each do |hook|
+        next if hook_skip_list.include?(hook)
+
+        begin
+          if params.nil?
+            send(hook)
+          else
+            send(hook, params)
+          end
+          Rails.logger.debug "Camaleon CMS - Hook \"#{hook_key}\" executed from dependency #{begin
+            plugin['key']
+          rescue StandardError
+            ''
+          end}".cama_log_style(:light_blue)
+        rescue StandardError
+          plugin_load_helpers(plugin)
+          next unless respond_to?(hook, true)
+
+          if params.nil?
+            send(hook)
+          else
+            send(hook, params)
+          end
+        end
+      end
+    end
+
+    def hook_skip_list
+      state = camaleon_hooks_state
+      return state[:hooks_skip] if state[:hooks_skip]
+
+      # back-compat: legacy plugins/themes may seed @_hooks_skip directly on the
+      # controller. Honored here (controller concern) only as initial input so the
+      # shared view helper stays ivar-free.
+      existing_hooks_skip = @_hooks_skip
+      state[:hooks_skip] = existing_hooks_skip.is_a?(Array) ? existing_hooks_skip : []
+    end
+
+    def camaleon_hooks_state
+      CurrentRequest.hooks_helper_state ||= {}
+    end
+
+    def plugin_load_helpers(plugin)
+      return if plugin.blank? || plugin['helpers'].blank?
+
+      plugin['helpers'].each do |h|
+        next if self.class.include?(h.constantize)
+
+        self.class.class_eval { include h.constantize }
+      rescue StandardError => e
+        Rails.logger.debug do
+          "Camaleon CMS - App loading error for #{h}: #{e.message}. Please check the plugins and themes presence"
+        end
+      end
+    end
+  end
+end

data/app/controllers/concerns/camaleon_cms/request_context_concern.rb

@@ -0,0 +1,113 @@
+module CamaleonCms
+  # Wires per-request site/theme resolution and Camaleon's before-action
+  # housekeeping into the runtime controller stack. The `current_site` /
+  # `current_theme` implementations live in `CamaleonCms::SiteHelper` (single
+  # source of truth shared with views); this concern only adds controller-only
+  # hooks like view-path setup and site-existence guards.
+  module RequestContextConcern
+    extend ActiveSupport::Concern
+
+    include CamaleonCms::SiteHelper
+
+    # Back-compat: expose the resolved site as the `@current_site` controller
+    # ivar for legacy templates/plugins. The helper logic itself stays ivar-free
+    # (it reads/writes `CurrentRequest.site`); only this controller concern
+    # bridges the value into an instance variable so views/plugins keep working.
+    def current_site(site = nil)
+      result = super
+      @current_site = CurrentRequest.site
+      result
+    end
+
+    private
+
+    def configure_runtime_request_context
+      sanitize_forwarded_host_header
+      configure_runtime_view_paths
+      sync_runtime_defaults
+      assign_template_compatibility_state
+    end
+
+    def sanitize_forwarded_host_header
+      request.env.except!('HTTP_X_FORWARDED_HOST') if request.env['HTTP_X_FORWARDED_HOST']
+    end
+
+    def configure_runtime_view_paths
+      views_dir = 'app/apps/'
+      prepend_view_path(CamaleonCms::Engine.root.join(views_dir).to_s)
+      prepend_view_path(Rails.root.join(views_dir).to_s)
+    end
+
+    def sync_runtime_defaults
+      CamaleonCms::PostDefault.current_user = cama_current_user
+      CamaleonCms::PostDefault.current_site = current_site
+    end
+
+    def assign_template_compatibility_state
+      @current_site = current_site
+    end
+
+    # check if current site exist, if not, this will be redirected to main domain
+    # Also, check current site status
+    def cama_site_check_existence
+      if current_site.blank?
+        redirect_when_site_missing
+      elsif (cama_current_user.present? && !cama_current_user.admin?) || cama_current_user.blank?
+        handle_inactive_site_access
+        handle_maintenance_site_access
+      end
+    end
+
+    def redirect_when_site_missing
+      if Cama::Site.main_site.present?
+        url = Cama::Site.main_site.decorate.the_url
+        # TODO: Remove this condition when Rails 6.x won't be supported
+        if Rails.gem_version >= Gem::Version.new('7.0.0')
+          redirect_to url, allow_other_host: true
+        else
+          redirect_to url
+        end
+      else
+        redirect_to cama_admin_installers_path
+      end
+    end
+
+    def handle_inactive_site_access
+      return unless current_site.is_inactive?
+
+      if request.original_url.to_s.match?(%r{\A#{current_site.the_url}admin(/|\z)})
+        if cama_current_user.present?
+          cama_logout_user
+          flash[:error] = 'Site is Inactive'
+        end
+      else
+        post = current_site.posts.find_by(id: current_site.get_option('page_inactive')).try(:decorate)
+        if post
+          redirect_to(post.the_url) unless params == {
+            'controller' => 'camaleon_cms/frontend',
+            'action' => 'post',
+            'slug' => post.the_slug
+          }
+        else
+          render html: 'This site was inactivated. Please contact to administrator.'
+        end
+      end
+    end
+
+    def handle_maintenance_site_access
+      return unless current_site.is_maintenance?
+      return if current_site.get_option('maintenance_ips', '').split(',').include?(request.remote_ip)
+
+      post = current_site.posts.find_by(id: current_site.get_option('page_maintenance')).try(:decorate)
+      if post
+        redirect_to(post.the_url) if params != {
+          'controller' => 'camaleon_cms/frontend',
+          'action' => 'post',
+          'slug' => post.the_slug
+        }
+      else
+        render html: 'This site is in maintenance mode. Please contact to administrator.'
+      end
+    end
+  end
+end

data/app/controllers/concerns/camaleon_cms/runtime_admin_menu_concern.rb

@@ -0,0 +1,237 @@
+# rubocop:disable Metrics/AbcSize
+module CamaleonCms
+  module RuntimeAdminMenuConcern
+    extend ActiveSupport::Concern
+
+    def admin_menus_add_commons
+      admin_menu_add_menu(
+        'dashboard',
+        { icon: 'dashboard', title: t('camaleon_cms.admin.sidebar.dashboard'), url: cama_admin_dashboard_path }
+      )
+
+      items = []
+      current_site.post_types.eager_load(:metas).visible_menu.find_each do |pt|
+        pt = pt.decorate
+        items_i = []
+        if can? :posts, pt
+          items_i << { icon: 'list', title: t('camaleon_cms.admin.post_type.all').to_s,
+                       url: cama_admin_post_type_posts_path(pt.id) }
+        end
+        if can? :create_post, pt
+          items_i << { icon: 'plus', title: t('camaleon_cms.admin.post_type.add_new', type_title: pt.the_title).to_s,
+                       url: new_cama_admin_post_type_post_path(pt.id) }
+        end
+        if pt.manage_categories? && (can? :categories, pt)
+          items_i << { icon: 'folder-open', title: t('camaleon_cms.admin.post_type.categories'),
+                       url: cama_admin_post_type_categories_path(pt.id) }
+        end
+        if pt.manage_tags? && (can? :post_tags, pt)
+          items_i << { icon: 'tags', title: t('camaleon_cms.admin.post_type.tags'),
+                       url: cama_admin_post_type_post_tags_path(pt.id) }
+        end
+        if items_i.present?
+          items << { icon: pt.get_option('icon', 'copy'), title: pt.the_title, url: '', items: items_i }
+        end
+      end
+
+      if items.present?
+        admin_menu_add_menu(
+          'content',
+          {
+            icon: 'database', title: t('camaleon_cms.admin.sidebar.contents'), url: '', items: items,
+            datas: "data-intro='#{t('camaleon_cms.admin.intro.content')}' data-position='right' data-wait='600'"
+          }
+        )
+      end
+
+      if can? :manage, :media
+        admin_menu_add_menu(
+          'media',
+          {
+            icon: 'picture-o', title: t('camaleon_cms.admin.sidebar.media'), url: cama_admin_media_path,
+            datas: "data-intro='#{t('camaleon_cms.admin.intro.media')}' data-position='right'"
+          }
+        )
+      end
+      if can? :manage, :comments
+        admin_menu_add_menu(
+          'comments',
+          {
+            icon: 'comments', title: t('camaleon_cms.admin.sidebar.comments'), url: cama_admin_comments_path,
+            datas: "data-intro='#{t('camaleon_cms.admin.intro.comments')}' data-position='right'"
+          }
+        )
+      end
+
+      items = []
+      if can? :manage, :themes
+        items << {
+          icon: 'desktop', title: t('camaleon_cms.admin.sidebar.themes'), url: cama_admin_appearances_themes_path,
+          datas: "data-intro='#{t('camaleon_cms.admin.intro.themes')}' data-position='right'"
+        }
+      end
+      if can? :manage, :widgets
+        items << {
+          icon: 'archive', title: t('camaleon_cms.admin.sidebar.widgets'),
+          url: cama_admin_appearances_widgets_main_index_path,
+          datas: "data-intro='#{t('camaleon_cms.admin.intro.widgets')}' data-position='right'"
+        }
+      end
+      if can? :manage, :nav_menu
+        intro_menus_data =
+          t('camaleon_cms.admin.intro.menus', image: helpers.asset_path('camaleon_cms/admin/intro/menus.png'))
+        items << {
+          icon: 'list', title: t('camaleon_cms.admin.sidebar.menus'), url: cama_admin_appearances_nav_menus_path,
+          datas: "data-intro='#{intro_menus_data}' data-position='right'"
+        }
+      end
+      if can? :manage, :shortcodes
+        items << {
+          icon: 'code', title: t('camaleon_cms.admin.sidebar.shortcodes', default: 'Shortcodes'),
+          url: cama_admin_settings_shortcodes_path,
+          datas: "data-intro='#{t('camaleon_cms.admin.intro.shortcodes')}' data-position='right'"
+        }
+      end
+      if items.present?
+        admin_menu_add_menu(
+          'appearance',
+          {
+            icon: 'paint-brush', title: t('camaleon_cms.admin.sidebar.appearance'), url: '', items: items,
+            datas: "data-intro='#{t('camaleon_cms.admin.intro.appearance')}' data-position='right' data-wait='500'"
+          }
+        )
+      end
+
+      if can? :manage, :plugins
+        plugin_count = PluginRoutes.all_plugins.count do |plugin|
+          !(plugin[:domain].present? && !plugin[:domain].split(',').include?(current_site.the_slug))
+        end
+        admin_menu_add_menu(
+          'plugins',
+          {
+            icon: 'plug',
+            title: helpers.safe_join([
+                                       t('camaleon_cms.admin.sidebar.plugins'),
+                                       ' ',
+                                       helpers.content_tag(:small, plugin_count, class: 'label label-primary')
+                                     ]),
+            url: cama_admin_plugins_path,
+            datas: "data-intro='#{t('camaleon_cms.admin.intro.plugins')}' data-position='right'"
+          }
+        )
+      end
+
+      if can? :manage, :users
+        items = []
+        items << { icon: 'list', title: t('camaleon_cms.admin.users.all_users'), url: cama_admin_users_path }
+        items << { icon: 'plus', title: t('camaleon_cms.admin.users.add_user'), url: new_cama_admin_user_path }
+        items << { icon: 'group', title: t('camaleon_cms.admin.users.user_roles'), url: cama_admin_user_roles_path }
+        admin_menu_add_menu(
+          'users',
+          {
+            icon: 'users', title: t('camaleon_cms.admin.sidebar.users'), url: '', items: items,
+            datas: "data-intro='#{t('camaleon_cms.admin.intro.users')}' data-position='right' data-wait='500'"
+          }
+        )
+      end
+
+      items = []
+      if can? :manage, :settings
+        items << {
+          icon: 'desktop', title: t('camaleon_cms.admin.sidebar.general_site'),
+          url: cama_admin_settings_site_path,
+          datas: "data-intro='#{t('camaleon_cms.admin.intro.gral_site')}' data-position='right'"
+        }
+        if current_site.manage_sites?
+          items << {
+            icon: 'cog', title: t('camaleon_cms.admin.sidebar.sites'),
+            url: cama_admin_settings_sites_path,
+            datas: "data-intro='#{t('camaleon_cms.admin.intro.sites')}' data-position='right'"
+          }
+        end
+        items << {
+          icon: 'files-o', title: t('camaleon_cms.admin.sidebar.content_groups'),
+          url: cama_admin_settings_post_types_path,
+          datas: "data-intro='#{t('camaleon_cms.admin.intro.post_type')}' data-position='right'"
+        }
+        items << {
+          icon: 'cog', title: t('camaleon_cms.admin.sidebar.custom_fields'),
+          url: cama_admin_settings_custom_fields_path,
+          datas: "data-intro='#{t('camaleon_cms.admin.intro.custom_fields')}' data-position='right'"
+        }
+        items << {
+          icon: 'language', title: t('camaleon_cms.admin.sidebar.languages'),
+          url: cama_admin_settings_languages_path,
+          datas: "data-intro='#{t('camaleon_cms.admin.intro.languages')}' data-position='right'"
+        }
+      end
+
+      if can? :manage, :theme_settings
+        items << {
+          icon: 'windows', title: t('camaleon_cms.admin.settings.theme_setting', default: 'Theme Settings'),
+          url: cama_admin_settings_theme_path
+        }
+      end
+      return if items.blank?
+
+      admin_menu_add_menu(
+        'settings',
+        {
+          icon: 'cogs', title: t('camaleon_cms.admin.sidebar.settings'), url: '', items: items,
+          datas: "data-intro='#{t('camaleon_cms.admin.intro.settings')}' data-position='right' data-wait='500'"
+        }
+      )
+    end
+
+    def admin_menu_add_menu(key, menu)
+      CurrentRequest.admin_menu_items ||= {}
+      CurrentRequest.admin_menu_items[key] = menu
+    end
+
+    def admin_menu_append_menu_item(key, menu)
+      CurrentRequest.admin_menu_items ||= {}
+      return if CurrentRequest.admin_menu_items[key].blank?
+
+      CurrentRequest.admin_menu_items[key][:items] = [] unless CurrentRequest.admin_menu_items[key].key?(:items)
+      CurrentRequest.admin_menu_items[key][:items] << menu
+    end
+
+    def admin_menu_prepend_menu_item(key, menu)
+      CurrentRequest.admin_menu_items ||= {}
+      return if CurrentRequest.admin_menu_items[key].blank?
+
+      CurrentRequest.admin_menu_items[key][:items] = [] unless CurrentRequest.admin_menu_items[key].key?(:items)
+      CurrentRequest.admin_menu_items[key][:items] = [menu] + CurrentRequest.admin_menu_items[key][:items]
+    end
+
+    def admin_menu_insert_menu_before(key_target, key_menu, menu)
+      CurrentRequest.admin_menu_items ||= {}
+      res = CurrentRequest.admin_menu_items.each_with_object({}) do |(key, val), hsh|
+        hsh[key_menu] = menu if key == key_target
+        hsh[key] = val
+      end
+      CurrentRequest.admin_menu_items.replace(res) # mutate in place so @_admin_menus stays a live alias (M19)
+    end
+
+    def admin_menu_insert_menu_after(key_target, key_menu, menu)
+      CurrentRequest.admin_menu_items ||= {}
+      res = CurrentRequest.admin_menu_items.each_with_object({}) do |(key, val), hsh|
+        hsh[key] = val
+        hsh[key_menu] = menu if key == key_target
+      end
+      CurrentRequest.admin_menu_items.replace(res) # mutate in place so @_admin_menus stays a live alias (M19)
+    end
+
+    def cama_comments_get_common_data
+      comment_data = {}
+      comment_data[:user_id] = cama_current_user.id
+      comment_data[:author] = cama_current_user.the_name
+      comment_data[:author_email] = cama_current_user.email
+      comment_data[:author_IP] = request.remote_ip.to_s
+      comment_data[:approved] = 'approved'
+      comment_data[:agent] = request.user_agent.force_encoding('ISO-8859-1').encode('UTF-8')
+      comment_data
+    end
+  end
+end
+# rubocop:enable Metrics/AbcSize

data/app/controllers/concerns/camaleon_cms/runtime_captcha_image_concern.rb

@@ -0,0 +1,13 @@
+module CamaleonCms
+  # Controller-stack entry point for captcha image generation: GET /captcha
+  # (CamaleonController#captcha) resolves cama_captcha_build through this concern.
+  # The implementation lives in CamaleonCms::CaptchaImageGeneration, shared with
+  # CamaleonCms::CaptchaHelper, so a captcha hardening fix cannot land in one entry
+  # point and not the other (parity is guarded by
+  # spec/lib/camaleon_cms/captcha_implementation_parity_spec.rb).
+  module RuntimeCaptchaImageConcern
+    extend ActiveSupport::Concern
+
+    include CamaleonCms::CaptchaImageGeneration
+  end
+end