camaleon_cms 2.9.2 → 2.9.3

data/app/decorators/camaleon_cms/post_decorator.rb

@@ -12,15 +12,18 @@ module CamaleonCms
     # return the excerpt of this post
     def the_excerpt(qty_chars = 200)
       excerpt = object.get_meta('summary').to_s.translate(get_locale)
-      # r = {content: (excerpt.present? ? excerpt : object.content_filtered.to_s.translate(get_locale).strip_tags.gsub(/
|\n/, " ").truncate(qty_chars)), post: object}
+      # r = {
+      #   content: (
+      #     (excerpt if excerpt.present?) ||
+      #     object.content_filtered.to_s.translate(get_locale).strip_tags.gsub(/
|\n/, " ").truncate(qty_chars)
+      #   ),
+      #   post: object
+      # }
       r = {
-        content: (if excerpt.present?
-                    excerpt
-                  else
-                    h.cama_strip_shortcodes(object.content_filtered.to_s.translate(get_locale).strip_tags.gsub(
-                      /
|\n/, ' '
-                    ).truncate(qty_chars))
-                  end), post: object
+        content:
+          excerpt.presence || h.cama_strip_shortcodes(object.content_filtered.to_s.translate(get_locale)
+                                                            .strip_tags.gsub(/
|\n/, ' ').truncate(qty_chars)),
+        post: object
       }
       h.hooks_run('post_the_excerpt', r)
       r[:content]
@@ -33,17 +36,13 @@ module CamaleonCms
       h.do_shortcode(r[:content], self)
     end
 
-    # return thumbnail image for this post
+    # Return the thumbnail image for this post
     # default: default image if thumbails not exist
     # if default is empty, post_type default thumb will be returned
     def the_thumb_url(default = nil)
       th = object.get_meta('thumb')
-      if th.present?
-        th
-      else
-        default || object.post_type.get_option('default_thumb',
-                                               nil) || h.asset_url('camaleon_cms/image-not-found.png')
-      end
+      th.presence || default || object.post_type.get_option('default_thumb', nil) ||
+        h.asset_url('camaleon_cms/image-not-found.png')
     end
     alias the_image_url the_thumb_url
 
@@ -93,7 +92,7 @@ module CamaleonCms
           args[:label_cat] = I18n.t('routes.category', default: 'category')
           args[:category_id] = cat.id
           args[:title] = cat.the_title(args[:locale]).parameterize
-          args[:title] = cat.the_slug unless args[:title].present?
+          args[:title] = cat.the_slug if args[:title].blank?
         else
           p_url_format = 'post'
         end
@@ -110,7 +109,7 @@ module CamaleonCms
           args[:post_type_title] = ptype.the_title(args[:locale]).parameterize.presence || ptype.the_slug
           args[:category_id] = cat.id
           args[:title] = cat.the_title(args[:locale]).parameterize
-          args[:title] = cat.the_slug unless args[:title].present?
+          args[:title] = cat.the_slug if args[:title].blank?
         else
           p_url_format = 'post'
         end
@@ -130,12 +129,10 @@ module CamaleonCms
     # sample: {es: 'https://mydomain.com/es/articulo-3.html', en: 'https://mydomain.com/en/post-3.html'}
     def the_urls(*args)
       args = args.extract_options!
-      res = {}
-      h.current_site.the_languages.each do |l|
+      h.current_site.the_languages.each_with_object({}) do |l, hsh|
         args[:locale] = l
-        res[l] = the_url(args.clone)
+        hsh[l] = the_url(args.clone)
       end
-      res
     end
 
     # return edit url for this post
@@ -148,10 +145,10 @@ module CamaleonCms
     # return html link
     # attrs: Hash of link tag attributes, sample: {id: "myid", class: "sss" }
     def the_edit_link(title = nil, attrs = {})
-      return '' unless h.cama_current_user.present?
+      return '' if h.cama_current_user.blank?
 
-      attrs = { target: '_blank', style: 'font-size:11px !important;cursor:pointer;' }.merge(attrs)
-      h.link_to("→ #{title || h.ct('edit', default: 'Edit')}".html_safe, the_edit_url, attrs)
+      attrs = { target: '_blank', style: 'font-size:11px !important;cursor:pointer;' }.merge!(attrs)
+      h.link_to(h.safe_join(['→ ', title || h.ct('edit', default: 'Edit')]), the_edit_url, attrs)
     end
 
     # show thumbnail image as html
@@ -162,7 +159,7 @@ module CamaleonCms
     end
 
     # show link and thumbnail included as html
-    # link_args: html attributes for link
+    # link_args: html attributes for the link
     # img_args: html attributes for image
     def the_link_thumb(link_args = {}, img_args = {})
       h.link_to(the_thumb(img_args), the_url, link_args)
@@ -186,7 +183,15 @@ module CamaleonCms
         color = 'default'
         status = self.status
       end
-      "<span class='label label-#{color} label-form'>#{status.titleize}</span>"
+      # The `else` arm above returns the raw column value, which is not validated and is writable at
+      # contributor privilege, and three admin views render this label through `raw`. Escaping the
+      # interpolated value here -- at the source, as `the_title` does -- is what makes those sinks
+      # safe. `titleize` is not a mitigation: HTML tag names and hostnames are case-insensitive.
+      # `content_tag` is deliberately not used: it emits double-quoted attributes and would change
+      # the byte output for every legitimate status, which downstream themes may match on.
+      # rubocop:disable Rails/OutputSafety -- only the escaped status is interpolated into fixed markup
+      "<span class='label label-#{color} label-form'>#{h.h(status.titleize)}</span>".html_safe
+      # rubocop:enable Rails/OutputSafety
     end
 
     # return the user object who created this post
@@ -209,7 +214,7 @@ module CamaleonCms
       object.comments.main.approveds.eager_load(:user)
     end
 
-    # check if the post can be visited by current visitor
+    # check if the post can be visited by the current user
     def can_visit?
       r = { flag: true, post: object }
       h.hooks_run('post_can_visit', r)
@@ -228,7 +233,7 @@ module CamaleonCms
         p_type.decorate.generate_breadcrumb(add_post_type, true)
       end
       if object.post_parent.present? && p_type.manage_hierarchy?
-        object.parents.reverse.each do |p|
+        object.parents.reverse_each do |p|
           p = p.decorate
           h.breadcrumb_add(p.the_title, p.published? ? p.the_url : nil)
         end
@@ -238,50 +243,61 @@ module CamaleonCms
 
     # return the post type of this post
     def the_post_type
-      object.post_type.decorate
+      @the_post_type ||= object.post_type.decorate
     end
 
-    # looks for the next post item related to parent element based on post_order attribute
-    # @param _parent: parent decorated model, like: (PostType *default), Category, PostTag, Site
+    # It looks for the next post item related to the parent element based on the post_order attribute
+    # @param parent: parent decorated model, like: (PostType *default), Category, PostTag, Site
     # @samples: my_post.the_next_post(), my_post.the_next_post(@category), my_post.the_next_post(current_site)
-    def the_next_post(_parent = nil)
-      (_parent.presence || the_post_type).the_posts.where(
-        "#{CamaleonCms::Post.table_name}.post_order > :position OR (#{CamaleonCms::Post.table_name}.post_order = :position and #{CamaleonCms::Post.table_name}.created_at > :created_at)", {
-          position: object.post_order, created_at: object.created_at
-        }
+    def the_next_post(parent = nil)
+      (parent.presence || the_post_type).the_posts.where(
+        post_order_predicate_gt(object.post_order, object.created_at)
       ).where.not(id: object.id).take.try(:decorate)
     end
 
-    # looks for the next post item related to parent element based on post_order attribute
-    # @param _parent: parent decorated model, like: (PostType *default), Category, PostTag, Site
+    # looks for the next post item related to the parent element based on post_order attribute
+    # @param parent: parent decorated model, like: (PostType *default), Category, PostTag, Site
     # @samples: my_post.the_prev_post(), my_post.the_prev_post(@category), my_post.the_prev_post(current_site)
-    def the_prev_post(_parent = nil)
-      (_parent.presence || the_post_type).the_posts.where("#{CamaleonCms::Post.table_name}.post_order < :position OR (#{CamaleonCms::Post.table_name}.post_order = :position and #{CamaleonCms::Post.table_name}.created_at < :created_at)", { position: object.post_order, created_at: object.created_at }).where.not(id: object.id).reorder(
-        post_order: :asc, created_at: :asc
-      ).last.try(:decorate)
+    def the_prev_post(parent = nil)
+      (parent.presence || the_post_type).the_posts
+        .where(post_order_predicate_lt(object.post_order, object.created_at))
+        .where.not(id: object.id).reorder(post_order: :asc, created_at: :asc).last.try(:decorate)
     end
 
     # return the title with hierarchy prefixed
-    # sample: title paren 1 - title parent 2 -.. -...
+    # sample: title paren 1 - title parent 2 -... -...
     # if add_parent_title: true will add parent title like: —— item 1.1.1 | item 1.1
     def the_hierarchy_title
-      return the_title unless object.post_parent.present?
+      return the_title if object.post_parent.blank?
 
-      res = '&#8212;' * object.parents.count
-      res << " #{the_title}"
-      res << " | #{object.parent.decorate.the_title}" if object.show_title_with_parent
-      res.html_safe
+      parts = [h.raw('&#8212;' * object.parents.count), h.sanitize(" #{the_title}")]
+      parts << h.sanitize(" | #{object.parent.decorate.the_title}") if object.show_title_with_parent
+      h.safe_join(parts)
     end
 
-    # return all related posts of current post
+    # return all related posts of the current post
     def the_related_posts
       ptype = the_post_type
-      ptype.the_posts.joins(:categories).where(CamaleonCms::TermRelationship.table_name.to_s => { term_taxonomy_id: the_categories.pluck(:id) }).distinct
+      ptype.the_posts.joins(:categories).where(
+        CamaleonCms::TermRelationship.table_name.to_s => { term_taxonomy_id: the_categories.pluck(:id) }
+      ).distinct
     end
 
     # fix for "Using Draper::Decorator without inferred source class"
     def self.object_class_name
       'CamaleonCms::Post'
     end
+
+    private
+
+    def post_order_predicate_gt(position, created_at)
+      t = CamaleonCms::Post.arel_table
+      t[:post_order].gt(position).or(t[:post_order].eq(position).and(t[:created_at].gt(created_at)))
+    end
+
+    def post_order_predicate_lt(position, created_at)
+      t = CamaleonCms::Post.arel_table
+      t[:post_order].lt(position).or(t[:post_order].eq(position).and(t[:created_at].lt(created_at)))
+    end
   end
 end

data/app/decorators/camaleon_cms/post_type_decorator.rb

@@ -71,7 +71,7 @@ module CamaleonCms
     def the_category(slug_or_id)
       return the_categories.where(id: slug_or_id).first if slug_or_id.is_a?(Integer)
 
-      the_categories.find_by_slug(slug_or_id) if slug_or_id.is_a?(String)
+      the_categories.find_by_slug(slug_or_id) if slug_or_id.is_a?(String) # rubocop:disable Rails/DynamicFindBy
     end
 
     # return all post_tags for the post_type (active_record) filtered by permissions + hidden posts + roles + etc...

data/app/decorators/camaleon_cms/site_decorator.rb

@@ -67,8 +67,10 @@ module CamaleonCms
           nil
         end
       end
-      post = the_posts.find_by_slug(slug_or_id) if slug_or_id.is_a?(String) # id
-      post.present? ? post.decorate : nil
+      # use find_by_slug (multi-language aware) so posts with localized slugs
+      # (e.g. "<!--:en-->sample-post<!--:-->...") are matched instead of returning nil
+      post = the_posts.find_by_slug(slug_or_id) if slug_or_id.is_a?(String) # rubocop:disable Rails/DynamicFindBy
+      post&.decorate
     end
 
     # return a collection of categories
@@ -81,7 +83,7 @@ module CamaleonCms
     def the_categories(slug_or_id = nil)
       return the_post_type(slug_or_id).the_categories if slug_or_id.present?
 
-      object.categories unless slug_or_id.present?
+      object.categories if slug_or_id.blank?
     end
 
     # return the category object with id or slug = slug_or_id from this site
@@ -96,7 +98,7 @@ module CamaleonCms
       return unless slug_or_id.is_a?(String)
 
       begin
-        the_full_categories.find_by_slug(slug_or_id).decorate
+        the_full_categories.find_by_slug(slug_or_id).decorate # rubocop:disable Rails/DynamicFindBy
       rescue StandardError
         nil
       end
@@ -126,7 +128,7 @@ module CamaleonCms
       return unless slug_or_id.is_a?(String)
 
       begin
-        object.post_tags.find_by_slug(slug_or_id).decorate
+        object.post_tags.find_by_slug(slug_or_id).decorate # rubocop:disable Rails/DynamicFindBy
       rescue StandardError
         nil
       end
@@ -144,7 +146,7 @@ module CamaleonCms
       return unless id_or_username.is_a?(String)
 
       begin
-        object.users.find_by_username(id_or_username).decorate
+        object.users.find_by_username(id_or_username).decorate # rubocop:disable Rails/DynamicFindBy
       rescue StandardError
         nil
       end
@@ -165,14 +167,14 @@ module CamaleonCms
     def the_post_type(slug_or_id)
       if slug_or_id.is_a?(String)
         begin
-          return object.post_types.find_by_slug(slug_or_id).decorate
+          return object.post_types.find_by_slug(slug_or_id).decorate # rubocop:disable Rails/DynamicFindBy
         rescue StandardError
           nil
         end
       end
       if slug_or_id.is_a?(Array)
         begin
-          return object.post_types.find_by_slug(slug_or_id).decorate
+          return object.post_types.find_by_slug(slug_or_id).decorate # rubocop:disable Rails/DynamicFindBy
         rescue StandardError
           nil
         end
@@ -195,21 +197,25 @@ module CamaleonCms
       lan = object.get_languages
       return if lan.size < 2
 
-      res = ["<ul class='#{list_class}'>"]
-      lan.each do |lang|
-        path = "#{lang}.png"
-        label = (if block
-                   h.capture(lang, I18n.locale.to_s == lang.to_s,
-                             &block)
-                 else
-                   "<img src='#{h.asset_path("camaleon_cms/language/#{path}")}'/>"
-                 end)
-        res << "<li class='#{current_class if I18n.locale.to_s == lang.to_s}'> <a href='#{h.cama_url_to_fixed(
-          current_page ? 'url_for' : 'cama_root_url', { locale: lang, cama_set_language: lang }
-        )}'>#{label}</a> </li>"
+      h.content_tag(:ul, class: list_class) do
+        h.safe_join(lan.map do |lang|
+          label = if block
+                    h.capture(lang, I18n.locale.to_s == lang.to_s, &block)
+                  else
+                    h.tag.img(src: h.asset_path("camaleon_cms/language/#{lang}.png"))
+                  end
+
+          h.content_tag(:li, class: (current_class if I18n.locale.to_s == lang.to_s)) do
+            h.link_to(
+              label,
+              h.cama_url_to_fixed(
+                current_page ? 'url_for' : 'cama_root_url',
+                { locale: lang, cama_set_language: lang }
+              )
+            )
+          end
+        end)
       end
-      res << '</ul>'
-      res.join('').html_safe
     end
 
     # return Array of frontend languages configured for this site
@@ -245,7 +251,7 @@ module CamaleonCms
       postfix = 'url'
       postfix = 'path' if args.delete(:as_path)
       skip_relative_url_root = args.delete(:skip_relative_url_root)
-      h.cama_current_site_host_port(args) unless args.keys.include?(:host)
+      h.cama_current_site_host_port(args) unless args.key?(:host)
       res = h.cama_url_to_fixed("cama_root_#{postfix}", args)
       if skip_relative_url_root && PluginRoutes.static_system_info['relative_url_root'].present?
         res = res.sub("/#{PluginRoutes.static_system_info['relative_url_root']}",

data/app/decorators/camaleon_cms/term_taxonomy_decorator.rb

@@ -4,8 +4,12 @@ module CamaleonCms
     delegate_all
 
     # return the title for current locale
+    # The name is HTML-escaped here (like PostDecorator#the_title) because taxonomy
+    # names are plain text yet are rendered through `raw`/`html_safe` sinks such as
+    # the breadcrumb builder and the nav menu, so escaping at the source prevents
+    # stored XSS via category/tag/post_type/site names.
     def the_title(locale = nil)
-      r = { title: object.name.translate(get_locale(locale)), object: object }
+      r = { title: h.h(object.name.to_s.translate(get_locale(locale))), object: object }
       begin
         h.hooks_run('taxonomy_the_title', r)
       rescue StandardError
@@ -26,12 +30,19 @@ module CamaleonCms
       h.do_shortcode(r[:content], self)
     end
 
+    # Same shape as PostDecorator#the_status: markup built by interpolation and rendered through
+    # `raw` at admin/search.html.erb. Only I18n strings reach it today, so there is nothing to
+    # exploit here -- escaping at the source is what keeps that true if the interpolated value ever
+    # changes.
     def the_status
-      if status.to_s.to_bool
-        "<span class='label label-success'> #{I18n.t('camaleon_cms.admin.button.actived')} </span>"
-      else
-        "<span class='label label-default'> #{I18n.t('camaleon_cms.admin.button.not_actived')} </span>"
-      end
+      color, label = if status.to_s.to_bool
+                       ['success', I18n.t('camaleon_cms.admin.button.actived')]
+                     else
+                       ['default', I18n.t('camaleon_cms.admin.button.not_actived')]
+                     end
+      # rubocop:disable Rails/OutputSafety -- only the escaped label is interpolated into fixed markup
+      "<span class='label label-#{color}'> #{h.h(label)} </span>".html_safe
+      # rubocop:enable Rails/OutputSafety
     end
 
     # return excerpt for this post type
@@ -55,7 +66,7 @@ module CamaleonCms
 
     # search a post with id (integer) or slug (string)
     def the_post(slug_or_id)
-      return nil unless slug_or_id.present?
+      return nil if slug_or_id.blank?
 
       if slug_or_id.is_a?(Integer)
         begin
@@ -67,7 +78,7 @@ module CamaleonCms
       return unless slug_or_id.is_a?(String)
 
       begin
-        object.posts.find_by_slug(slug_or_id).decorate
+        object.posts.find_by_slug(slug_or_id).decorate # rubocop:disable Rails/DynamicFindBy
       rescue StandardError
         nil
       end
@@ -94,10 +105,10 @@ module CamaleonCms
     # return html link
     # attrs: Hash of link tag attributes, sample: {id: "myid", class: "sss" }
     def the_edit_link(title = nil, attrs = {})
-      return '' unless h.cama_current_user.present?
+      return '' if h.cama_current_user.blank?
 
       attrs = { target: '_blank', style: 'font-size:11px !important;cursor:pointer;' }.merge(attrs)
-      h.link_to("&rarr; #{title || h.ct('edit', default: 'Edit')}".html_safe, the_edit_url, attrs)
+      h.link_to(h.safe_join(['→ ', title || h.ct('edit', default: 'Edit')]), the_edit_url, attrs)
     end
 
     # return the user owner of this item

data/app/decorators/camaleon_cms/theme_decorator.rb

@@ -11,11 +11,11 @@ module CamaleonCms
       h.cama_admin_settings_theme_url(args)
     end
 
-    def the_settings_link
-      return '' unless h.cama_current_user.present?
+    def the_settings_link(title = nil, attrs = {})
+      return '' if h.cama_current_user.blank?
 
       attrs = { target: '_blank', style: 'font-size:11px !important;cursor:pointer;' }.merge(attrs)
-      h.link_to("→ #{title || h.ct('edit', default: 'Edit')}".html_safe, the_settings_url, attrs)
+      h.link_to(h.safe_join(['→ ', title || h.ct('edit', default: 'Edit')]), the_settings_url, attrs)
     end
   end
 end

data/app/decorators/camaleon_cms/user_decorator.rb

@@ -20,7 +20,9 @@ module CamaleonCms
 
     # return the avatar for this user, default: assets/admin/img/no_image.jpg
     def the_avatar(default_avatar = nil)
-      avatar_exists? ? object.get_meta('avatar') : (default_avatar || h.asset_url('camaleon_cms/admin/img/no_image.jpg'))
+      return object.get_meta('avatar') if avatar_exists?
+
+      default_avatar || h.asset_url('camaleon_cms/admin/img/no_image.jpg')
     end
 
     # return the slogan for this user, default: Hello World
@@ -34,7 +36,7 @@ module CamaleonCms
       args[:label] = I18n.t('routes.profile', default: 'profile')
       args[:user_id] = the_id
       args[:user_name] = the_name.parameterize
-      args[:user_name] = the_username unless args[:user_name].present?
+      args[:user_name] = the_username if args[:user_name].blank?
       args[:locale] = get_locale unless args.include?(:locale)
       args[:format] = args[:format] || 'html'
       as_path = args.delete(:as_path)
@@ -52,8 +54,26 @@ module CamaleonCms
       h.current_site.posts.where(user_id: object.id)
     end
 
-    def role_grantor?(other_user)
-      h.can?(:manage, :users) && (other_user.nil? || id != other_user.id)
+    # Whether this user may set another user's role. Only an admin may grant the `admin` role (the one
+    # `User#admin?` tests) or change the role of a user who is already an admin — so holding
+    # `:manage, :users` is neither a path to minting an admin (escalation) nor to stripping one (H10).
+    def role_grantor?(other_user, new_role = nil)
+      return false unless h.can?(:manage, :users) && (other_user.nil? || id != other_user.id)
+      return admin? if new_role.to_s == 'admin' || other_user&.role.to_s == 'admin'
+
+      true
+    end
+
+    # Whether this user may edit +other_user+'s login credential (password) or recovery identifiers
+    # (email, username). Only an admin may edit an admin's account: a `:manage, :users` holder who could
+    # reset an admin's password would sign in as them, and one who could repoint an admin's email would
+    # hijack a password-reset link — either is a path to superadmin that would make `role_grantor?`'s
+    # guard of the privileged set moot (H10). Editing one's own account, or any non-admin, is unrestricted
+    # here; the controller's `:manage, :users` (or self) authorization still applies first.
+    def may_edit_credentials?(other_user)
+      return true unless other_user&.admin?
+
+      admin?
     end
 
     def self.object_class_name
@@ -65,7 +85,8 @@ module CamaleonCms
     def avatar_exists?
       # TODO: change verification
       # if object.get_meta('avatar').present?
-      #   File.exist?(h.cama_url_to_file_path(object.get_meta('avatar'))) || Faraday.head(object.get_meta('avatar')).status == 200
+      #   File.exist?(h.cama_url_to_file_path(object.get_meta('avatar'))) ||
+      #     Faraday.head(object.get_meta('avatar')).status == 200
       # else
       #   false
       # end

data/app/helpers/camaleon_cms/admin/application_helper.rb

@@ -32,16 +32,13 @@ module CamaleonCms
         end
       end
 
-      # return the locale for frontend translations initialized in admin controller
-      # used by models like posts, categories, ..., sample: my_post.the_url
-      # fix for https://github.com/owen2345/camaleon-cms/issues/233#issuecomment-215385432
-      def cama_get_i18n_frontend
-        @cama_i18n_frontend
-      end
-
       # print code with auto copy
       def cama_shortcode_print(code)
-        content_tag(:input, nil, class: 'code_style', readonly: true, onmousedown: 'this.clicked = 1;', onfocus: 'if (!this.clicked) this.select(); else this.clicked = 2;', onclick: 'if (this.clicked == 2) this.select(); this.clicked = 0;', tabindex: '-1', value: code)
+        content_tag(
+          :input, nil, class: 'code_style', readonly: true, onmousedown: 'this.clicked = 1;',
+                       onfocus: 'if (!this.clicked) this.select(); else this.clicked = 2;',
+                       onclick: 'if (this.clicked == 2) this.select(); this.clicked = 0;', tabindex: '-1', value: code
+        )
       end
     end
   end

data/app/helpers/camaleon_cms/admin/breadcrumb_helper.rb

@@ -4,7 +4,7 @@ module CamaleonCms
       # draw the title for the admin admin panel according the breadcrumb
       def cama_admin_title_draw
         res = [t('camaleon_cms.admin.sidebar_top.admin_panel')]
-        breadcrumbs.reverse.slice(0, 2).reverse.each { |b| res << (b.is_a?(Hash) ? b[:name] : b.name) }
+        breadcrumbs.reverse.slice(0, 2).reverse_each { |b| res << (b.is_a?(Hash) ? b[:name] : b.name) }
         res.join(' &raquo; ')
       end
 

data/app/helpers/camaleon_cms/admin/custom_fields_helper.rb

@@ -2,31 +2,19 @@ module CamaleonCms
   module Admin
     module CustomFieldsHelper
       def cama_custom_field_elements
-        return @_cama_custom_field_elements if @_cama_custom_field_elements.present?
+        return CurrentRequest.custom_field_elements if CurrentRequest.custom_field_elements.present?
 
         items = {}
         items[:text_box] = {
           key: 'text_box',
           label: t('camaleon_cms.admin.custom_field.fields.text_box'),
-          options: {
-            required: true,
-            multiple: true,
-            translate: true,
-            default_value: '',
-            show_frontend: true
-          }
+          options: { required: true, multiple: true, translate: true, default_value: '', show_frontend: true }
         }
 
         items[:text_area] = {
           key: 'text_area',
           label: t('camaleon_cms.admin.custom_field.fields.text_area'),
-          options: {
-            required: true,
-            multiple: true,
-            translate: true,
-            default_value: '',
-            show_frontend: true
-          }
+          options: { required: true, multiple: true, translate: true, default_value: '', show_frontend: true }
         }
         items[:select] = {
           key: 'select',
@@ -35,10 +23,7 @@ module CamaleonCms
             required: true,
             multiple: true,
             translate: true,
-            multiple_options: {
-              label: t('camaleon_cms.admin.settings.options_select'),
-              default: 'radio'
-            },
+            multiple_options: { label: t('camaleon_cms.admin.settings.options_select'), default: 'radio' },
             show_frontend: true
           }
         }
@@ -298,7 +283,8 @@ module CamaleonCms
         }
 
         # evaluate the content of command value on listing
-        # sample command: options_from_collection_for_select(current_site.the_posts("commerce").decorate, :id, :the_title)
+        # sample command:
+        # options_from_collection_for_select(current_site.the_posts("commerce").decorate, :id, :the_title)
         items[:select_eval] = {
           key: 'select_eval',
           label: t('camaleon_cms.admin.custom_field.fields.select_eval'),
@@ -344,17 +330,32 @@ module CamaleonCms
         }
         r = { fields: items }
         hooks_run('extra_custom_fields', r)
-        @_cama_custom_field_elements = r[:fields]
+        CurrentRequest.custom_field_elements = r[:fields]
       end
 
       # add your model class into custom fields editor
       # Note: to use custom fields on your model, you need the following:
-      # - add: belongs_to :site (in your model) //don't forget multi site support, i.e.: you need site_id attribute in your table
+      # - add: belongs_to :site (in your model)
+      #   //don't forget multi site support, i.e.: you need site_id attribute in your table
       # - add: include CamaleonCms::CustomFieldsRead (in your model)
       # ==> With this, you can manage your model like a plugin. Check api -> custom fields section into docs)
       # model_class: class name (Product)
       def cf_add_model(model_class)
-        @_extra_models_for_fields << model_class
+        CurrentRequest.extra_models_for_fields ||= []
+        CurrentRequest.extra_models_for_fields << model_class
+      end
+
+      # Models offered in the field-group placement dropdown: those registered via cf_add_model plus any
+      # a custom_field_custom_models hook appends. Seeded from the legacy @_extra_models_for_fields ivar
+      # so a controller still assigning it keeps working. The dropdown used to read that ivar while
+      # cf_add_model wrote CurrentRequest, so registered models never appeared. Regression M18.
+      # The seed and the hook payload are copies: hook appends must reach only this read, not
+      # accumulate in the request store or leak into the controller ivar.
+      def cf_extra_models_for_fields
+        CurrentRequest.extra_models_for_fields ||= (instance_variable_get(:@_extra_models_for_fields) || []).dup
+        f_args = { models: CurrentRequest.extra_models_for_fields.dup }
+        hooks_run('custom_field_custom_models', f_args)
+        f_args[:models]
       end
     end
   end