camaleon_cms 2.9.2 → 2.9.4

data/app/helpers/camaleon_cms/camaleon_helper.rb

@@ -4,31 +4,15 @@ module CamaleonCms
     # verify if current user is logged in, if not, then return nil
     # return html link
     def cama_edit_link(url, title = nil, attrs = {})
-      return '' unless cama_current_user.present?
+      return '' if cama_current_user.blank?
       return '' unless cama_current_user.admin?
 
       attrs = { target: '_blank', style: 'font-size:11px !important;cursor:pointer;' }.merge(attrs)
-      ActionController::Base.helpers.link_to("→ #{title || ct('edit', default: 'Edit')}".html_safe, url, attrs)
-    end
-
-    # execute controller action and return response
-    # NON USED
-    def cama_requestAction(controller, action, params = {})
-      controller.class_eval do
-        def params=(params)
-          @params = params
-        end
-
-        def params
-          @params
-        end
-      end
-      c = controller.new
-      c.request = @_request
-      c.response = @_response
-      c.params = params
-      c.send(action)
-      c.response.body
+      link_to(
+        safe_join(['→ ', title || ct('edit', default: 'Edit')]),
+        url,
+        attrs
+      )
     end
 
     # theme common translation text
@@ -44,26 +28,37 @@ module CamaleonCms
       I18n.translate("camaleon_cms.common.#{key}", **args)
     end
 
-    # check if current request was for admin panel
+    # Public compatibility API for plugins such as camaleon-ecommerce, which use
+    # this predicate to switch from visitor pricing/locale behavior to admin mode.
+    # This still matters while previewing frontend content from admin, for example
+    # a theme preview that renders ecommerce helpers before the request reaches the
+    # public frontend controller stack.
     def cama_is_admin_request?
-      @cama_i18n_frontend.present?
+      respond_to?(:cama_get_i18n_frontend) && cama_get_i18n_frontend.present?
     end
 
     # generate loop categories html sitemap links
     # this is a helper for sitemap generator to print categories, sub categories and post contents in html list format
-    def cama_sitemap_cats_generator(cats)
+    def cama_sitemap_cats_generator(cats, skip_config = {})
+      skip_config = {} unless skip_config.is_a?(Hash)
+      # merge! alone is not enough: an on_render_sitemap hook that sets one of these keys to nil
+      # overwrites the default with nil and brings back the very nil.include? crash the defaults
+      # exist to prevent. compact drops those before they win.
+      skip_config = { skip_cat_ids: [], skip_post_ids: [] }.merge!(skip_config.compact)
       res = []
       cats.decorate.each do |cat|
-        next if @r[:skip_cat_ids].include?(cat.id)
+        next if skip_config[:skip_cat_ids].include?(cat.id)
 
         res_posts = []
         cat.the_posts.decorate.each do |post|
-          next if @r[:skip_post_ids].include?(post.id)
+          next if skip_config[:skip_post_ids].include?(post.id)
 
-          res_posts << "<li><a href='#{post.the_url}'>#{post.the_title}</a></li>"
+          post_href = ERB::Util.html_escape(post.the_url)
+          res_posts << "<li><a href='#{post_href}'>#{post.the_title}</a></li>"
         end
-        res << "<li><h4><a href='#{cat.the_url}'>#{cat.the_title}</a></h4><ul>#{res_posts.join('')}</ul></li>"
-        res << cama_sitemap_cats_generator(cat.the_categories)
+        cat_href = ERB::Util.html_escape(cat.the_url)
+        res << "<li><h4><a href='#{cat_href}'>#{cat.the_title}</a></h4><ul>#{res_posts.join('')}</ul></li>"
+        res << cama_sitemap_cats_generator(cat.the_categories, skip_config)
       end
       res.join('')
     end
@@ -79,22 +74,19 @@ module CamaleonCms
       cache
     end
 
-    # =Deprecated
-    def cama_draw_timer
-      @_cama_timer ||= Time.current
-      puts "***************************************** timer: #{((Time.current - @_cama_timer) * 24 * 60 * 60).to_i}  (#{caller.first})"
-      @_cama_timer = Time.current
-    end
-
     # return normal translation with default value with translation of english
     def cama_t(key, args = {})
-      args[:default] = I18n.t(key, **args.dup.merge(locale: :en)) unless args[:default].present?
+      args[:default] = I18n.t(key, **args.dup.merge(locale: :en)) if args[:default].blank?
       I18n.t(key, **args)
     end
 
     # function that converts string into plural format
+    # `SafeBuffer#pluralize` returns a plain String, so callers composing the result with other
+    # markup lose the safe flag before they can use it. The safeness of the input is propagated --
+    # never added, so an unsafe input stays unsafe and no caller becomes less safe than before.
     def cama_pluralize_text(text)
-      text.try(:pluralize)
+      res = text.try(:pluralize)
+      text.try(:html_safe?) ? res.try(:html_safe) : res
     end
   end
 end

data/app/helpers/camaleon_cms/captcha_helper.rb

@@ -1,78 +1,112 @@
 module CamaleonCms
   module CaptchaHelper
-    # build a captcha image
-    # len: Number or characters to include in captcha (default 5)
-    def cama_captcha_build(len = 5)
-      img = MiniMagick::Image.open(File.join($camaleon_engine_dir.present? ? $camaleon_engine_dir : Rails.root.to_s,
-                                             'lib', 'captcha', "captcha_#{rand(12)}.jpg").to_s)
-      text = cama_rand_str(len)
-      session[:cama_captcha] = [] unless session[:cama_captcha].present?
-      session[:cama_captcha] << text
-      img.combine_options do |c|
-        c.gravity 'Center'
-        c.fill('#FFFFFF')
-        c.draw "text 0,5 #{text}"
-        c.font File.join($camaleon_engine_dir.present? ? $camaleon_engine_dir : Rails.root.to_s, 'lib', 'captcha',
-                         'bumpyroad.ttf')
-        c.pointsize '30'
-      end
-      img
-    end
+    # Challenge/image generation (including the length clamp and its constants) lives in
+    # CamaleonCms::CaptchaImageGeneration, shared with the controller-stack
+    # CamaleonCms::RuntimeCaptchaImageConcern; verification and the under-attack counters
+    # below exist only here.
+    include CamaleonCms::CaptchaImageGeneration
 
     # build a captcha tag (image with captcha)
     # img_args: attributes for image_tag
     # input_args: attributes for input field
     def cama_captcha_tag(len = 5, img_args = { alt: '' }, input_args = {}, bootstrap_group_mode = false)
-      unless input_args[:placeholder].present?
+      # Symbolize so string-keyed args work: the :placeholder / :style reads below use Symbol keys,
+      # so a caller's String key would be missed — the default placeholder would then be added under
+      # the Symbol key and render as a duplicate attribute.
+      img_args = img_args.to_h.symbolize_keys
+      input_args = input_args.to_h.symbolize_keys
+      if input_args[:placeholder].blank?
         input_args[:placeholder] =
-          I18n.t('camaleon_cms.captcha_placeholder',
-                 default: 'Please enter the text of the image')
+          I18n.t('camaleon_cms.captcha_placeholder', default: 'Please enter the text of the image')
       end
-      img_args['onclick'] = "this.src = \"#{cama_captcha_url(len: len)}\"+\"&t=\"+(new Date().getTime());"
-      img = "<img style='cursor: pointer;' src='#{cama_captcha_url(len: len,
-                                                                   t: Time.current.to_i)}' #{img_args.collect do |k, v|
-                                                                                               "#{k}='#{v}'"
-                                                                                             end.join(' ')} />"
-      input = "<input type='text' name='captcha' #{input_args.collect { |k, v| "#{k}='#{v}'" }.join(' ')} />"
+      img_args[:onclick] = "this.src = \"#{cama_captcha_url(len: len)}\"+\"&t=\"+(new Date().getTime());"
+      # Keep a caller-supplied style; the pointer cursor is required for click-to-refresh, so prepend it.
+      img_args[:style] = ['cursor: pointer;', img_args[:style].presence].compact.join(' ')
+
+      helpers = ActionController::Base.helpers
+      img = helpers.image_tag(cama_captcha_url(len: len, t: Time.current.to_i), img_args)
+      input = helpers.tag(:input, type: 'text', name: 'captcha', **input_args)
+
       if bootstrap_group_mode
-        "<div class='input-group input-group-captcha'><span class='input-group-btn' style='vertical-align: top;'>#{img}</span>#{input}</div>"
+        span = helpers.content_tag(:span, img, class: 'input-group-btn', style: 'vertical-align: top;')
+        helpers.content_tag(:div, helpers.safe_join([span, input]), class: 'input-group input-group-captcha')
       else
-        "<div class='input-group-captcha'>#{img}#{input}</div>"
+        helpers.content_tag(:div, helpers.safe_join([img, input]), class: 'input-group-captcha')
       end
     end
 
-    # verify captcha value
+    # verify captcha value against the single active challenge and consume it on success, so a solved
+    # captcha is single-use and a blank submission can never match (H3).
     def cama_captcha_verified?
-      (session[:cama_captcha] || []).include?((params[:cama_captcha] || params[:captcha]).to_s.upcase)
+      submitted = (params[:cama_captcha] || params[:captcha]).to_s.upcase
+      return false if submitted.blank?
+      return false unless Array(session[:cama_captcha]).include?(submitted)
+
+      session.delete(:cama_captcha)
+      true
     end
 
     # ************************* captcha in attack helpers ***************************#
+    # Failed attempts are counted BOTH per session and per client IP. The per-IP counter lives in
+    # Rails.cache and is the server-side signal an attacker cannot reset by dropping the session
+    # cookie (audit finding H1); it rolls off CAMA_ATTACK_WINDOW after the last failure.
+    CAMA_ATTACK_WINDOW = 15.minutes
+
     # check if the current visitor was submitted 5+ times
     # key: a string to represent a url or form view
     # key must be the same as the form "captcha_tags_if_under_attack(key, ...)"
     def cama_captcha_under_attack?(key)
       session["cama_captcha_#{key}"] ||= 0
-      session["cama_captcha_#{key}"].to_i > current_site.get_option('max_try_attack', 5).to_i
+      max = current_site.get_option('max_try_attack', 5).to_i
+      session["cama_captcha_#{key}"].to_i > max || cama_captcha_attack_ip_count(key) > max
     end
 
-    # verify captcha values if this key is under attack
-    # key: a string to represent a url or form view
+    # per-IP failed-attempt count for this key (0 when the counter is unset). Reads raw so the
+    # value round-trips as a bare integer on Redis/Memcached (see cama_captcha_increment_attack).
+    # Assumes a request + current_site context, which the admin login flow always has.
+    def cama_captcha_attack_ip_count(key)
+      Rails.cache.read(cama_captcha_attack_ip_key(key), raw: true).to_i
+    end
+
+    # verify the captcha only when this key is under attack; reports solely whether the
+    # current challenge was solved. The attack counter is cleared only by an explicit
+    # cama_captcha_reset_attack once the protected action itself succeeds (as the login
+    # flows do), so solving a captcha can no longer buy captcha-free attempts for an
+    # otherwise failing action. When the key is not under attack, the pending challenge
+    # is left unconsumed for whatever form it belongs to.
     def captcha_verify_if_under_attack(key)
-      res = cama_captcha_under_attack?(key) ? cama_captcha_verified? : true
-      session["cama_captcha_#{key}"] = 0 if cama_captcha_verified?
-      res
+      return true unless cama_captcha_under_attack?(key)
+
+      cama_captcha_verified?
     end
 
-    # increment attempts for key by 1
+    # increment attempts for key by 1 (both the per-session and the per-IP counter)
     def cama_captcha_increment_attack(key)
       session["cama_captcha_#{key}"] ||= 0
       session["cama_captcha_#{key}"] = session["cama_captcha_#{key}"].to_i + 1
+      # Per-IP counter: an ATOMIC cache increment, not a read-then-write. Concurrent failures from
+      # one IP would otherwise race on read+write and lose updates, undercounting a burst and
+      # deferring both the captcha gate and the hard lockout. `raw: true` keeps the value a bare
+      # integer so Redis/Memcached INCR operates on it (a no-op on Memory/File stores); refreshing
+      # the TTL on every increment keeps the rolling window alive during a sustained attack.
+      cache_key = cama_captcha_attack_ip_key(key)
+      counted = Rails.cache.increment(cache_key, 1, expires_in: CAMA_ATTACK_WINDOW, raw: true)
+      # Older FileStore/MemoryStore (Rails < 7.1) return nil for a missing key instead of seeding it;
+      # seed it then. This one-time seed's own race is harmless (count 1 vs 2 is far from any
+      # threshold) and every subsequent increment is atomic.
+      Rails.cache.write(cache_key, 1, expires_in: CAMA_ATTACK_WINDOW, raw: true) if counted.nil?
     end
 
-    # reset the attacks counter for key
+    # reset the attacks counter for key (both the per-session and the per-IP counter)
     # key: a string to represent a url or form view
     def cama_captcha_reset_attack(key)
       session["cama_captcha_#{key}"] = 0
+      Rails.cache.delete(cama_captcha_attack_ip_key(key))
+    end
+
+    # cache key for the per-IP attack counter, scoped to the site and the form key
+    def cama_captcha_attack_ip_key(key)
+      "cama_captcha_attack:#{current_site.id}:#{request.remote_ip}:#{key}"
     end
 
     # return a number of attempts for key
@@ -86,19 +120,5 @@ module CamaleonCms
     def cama_captcha_tags_if_under_attack(key, captcha_parmas = [5, {}, { class: 'form-control required' }])
       cama_captcha_tag(*captcha_parmas) if cama_captcha_under_attack?(key)
     end
-
-    private
-
-    # generate random string for captcha
-    # len: length of characters, default 6
-    def cama_rand_str(len = 6)
-      alphabets = [('A'..'Z').to_a].flatten!
-      alphanumerics = [('A'..'Z').to_a, ('1'..'9').to_a].flatten!
-      str = alphabets[rand(alphabets.size)]
-      (len.to_i - 1).times do
-        str << alphanumerics[rand(alphanumerics.size)]
-      end
-      str
-    end
   end
 end

data/app/helpers/camaleon_cms/comment_helper.rb

@@ -17,7 +17,10 @@ module CamaleonCms
 
     # render as html content all comments recursively
     # comments: collection of comments
-    def cama_comments_render_html(comments)
+    def cama_comments_render_html(comments, post_id = nil)
+      if post_id.nil? && respond_to?(:controller) && controller.respond_to?(:instance_variable_get)
+        post_id = controller.instance_variable_get(:@post)&.id
+      end
       comments.decorate.map do |comment|
         author = comment.the_author
         content_tag(:div, class: 'media') do
@@ -31,7 +34,10 @@ module CamaleonCms
               [
                 content_tag(:h4, class: 'media-heading') do
                   [
-                    author.the_name,
+                    # Escape the author name: User first_name/last_name are no longer sanitized at
+                    # save time and this heading is marked html_safe below, so a commenter-controlled
+                    # name would otherwise be injected as raw HTML into the moderator's page.
+                    ERB::Util.html_escape(author.the_name),
                     ' ',
                     content_tag(:small, comment.the_created_at),
                     ' ',
@@ -45,7 +51,7 @@ module CamaleonCms
                     content_tag(:div, class: 'pull-left') do
                       [
                         link_to(
-                          cama_admin_post_comment_answer_path(@post.id, comment.id),
+                          cama_admin_post_comment_answer_path(post_id, comment.id),
                           data: { comment_id: comment.id },
                           title: t('camaleon_cms.admin.comments.tooltip.reply_comment'),
                           class: 'btn btn-info reply btn-xs ajax_modal'
@@ -64,20 +70,26 @@ module CamaleonCms
                       [
                         link_to(
                           url_for({ action: :toggle_status, comment_id: comment.id, s: 'a' }),
+                          method: :patch,
                           title: t('camaleon_cms.admin.comments.tooltip.approved_comment'),
-                          class: "#{comment.approved == 'approved' ? 'hidden' : ''} btn btn-success approve btn-xs cama_ajax_request"
+                          class: "#{comment.approved == 'approved' ? 'hidden' : ''} " \
+                                 'btn btn-success approve btn-xs cama_ajax_request'
                         ) { content_tag(:span, '', class: 'fa fa-thumbs-o-up') },
                         ' ',
                         link_to(
                           url_for({ action: :toggle_status, comment_id: comment.id, s: 'p' }),
+                          method: :patch,
                           title: t('camaleon_cms.admin.comments.tooltip.comment_pending'),
-                          class: "#{comment.approved == 'pending' ? 'hidden' : ''} btn btn-primary pending btn-xs cama_ajax_request"
+                          class: "#{comment.approved == 'pending' ? 'hidden' : ''} " \
+                                 'btn btn-primary pending btn-xs cama_ajax_request'
                         ) { content_tag(:span, '', class: 'fa fa-warning') },
                         ' ',
                         link_to(
                           url_for({ action: :toggle_status, comment_id: comment.id, s: 's' }),
+                          method: :patch,
                           title: t('camaleon_cms.admin.comments.tooltip.comment_spam'),
-                          class: "#{comment.approved == 'spam' ? 'hidden' : ''} btn btn-danger spam btn-xs cama_ajax_request"
+                          class: "#{comment.approved == 'spam' ? 'hidden' : ''} " \
+                                 'btn btn-danger spam btn-xs cama_ajax_request'
                         ) { content_tag(:span, '', class: 'fa fa-bug') }
                       ].join.html_safe
                     end
@@ -85,7 +97,7 @@ module CamaleonCms
                 end,
                 content_tag(:hr),
                 content_tag(:div, '', class: 'clearfix'),
-                cama_comments_render_html(comment.children)
+                cama_comments_render_html(comment.children, post_id)
               ].join.html_safe
             end
           ].join.html_safe

data/app/helpers/camaleon_cms/content_helper.rb

@@ -2,34 +2,41 @@ module CamaleonCms
   module ContentHelper
     # initialize content variables
     def cama_content_init
-      @_before_content = []
-      @_after_content = []
+      state = cama_content_state
+      state[:before_content] = []
+      state[:after_content] = []
     end
 
     # prepend content for admin or frontend (after <body>)
     # sample: cama_content_prepend(<div>my prepend content</div>)
     def cama_content_prepend(content)
-      @_before_content << content
+      cama_content_state[:before_content] << content
     end
 
     # append content for admin or frontend (before </body>)
     # sample: cama_content_prepend(<div>my after content</div>)
     def cama_content_append(content)
-      @_after_content << content
+      cama_content_state[:after_content] << content
     end
 
     # draw all before contents registered by cama_content_prepend
     def cama_content_before_draw
-      @_before_content.join('')
+      cama_content_state[:before_content].join('')
     rescue StandardError
       ''
     end
 
     # draw all after contents registered by cama_content_append
     def cama_content_after_draw
-      @_after_content.join('')
+      cama_content_state[:after_content].join('')
     rescue StandardError
       ''
     end
+
+    private
+
+    def cama_content_state
+      CurrentRequest.content_helper_state ||= { before_content: [], after_content: [] }
+    end
   end
 end

data/app/helpers/camaleon_cms/email_helper.rb

@@ -1,7 +1,7 @@
 module CamaleonCms
   module EmailHelper
     include CamaleonCms::HooksHelper
-    # send and email
+    # send an email
     # email: email to
     # subject: Subject of the email
     # content: content of the email
@@ -20,7 +20,8 @@ module CamaleonCms
     end
 
     # short method of send_email
-    # args: content='', from=nil, attachs=[], url_base='', current_site, template_name, layout_name, extra_data, format, cc_to
+    # args: content='', from=nil, attachs=[], url_base='', current_site, template_name, layout_name, extra_data,
+    #         format, cc_to
     def cama_send_email(email_to, subject, args = {})
       args = { url_base: cama_root_url, current_site: current_site, subject: subject }.merge(args)
       args[:attachments] = args[:attachs] if args[:attachs].present?
@@ -42,7 +43,10 @@ module CamaleonCms
 
     def send_password_reset_email(user_to_send)
       user_to_send.send_password_reset
-      reset_url = cama_admin_forgot_url({ h: user_to_send.password_reset_token })
+      # Read the column, not the same-named method has_secure_password generates on Rails 7.1+ (which
+      # shadows it with a signed token the controller's column lookup never matches). read_attribute
+      # returns the stored column on every supported Rails version (6.1–8.1).
+      reset_url = cama_admin_forgot_url({ h: user_to_send.read_attribute(:password_reset_token) })
       extra_data = {
         url: reset_url,
         fullname: user_to_send.fullname,

data/app/helpers/camaleon_cms/frontend/application_helper.rb

@@ -8,8 +8,13 @@ module CamaleonCms
 
       # add where conditionals to filter private/hidden/expired/drafts/unpublished
       # note: only for post records
-      def verify_front_visibility(active_record)
+      # eager: collection listings (the_posts/the_contents) preload metas, categories, post_tags and
+      # the post-type metas up front to avoid N+1. Single-record lookups (the_post, render_post,
+      # the_next_post/the_prev_post) pass eager: false so a one-row find is not charged the listing
+      # preloads it never reads.
+      def verify_front_visibility(active_record, eager: true)
         active_record = active_record.visible_frontend
+        active_record = active_record.with_eager if eager
         r = { active_record: active_record }
         hooks_run('filter_post', r)
         r[:active_record]

data/app/helpers/camaleon_cms/frontend/content_select_helper.rb

@@ -1,21 +1,22 @@
 #   Camaleon CMS is a content management system
 #   Copyright (C) 2015 by Owen Peredo Diaz
 #   Email: owenperedo@gmail.com
-#   This program is free software: you can redistribute it and/or modify   it under the terms of the GNU Affero General Public License as  published by the Free Software Foundation, either version 3 of the  License, or (at your option) any later version.
-#   This program is distributed in the hope that it will be useful,  but WITHOUT ANY WARRANTY; without even the implied warranty of  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+#   This program is free software: you can redistribute it and/or modify it under the terms of the
+#   GNU Affero General Public License as published by the Free Software Foundation, either version 3 of the License,
+#   or (at your option) any later version.
+#   This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
 #   See the  GNU Affero General Public License (GPLv3) for more details.
 module CamaleonCms
   module Frontend
     module ContentSelectHelper
-      # select single post of post type
+      # select a single post of post type
       # the_post_type('post') do
       #   the_post('first-blog-post')
       # end
       def the_post(slug)
-        post = @object.the_post(slug)
-        process_in_block(post) do
-          yield(post) if block_given?
-        end
+        post = camaleon_frontend_object.the_post(slug)
+        process_in_block(post) { yield(post) if block_given? }
         post
       end
 
@@ -28,7 +29,7 @@ module CamaleonCms
       #   the_posts(limit: 10)
       # end
       def the_posts(options = {})
-        @object.posts.visible_frontend.limit(options[:limit]).decorate
+        camaleon_frontend_object.posts.visible_frontend.limit(options[:limit]).decorate
       end
 
       # select post type by just pass slug to parameter
@@ -52,7 +53,7 @@ module CamaleonCms
       #   the_comments
       # end
       def the_comments(options = {})
-        @object.comments.limit(options[:limit]).decorate if @object.present?
+        camaleon_frontend_object.comments.limit(options[:limit]).decorate if camaleon_frontend_object.present?
       end
 
       # select title of post
@@ -60,7 +61,7 @@ module CamaleonCms
       #   the_title
       # end
       def the_title
-        @object.the_title if @object.present?
+        camaleon_frontend_object&.the_title
       end
 
       # select content of post
@@ -68,7 +69,12 @@ module CamaleonCms
       #   the_content
       # end
       def the_content
-        sanitize(@object.the_content) if @object.present?
+        # Security (scan-and-reject policy): no render-time transform. Stored content is gated at
+        # save (Post#reject_untrusted_dangerous_content), always equals what its author wrote, and
+        # renders verbatim — the same contract as the templates' `raw post.the_content`. The
+        # sanitize this once applied used the narrow default allowlist, so it also broke trusted
+        # authors' tables and embeds on this DSL path only.
+        camaleon_frontend_object.the_content.to_s.html_safe if camaleon_frontend_object.present? # rubocop:disable Rails/OutputSafety
       end
 
       # select url of post
@@ -76,7 +82,7 @@ module CamaleonCms
       #   the_url
       # end
       def the_url
-        @object.the_url if @object.present?
+        camaleon_frontend_object&.the_url
       end
 
       # select thumbnail of post
@@ -84,15 +90,15 @@ module CamaleonCms
       #   the_thumbnail
       # end
       def the_thumbnail
-        @object.the_thumb_url if @object.present?
+        camaleon_frontend_object&.the_thumb_url
       end
 
-      # select slug of post, post type ... (@object)
+      # select slug of post, post type ...
       # the_post('blog') do
       #   the_slug
       # end
       def the_slug
-        @object.the_slug if @object.present?
+        camaleon_frontend_object&.the_slug
       end
 
       # select excerpt of post
@@ -100,7 +106,7 @@ module CamaleonCms
       #   the_excerpt
       # end
       def the_excerpt(chars = 200)
-        @object.the_excerpt(chars) if @object.present?
+        camaleon_frontend_object&.the_excerpt(chars)
       end
 
       # select custome field from object
@@ -108,7 +114,7 @@ module CamaleonCms
       #   the_field('extra-content')
       # end
       def the_field(slug)
-        @object.the_field(slug) if @object.present?
+        camaleon_frontend_object&.the_field(slug)
       end
 
       # loop through each post of post type
@@ -152,10 +158,18 @@ module CamaleonCms
       #   the_field('extra-content')
       # end
       def process_in_block(object)
-        temp_object = @object
-        @object     = object
+        temp_object = CurrentRequest.frontend_object
+        CurrentRequest.frontend_object = object
         yield
-        @object = temp_object
+      ensure
+        CurrentRequest.frontend_object = temp_object
+      end
+
+      private
+
+      def camaleon_frontend_object
+        # Fall back to a plugin-set @object ivar; core writes CurrentRequest.frontend_object. Regression M20.
+        CurrentRequest.frontend_object || (instance_variable_get(:@object) if instance_variable_defined?(:@object))
       end
     end
   end