camaleon_cms 2.9.2 → 2.9.4

data/app/helpers/camaleon_cms/html_helper.rb

@@ -1,9 +1,10 @@
 module CamaleonCms
   module HtmlHelper
     def cama_html_helpers_init
-      @_pre_assets_content = [] # Assets contents before the libraries import
-      @_assets_libraries = {}
-      @_assets_content = []
+      state = camaleon_html_helper_state
+      state[:pre_assets_content] = [] # Assets contents before the libraries import
+      state[:assets_libraries] = {}
+      state[:assets_content] = []
     end
 
     # register a new asset library to be included on demand calling by: cama_load_libraries(...)
@@ -12,36 +13,47 @@ module CamaleonCms
     def cama_assets_library_register(key, assets = {})
       key = key.to_sym
       cama_assets_libraries
-      @_cama_assets_libraries[key] = { css: [], js: [] } unless @_cama_assets_libraries[key].present?
-      @_cama_assets_libraries[key][:css] += assets[:css] if assets[:css].present?
-      @_cama_assets_libraries[key][:js] += assets[:js] if assets[:js].present?
+      state = camaleon_html_helper_state
+      state[:cama_assets_libraries][key] = { css: [], js: [] } if state[:cama_assets_libraries][key].blank?
+      state[:cama_assets_libraries][key][:css] += assets[:css] if assets[:css].present?
+      state[:cama_assets_libraries][key][:js] += assets[:js] if assets[:js].present?
     end
 
     # enable to load admin or registered libraries (colorpicker, datepicker, tinymce, form_ajax, cropper)
     # sample: add_asset_library("datepicker", "colorpicker")
     # This will add this assets library in the admin head or in a custom place by calling: cama_draw_custom_assets()
     def cama_load_libraries(*keys)
+      state = camaleon_html_helper_state
       keys.each do |key|
         library = cama_assets_libraries[key.to_sym]
-        @_assets_libraries[key.to_sym] = library if library.present?
+        state[:assets_libraries][key.to_sym] = library if library.present?
       end
     end
 
     alias add_asset_library cama_load_libraries
 
-    # add custom asset libraries (js, css or both) for the current request, also you can add extra css or js files for existent libraries
-    # sample: (add new library)
-    #   append_asset_libraries({"my_library_key"=> { js: [plugin_asset("js/my_js"), "plugins/myplugin/assets/js/my_js2"], css: [plugin_asset("css/my_css"), "plugins/myplugin/assets/css/my_css2"] }})
+    # add custom asset libraries (js, css or both) for the current request, also you can add extra css or js files for
+    # existent libraries
+    # sample: (add a new library)
+    #   append_asset_libraries(
+    #     {
+    #       "my_library_key"=> {
+    #         js: [plugin_asset("js/my_js"), "plugins/myplugin/assets/js/my_js2"],
+    #         css: [plugin_asset("css/my_css"), "plugins/myplugin/assets/css/my_css2"]
+    #       }
+    #     }
+    #   )
     # sample: (update existent library)
     #   append_asset_libraries({"colorpicker"=>{js: [plugin_asset("js/my_custom_js")] } })
     # return nil
     def append_asset_libraries(libraries)
+      state = camaleon_html_helper_state
       libraries.each do |key, library|
-        @_assets_libraries[key.to_sym] = if @_assets_libraries.include?(key)
-                                           @_assets_libraries[key.to_sym].merge(library)
-                                         else
-                                           library
-                                         end
+        state[:assets_libraries][key.to_sym] = if state[:assets_libraries].include?(key)
+                                                 state[:assets_libraries][key.to_sym].merge(library)
+                                               else
+                                                 library
+                                               end
       end
     end
     alias cama_load_custom_assets append_asset_libraries
@@ -51,7 +63,7 @@ module CamaleonCms
     # content may be: <style>a{color: red;}</style>
     # this will be printed with <%raw cama_draw_custom_assets %>
     def append_asset_content(content)
-      @_assets_content << content
+      camaleon_html_helper_state[:assets_content] << content
     end
 
     # add pre asset content into custom assets
@@ -59,27 +71,30 @@ module CamaleonCms
     # content may be: <style>a{color: red;}</style>
     # this will be printed before assets_library with <%raw cama_draw_pre_asset_contents %>
     def append_pre_asset_content(content)
-      @_pre_assets_content << content
+      camaleon_html_helper_state[:pre_assets_content] << content
     end
 
     # return all scripts to be executed before import the js libraries(cama_draw_custom_assets)
     def cama_draw_pre_asset_contents
-      (@_pre_assets_content || []).join('').html_safe
+      # rubocop:disable Rails/OutputSafety -- Callers append trusted script/style fragments that must render as markup.
+      camaleon_html_helper_state[:pre_assets_content].join('').html_safe
+      # rubocop:enable Rails/OutputSafety
     end
 
     # return all js libraries added [aa.js, bb,js, ..]
     # def get_assets_js
     def cama_draw_custom_assets
-      cama_html_helpers_init unless @_assets_libraries.present?
+      state = camaleon_html_helper_state
+      cama_html_helpers_init if state[:assets_libraries].blank?
       libs = []
-      @_assets_libraries.each_value do |assets|
+      state[:assets_libraries].each_value do |assets|
         libs += assets[:css] if assets[:css].present?
       end
       stylesheets = libs.uniq
       css = stylesheet_link_tag(*stylesheets, media: 'all')
 
       libs = []
-      @_assets_libraries.each_value do |assets|
+      state[:assets_libraries].each_value do |assets|
         libs += assets[:js] if assets[:js].present?
       end
       javascripts = libs.uniq
@@ -87,33 +102,31 @@ module CamaleonCms
 
       args = { stylesheets: stylesheets, javascripts: javascripts, js_html: js, css_html: css }
       hooks_run('draw_custom_assets', args)
-      "#{args[:css_html]}\n#{args[:js_html]}\n#{@_assets_content.join('').html_safe}"
-    end
+      # rubocop:disable Rails/OutputSafety -- Asset helper output and appended fragments are trusted framework/plugin markup.
+      trusted_fragments = [args[:css_html], args[:js_html], *state[:assets_content]].filter_map do |fragment|
+        next if fragment.blank?
 
-    # return category tree for category dropdown
-    # each level is prefixed with -
-    # level: internal recursive control
-    def cama_get_options_html_from_items(terms, level = 0)
-      options = []
-      terms.all.each do |term|
-        options << [('—' * level) + term.name, term.id] unless @term.id == term.id
-        children = term.children
-        options += cama_get_options_html_from_items(children, level + 1) unless children.empty?
+        fragment.is_a?(ActiveSupport::SafeBuffer) ? fragment : fragment.to_s.html_safe
       end
-      options
+      # rubocop:enable Rails/OutputSafety
+
+      safe_join(trusted_fragments, "\n")
     end
 
-    # create a html tooltip to include anywhere
+    # create an HTML tooltip to include anywhere
     # text: text of the tooltip
     # location: location of the tooltip (left | right | top |bottom)
     def cama_html_tooltip(text = 'Tooltip', location = 'left')
-      "<a href='javascript:;' title='#{text}' data-toggle='tooltip' data-placement='#{location}'><i class='fa fa-info-circle'></i></a>"
+      tag.a(href: 'javascript:;', title: text, data: { toggle: 'tooltip', placement: location }) do
+        tag.i(class: 'fa fa-info-circle')
+      end
     end
 
     private
 
     def cama_assets_libraries
-      return @_cama_assets_libraries if @_cama_assets_libraries.present?
+      state = camaleon_html_helper_state
+      return state[:cama_assets_libraries] if state[:cama_assets_libraries].present?
 
       libs = {}
       libs[:colorpicker] =
@@ -135,7 +148,15 @@ module CamaleonCms
           js: %w[camaleon_cms/admin/jquery.nestable camaleon_cms/admin/nav_menu] }
       libs[:admin_intro] =
         { js: ['camaleon_cms/admin/introjs/intro.min'], css: ['camaleon_cms/admin/introjs/introjs.min'] }
-      @_cama_assets_libraries = libs
+      state[:cama_assets_libraries] = libs
+    end
+
+    def camaleon_html_helper_state
+      state = CurrentRequest.html_helper_state ||= {}
+      state[:pre_assets_content] ||= []
+      state[:assets_libraries] ||= {}
+      state[:assets_content] ||= []
+      state
     end
 
     # execute translation for value if this value is like: t(admin.my_text) ==> My Text

data/app/helpers/camaleon_cms/plugins_helper.rb

@@ -2,21 +2,19 @@ module CamaleonCms
   module PluginsHelper
     include CamaleonCms::SiteHelper
     # load all plugins + theme installed for current site
-    # METHOD IGNORED (is a partial solution to avoid load helpers and cache it for all sites)
-    # this method try to load helpers for each request without caching
+    # METHOD IGNORED (is a partial solution to avoid loading helpers and cache it for all sites)
+    # this method tries to load helpers for each request without caching
     def plugins_initialize(klass = nil)
       mod = Module.new
       PluginRoutes.enabled_apps(current_site).each do |plugin|
-        next if !plugin.present? || !plugin['helpers'].present?
+        next if plugin.blank? || plugin['helpers'].blank?
 
-        plugin['helpers'].each do |h|
-          mod.send :include, h.constantize
-        end
+        plugin['helpers'].each { |h| mod.send :include, h.constantize }
       end
       (klass || self).send :extend, mod
     end
 
-    # upgrade installed plugin in current site for a new version
+    # upgrade the installed plugin in the current site for a new version
     # plugin_key: key of the plugin
     # trigger hook "on_upgrade"
     # return model of the plugin
@@ -29,7 +27,7 @@ module CamaleonCms
       plugin_model
     end
 
-    # install a plugin for current site
+    # install a plugin for the current site
     # plugin_key: key of the plugin
     # return model of the plugin
     def plugin_install(plugin_key)
@@ -50,7 +48,7 @@ module CamaleonCms
       end
     end
 
-    # uninstall a plugin from current site
+    # uninstall a plugin from the current site
     # plugin_key: key of the plugin
     # return model of the plugin
     def plugin_uninstall(plugin_key)
@@ -66,7 +64,7 @@ module CamaleonCms
       plugin_model
     end
 
-    # remove a plugin from current site
+    # remove a plugin from the current site
     # plugin_key: key of the plugin
     # return model of the plugin removed
     # DEPRECATED: PLUGINS AND THEMES CANNOT BE DESTROYED
@@ -105,8 +103,10 @@ module CamaleonCms
     # return plugin full asset path
     # plugin_key: plugin name
     # asset: (String) asset name
-    # sample: <script src="<%= plugin_asset_path("admin.js") %>"></script> => /assets/plugins/my_plugin/admin-54505620f.js
-    # sample: <script src="<%= plugin_asset_path("admin.js", 'my_plugin') %>"></script> => /assets/plugins/my_plugin/admin-54505620f.js
+    # sample: <script src="<%= plugin_asset_path("admin.js") %>"></script> =>
+    #           /assets/plugins/my_plugin/admin-54505620f.js
+    # sample: <script src="<%= plugin_asset_path("admin.js", 'my_plugin') %>"></script> =>
+    #           /assets/plugins/my_plugin/admin-54505620f.js
     def plugin_asset_path(asset, plugin_key = nil)
       if plugin_key.present? && plugin_key.include?('/')
         return plugin_asset_url(plugin_key,
@@ -123,11 +123,12 @@ module CamaleonCms
     alias plugin_asset plugin_asset_path
     alias plugin_gem_asset plugin_asset_path
 
-    # return the full url for asset of current plugin:
+    # return the full url for asset of the current plugin:
     # asset: (String) asset name
     # plugin_key: (optional) plugin name, default (current plugin caller to this function)
     # sample:
-    #   plugin_asset_url("css/main.css") => return: https://myhost.com/assets/plugins/my_plugin/assets/css/main-54505620f.css
+    #   plugin_asset_url("css/main.css") =>
+    #     return: https://myhost.com/assets/plugins/my_plugin/assets/css/main-54505620f.css
     def plugin_asset_url(asset, plugin_key = nil)
       key = plugin_key || self_plugin_key(1)
       p = PluginRoutes.plugin_info(key)['gem_mode'] ? "plugins/#{key}/#{asset}" : "plugins/#{key}/assets/#{asset}"
@@ -138,22 +139,22 @@ module CamaleonCms
       end
     end
 
-    # auto load all helpers of this plugin
+    # Autoload all helpers of this plugin
     def plugin_load_helpers(plugin)
-      return if !plugin.present? || !plugin['helpers'].present?
+      return if plugin.blank? || plugin['helpers'].blank?
 
       plugin['helpers'].each do |h|
         next if self.class.include?(h.constantize)
 
-        class_eval do
-          include h.constantize
-        end
+        class_eval { include h.constantize }
       rescue StandardError => e
-        Rails.logger.debug "Camaleon CMS - App loading error for #{h}: #{e.message}. Please check the plugins and themes presence"
+        Rails.logger.debug do
+          "Camaleon CMS - App loading error for #{h}: #{e.message}. Please check the plugins and themes presence"
+        end
       end
     end
 
-    # return plugin key for current plugin file (helper|controller|view)
+    # return the plugin key for the current plugin file (helper|controller|view)
     # index: internal control (ignored)
     def self_plugin_key(index = 0)
       f = caller[index]
@@ -175,9 +176,7 @@ module CamaleonCms
     # return the plugin model for current site calculated according to the file caller location
     def current_plugin(plugin_key = nil)
       _key = plugin_key || self_plugin_key(1)
-      cama_cache_fetch("current_plugin_#{_key}") do
-        current_site.get_plugin(_key)
-      end
+      cama_cache_fetch("current_plugin_#{_key}") { current_site.get_plugin(_key) }
     end
   end
 end

data/app/helpers/camaleon_cms/session_helper.rb

@@ -6,10 +6,22 @@ module CamaleonCms
     # redirect_url (default nil): after initialized the session, this will be redirected to
     #   "redirect_url" if defined
     #   it doesn't redirect if redirect_url === false
-    #   return to previous page if defined the cookie['return_to'] or login url received extra param: return_to=https://mysite.com
-    def login_user(user, remember_me = false, redirect_url = nil)
-      c = { value: [user.auth_token, request.user_agent, request.ip], expires: 24.hours.from_now }
-      c[:domain] = :all if PluginRoutes.system_info['users_share_sites'].present? && CamaleonCms::Site.count > 1
+    #   return to previous page if defined the cookie['return_to'], or login
+    #     url received extra param: return_to=https://mysite.com
+    # allow_external (default false): follow redirect_url even when it points off-site, for a caller that
+    #   has vetted the destination (e.g. an after_login hook doing SSO/payment). http(s) only; a configured
+    #   allowlist (redirect_allowed_hosts option / safe_redirect_hosts hook) is honored regardless of it.
+    def login_user(user, remember_me = false, redirect_url = nil, rotate_session: true, allow_external: false)
+      # Rotate the session on a genuine sign-in (H6): a fresh session drops any state left behind by a
+      # previous occupant of a shared browser — notably an impersonation parent_auth_token, which
+      # session_back_to_parent would otherwise restore on logout, escalating the new user to admin.
+      # Impersonation manages that token itself and passes rotate_session: false so this does not wipe it.
+      reset_session if rotate_session
+
+      # Security (audit 2026-08-11 M3): the auth cookie is HttpOnly (JavaScript/XSS cannot read the
+      # bearer token) and Secure over an SSL request (never sent in the clear). The three components are
+      # joined into one string so the split-based reader and the impersonation stash keep their shape.
+      c = cama_auth_cookie_options([user.auth_token, request.user_agent, request.ip].join('&'))
       c[:expires] = 1.month.from_now if remember_me
 
       # fix to overwrite a cookie
@@ -24,9 +36,13 @@ module CamaleonCms
       return if redirect_url == false
 
       if redirect_url.present?
-        redirect_to redirect_url
+        # Host-check the explicit redirect_url too: after_login hooks and downstream plugins pass
+        # caller-controlled destinations here (e.g. a return_to cookie), so it gets the same open-redirect
+        # guard as the return_to cookie branch below. allow_external lets such a hook opt a vetted off-site
+        # destination (SSO/payment) past the same-host rule; it stays http(s)-only either way.
+        cama_safe_redirect(redirect_url, cama_admin_dashboard_path, allow_external: allow_external)
       elsif (return_to = cookies.delete(:return_to)).present?
-        redirect_to safe_redirect_url(return_to) || cama_admin_dashboard_path
+        cama_safe_redirect(return_to, cama_admin_dashboard_path)
       else
         redirect_to cama_admin_dashboard_path
       end
@@ -35,13 +51,14 @@ module CamaleonCms
     # login a user using username and password
     # return boolean: true => authenticated, false => authentication failed
     def login_user_with_password(username, password)
-      @user = current_site.users.find_by_username(username)
-      r = { user: @user, params: params, password: password, captcha_validate: true }
+      # Custom class finder: usernames are stored downcased, so the lookup must
+      # lower-case both sides regardless of DB collation.
+      user = current_site.users.find_by_username(username) # rubocop:disable Rails/DynamicFindBy
+      r = { user: user, params: params, password: password, captcha_validate: true }
       hooks_run('user_before_login', r)
-      @user&.authenticate(password)
+      user&.authenticate(password)
     end
 
-    ##
     # User registration.
     #
     # user_data must contain:
@@ -50,22 +67,42 @@ module CamaleonCms
     # - username
     # - password
     # - password_confirmation
-
     def cama_register_user(user_data, meta)
-      @user = current_site.users.new(user_data)
-      r = { user: @user, params: params }
-      hook_run('user_before_register', r)
-
+      user = current_site.users.new(user_data)
+
+      # Gate on the register captcha before running any hook, so user_before_register does not fire for
+      # attempts that fail the captcha. This diverges from user_before_login, which runs its hook even on a
+      # failed captcha and passes the result as r[:captcha_validate]; user_before_register does neither, so
+      # the "parity with user_before_login" below is limited to the stop_process veto. Verifying here also
+      # consumes the single-use captcha before the hook, so a later veto burns a solved challenge —
+      # harmless, since the re-rendered form issues a fresh one.
       if current_site.security_user_register_captcha_enabled? && !cama_captcha_verified?
-        { result: false, type: :captcha_error, message: t('camaleon_cms.admin.users.message.error_captcha') }
-      elsif @user.save
-        @user.set_metas(meta)
-        message = current_site.need_validate_email? ? t('camaleon_cms.admin.users.message.created_pending_validate_email') : t('camaleon_cms.admin.users.message.created')
-        r = { user: @user, message: message, redirect_url: cama_admin_login_path }
+        return { result: false, type: :captcha_error,
+                 message: t('camaleon_cms.admin.users.message.error_captcha'), user: user }
+      end
+
+      r = { user: user, params: params, stop_process: false }
+      # Broadcast (hooks_run), not hook_run: hook_run(target, name, …) takes the app as its first arg, so
+      # hook_run('user_before_register', r) treated the name as a plugin and silently no-op'd — the hook
+      # never fired. Match the sibling user_before_login/user_after_register broadcasts.
+      hooks_run('user_before_register', r)
+      # A handler may veto the registration by setting r[:stop_process] (parity with user_before_login):
+      # stop here without saving. The handler may surface its own reason (add to r[:user].errors, or
+      # render/redirect); otherwise the controller shows a generic error.
+      return { result: false, type: :stopped, user: user } if r[:stop_process]
+
+      if user.save
+        user.set_metas(meta)
+        message = if current_site.need_validate_email?
+                    t('camaleon_cms.admin.users.message.created_pending_validate_email')
+                  else
+                    t('camaleon_cms.admin.users.message.created')
+                  end
+        r = { user: user, message: message, redirect_url: cama_admin_login_path }
         hooks_run('user_after_register', r)
-        { result: true, message: r[:message], redirect_url: r[:redirect_url] }
+        { result: true, message: r[:message], redirect_url: r[:redirect_url], user: user }
       else
-        { result: false, type: :no_saved }
+        { result: false, type: :no_saved, user: user }
       end
     end
 
@@ -79,55 +116,87 @@ module CamaleonCms
     def session_switch_user(user, redirect_url = nil)
       return unless cama_sign_in?
 
-      session[:parent_auth_token] = cookies[:auth_token]
-      login_user(user, false, redirect_url)
+      # Start impersonation from a clean session (see login_user), then stash the admin's auth cookie.
+      # The stash happens AFTER the reset and login_user is told not to rotate again, so the token
+      # session_back_to_parent restores later survives this rotation (H6).
+      parent_auth_token = cookies[:auth_token]
+      reset_session
+      session[:parent_auth_token] = parent_auth_token
+      login_user(user, false, redirect_url, rotate_session: false)
+    end
+
+    # The admin who started the current impersonation, resolved from the stashed parent auth token
+    # (same lookup as cama_current_user). Returns nil if there is no active impersonation or the stash
+    # no longer resolves to a user (e.g. the admin rotated their token by changing their password).
+    # Callers MUST re-authenticate this user before session_back_to_parent (H6 residual): the
+    # impersonated session an admin holds is indistinguishable from one they abandon, so the admin's
+    # password is the only proof that the person returning is the admin and not a later occupant.
+    def cama_impersonation_parent_user
+      token = session[:parent_auth_token].to_s.split('&').first
+      return if token.blank?
+
+      current_site.users_include_admins.find_by(auth_token: token)
     end
 
     # switch current session into parent session called by session_switch_user
     # after returned into parent session, this will be redirected to redirect_url or admin dashboard
+    # SECURITY: only call this once the parent admin has been re-authenticated (see
+    # Admin::SessionsController#back_to_parent and cama_impersonation_parent_user).
     def session_back_to_parent(redirect_url = nil)
       return unless cama_sign_in? && session[:parent_auth_token].present?
 
-      cookies[:auth_token] = session[:parent_auth_token]
+      cookies[:auth_token] = cama_auth_cookie_options(session[:parent_auth_token])
       session.delete(:parent_auth_token)
       redirect_to (redirect_url || cama_admin_dashboard_path), notice: 'Welcome back!'
     end
 
     # logout current user
     def cama_logout_user
+      # Security (audit 2026-08-11 M3): rotate the server-side token so a cookie copied before logout
+      # cannot be replayed afterwards. The token is per-user, so this also ends the user's other sessions.
+      # Audit M14: skip the rotation during impersonation -- cama_current_user is then the impersonated
+      # user, not the admin ending the session, and rotating their token would log the innocent user
+      # out of all their own devices. session_back_to_parent is the intended exit from impersonation.
+      cama_current_user&.cama_reset_auth_token! if session[:parent_auth_token].blank?
       cookies.delete(:auth_token, domain: :all)
       cookies.delete(:auth_token, domain: nil)
       c_data = { value: nil, expires: 24.hours.ago }
       c_data[:domain] = :all if PluginRoutes.system_info['users_share_sites'].present? && CamaleonCms::Site.count > 1
       cookies[:auth_token] = c_data
-      redirect_to params[:return_to].present? ? params[:return_to] : cama_admin_login_path,
-                  notice: t('camaleon_cms.admin.logout.message.closed')
+      CurrentRequest.user = nil
+      CurrentRequest.user_resolved = true # the cookie is gone; don't re-resolve to a stale user
+      # Drop all server-side session state on logout (H6): a lingering impersonation parent_auth_token
+      # must not survive to be restored into a later session on a shared browser.
+      reset_session
+      cama_safe_redirect(params[:return_to], cama_admin_login_path,
+                         notice: t('camaleon_cms.admin.logout.message.closed'))
     end
 
-    # check if current user is already signed
+    # Check if the current user is already signed
     def cama_sign_in?
       !cama_current_user.nil?
     end
 
     alias signin? cama_sign_in?
 
-    # return the role for current user
+    # return the role for the current user
     # if not logged in, then return 'public'
     def cama_current_role
       current_site.visitor_role
     end
 
-    # return current user logged in
+    # return the current user logged in
     def cama_current_user
-      return @cama_current_user if defined?(@cama_current_user)
-
-      # api current user...
-      @cama_current_user = cama_calc_api_current_user
-      return @cama_current_user if @cama_current_user
-
-      return nil unless cookie_auth_token_complete?
-
-      @cama_current_user = current_site.users_include_admins.find_by_auth_token(user_auth_token_from_cookie).try(:decorate)
+      # Honor an externally-set user, and memoize a nil resolution via user_resolved so a signed-out
+      # request (or a present-but-stale auth cookie) is not re-resolved on every call (regression M16).
+      return CurrentRequest.user if CurrentRequest.user || CurrentRequest.user_resolved
+
+      CurrentRequest.user_resolved = true
+      user = cama_calc_api_current_user # api current user...
+      if user.nil? && cookie_auth_token_complete?
+        user = current_site.users_include_admins.find_by(auth_token: user_auth_token_from_cookie).try(:decorate)
+      end
+      CurrentRequest.user = user
     end
 
     def cookie_auth_token_complete?
@@ -159,7 +228,7 @@ module CamaleonCms
 
     # return the session id
     def cama_get_session_id
-      session[:autor] = 'Owen Peredo Diaz' unless request.session_options[:id].present?
+      session[:autor] = 'Owen Peredo Diaz' if request.session_options[:id].blank?
       id = request.session_options[:id]
       id = id.public_id if id.instance_of?(::Rack::Session::SessionId)
       id
@@ -167,18 +236,93 @@ module CamaleonCms
 
     private
 
-    # validate redirect url to prevent open redirect attacks
-    def safe_redirect_url(url)
+    # Options for the auth cookie (M3): HttpOnly so JavaScript cannot read the bearer token, Secure over
+    # an SSL request so it is never sent in the clear, a 24h default lifetime, and the shared-domain
+    # scope when sites share users. Callers override :expires (remember-me) as needed.
+    def cama_auth_cookie_options(value)
+      opts = { value: value, httponly: true, secure: request.ssl?, expires: 24.hours.from_now }
+      opts[:domain] = :all if PluginRoutes.system_info['users_share_sites'].present? && CamaleonCms::Site.count > 1
+      opts
+    end
+
+    # validate redirect url to prevent open redirect attacks: relative, or same-host over http(s), only —
+    # unless the off-site host is explicitly trusted (see cama_redirect_allowed_hosts) or the caller vouches
+    # for it (allow_external, for hook-set SSO/payment destinations). Host compared case-insensitively
+    # (RFC 3986); a same-host absolute URL is emitted with the host in the request's canonical case, so
+    # Rails' own case-sensitive open-redirect protection stays active without tripping on it.
+    def safe_redirect_url(url, allow_external: false)
       return if url.blank?
 
       uri = URI.parse(url)
-      return if uri.host.present? && uri.host != request.host
+      if uri.host.present?
+        # A non-HTTP scheme carrying a host (javascript://host/..., data://host/...) parses with a host but
+        # is not a real navigation — it would execute if rendered into an href/JS sink. Reject it before any
+        # host decision, so neither the allowlist nor allow_external can let such a scheme through.
+        return unless uri.scheme.blank? || %w[http https].include?(uri.scheme.downcase)
+
+        if uri.host.casecmp?(request.host)
+          uri.host = request.host
+          return uri.to_s
+        end
+
+        # Off-host: followed only for an admin/plugin-vetted host, or when the caller explicitly vouches for
+        # this destination (allow_external — a hook doing SSO/payment). Never for a caller-controlled
+        # return_to, which always passes allow_external: false.
+        return uri.to_s if allow_external || cama_redirect_host_allowed?(uri.host)
+
+        return
+      end
+
+      # A blank parsed host does not mean same-origin: a scheme (https:evil.com, javascript:...) or a
+      # slash/backslash-led form (///evil.com, /\evil.com, and their %2f/%5c encodings) still sends a
+      # browser off-site. Follow only a genuine same-origin path — one leading "/" then a normal path
+      # character (audit: the ///evil.com open redirect).
+      return unless uri.scheme.blank? && url.start_with?('/') && !url.match?(%r{\A/(?:[/\\]|%2f|%5c)}i)
 
       url
     rescue URI::InvalidURIError
       nil
     end
 
+    # Redirect to a destination vetted by safe_redirect_url, or to `fallback` when it is dropped. A vetted
+    # off-host destination (allowlisted or vouched via allow_external) is emitted with allow_other_host so
+    # Rails' backstop does not reject it; a same-host destination keeps that backstop as a second layer.
+    def cama_safe_redirect(url, fallback, allow_external: false, **opts)
+      target = safe_redirect_url(url, allow_external: allow_external)
+      return redirect_to(fallback, **opts) if target.blank?
+
+      opts[:allow_other_host] = true if cama_redirect_off_host?(target) && cama_supports_allow_other_host?
+      redirect_to(target, **opts)
+    end
+
+    # Admin- and plugin-declared allowlist of off-site hosts that redirects may target, in addition to the
+    # request host. Sourced from the `redirect_allowed_hosts` site option (comma-separated) and the
+    # `safe_redirect_hosts` hook (plugins append their provider host to r[:hosts]). Empty by default — the
+    # strict same-host policy — so an off-host redirect is only ever reachable once a host is explicitly
+    # trusted. Only consulted for an off-host destination, so same-host/relative redirects skip it.
+    def cama_redirect_allowed_hosts
+      r = { hosts: current_site.get_option('redirect_allowed_hosts', '').to_s.split(',') }
+      hooks_run('safe_redirect_hosts', r)
+      Array(r[:hosts]).map { |h| h.to_s.strip }.reject(&:blank?)
+    end
+
+    def cama_redirect_host_allowed?(host)
+      cama_redirect_allowed_hosts.any? { |allowed| allowed.casecmp?(host) }
+    end
+
+    def cama_redirect_off_host?(url)
+      host = URI.parse(url).host
+      host.present? && !host.casecmp?(request.host)
+    rescue URI::InvalidURIError
+      false
+    end
+
+    # allow_other_host is a Rails 7.0+ redirect_to option; on the 6.1 floor there is no open-redirect
+    # backstop to satisfy, so an off-host redirect there just works without it.
+    def cama_supports_allow_other_host?
+      Rails::VERSION::MAJOR >= 7
+    end
+
     # calculate the current user for API
     def cama_calc_api_current_user
       begin
@@ -190,7 +334,7 @@ module CamaleonCms
       end
       return unless doorkeeper_token
 
-      current_site.users_include_admins.find_by_id(doorkeeper_token.resource_owner_id).try(:decorate)
+      current_site.users_include_admins.find_by(id: doorkeeper_token.resource_owner_id).try(:decorate)
     end
   end
 end