camaleon_cms 2.9.2 → 2.9.4

data/app/models/camaleon_cms/site.rb

@@ -1,32 +1,45 @@
 module CamaleonCms
   class Site < CamaleonCms::TermTaxonomy
-    normalize_attrs(:name, :description)
+    normalize_attrs(:description)
 
     include CamaleonCms::SiteDefaultSettings
 
     # attrs: [name, description, slug]
     attr_accessor :site_domain
 
-    default_scope { where(taxonomy: :site).reorder(term_group: :desc) }
+    # Transient (never persisted): when default_settings auto-provisions the
+    # administrator, it stashes the randomly generated plaintext password here so
+    # the provisioning controller can surface it once. nil when no admin was minted
+    # (e.g. a shared admin already existed). See harden-installer-default-admin.
+    attr_accessor :generated_admin_password
 
-    has_many :post_types, class_name: 'CamaleonCms::PostType', foreign_key: :parent_id, dependent: :destroy
+    has_many :post_types, class_name: 'CamaleonCms::PostType', foreign_key: :parent_id, dependent: :destroy,
+                          inverse_of: :site
     has_many :nav_menus, class_name: 'CamaleonCms::NavMenu', foreign_key: :parent_id, dependent: :destroy,
                          inverse_of: :site
-    has_many :nav_menu_items, class_name: 'CamaleonCms::NavMenuItem', foreign_key: :term_group
-    has_many :widgets, class_name: 'CamaleonCms::Widget::Main', foreign_key: :parent_id, dependent: :destroy
-    has_many :sidebars, class_name: 'CamaleonCms::Widget::Sidebar', foreign_key: :parent_id, dependent: :destroy
-    has_many :user_roles_rel, class_name: 'CamaleonCms::UserRole', foreign_key: :parent_id, dependent: :destroy
+    # inverse_of: false — this joins by term_group (the site id), while NavMenuItem#parent
+    # reads parent_id (the menu id); an inverse here overwrites items' real menu parent.
+    has_many :nav_menu_items, class_name: 'CamaleonCms::NavMenuItem', foreign_key: :term_group, inverse_of: false,
+                              dependent: :destroy
+    has_many :widgets, class_name: 'CamaleonCms::Widget::Main', foreign_key: :parent_id, dependent: :destroy,
+                       inverse_of: :site
+    has_many :sidebars, class_name: 'CamaleonCms::Widget::Sidebar', foreign_key: :parent_id, dependent: :destroy,
+                        inverse_of: :site
+    has_many :user_roles_rel, class_name: 'CamaleonCms::UserRole', foreign_key: :parent_id, dependent: :destroy,
+                              inverse_of: :site
     has_many :custom_field_groups, class_name: 'CamaleonCms::CustomFieldGroup', foreign_key: :parent_id,
-                                   dependent: :destroy
-    has_many :term_taxonomies, class_name: 'CamaleonCms::TermTaxonomy', foreign_key: :parent_id
+                                   dependent: :destroy, inverse_of: :parent
+    has_many :term_taxonomies, class_name: 'CamaleonCms::TermTaxonomy', foreign_key: :parent_id, inverse_of: :parent,
+                               dependent: :destroy
 
     has_many :posts, through: :post_types, source: :posts
-    has_many :plugins, class_name: 'CamaleonCms::Plugin', foreign_key: :parent_id, dependent: :destroy
-    has_many :themes, class_name: 'CamaleonCms::Theme', foreign_key: :parent_id, dependent: :destroy
-    has_many :public_media, -> { where(is_public: true) },
-             class_name: 'CamaleonCms::Media', foreign_key: :site_id, dependent: :destroy
-    has_many :private_media, -> { where(is_public: false) },
-             class_name: 'CamaleonCms::Media', foreign_key: :site_id, dependent: :destroy
+    has_many :plugins, class_name: 'CamaleonCms::Plugin', foreign_key: :parent_id, dependent: :destroy,
+                       inverse_of: :site
+    has_many :themes, class_name: 'CamaleonCms::Theme', foreign_key: :parent_id, dependent: :destroy, inverse_of: :site
+    has_many :public_media, -> { where(is_public: true) }, class_name: 'CamaleonCms::Media', foreign_key: :site_id,
+                                                           dependent: :destroy, inverse_of: :site
+    has_many :private_media, -> { where(is_public: false) }, class_name: 'CamaleonCms::Media', foreign_key: :site_id,
+                                                             dependent: :destroy, inverse_of: :site
 
     after_create :default_settings
     after_create :set_default_user_roles
@@ -35,7 +48,7 @@ module CamaleonCms
     before_destroy :destroy_site
     after_destroy :refresh_routes
 
-    validates_uniqueness_of :slug, scope: :taxonomy
+    validates :slug, uniqueness: { scope: :taxonomy }
 
     # all user roles for this site
     def user_roles
@@ -79,7 +92,7 @@ module CamaleonCms
       options[:_admin_theme] || 'en'
     end
 
-    # set current admin language for this site
+    # Set the current admin language for this site
     def set_admin_language(language)
       set_option('_admin_theme', language)
     end
@@ -149,11 +162,9 @@ module CamaleonCms
 
     # list all users of current site
     def users
-      if PluginRoutes.system_info['users_share_sites']
-        CamaleonCms::User.all
-      else
-        CamaleonCms::User.where(site_id: id)
-      end
+      return CamaleonCms::User.all if PluginRoutes.system_info['users_share_sites']
+
+      CamaleonCms::User.where(site_id: id)
     end
     alias users_include_admins users
 
@@ -176,15 +187,13 @@ module CamaleonCms
     def get_valid_post_slug(slug, post_id = nil)
       slugs = slug.translations
       if slugs.present?
-        slugs.each do |k, v|
-          slugs[k] = get_valid_post_slug(v)
-        end
+        slugs.each { |k, v| slugs[k] = get_valid_post_slug(v) }
         slugs.to_translate
       else
         res = slug
         (1..9999).each do |i|
-          p = posts.find_by_slug(res)
-          break if !p.present? || (p.present? && p.id == post_id)
+          p = posts.find_by_slug(res) # rubocop:disable Rails/DynamicFindBy
+          break if p.blank? || (p.present? && p.id == post_id)
 
           res = "#{slug}-#{i}"
         end
@@ -211,7 +220,7 @@ module CamaleonCms
     # if the anonymous user not exist, will create one
     def get_anonymous_user
       user = users.where(username: 'anonymous').first
-      unless user.present?
+      if user.blank?
         pass = "anonymous#{rand(9999)}"
         user = users.create({ email: 'anonymous_user@local.com', username: 'anonymous', password: pass,
                               password_confirmation: pass, first_name: 'Anonymous' })
@@ -221,7 +230,8 @@ module CamaleonCms
 
     # return the domain for current site
     # sample: mysite.com | sample.mysite.com
-    # also, you can define custom domain for this site by: my_site.site_domain = 'my_site.com' # used for sites with different domains to call from console or task
+    # also, you can define custom domain for this site by: my_site.site_domain = 'my_site.com'
+    # used for sites with different domains to call from console or task
     def get_domain
       @site_domain || (if main_site?
                          slug

data/app/models/camaleon_cms/term_relationship.rb

@@ -1,23 +1,26 @@
 module CamaleonCms
   class TermRelationship < CamaleonRecord
     self.table_name = "#{PluginRoutes.static_system_info['db_prefix']}term_relationships"
+
     default_scope -> { order(term_order: :asc) }
 
-    belongs_to :term_taxonomy, inverse_of: :term_relationships, required: false
-    belongs_to :object, lambda {
-                          order("#{CamaleonCms::Post.table_name}.id DESC")
-                        }, class_name: 'CamaleonCms::Post', foreign_key: :objectid, inverse_of: :term_relationships, required: false
+    belongs_to :term_taxonomy, inverse_of: :term_relationships, optional: true
+    belongs_to :object, -> { order("#{CamaleonCms::Post.table_name}.id DESC") },
+               class_name: 'CamaleonCms::Post', foreign_key: :objectid, inverse_of: :term_relationships,
+               optional: true
 
-    # callbacks
     after_create :update_count
     before_destroy :update_count
 
     private
 
-    # update counter of post published items
+    # Update the counter of post-published items
     # TODO verify counter
     def update_count
-      term_taxonomy.update_column('count', term_taxonomy.posts.published.size) if term_taxonomy&.try(:posts)
+      return unless term_taxonomy&.try(:posts)
+
+      term_taxonomy
+        .update_column(:count, term_taxonomy.posts.published.size) # rubocop:disable Rails/SkipsModelValidations
     end
   end
 end

data/app/models/camaleon_cms/term_taxonomy.rb

@@ -2,6 +2,7 @@ module CamaleonCms
   class TermTaxonomy < CamaleonRecord
     include CamaleonCms::Metas
     include CamaleonCms::CustomFieldsRead
+    include CamaleonCms::ContentShortcodeGate
 
     extend CamaleonCms::NormalizeAttrs
 
@@ -14,10 +15,57 @@ module CamaleonCms
     end
 
     self.table_name = "#{PluginRoutes.static_system_info['db_prefix']}term_taxonomy"
-    # attr_accessible :taxonomy, :description, :parent_id, :count, :name, :slug, :term_group, :status, :term_order, :user_id
+    # attr_accessible :taxonomy, :description, :parent_id, :count, :name, :slug, :term_group, :status, :term_order,
+    #                 :user_id
     # attr_accessible :data_options
     # attr_accessible :data_metas
 
+    self.inheritance_column = :taxonomy
+
+    def self.sti_name
+      name.demodulize.underscore
+    end
+
+    def self.polymorphic_name
+      name.demodulize
+    end
+
+    def self.find_sti_class(type_name)
+      # Handle explicit exceptions where database string doesn't match namespacing layout
+      case type_name.to_s
+      when 'widget'
+        return CamaleonCms::Widget::Main
+      when 'sidebar'
+        return CamaleonCms::Widget::Sidebar
+      end
+
+      # Standard conversion for "site" -> "CamaleonCms::Site"
+      # or "nav_menu_item" -> "CamaleonCms::NavMenuItem"
+      klass = begin
+        "CamaleonCms::#{type_name.camelize}".constantize
+      rescue NameError
+        nil
+      end
+      # The ancestry guard keeps a value like "meta" from instantiating an unrelated
+      # CamaleonCms class against the term_taxonomy table.
+      return klass if klass && klass <= base_class
+
+      # Runtime scan across loaded taxonomy models.
+      found = CamaleonCms::TermTaxonomy.descendants.find { |k| k.sti_name == type_name.to_s }
+      return found if found
+
+      # `super` resolves fully-qualified external classes (plugin STI outside the CamaleonCms
+      # namespace) and enforces ancestry — the scan above only sees classes already loaded, so
+      # without this an unloaded plugin taxonomy silently degraded to the base class. Same
+      # fallback PostDefault.find_sti_class keeps. Values it cannot place load as the base class,
+      # as every row did before native STI.
+      begin
+        super
+      rescue ActiveRecord::SubclassNotFound
+        base_class
+      end
+    end
+
     # callbacks
     before_validation :before_validating
     before_destroy :destroy_dependencies
@@ -25,13 +73,19 @@ module CamaleonCms
     # validates
     validates :name, :taxonomy, presence: true
     validates_with CamaleonCms::UniqValidator
+    # A taxonomy/widget description is expanded by do_shortcode at render
+    # (TermTaxonomyDecorator#the_content, shortcode_templates/widget.html.erb); STI-covers every
+    # subclass (post types, categories, tags, widgets, sidebars). Gate authorship behind
+    # content_shortcodes -- benign descriptions pass without ever building an Ability.
+    gate_content_shortcodes :description
 
     # relations
-    has_many :term_relationships, class_name: 'CamaleonCms::TermRelationship', foreign_key: :term_taxonomy_id,
+    has_many :term_relationships, class_name: 'CamaleonCms::TermRelationship',
                                   dependent: :destroy
     # has_many :posts, foreign_key: :objectid, through: :term_relationships, :source => :objects
-    belongs_to :parent, class_name: 'CamaleonCms::TermTaxonomy', foreign_key: :parent_id, required: false
-    belongs_to :owner, class_name: CamaManager.get_user_class_name, foreign_key: :user_id, required: false
+    belongs_to :parent, class_name: 'CamaleonCms::TermTaxonomy', optional: true
+    belongs_to :owner, class_name: CamaManager.get_user_class_name.to_s, foreign_key: :user_id, optional: true,
+                       inverse_of: false
 
     # return all children taxonomy
     # sample: sub categories of a category

data/app/models/camaleon_cms/theme.rb

@@ -1,12 +1,10 @@
 module CamaleonCms
   class Theme < CamaleonCms::TermTaxonomy
-    normalize_attrs(:name, :description)
+    normalize_attrs(:description)
 
     # attrs:
     #   slug => plugin key
-    belongs_to :site, class_name: 'CamaleonCms::Site', foreign_key: :parent_id, required: false
-
-    default_scope { where(taxonomy: :theme) }
+    belongs_to :site, class_name: 'CamaleonCms::Site', foreign_key: :parent_id, optional: true, inverse_of: :themes
 
     before_validation :fix_name
     before_destroy :destroy_custom_fields

data/app/models/camaleon_cms/user.rb

@@ -1,22 +1,34 @@
-unless PluginRoutes.static_system_info['user_model'].present?
+if PluginRoutes.static_system_info['user_model'].blank?
   module CamaleonCms
     class User < CamaleonRecord
       include CamaleonCms::UserMethods
 
-      self.table_name = PluginRoutes.static_system_info['cama_users_db_table'] || "#{PluginRoutes.static_system_info['db_prefix']}users"
+      self.table_name = PluginRoutes.static_system_info['cama_users_db_table'] ||
+                        "#{PluginRoutes.static_system_info['db_prefix']}users"
 
       default_scope { order(role: :asc) }
 
+      # No `dependent:` — a deleted user's widgets keep rendering; only the owner is gone.
+      has_many :widgets, class_name: 'CamaleonCms::Widget::Main', # rubocop:disable Rails/HasManyOrHasOneDependent
+                         inverse_of: :owner
+
       validates :username, presence: true
-      validates :email, presence: true, format: { with: /\A[\w+\-.]+@[a-z\d\-.]+\.[a-z]+\z/i } # , :unless => Proc.new { |a| a.auth_social.present? }
+      # The following might be continued wit: , :unless => Proc.new { |a| a.auth_social.present? }
+      validates :email, presence: true, format: { with: /\A[\w+\-.]+@[a-z\d\-.]+\.[a-z]+\z/i }
       has_secure_password
+      # Security (audit 2026-08-11 M15): has_secure_password only validates presence (on create) and the
+      # 72-byte bcrypt maximum, so a trivially short password was accepted. Enforce a minimum length
+      # whenever a password is actually set (create, reset, change). allow_blank leaves an update that
+      # submits no password untouched (a blank field is not a change), and lets has_secure_password's own
+      # presence check own the empty-on-create case.
+      validates :password, length: { minimum: 8 }, allow_blank: true
 
       def self.find_by_email(email)
-        where(['lower(email) = ?', email.to_s.downcase]).take
+        find_by(['lower(email) = ?', email.to_s.downcase])
       end
 
       def self.find_by_username(username)
-        where(['lower(username) = ?', username.to_s.downcase]).take
+        find_by(['lower(username) = ?', username.to_s.downcase])
       end
     end
   end

data/app/models/camaleon_cms/user_role.rb

@@ -1,12 +1,15 @@
 module CamaleonCms
   class UserRole < CamaleonCms::TermTaxonomy
-    normalize_attrs(:name, :description)
+    normalize_attrs(:description)
 
-    after_destroy :set_users_as_cilent
+    def self.sti_name
+      'user_roles'
+    end
 
-    default_scope { where(taxonomy: :user_roles) }
+    after_destroy :set_users_as_cilent
 
-    belongs_to :site, class_name: 'CamaleonCms::Site', foreign_key: :parent_id, required: false
+    belongs_to :site, class_name: 'CamaleonCms::Site', foreign_key: :parent_id, optional: true,
+                      inverse_of: :user_roles_rel
 
     def roles_post_type
       get_meta('_post_type')
@@ -20,6 +23,23 @@ module CamaleonCms
       term_group.nil?
     end
 
+    # Users in a role slugged `admin` are administrators: `User#admin?` tests exactly this, and
+    # `Ability#initialize` answers `can :manage, :all` for them and returns before this role's
+    # `_post_type_`/`_manager_` metas are read. Those metas therefore describe nothing — every
+    # permission is held whatever they say.
+    def grants_all_permissions?
+      slug == 'admin'
+    end
+
+    # Whether the permission checkboxes mean anything. False for the default admin role, which is not
+    # editable at all, and false for any other role slugged `admin`, whose permissions cannot be
+    # withheld from its users. The editor renders them locked and the controller declines to write
+    # them, so the two cannot disagree — and a locked checkbox, which the browser does not submit,
+    # can never silently clear what is stored.
+    def permissions_editable?
+      editable? && !grants_all_permissions?
+    end
+
     ROLES = {
       post_type: [
         {
@@ -81,6 +101,14 @@ module CamaleonCms
           label: I18n.t('camaleon_cms.admin.users.roles_values.html_manage_tags').to_s,
           color: 'warning',
           description: I18n.t('camaleon_cms.admin.users.tool_tip.manage_tags').to_s
+        },
+        {
+          key: 'post_content_unfiltered_html',
+          label: I18n.t('camaleon_cms.admin.users.roles_values.post_content_unfiltered_html',
+                        default: 'Allow unfiltered HTML in post content').to_s,
+          color: 'danger',
+          description: I18n.t('camaleon_cms.admin.users.tool_tip.post_content_unfiltered_html',
+                              default: 'Permit users with this role to save raw/unfiltered HTML in post content').to_s
         }
       ],
       manager: [
@@ -133,12 +161,59 @@ module CamaleonCms
         {
           key: 'select_eval',
           label: I18n.t('camaleon_cms.admin.custom_field.select_eval', default: 'Select Eval').to_s,
-          description: I18n.t('camaleon_cms.admin.users.tool_tip.select_eval', default: 'Allow toggling and using select_eval custom fields in the admin UI.').to_s
+          description: I18n.t(
+            'camaleon_cms.admin.users.tool_tip.select_eval',
+            default: 'Allow toggling and using select_eval custom fields in the admin UI.'
+          ).to_s
         },
         {
           key: 'theme_settings',
           label: I18n.t('camaleon_cms.admin.settings.theme_setting', default: 'Theme Settings').to_s,
           description: I18n.t('camaleon_cms.admin.users.tool_tip.themes').to_s
+        },
+        {
+          key: 'contact_form_unfiltered_html',
+          label: I18n.t('camaleon_cms.admin.users.roles_values.contact_form_unfiltered_html',
+                        default: 'Allow unfiltered HTML in contact forms').to_s,
+          color: 'danger',
+          description: I18n.t(
+            'camaleon_cms.admin.users.tool_tip.contact_form_unfiltered_html',
+            default: 'Permit users with this role to save raw/unfiltered HTML anywhere in a contact form: the ' \
+                     'markup wrapping a form, field labels, descriptions, templates, CSS classes, default ' \
+                     'values, custom attributes, option labels and response messages. Without it, a save ' \
+                     'carrying such content is refused rather than cleaned up. Distinct from the per-post-type ' \
+                     '"Allow unfiltered HTML in post content" permission.'
+          ).to_s
+        },
+        {
+          key: 'media_unfiltered_upload',
+          label: I18n.t('camaleon_cms.admin.users.roles_values.media_unfiltered_upload',
+                        default: 'Allow unscanned media uploads').to_s,
+          color: 'danger',
+          description: I18n.t(
+            'camaleon_cms.admin.users.tool_tip.media_unfiltered_upload',
+            default: 'Permit users with this role to upload files without the malicious-content scan. Without ' \
+                     'it, every upload is scanned whatever its source, and a file carrying scripts, event ' \
+                     'handlers, blocked elements or blocked URI schemes is refused rather than cleaned up. ' \
+                     'Uploaded files are served from the site origin, so this grants the ability to publish ' \
+                     'active content there. Site-wide, unlike the per-post-type "Allow unfiltered HTML in post ' \
+                     'content" permission.'
+          ).to_s
+        },
+        {
+          key: 'content_shortcodes',
+          label: I18n.t('camaleon_cms.admin.users.roles_values.content_shortcodes',
+                        default: 'Allow shortcodes in content').to_s,
+          color: 'danger',
+          description: I18n.t(
+            'camaleon_cms.admin.users.tool_tip.content_shortcodes',
+            default: 'Permit users with this role to publish shortcodes in content that the CMS expands at ' \
+                     'render: post content, custom-field values, taxonomy content and widget descriptions. A ' \
+                     'shortcode makes theme/plugin code emit arbitrary HTML/JS on the page, which the ' \
+                     'content scan cannot judge. Without it, a save carrying a registered shortcode is refused ' \
+                     'rather than cleaned up. Site-wide, and an end-run around the per-post-type "Allow ' \
+                     'unfiltered HTML in post content" permission.'
+          ).to_s
         }
       ]
     }.freeze
@@ -146,7 +221,7 @@ module CamaleonCms
     private
 
     def set_users_as_cilent
-      site.users.where(role: slug).update_all(role: 'client')
+      site.users.where(role: slug).update_all(role: 'client') # rubocop:disable Rails/SkipsModelValidations
     end
   end
 end

data/app/models/camaleon_cms/widget/assigned.rb

@@ -1,7 +1,12 @@
 module CamaleonCms
   module Widget
     class Assigned < CamaleonCms::PostDefault
-      default_scope -> { where(post_class: name).order(:taxonomy_id) }
+      default_scope -> { order(:taxonomy_id) }
+
+      def self.type_condition(table = arel_table)
+        super.or(table[inheritance_column].eq(name))
+      end
+
       # post_parent: sidebar_id
       # visibility: widget_id
       # comment_count: item_order
@@ -12,11 +17,11 @@ module CamaleonCms
 
       # attr_accessible :widget_id, :sidebar_id, :item_order
 
-      has_many :metas, lambda {
-                         where(object_class: 'Widget::Assigned')
-                       }, class_name: 'CamaleonCms::Meta', foreign_key: :objectid, dependent: :destroy
-      belongs_to :sidebar, class_name: 'CamaleonCms::Widget::Sidebar', foreign_key: :post_parent
-      belongs_to :widget, class_name: 'CamaleonCms::Widget::Main', foreign_key: :visibility
+      belongs_to :sidebar, class_name: 'CamaleonCms::Widget::Sidebar', foreign_key: :post_parent, inverse_of: :assigned,
+                           optional: true
+      belongs_to :widget, class_name: 'CamaleonCms::Widget::Main', foreign_key: :visibility, inverse_of: :assigned,
+                          optional: true
+
       after_initialize :fix_slug2
       before_create :set_order
 

data/app/models/camaleon_cms/widget/main.rb

@@ -1,9 +1,10 @@
 module CamaleonCms
   module Widget
     class Main < CamaleonCms::TermTaxonomy
-      normalize_attrs(:name)
+      def self.sti_name
+        'widget'
+      end
 
-      default_scope { where(taxonomy: :widget) }
       # attr_accessible :excerpt, :renderer
       # name: "title"
       # description: "content for this"
@@ -12,14 +13,17 @@ module CamaleonCms
       # excerpt: string for message
       # renderer: string (path to the template for render this widget)
 
-      has_many :metas, lambda {
-                         where(object_class: 'Widget::Main')
-                       }, class_name: 'CamaleonCms::Meta', foreign_key: :objectid, dependent: :destroy
-      belongs_to :owner, class_name: CamaManager.get_user_class_name, foreign_key: :user_id
-      belongs_to :site, class_name: 'CamaleonCms::Site', foreign_key: :parent_id
+      # inverse_of: false — custom `user_model` classes get only UserMethods, which
+      # defines no `widgets` collection the inverse could point at.
+      belongs_to :owner, class_name: CamaManager.get_user_class_name.to_s, foreign_key: :user_id, inverse_of: false,
+                         optional: true
+      belongs_to :site, class_name: 'CamaleonCms::Site', foreign_key: :parent_id, inverse_of: :widgets, optional: true
+
+      has_many :assigned, class_name: 'CamaleonCms::Widget::Assigned', foreign_key: :visibility, dependent: :destroy,
+                          inverse_of: :widget
 
-      has_many :assigned, class_name: 'CamaleonCms::Widget::Assigned', foreign_key: :visibility, dependent: :destroy
       before_save :check_excerpt
+
       def is_simple?
         status == 'simple'
       end

data/app/models/camaleon_cms/widget/sidebar.rb

@@ -1,15 +1,10 @@
 module CamaleonCms
   module Widget
     class Sidebar < CamaleonCms::TermTaxonomy
-      normalize_attrs(:name, :description)
+      normalize_attrs(:description)
 
-      default_scope { where(taxonomy: :sidebar) }
-
-      has_many :metas, lambda {
-                         where(object_class: 'Widget::Sidebar')
-                       }, class_name: 'CamaleonCms::Meta', foreign_key: :objectid, dependent: :destroy
-      has_many :assigned, foreign_key: :post_parent, dependent: :destroy
-      belongs_to :site, class_name: 'CamaleonCms::Site', foreign_key: :parent_id
+      has_many :assigned, foreign_key: :post_parent, dependent: :destroy, inverse_of: :sidebar
+      belongs_to :site, class_name: 'CamaleonCms::Site', foreign_key: :parent_id, inverse_of: :sidebars, optional: true
 
       # scopes
       scope :default_sidebar, -> { where(slug: 'default-sidebar') }

data/app/models/camaleon_record.rb

@@ -1,16 +1,60 @@
 # frozen_string_literal: true
 
-class CamaleonRecord < ActiveRecord::Base
-  TRANSLATION_TAG_HIDE_MAP = { '<!--' => '!--', '-->' => '--!' }.freeze
+class CamaleonRecord < ActiveRecord::Base # rubocop:disable Rails/ApplicationRecord
+  # Sentinels used to shield HTML comment delimiters (the translation locale markers such as `<!--:en-->`)
+  # from ActionController's sanitize(), which strips HTML comments. Private-Use-Area code points are used so
+  # that plain text typed by a user can never be rewritten into a comment delimiter after sanitization: the
+  # previous `!--`/`--!` tokens collided with ordinary text (e.g. "Read more !--"), so the restore pass would
+  # inject stray `<!--`/`-->` into the output. The hide map also strips any raw sentinel characters supplied
+  # in the input, so they cannot be smuggled through to become delimiters on restore.
+  TRANSLATION_TAG_HIDE_SENTINELS = { open: "\u{E000}", close: "\u{E001}" }.freeze
+  TRANSLATION_TAG_HIDE_MAP = {
+    '<!--' => TRANSLATION_TAG_HIDE_SENTINELS[:open],
+    '-->' => TRANSLATION_TAG_HIDE_SENTINELS[:close],
+    TRANSLATION_TAG_HIDE_SENTINELS[:open] => '',
+    TRANSLATION_TAG_HIDE_SENTINELS[:close] => ''
+  }.freeze
   TRANSLATION_TAG_HIDE_REGEX = Regexp.new(TRANSLATION_TAG_HIDE_MAP.keys.map { |x| Regexp.escape(x) }.join('|')).freeze
-  TRANSLATION_TAG_RESTORE_MAP = { '--!' => '-->', '!--' => '<!--' }.freeze
+  TRANSLATION_TAG_RESTORE_MAP = {
+    TRANSLATION_TAG_HIDE_SENTINELS[:open] => '<!--',
+    TRANSLATION_TAG_HIDE_SENTINELS[:close] => '-->'
+  }.freeze
   TRANSLATION_TAG_RESTORE_REGEX =
     Regexp.new(TRANSLATION_TAG_RESTORE_MAP.keys.map { |x| Regexp.escape(x) }.join('|')).freeze
 
-  include ActiveRecordExtras::Relation
-
   self.abstract_class = true
 
+  # Sanitize a value with ActionController's sanitize() while preserving translation locale markers
+  # (<!--:xx-->). Shared by Post#sanitize_content and the NormalizeAttrs concern so the transform lives in
+  # one place. Returns nil unchanged. `tags:`/`attributes:` default to nil, i.e. the sanitizer's own
+  # allowlist, so NormalizeAttrs and other callers are unaffected; Post#content passes a widened list.
+  def self.cama_sanitize_translatable(value, tags: nil, attributes: nil)
+    return value if value.nil?
+
+    options = {}
+    options[:tags] = tags if tags
+    options[:attributes] = attributes if attributes
+    ActionController::Base.helpers.sanitize(
+      value.to_s.gsub(TRANSLATION_TAG_HIDE_REGEX, TRANSLATION_TAG_HIDE_MAP), **options
+    ).gsub(TRANSLATION_TAG_RESTORE_REGEX, TRANSLATION_TAG_RESTORE_MAP)
+  end
+
+  def self.polymorphic_name
+    return super unless name.to_s.start_with?('CamaleonCms::')
+
+    name.demodulize
+  end
+
+  def self.polymorphic_class_for(name)
+    super
+  rescue NameError
+    legacy_class = legacy_camaleon_polymorphic_class(name)
+    return legacy_class if legacy_class
+    return nil if legacy_polymorphic_marker?(name)
+
+    raise
+  end
+
   # save cache value for this key
   def cama_set_cache(key, val)
     @cama_cache_vars ||= {}
@@ -20,6 +64,8 @@ class CamaleonRecord < ActiveRecord::Base
 
   # remove cache value for this key
   def cama_remove_cache(key)
+    return unless @cama_cache_vars
+
     @cama_cache_vars.delete(cama_build_cache_key(key))
   end
 
@@ -83,4 +129,42 @@ class CamaleonRecord < ActiveRecord::Base
 
     @current_site = CurrentRequest.site
   end
+
+  def self.legacy_camaleon_polymorphic_class(name)
+    class_name = name.to_s
+    return if class_name.blank?
+
+    candidates = []
+
+    unless class_name.include?('::')
+      candidates << "CamaleonCms::#{class_name}"
+
+      if class_name.include?('_')
+        base_name = class_name.split('_').first
+        candidates << "CamaleonCms::#{base_name}" if base_name.present?
+      end
+
+      candidates << CamaManager.get_user_class_name.to_s if class_name == 'User'
+    end
+
+    candidates << "CamaleonCms::#{class_name}" if class_name.include?('::') && !class_name.start_with?('CamaleonCms::')
+
+    candidates.uniq.each do |candidate|
+      next unless valid_constant_name?(candidate)
+
+      klass = candidate.safe_constantize
+      return klass if klass
+    end
+
+    nil
+  end
+  private_class_method def self.legacy_polymorphic_marker?(name)
+    name.to_s.start_with?('_')
+  end
+
+  private_class_method def self.valid_constant_name?(name)
+    name.to_s.match?(/\A[A-Z]\w*(::[A-Z]\w*)*\z/)
+  end
+
+  private_class_method :legacy_camaleon_polymorphic_class
 end