camaleon_cms 2.9.2 → 2.9.4

data/app/models/concerns/camaleon_cms/categories_tags_for_posts.rb

@@ -24,18 +24,22 @@ module CamaleonCms
     # update category assignations for this post
     # remove assignations that no longer exist
     # add new assignations
-    # cats: (Array) array of category ids assigned for this post, sample: [1,2,3]
+    # cats: (Array) array of category ids assigned for this post, sample: [1, 2, 3]
     def update_categories(cats = [])
       rescue_extra_data
-      cats = cats.to_i
-      old_categories = categories.pluck("#{CamaleonCms::TermTaxonomy.table_name}.id")
+      # uniq: duplicate ids (e.g. a crafted `categories[]=5&categories[]=5`) would otherwise create
+      # duplicate term_relationships rows, which duplicate the post in category/tag listings and
+      # inflate will_paginate's total_entries (there is no unique index on the join table)
+      cats = cats.to_i.uniq
+      # reuse the snapshot rescue_extra_data just took instead of plucking the same set again
+      old_categories = manage_categories? ? @cats_before : categories.pluck("#{CamaleonCms::TermTaxonomy.table_name}.id")
       delete_categories = old_categories - cats
       news_categories = cats - old_categories
       term_relationships.where('term_taxonomy_id in (?)', delete_categories).destroy_all if delete_categories.present?
       news_categories.each do |key|
         term_relationships.create(term_taxonomy_id: key)
       end
-      update_counters('categories')
+      update_counts('categories')
     end
 
     # update tags assignations for this post
@@ -53,7 +57,7 @@ module CamaleonCms
         post_tag = post_type.post_tags.where({ name: f }).first_or_create(slug: f.parameterize)
         term_relationships.where({ term_taxonomy_id: post_tag.id }).first_or_create
       end
-      update_counters('tags')
+      update_counts('tags')
     end
 
     # Assign this post for category with id: category_id
@@ -64,72 +68,62 @@ module CamaleonCms
       categories_id.each do |key|
         term_relationships.where(term_taxonomy_id: key).first_or_create!
       end
-      update_counters('categories')
+      update_counts('categories')
     end
 
-    # Assign this post for category with id: category_id
-    # categories_id: (Array) array of category ids assigned for this post, sample: [1,2,3]
+    # Unassign this post from categories with ids: categories_id
+    # categories_id: (Array) array of category ids to unassign from this post, sample: [1,2,3]
     def unassign_category(categories_id)
       categories_id = [categories_id] if categories_id.is_a?(Integer)
       rescue_extra_data
       term_relationships.where(term_taxonomy_id: categories_id).destroy_all
-      update_counters('categories')
-    end
-
-    # Assign new tags to this post
-    # tags_title: (String) tags name separated by commas, sample: "Tag1,Tag two,tag new"
-    def assign_tags(tag_titles)
-      update_counters_before
-      tags = tag_titles.split(',').strip
-      tags.each do |t|
-        post_tag = post_type.post_tags.where(name: t).first_or_create!
-        term_relationships.where({ term_taxonomy_id: post_tag.id }).first_or_create!
-      end
-      update_counters('tags')
+      update_counts('categories')
     end
 
-    # Unassign tags from this post
-    # tags_title: (String) tags name separated by commas, sample: "Tag1,Tag two,tag new"
-    def unassign_tags(tag_titles)
-      update_counters_before
-      tags = tag_titles.split(',').strip
-      term_relationships.where({ term_taxonomy_id: post_type.post_tags.where(name: tags).pluck(:id) }).destroy_all
-      update_counters('tags')
-    end
-
-    # update quantity of posts assigned for tags and categories assigned to this post
+    # Update the quantity of posts assigned for tags and categories assigned to this post
     def update_extra_data
       rescue_extra_data
-      update_counters
+      update_counts
     end
 
     private
 
-    @cats_before = []
-    @tags_before = []
     # save as a cache previous categories and tags assigned for this post
     def rescue_extra_data
+      # Every writer mutates term_relationships directly, which does NOT invalidate an already-loaded
+      # categories/post_tags/term_relationships proxy -- and the_post preloads categories/post_tags via
+      # with_eager, so the proxy is routinely loaded before a write. Reset here, the single point every
+      # writer (and update_extra_data) calls first, so the snapshots below and every later
+      # pluck/empty?/count read the database rather than a stale in-memory target.
+      reset_term_proxies
       @cats_before = categories.pluck(:id) if manage_categories?
       @tags_before = post_tags.pluck(:id) if manage_tags?
     end
 
-    # update quantity of posts assigned for tags and categories assigned to this post
+    # drop any loaded category/tag/term_relationship cache so a write starts from DB truth
+    def reset_term_proxies
+      categories.reset
+      post_tags.reset
+      term_relationships.reset
+    end
+
+    # Update the quantity of posts assigned for tags and categories assigned to this post
     # if kind is empty, then this will update both: cats and tags
     # kind: (string) tags | categories
-    def update_counters(kind = '')
+    def update_counts(kind = '')
       if ['', 'categories'].include?(kind) && manage_categories?
-        post_type.full_categories.where(id: (@cats_before + categories.pluck(:id)).uniq).each do |c|
-          c.update_column('count', c.posts.published.size)
+        post_type.full_categories.where(id: (@cats_before + categories.pluck(:id)).uniq).find_each do |c|
+          c.update_column(:count, c.posts.published.size) # rubocop:disable Rails/SkipsModelValidations
         end
       end
       return unless ['', 'tags'].include?(kind) && manage_tags?
 
-      post_type.post_tags.where(id: (@tags_before + post_tags.pluck(:id)).uniq).each do |tag|
-        tag.update_column('count', tag.posts.published.size)
+      post_type.post_tags.where(id: (@tags_before + post_tags.pluck(:id)).uniq).find_each do |tag|
+        tag.update_column(:count, tag.posts.published.size) # rubocop:disable Rails/SkipsModelValidations
       end
     end
 
-    # save extra data such as: categories and tags assigned to this post
+    # Save extra data such as categories and tags assigned to this post
     def save_extra_data
       update_categories(data_categories) if manage_categories? && !data_categories.nil?
       update_tags(data_tags) if manage_tags? && !data_tags.nil?
@@ -139,7 +133,7 @@ module CamaleonCms
     def check_default_category
       return unless manage_categories?
 
-      assign_category([post_type.default_category.id]) unless categories.present?
+      assign_category([post_type.default_category.id]) if categories.blank?
     end
   end
 end

data/app/models/concerns/camaleon_cms/common_relationships.rb

@@ -3,22 +3,35 @@
 module CamaleonCms
   module CommonRelationships
     extend ActiveSupport::Concern
+    # rubocop:disable Rails/InverseOf
 
     included do
-      class_name = name.demodulize
-      has_many :metas, -> { where(object_class: class_name) },
+      # Scopes use the demodulized class name (the 2.9.2 contract every install's rows were
+      # written under): 'Post', 'Main' for Widget::Main, and 'User' for a host Admin::User.
+      # to_s tolerates anonymous subclasses (STI specs build them), whose name is nil.
+      object_class_name = name.to_s.demodulize
+      has_many :metas, -> { where(object_class: object_class_name) },
                class_name: 'CamaleonCms::Meta', foreign_key: :objectid, dependent: :destroy
 
-      has_many :custom_field_values, -> { where(object_class: class_name) },
+      has_many :custom_field_values, -> { where(object_class: object_class_name) },
                class_name: 'CamaleonCms::CustomFieldsRelationship', foreign_key: :objectid, dependent: :delete_all
 
-      has_many :custom_fields, -> { where(object_class: class_name) },
+      # No dependent: on the definition associations (2.9.2 behavior). Teardown is owned by
+      # CustomFieldsRead#_destroy_custom_field_groups, which runs first and destroys groups WITH
+      # callbacks; a dependent here is inert at best, and on hook-less includers (PostComment) a
+      # delete_all removed group rows while orphaning their fields and option metas. A :destroy
+      # cascade is no alternative: custom_fields matches group rows too (same table, same scope)
+      # but its CustomField typing would skip group teardown.
+      # rubocop:disable Rails/HasManyOrHasOneDependent
+      has_many :custom_fields, -> { where(object_class: object_class_name) },
                class_name: 'CamaleonCms::CustomField', foreign_key: :objectid
 
       # valid only for simple groups and not for complex like: posts, post, ... where the group is for individual or
       # children groups
-      has_many :custom_field_groups, -> { where(object_class: class_name) },
+      has_many :custom_field_groups, -> { where(object_class: object_class_name) },
                class_name: 'CamaleonCms::CustomFieldGroup', foreign_key: :objectid
+      # rubocop:enable Rails/HasManyOrHasOneDependent
     end
+    # rubocop:enable Rails/InverseOf
   end
 end

data/app/models/concerns/camaleon_cms/content_shortcode_gate.rb

@@ -0,0 +1,73 @@
+# frozen_string_literal: true
+
+module CamaleonCms
+  # Save-time authorization gate for authored content that `do_shortcode` later expands (post
+  # content, custom-field values, taxonomy/widget descriptions). A registered shortcode makes
+  # theme/plugin code emit arbitrary HTML/JS at render, which the content scan cannot judge, so
+  # authorship is GATED behind the default-off `content_shortcodes` manager permission rather than
+  # filtered. The content is never escaped, stripped or rewritten -- a save carrying a shortcode is
+  # refused for an untrusted author, and stored verbatim for a trusted one.
+  #
+  # Conforms to `security-capability-gating` (fail-closed) and the content-shortcode-gating
+  # capability. A model gates an attribute with `gate_content_shortcodes :attr`; a newly added
+  # surface that `do_shortcode` expands MUST adopt this gate (asserted by the coverage spec).
+  module ContentShortcodeGate
+    extend ActiveSupport::Concern
+
+    class_methods do
+      # Gate the named attribute(s) on create/update. Each attribute is scanned in its RAW stored
+      # form -- which contains every locale of a translatable value at once, so a shortcode in any
+      # locale is caught -- and, if a registered shortcode is present and the actor is a
+      # non-administrator lacking `content_shortcodes`, the save is refused with a base error.
+      def gate_content_shortcodes(*attributes, on: %i[create update])
+        gated = attributes.map(&:to_sym)
+        validate(on: on) { cama_reject_unauthorized_shortcodes(gated) }
+      end
+    end
+
+    private
+
+    def cama_reject_unauthorized_shortcodes(attributes)
+      return unless attributes.any? { |attr| cama_shortcode_attr_gated?(attr) }
+      return if cama_trusted_for_shortcodes?
+
+      errors.add(:base, cama_shortcode_rejection_message)
+    end
+
+    # An attribute needs the gate only when it (a) changed on this save (or the record is new) -- so
+    # a title-only edit never re-gates pre-existing shortcode content, mirroring
+    # Post#reject_untrusted_dangerous_content -- and (b) actually contains a registered shortcode.
+    def cama_shortcode_attr_gated?(attr)
+      return false unless new_record? || cama_gate_attribute_changed?(attr)
+
+      value = self[attr]
+      value.present? && CamaleonCms::ShortcodeRegistry.content_has_shortcode?(value.to_s)
+    end
+
+    def cama_gate_attribute_changed?(attr)
+      respond_to?("#{attr}_changed?") ? public_send("#{attr}_changed?") : attribute_changed?(attr.to_s)
+    end
+
+    # Fail closed (the gate applies) without a request context or on any evaluation error, per
+    # security-capability-gating: a background job, rake task or console is untrusted. Administrators
+    # always pass; a non-administrator passes only while holding the `content_shortcodes` manager
+    # permission.
+    def cama_trusted_for_shortcodes?
+      user = CurrentRequest.user
+      site = CurrentRequest.site
+      return false if user.blank? || site.blank?
+      return true if user.admin?
+
+      CamaleonCms::Ability.new(user, site).can?(:manage, :content_shortcodes)
+    rescue StandardError
+      false
+    end
+
+    # Only en.yml carries this key while the process locale follows the current admin/site language
+    # -- fall back to English rather than emit "translation missing".
+    def cama_shortcode_rejection_message
+      key = 'camaleon_cms.admin.shortcodes.message.rejected'
+      I18n.t(key, default: I18n.t(key, locale: :en))
+    end
+  end
+end

data/app/models/concerns/camaleon_cms/custom_fields_read.rb

@@ -35,21 +35,29 @@ module CamaleonCms
       when 'Post'
         if term_relationships.empty? && args[:cat_ids].nil?
           CamaleonCms::CustomFieldGroup.where(
-            '(objectid = ? AND object_class = ?) OR (objectid = ? AND object_class = ?)', id || -1, class_name, post_type.id, "PostType_#{class_name}"
+            '(objectid = ? AND object_class = ?) OR (objectid = ? AND object_class = ?)',
+            id || -1, class_name, post_type.id, "PostType_#{class_name}"
           )
         else
           cat_ids = categories.map(&:id)
           cat_ids += args[:cat_ids] unless args[:cat_ids].nil?
           cat_ids += CamaleonCms::Category.find(cat_ids).map { |category| _category_parents_ids(category) }.flatten.uniq
-          CamaleonCms::CustomFieldGroup.where("(objectid = ? AND object_class = ?) OR
-                                               (objectid = ? AND object_class = ?) OR
-                                               (objectid IN (?) AND object_class = ?)",
-                                              id || -1, class_name,
-                                              post_type.id, "PostType_#{class_name}",
-                                              cat_ids, "Category_#{class_name}")
+          CamaleonCms::CustomFieldGroup.where(
+            "(objectid = ? AND object_class = ?) OR
+             (objectid = ? AND object_class = ?) OR
+             (objectid IN (?) AND object_class = ?)",
+            id || -1, class_name, post_type.id, "PostType_#{class_name}", cat_ids, "Category_#{class_name}"
+          )
         end
       when 'NavMenuItem'
         main_menu.custom_field_groups
+      when 'Site'
+        # Site overrides `custom_field_groups` to mean "every group this site owns" (foreign key
+        # parent_id), unlike the object_class + objectid association every other model receives from
+        # CommonRelationships. Scoping by placement here keeps groups meant for post types, themes or
+        # menus off the site settings form, where their required fields blocked the submit and their
+        # values were discarded on save anyway.
+        custom_field_groups.where(object_class: 'Site', objectid: id)
       when 'PostType'
         case args[:kind]
         when 'all'
@@ -69,7 +77,9 @@ module CamaleonCms
     # return collections CustomFieldGroup
     # site: site object
     def get_user_field_groups(site)
-      site.custom_field_groups.where(object_class: self.class.to_s.parseCamaClass)
+      # Demodulized to match the association scope and the placement the settings form stores
+      # ('User' for a host Admin::User); parseCamaClass still strips a Draper Decorator suffix.
+      site.custom_field_groups.where(object_class: self.class.to_s.parseCamaClass.demodulize)
     end
 
     # get custom field value
@@ -82,7 +92,7 @@ module CamaleonCms
       rescue StandardError
         _default
       end
-      v.present? ? v : _default
+      v.presence || _default
     end
     alias get_field get_field_value
     alias get_field! get_field_value
@@ -117,12 +127,12 @@ module CamaleonCms
     #   puts res[0]['my_slug1'].first ==> "val 1"
     def get_fields_grouped(field_keys)
       res = []
-      custom_field_values.where(custom_field_slug: field_keys).order(group_number: :asc).group_by(&:group_number).each_value do |group_fields|
-        group = {}
-        field_keys.each do |field_key|
-          _tmp = []
-          group_fields.each { |field| _tmp << field.value if field_key == field.custom_field_slug }
-          group[field_key] = _tmp if _tmp.present?
+      custom_field_values.where(custom_field_slug: field_keys)
+                         .order(group_number: :asc).group_by(&:group_number).each_value do |group_fields|
+        group = field_keys.each_with_object({}) do |field_key, hsh|
+          _tmp = group_fields
+                 .each_with_object([]) { |field, ary| ary << field.value if field_key == field.custom_field_slug }
+          hsh[field_key] = _tmp if _tmp.present?
         end
         res << group
       end
@@ -131,7 +141,8 @@ module CamaleonCms
 
     # return all values
     # {key1: "single value", key2: [multiple, values], key3: value4} if include_options = false
-    # {key1: {values: "single value", options: {a:1, b: 4}}, key2: {values: [multiple, values], options: {a=1, b=2} }} if include_options = true
+    # {key1: {values: "single value", options: {a:1, b: 4}}, key2: {values: [multiple, values], options: {a=1, b=2} }}
+    # if include_options = true
     def get_field_values_hash(include_options = false)
       fields = {}
       custom_field_values.to_a.uniq.each do |field_value|
@@ -159,9 +170,10 @@ module CamaleonCms
         custom_field = field_value.custom_field
         # if custom_field.options[:show_frontend].to_s.to_bool
         values = custom_field.values.where(objectid: id).pluck(:value)
-        fields[field_value.custom_field_slug] =
-          custom_field.attributes.merge(options: custom_field.cama_options,
-                                        values: custom_field.cama_options[:multiple].to_s.to_bool ? values : values.first)
+        fields[field_value.custom_field_slug] = custom_field.attributes.merge(
+          options: custom_field.cama_options,
+          values: custom_field.cama_options[:multiple].to_s.to_bool ? values : values.first
+        )
         # end
       end
       fields.to_sym
@@ -179,10 +191,11 @@ module CamaleonCms
     #     post_type.add_custom_field_group(values, kind = "Category")
     # Note 2: If you need add fields for only the Post_type, you have to use options or metas
     # return: CustomFieldGroup object
-    # kind: argument only for PostType model: (Post | Category | PostTag), default => Post. If kind = "" this will add group for all post_types
+    # kind: argument only for PostType model: (Post | Category | PostTag), default => Post.
+    # If kind = "" this will add group for all post_types
     def add_custom_field_group(values, kind = 'Post')
       values = values.with_indifferent_access
-      group = get_field_groups(kind).find_by(slug: values[:slug])
+      group = get_field_groups(kind).find_by_slug(values[:slug]) # rubocop:disable Rails/DynamicFindBy
       unless group
         site = _cama_get_field_site
         values[:parent_id] = site.id if site.present?
@@ -202,7 +215,7 @@ module CamaleonCms
     # more details in add_manual_field(item, options) from custom field groups
     # kind: argument only for PostType model: (Post | Category | PostTag), default => Post
     def add_custom_field_to_default_group(item, options, kind = 'Post')
-      g = get_field_groups(kind).find_by(slug: '_default')
+      g = get_field_groups(kind).find_by_slug('_default') # rubocop:disable Rails/DynamicFindBy
       g ||= add_custom_field_group({ name: 'Default Field Group', slug: '_default' }, kind)
       g.add_manual_field(item, options)
     end
@@ -210,13 +223,8 @@ module CamaleonCms
 
     # return field object for current model
     def get_field_object(slug)
-      CamaleonCms::CustomField.where(
-        slug: slug,
-        parent_id: get_field_groups.pluck(:id)
-      ).first || CamaleonCms::CustomField.where(
-        slug: slug,
-        parent_id: get_field_groups({ include_parent: true })
-      ).first
+      CamaleonCms::CustomField.where(slug: slug, parent_id: get_field_groups.pluck(:id)).first ||
+        CamaleonCms::CustomField.where(slug: slug, parent_id: get_field_groups({ include_parent: true })).first
     end
 
     # save all fields sent from browser (reservated for browser request)
@@ -226,28 +234,57 @@ module CamaleonCms
     #   "1"=>{ "untitled-text-box"=>{"id"=>"262", "values"=>{"0"=>"33333"}}}
     # }
     def set_field_values(datas = {})
-      return unless datas.present?
+      return if datas.blank?
 
       ActiveRecord::Base.transaction do
+        # A value identical to one already stored is not newly authored, so it must not be re-gated on
+        # an unrelated edit (audit M8): the admin form round-trips every value and this method
+        # delete/recreates them all, so without this skip a single pre-gate dangerous value would fail
+        # the whole save and brick every later edit -- the trap Post#reject_untrusted_dangerous_content
+        # avoids via content_changed?. Snapshot the stored pairs before clearing; skip the gate for any
+        # recreated value that matches one.
+        previously_stored = custom_field_values.pluck(:custom_field_slug, :value).to_set
         custom_field_values.delete_all
         datas.each_value do |fields_data|
           fields_data.each do |field_key, values|
-            next unless values[:values].present?
+            next if values[:values].blank?
+
+            # Resolve the field id from the trusted slug, not the client-supplied values[:id]: a
+            # forged custom_field_id points the row at a different field definition, and the
+            # scan-and-reject gate keys off custom_field.options[:field_key] -- so a forged non-gated
+            # id would slip markup past the gate for a gated (editor/uri/field_attrs) slug. Fall back
+            # to values[:id] only when the slug names no field here (trusted/internal callers that
+            # pass slugs outside this object's registered groups; permitted browser payloads never do).
+            field_id = get_field_object(field_key)&.id || fallback_field_id_for(field_key) || values[:id]
+            group_number = [values[:group_number].to_i, 0].max
 
             order_value = -1
-            (values[:values].is_a?(Hash) || values[:values].is_a?(ActionController::Parameters) ? values[:values].values : values[:values]).each do |value|
-              custom_field_values.create!({ custom_field_id: values[:id], custom_field_slug: field_key,
-                                            value: fix_meta_value(value), term_order: order_value += 1, group_number: values[:group_number] || 0 })
+            (
+              if values[:values].is_a?(Hash) || values[:values].is_a?(ActionController::Parameters)
+                values[:values].values
+              else
+                values[:values]
+              end
+            ).each do |value|
+              row = custom_field_values.new(
+                custom_field_id: field_id, custom_field_slug: field_key,
+                value: fix_meta_value(value), term_order: order_value += 1, group_number: group_number
+              )
+              row.unfiltered_value! if previously_stored.include?([field_key.to_s, row.value])
+              row.save!
             end
           end
         end
       end
     end
 
-    # update new value for field with slug _key
+    # Update the value for the field with slug _key
     # Sample: my_posy.update_field_value('sub_title', 'Test Sub Title')
-    def update_field_value(_key, value = nil, group_number = 0)
-      custom_field_values.find_by(custom_field_slug: _key, group_number: group_number)&.update_column('value', value)
+    def update_field_value(key, value = nil, group_number = 0)
+      # Route through validations so the scan-and-reject gate applies (audit M5): update_column
+      # skipped it, letting a dangerous value an untrusted caller supplies reach the frontend verbatim.
+      custom_field_values.find_by(custom_field_slug: key, group_number: group_number)
+                         &.update(value: value)
     rescue StandardError
       nil
     end
@@ -262,45 +299,65 @@ module CamaleonCms
 
     # Set custom field values for current model (support for multiple group values)
     # key: (string required) slug of the custom field
-    # value: (array | string) array: array of values for multiple values support, string: uniq value for the custom field
+    # value: (array | string) array: array of values for multiple values support,
+    #                         string: uniq value for the custom field
     # args:
     #   field_id: (integer optional) identifier of the custom field
     #   order: order or position of the field value
     #   group_number: number of the group (only for custom field group with is_repeat enabled)
-    #   clear: (boolean, default true) if true, will remove previous values and set these values, if not will append values
+    #   clear: (boolean, default true) if true, will remove previous values and set these values,
+    #                                  if not will append values
     # return false if the was not saved because there is not present the field with slug: key
     # sample: my_post.set_field_value('subtitle', 'Sub Title')
-    # sample: my_post.set_field_value('subtitle', ['Sub Title1', 'Sub Title2']) # set values for a field (for fields that support multiple values)
+    # sample: set values for a field (for fields that support multiple values)
+    # my_post.set_field_value('subtitle', ['Sub Title1', 'Sub Title2'])
     # sample: my_post.set_field_value('subtitle', 'Sub Title', {group_number: 1})
-    # sample: my_post.set_field_value('subtitle', 'Sub Title', {group_number: 1, group_number: 1}) # add field values for fields in group 1
+    # sample: add field values for fields in group 1
+    # my_post.set_field_value('subtitle', 'Sub Title', {group_number: 1, group_number: 1})
     def set_field_value(key, value, args = {})
       args = { order: 0, group_number: 0, field_id: nil, clear: true }.merge!(args)
-      unless args[:field_id].present?
+      if args[:field_id].blank?
         args[:field_id] = begin
           get_field_object(key).id
         rescue StandardError
           nil
         end
       end
-      raise ArgumentError, "There is no custom field configured for #{key}" unless args[:field_id].present?
+      args[:field_id] ||= fallback_field_id_for(key)
 
-      if args[:clear]
-        custom_field_values.where({ custom_field_slug: key,
-                                    group_number: args[:group_number] }).delete_all
-      end
-      v = { custom_field_id: args[:field_id], custom_field_slug: key, value: fix_meta_value(value),
-            term_order: args[:order], group_number: args[:group_number] }
-      if value.is_a?(Array)
-        value.each do |val|
-          custom_field_values.create!(v.merge({ value: fix_meta_value(val) }))
+      raise ArgumentError, "There is no custom field configured for #{key}" if args[:field_id].blank?
+
+      v = {
+        custom_field_id: args[:field_id], custom_field_slug: key, value: fix_meta_value(value),
+        term_order: args[:order], group_number: args[:group_number]
+      }
+      # Atomic (audit M7): clear the previous value and write the new one in one transaction, so a
+      # value the scan-and-reject gate refuses (create! -> RecordInvalid) rolls the delete back and
+      # the previously stored value survives instead of being destroyed.
+      ActiveRecord::Base.transaction do
+        if args[:clear]
+          custom_field_values.where({ custom_field_slug: key, group_number: args[:group_number] }).delete_all
+        end
+        if value.is_a?(Array)
+          value.each { |val| custom_field_values.create!(v.merge({ value: fix_meta_value(val) })) }
+        else
+          custom_field_values.create!(v)
         end
-      else
-        custom_field_values.create!(v)
       end
     end
 
     private
 
+    def fallback_field_id_for(key)
+      return unless self.class.to_s.parseCamaClass == 'Post'
+      return unless respond_to?(:post_type_id) && post_type_id.present?
+
+      group_ids = CamaleonCms::CustomFieldGroup.where(object_class: 'PostType_Post', objectid: post_type_id).pluck(:id)
+      return if group_ids.blank?
+
+      CamaleonCms::CustomField.where(slug: key, parent_id: group_ids).pick(:id)
+    end
+
     def fix_meta_value(value)
       return value.to_json if value.is_a?(ActionController::Parameters)
       return JSON.generate(value) if value.is_a?(Array) || value.is_a?(Hash)

data/app/models/concerns/camaleon_cms/metas.rb

@@ -14,7 +14,25 @@ module CamaleonCms
     # Add meta with value or Update meta with key: key
     # return true or false
     def set_meta(key, value)
-      metas.where(key: key).update_or_create({ value: fix_meta_value(value) })
+      fixed_value = fix_meta_value(value)
+
+      # Check if the parent object has been saved to the database yet
+      if persisted?
+        # Safe to use database-driven lookups and updates
+        meta_record = metas.find_or_create_by(key: key.to_s)
+        meta_record.update(value: fixed_value)
+      else
+        # In-Memory Fallback: Find an existing unsaved item in the array collection,
+        # or build a brand new unsaved record on the association.
+        meta_record = metas.find { |m| m.key == key.to_s }
+
+        if meta_record
+          meta_record.value = fixed_value
+        else
+          metas.build(key: key.to_s, value: fixed_value)
+        end
+      end
+
       cama_set_cache("meta_#{key}", value)
     end
 
@@ -23,7 +41,7 @@ module CamaleonCms
     def get_meta(key, default = nil)
       key_str = key.is_a?(Symbol) ? key.to_s : key
       cama_fetch_cache("meta_#{key_str}") do
-        option = metas.loaded? ? metas.select { |m| m.key == key }.first : metas.where(key: key_str).first
+        option = metas.loaded? ? metas.find { |m| m.key == key_str } : metas.where(key: key_str).first
         res = ''
         if option.present?
           value = begin
@@ -73,12 +91,16 @@ module CamaleonCms
     # return value for attribute
     def get_option(key = nil, default = nil, meta_key = '_default')
       values = cama_options(meta_key)
+      return default if key.nil?
+
       key = key.to_sym
       values.key?(key) && values[key] != '' ? values[key] : default
     end
 
     # delete attribute from configuration
     def delete_option(key, meta_key = '_default')
+      return if key.nil?
+
       values = cama_options(meta_key)
       key = key.to_sym
       values.delete(key) if values.key?(key)
@@ -88,7 +110,7 @@ module CamaleonCms
     # set multiple configurations
     # h: {ket1: "sdsds", ff: "fdfdfdfd"}
     def set_options(h = {}, meta_key = '_default')
-      return unless h.present?
+      return if h.blank?
 
       data = cama_options(meta_key)
       PluginRoutes.fixActionParameter(h).to_sym.each do |key, value|
@@ -116,11 +138,14 @@ module CamaleonCms
       save_metas_options # unless self.changed?
     end
 
-    # save all settings for this post type received in data_options and data_metas attribute (options and metas)
-    # sample: Site.first.post_types.create({name: "owen", slug: "my_post_type", data_options: { has_category: true, default_layout: "my_layout" }})
+    # Save all settings for this post type - received in data_options and data_metas attribute (options and metas)
+    # sample:
+    # Site.first.post_types.create(
+    #   {name: "owen", slug: "my_post_type", data_options: { has_category: true, default_layout: "my_layout" }}
+    # )
     def save_metas_options
       set_multiple_options(data_options)
-      return unless data_metas.present?
+      return if data_metas.blank?
 
       data_metas.each do |key, val|
         set_meta(key, val)

data/app/models/concerns/camaleon_cms/normalize_attrs.rb

@@ -9,17 +9,11 @@ module CamaleonCms
           args.each do |attr|
             next unless new_record? || attribute_changed?(attr)
 
-            self[attr] = ActionController::Base.helpers.sanitize(
-              __send__(attr)&.gsub(CamaleonRecord::TRANSLATION_TAG_HIDE_REGEX, CamaleonRecord::TRANSLATION_TAG_HIDE_MAP)
-            )&.gsub(CamaleonRecord::TRANSLATION_TAG_RESTORE_REGEX, CamaleonRecord::TRANSLATION_TAG_RESTORE_MAP)
+            self[attr] = CamaleonRecord.cama_sanitize_translatable(__send__(attr))
           end
         end
       else
-        normalizes(*args, with: lambda { |field|
-          ActionController::Base.helpers.sanitize(
-            field.gsub(CamaleonRecord::TRANSLATION_TAG_HIDE_REGEX, CamaleonRecord::TRANSLATION_TAG_HIDE_MAP)
-          ).gsub(CamaleonRecord::TRANSLATION_TAG_RESTORE_REGEX, CamaleonRecord::TRANSLATION_TAG_RESTORE_MAP)
-        })
+        normalizes(*args, with: ->(field) { CamaleonRecord.cama_sanitize_translatable(field) })
       end
     end
   end