camaleon_cms 2.9.2 → 2.9.4

data/app/validators/camaleon_cms/post_uniq_validator.rb

@@ -5,7 +5,7 @@ module CamaleonCms
 
       slug_array = record.slug.to_s.translations_array
       ptype = record.post_type
-      return unless ptype.present? # only for posts that belongs to a post type model
+      return if ptype.blank? # only for posts that belongs to a post type model
 
       post_table = CamaleonCms::Post.table_name
 
@@ -27,7 +27,7 @@ module CamaleonCms
                    .where.not(id: record.id)
                    .where.not(status: %i[draft draft_child trash])
       unless posts.empty?
-        record.errors[:base] <<
+        message =
           if slug_array.size > 1
             "#{I18n.t('camaleon_cms.admin.post.message.requires_different_slug')}: #{posts.pluck(:slug).map do |slug|
               record.slug.to_s.translations.map do |lng, r_slug|
@@ -37,14 +37,15 @@ module CamaleonCms
           else
             "#{I18n.t('camaleon_cms.admin.post.message.requires_different_slug')}: #{record.slug} "
           end
+        record.errors.add(:base, message)
       end
 
       # avoid recursive page parent
       return unless record.post_parent.present? && ptype.manage_hierarchy? &&
                     record.parents.cama_pluck(:id).include?(record.id)
 
-      record.errors[:base] << I18n.t('camaleon_cms.admin.post.message.recursive_hierarchy',
-                                     default: 'Parent Post Recursive')
+      record.errors.add(:base, I18n.t('camaleon_cms.admin.post.message.recursive_hierarchy',
+                                      default: 'Parent Post Recursive'))
     end
   end
 end

data/app/validators/camaleon_cms/uniq_validator.rb

@@ -11,7 +11,7 @@ module CamaleonCms
 
       return unless slug_exists
 
-      record.errors[:base] << I18n.t('camaleon_cms.admin.post.message.requires_different_slug').to_s
+      record.errors.add(:base, I18n.t('camaleon_cms.admin.post.message.requires_different_slug').to_s)
     end
   end
 end

data/app/validators/camaleon_cms/user_url_validator.rb

@@ -24,20 +24,32 @@
 # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 # SOFTWARE.
 
-# require 'resolv'
-require 'ipaddress'
+require 'ipaddr'
+require 'resolv'
 require 'addressable/uri'
 
 module CamaleonCms
   class UserUrlValidator
+    HTTPS_SCHEME = 'https'
     LOCAL_IPS = %w[0.0.0.0 ::].freeze
+    LINK_LOCAL_NETMASK  = IPAddr.new('169.254.0.0/16').freeze
+    SHARED_ADDR_NETMASK = IPAddr.new('100.64.0.0/10').freeze
+    IPV6_SITELOCAL      = IPAddr.new('fec0::/10').freeze
+    IPV6_UNIQUE_LOCAL   = IPAddr.new('fc00::/7').freeze
 
     def self.validate(...)
       new.validate(...)
     end
 
+    def self.validate_external_https(...)
+      new.validate_external_https(...)
+    end
+
+    attr_reader :resolved_ip
+
     def initialize
       @errors = []
+      @resolved_ip = nil
     end
 
     # Validates the given url according to the constraints specified by the received arguments.
@@ -46,31 +58,65 @@ module CamaleonCms
     # allow_local_network - Registers error if URL resolves to a link-local address and argument is false.
     # enforce_user - Registers error if URL user doesn't start with alphanumeric characters and argument is true.
     # enforce_sanitizing - Registers error if URL includes any HTML/CSS/JS tags and argument is true.
+    # resolve - When true (default), performs DNS resolution to check the IP.
+    #           When false, only validates URL structure and checks IP literals statically
+    #           (no DNS resolution, allowing unresolvable hostnames like custom scheme URLs).
+    # reject_path_traversal - When true, checks if URI path contains path traversal sequences.
     #
-    # Returns an array with [<uri>, <original-hostname>].
-    def validate(url, allow_localhost: false, allow_local_network: false, enforce_user: true, enforce_sanitizing: true)
-      return invalid_url unless url.present?
+    # Returns an array with error messages, or true if valid.
+    def validate(url, allow_localhost: false, allow_local_network: false, enforce_user: true, enforce_sanitizing: true,
+                 resolve: true, reject_path_traversal: false)
+      return true if skip_validation?
+      return invalid_url if url.blank?
 
-      # Param url can be a string, URI or Addressable::URI
       return invalid_url unless (uri = parse_url(url))
 
       validate_uri(uri: uri, enforce_sanitizing: enforce_sanitizing, enforce_user: enforce_user)
-      return @errors if @errors.any?
 
-      address_info = get_address_info(uri)
+      validate_path_traversal(uri) if reject_path_traversal
       return @errors if @errors.any?
 
-      validate_local_request(
-        address_info: address_info,
-        allow_localhost: allow_localhost,
-        allow_local_network: allow_local_network
-      )
+      if resolve
+        return @errors if @errors.any?
+
+        address_info = get_address_info(uri)
+        return @errors if @errors.any?
+
+        @resolved_ip = address_info.first&.ip_address
+
+        validate_local_request(
+          address_info: address_info,
+          allow_localhost: allow_localhost,
+          allow_local_network: allow_local_network
+        )
+      else
+        validate_static_ip(uri.hostname, allow_localhost: allow_localhost, allow_local_network: allow_local_network)
+      end
 
       @errors.empty? || @errors
     end
 
+    def validate_external_https(url)
+      return true if skip_validation?
+
+      uri = parse_url(url)
+      return [I18n.t('camaleon_cms.admin.validate.url')] if uri.nil? || uri.scheme.blank? || uri.hostname.blank?
+      return [I18n.t('camaleon_cms.admin.validate.https_only_url')] unless uri.scheme&.downcase == HTTPS_SCHEME
+
+      validate(uri, allow_localhost: false, allow_local_network: false)
+    end
+
     private
 
+    # Operator escape hatch: when ENV['CAMALEON_SKIP_URL_VALIDATION'] is set, all upload-URL
+    # validation (scheme, host, SSRF/link-local, path traversal, HTML sanitization) is bypassed.
+    # It is meant only for trusted, isolated environments (e.g. a local import job behind no
+    # network); leaving it set in production removes the SSRF and open-fetch protections around
+    # crop/crop_url. Off unless the variable is explicitly present.
+    def skip_validation?
+      ENV['CAMALEON_SKIP_URL_VALIDATION'].present?
+    end
+
     def validate_uri(uri:, enforce_sanitizing:, enforce_user:)
       validate_html_tags(uri) if enforce_sanitizing
 
@@ -78,19 +124,23 @@ module CamaleonCms
       validate_hostname(uri.hostname)
     end
 
-    # @param uri [Addressable::URI]
-    # @return [Array<Addrinfo>] addrinfo object for the URI
     def get_address_info(uri)
-      Addrinfo.getaddrinfo(uri.hostname, get_port(uri), nil, :STREAM).map do |addr|
+      return @errors << I18n.t('camaleon_cms.admin.validate.host_invalid') if uri.hostname.blank?
+
+      Addrinfo.getaddrinfo(hostname_for_resolution(uri.hostname), get_port(uri), nil, :STREAM).map do |addr|
         addr.ipv6_v4mapped? ? addr.ipv6_to_ipv4 : addr
       end
+    rescue SocketError
+      if valid_ip?(uri.hostname)
+        addr = Addrinfo.new(Socket.pack_sockaddr_in(get_port(uri), uri.hostname))
+        [addr.ipv6_v4mapped? ? addr.ipv6_to_ipv4 : addr]
+      else
+        @errors << I18n.t('camaleon_cms.admin.validate.host_invalid')
+      end
     rescue ArgumentError => e
-      # Addrinfo.getaddrinfo errors if the domain exceeds 1024 characters.
       @errors << I18n.t('camaleon_cms.admin.validate.hostname_long') if e.message.include?('hostname too long')
 
       @errors << "#{e.message}: #{I18n.t('camaleon_cms.admin.validate.url')}" if @errors.blank?
-    rescue SocketError
-      @errors << I18n.t('camaleon_cms.admin.validate.host_invalid')
     end
 
     def validate_local_request(address_info:, allow_localhost:, allow_local_network:)
@@ -113,14 +163,21 @@ module CamaleonCms
       uri.port || uri.default_port
     end
 
+    def hostname_for_resolution(hostname)
+      return hostname if hostname.blank?
+      return hostname if hostname.end_with?('.')
+      return hostname if valid_ip?(hostname)
+      return hostname unless hostname.match?(/\.[a-zA-Z]/)
+
+      "#{hostname}."
+    end
+
     def validate_html_tags(uri)
       uri_str = uri.to_s
       sanitized_uri = ActionController::Base.helpers.sanitize(uri_str, tags: [])
       @errors << I18n.t('camaleon_cms.admin.validate.html_tags') unless sanitized_uri == uri_str
     end
 
-    # @param [String, Addressable::URI, #to_str] url The URL string to parse
-    # @return [Addressable::URI, nil] URI object based on the parsed string, or `nil` if the `url` is invalid
     def parse_url(url)
       invalid = nil
       uri = Addressable::URI.parse(url).tap do |parsed_url|
@@ -136,8 +193,7 @@ module CamaleonCms
     def multiline_blocked?(parsed_url)
       url = parsed_url.to_s
 
-      return true if url =~ /[\n\r]/
-      # Google Cloud Storage uses a multi-line, encoded Signature query string
+      return true if /[\n\r]/.match?(url)
       return false if %w[http https].include?(parsed_url.scheme&.downcase)
 
       CGI.unescape(url) =~ /[\n\r]/
@@ -145,19 +201,44 @@ module CamaleonCms
 
     def validate_user(value)
       return if value.blank?
-      return if value =~ /\A\p{Alnum}/
+      return if /\A\p{Alnum}/.match?(value)
 
       @errors << I18n.t('camaleon_cms.admin.validate.username_alphanumeric')
     end
 
     def validate_hostname(value)
       return if value.blank?
-      return if IPAddress.valid?(value)
-      return if value =~ /\A\p{Alnum}/
+      return @errors << I18n.t('camaleon_cms.admin.validate.host_invalid') if invalid_decimal_ipv4_hostname?(value)
+      return if valid_ip?(value)
+      return if /\A\p{Alnum}/.match?(value)
 
       @errors << I18n.t('camaleon_cms.admin.validate.host_or_ip_invalid')
     end
 
+    def invalid_decimal_ipv4_hostname?(value)
+      return false unless /\A(?:0|[1-9]\d*)(?:\.(?:0|[1-9]\d*))+\z/.match?(value)
+
+      # An all-numeric dotted hostname is only ever meant to be a dotted-quad
+      # IPv4 literal. Reject it when it has too many octets or any out-of-range
+      # octet (regardless of octet count) so an out-of-range shorthand form such
+      # as 192.168.257 cannot slip through as a resolvable name. In-range
+      # shorthand (e.g. 192.168.1) is left to the resolver/category checks.
+      octets = value.split('.')
+      octets.length > 4 || octets.any? { |octet| octet.to_i > 255 }
+    end
+
+    def valid_ip?(value)
+      str = value.to_s
+      return false if str.blank?
+      return false if str.include?('/')
+      return false unless Resolv::IPv4::Regex.match?(str) || Resolv::IPv6::Regex.match?(str)
+
+      IPAddr.new(str)
+      true
+    rescue IPAddr::InvalidAddressError, IPAddr::AddressFamilyError
+      false
+    end
+
     def validate_localhost(addrs_info)
       return if (Socket.ip_address_list.map(&:ip_address).concat(LOCAL_IPS) & addrs_info.map(&:ip_address)).empty?
 
@@ -165,41 +246,139 @@ module CamaleonCms
     end
 
     def validate_loopback(addrs_info)
-      return unless addrs_info.any? { |addr| addr.ipv4_loopback? || addr.ipv6_loopback? }
+      return unless addrs_info.any? { |addr| loopback_ip?(ip_from_addrinfo(addr)) }
 
       @errors << I18n.t('camaleon_cms.admin.validate.no_loopback_requests')
     end
 
     def validate_local_network(addrs_info)
-      return unless addrs_info.any? { |addr| addr.ipv4_private? || addr.ipv6_sitelocal? || addr.ipv6_unique_local? }
+      return unless addrs_info.any? { |addr| local_network_ip?(ip_from_addrinfo(addr)) }
 
       @errors << I18n.t('camaleon_cms.admin.validate.no_local_net_requests')
     end
 
     def validate_link_local(addrs_info)
-      netmask = IPAddr.new('169.254.0.0/16')
-      return unless addrs_info.any? { |addr| addr.ipv6_linklocal? || netmask.include?(addr.ip_address) }
+      return unless addrs_info.any? { |addr| link_local_ip?(ip_from_addrinfo(addr)) }
 
       @errors << I18n.t('camaleon_cms.admin.validate.no_link_local_net_requests')
     end
 
     def validate_shared_address(addrs_info)
-      netmask = IPAddr.new('100.64.0.0/10')
-      return unless addrs_info.any? { |addr| netmask.include?(addr.ip_address) }
+      return unless addrs_info.any? { |addr| shared_address_ip?(ip_from_addrinfo(addr)) }
 
       @errors << I18n.t('camaleon_cms.admin.validate.no_shared_address_requests')
     end
 
-    # Registers an error if any IP in `addrs_info` is the limited broadcast address.
-    # https://datatracker.ietf.org/doc/html/rfc919#section-7
     def validate_limited_broadcast_address(addrs_info)
-      blocked_ips = ['255.255.255.255']
+      return unless addrs_info.any? { |addr| limited_broadcast_ip?(ip_from_addrinfo(addr)) }
+
+      @errors << I18n.t('camaleon_cms.admin.validate.no_limited_broadcast_address_requests')
+    end
+
+    def validate_static_ip(hostname, allow_localhost:, allow_local_network:)
+      return if hostname.blank?
+
+      if !allow_localhost && (hostname.casecmp?('localhost') || hostname.casecmp?('localhost.localdomain'))
+        @errors << I18n.t('camaleon_cms.admin.validate.no_localhost_requests')
+        return
+      end
+
+      return unless valid_ip?(hostname)
+
+      ip = IPAddr.new(hostname)
+      ip = ip.native if ip.ipv4_mapped?
+
+      validate_static_localhost(hostname, ip) unless allow_localhost
+      return if allow_local_network
 
-      return if (blocked_ips & addrs_info.map(&:ip_address)).empty?
+      validate_static_local_network(ip)
+      validate_static_link_local(ip)
+      validate_static_shared_address(ip)
+      validate_static_limited_broadcast(ip)
+    end
+
+    def validate_static_localhost(hostname, ip)
+      if hostname.in?(LOCAL_IPS) || ip.to_s == '::'
+        @errors << I18n.t('camaleon_cms.admin.validate.no_localhost_requests')
+      elsif ip.loopback?
+        @errors << I18n.t('camaleon_cms.admin.validate.no_loopback_requests')
+      end
+    end
+
+    def validate_static_local_network(ip)
+      return unless local_network_ip?(ip)
+
+      @errors << I18n.t('camaleon_cms.admin.validate.no_local_net_requests')
+    end
+
+    def validate_static_link_local(ip)
+      return unless link_local_ip?(ip)
+
+      @errors << I18n.t('camaleon_cms.admin.validate.no_link_local_net_requests')
+    end
+
+    def validate_static_shared_address(ip)
+      return unless shared_address_ip?(ip)
+
+      @errors << I18n.t('camaleon_cms.admin.validate.no_shared_address_requests')
+    end
+
+    def validate_static_limited_broadcast(ip)
+      return unless limited_broadcast_ip?(ip)
 
       @errors << I18n.t('camaleon_cms.admin.validate.no_limited_broadcast_address_requests')
     end
 
+    def validate_path_traversal(uri)
+      # Fully percent-decode the path (so both %2e%2e and multiply-encoded forms
+      # such as %252e%252e are caught) then look for actual ".." path segments.
+      # Comparing uri.path to uri.normalized_path would instead flag legitimate
+      # URLs whose encoding merely differs (e.g. %7E -> ~).
+      decoded = uri.path.to_s
+      5.times do
+        unencoded = Addressable::URI.unencode(decoded)
+        break if unencoded == decoded
+
+        decoded = unencoded
+      end
+      return unless decoded.split(%r{[/\\]}).include?('..')
+
+      @errors << I18n.t('camaleon_cms.admin.validate.path_traversal')
+    end
+
+    def ip_from_addrinfo(addr)
+      ip = IPAddr.new(addr.ip_address)
+      ip.ipv4_mapped? ? ip.native : ip
+    end
+
+    def loopback_ip?(ip)
+      ip.loopback?
+    end
+
+    def local_network_ip?(ip)
+      ip.private? || ipv6_sitelocal?(ip) || ipv6_unique_local?(ip)
+    end
+
+    def link_local_ip?(ip)
+      ip.link_local? || LINK_LOCAL_NETMASK.include?(ip)
+    end
+
+    def shared_address_ip?(ip)
+      SHARED_ADDR_NETMASK.include?(ip)
+    end
+
+    def limited_broadcast_ip?(ip)
+      ip.to_s == '255.255.255.255'
+    end
+
+    def ipv6_sitelocal?(ip)
+      IPV6_SITELOCAL.include?(ip)
+    end
+
+    def ipv6_unique_local?(ip)
+      IPV6_UNIQUE_LOCAL.include?(ip)
+    end
+
     def invalid_url
       @errors << I18n.t('camaleon_cms.admin.validate.url')
     end

data/app/views/camaleon_cms/admin/categories/index.html.erb

@@ -12,7 +12,7 @@
       <div class="panel panel-default">
         <div class="panel-heading ui-draggable-handle">
             <h4>
-                <span class="fa fa-folder"></span> <%= "#{@post_type.decorate.the_title} / " if @post_type.present? %> <%= t('camaleon_cms.admin.post_type.categories', default: 'Categories') %>
+                <span class="fa fa-folder"></span> <%= safe_join([@post_type.decorate.the_title, ' / ']) if @post_type.present? %> <%= t('camaleon_cms.admin.post_type.categories', default: 'Categories') %>
             </h4>
         </div>
         <div class="panel-body">
@@ -39,7 +39,7 @@
                       <%= r = {html: "", post_type: @post_type, category: item}; hooks_run("category_list_body", r); raw(r[:html]); %>
                       <td>
                           <%= link_to raw('<i class="fa fa-eye"></i>'), item.the_url, target: '_blank', class: "btn btn-info btn-xs", title: "#{t('camaleon_cms.common.visit')}" %>
-                          <%= link_to raw('<i class="fa fa-list"></i>'), cama_admin_post_type_taxonomy_posts_path(@post_type.id, "category", item.id), class: "btn btn-default btn-xs cama_ajax_request", title: "#{cama_pluralize_text(@post_type.decorate.the_title)} - #{item.the_title.to_s.titleize}" if @post_type.present? && (can? :posts, @post_type) %>
+                          <%= link_to raw('<i class="fa fa-list"></i>'), cama_admin_post_type_taxonomy_posts_path(@post_type.id, "category", item.id), class: "btn btn-default btn-xs cama_ajax_request", title: safe_join([cama_pluralize_text(@post_type.decorate.the_title), ' - ', item.name.to_s.translate(item.get_locale).titleize]) if @post_type.present? && (can? :posts, @post_type) %>
                           <%= link_to raw('<i class="fa fa-pencil"></i>'), {action: :edit, id: item.id }, class: "btn btn-default btn-xs cama_ajax_request", title: "#{t('camaleon_cms.admin.button.edit')}" %>
                           <%= link_to raw('<i class="fa fa-times"></i>'), { action: :destroy, id: item.id },method: :delete, data: { confirm: t('camaleon_cms.admin.message.delete') }, class: "btn btn-danger btn-xs cama_ajax_request", title: "#{t('camaleon_cms.admin.button.delete')}" unless item.get_option('not_deleted', false) %>
                       </td>

data/app/views/camaleon_cms/admin/installers/form.html.erb

@@ -13,6 +13,11 @@
         <%= f.label t('camaleon_cms.admin.post_type.template') %><br>
         <%= select_tag :theme, options_for_select(PluginRoutes.all_themes.map{|theme| [theme["name"], theme["key"]] }), :class => "form-control required" %>
     </div>
+    <div class="form-group">
+        <%= label_tag :setup_token, t('camaleon_cms.admin.installer.setup_token', default: 'Setup token') %><br>
+        <%= text_field_tag :setup_token, nil, class: "form-control", autocomplete: "off" %>
+        <small style="color: #999;"><%= t('camaleon_cms.admin.installer.setup_token_hint', default: 'Required for remote installations; leave blank when installing locally. Printed in the server log and saved to tmp/camaleon_setup_token on first run.') %></small>
+    </div>
     <div class="form-group">
         <button class="btn btn-primary pull-right" type="submit"><%= t('camaleon_cms.admin.button.submit') %></button>
     </div>

data/app/views/camaleon_cms/admin/installers/welcome.html.erb

@@ -1,8 +1,32 @@
 <div class="well">
-    <h3>Your site was created successfully.</h3>
+    <h3><%= t('camaleon_cms.admin.installer.welcome_title', default: 'Your site was created successfully.') %></h3>
     <hr>
-    <p>Vist Frontend: <%= link_to("Here.", cama_root_url, target: "_blank") %></p>
-    <p>Visit Admin panel <%= link_to("Here.", cama_admin_login_url, target: "_blank") %></p>
-    <p>user: admin</p>
-    <p>pass: admin123</p>
-</div>
+    <p><%= t('camaleon_cms.admin.installer.visit_frontend', default: 'Visit Frontend:') %> <%= link_to(t('camaleon_cms.admin.installer.here', default: 'Here.'), cama_root_url, target: "_blank") %></p>
+    <p><%= t('camaleon_cms.admin.installer.visit_admin', default: 'Visit Admin panel') %> <%= link_to(t('camaleon_cms.admin.installer.here', default: 'Here.'), cama_admin_login_url, target: "_blank") %></p>
+    <hr>
+    <p><%= t('camaleon_cms.admin.installer.user_label', default: 'User:') %> <strong>admin</strong></p>
+    <% if @generated_admin_password.present? %>
+        <p>
+            <%= t('camaleon_cms.admin.installer.password_label', default: 'Password:') %>
+            <strong><span id="cama_generated_password"><%= @generated_admin_password %></span></strong>
+            <button type="button" class="btn btn-xs btn-default" onclick="cama_copy_generated_password(this)">
+                <%= t('camaleon_cms.admin.installer.copy', default: 'Copy') %>
+            </button>
+        </p>
+        <p style="color: #c0392b;"><%= t('camaleon_cms.admin.installer.must_change_notice', default: 'Save this password now — it is shown only once. You will be asked to change it when you first sign in.') %></p>
+        <script>
+            function cama_copy_generated_password(btn) {
+                var node = document.getElementById('cama_generated_password');
+                var done = function () { btn.textContent = '<%= j t('camaleon_cms.admin.installer.copied', default: 'Copied!') %>'; };
+                if (navigator.clipboard && navigator.clipboard.writeText) {
+                    navigator.clipboard.writeText(node.textContent).then(done, function () {});
+                } else {
+                    var range = document.createRange(); range.selectNode(node);
+                    var sel = window.getSelection(); sel.removeAllRanges(); sel.addRange(range);
+                    try { document.execCommand('copy'); done(); } catch (e) {}
+                    sel.removeAllRanges();
+                }
+            }
+        </script>
+    <% end %>
+</div>

data/app/views/camaleon_cms/admin/plugins/_plugins_list.html.erb

@@ -30,8 +30,8 @@
                     <td><%= t("camaleon_cms.admin.plugins.status_#{status}") %></td>
                     <td>
                         <% msg = "#{status ? t('camaleon_cms.admin.button.disable_plugin') : t('camaleon_cms.admin.button.activate_plugin') }" %>
-                        <%= link_to msg, {action: :toggle, id: plugin["key"], status: status }, class: "btn btn-#{status ? 'danger' : 'primary'} btn-xs", data: { confirm: msg } %>
-                        <%= link_to("<i class='fa fa-arrow-circle-o-up'></i>".html_safe, cama_admin_plugin_upgrade_path(plugin["key"]), class: "btn btn-info btn-xs", title: "#{t("camaleon_cms.admin.plugins.upgrade_to")} #{plugin["version"]}") if status && current_site.get_plugin(plugin["key"]).old_version? %>
+                        <%= link_to msg, {action: :toggle, id: plugin["key"], status: status }, method: :patch, class: "btn btn-#{status ? 'danger' : 'primary'} btn-xs", data: { confirm: msg } %>
+                        <%= link_to("<i class='fa fa-arrow-circle-o-up'></i>".html_safe, cama_admin_plugin_upgrade_path(plugin["key"]), method: :post, class: "btn btn-info btn-xs", title: "#{t("camaleon_cms.admin.plugins.upgrade_to")} #{plugin["version"]}") if status && current_site.get_plugin(plugin["key"]).old_version? %>
                     </td>
                 </tr>
             <% end %>

data/app/views/camaleon_cms/admin/post_tags/index.html.erb

@@ -3,7 +3,7 @@
     <div class="col-md-4">
       <div class="panel panel-default">
         <div class="panel-heading ui-draggable-handle">
-            <h4><span class="fa fa-folder"></span> <%= "#{cama_pluralize_text(@post_type.decorate.the_title)} / " if @post_type.present? %> <%= cama_pluralize_text(t('camaleon_cms.admin.post_type.tags').to_s.titleize) %></h4>
+            <h4><span class="fa fa-folder"></span> <%= safe_join([cama_pluralize_text(@post_type.decorate.the_title), ' / ']) if @post_type.present? %> <%= cama_pluralize_text(t('camaleon_cms.admin.post_type.tags').to_s.titleize) %></h4>
         </div>
         <%= render partial: 'form' %>
       </div>
@@ -37,7 +37,7 @@
                         <td><%= tag.count %></td>
                         <td>
                             <%= link_to raw('<i class="fa fa-eye"></i>'), tag.the_url, target: '_blank', class: "btn btn-info btn-xs btn_view", title: "#{t('camaleon_cms.common.visit')}" %>
-                            <%= link_to raw('<i class="fa fa-list"></i>'), cama_admin_post_type_taxonomy_posts_path(@post_type.id, "post_tag", tag.id), class: "btn btn-default btn-xs cama_ajax_request btn_posts", title: "#{cama_pluralize_text(@post_type.decorate.the_title)}-#{tag.slug.to_s.titleize}" if @post_type.present? %>
+                            <%= link_to raw('<i class="fa fa-list"></i>'), cama_admin_post_type_taxonomy_posts_path(@post_type.id, "post_tag", tag.id), class: "btn btn-default btn-xs cama_ajax_request btn_posts", title: safe_join([cama_pluralize_text(@post_type.decorate.the_title), '-', tag.slug.to_s.titleize]) if @post_type.present? %>
                             <%= link_to raw('<i class="fa fa-pencil"></i>'), {action: :edit, id: tag.id }, class: "btn btn-default btn-xs cama_ajax_request btn_edit", title: "#{t('camaleon_cms.admin.button.edit')}" %>
                             <%= link_to raw('<i class="fa fa-times"></i>'), { action: :destroy, id: tag.id }, method: :delete, data: { confirm: t('camaleon_cms.admin.message.delete') }, class: "btn btn-danger btn-xs cama_ajax_request btn_del", title: "#{t('camaleon_cms.admin.button.delete')}" unless tag.get_option('not_deleted', false) %>
                         </td>

data/app/views/camaleon_cms/admin/posts/_sidebar.html.erb

@@ -14,7 +14,7 @@
         </div>
         <div class="panel-footer">
             <div class="row">
-                <div class="col-md-6 "><%= link_to t('camaleon_cms.admin.button.move_trash'), {action: :trash, post_id: @post.id}, class: "text-center text-danger btn-xs btn" unless @post.new_record? %></div>
+                <div class="col-md-6 "><%= link_to t('camaleon_cms.admin.button.move_trash'), {action: :trash, post_id: @post.id}, method: :patch, data: {confirm: t('camaleon_cms.admin.message.delete')}, class: "text-center text-danger btn-xs btn" unless @post.new_record? %></div>
                 <div class="col-md-6">
                     <% if @post.draft?  %>
                         <a class="btn btn-default btn-xs pull-right" href="#" data-type="pending" onclick="$('#form-post').submit(); return false;" style="<%= 'display: none' unless @post.pending? %>" ><%= t('camaleon_cms.admin.post_type.save_pending')%> </a>

data/app/views/camaleon_cms/admin/posts/form.html.erb

@@ -9,9 +9,10 @@
                     <h4>
                         <span class="fa fa-file-o"></span>
                         <% if !@post.new_record? %>
-                            <%= "#{t('camaleon_cms.admin.page_title.edit')} #{@post_type.the_title}: #{@post_decorate.the_title}" %> <%= raw @post_decorate.the_status.html_safe %>
+                            <%= safe_join([t('camaleon_cms.admin.page_title.edit'), ' ', @post_type.the_title, ': ', @post_decorate.the_title]) %> <%= raw @post_decorate.the_status.html_safe %>
                         <% end %>
-                        <%= link_to raw("#{t('camaleon_cms.admin.button.view_draft')}"), {action: :edit, id: @post.drafts.pluck('id')}, id: "view_draft", class: "label label-warning label-form", title: "#{t('camaleon_cms.admin.button.view_draft')}", target: '_blank' if @post.drafts.present? %>
+                        <% cama_own_draft = @post.drafts.where(user_id: cama_current_user.id).first %>
+                        <%= link_to raw("#{t('camaleon_cms.admin.button.view_draft')}"), {action: :edit, id: cama_own_draft.id}, id: "view_draft", class: "label label-warning label-form", title: "#{t('camaleon_cms.admin.button.view_draft')}", target: '_blank' if cama_own_draft %>
                         <%= t('camaleon_cms.admin.page_title.create') + " " + @post_type.the_title.to_s if @post.new_record? %>
                     </h4>
 

data/app/views/camaleon_cms/admin/posts/index.html.erb

@@ -60,10 +60,10 @@
                     <td><%= link_to raw(f.the_status), {action: :index, s: f.status}, class: "cama_ajax_request" %>  </td>
                     <td><%= f.author.fullname %></td>
                     <% if @post_type.manage_categories? %>
-                        <td><%= post_type_list_taxonomy(f.categories, "success") %></td>
+                        <td><%= post_type_list_taxonomy(f.categories, "success", @post_type) %></td>
                     <% end %>
                     <% if @post_type.manage_tags? %>
-                        <td><%= post_type_list_taxonomy(f.post_tags, "default") %></td>
+                        <td><%= post_type_list_taxonomy(f.post_tags, "default", @post_type) %></td>
                     <% end %>
                     <% extra_column = {post: f, post_type: @post_type, content: "", from_body: true};  hooks_run("list_post_extra_columns", extra_column) %>
                     <%= raw extra_column[:content] %>
@@ -88,18 +88,18 @@
                         <% end %>
 
                         <% if f.trash? %>
-                            <%= link_to raw('<i class="fa fa-check"></i>'), {action: :restore, post_id: f.id, s: params[:s]}, class: "btn btn-success btn-xs", title: "#{t('camaleon_cms.admin.button.restore')}" if can? :update, f %>
+                            <%= link_to raw('<i class="fa fa-check"></i>'), {action: :restore, post_id: f.id, s: params[:s]}, method: :patch, class: "btn btn-success btn-xs", title: "#{t('camaleon_cms.admin.button.restore')}" if can? :update, f %>
                             <%= link_to raw('<i class="fa fa-times"></i>'), {action: :destroy, id: f.id, s: params[:s]},
                                         method: :delete, data: {confirm: t('camaleon_cms.admin.message.delete_item')}, class: "btn btn-danger btn-xs cama_ajax_request", title: "#{t('camaleon_cms.admin.button.delete_complete', default: 'Delete completely')}" if can? :destroy, f %>
                         <% elsif f.draft? %>
                             <%#= link_to raw('<i class="fa fa-check"></i>'), {action: :edit, id: f.id, recover_draft: 'true' }, class: "btn btn-success btn-xs", title: "#{t('camaleon_cms.admin.button.recover')}" if can? :update, f %>
                             <%= link_to raw('<i class="fa fa-pencil"></i>'), {action: :edit, id: f.id}, class: "btn btn-default btn-xs cama_ajax_request", title: "#{t('camaleon_cms.admin.button.edit')}" if can? :update, f %>
                             <%= link_to raw('<i class="fa fa-trash"></i>'), {action: :trash, post_id: f.id, s: params[:s]},
-                                        data: {confirm: t('camaleon_cms.admin.message.delete')}, class: "btn btn-danger btn-xs cama_ajax_request", title: "#{t('camaleon_cms.admin.button.move_trash')}" if can? :destroy, f %>
+                                        method: :patch, data: {confirm: t('camaleon_cms.admin.message.delete')}, class: "btn btn-danger btn-xs cama_ajax_request", title: "#{t('camaleon_cms.admin.button.move_trash')}" if can? :destroy, f %>
                         <% else %>
                             <%= link_to raw('<i class="fa fa-pencil"></i>'), {action: :edit, id: f.id}, class: "btn btn-default btn-xs cama_ajax_request", title: "#{t('camaleon_cms.admin.button.edit')}" if can? :update, f %>
                             <%= link_to raw('<i class="fa fa-trash"></i>'), {action: :trash, post_id: f.id, s: params[:s]},
-                                        data: {confirm: t('camaleon_cms.admin.message.delete')}, class: "btn btn-danger btn-xs cama_ajax_request", title: "#{t('camaleon_cms.admin.button.move_trash')}" if can? :destroy, f %>
+                                        method: :patch, data: {confirm: t('camaleon_cms.admin.message.delete')}, class: "btn btn-danger btn-xs cama_ajax_request", title: "#{t('camaleon_cms.admin.button.move_trash')}" if can? :destroy, f %>
                         <% end %>
                     </td>
                 </tr>

data/app/views/camaleon_cms/admin/sessions/back_to_parent.html.erb

@@ -0,0 +1,39 @@
+<div class="login-body">
+    <h3 class="login-box-msg"><%= t('camaleon_cms.admin.login.back_to_parent.title', default: 'Return to your account') %></h3>
+    <%= render "camaleon_cms/flash_messages" %>
+    <p>
+        <%# The parent admin's username is deliberately not shown: whoever holds an abandoned
+            impersonation must not learn which admin account to attack (or phish). %>
+        <%= t('camaleon_cms.admin.login.back_to_parent.instructions',
+              default: 'You are currently working as %{impersonated}. Enter the password for your own account to return to it, or log out completely.',
+              impersonated: @impersonated_user.username) %>
+    </p>
+    <%= form_tag cama_admin_back_to_parent_path, method: "post", role: "form", id: "back_to_parent", class: "form-horizontal cama_form_validate" do %>
+        <div class="form-group">
+            <div class="col-md-12">
+                <%= password_field_tag :password, nil, class: "form-control required", autofocus: true,
+                                       placeholder: t('camaleon_cms.admin.login.password', default: 'Password') %>
+            </div>
+        </div>
+        <div class="form-group">
+            <div class="col-md-12">
+                <%= raw cama_captcha_tags_if_under_attack("login") %>
+            </div>
+        </div>
+    <% end %>
+    <%# Security (audit M6): the full-logout button is its OWN button_to form, a sibling of the
+        re-auth form above -- never nested inside it. A nested <form> is dropped by the HTML parser
+        (the button would submit the outer form), and with per-form CSRF tokens the two tokens would
+        collide, breaking both submits. The "Return to my account" button stays a submit of the
+        re-auth form via the HTML5 `form` attribute. %>
+    <div class="row">
+        <div class="col-xs-6">
+            <%= button_to t('camaleon_cms.admin.login.back_to_parent.logout', default: 'Log out completely'),
+                          cama_admin_logout_path(full: 1), method: :post,
+                          class: 'btn btn-default btn-block btn-flat' %>
+        </div>
+        <div class="col-xs-6">
+            <button type="submit" form="back_to_parent" class="btn btn-primary btn-block btn-flat"><%= t('camaleon_cms.admin.login.back_to_parent.submit', default: 'Return to my account') %></button>
+        </div>
+    </div>
+</div>