camaleon_cms 2.9.2 → 2.9.4

data/app/views/camaleon_cms/admin/sessions/logout_confirm.html.erb

@@ -0,0 +1,27 @@
+<div class="login-body">
+    <h3 class="login-box-msg"><%= t('camaleon_cms.admin.logout.confirm_title', default: 'Log out?') %></h3>
+    <%= render "camaleon_cms/flash_messages" %>
+    <p>
+        <%# Security (audit M6): reached over GET (an old bookmark, or a theme still linking the
+            path) — the session ends only through the POST below, so a forged GET cannot end it. %>
+        <%= t('camaleon_cms.admin.logout.confirm_instructions',
+              default: 'You are about to end your session. Continue?') %>
+    </p>
+    <div class="row">
+        <div class="col-xs-6">
+            <%# Cancel returns to the vetted return_to when a theme supplied one (see
+                #prepare_logout_confirmation), else the dashboard -- never blindly into the admin. %>
+            <a href="<%= @logout_cancel_url %>" class="btn btn-default btn-block btn-flat"><%= t('camaleon_cms.admin.button.cancel', default: 'Cancel') %></a>
+        </div>
+        <div class="col-xs-6">
+            <%# `full` (impersonation), `return_to` (ecosystem themes link logout with a return-to-site
+                destination) and `locale` are carried through to the POST -- precomputed as scalars in
+                the controller so a hash-shaped param cannot crash url generation; return_to is then
+                vetted by cama_logout_user's safe-redirect check like on any logout. %>
+            <%= button_to t('camaleon_cms.admin.logout.logout', default: 'Logout'),
+                          cama_admin_logout_path(full: @logout_full, return_to: @logout_return_to,
+                                                 locale: @logout_locale),
+                          method: :post, class: 'btn btn-danger btn-block btn-flat' %>
+        </div>
+    </div>
+</div>

data/app/views/camaleon_cms/admin/settings/_email_settings.html.erb

@@ -49,7 +49,10 @@
                 var form = modal.find('form');
                 form.validate({submitHandler: function(){
                     showLoading();
-                    $.get(link.attr('href'), form.serialize(), function(){ hideLoading(); }).complete(function(){ modal.modal('hide'); }).error(function(r){ $.fn.alert({title: r.responseText, type: 'error'}) });
+                    // Security (audit M6): test_email sends mail, so the route is POST-only;
+                    // jquery_ujs' prefilter attaches the CSRF token to non-GET ajax.
+                    // .always/.fail (not the .complete/.error jqXHR aliases removed in jQuery 3).
+                    $.post(link.attr('href'), form.serialize(), function(){ hideLoading(); }).always(function(){ modal.modal('hide'); }).fail(function(r){ $.fn.alert({title: r.responseText, type: 'error'}) });
                 }});
             }});
             return false;

data/app/views/camaleon_cms/admin/settings/custom_fields/_get_items.html.erb

@@ -3,7 +3,7 @@
    @item_options_value = @item_options_value || {}
    @item_id = @item_value[:id] || ''
    @index = "#{@item_id}_#{Time.now.to_i}_#{rand(999...99999)}"
-   @field_config = cama_custom_field_elements[@key.to_sym]
+   @field_config = @key.present? ? cama_custom_field_elements[@key.to_sym] : nil
    @panel_id = "panel-field#{@index}"
    colors = ['primary','success','warning','colorful','info','danger']
    unless @field_config.nil?

data/app/views/camaleon_cms/admin/settings/custom_fields/_render.html.erb

@@ -15,13 +15,24 @@
                     </div>
                 <% end %>
                 <div class="fields_container">
-                    <% fields.decorate.each do |field| is_disabled = field.options[:disabled].present? || field.options[:readonly].present?; group_field_data[field.slug] = {default_value: field.options[:default_value], is_disabled: is_disabled, id: field.id, multiple: field.options[:multiple].to_s.to_bool && !is_disabled, kind: field.get_option('field_key')} %>
-                        <div class="item-custom-field c-field-<%= field.options[:field_key] %>" data-field-key="<%= field.slug %>">
+                    <% fields.decorate.each do |field|
+                         field_key = field.get_option('field_key').presence || field.options[:field_key].presence || field.options['field_key'].presence
+                         normalized_field_key = field_key.presence || 'text_box'
+                         is_disabled = field.get_option('disabled').present? || field.get_option('readonly').present?
+                         required_field = field.get_option('required').to_s.to_bool
+                         group_field_data[field.slug] = {
+                           default_value: field.get_option('default_value'),
+                           is_disabled: is_disabled,
+                           id: field.id,
+                           multiple: field.get_option('multiple').to_s.to_bool && !is_disabled,
+                           kind: normalized_field_key
+                         } %>
+                        <div class="item-custom-field c-field-<%= normalized_field_key %>" data-field-key="<%= field.slug %>">
                             <input name="<%= field_name %>[<%= field.slug %>][id]" type="hidden" value="<%= field.id %>"/>
                             <input name="<%= field_name %>[<%= field.slug %>][group_number]" class="cama_custom_group_number" type="hidden" value="0"/>
                             <label>
                                 <%= field.name %>
-                                <%= raw "<em class='text-danger'>*</em>" if field.options[:required].to_s.to_bool %>
+                                <%= raw "<em class='text-danger'>*</em>" if required_field %>
                                 <% if current_site.get_option('custom_fields_show_shortcodes') && ["post", "posttype", "category", "postTag", "site", "user", "navmenu", "theme"].include?(obj_class) %>
                                     <small class="shortcode_field"><br><%= cama_shortcode_print("[data field='#{field.slug}' #{"object='#{obj_class}' #{"id='#{record.id}'" if obj_class != "Theme" }" unless record.new_record?}]") %></small>
                                 <% end %>
@@ -31,7 +42,11 @@
                             <% end  %>
                             <div class="editor-custom-fields content-field-<%= field.id %>" data-add_field_title="<%= t('camaleon_cms.admin.button.add_new_field', default: 'Add new field')%>">
                                 <%= begin
-                                      render(field.get_option('render') || (cama_custom_field_elements[field.get_option('field_key').to_sym][:render] rescue nil) || "camaleon_cms/admin/settings/custom_fields/fields/#{field.options[:field_key]}", field: field, values: nil, is_disabled: is_disabled, default_use: default_use, field_name: field_name)
+                                      custom_field_render = (cama_custom_field_elements[normalized_field_key.to_sym][:render] rescue nil)
+                                      render(
+                                        field.get_option('render') || custom_field_render || "camaleon_cms/admin/settings/custom_fields/fields/#{normalized_field_key}",
+                                        field: field, values: nil, is_disabled: is_disabled, default_use: default_use, field_name: field_name
+                                      )
                                     rescue => e
                                       Rails.logger.error "Camaleon CMS - Render Custom Fields Error: Custom field template was not found => #{e.message}: #{$!.backtrace}".cama_log_style(:red)
                                       e.message

data/app/views/camaleon_cms/admin/settings/custom_fields/_render_category_simple.html.erb

@@ -2,7 +2,7 @@
 def _render_category_option_html(item, pos = 0)
   category = item.decorate
   value = "Category_Post,#{category.id}" %>
-  <option value="<%= value %>" data-help="<%= "#{t('camaleon_cms.admin.settings.tooltip.add_custom_field_posts')}"+ category.the_title %>"><%=  "#{('—' * pos)} #{category.the_title}" %></option>
+  <option value="<%= value %>" data-help="<%= safe_join([t('camaleon_cms.admin.settings.tooltip.add_custom_field_posts'), category.the_title]) %>"><%= safe_join([('—' * pos), ' ', category.the_title]) %></option>
 <% end
 
    def _render_categories(categories, _level = 0)

data/app/views/camaleon_cms/admin/settings/custom_fields/form.html.erb

@@ -64,13 +64,14 @@
                                 </optgroup>
 
                                 <optgroup label="<%= t('camaleon_cms.admin.settings.others') %>">
-                                    <% value = "#{PluginRoutes.static_system_info['user_model'].presence || 'User'},#{current_site.id}" %>
+                                    <%# Demodulized: user groups are stored and read under the association's scope name %>
+                                    <% value = "#{PluginRoutes.get_user_class_name.demodulize},#{current_site.id}" %>
                                     <option value="<%= value %>" data-help="<%= t('camaleon_cms.admin.settings.tooltip.add_custom_field_users') %>"><%= t('camaleon_cms.admin.sidebar.users') %></option>
                                     <% value = "Site,#{current_site.id}" %>
                                     <option value="<%= value %>" data-help="<%= t('camaleon_cms.admin.settings.tooltip.add_custom_field_sites') %>"><%= t('camaleon_cms.admin.sidebar.site_settings') %></option>
-                                    <% f_args={models: @_extra_models_for_fields || []}; hooks_run('custom_field_custom_models', f_args); f_args[:models].each do |model| %>
+                                    <% cf_extra_models_for_fields.each do |model| %>
                                         <% value = "#{model.name},#{current_site.id}" %>
-                                        <option value="<%= value %>" data-help=""><%= model.name %></option><%= model.name %>
+                                        <option value="<%= value %>" data-help=""><%= model.name %></option>
                                     <% end %>
                                 </optgroup>
 

data/app/views/camaleon_cms/admin/settings/shortcodes.html.erb

@@ -13,17 +13,17 @@
                     </tr>
                     </thead>
                     <tbody>
-                    <% @_shortcodes.each do |code| %>
+                    <% shortcodes_list.each do |code| %>
                         <tr>
                             <td>
                                 <code>[<%= code %>]</code>
                             </td>
-                            <td class="col_descr"><%= @_shortcodes_descr[code] %></td>
+                            <td class="col_descr"><%= shortcodes_descriptions[code] %></td>
                         </tr>
                     <% end %>
                     </tbody>
                 </table>
-                <%= content_tag("div", t('camaleon_cms.admin.message.data_found_list'), class: "alert alert-warning") if @_shortcodes.empty? %>
+                <%= content_tag("div", t('camaleon_cms.admin.message.data_found_list'), class: "alert alert-warning") if shortcodes_list.empty? %>
             </div>
         </div>
     </div>
@@ -34,4 +34,4 @@
             $(this).html($(this).html().replace(/\n/g, "<br>"));
         });
     })
-</script>
+</script>

data/app/views/camaleon_cms/admin/settings/site.html.erb

@@ -3,7 +3,7 @@
 <div class="page-content-wrap">
   <div class="panel panel-default">
     <div class="panel-heading">
-      <h4><span class="fa fa-cog"></span> <%= "#{t('camaleon_cms.admin.settings.configuration_site')}: #{@site.the_title} " %> </h4>
+      <h4><span class="fa fa-cog"></span> <%= safe_join([t('camaleon_cms.admin.settings.configuration_site'), ': ', @site.the_title, ' ']) %> </h4>
     </div>
     <%= form_for @site, as: "site", url: {action: :site_saved}, html: {id: "site_settings_form", class: "panel-body cama_ajax_request validate"} do |f| %>
         <div class="tabs">

data/app/views/camaleon_cms/admin/settings/sites/form.html.erb

@@ -5,7 +5,7 @@
         <div class="col-md-8 col-md-offset-2">
           <div class="panel panel-default">
             <div class="panel-heading">
-                <h4><span class="fa fa-cog"></span> <%= @site.new_record? ? t('camaleon_cms.admin.page_title.new_site') : "#{t('camaleon_cms.admin.page_title.edit_site')}: #{@site.the_title} "%> </h4>
+                <h4><span class="fa fa-cog"></span> <%= @site.new_record? ? t('camaleon_cms.admin.page_title.new_site') : safe_join([t('camaleon_cms.admin.page_title.edit_site'), ': ', @site.the_title, ' ']) %> </h4>
             </div>
             <div class="panel-body">
               <%= render partial: 'layouts/camaleon_cms/admin/form_error', locals: {data: @site} %>

data/app/views/camaleon_cms/admin/user_roles/form.html.erb

@@ -17,6 +17,26 @@
               <%= render partial: 'layouts/camaleon_cms/admin/form_error', locals: {data: @user_role} %>
                 <% rol_values_post_type = @user_role.new_record? ? {} : @user_role.get_meta("_post_type_#{current_site.id.to_s}") %>
                 <% rol_values_manager = @user_role.new_record? ? {} : @user_role.get_meta("_manager_#{current_site.id.to_s}") %>
+                <%# A role whose users are administrators holds every permission through `Ability`'s   %>
+                <%# `can :manage, :all`, which returns before either meta above is read. Their stored  %>
+                <%# metas are only what `set_default_user_roles` seeded when the site was created, so  %>
+                <%# every key added to ROLES afterwards rendered unchecked on existing sites and read  %>
+                <%# as "denied to administrators", which it never was. Deriving the state from the     %>
+                <%# role keeps it true for keys added later, with no backfill task to run and none to  %>
+                <%# write again next time.                                                            %>
+                <%#                                                                                    %>
+                <%# Such a role's boxes are also locked, and `UserRolesController` declines to write   %>
+                <%# its metas — the two conditions are the same predicate, so a locked box, which the  %>
+                <%# browser never submits, cannot silently clear what is stored.                      %>
+                <% grants_all = @user_role.grants_all_permissions? %>
+                <% permissions_editable = @user_role.permissions_editable? %>
+                <%# Without this the locked, all-checked boxes look like a bug rather than a statement %>
+                <%# about what an administrator is. %>
+                <% if grants_all %>
+                    <div class="alert alert-info">
+                      <span class="fa fa-info-circle"></span>&nbsp;<%= t('camaleon_cms.admin.users.admin_holds_all_permissions', default: 'Users with this role are administrators, so they hold every permission below regardless of what is selected. These settings cannot be changed.') %>
+                    </div>
+                <% end %>
               <div id="contents-checkbox" class="form-horizontal">
                 <div class="">
                    <table class="table table-responsive table-hover table-striped">
@@ -49,7 +69,7 @@
                                 values = [] if values == 0
                                 %>
                                 <% if visible %>
-                                    <input type="checkbox" name="rol_values[post_type][<%= value[:key] %>][]" value="<%= pt.id %>" <%= "checked" if values.include?(pt.id)  %> <%= "disabled" unless @user_role.editable?  %> onclick="<%= "cama_user_roles_do_all_publish(this, '#{value[:color]}', '#{value[:key]}')" %>" >
+                                    <input type="checkbox" name="rol_values[post_type][<%= value[:key] %>][]" value="<%= pt.id %>" <%= "checked" if grants_all || values.include?(pt.id)  %> <%= "disabled" unless permissions_editable  %> onclick="<%= "cama_user_roles_do_all_publish(this, '#{value[:color]}', '#{value[:key]}')" %>" >
                                 <% end %>
                               </td>
                           <% end %>
@@ -64,9 +84,10 @@
                   <h5><%= t('camaleon_cms.admin.users.other_permissions')%></h5>
                   <div class="row">
                     <% values = rol_values_manager || {}  %>
+                    <%# Same rule as the grid above: see `grants_all` where it is assigned. %>
                     <% cama_get_roles_values[:manager].each do |value|  %>
                         <div class="col-md-4">
-                          <label><input type="checkbox" name="rol_values[manager][<%= value[:key] %>]" value="1" <%= "checked" if values[value[:key].to_sym].present?  %> <%= "disabled" unless @user_role.editable?  %> <%= 'data-danger-select-eval=1' if value[:key].to_s == 'select_eval' %> >&nbsp; <%= raw value[:label] %></label>
+                          <label><input type="checkbox" name="rol_values[manager][<%= value[:key] %>]" value="1" <%= "checked" if grants_all || values[value[:key].to_sym].present?  %> <%= "disabled" unless permissions_editable  %> <%= 'data-danger-select-eval=1' if value[:key].to_s == 'select_eval' %> >&nbsp; <%= raw value[:label] %></label>
                           &nbsp;<%= raw cama_html_tooltip(value[:description], 'right') if value[:description].present? %>
                         </div>
                     <% end %>
@@ -77,7 +98,7 @@
 
 
             </div>
-            <% if @user_role.editable? %>
+            <% if permissions_editable %>
                 <div id="checked-actions" class="panel-footer text-right">
                   <a class="btn btn-default btn-sm" data-type="all" href="#"><%= t('camaleon_cms.admin.button.select_all') %></a>
                   <a class="btn btn-default btn-sm" data-type="none" href="#"><%= t('camaleon_cms.admin.button.select_none') %></a>

data/app/views/camaleon_cms/admin/users/form.html.erb

@@ -13,6 +13,9 @@
 
     <div class="row">
         <%= form_for @user, as: "user", url:{action: @user.new_record? ? :create : :update, id: @user.id}, html:{class: 'validate-user  form-horizontal cama_ajax_request', id: "user_form"} do |f| %>
+            <%# A non-admin may not change an admin's password or recovery identifiers (email/username), so
+                the enforcement in UsersController#user_params/#updated_ajax is mirrored here (H10). %>
+            <% credentials_locked = !cama_current_user.may_edit_credentials?(@user) %>
             <div class="col-md-3">
                 <div class="panel panel-default">
                     <div class="panel-body">
@@ -35,11 +38,11 @@
                         </div>
                         <div class="">
                             <label class="control-label"><%= t('camaleon_cms.admin.table.login')%></label>
-                            <%= f.text_field :username, :class => "form-control required" %>
+                            <%= f.text_field :username, :class => "form-control required", disabled: credentials_locked %>
                         </div>
                         <div class="">
                             <label class="control-label"><%= t('camaleon_cms.admin.table.e_mail')%></label>
-                            <%= f.email_field :email, :class => "form-control required email"%>
+                            <%= f.email_field :email, :class => "form-control required email", disabled: credentials_locked %>
                         </div>
                         <% if @user.new_record? %>
                             <div class="">
@@ -54,14 +57,15 @@
                         <div class="">
                             <%= f.label "#{t('camaleon_cms.admin.table.role')}", class: "control-label" %>
                             <div class="">
-                                <%= f.select :role,current_site.user_roles.reorder(:name).decorate.map{|role| [role.the_title, role.slug]}, {}, {:class => "form-control required", disabled: !cama_current_user.role_grantor?(@user)}%>
+                                <%# Only offer the admin role to someone who may actually grant it (H10); keep it listed when editing a user who already holds it so their role still displays. %>
+                                <%= f.select :role, current_site.user_roles.reorder(:name).decorate.reject { |role| role.slug == 'admin' && !cama_current_user.role_grantor?(@user, 'admin') && @user&.role.to_s != 'admin' }.map{|role| [role.the_title, role.slug]}, {}, {:class => "form-control required", disabled: !cama_current_user.role_grantor?(@user)}%>
                             </div>
                         </div>
                         <hr>
                         <div class="">
                             <button type="submit" class="btn btn-success btn-block" ><%= @user.new_record? ? t('camaleon_cms.admin.button.create') : t('camaleon_cms.admin.button.update') %></button>
                         </div>
-                        <% if !@user.new_record? %>
+                        <% if !@user.new_record? && !credentials_locked %>
                             <div class="">
                                 <a href="#" class="btn btn-warning btn-block btn-rounded" data-toggle="modal" data-target="#modal_change_password"><%= t('camaleon_cms.admin.button.change_password') %></a>
                             </div>

data/app/views/camaleon_cms/admin/users/index.html.erb

@@ -45,7 +45,7 @@
                         <%= link_to raw('<i class="fa fa-times"></i>'), { action: :destroy, id: f.id },
                                 method: :delete, data: { confirm: t('camaleon_cms.admin.message.delete_item') }, class: "btn btn-danger btn-xs cama_ajax_request", title: "#{t('camaleon_cms.admin.button.delete')}" %>
                     <% end %>
-                    <%= link_to raw('<i class="fa fa-retweet"></i>'), {action: :impersonate, id: f.id }, class: "btn btn-default btn-xs cama_ajax_request", title: "#{cama_t('camaleon_cms.admin.users.impersonate')}" if can? :impersonate, f %>
+                    <%= link_to raw('<i class="fa fa-retweet"></i>'), {action: :impersonate, id: f.id }, method: :post, class: "btn btn-default btn-xs cama_ajax_request", title: "#{cama_t('camaleon_cms.admin.users.impersonate')}" if can? :impersonate, f %>
                   </td>
                 </tr>
             <% end %>

data/app/views/camaleon_cms/default_theme/partials/_render_custom_field.html.erb

@@ -41,9 +41,15 @@
                 %>
                     <p><%= post.decorate.the_title if post.present? %></p>
                 <% when 'field_attrs'
-                    post = JSON.parse(value) rescue {}
+                    attrs = JSON.parse(value) rescue nil
                 %>
-                    <p><%= raw("<strong>#{post['attr']}: </strong>#{post['attr']}") if post.present? %></p>
+                    <% if attrs.is_a?(Hash) && attrs.present? %>
+                      <%# Security (scan-and-reject policy): attr/value are gated at save like editor %>
+                      <%# values -- CustomFieldsRelationship scans the DECODED JSON members (any shape) -- %>
+                      <%# so stored values equal authored values and render verbatim. Guard on Hash so a %>
+                      <%# non-object JSON value (array/scalar) renders nothing instead of raising a 500. %>
+                      <p><strong><%= raw attrs['attr'] %>: </strong><%= raw attrs['value'] %></p>
+                    <% end %>
                 <% else %>
                     <p><%= value %></p>
             <% end %>

data/app/views/camaleon_cms/default_theme/sitemap.html.erb

@@ -6,7 +6,7 @@
         <li>
             <h3><a href="<%= ptype.the_url %>"><%= ptype.the_title %></a></h3>
             <% if ptype.manage_categories? %>
-                <%= raw(cama_sitemap_cats_generator(ptype.the_categories)) %>
+                <%= raw(cama_sitemap_cats_generator(ptype.the_categories, @r)) %>
             <% else %>
                 <ul>
                     <% ptype.the_posts.decorate.each do |post| next if @r[:skip_post_ids].include?(post.id) %>

data/app/views/camaleon_cms/default_theme/sitemap.xml.builder

@@ -57,7 +57,7 @@ xml.urlset 'xmlns' => 'https://www.sitemaps.org/schemas/sitemap/0.9' do
   @r[:custom].each_value do |item|
     xml.url do
       xml.loc item[:url]
-      xml.lastmod item[:lastmod] || Date.today.to_s
+      xml.lastmod item[:lastmod] || Date.current.to_s
       xml.changefreq item[:changefreq] || 'monthly'
       xml.priority item[:priority] || '0.5'
     end

data/app/views/layouts/camaleon_cms/admin/_header.html.erb

@@ -38,7 +38,7 @@
                                 <a href="<%= cama_admin_profile_edit_path %>" class="btn btn-primary cama_ajax_request"><%= t("camaleon_cms.admin.users.profile") %></a>
                             </div>
                             <div class="pull-right">
-                                <a href="<%= cama_admin_logout_path %>" class="btn btn-danger"><%= t("camaleon_cms.admin.logout.logout") %></a>
+                                <%= button_to t("camaleon_cms.admin.logout.logout"), cama_admin_logout_path, method: :post, class: "btn btn-danger" %>
                             </div>
                         </li>
                     </ul>

data/config/initializers/action_view.rb

@@ -7,11 +7,14 @@ module ActionView
       # fix to add camaleon prefix to search partials and layouts
       def find(name, prefixes = [], partial = false, keys = [], options = {})
         if use_camaleon_partial_prefixes.present?
-          if !partial && !prefixes.present? && File.exist?(name) # fix for windows ==> render file: '....'
+          scoped_prefixes = cama_theme_scoped_prefixes(prefixes)
+          theme_scoped = scoped_prefixes.present?
+          prefixes = scoped_prefixes if theme_scoped
+          if !partial && prefixes.blank? && File.exist?(name) # fix for windows ==> render file: '....'
             # puts "rendering specific file (render file: '....')"
           else
-            prefixes = [''] unless prefixes.present?
-            prefixes = (self.prefixes + prefixes).uniq if prefixes.is_a?(Array)
+            prefixes = [''] if prefixes.blank?
+            prefixes = (self.prefixes + prefixes).uniq if prefixes.is_a?(Array) && !theme_scoped
           end
         end
         @view_paths.find(*cama_args_for_lookup(name, prefixes, partial, keys, options))
@@ -21,8 +24,11 @@ module ActionView
       # fix to add camaleon prefixes on verify template exist
       def exists?(name, prefixes = [], partial = false, keys = [], **options)
         if use_camaleon_partial_prefixes.present?
-          prefixes = [''] unless prefixes.present?
-          prefixes = (prefixes + self.prefixes).uniq if prefixes.is_a?(Array)
+          scoped_prefixes = cama_theme_scoped_prefixes(prefixes)
+          theme_scoped = scoped_prefixes.present?
+          prefixes = scoped_prefixes if theme_scoped
+          prefixes = [''] if prefixes.blank?
+          prefixes = (prefixes + self.prefixes).uniq if prefixes.is_a?(Array) && !theme_scoped
         end
         @view_paths.exists?(*cama_args_for_lookup(name, prefixes, partial, keys, options))
       end
@@ -43,6 +49,37 @@ module ActionView
           [name, prefixes, partial || false, details, details_key, keys]
         end
       end
+
+      # Detects a lookup whose explicit prefixes are *entirely* scoped to the
+      # current (frontend) theme -- i.e. its `themes/<slug>/views...` prefixes
+      # and/or the gem `camaleon_cms/default_theme` fallback, and nothing else
+      # (e.g. a partial rendered from within a theme, or a theme preview). In
+      # that case the lookup is restricted to that theme and the global
+      # `self.prefixes` are NOT merged, so a different theme / per-site override
+      # does not leak in.
+      #
+      # When the explicit prefixes also include non-theme prefixes (e.g. a
+      # plugin front controller rendering its own `plugins/<name>/...`
+      # templates), it returns a blank list, signalling the caller to merge
+      # `self.prefixes` as before -- this keeps the plugin's own
+      # `plugins/<name>/views/...` lookup prefix reachable.
+      #
+      # Known limitation (regression audit M30, deliberately kept): an explicit
+      # `render prefixes:` whose list is *entirely* theme-scoped but whose target
+      # template actually lives under a controller prefix raises MissingTemplate,
+      # because `self.prefixes` are not merged in that case. Merging them would
+      # reopen the per-site-override / cross-theme leak this guard exists to close,
+      # and no stock or ecosystem caller hits it, so the isolation is kept.
+      def cama_theme_scoped_prefixes(prefixes)
+        theme = CurrentRequest.frontend_current_theme
+        slug = theme&.slug
+        return if slug.blank? || prefixes.blank? || !prefixes.is_a?(Array)
+
+        selected = prefixes.select do |prefix|
+          prefix.include?("themes/#{slug}/views") || prefix == 'camaleon_cms/default_theme'
+        end
+        selected if selected.length == prefixes.length
+      end
     end
   end
 end

data/config/initializers/active_record_extension.rb

@@ -1,25 +1,3 @@
-module ActiveRecordExtras
-  module Relation
-    extend ActiveSupport::Concern
-
-    module ClassMethods
-      def update_or_create(attributes = {})
-        assign_or_new(attributes).save
-      end
-
-      def update_or_create!(attributes = {})
-        assign_or_new(attributes).save!
-      end
-
-      def assign_or_new(attributes)
-        obj = first || new
-        obj.assign_attributes(attributes)
-        obj
-      end
-    end
-  end
-end
-
 ActiveRecord::Associations::CollectionProxy.class_eval do
   # order a collection by custom fields
   # Arguments:
@@ -28,9 +6,17 @@ ActiveRecord::Associations::CollectionProxy.class_eval do
   # sample: CamaleonCms::Site.first.posts.sort_by_field("untitled-field-attributes", "desc")
   def sort_by_field(key, order = 'ASC')
     cfr_table = CamaleonCms::CustomFieldsRelationship.table_name
-    joins("LEFT OUTER JOIN #{cfr_table} ON #{cfr_table}.objectid = #{build.class.table_name}.id").where(
-      "#{cfr_table}.custom_field_slug = ? and #{cfr_table}.object_class = ?", key, build.class.name.parseCamaClass
-    ).reorder("#{cfr_table}.value #{order}")
+    # Security (audit 2026-08-11, Tier-2 #8): sort_by_field is a public API themes/plugins reach as
+    # sort_by_field(key, params[:order]), so interpolating `order` straight into ORDER BY was an
+    # injection sink. Whitelist the direction to ASC/DESC and order by a quoted Arel column, so a
+    # hostile direction can neither append extra ORDER BY terms nor raise -- without relying on
+    # ActiveRecord's implicit raw-SQL guard. The whitelist reads the leading token so previously
+    # working spellings (' desc ', 'DESC NULLS LAST') keep their direction; punctuation sticks to
+    # the token ('DESC;...' != 'DESC'), so hostile strings still fail closed to ascending.
+    direction = order.to_s.strip[/\A\S+/]&.casecmp?('DESC') ? :desc : :asc
+    joins("LEFT OUTER JOIN #{cfr_table} ON #{cfr_table}.objectid = #{klass.table_name}.id").where(
+      "#{cfr_table}.custom_field_slug = ? and #{cfr_table}.object_class = ?", key, klass.name.parseCamaClass
+    ).reorder(CamaleonCms::CustomFieldsRelationship.arel_table[:value].public_send(direction))
   end
 
   # Filter by custom field values
@@ -43,8 +29,8 @@ ActiveRecord::Associations::CollectionProxy.class_eval do
   #   .where("#{CamaleonCms::CustomFieldsRelationship.table_name}.value=?", "my_value_for_field")
   def filter_by_field(key, args = {})
     cfr_table = CamaleonCms::CustomFieldsRelationship.table_name
-    res = joins("LEFT OUTER JOIN #{cfr_table} ON #{cfr_table}.objectid = #{build.class.table_name}.id").where(
-      "#{cfr_table}.custom_field_slug = ? and #{cfr_table}.object_class = ?", key, build.class.name.parseCamaClass
+    res = joins("LEFT OUTER JOIN #{cfr_table} ON #{cfr_table}.objectid = #{klass.table_name}.id").where(
+      "#{cfr_table}.custom_field_slug = ? and #{cfr_table}.object_class = ?", key, klass.name.parseCamaClass
     )
     res = res.where("#{cfr_table}.value = ?", args[:value]) if args[:value]
     res

data/config/initializers/assets.rb

@@ -1,34 +1,63 @@
 # Be sure to restart your server when you modify this file.
 
 # Version of your assets, change this if you want to expire all your assets.
-Rails.application.config.assets.version = '1.0'
+Rails.application.config.assets.version = '1.1'
 
 Rails.application.config.tinymce.install = :copy
 
-# Add additional assets to the asset load path
-Rails.application.config.assets.precompile += %w[camaleon_cms/*]
-# Rails.application.config.assets.precompile += %w( themes/*/assets/* )
+# TinyMCE editor icons in development.
+#
+# sprockets-rails >= 3.5 registers `Sprockets::Rails::AssetUrlProcessor`, a `text/css`
+# post-processor that rewrites every relative `url(...)` reference to a digested asset
+# path. TinyMCE's bundled skin (`tinymce/skins/lightgray/skin.min.css`) references its
+# icon font with directory-relative urls such as `url('fonts/tinymce.woff')`. Sprockets
+# resolves `url()` paths against the asset load roots (not the referencing file's own
+# directory), so it cannot find `fonts/tinymce.woff` (its real logical path is
+# `tinymce/skins/lightgray/fonts/...`) and rewrites it to an invalid root path
+# (`/fonts/tinymce.woff`) which 404s, leaving the editor toolbar without icons.
+#
+# In production this never happens: `tinymce.install = :copy` ships the skin as raw static
+# files under `public/assets`, bypassing Sprockets (and this processor) entirely. The bug
+# only surfaces in environments that compile assets on the fly (development).
+#
+# We must NOT disable the processor globally: other stylesheets (e.g. Bootstrap, whose
+# glyphicon @font-face urls are relative) rely on it to produce resolvable digested paths.
+# Instead, swap it for a thin subclass that, for the TinyMCE skin only, first expands the
+# skin's directory-relative font urls into full logical asset paths (prefixing them with the
+# skin's own logical directory) before delegating to the original processor. The original
+# then resolves and digests them correctly. Every other stylesheet is processed unchanged.
+if defined?(Sprockets::Rails::AssetUrlProcessor) && Rails.application.config.assets.compile &&
+   Sprockets.respond_to?(:unregister_postprocessor) && Sprockets.respond_to?(:register_postprocessor)
+  class TinymceSkinSafeAssetUrlProcessor < Sprockets::Rails::AssetUrlProcessor
+    SKIN_MARKER = 'tinymce/skins/'.freeze
+    # Directory-relative `url(...)` references that are not absolute/external/data urls.
+    RELATIVE_URL = %r{url\(\s*["']?(?!(?:#|data|http|/))(?:\./)?(?<path>[^"'\s)]+)\s*["']?\)}
 
-# This will precompile any assets, not just JavaScript (.js, .swf, .css, .scss)
-
-sprockets_3 = !Sprockets.const_defined?(:BabelProcessor)
-if sprockets_3
-  Rails.application.config.assets.precompile << proc do |path|
-    res = false
-    dirname = File.dirname(path)
-    if dirname.start_with?('plugins/') || dirname.start_with?('themes/')
-      name = File.basename(path)
-      content_type = begin
-        MIME::Types.type_for(name).first.content_type
-      rescue StandardError
-        ''
-      end
-      if (path =~ /\.(css|js|svg|ttf|woff|eot|swf|pdf|png|jpg|gif)\z/ ||
-        content_type.scan(%r{(javascript|image/|audio|video|font)}).any?) &&
-         !name.start_with?('_') && !path.include?('/views/')
-        res = true
+    def self.call(input)
+      filename = input[:filename].to_s
+      return super unless filename.include?(SKIN_MARKER)
+
+      logical_dir = File.dirname(filename[filename.index('tinymce/')..])
+      rewritten = input[:data].gsub(RELATIVE_URL) do
+        "url(#{logical_dir}/#{Regexp.last_match(:path)})"
       end
+      super(input.merge(data: rewritten))
     end
-    res
   end
+
+  Sprockets.unregister_postprocessor('text/css', Sprockets::Rails::AssetUrlProcessor)
+  Sprockets.register_postprocessor('text/css', TinymceSkinSafeAssetUrlProcessor)
 end
+
+# Add additional assets to the asset load path
+Rails.application.config.assets.precompile += %w[camaleon_cms/*]
+# Rails.application.config.assets.precompile += %w( themes/*/assets/* )
+
+# Precompile plugin/theme assets that live under app/apps/{plugins,themes}/.../assets.
+# Rails' default precompile rules only cover app/assets, so without this plugin/theme
+# assets are never declared as precompiled and `javascript_include_tag` /
+# `stylesheet_link_tag` raise `AssetNotPrecompiledError` on Sprockets >= 4 when
+# `unknown_asset_fallback` is disabled. Sprockets 4 only resolves exact logical paths
+# (globs/procs are not honored by `asset_precompiled?`), so we enumerate them as strings.
+require 'camaleon_cms/assets_precompile'
+Rails.application.config.assets.precompile += CamaleonCms::AssetsPrecompile.logical_paths

data/config/initializers/custom_initializers.rb

@@ -1,7 +1,7 @@
 # load all custom initializers of plugins or themes
 Rails.application.config.to_prepare do |_config|
   PluginRoutes.all_apps.each do |ap|
-    next unless ap['path'].present?
+    next if ap['path'].blank?
 
     f = File.join(ap['path'], 'config', 'initializer.rb')
     load f if File.exist?(f)

data/config/locales/camaleon_cms/admin/ar.yml

@@ -136,6 +136,7 @@ ar:
         message:
           success: 'Welcome!!!'
           fail: 'Username or Password incorrect'
+          too_many_attempts: 'محاولات فاشلة كثيرة جدًا. يرجى المحاولة مرة أخرى لاحقًا.'
           forgot_url_incorrect: 'URL incorrect'
           forgot_expired: 'Reset expired.'
           hello: 'Hello'

data/config/locales/camaleon_cms/admin/de.yml

@@ -135,6 +135,7 @@ de:
         message:
           success: 'Willkommen!!!'
           fail: 'Benutzername oder Passwort falsch'
+          too_many_attempts: 'Zu viele fehlgeschlagene Versuche. Bitte versuchen Sie es später erneut.'
           forgot_url_incorrect: 'URL inkorrekt'
           forgot_expired: 'Resetfunktion abgelaufen'
           hello: 'Hallo'