camaleon_cms 2.9.2 → 2.9.4

data/config/locales/camaleon_cms/admin/en.yml

@@ -100,8 +100,12 @@ en:
         custom_group_support_multiple: Support multiple groups
         message:
           custom_group_error: 'Error custom field group'
+          value_rejected_html: "The '%{slug}' field contains HTML that is not allowed for your role (for example scripts, event handlers or embeds). Remove it, or ask an administrator for the unfiltered-content permission."
+          value_rejected_uri: "The '%{slug}' field contains a script-capable URL (javascript:/data:), which is not allowed."
+          value_too_large: "The '%{slug}' field is too large to store; please shorten it."
           custom_created: 'The custom field group has been created.'
           custom_updated: 'The custom field group has been updated.'
+          invalid_placement: 'Select where to display this group. The selected target does not belong to this site.'
         fields:
           text_box: 'Text Box'
           private_file: Private File
@@ -170,11 +174,19 @@ en:
           subject_email: 'Reset your access'
           send_mail_succes: 'Send email reset success.'
           send_mail_error: 'Not found email address.'
+          password_reset_requested: 'If an account matches that email, a password reset link has been sent.'
           invalid_caption: 'Invalid captcha'
           email_not_validated: 'Email has not been validated.'
           confirm_email_token_incorrect: 'URL incorrect'
           confirm_email_token_expired: 'Confirm email URL expired'
           confirm_email_success: 'Confirm email success!'
+          reauth_failed: 'Incorrect password. Please try again.'
+          too_many_attempts: 'Too many failed attempts. Please try again later.'
+        back_to_parent:
+          title: 'Return to your account'
+          instructions: 'You are currently working as %{impersonated}. Enter the password for your own account to return to it, or log out completely.'
+          submit: 'Return to my account'
+          logout: 'Log out completely'
         personal_info: 'Personal info'
         please_login: 'Please login'
         reset_password: 'reset password'
@@ -200,6 +212,8 @@ en:
         out: 'Out'
         logout: 'Logout'
         logout_html: 'Log <strong>Out</strong>?'
+        confirm_title: 'Log out?'
+        confirm_instructions: 'You are about to end your session. Continue?'
         message:
           closed: 'Session Closed'
       media:
@@ -273,6 +287,9 @@ en:
         new_site: 'New Site'
         edit_site: 'Edit Site'
         update: 'Update'
+      shortcodes:
+        message:
+          rejected: "This content contains a shortcode that your role is not allowed to publish. Remove the shortcode, or ask an administrator for the shortcode-content permission."
       post:
         add_tag: 'Add a Tag'
         clone: 'Clone'
@@ -281,6 +298,8 @@ en:
         label_required: 'Required Label'
         placeholder_required: 'Required Placeholder'
         message:
+          content_rejected: 'contains HTML that is not allowed for your role (for example scripts, event handlers or embeds). Remove it, or ask an administrator for the unfiltered-content permission.'
+          content_too_large: 'is too large to store; please shorten it.'
           created: 'The %{post_type} has been created.'
           updated: 'The %{post_type} has been updated.'
           deleted: 'The %{post_type} has been removed.'
@@ -487,10 +506,24 @@ en:
         message:
           error: 'Not found site'
           created: 'The site has been created.'
+          created_with_admin: 'Site created. New administrator password: %{password}. Change it after signing in.'
           updated: 'The site has been updated.'
           deleted: 'Correct Deleted'
           enter_key_domain: 'Enter a key or a domain'
           enter_key_domain_empty: 'Enter a key (site2) or a domain (my_domain.com). Key will be the name of your subdomain.'
+      installer:
+        setup_token: 'Setup token'
+        setup_token_hint: 'Required for remote installations; leave blank when installing locally. Printed in the server log and saved to tmp/camaleon_setup_token on first run.'
+        invalid_setup_token: 'A valid setup token is required to install. See the server log or tmp/camaleon_setup_token.'
+        welcome_title: 'Your site was created successfully.'
+        visit_frontend: 'Visit Frontend:'
+        visit_admin: 'Visit Admin panel'
+        here: 'Here.'
+        user_label: 'User:'
+        password_label: 'Password:'
+        copy: 'Copy'
+        copied: 'Copied!'
+        must_change_notice: 'Save this password now — it is shown only once. You will be asked to change it when you first sign in.'
       signin:
         message:
           enter_username_password: 'You must enter a username and/or password'
@@ -628,6 +661,7 @@ en:
           created: 'The user has been created.'
           updated: 'The user has been updated.'
           deleted: 'The user has been deleted.'
+          must_change_password: 'Please choose a new password before continuing.'
           incorrect_old_password: 'Incorrect old password'
           rol_error: 'Not found group user.'
           rol_created: 'The user role has been created.'
@@ -710,6 +744,8 @@ en:
         max: 'Please enter a value less than or equal to {0}.'
         min: 'Please enter a value greater than or equal to {0}.'
         username_alphanumeric: 'Username needs to start with an alphanumeric character'
+        https_only_url: 'Only HTTPS URLs are allowed'
+        path_traversal: 'URL path contains path traversal sequences'
       widgets:
         create_widget: 'Create Widget'
         create_sidebar: 'Create Sidebar'

data/config/locales/camaleon_cms/admin/es.yml

@@ -125,6 +125,7 @@ es:
         message:
           success: 'Bienvenido!!!'
           fail: 'Usuario o contraseña incorrectos'
+          too_many_attempts: 'Demasiados intentos fallidos. Vuelva a intentarlo más tarde.'
           forgot_url_incorrect: 'URL incorrecta'
           forgot_expired: 'Restablecer caducado.'
           hello: 'Hola'

data/config/locales/camaleon_cms/admin/fr.yml

@@ -128,6 +128,7 @@ fr:
         message:
           success: 'Bienvenue !!!'
           fail: 'Nom ou mot de passe incorrect'
+          too_many_attempts: 'Trop de tentatives échouées. Veuillez réessayer plus tard.'
           forgot_url_incorrect: 'URL incorrecte'
           forgot_expired: 'Réinitialisation expirée.'
           hello: 'Bonjour'

data/config/locales/camaleon_cms/admin/it.yml

@@ -135,6 +135,7 @@ it:
         message:
           success: 'Benvenuto!!!'
           fail: 'Username o Password errati'
+          too_many_attempts: 'Troppi tentativi falliti. Riprova più tardi.'
           forgot_url_incorrect: 'URL errato'
           forgot_expired: 'Reset scaduto.'
           hello: 'Ciao'

data/config/locales/camaleon_cms/admin/nl.yml

@@ -126,6 +126,7 @@ nl:
         message:
           success: 'Welkom!!!'
           fail: 'Gebruikersnaam of wachtwoord incorrect'
+          too_many_attempts: 'Te veel mislukte pogingen. Probeer het later opnieuw.'
           forgot_url_incorrect: 'URL incorrect'
           forgot_expired: 'Reset verlopen.'
           hello: 'Hallo'

data/config/locales/camaleon_cms/admin/pt-BR.yml

@@ -126,6 +126,7 @@ pt-BR:
         message:
           success: 'Bem-vindo!!!'
           fail: 'Usuário ou senha incorreta'
+          too_many_attempts: 'Muitas tentativas malsucedidas. Tente novamente mais tarde.'
           forgot_url_incorrect: 'URL incorreta'
           forgot_expired: 'Expirou o prazo para redefinir a senha.'
           hello: 'Olá'

data/config/locales/camaleon_cms/admin/pt.yml

@@ -124,6 +124,7 @@ pt:
         message:
           success: 'Benvindo!!!'
           fail: 'Utilizador ou password incorreta'
+          too_many_attempts: 'Demasiadas tentativas falhadas. Tente novamente mais tarde.'
           forgot_url_incorrect: 'Endereço incorreto'
           forgot_expired: 'Expirou o prazo para redefinir a password.'
           hello: 'Olá'

data/config/locales/camaleon_cms/admin/ru.yml

@@ -137,6 +137,7 @@ ru:
         message:
           success: 'Добро пожаловать!!!'
           fail: 'Неверное имя пользователя или пароль'
+          too_many_attempts: 'Слишком много неудачных попыток. Повторите попытку позже.'
           forgot_url_incorrect: 'Неверный URL'
           forgot_expired: 'Сброс истек.'
           hello: 'Привет'

data/config/locales/camaleon_cms/admin/uk.yml

@@ -134,6 +134,7 @@ uk:
         message:
           success: 'Ласкаво просимо !!!'
           fail: "Неправильне ім'я користувача або пароль"
+          too_many_attempts: 'Забагато невдалих спроб. Спробуйте пізніше.'
           forgot_url_incorrect: 'Неправильний URL'
           forgot_expired: 'Скидання закінчилось.'
           hello: 'Привіт'

data/config/locales/camaleon_cms/admin/zh-CH.yml

@@ -143,6 +143,7 @@ zh-CN:
         message:
           success: '欢迎登录!!!'
           fail: '用户名或密码不正确'
+          too_many_attempts: '尝试次数过多，请稍后再试。'
           forgot_url_incorrect: '链接错误'
           forgot_expired: '重置链接已过期。'
           hello: '您好'

data/config/routes/admin.rb

@@ -8,17 +8,22 @@ Rails.application.routes.draw do
         get 'search'
         get 'login' => 'sessions#login'
         post 'login' => 'sessions#login_post'
-        get 'logout' => 'sessions#logout'
+        # Security (audit M6): logout changes state, so it acts only over POST. The GET renders a
+        # confirmation page instead of 404ing -- frontend themes across the ecosystem link this
+        # path -- and the impersonation flow keeps its redirect (see SessionsController#logout).
+        match 'logout' => 'sessions#logout', via: %i[get post]
+        match 'back_to_parent' => 'sessions#back_to_parent', via: %i[get post]
         match 'forgot' => 'sessions#forgot', via: %i[get post patch]
-        match 'confirm_email' => 'sessions#confirm_email', via: %i[get post path]
+        match 'confirm_email' => 'sessions#confirm_email', via: %i[get post patch]
         match 'register' => 'sessions#register', via: %i[get post patch]
         match 'api/:method', action: :api, via: %i[get post], as: :api
 
         resources :post_type, as: :post_type do
           resources :posts, controller: 'posts' do
             # resources :comments
-            get :trash
-            get :restore
+            # Security (audit M6): state-changing member actions must not ride GET links.
+            patch :trash
+            patch :restore
             collection do
               match 'ajax', via: %i[get post patch]
             end
@@ -41,7 +46,8 @@ Rails.application.routes.draw do
         match 'profile/edit' => 'users#profile_edit', via: %i[get post patch]
         resources :users, controller: 'users' do
           patch 'updated_ajax'
-          get :impersonate, on: :member
+          # Security (audit M6): forces a session switch -- the highest-value CSRF target here.
+          post :impersonate, on: :member
         end
 
         resources :user_roles, controller: 'user_roles' do
@@ -53,11 +59,11 @@ Rails.application.routes.draw do
             collection do
               post 'get_items/:key', action: :get_items, as: :get_items
               post 'reorder'
-              get 'list'
+              match 'list', via: %i[get post]
             end
           end
           get 'site'
-          get 'test_email'
+          post 'test_email' # Security (audit M6): sends mail; must not be a CSRF-able GET
           get 'theme'
           post 'save_theme'
           get 'languages'
@@ -73,25 +79,33 @@ Rails.application.routes.draw do
           resources :comments, controller: 'comments' do
             get 'answer'
             post 'save_answer'
-            get 'toggle_status'
+            patch 'toggle_status' # Security (audit M6): flips moderation state
           end
         end
 
         namespace :appearances do
-          match 'widgets', via: %i[get delete]
+          # Security (audit M6): this legacy widgets surface predates the widgets/{main,sidebar,
+          # assign} controllers (its target controller is long gone) but still declared delete
+          # endpoints reachable over CSRF-exempt GET. The non-GET verbs keep the paths and helpers
+          # routable for any external binding.
+          delete 'widgets'
           match 'widgets_save', via: %i[post patch]
-          match 'widget_delete', via: %i[get patch]
+          patch 'widget_delete'
           get 'render_form'
 
           resources :themes, only: [:index] do
             collection do
               get 'preview'
               # match "settings", via: [:get, :post, :patch]
-              match 'load_data', via: %i[get post patch]
+              # Security (audit M6): load_data clears and re-imports post types, nav menus and sliders
+              # -- a state change that must not ride a CSRF-exempt GET link.
+              match 'load_data', via: %i[post patch]
             end
           end
           resources :nav_menus, except: :show do
-            get 'item_delete/:id' => :delete_menu_item, as: :delete_menu_item
+            # Security (audit M6): destroys a menu item -- must not ride a CSRF-exempt GET. The
+            # admin JS sends a token-bearing DELETE (nav_menu.js).
+            delete 'item_delete/:id' => :delete_menu_item, as: :delete_menu_item
             get 'custom_settings/:id' => :custom_settings, as: :custom_settings
             post 'save_custom_settings/:id' => :save_custom_settings, as: :save_custom_settings
             get 'edit_menu_item/:id' => :edit_menu_item, as: :edit_menu_item
@@ -114,8 +128,10 @@ Rails.application.routes.draw do
         end
 
         resources :plugins, only: %i[index destroy] do
-          get 'toggle', on: :collection
-          get 'upgrade'
+          # Security (audit M6): activating/deactivating and upgrading a plugin run install and
+          # upgrade hooks -- state changes, not reads.
+          patch 'toggle', on: :collection
+          post 'upgrade'
         end
 
         # installer
@@ -125,7 +141,9 @@ Rails.application.routes.draw do
         end
 
         resources :media, only: [:index] do
-          match 'crop', via: :all, on: :collection
+          # Security (audit M6): crop writes a cropped upload and can rewrite a user avatar
+          # (saved_avatar); via: :all admitted every verb, the CSRF-exempt GET/HEAD included.
+          post 'crop', on: :collection
           get 'ajax', on: :collection
           get 'download_private_file', on: :collection
           post 'upload', on: :collection

data/config/routes/frontend.rb

@@ -29,11 +29,12 @@ Rails.application.routes.draw do
           multilingual_segment = PluginRoutes.all_translations('routes.category', default: 'category')
           request.params[:category_id].match(/[0-9]+/) && request.params[:label_cat].in?(multilingual_segment)
         }
-        get ':post_type_title/:label_cat/:category_id-:title/:slug' => :post, as: 'post_of_category_post_type', constraints: lambda { |request|
-          multilingual_segment = PluginRoutes.all_translations('routes.category', default: 'category')
-          request.params[:post_type_title].match(/^(?!(#{PluginRoutes.all_locales})$)[\w.-]+$/) &&
-            request.params[:category_id].match(/[0-9]+/) && request.params[:label_cat].in?(multilingual_segment)
-        }
+        get ':post_type_title/:label_cat/:category_id-:title/:slug' => :post, as: 'post_of_category_post_type',
+            constraints: lambda { |request|
+              multilingual_segment = PluginRoutes.all_translations('routes.category', default: 'category')
+              request.params[:post_type_title].match(/^(?!(#{PluginRoutes.all_locales})$)[\w.-]+$/) &&
+                request.params[:category_id].match(/[0-9]+/) && request.params[:label_cat].in?(multilingual_segment)
+            }
         get ':label/:post_tag_id-:title' => :post_tag, as: 'post_tag', constraints: lambda { |request|
           multilingual_segment = PluginRoutes.all_translations('routes.tag', default: 'tag')
           request.params[:post_tag_id].match(/[0-9]+/) && request.params[:label].in?(multilingual_segment)
@@ -44,12 +45,14 @@ Rails.application.routes.draw do
         }
         get ':label/:post_tag_slug' => :post_tag, as: 'post_tag_simple', constraints: lambda { |request|
           multilingual_segment = PluginRoutes.all_translations('routes.tag', default: 'tag')
-          request.params[:post_tag_slug].match(%r{[a-zA-Z0-9_=\s\-/]+}) && request.params[:label].in?(multilingual_segment)
-        }
-        get ':label/:user_id-:user_name' => :profile, as: :profile, defaults: { label: 'profile' }, constraints: lambda { |request|
-          multilingual_segment = PluginRoutes.all_translations('routes.profile', default: 'profile') | %w[profile]
-          request.params[:user_id].match(/[0-9]+/) && request.params[:label].in?(multilingual_segment)
+          request.params[:post_tag_slug].match(%r{[a-zA-Z0-9_=\s\-/]+}) &&
+            request.params[:label].in?(multilingual_segment)
         }
+        get ':label/:user_id-:user_name' => :profile, as: :profile, defaults: { label: 'profile' },
+            constraints: lambda { |request|
+              multilingual_segment = PluginRoutes.all_translations('routes.profile', default: 'profile') | %w[profile]
+              request.params[:user_id].match(/[0-9]+/) && request.params[:label].in?(multilingual_segment)
+            }
         get ':label' => :search, as: :search, defaults: { label: 'search' }, constraints: lambda { |request|
           multilingual_segment = PluginRoutes.all_translations('routes.search', default: 'search') | %w[search]
           request.params[:label].in?(multilingual_segment)
@@ -71,11 +74,14 @@ Rails.application.routes.draw do
         # post types
         controller 'camaleon_cms/frontend' do
           PluginRoutes.get_sites.each do |s|
-            s.post_types.pluck(:slug, :id).each do |pt_slug, pt_id|
-              get ':post_type_slug' => :post_type, as: "post_type_#{pt_id}", post_type_id: pt_id, constraints: lambda { |request|
-                multilingual_segment = PluginRoutes.all_translations("routes.post_types.#{pt_slug}", default: pt_slug)
-                request.params[:post_type_slug].in?(multilingual_segment)
-              }
+            # get_sites eager-loads :post_types, so map in memory instead of a per-site pluck query.
+            s.post_types.map { |pt| [pt.slug, pt.id] }.each do |pt_slug, pt_id|
+              get ':post_type_slug' => :post_type, as: "post_type_#{pt_id}", post_type_id: pt_id,
+                  constraints: lambda { |request|
+                    multilingual_segment =
+                      PluginRoutes.all_translations("routes.post_types.#{pt_slug}", default: pt_slug)
+                    request.params[:post_type_slug].in?(multilingual_segment)
+                  }
             end
           end
         end

data/lib/camaleon_cms/assets_precompile.rb

@@ -0,0 +1,86 @@
+module CamaleonCms
+  # Helper used by config/initializers/assets.rb to declare plugin/theme assets as
+  # precompiled.
+  #
+  # Plugin and theme assets can live in three different layouts:
+  #   * host app:               <app>/app/apps/{plugins,themes}/<key>/assets/...
+  #   * the camaleon_cms gem:   <gem>/app/apps/{plugins,themes}/<key>/assets/...
+  #   * separate "gem_mode" gems: <gem>/app/assets/<type>/{plugins,themes}/<key>/...
+  #     (e.g. cama_contact_form ships app/assets/javascripts/plugins/cama_contact_form/...)
+  #
+  # Rails' default Sprockets precompile rules only cover the app/assets top level, so none
+  # of these are declared as precompiled. On modern Sprockets (>= 4) with
+  # `config.assets.unknown_asset_fallback = false`, requesting such an asset (e.g. via
+  # `javascript_include_tag "plugins/visibility_post/assets/js/form.js"`) raises
+  # `Sprockets::Rails::Helper::AssetNotPrecompiledError` unless it is declared.
+  #
+  # We enumerate the concrete asset files from the *real* Sprockets load paths and declare
+  # their exact logical paths as strings. Strings are the canonical, Sprockets-version
+  # agnostic form (work on both 3.x and 4.x). Scanning `config.assets.paths` (instead of a
+  # couple of hardcoded directories) ensures host, gem-bundled and separately gem-packaged
+  # (gem_mode) plugins/themes are all covered, matching the reach of the old precompile
+  # `proc` this replaced. Because the declaration is computed from the on-disk files, every
+  # installed plugin/theme is declared regardless of whether it is currently active, so
+  # switching themes / enabling-disabling plugins (DB-only operations) never requires a
+  # recompile.
+  module AssetsPrecompile
+    PRECOMPILE_EXTENSIONS = /\.(css|js|svg|ttf|woff|woff2|eot|otf|swf|pdf|png|jpe?g|gif|ico|mp3|mp4|webm|ogg|webp)\z/i
+    PRECOMPILE_CONTENT_TYPES = %r{(javascript|image/|audio|video|font)}
+
+    module_function
+
+    # path: logical asset path relative to an asset load path, e.g.
+    #   "plugins/visibility_post/assets/js/form.js", "themes/my_theme/assets/css/app.css"
+    #   or "plugins/cama_contact_form/admin_editor.js" (gem_mode layout).
+    # Returns true when the asset must be precompiled.
+    def match?(path)
+      dirname = File.dirname(path)
+      return false unless dirname.start_with?('plugins/', 'themes/')
+
+      name = File.basename(path)
+      return false if name.start_with?('_') || path.include?('/views/')
+
+      PRECOMPILE_EXTENSIONS.match?(path) || content_type_for(name).scan(PRECOMPILE_CONTENT_TYPES).any?
+    end
+
+    def content_type_for(name)
+      MIME::Types.type_for(name).first.content_type
+    rescue StandardError
+      ''
+    end
+
+    # Enumerate the logical paths of every plugin/theme asset found under the given asset
+    # roots. For each root, only the `plugins/` and `themes/` subtrees are scanned, and each
+    # file is converted to its logical path (relative to the root) and filtered by `match?`.
+    def logical_paths(asset_roots = default_asset_roots)
+      asset_roots.flat_map do |root|
+        root = root.to_s
+        next [] if root.empty? || !Dir.exist?(root)
+
+        prefix = "#{root.chomp('/')}/"
+        Dir.glob(File.join(root, '{plugins,themes}', '**', '*')).filter_map do |file|
+          next unless File.file?(file)
+
+          logical = file.delete_prefix(prefix)
+          logical if match?(logical)
+        end
+      end.uniq
+    end
+
+    # Asset roots to scan: the configured Sprockets load paths (which cover host,
+    # gem-bundled and gem_mode plugin/theme assets), plus the host and camaleon_cms gem
+    # `app/apps` folders as a fallback in case the asset paths are not yet populated when
+    # this is called during initialization.
+    def default_asset_roots
+      roots = []
+      if defined?(Rails) && Rails.respond_to?(:application) && Rails.application
+        roots.concat(Array(Rails.application.config.assets.paths).map(&:to_s))
+      end
+      roots << Rails.root.join('app/apps').to_s if defined?(Rails) && Rails.respond_to?(:root) && Rails.root
+      # rubocop:disable Style/GlobalVars
+      roots << File.join($camaleon_engine_dir, 'app', 'apps') if defined?($camaleon_engine_dir) && $camaleon_engine_dir
+      # rubocop:enable Style/GlobalVars
+      roots.uniq
+    end
+  end
+end

data/lib/camaleon_cms/captcha_image_generation.rb

@@ -0,0 +1,65 @@
+# frozen_string_literal: true
+
+module CamaleonCms
+  # Captcha challenge/image generation shared by the two entry points that expose it:
+  # CamaleonCms::RuntimeCaptchaImageConcern (the controller stack serving GET /captcha) and
+  # CamaleonCms::CaptchaHelper (views and the runtime helper surface). Both include this
+  # module, so a captcha hardening fix cannot land in one entry point and silently miss the
+  # copy that actually runs. Parity between the entry points is guarded by
+  # spec/lib/camaleon_cms/captcha_implementation_parity_spec.rb.
+  module CaptchaImageGeneration
+    # The requested length is clamped so an attacker-supplied ?len= can neither make the
+    # worker build an arbitrarily large challenge string for ImageMagick to draw (H4
+    # resource exhaustion) nor shrink the answer space to a brute-forceable size (H3).
+    CAPTCHA_MIN_LENGTH = 4
+    CAPTCHA_MAX_LENGTH = 8
+    CAPTCHA_DEFAULT_LENGTH = 5
+
+    # build a captcha image
+    # @param [Integer, nil] len Number of characters to include in captcha (default: 5)
+    # @return [MiniMagick::Image]
+    def cama_captcha_build(len = CAPTCHA_DEFAULT_LENGTH)
+      img = MiniMagick::Image.open(resolve_captcha_file("captcha_#{rand(12)}.jpg"))
+      text = cama_rand_str(cama_captcha_length(len))
+      # Single active challenge: replace, never accumulate. An append-only list let any previously
+      # issued answer keep verifying, which (with a shrinkable length) made the captcha bypassable (H3).
+      session[:cama_captcha] = [text]
+      img.combine_options do |c|
+        c.gravity('Center')
+        c.fill('#FFFFFF')
+        c.draw("text 0,5 #{text}")
+        c.font(resolve_captcha_file('bumpyroad.ttf'))
+        c.pointsize('30')
+      end
+    end
+
+    private
+
+    # Clamp a requested captcha length into the safe range; a non-numeric or absent value
+    # falls back to the default.
+    def cama_captcha_length(len)
+      return CAPTCHA_DEFAULT_LENGTH unless len.to_s.match?(/\A\d+\z/)
+
+      len.to_i.clamp(CAPTCHA_MIN_LENGTH, CAPTCHA_MAX_LENGTH)
+    end
+
+    def resolve_captcha_file(filename)
+      base_dir = $camaleon_engine_dir.presence || Rails.root.to_s # rubocop:disable Style/GlobalVars
+      File.join(base_dir, 'lib', 'captcha', filename)
+    end
+
+    # generate random string for captcha
+    # len: length of characters, default 6
+    def cama_rand_str(len = 6)
+      alphabets = [('A'..'Z').to_a].flatten!
+      alphanumerics = [('A'..'Z').to_a, ('1'..'9').to_a].flatten!
+      # Security (audit Low): draw from a CSPRNG. Kernel#rand is a Mersenne-Twister PRNG whose future
+      # output is predictable from observed samples, so a seen challenge weakened the next one.
+      str = alphabets[SecureRandom.random_number(alphabets.size)]
+      (len.to_i - 1).times do
+        str << alphanumerics[SecureRandom.random_number(alphanumerics.size)]
+      end
+      str
+    end
+  end
+end