camaleon_cms 2.9.2 → 2.9.4

data/lib/ext/string.rb

@@ -109,7 +109,7 @@ class String
     name = tr('\\', '/') # work-around for IE
     name = File.basename(name)
     name = name.gsub(sanitize_regexp, '_')
-    name = "_#{name}" if name =~ /\A\.+\z/
+    name = "_#{name}" if /\A\.+\z/.match?(name)
     name = 'unnamed' if name.empty?
     name
   end
@@ -122,7 +122,9 @@ class String
   end
 
   # convert url into custom url with postfix,
-  # sample: "http://localhost/company/rack_multipart20160124_2288_8xcdjs.jpg".cama_add_postfix_url('thumbs/') into http://localhost/company/thumbs/rack_multipart20160124_2288_8xcdjs.jpg
+  # sample:
+  # "http://localhost/company/rack_multipart20160124_2288_8xcdjs.jpg".cama_add_postfix_url('thumbs/')
+  #   into http://localhost/company/thumbs/rack_multipart20160124_2288_8xcdjs.jpg
   def cama_add_postfix_url(postfix)
     File.join(File.dirname(self), "#{postfix}#{File.basename(self)}")
   end
@@ -135,9 +137,12 @@ class String
 
   # Parse the url to get the image version
   #   version_name: (String, default empty) version name,
-  #     if this is empty, this will return the image version for thumb of the image, sample: 'http://localhost/my_image.png'.cama_parse_image_version('') => http://localhost/thumb/my_image.png
-  #     if this is present, this will return the image version generated, sample: , sample: 'http://localhost/my_image.png'.cama_parse_image_version('200x200') => http://localhost/thumb/my_image_200x200.png
-  #   check_url: (boolean, default false) if true the image version will be verified, i.e. if the url exist will return version url, if not will return current url
+  #     if this is empty, this will return the image version for thumb of the image, sample:
+  #  'http://localhost/my_image.png'.cama_parse_image_version('') => http://localhost/thumb/my_image.png
+  #     if this is present, this will return the image version generated, sample:
+  #  'http://localhost/my_image.png'.cama_parse_image_version('200x200') => http://localhost/thumb/my_image_200x200.png
+  #   check_url: (boolean, default false) if true the image version will be verified,
+  #              i.e. if the url exist will return version url, if not will return current url
   def cama_parse_image_version(version_name = '', check_url = false)
     res = File.join(File.dirname(self), 'thumb', "#{File.basename(self).parameterize}#{File.extname(self)}")
     res = res.cama_add_postfix_file_name("_#{version_name}") if version_name.present?

data/lib/ext/translator.rb

@@ -6,7 +6,8 @@ class String
   # The default value if translation is not provided is all text
   #
   #  $ WpPost.post_title
-  #  $ => "<!--:en-->And this is how the Universe ended.<!--:--><!--:fr-->Et c'est ainsi que l'univers connu cessa d'exister.<!--:-->"
+  #  $ => "<!--:en-->And this is how the Universe ended.<!--:-->" \
+  #       "<!--:fr-->Et c'est ainsi que l'univers connu cessa d'exister.<!--:-->"
   #  $ I18n.locale = :en
   #  $ WpPost.post_title.translate
   #  $ => "And this is how the Universe ended."
@@ -33,6 +34,13 @@ class String
   # return hash of translations for this string
   # sample: {es: "hola mundo", en: "Hello World"}
   def translations
+    # A frozen receiver cannot carry the memo: Ruby 3.4's nil.to_s returns a frozen —
+    # and process-wide shared — empty string, and every literal in a file with the
+    # frozen_string_literal magic comment is frozen too. Parse without memoizing for
+    # those rather than raising FrozenError (memoizing on a shared instance would be
+    # wrong even where it is permitted).
+    return split_locales if frozen?
+
     @translations ||= split_locales
   end
 
@@ -40,7 +48,7 @@ class String
   # sample: ["hola mundo", "Hello World"]
   def translations_array
     r = translations.map { |_key, value| value }
-    r.present? ? r : [self]
+    r.presence || [self]
   end
 
   protected

data/lib/generators/camaleon_cms/gem_plugin_template/app/controllers/plugins/my_plugin/admin_controller.rb

@@ -2,6 +2,8 @@ module Plugins
   module PluginClass
     class AdminController < CamaleonCms::Apps::PluginsAdminController
       include Plugins::PluginClass::MainHelper
+      # Confines submitted field_options to slugs the plugin actually registered (see save_settings).
+      include CamaleonCms::Admin::CustomFieldsConcern
       def index; end
 
       # show settings form
@@ -11,7 +13,9 @@ module Plugins
       def save_settings
         @plugin.set_options(params[:options]) if params[:options].present? # save option values
         @plugin.set_metas(params[:metas]) if params[:metas].present? # save meta values
-        @plugin.set_field_values(params[:field_options]) if params[:field_options].present? # save custom field values
+        # Save custom field values, confined to this plugin's registered slugs (like core's admin
+        # controllers) so a forged request cannot write values for slugs the plugin never defined.
+        @plugin.set_field_values(cama_permitted_field_options('Plugin')) if params[:field_options].present?
         redirect_to url_for(action: :settings), notice: 'Settings Saved Successfully'
       end
       # add custom methods below ....

data/lib/generators/camaleon_cms/install_generator.rb

@@ -1,5 +1,6 @@
 require 'rails/generators/base'
 require 'securerandom'
+
 module CamaleonCms
   module Generators
     class InstallGenerator < Rails::Generators::Base
@@ -9,13 +10,13 @@ module CamaleonCms
       def create_initializer_file
         copy_file 'system.json', 'config/system.json'
         copy_file 'plugin_routes.rb', 'lib/plugin_routes.rb'
-        Dir.mkdir Rails.root.join('app', 'apps').to_s unless Dir.exist?(Rails.root.join('app', 'apps').to_s)
+        FileUtils.mkdir_p(Rails.root.join('app/apps'))
         directory('apps', 'app/apps')
         directory(File.join($camaleon_engine_dir, 'app/apps/themes').to_s, 'app/apps/themes')
 
         sprokects_4_or_newer = defined?(Sprockets::BabelProcessor)
         if sprokects_4_or_newer
-          assets_config_dir = Rails.root.join('app', 'assets', 'config')
+          assets_config_dir = Rails.root.join('app/assets/config')
           FileUtils.makedirs(assets_config_dir)
           assets_config_file = assets_config_dir.join('manifest.js')
           FileUtils.touch(assets_config_file) unless File.file?(assets_config_file)
@@ -27,7 +28,7 @@ module CamaleonCms
             //= link_tree ../../apps/themes/default/assets
             //= link_tree ../../apps/themes/new/assets
           ASSETS
-          append_to_file Rails.root.join('config', 'initializers', 'assets.rb'),
+          append_to_file Rails.root.join('config/initializers/assets.rb'),
                          <<~PRECOMPILE_MANIFEST
 
                            Rails.application.config.assets.precompile += %w( manifest.js )
@@ -35,7 +36,9 @@ module CamaleonCms
         end
 
         append_to_file 'Gemfile' do
-          "\n\n#################### Camaleon CMS include all gems for plugins and themes #################### \nrequire_relative './lib/plugin_routes' \ninstance_eval(PluginRoutes.draw_gems)"
+          "\n\n#################### Camaleon CMS include all gems for plugins and themes #################### \n" \
+            "require_relative './lib/plugin_routes' \n" \
+            'instance_eval(PluginRoutes.draw_gems)'
         end
       end
     end

data/lib/generators/camaleon_cms/install_template/plugin_routes.rb

@@ -2,22 +2,15 @@ require 'json'
 class PluginRoutes
   # draw "all" gems registered for the plugins or themes and camaleon gems
   def self.draw_gems
-    res = []
-    dirs = [] + Dir["#{apps_dir}/plugins/*"] + Dir["#{apps_dir}/themes/*"]
+    gemfiles = Dir["#{apps_dir}/{plugins,themes}/*/config/Gemfile"]
 
-    dirs.each do |path|
-      next if ['.', '..'].include?(path)
-
-      g = File.join(path, 'config', 'Gemfile')
-      res << File.read(g) if File.exist?(g)
-    end
-    res.join("\n")
+    # map + read + join is very memory efficient for strings
+    # Ensuring a newline between files prevents syntax errors if a file lacks a trailing newline
+    gemfiles.map { |gem| File.read(gem, encoding: 'UTF-8') }.join("\n\n")
   end
 
   # return apps directory path
   def self.apps_dir
-    dir = File.dirname(__FILE__).to_s.split('/')
-    dir.pop
-    "#{dir.join('/')}/app/apps"
+    File.join(File.dirname(__dir__), 'app', 'apps')
   end
 end

data/lib/generators/camaleon_cms/theme_generator.rb

@@ -1,5 +1,6 @@
 require 'rails/generators/base'
 require 'securerandom'
+
 module CamaleonCms
   module Generators
     class ThemeGenerator < Rails::Generators::Base
@@ -12,19 +13,13 @@ module CamaleonCms
         if behavior == :revoke
           if Dir.exist?(theme_folder)
             FileUtils.rm_rf(theme_folder)
-            puts 'Theme destroyed successfully'
+            say 'Theme destroyed successfully'
           else
-            puts "This theme doesn't exist"
+            say "This theme doesn't exist"
           end
-
         elsif Dir.exist?(theme_folder)
-
-          puts 'This theme already exist'
+          say 'This theme already exist'
         else
-
-          theme_folder = Rails.root.join('app', 'apps', 'themes', get_theme_name)
-          return puts("There is already a theme with the same name in: #{theme_folder}") if Dir.exist?(theme_folder)
-
           # tmp copy
           FileUtils.mkdir_p(theme_folder)
           FileUtils.copy_entry(File.join($camaleon_engine_dir, 'lib', 'generators', 'camaleon_cms', 'theme_template'),
@@ -37,7 +32,7 @@ module CamaleonCms
           # helper
           t = fix_text(File.read(File.join(theme_folder, 'main_helper.rb')))
           File.open(File.join(theme_folder, 'main_helper.rb'), 'w') { |f| f << t }
-          puts "Theme successfully created in: #{theme_folder}"
+          say "Theme successfully created in: #{theme_folder}"
         end
       end
 

data/lib/generators/camaleon_cms/theme_template/views/layouts/index.html.erb

@@ -38,7 +38,9 @@
                         <ul class="dropdown-menu">
                             <li><a href="<%= cama_admin_dashboard_path %>"><%= I18n.t('camaleon_cms.common.dashboard') %></a></li>
                             <li><a href="<%= cama_admin_profile_path %>"><%= I18n.t('camaleon_cms.common.profile') %></a></li>
-                            <li><a href="<%= cama_admin_logout_path %>"><%= I18n.t('camaleon_cms.common.logout') %></a></li>
+                            <%# Security (audit M6): logout acts only over POST; button_to carries the CSRF
+                                token without needing rails-ujs on the frontend. %>
+                            <li><%= button_to I18n.t('camaleon_cms.common.logout'), cama_admin_logout_path, method: :post, class: 'btn btn-link' %></li>
                         </ul>
                     </li>
                     <% else %>