camaleon_cms 2.9.2 → 2.9.4

data/app/controllers/camaleon_cms/admin/appearances/nav_menus_controller.rb

@@ -3,7 +3,6 @@ module CamaleonCms
     module Appearances
       class NavMenusController < CamaleonCms::AdminController
         include CamaleonCms::Admin::CustomFieldsConcern
-        include CamaleonCms::Frontend::NavMenuHelper
 
         add_breadcrumb I18n.t('camaleon_cms.admin.sidebar.appearance')
         add_breadcrumb I18n.t('camaleon_cms.admin.sidebar.menus')
@@ -11,9 +10,9 @@ module CamaleonCms
 
         def index
           @nav_menu = if params[:id].present?
-                        current_site.nav_menus.find_by_id(params[:id])
+                        current_site.nav_menus.find_by(id: params[:id])
                       elsif params[:slug].present?
-                        current_site.nav_menus.find_by_slug(params[:slug])
+                        current_site.nav_menus.find_by_slug(params[:slug]) # rubocop:disable Rails/DynamicFindBy
                       else
                         current_site.nav_menus.first
                       end
@@ -91,7 +90,10 @@ module CamaleonCms
         # update the reorder of items
         def reorder_items(items = nil, parent_id = nil, is_root = true)
           items = params[:items] if items.nil?
-          parent_id = params[:nav_menu_id] if parent_id.nil?
+          # Security (audit M10): resolve the destination menu through the current site (like
+          # #add_items) -- a raw params[:nav_menu_id] let an item be re-homed under another site's
+          # nav menu. Nested calls pass an explicit parent item id, so only the root needs scoping.
+          parent_id = current_site.nav_menus.find(params[:nav_menu_id]).id if parent_id.nil?
           items.each do |index, _item|
             item = current_site.nav_menu_items.find(_item['id'])
             item.update(parent_id: parent_id, term_order: index)
@@ -113,7 +115,7 @@ module CamaleonCms
 
           if params[:custom_items].present? # custom menu items
             params[:custom_items].each_value do |custom_item|
-              type = custom_item['kind'].present? ? custom_item['kind'] : 'external'
+              type = custom_item['kind'].presence || 'external'
               items << @nav_menu.append_menu_item({ label: custom_item['label'], link: custom_item['url'], type: type })
             end
           end
@@ -146,7 +148,7 @@ module CamaleonCms
         # Only permit external menu options that match registered custom field slug
         def permitted_external_options(external_params = nil)
           opts = external_params ? external_params[:options] : params[:options]
-          return {} unless opts.present?
+          return {} if opts.blank?
 
           allowed_keys = cama_custom_field_allowed_slugs('NavMenuItem')
           return {} if allowed_keys.blank?

data/app/controllers/camaleon_cms/admin/appearances/themes_controller.rb

@@ -7,9 +7,8 @@ module CamaleonCms
         add_breadcrumb I18n.t('camaleon_cms.admin.sidebar.appearance')
         def index
           add_breadcrumb I18n.t('camaleon_cms.admin.sidebar.themes')
-          PluginRoutes.reload
           authorize! :manage, :themes
-          return unless params[:set].present?
+          return if params[:set].blank?
 
           site_install_theme(params[:set])
           flash.now[:notice] = t('camaleon_cms.admin.themes.message.updated')
@@ -18,9 +17,13 @@ module CamaleonCms
 
         def load_data
           file = Rails.root.join('app', 'apps', 'themes', current_site.get_theme_slug, 'data.json')
-          @messages = load_file_content_to_db(file,
-                                              { post_types: 1, clear_post_type: 1, nav_menus: 1, clear_nav_menus: 1, slider_basic: 1, clear_slider_basic: 1,
-                                                theme_import: 1 })
+          @messages = load_file_content_to_db(
+            file,
+            {
+              post_types: 1, clear_post_type: 1, nav_menus: 1, clear_nav_menus: 1, slider_basic: 1,
+              clear_slider_basic: 1, theme_import: 1
+            }
+          )
         end
 
         def preview

data/app/controllers/camaleon_cms/admin/appearances/widgets/assign_controller.rb

@@ -17,8 +17,13 @@ module CamaleonCms
           end
 
           def update
-            if @assigned.update(params.require(:assign).permit(:title, :content, :widget_id, :sidebar_id, :item_order))
-              @assigned.set_field_values(cama_permitted_field_options('Widget::Main'))
+            # sidebar_id (post_parent) and widget_id (visibility) identify the tenant-scoped sidebar and
+            # widget this assignment belongs to; they are set from @sidebar/@widget on create and must
+            # not be reassigned from the request, or the assignment could be re-pointed into another
+            # site's sidebar or widget (audit finding H9). Reordering has its own current-site-scoped
+            # action (sidebar#reorder).
+            if @assigned.update(params.require(:assign).permit(:title, :content, :item_order))
+              @assigned.set_field_values(cama_permitted_field_options('Main'))
               flash[:notice] = t('camaleon_cms.admin.widgets.assign.updated')
             else
               flash[:error] = t('camaleon_cms.admin.widgets.assign.error_updated')

data/app/controllers/camaleon_cms/admin/appearances/widgets/main_controller.rb

@@ -22,7 +22,8 @@ module CamaleonCms
           end
 
           def create
-            @widget = current_site.widgets.new(params.require(:widget_main).permit(:name, :slug, :description, :excerpt, :renderer))
+            @widget = current_site
+                      .widgets.new(params.require(:widget_main).permit(:name, :slug, :description, :excerpt, :renderer))
             @widget.status = 'simple'
             if @widget.save!
               flash[:notice] = t('camaleon_cms.admin.widgets.message.created')

data/app/controllers/camaleon_cms/admin/categories_controller.rb

@@ -7,6 +7,7 @@ module CamaleonCms
 
       before_action :set_post_type
       before_action :set_category, only: %w[show edit update destroy]
+      before_action :validate_category_parent, only: %w[create update]
 
       def index
         @categories = @post_type.categories
@@ -51,8 +52,11 @@ module CamaleonCms
 
       # return html category list used to reload categories list in post editor form
       def list
-        render inline: post_type_html_inputs(@post_type, 'categories', 'categories',
-                                             @post_type.get_option('has_single_category', false) ? 'radio' : 'checkbox', params[:categories] || [], 'categorychecklist', true)
+        render inline: post_type_html_inputs(
+          @post_type, 'categories', 'categories',
+          @post_type.get_option('has_single_category', false) ? 'radio' : 'checkbox',
+          params[:categories] || [], 'categorychecklist', true
+        )
       end
 
       def destroy
@@ -62,10 +66,21 @@ module CamaleonCms
 
       private
 
+      # The parent dropdown offers the post type itself or one of its own categories. A parent_id naming
+      # anything else would re-home the category under another post type or site, so it is rejected
+      # (audit finding H8). full_categories is scoped to this post type's site and id.
+      def validate_category_parent
+        submitted = params.dig(:category, :parent_id)
+        return if submitted.blank? || submitted.to_s == @post_type.id.to_s
+        return if @post_type.full_categories.exists?(id: submitted)
+
+        raise CanCan::AccessDenied, t('camaleon_cms.admin.post_type.message.error')
+      end
+
       # define parent post type
       def set_post_type
         begin
-          @post_type = current_site.post_types.find_by_id(params[:post_type_id]).decorate
+          @post_type = current_site.post_types.find_by(id: params[:post_type_id]).decorate
         rescue StandardError
           flash[:error] = t('camaleon_cms.admin.request_error_message')
           redirect_to cama_admin_path, { error: 'Error Post Type' }
@@ -76,7 +91,7 @@ module CamaleonCms
       end
 
       def set_category
-        @category = @post_type.categories.find_by_id(params[:id])
+        @category = @post_type.categories.find_by(id: params[:id])
         render_404 unless @category
       rescue StandardError
         flash[:error] = t('camaleon_cms.admin.post_type.message.error')

data/app/controllers/camaleon_cms/admin/comments_controller.rb

@@ -2,7 +2,6 @@ require 'will_paginate/array'
 module CamaleonCms
   module Admin
     class CommentsController < CamaleonCms::AdminController
-      include CamaleonCms::CommentHelper
       add_breadcrumb I18n.t('camaleon_cms.admin.sidebar.comments'), :cama_admin_comments_url
       before_action :validate_role
       before_action :set_post, except: :list

data/app/controllers/camaleon_cms/admin/installers_controller.rb

@@ -5,9 +5,13 @@ module CamaleonCms
       skip_before_action :cama_before_actions
       skip_after_action :cama_after_actions
       before_action :installer_verification, except: :welcome
+      before_action :require_setup_token, only: :save
       layout 'camaleon_cms/login'
 
       def index
+        # Ensure the setup token exists (and is logged) so a remote operator can read it and enter it
+        # below. Local installs are exempt (require_setup_token), so no token is generated for them.
+        CamaleonCms::SetupToken.value if CamaleonCms::SetupToken.required? && !request.local?
         @site ||= CamaleonCms::Site.new
         @site.slug = request.original_url.to_s.parse_domain
         render 'form'
@@ -17,6 +21,10 @@ module CamaleonCms
         @site = CamaleonCms::Site.new(params[:site].permit(:slug, :name)).decorate
         if @site.save
           site_after_install(@site, params[:theme])
+          CamaleonCms::SetupToken.clear! # single-use: the installer is closed now that a site exists
+          # Carry the generated admin password to the welcome page for a single, session-scoped display.
+          flash[:generated_admin_password] = @site.generated_admin_password
+          session[:cama_installer_welcome] = true
           flash[:notice] = t('camaleon_cms.admin.sites.message.created')
           redirect_to action: :welcome
         else
@@ -24,11 +32,34 @@ module CamaleonCms
         end
       end
 
-      def welcome; end
+      def welcome
+        # Only the operator who just completed setup may see the credentials; the marker is one-time.
+        return redirect_to cama_admin_login_url unless session.delete(:cama_installer_welcome)
+
+        @generated_admin_password = flash[:generated_admin_password]
+      end
 
       def installer_verification
         redirect_to cama_root_url unless CamaleonCms::Site.count == 0
       end
+
+      # Refuse to provision unless the request carries the setup token (readable only from the server's
+      # environment or filesystem). Only enforced while no site exists; afterwards installer_verification
+      # has already closed the installer.
+      def require_setup_token
+        return unless CamaleonCms::SetupToken.required?
+        # Loopback requests (a local console/dev install, or an SSH tunnel) already prove host access,
+        # so the token is required only for remote requests. request.local? is true only when the
+        # computed client IP is loopback, so a real remote client behind a proxy that forwards
+        # X-Forwarded-For is still gated. See harden-installer-default-admin.
+        return if request.local?
+        return if CamaleonCms::SetupToken.valid?(params[:setup_token])
+
+        flash[:error] = t('camaleon_cms.admin.installer.invalid_setup_token',
+                          default: 'A valid setup token is required to install. See the server log or ' \
+                                   'tmp/camaleon_setup_token.')
+        redirect_to cama_admin_installers_path
+      end
     end
   end
 end

data/app/controllers/camaleon_cms/admin/media_controller.rb

@@ -3,25 +3,69 @@ module CamaleonCms
   module Admin
     class MediaController < CamaleonCms::AdminController
       skip_before_action :admin_logged_actions, except: %i[index download_private_file], raise: false
-      skip_before_action :verify_authenticity_token, only: :upload, raise: false
+      # Security (audit M6/M7): upload writes files (and, via saved_avatar-style flows, model state),
+      # so it must not skip CSRF. The multipart uploader (jQuery uploadFile) posts outside jquery_ujs'
+      # ajax prefilter, so it carries the token as an authenticity_token form field instead (see
+      # _media_manager.js). The url-upload path posts through media#actions, already CSRF-protected.
       before_action :init_media_vars, except: :download_private_file
       before_action :verify_media_authorization
 
       # render media section
       def index
         @show_file_actions = true
-        @files = @tree.paginate(page: params[:page], per_page: 100)
+        @files = cama_uploader.cama_prepare_browser_page(@tree.paginate(page: params[:page], per_page: 100))
         @next_page = @files.current_page < @files.total_pages ? @files.current_page + 1 : nil
         add_breadcrumb I18n.t('camaleon_cms.admin.sidebar.media')
       end
 
       # crop a image to save as a new file
+      #
+      # Unlike crop_url (which is URL-only and prefixes the site URL onto relative
+      # inputs), crop accepts three cp_img_path shapes: an http(s) URL, a data:
+      # URI, or a server filesystem path (see the cama_tmp_upload examples). Only
+      # http(s) URLs are validated here; data: URIs and filesystem paths pass
+      # through to cama_tmp_upload, whose cama_canonical_upload_path guard confines
+      # them to the public/tmp roots. A bare relative path is therefore treated as
+      # a filesystem path, not prefixed with the site URL — intentional divergence.
       def crop
-        path_image = cama_tmp_upload(params[:cp_img_path])[:file_path]
+        cp_img_path = params[:cp_img_path].to_s
+        if (url_error = cama_upload_url_error(cp_img_path))
+          return render(plain: helpers.sanitize(url_error))
+        end
+
+        # Security (object-level authorization): setting another user's avatar is a user-management
+        # write, so gate a non-self saved_avatar target on :manage, :users -- the same capability
+        # UsersController#update already requires. Decide from the parameter, before resolving the
+        # target (so a denied caller cannot use the response as a same-site existence oracle) and
+        # before the upload/crop (so no file work happens on a denied request). A caller may always
+        # set their own avatar with the media permission the endpoint already requires.
+        # (Mirrors UsersController#profile's self-vs-other gate. The .to_s compare and the blank-
+        # saved_avatar skip -- a plain crop, not a user write -- are intentional and fail-closed; do
+        # not "align" this to users_controller's .to_i, which coerces non-canonical ids.)
+        if params[:saved_avatar].present? && params[:saved_avatar].to_s != cama_current_user.id.to_s
+          authorize! :manage, :users
+        end
+
+        tmp = cama_tmp_upload(cp_img_path, formats: params[:formats], name: params[:name])
+        return render(plain: helpers.sanitize(tmp[:error])) if tmp[:error].present?
+
+        path_image = tmp[:file_path]
         crop_path = cama_crop_image(path_image, params[:ic_w], params[:ic_h], params[:ic_x], params[:ic_y])
         res = upload_file(crop_path, { remove_source: true })
-        CamaleonCms::User.find(params[:saved_avatar]).set_meta('avatar', res['url']) if params[:saved_avatar].present?
-        render html: res['url'].html_safe
+        # A failed upload returns { error: ... } with no url. Surface it like the action's other
+        # error paths instead of writing a nil avatar meta and rendering an empty 200 body (which
+        # let the avatar flow store "").
+        return render(plain: helpers.sanitize(res[:error])) if res[:error].present?
+
+        # Security (audit Low): resolve the avatar target through the current site and nil-safely.
+        # The object-level gate above (:manage, :users for a non-self target) is the primary control
+        # that stops a media manager from writing another user's avatar; this site-scoping is defense
+        # in depth -- for an authorized :manage,:users holder a foreign id is a no-op here, where an
+        # unscoped User.find would reach across sites and 500 on a bad id.
+        if params[:saved_avatar].present?
+          current_site.users.find_by(id: params[:saved_avatar])&.set_meta('avatar', res['url'])
+        end
+        render plain: res['url'].to_s
       end
 
       # download private files
@@ -42,13 +86,13 @@ module CamaleonCms
       def ajax
         @show_file_actions = true if current_site.get_option('file_actions_in_modals') == 'yes'
         @tree = cama_uploader.search(params[:search]) if params[:search].present?
-        @files = @tree.paginate(page: params[:page], per_page: 100)
+        @files = cama_uploader.cama_prepare_browser_page(@tree.paginate(page: params[:page], per_page: 100))
         @next_page = @files.current_page < @files.total_pages ? @files.current_page + 1 : nil
         if params[:partial].present?
           render json: { next_page: @next_page,
                          html: render_to_string(partial: 'render_file_item', locals: { files: @files }) }
-        else
-          render 'index', layout: false unless params[:partial].present?
+        elsif params[:partial].blank?
+          render 'index', layout: false
         end
       end
 
@@ -68,9 +112,9 @@ module CamaleonCms
         when 'crop_url'
           user_url = params[:url].to_s
           user_url = "#{current_site.the_url(locale: nil)}#{user_url}" unless user_url.start_with?('data:', 'http')
-          url_validation_result = UserUrlValidator.validate(user_url)
-          r = if url_validation_result.is_a?(Array)
-                { error: url_validation_result.join(', ') }
+          url_error = cama_upload_url_error(user_url)
+          r = if url_error
+                { error: url_error }
               else
                 cama_tmp_upload(user_url, formats: params[:formats], name: params[:name])
               end
@@ -93,9 +137,17 @@ module CamaleonCms
         params[:dimension] = nil if params[:skip_auto_crop].present?
         f = { error: 'File not found.' }
         if params[:file_upload].present?
-          f = upload_file(params[:file_upload],
-                          { folder: params[:folder], dimension: params['dimension'], formats: params[:formats], versions: params[:versions],
-                            thumb_size: params[:thumb_size] }.merge(settings))
+          if params[:file_upload].is_a?(String) && (url_error = cama_upload_url_error(params[:file_upload]))
+            return render plain: helpers.sanitize(url_error)
+          end
+
+          f = upload_file(
+            params[:file_upload],
+            {
+              folder: params[:folder], dimension: params['dimension'], formats: params[:formats],
+              versions: params[:versions], thumb_size: params[:thumb_size]
+            }.merge!(settings)
+          )
         end
 
         if f[:error].present?

data/app/controllers/camaleon_cms/admin/plugins_controller.rb

@@ -3,9 +3,7 @@ module CamaleonCms
     class PluginsController < CamaleonCms::AdminController
       before_action :validate_role
       add_breadcrumb I18n.t('camaleon_cms.admin.sidebar.plugins')
-      def index
-        PluginRoutes.reload
-      end
+      def index; end
 
       def toggle
         status = params[:status].to_bool

data/app/controllers/camaleon_cms/admin/post_tags_controller.rb

@@ -30,7 +30,7 @@ module CamaleonCms
       def update
         args = { post_tag: @post_tag, post_type: @post_type }
         hooks_run('before_update_post_tag', args)
-        if @post_tag.update(params.require(:post_tag).permit(:name, :slug, :description, :parent_id))
+        if @post_tag.update(post_tag_params)
           @post_tag.set_options(params[:meta]) if params[:meta].present?
           @post_tag.set_field_values(cama_permitted_field_options('PostType_PostTag'))
           hooks_run('after_update_post_tag', args)
@@ -43,7 +43,7 @@ module CamaleonCms
 
       # render post tag create form
       def create
-        @post_tag = @post_type.post_tags.new(params.require(:post_tag).permit(:name, :slug, :description, :parent_id))
+        @post_tag = @post_type.post_tags.new(post_tag_params)
         args = { post_tag: @post_tag, post_type: @post_type }
         hooks_run('before_create_post_tag', args)
         if @post_tag.save
@@ -73,15 +73,21 @@ module CamaleonCms
 
       private
 
+      # parent_id is the owning post type's id, set from the @post_type association on create; it is not
+      # accepted from the request so a tag cannot be moved under another post type or site (H8).
+      def post_tag_params
+        params.require(:post_tag).permit(:name, :slug, :description)
+      end
+
       def set_post_type
-        @post_type = current_site.post_types.find_by_id(params[:post_type_id]).decorate
+        @post_type = current_site.post_types.find_by(id: params[:post_type_id]).decorate
         authorize! :post_tags, @post_type
         add_breadcrumb @post_type.the_title, @post_type.the_admin_url
         add_breadcrumb t('camaleon_cms.admin.post_type.post_tags'), url_for({ action: :index })
       end
 
       def set_post_tag
-        @post_tag = @post_type.post_tags.find_by_id(params[:id])
+        @post_tag = @post_type.post_tags.find_by(id: params[:id])
       rescue StandardError
         flash[:error] = t('camaleon_cms.admin.post_type.message.error')
         redirect_to cama_admin_path

data/app/controllers/camaleon_cms/admin/posts/drafts_controller.rb

@@ -5,22 +5,37 @@ module CamaleonCms
         before_action :set_post_data_params, only: %i[create update]
 
         def index
+          # Security (audit 2026-08-11 M12): this action had no authorization, so any signed-in user
+          # could read a post type's JSON. Gate it on the same permission the post listing requires.
+          authorize! :posts, @post_type
           render json: @post_type
         end
 
         def create
-          if params[:post_id].present?
-            @post_draft = CamaleonCms::Post.drafts.where(post_parent: params[:post_id]).first
+          if @draft_parent_post.present?
+            # A draft buffer is an artifact of editing its parent post — authorize that post,
+            # and only ever touch the current user's own buffer
+            authorize! :update, @draft_parent_post
+            @post_draft = @post_type.posts.drafts.where(post_parent: @draft_parent_post.id,
+                                                        user_id: cama_current_user.id).first
             if @post_draft.present?
               @post_draft.set_option('draft_status', @post_draft.status)
               @post_draft.attributes = @post_data
             end
+          else
+            authorize! :create_post, @post_type
+          end
+          if @post_draft.blank?
+            @post_draft = @post_type.posts.new(@post_data)
+            @post_draft.user_id = cama_current_user.id
           end
-          @post_draft = @post_type.posts.new(@post_data) unless @post_draft.present?
           r = { post: @post_draft, post_type: @post_type }
           hooks_run('create_post_draft', r)
           if @post_draft.save(validate: false)
-            @post_draft.set_params(params[:meta], params[:field_options], @post_data[:keywords])
+            # Security (audit M8): confine field values to slugs actually registered on the post type,
+            # like PostsController#save_post_with_fields -- raw params[:field_options] let a caller
+            # write custom_field_values with attacker-chosen slugs/ids/group numbers.
+            @post_draft.set_params(params[:meta], cama_permitted_field_options('PostType_Post'), @post_data[:keywords])
             msg = { draft: { id: @post_draft.id },
                     _drafts_path: cama_admin_post_type_draft_path(@post_type.id, @post_draft) }
             r = { post: @post_draft, post_type: @post_type }
@@ -33,18 +48,25 @@ module CamaleonCms
         end
 
         def update
-          @post_draft = CamaleonCms::Post.drafts.find(params[:id])
+          @post_draft = @post_type.posts.drafts.where(user_id: cama_current_user.id).find(params[:id])
+          authorize! :update, @post_draft.parent || @post_draft
           @post_draft.attributes = @post_data
           r = { post: @post_draft, post_type: @post_type }
           hooks_run('update_post_draft', r)
           if @post_draft.save(validate: false)
-            @post_draft.set_params(params[:meta], params[:field_options], params[:options])
+            # Security (audit M8): confine field values to the post type's registered slugs (see #create).
+            @post_draft.set_params(params[:meta], cama_permitted_field_options('PostType_Post'), params[:options])
             hooks_run('updated_post_draft', { post: @post_draft, post_type: @post_type })
             msg = { draft: { id: @post_draft.id } }
           else
             msg = { error: @post_draft.errors.full_messages }
           end
           render json: msg
+        rescue ActiveRecord::RecordNotFound
+          # Another user's buffer answers exactly like a nonexistent draft id (same rescue
+          # behavior as PostsController#set_post) — no existence oracle for foreign buffers
+          flash[:error] = t('camaleon_cms.admin.post.message.error', post_type: @post_type.decorate.the_title)
+          redirect_to cama_admin_path
         end
 
         def destroy; end
@@ -52,12 +74,19 @@ module CamaleonCms
         private
 
         def set_post_data_params
-          post_data = params.require(:post).permit(:title, :slug, :content, :excerpt, :status, :comment_status, :post_parent, :visibility, :visibility_value, :post_order, :published_at).to_h
-          post_data.delete(:created_at) unless params[:post][:created_at].present?
-          post_data.delete(:updated_at) unless params[:post][:updated_at].present?
+          post_data = params
+                      .require(:post).permit(
+                        :title, :slug, :content, :excerpt, :status, :comment_status, :visibility,
+                        :visibility_value, :post_order, :published_at
+                      ).to_h
+          post_data.delete(:created_at) if params[:post][:created_at].blank?
+          post_data.delete(:updated_at) if params[:post][:updated_at].blank?
           post_data[:status] = 'draft_child'
-          post_data[:post_parent] = params[:post_id]
-          post_data[:user_id] = cama_current_user.id unless post_data[:user_id].present?
+          if action_name == 'create'
+            @draft_parent_post = current_site.posts.find_by(id: params[:post_id]) if params[:post_id].present?
+            # post_parent is create-only and always overwritten — never client-writable via post[post_parent]
+            post_data[:post_parent] = @draft_parent_post&.id
+          end
           post_data[:data_tags] = params[:tags].to_s
           post_data[:data_categories] = params[:categories] || []
           @post_data = post_data