camaleon_cms 2.9.2 → 2.9.4

data/app/controllers/concerns/camaleon_cms/runtime_html_content_concern.rb

@@ -0,0 +1,143 @@
+# rubocop:disable Rails/OutputSafety
+module CamaleonCms
+  module RuntimeHtmlContentConcern
+    extend ActiveSupport::Concern
+
+    # Single source of truth for the cama_content_* surface (prepend/append/draw).
+    # Including it here keeps those methods reachable from controllers (e.g. plugin
+    # hooks running in controller context call cama_content_append) while the shared
+    # view helper stays ivar-free.
+    include CamaleonCms::ContentHelper
+
+    def cama_html_helpers_init
+      state = camaleon_html_helper_state
+      state[:pre_assets_content] = []
+      state[:assets_libraries] = {}
+      state[:assets_content] = []
+    end
+
+    def cama_load_libraries(*keys)
+      state = camaleon_html_helper_state
+      keys.each do |key|
+        library = cama_assets_libraries[key.to_sym]
+        state[:assets_libraries][key.to_sym] = library if library.present?
+      end
+    end
+    alias add_asset_library cama_load_libraries
+
+    def append_asset_libraries(libraries)
+      state = camaleon_html_helper_state
+      libraries.each do |key, library|
+        state[:assets_libraries][key.to_sym] = if state[:assets_libraries].include?(key)
+                                                 state[:assets_libraries][key.to_sym].merge(library)
+                                               else
+                                                 library
+                                               end
+      end
+    end
+    alias cama_load_custom_assets append_asset_libraries
+
+    def append_asset_content(content)
+      camaleon_html_helper_state[:assets_content] << content
+    end
+
+    def append_pre_asset_content(content)
+      camaleon_html_helper_state[:pre_assets_content] << content
+    end
+
+    def cama_draw_pre_asset_contents
+      camaleon_html_helper_state[:pre_assets_content].join('').html_safe
+    end
+
+    def cama_draw_custom_assets
+      state = camaleon_html_helper_state
+      cama_html_helpers_init if state[:assets_libraries].blank?
+      libs = []
+      state[:assets_libraries].each_value do |assets|
+        libs += assets[:css] if assets[:css].present?
+      end
+      stylesheets = libs.uniq
+      css = helpers.stylesheet_link_tag(*stylesheets, media: 'all')
+
+      libs = []
+      state[:assets_libraries].each_value do |assets|
+        libs += assets[:js] if assets[:js].present?
+      end
+      javascripts = libs.uniq
+      js = helpers.javascript_include_tag(*javascripts)
+
+      args = { stylesheets: stylesheets, javascripts: javascripts, js_html: js, css_html: css }
+      hooks_run('draw_custom_assets', args)
+      trusted_fragments = [args[:css_html], args[:js_html], *state[:assets_content]].filter_map do |fragment|
+        next if fragment.blank?
+
+        fragment.is_a?(ActiveSupport::SafeBuffer) ? fragment : fragment.to_s.html_safe
+      end
+
+      helpers.safe_join(trusted_fragments, "\n")
+    end
+
+    def theme_init
+      breadcrumb_items = []
+      camaleon_theme_state[:front_breadcrumb] = breadcrumb_items
+      # back-compat ivar: themes/plugins may read @_front_breadcrumb directly.
+      # Owned here (controller concern) so the shared view helper stays ivar-free.
+      @_front_breadcrumb = breadcrumb_items
+    end
+
+    def breadcrumb_add(label, url = '', prepend = false)
+      breadcrumb_items = nav_menu_breadcrumb_items
+      if prepend
+        breadcrumb_items.unshift([label, url])
+      else
+        breadcrumb_items << [label, url]
+      end
+    end
+
+    private
+
+    def camaleon_html_helper_state
+      state = CurrentRequest.html_helper_state ||= {}
+      state[:pre_assets_content] ||= []
+      state[:assets_libraries] ||= {}
+      state[:assets_content] ||= []
+      state
+    end
+
+    def cama_assets_libraries
+      state = camaleon_html_helper_state
+      return state[:cama_assets_libraries] if state[:cama_assets_libraries].present?
+
+      libs = {}
+      libs[:colorpicker] =
+        { js: ['camaleon_cms/admin/bootstrap-colorpicker'], css: ['camaleon_cms/admin/colorpicker'] }
+      libs[:datepicker] = { js: [] }
+      libs[:datetimepicker] = { js: [], css: [] }
+      libs[:tinymce] =
+        { js: %w[camaleon_cms/admin/tinymce/tinymce.min camaleon_cms/admin/tinymce/plugins/filemanager/plugin.min],
+          css: ['camaleon_cms/admin/tinymce/skins/lightgray/content.min'] }
+      libs[:form_ajax] = { js: ['camaleon_cms/admin/form/jquery.form'] }
+      libs[:cropper] = {}
+      libs[:post] =
+        { js: %w[camaleon_cms/admin/jquery.tagsinput.min camaleon_cms/admin/post],
+          css: ['camaleon_cms/admin/jquery.tagsinput'] }
+      libs[:multiselect] = { js: ['camaleon_cms/admin/bootstrap-select.js'] }
+      libs[:validate] = { js: ['camaleon_cms/admin/jquery.validate'] }
+      libs[:nav_menu] =
+        { css: ['camaleon_cms/admin/nestable/jquery.nestable'],
+          js: %w[camaleon_cms/admin/jquery.nestable camaleon_cms/admin/nav_menu] }
+      libs[:admin_intro] =
+        { js: ['camaleon_cms/admin/introjs/intro.min'], css: ['camaleon_cms/admin/introjs/introjs.min'] }
+      state[:cama_assets_libraries] = libs
+    end
+
+    def camaleon_theme_state
+      CurrentRequest.theme_helper_state ||= {}
+    end
+
+    def nav_menu_breadcrumb_items
+      camaleon_theme_state[:front_breadcrumb] ||= []
+    end
+  end
+end
+# rubocop:enable Rails/OutputSafety

data/app/controllers/concerns/camaleon_cms/runtime_shortcode_theme_concern.rb

@@ -0,0 +1,246 @@
+# rubocop:disable Layout/LineLength
+module CamaleonCms
+  module RuntimeShortcodeThemeConcern
+    extend ActiveSupport::Concern
+
+    # Theme asset/view helpers are owned by CamaleonCms::ThemeHelper (single
+    # source of truth shared with views). Including it here exposes them on the
+    # controller runtime stack so plugin/theme hooks executed in controller
+    # context (e.g. `on_install_theme`) can call `theme_asset`, `theme_view`,
+    # `theme_asset_path`, etc. ThemeHelper is ivar-free, so it is safe to mix in.
+    include CamaleonCms::ThemeHelper
+
+    def shortcodes_init
+      CurrentRequest.shortcodes = []
+      CurrentRequest.shortcodes_template = {}
+      CurrentRequest.shortcodes_descr = {}
+
+      shortcode_add('widget', nil, "Renderize the widget content in this place.
+                Don't forget to create and copy the shortcode of your widgets in appearance -> widgets
+                Sample: [widget widget_key]")
+
+      shortcode_add(
+        'load_libraries',
+        lambda do |attrs, args|
+          return args[:shortcode] if attrs.blank?
+
+          cama_load_libraries(*attrs['data'].to_s.split(','))
+          ''
+        end,
+        "Permit to load libraries on demand, sample: [load_libraries data='datepicker,tinymce']"
+      )
+      shortcode_add(
+        'asset',
+        lambda do |attrs, args|
+          return args[:shortcode] if attrs.blank?
+
+          url = shortcode_asset_reference(attrs['file'], as_path: attrs['as_path'].present?)
+          if attrs['image'].present?
+            ActionController::Base.helpers.image_tag(url, class: attrs['class'], style: attrs['style'])
+          else
+            url
+          end
+        end,
+        "Permit to generate an asset url (
+        add file='' asset file path,
+        add as_path='true' to generate only the path and not the full url,
+        add class='my_class' to setup image class,
+        add style='height: 100px; width: 200px;...' to setup image style,
+        add image='true' to generate the image tag with this url),
+      sample: <img src=\"[asset as_path='true' file='themes/my_theme/assets/img/signature.png']\" /> or [asset image='true' file='themes/my_theme/assets/img/signature.png' style='height: 50px;']"
+      )
+
+      shortcode_add(
+        'data',
+        ->(attrs, args) { attrs.present? ? cama_shortcode_data(attrs, args) : args[:shortcode] },
+        "Permit to generate specific data of a post.
+        Attributes:
+          object: (String, defaut post) Model name: post | posttype | category | posttag | site | user |theme | navmenu
+          id: (Integer) Post id
+          key: (String) Post slug
+          field: (String) Custom field key, you can add render_field='true' to render field as html element, also you can add index=2 to indicate the value in position 2 for multitple values
+          attrs: (String) attribute name
+                  post: title | created_at | excerpt | url | link | thumb | updated_at | author_name | author_url | content
+                  posttype: title | created_at | excerpt | url | link | thumb | updated_at
+                  category: title | created_at | excerpt | url | link | thumb | updated_at
+                  posttag: title | created_at | excerpt | url | link | thumb | updated_at
+                  site: title | created_at | excerpt | url | link | thumb | updated_at
+                  user: title | created_at | excerpt | url | link | thumb | updated_at
+                  theme: title | created_at | excerpt | url | link | thumb | updated_at
+                  navmenu: title | created_at | excerpt | url | link | thumb | updated_at
+          Note: If id and key is not present, then will be rendered for current model
+        Sample:
+          [data id='122' attr='title'] ==> return the title of post with id = 122
+          [data key='contact' attr='url'] ==> return the url of post with slug = contact
+          [data key='contact' attr='link'] ==> return the link with title as text of the link of post with slug = contact
+          [data object='site' attr='url'] ==> return the url of currrent site
+          [data key='page' object='posttype' attr='url'] ==> return the url of post_type with slug = page
+          [data field=icon index=2] ==> return the second value (multiple values) for this custom field with key=icon of current object
+          [data key='contact' field='sub_title'] ==> return the value of the custom_field with key=sub_title registered for post.slug = contact
+          [data object='site' field='sub_title'] ==> return the value of the custom_field with key=sub_title registered for current_site"
+      )
+    end
+
+    def shortcode_add(key, template = nil, descr = '')
+      shortcode_keys << key
+      CurrentRequest.shortcodes_template = shortcode_templates.merge({ key.to_s => template }) if template.present?
+      shortcode_descriptions[key] = descr if descr.present?
+    end
+
+    def shortcode_keys
+      CurrentRequest.shortcodes ||= []
+    end
+
+    def shortcode_templates
+      CurrentRequest.shortcodes_template ||= {}
+    end
+
+    def shortcode_descriptions
+      CurrentRequest.shortcodes_descr ||= {}
+    end
+
+    def shortcode_asset_reference(file, as_path: false)
+      return if file.blank?
+
+      # Defensive ordering: assign the locals the rescue branch uses before everything else, so it
+      # can never see them nil. The only call that raises AssetNotFound is the asset helper below —
+      # resolve_shortcode_theme_asset never does (regex, string interpolation and File.exist? only).
+      helper = ActionController::Base.helpers
+      method_name = as_path ? :asset_path : :asset_url
+      file = resolve_shortcode_theme_asset(file)
+      helper.public_send(method_name, file)
+    rescue Sprockets::Rails::Helper::AssetNotFound
+      helper.public_send(method_name, file, skip_pipeline: true)
+    end
+
+    def resolve_shortcode_theme_asset(file)
+      # Tolerate both `themes/<slug>/assets/...` and `/themes/<slug>/assets/...` — the latter is
+      # what Rails' asset helpers typically emit.
+      match = file.to_s.match(%r{\A/?themes/[^/]+/assets/(?<asset>.+)\z})
+      return file unless match
+
+      can_resolve_theme_assets = respond_to?(:current_theme) &&
+                                 respond_to?(:theme_asset_path) &&
+                                 respond_to?(:theme_asset_file_path)
+      return file unless can_resolve_theme_assets
+      return file if current_theme.blank?
+
+      asset = match[:asset]
+      remapped_file = theme_asset_path(asset)
+      return file unless remapped_file.present? && remapped_file != file
+      return file unless File.exist?(theme_asset_file_path(asset))
+
+      remapped_file
+    end
+
+    def cama_shortcode_data(attrs, args)
+      res = args[:shortcode]
+      object = (attrs['object'].presence || 'post').downcase
+      attr = attrs['attr'] || 'title'
+      model = if attrs['id'].present? || attrs['key'].present?
+                cama_shortcode_model_parser(object, attrs)
+              else
+                args[:owner]
+              end
+      return res if model.blank?
+
+      if attrs['field'].present?
+        field = model.get_field_object(attrs['field'])
+        if attrs['render_field'].present?
+          return render_to_string(template: "custom_fields/#{field.options['field_key']}", layout: false,
+                                  locals: { object: model, field: field, field_key: attrs['field'], attibutes: attrs })
+        end
+
+        res = if attrs['index']
+                begin
+                  model.the_fields(attrs['field'])[attrs['index'].to_i - 1]
+                rescue StandardError
+                  ''
+                end
+              else
+                model.the_field(attrs['field'])
+              end
+        return res
+      else
+        case attr
+        when 'title'
+          res = model.the_title
+        when 'created_at'
+          res = model.the_created_at
+        when 'updated_at'
+          res = model.the_updated_at
+        when 'excerpt'
+          res = begin
+            model.the_excerpt
+          rescue StandardError
+            ''
+          end
+        when 'url'
+          res = begin
+            model.the_url
+          rescue StandardError
+            ''
+          end
+        when 'link'
+          res = begin
+            model.the_link
+          rescue StandardError
+            ''
+          end
+        when 'thumb'
+          res = case object
+                when 'site'
+                  model.the_logo
+                when 'user'
+                  model.the_avatar
+                else
+                  model.the_thumb_url
+                end
+        else
+          case object
+          when 'post'
+            case attr
+            when 'content'
+              res = model.try(:the_content)
+            when 'author_name'
+              res = model.try(:the_author).try(:the_name)
+            when 'author_url'
+              res = model.try(:the_author).try(:the_name)
+            end
+          end
+        end
+      end
+      res
+    end
+
+    def cama_shortcode_model_parser(object, attrs)
+      model = nil
+      case object.downcase
+      when 'post'
+        model = current_site.the_post(attrs['id'].to_i) if attrs['id'].present?
+        model = current_site.the_post(attrs['key'].to_s) if attrs['key'].present?
+      when 'posttype'
+        model = current_site.the_post_type(attrs['id'].to_i) if attrs['id'].present?
+        model = current_site.the_post_type(attrs['key'].to_s) if attrs['key'].present?
+      when 'category'
+        model = current_site.the_category(attrs['id'].to_i) if attrs['id'].present?
+        model = current_site.the_category(attrs['key'].to_s) if attrs['key'].present?
+      when 'posttag'
+        model = current_site.the_tag(attrs['id'].to_i) if attrs['id'].present?
+        model = current_site.the_tag(attrs['key'].to_s) if attrs['key'].present?
+      when 'site'
+        model = current_site
+      when 'theme'
+        model = current_theme
+      when 'navmenu'
+        model = current_site.nav_menu_items.find(attrs['id']) if attrs['id'].present?
+        model = current_site.nav_menu_items.find_by_slug(attrs['key']) if attrs['key'].present? # rubocop:disable Rails/DynamicFindBy
+      when 'user'
+        model = current_site.the_user(attrs['id'].to_i) if attrs['id'].present?
+        model = current_site.the_user(attrs['key'].to_s) if attrs['key'].present?
+      end
+      model
+    end
+  end
+end
+# rubocop:enable Layout/LineLength

data/app/controllers/concerns/camaleon_cms/runtime_state_concern.rb

@@ -0,0 +1,13 @@
+module CamaleonCms
+  module RuntimeStateConcern
+    extend ActiveSupport::Concern
+
+    include CamaleonCms::RuntimeShortcodeThemeConcern
+    include CamaleonCms::RuntimeHtmlContentConcern
+    include CamaleonCms::RuntimeAdminMenuConcern
+    include CamaleonCms::RuntimeCaptchaImageConcern
+    include CamaleonCms::RuntimeUploaderConcern
+
+    delegate :tag, :content_tag, :safe_join, :image_tag, :link_to, :sanitize, to: :helpers
+  end
+end

data/app/controllers/concerns/camaleon_cms/runtime_uploader_concern.rb

@@ -0,0 +1,54 @@
+module CamaleonCms
+  # Uploader entry point for controllers (mixed into CamaleonCms::CamaleonController and
+  # re-exported through RuntimeStateConcern). The implementation lives in the shared
+  # modules below, which CamaleonCms::UploaderHelper includes as well, so the two entry
+  # points cannot drift. Only cama_upload_url_error is controller-specific.
+  module RuntimeUploaderConcern
+    extend ActiveSupport::Concern
+
+    include UploaderContentSecurity
+    include UploaderPathSecurity
+    include UploaderPipeline
+    include UploaderImageProcessing
+    include UploaderSupport
+
+    private
+
+    # Route upload messages through `ct` when the host provides it — the media controllers do,
+    # since #1223 restored CamaleonHelper (and its `ct`) to the controller chain — so the
+    # on_translation hook that lets plugins override upload error text runs on the controller
+    # path too. Non-controller includers (ActiveJobs, standalone objects) have no `ct` and keep
+    # the pipeline's I18n default via super. The default (no hook) text is identical either way:
+    # `ct`'s default arm is I18n.translate("camaleon_cms.common.#{key}", **args).
+    def cama_uploader_ct(key, args = {})
+      return ct(key, args) if respond_to?(:ct, true)
+
+      super
+    end
+
+    # Validates a user-supplied upload URL and returns nil when it is acceptable,
+    # or an error String to render. Only http(s) URLs are validated here; other
+    # inputs (local paths, data: URIs) are handled by the sink guards in
+    # cama_tmp_upload/upload_file.
+    #
+    # Same-site URLs are mapped to a local file and read directly (no network
+    # request), so they only need the static path-traversal check — not DNS
+    # resolution, SSRF/private-IP blocking, or HTML-tag sanitizing. Applying those
+    # to a same-site URL wrongly rejects legitimate values: hosts that resolve to a
+    # loopback/private IP (localhost, Docker, intranet), non-resolvable dev hosts,
+    # and multi-parameter query strings (the "&" is escaped by sanitize). Remote
+    # URLs, which are actually fetched, still get the full SSRF validation.
+    def cama_upload_url_error(url)
+      return unless url.to_s.start_with?('http://', 'https://')
+
+      result = if same_site_url?(url, current_site)
+                 UserUrlValidator.validate(url, reject_path_traversal: true, resolve: false,
+                                                enforce_sanitizing: false, enforce_user: false,
+                                                allow_localhost: true, allow_local_network: true)
+               else
+                 UserUrlValidator.validate(url, reject_path_traversal: true)
+               end
+      result.join(', ') if result.is_a?(Array)
+    end
+  end
+end

data/app/controllers/concerns/camaleon_cms/session_captcha_runtime_concern.rb

@@ -0,0 +1,19 @@
+module CamaleonCms
+  # Wires the captcha helper into the runtime controller stack. Tag building,
+  # verification and the under-attack session counters live only in
+  # CamaleonCms::CaptchaHelper (shared with views); challenge/image generation
+  # lives in CamaleonCms::CaptchaImageGeneration, which both the helper and the
+  # controller-stack RuntimeCaptchaImageConcern include (parity-guarded), so the
+  # controller and view contexts cannot drift apart.
+  #
+  # CaptchaHelper is ivar-free (it only touches session/params/current_site and
+  # ActionController::Base.helpers), so it is safe to mix into the controller.
+  # Including it here restores `cama_captcha_tag`/`cama_captcha_build` on the
+  # controller runtime stack so shortcodes/forms rendered in controller context
+  # (e.g. the contact-form plugin) can call them.
+  module SessionCaptchaRuntimeConcern
+    extend ActiveSupport::Concern
+
+    include CamaleonCms::CaptchaHelper
+  end
+end

data/app/controllers/concerns/camaleon_cms/session_runtime_concern.rb

@@ -0,0 +1,40 @@
+module CamaleonCms
+  # Wires the session/auth and email helpers into the runtime controller stack.
+  # Behaviour lives in the helper modules (single source of truth) so view and
+  # controller contexts cannot drift apart.
+  module SessionRuntimeConcern
+    extend ActiveSupport::Concern
+
+    include CamaleonCms::SessionHelper
+    include CamaleonCms::EmailHelper
+    include CamaleonCms::SessionCaptchaRuntimeConcern
+
+    # When the host application does not define `current_user`, fall back to
+    # Camaleon's own user lookup so `helper_method :current_user` keeps working.
+    included do
+      define_method(:current_user) { cama_current_user } unless ApplicationController.method_defined?(:current_user)
+    end
+
+    # Back-compat: expose the affected user record as the `@user` controller ivar
+    # for legacy templates/plugins. The helper methods themselves stay ivar-free;
+    # these controller-concern overrides own the instance-variable bridging so the
+    # shared view helpers never pollute the view context.
+    def login_user_with_password(username, password)
+      result = super
+      @user = current_site.users.find_by(username: username)
+      result
+    end
+
+    def cama_register_user(user_data, meta)
+      result = super
+      @user = result[:user] if result.is_a?(Hash) && result.key?(:user)
+      result
+    end
+
+    # Redirect to login when the session has expired. Lives here because it is a
+    # controller-only redirect concern (not a view helper).
+    def auth_session_error
+      redirect_to cama_root_path
+    end
+  end
+end

data/app/decorators/camaleon_cms/application_decorator.rb

@@ -15,7 +15,7 @@ module CamaleonCms
     # return the keywords for this model
     def the_keywords
       k = object.get_option('keywords', '')
-      k = h.current_site.the_keywords if object.class.name != 'CamaleonCms::Site' && !k.present?
+      k = h.current_site.the_keywords if object.class.name != 'CamaleonCms::Site' && k.blank?
       k.to_s.translate(get_locale)
     end
 
@@ -50,22 +50,25 @@ module CamaleonCms
       @_deco_locale = locale.to_sym
     end
 
-    # get the locale for current decorator
+    # Admin requests can render frontend URLs from the dashboard, so prefer the
+    # cached frontend locale before falling back to the current I18n locale.
     def get_locale(locale = nil)
-      locale || @_deco_locale || begin
+      frontend_locale = begin
         h.cama_get_i18n_frontend
-      rescue StandardError
+      rescue NoMethodError
         nil
-      end || I18n.locale
+      end
+      locale || @_deco_locale || frontend_locale || I18n.locale
     end
 
     # return the current locale prefixed to add in frontend routes
     def _calc_locale(_l)
-      _l = (_l || @_deco_locale || begin
+      frontend_locale = begin
         h.cama_get_i18n_frontend
-      rescue StandardError
+      rescue NoMethodError
         nil
-      end || I18n.locale).to_s
+      end
+      _l = (_l || @_deco_locale || frontend_locale || I18n.locale).to_s
       "_#{_l}"
     end
   end

data/app/decorators/camaleon_cms/category_decorator.rb

@@ -19,7 +19,8 @@ module CamaleonCms
       h.edit_cama_admin_post_type_category_url(object.post_type.id, object)
     end
 
-    # return all children categories for the current category (active_record) filtered by permissions + hidden posts + roles + etc...
+    # return all children categories for the current
+    # category (active_record) filtered by permissions + hidden posts + roles + etc...
     # in return object, you can add custom where's or pagination like here:
     # https://edgeguides.rubyonrails.org/active_record_querying.html
     def the_categories
@@ -30,7 +31,7 @@ module CamaleonCms
     def the_category(slug_or_id)
       return object.categories.where(id: slug_or_id).first if slug_or_id.is_a?(Integer)
 
-      object.categories.find_by_slug(slug_or_id) if slug_or_id.is_a?(String)
+      object.categories.find_by_slug(slug_or_id) if slug_or_id.is_a?(String) # rubocop:disable Rails/DynamicFindBy
     end
 
     # ---------------------

data/app/decorators/camaleon_cms/post_comment_decorator.rb

@@ -7,9 +7,9 @@ module CamaleonCms
       h.l(object.created_at, format: format.to_sym)
     end
 
-    # return owner of this comment
+    # return owner of this comment, or nil for rows whose user is missing
     def the_user
-      object.user.decorate
+      object.user&.decorate
     end
     alias the_author the_user
 
@@ -26,15 +26,23 @@ module CamaleonCms
     end
 
     def the_author_name
-      object.author.presence || object.user.full_name
+      # `fullname` is the model method; `full_name` never existed, so this fallback
+      # crashed for any comment stored without an author string.
+      object.author.presence || object.user&.fullname
     end
 
     def the_author_email
-      object.author_email.presence || object.user.email
+      object.author_email.presence || object.user&.email
     end
 
+    # A missing user reads the same as the anonymous one: there is no profile to link to.
+    # Its three siblings above were made nil-safe for orphaned rows; this one was missed, so it
+    # still raised NoMethodError on exactly the rows they were fixed to tolerate.
     def the_author_url
-      object.author_url.presence || (object.user.username == 'anonymous' ? '' : object.user.decorate.the_url)
+      return object.author_url if object.author_url.present?
+      return '' if object.user.blank? || object.user.username == 'anonymous'
+
+      object.user.decorate.the_url
     end
   end
 end