camaleon_cms 2.9.2 → 2.9.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7fc3c9c70942e53b927d67366df21d19a549e0a349e8e87ca08f12977c3c5b08
-  data.tar.gz: d0b3948628d2c7c5d5efa55e6bc6c2ef1b90413d2a53764ac85ed281eceab630
+  metadata.gz: e0997f6bbf586f6f6c5618c97814c0a291fa98bcb54adbd7736a0449f60edc33
+  data.tar.gz: e73b0849f7b21ffc7bd7510d71c328706b022cfefaf738194836b9e332e4f062
 SHA512:
-  metadata.gz: f6795ac94a6097bafa86c8336f209cb395f2b102db44da96d091ad55b5373bb6a1ed5af876f6facb72ba313d6fa803201d0605e2e55b0f699304dab2df470c6b
-  data.tar.gz: 6045503558fb4aa769b6d3bbd8dfac05357c9e6427134ed2670b3dc08aae94df7b865d69a80f6bdbe950492a439d79345b1f57b94808fbeb78f6acb5868ec90e
+  metadata.gz: 74c4843293dd8fbfa585cc784834866be63a7e330b7c9d21ecbbeb9a9e6753168d5c2502705db0fdecee9f89b2ff3b3d102e699c41384fb398f6332be98464cf
+  data.tar.gz: f152511e4e5022003ea2003a275cd677912cce73ac55bb9dbc8528094b6ddcf529b445627ba3750c4bbcebf5412b7107049c43daa0f3e3f5390539d2ba6c4eff

data/README.md

@@ -81,14 +81,13 @@ https://camaleon.website/store/plugins
 * Image/iFrame Lazy Loader - https://github.com/brian-kephart/camaleon_lazy_loader
 * Import / Export - https://github.com/owen2345/camaleon_export_import
 * Lightbox - https://github.com/owen2345/CamaImageLightbox
-* Autocomplete - https://github.com/gaelfokou/cama_autocomplete
 * Permissions for External Menus - https://github.com/owen2345/cama_external_menu
 * TinyMCE Template Integration - https://github.com/owen2345/Camaleon-Tinymce-Templates
 * Download Manager - https://github.com/max2320/camaleon-download
 * OAuth - https://github.com/owen2345/camaleon_oauth
-* Visual Editor - Paid Plugin ($) - https://camaleon.website/store/plugins/camaleon_editor
-* Spree Commerce Integration - Paid Plugin ($) - https://camaleon.website/store/plugins/camaleon-spree
-* Admin AJAX - Paid Plugin ($) - https://camaleon.website/store/plugins/admin_ajax
+* Visual Editor - Paid Plugin ($) - https://camaleon.website/store/plugins/camaleon_editor (Github: https://github.com/owen2345/camaleon_editor)
+* Spree Commerce Integration - Paid Plugin ($) - https://camaleon.website/store/plugins/camaleon-spree (Github: https://github.com/owen2345/camaleon-spree)
+* Admin AJAX - Paid Plugin ($) - https://camaleon.website/store/plugins/admin_ajax (Github: https://github.com/owen2345/admin-ajax)
 * **See here for a complete Gemfile**: https://github.com/owen2345/camaleon-cms/blob/master/docs/example_gemfile.rb
 
 ## Camaleon CMS has many useful frontend Themes such as:
@@ -190,6 +189,13 @@ RAILS_ENV=test bundle exec rake app:db:test:prepare
 
 See [docs/security/permissions.md](docs/security/permissions.md) for details on manager permissions, custom fields, and security considerations.
 
+## Hooks
+
+Plugins and themes extend Camaleon by handling named hooks. See [docs/hooks.md](docs/hooks.md) for the
+mechanism (registration via `config.json`, the mutable `args` payload) and a code-derived inventory of the
+hooks core fires, including the session/auth hooks (`user_before_login`, `user_before_register`,
+`after_login`, …).
+
 ## Contributing
 * Fork it.
 * Create a branch (git checkout -b my_feature_branch)
@@ -197,6 +203,13 @@ See [docs/security/permissions.md](docs/security/permissions.md) for details on
 * Push to the branch (git push origin my_feature_branch)
 * Create a pull request from your branch into master (Please be sure to provide enough detail for us to understand what this change is doing)
 
+## Releasing
+
+Releases are cut by the manually-started **Release** GitHub Actions workflow, which builds the gem,
+publishes it to RubyGems, tags the commit and creates the GitHub release. See
+[docs/releasing.md](docs/releasing.md) for the full procedure, what the workflow checks before it
+publishes, and the fully manual fallback.
+
 ## Version History
 
 https://camaleon.website/version-history.html

data/Rakefile

@@ -4,26 +4,13 @@ rescue LoadError
   puts 'You must `gem install bundler` and `bundle install` to run rake tasks'
 end
 
-require 'rdoc/task'
-
-RDoc::Task.new(:rdoc) do |rdoc|
-  rdoc.rdoc_dir = 'rdoc'
-  rdoc.title    = 'CamaleonCms'
-  rdoc.options << '--line-numbers'
-  rdoc.rdoc_files.include('README.rdoc')
-  rdoc.rdoc_files.include('lib/**/*.rb')
-end
-
 APP_RAKEFILE = File.expand_path('spec/dummy/Rakefile', __dir__)
 load 'rails/tasks/engine.rake'
 
-load 'rails/tasks/statistics.rake'
-
-Bundler::GemHelper.install_tasks
-
-Dir[File.join(File.dirname(__FILE__), 'tasks/**/*.rake')].each { |f| load f }
+# Deliberately no Bundler::GemHelper.install_tasks: its `rake release` would tag `v<version>` and
+# push a gem that none of the release checks had seen. Releases go through the Release workflow —
+# see docs/releasing.md, which also covers building and publishing by hand.
 
-require 'rspec/core'
 require 'rspec/core/rake_task'
 
 desc 'Run all specs in spec directory (excluding plugin specs)'

data/app/apps/plugins/attack/admin_controller.rb

@@ -6,12 +6,15 @@ module Plugins
       end
 
       def save_settings
-        current_site.set_meta('attack_config', { get: { sec: params[:attack][:get_sec], max: params[:attack][:get_max] },
-                                                 post: { sec: params[:attack][:post_sec] || 20,
-                                                         max: params[:attack][:post_max] },
-                                                 msg: params[:attack][:msg],
-                                                 ban: params[:attack][:ban],
-                                                 cleared: Time.now })
+        current_site.set_meta(
+          'attack_config', {
+            get: { sec: params[:attack][:get_sec], max: params[:attack][:get_max] },
+            post: { sec: params[:attack][:post_sec] || 20, max: params[:attack][:post_max] },
+            msg: params[:attack][:msg],
+            ban: params[:attack][:ban],
+            cleared: Time.zone.now.iso8601
+          }
+        )
         flash[:notice] = t('plugin.attack.messages.settings_saved').to_s
         redirect_to action: :settings
       end

data/app/apps/plugins/attack/attack_helper.rb

@@ -1,14 +1,14 @@
 module Plugins
   module Attack
     module AttackHelper
-      # here all actions on plugin destroying
+      # Here all actions on the plugin are destroyed
       # plugin: plugin model
       def attack_on_destroy(_plugin)
         current_site.attack.destroy_all
       end
 
-      # here all actions on going to active
-      # you can run sql commands like this:
+      # Here all actions on going to active
+      # you can run SQL commands like this:
       # results = ActiveRecord::Base.connection.execute(query);
       # plugin: plugin model
       def attack_on_active(_plugin)
@@ -16,15 +16,13 @@ module Plugins
                                                  post: { sec: 20, max: 5 },
                                                  msg: I18n.t('plugin.attack.form.request_limit_exceeded').to_s,
                                                  ban: 5,
-                                                 cleared: Time.now })
+                                                 cleared: Time.zone.now.iso8601 })
 
-        unless ActiveRecord::Base.connection.table_exists? 'plugins_attacks'
-          ActiveRecord::Base.connection.create_table :plugins_attacks do |t|
-            t.string :path, index: true
-            t.string :browser_key, index: true
-            t.belongs_to :site, index: true
-            t.datetime 'created_at'
-          end
+        ActiveRecord::Base.connection.create_table :plugins_attacks, if_not_exists: true do |t|
+          t.string :path, index: true
+          t.string :browser_key, index: true
+          t.belongs_to :site, index: true
+          t.datetime 'created_at'
         end
         CamaleonCms::Site.class_eval do
           has_many :attack, class_name: 'Plugins::Attack::Models::Attack'
@@ -38,9 +36,9 @@ module Plugins
       end
 
       def attack_app_before_load
-        cache_ban = Rails.cache.read(cama_get_session_id)
+        cache_ban = Rails.cache.read(attack_ban_cache_key)
         if cache_ban.present? # render banned message if it was banned
-          render html: cache_ban.html_safe, layout: false
+          render html: cache_ban.to_s, layout: false
           return
         end
 
@@ -50,44 +48,56 @@ module Plugins
 
       private
 
+      # Throttle and ban on the client IP, not the session id (audit finding H2). A cookieless /
+      # cookie-rotating request presented a fresh session id every time, so the per-key counter never
+      # accumulated: the throttle never tripped and its per-request DB insert ran unbounded. Keying on
+      # the IP makes the count accumulate, trip the limit, and stop inserting.
+      def attack_client_key
+        request.remote_ip.to_s
+      end
+
+      def attack_ban_cache_key
+        "plugins_attack_ban:#{attack_client_key}"
+      end
+
       def attack_check_request
         return unless current_site
 
         config = current_site.get_meta('attack_config')
-        q = current_site.attack.where(browser_key: cama_get_session_id, path: attack_request_key)
-        return unless config.present?
+        query = current_site.attack.where(browser_key: attack_client_key, path: attack_request_key)
+        return if config.blank?
 
         # clear past requests
         if begin
-          Time.parse(config[:cleared])
+          Time.zone.parse(config[:cleared])
         rescue StandardError
           2.hours.ago
         end < 1.hour.ago
           current_site.attack.where('plugins_attacks.created_at < ?', 1.hour.ago).delete_all
-          config[:cleared] = Time.now.to_s
+          config[:cleared] = Time.zone.now.iso8601 # Use ISO8601 for reliable parsing
           current_site.set_meta('attack_config', config)
         end
 
         # post request
         if request.post? || request.patch?
-          r = q.where(created_at: config[:post][:sec].to_i.seconds.ago..Time.now)
+          r = query.where(created_at: config[:post][:sec].to_i.seconds.ago..Time.zone.now)
           if r.count > config[:post][:max].to_i
-            Rails.cache.write(cama_get_session_id, config[:msg], expires_in: config[:ban].to_i.minutes)
-            # send an email to administrator with request info (ip, browser, if logged then send user info
-            render html: config[:msg].html_safe
+            Rails.cache.write(attack_ban_cache_key, config[:msg], expires_in: config[:ban].to_i.minutes)
+            # Email administrator with request info (ip, browser, if logged, then send user info
+            render html: config[:msg].to_s
             return
           end
 
         # get request
         else
-          r = q.where(created_at: config[:get][:sec].to_i.seconds.ago..Time.now)
+          r = query.where(created_at: config[:get][:sec].to_i.seconds.ago..Time.zone.now)
           if r.count > config[:get][:max].to_i
-            Rails.cache.write(cama_get_session_id, config[:msg], expires_in: config[:ban].to_i.minutes)
-            render html: config[:msg].html_safe
+            Rails.cache.write(attack_ban_cache_key, config[:msg], expires_in: config[:ban].to_i.minutes)
+            render html: config[:msg].to_s
             return
           end
         end
-        q.create
+        query.create
       end
 
       def attack_request_key(method = nil)

data/app/apps/plugins/authoring_post/authoring_post_helper.rb

@@ -24,27 +24,34 @@ module Plugins
       private
 
       def plugin_authoring_form_html(post)
-        "
-    <div class='form-group'>
-      <label class='control-label'>#{t('camaleon_cms.admin.table.author')}</label>
-      <select id='post_user_id' #{if can?(:edit_other,
-                                          post.post_type) && (can?(:edit_publish,
-                                                                   post.post_type) || !post.published?)
-                                    ''
-                                  else
-                                    'disabled'
-                                  end} name='post[user_id]' class='form-control select valid' aria-invalid='false'>#{plugin_authoring_authors_list(post)}</select>
-    </div>
-    "
+        disabled = !(can?(:edit_other, post.post_type) && (can?(:edit_publish, post.post_type) || !post.published?))
+
+        label = tag.label(t('camaleon_cms.admin.table.author'), class: 'control-label')
+        select = content_tag(
+          :select,
+          safe_join(plugin_authoring_authors_list(post)),
+          id: 'post_user_id', name: 'post[user_id]',
+          class: 'form-control select valid',
+          disabled: disabled,
+          'aria-invalid' => 'false'
+        )
+
+        tag.div(safe_join([label, select]), class: 'form-group')
       end
 
       def plugin_authoring_authors_list(post)
         author_id = post.new_record? ? cama_current_user.id : post.author.id
-        ret = ''
-        current_site.users.where('role <> ?', 'client').order(:username).each do |user|
-          ret += "<option value='#{user.id}' #{user.id.eql?(author_id) ? 'selected' : ''}>#{user.username.titleize}#{user.fullname.eql?(user.username.titleize) ? '' : " (#{user.fullname})"}</option>"
+
+        current_site.users.where('role <> ?', 'client').order(:username).map do |user|
+          selected = user.id == author_id
+          titleized_username = user.username.titleize
+          display = if user.fullname == titleized_username
+                      titleized_username
+                    else
+                      "#{titleized_username} (#{user.fullname})"
+                    end
+          tag.option(display, value: user.id, selected: selected)
         end
-        ret
       end
     end
   end

data/app/apps/plugins/front_cache/admin_controller.rb

@@ -5,19 +5,24 @@ module Plugins
 
       def settings
         @caches = current_site.get_meta('front_cache_elements', { paths: [] })
-        @caches[:paths] << '' unless @caches[:paths].present?
+        @caches[:paths] << '' if @caches[:paths].blank?
       end
 
       def save_settings
-        current_site.set_meta('front_cache_elements', { paths: (params[:cache][:paths] || []).compact_blank || [],
-                                                        posts: params[:cache][:posts] || [],
-                                                        post_types: params[:cache][:post_type] || [],
-                                                        skip_posts: params[:cache][:skip_posts] || [],
-                                                        cache_login: params[:cache][:cache_login],
-                                                        home: params[:cache][:home],
-                                                        preserve_cache_on_restart: params[:cache][:preserve_cache_on_restart],
-                                                        invalidate_only: params[:cache][:invalidate_only],
-                                                        cache_counter: current_site.get_meta('front_cache_elements')[:cache_counter] || 0 })
+        current_site.set_meta(
+          'front_cache_elements',
+          {
+            paths: (params[:cache][:paths] || []).compact_blank || [],
+            posts: params[:cache][:posts] || [],
+            post_types: params[:cache][:post_type] || [],
+            skip_posts: params[:cache][:skip_posts] || [],
+            cache_login: params[:cache][:cache_login],
+            home: params[:cache][:home],
+            preserve_cache_on_restart: params[:cache][:preserve_cache_on_restart],
+            invalidate_only: params[:cache][:invalidate_only],
+            cache_counter: current_site.get_meta('front_cache_elements')[:cache_counter] || 0
+          }
+        )
         flash[:notice] = t('plugin.front_cache.message.settings_saved').to_s
         redirect_to action: :settings
       end

data/app/apps/plugins/front_cache/config/initializer.rb

@@ -3,7 +3,7 @@ if begin
 rescue StandardError
   false
 end
-  CamaleonCms::Site.all.each do |site|
+  CamaleonCms::Site.find_each do |site|
     site.set_option('refresh_cache', true)
   end
 end

data/app/apps/plugins/front_cache/front_cache_helper.rb

@@ -13,25 +13,35 @@ module Plugins
 
         cache_key = front_cache_plugin_cache_key
         @caches = current_site.get_meta('front_cache_elements')
-        if !flash.keys.present? && front_cache_exist?(cache_key) # recover cache item
+        if flash.keys.blank? && front_cache_exist?(cache_key) # recover cache item
           Rails.logger.info "Camaleon CMS - readed cache: #{front_cache_plugin_get_path(cache_key)}"
           response.headers['PLUGIN_FRONT_CACHE'] = 'TRUE'
           args = { data: front_cache_get(cache_key).gsub('{{form_authenticity_token}}', form_authenticity_token) }
           hooks_run('front_cache_reading_cache', args)
+          # rubocop:disable Rails/OutputSafety -- This replays a trusted cached page body that was already rendered by Rails.
           render html: args[:data].html_safe
+          # rubocop:enable Rails/OutputSafety
           return
         end
 
         @_plugin_do_cache = false
-        if @caches[:paths].include?(request.original_url) || @caches[:paths].include?(request.path_info) || front_cache_plugin_match_path_patterns?(request.original_url, request.path_info) || (params[:action] == 'index' && params[:controller] == 'camaleon_cms/frontend' && @caches[:home].present?) # cache paths and home page
+        # cache paths and home page
+        if @caches[:paths].include?(request.original_url) || @caches[:paths].include?(request.path_info) ||
+           front_cache_plugin_match_path_patterns?(request.original_url, request.path_info) ||
+           (params[:action] == 'index' && params[:controller] == 'camaleon_cms/frontend' && @caches[:home].present?)
           @_plugin_do_cache = true
-        elsif params[:action] == 'post' && params[:controller] == 'camaleon_cms/frontend' && !params[:draft_id].present?
-          if (post = current_site.the_posts.find_by_slug(params[:slug]))
+        elsif params[:action] == 'post' && params[:controller] == 'camaleon_cms/frontend' && params[:draft_id].blank?
+          if (post = current_site.the_posts.find_by_slug(params[:slug])) # rubocop:disable Rails/DynamicFindBy
             post = post.decorate
-            if post.can_visit? && post.visibility != 'private'
+            # Never cache non-public posts. A password-protected post is unlocked per session (visibility_post
+            # audit M2), but the page cache is keyed on the URL alone, so caching an unlocked render would
+            # serve the protected body to visitors who never entered the password. Private posts are already
+            # excluded; password posts must be too.
+            if post.can_visit? && !%w[private password].include?(post.visibility)
               if (@caches[:skip_posts] || []).include?(post.id.to_s)
                 @_plugin_do_cache = false
-              elsif (@caches[:post_types] || []).include?(post.post_type_id.to_s) || (@caches[:posts] || []).include?(post.id.to_s)
+              elsif (@caches[:post_types] || []).include?(post.post_type_id.to_s) ||
+                    (@caches[:posts] || []).include?(post.id.to_s)
                 @_plugin_do_cache = true
               end
             end
@@ -43,7 +53,7 @@ module Plugins
 
       def front_cache_front_after_load
         cache_key = front_cache_plugin_cache_key
-        return unless @_plugin_do_cache && !flash.keys.present?
+        return unless @_plugin_do_cache && flash.keys.blank?
 
         body =
           response
@@ -135,12 +145,26 @@ module Plugins
       end
 
       def front_cache_plugin_match_path_patterns?(key, key2)
-        @caches[:paths].any? { |path_pattern| key =~ Regexp.new(path_pattern) || key2 =~ Regexp.new(path_pattern) }
+        front_cache_compiled_path_patterns.any? { |pattern| key =~ pattern || key2 =~ pattern }
+      end
+
+      # Security (audit Low): compile the admin-configured patterns once per request and skip any that
+      # are malformed -- Regexp.new was rebuilt on every request and raised (500) on an invalid pattern
+      # (RegexpError) or a non-String pattern reachable via crafted settings params (TypeError).
+      def front_cache_compiled_path_patterns
+        @front_cache_compiled_path_patterns ||= (@caches[:paths] || []).filter_map do |pattern|
+          Regexp.new(pattern)
+        rescue RegexpError, TypeError
+          nil
+        end
       end
 
       def front_cache_plugin_cache_key
         uri = [request.protocol + request.host_with_port, request.fullpath].join('/')
-        uri.parameterize
+        # Security (audit Low): a lossless key. parameterize lowercased and collapsed every run of
+        # non-alphanumerics to '-', so distinct URLs shared one cache entry -- a visitor to one
+        # cacheable URL could be served the cached body of another.
+        Digest::SHA256.hexdigest(uri)
       end
     end
   end

data/app/apps/plugins/visibility_post/config/config.json

@@ -17,6 +17,7 @@
     "created_post":["plugin_visibility_create_post"],
     "updated_post":["plugin_visibility_create_post"],
     "post_the_content": ["plugin_visibility_post_the_content"],
+    "post_the_excerpt": ["plugin_visibility_post_the_excerpt"],
     "filter_post": ["plugin_visibility_filter_post"],
     "post_can_visit": ["plugin_visibility_can_visit"],
     "list_post_extra_columns": ["plugin_visibility_extra_columns"]

data/app/apps/plugins/visibility_post/config/routes_front.txt

@@ -0,0 +1 @@
+post 'unlock/:post_id' => 'front#unlock', as: :unlock, constraints: { post_id: /[0-9]+/ }

data/app/apps/plugins/visibility_post/front_controller.rb

@@ -0,0 +1,23 @@
+module Plugins
+  module VisibilityPost
+    class FrontController < CamaleonCms::Apps::PluginsFrontController
+      # Security (audit M2): unlocks a password-protected post for the current session. Replaces
+      # the old GET `post_password` parameter flow, which put the password in URLs, logs and
+      # referrers and compared it with `==`. The password travels in a POST body, is compared in
+      # constant time, and the unlocked state is a session-side marker -- never the password.
+      def unlock
+        post = current_site.the_posts.where(id: params[:post_id]).first
+        return page_not_found if post.blank? || post.visibility != 'password'
+
+        submitted = params[:post_password].to_s
+        if submitted.present? && ActiveSupport::SecurityUtils.secure_compare(submitted, post.visibility_value.to_s)
+          session[VisibilityPostHelper::SESSION_UNLOCKED_KEY] =
+            Array(session[VisibilityPostHelper::SESSION_UNLOCKED_KEY]) | [post.id]
+        else
+          flash[:cama_visibility_post_error] = true
+        end
+        redirect_to post.decorate.the_url(as_path: true)
+      end
+    end
+  end
+end