camaleon_cms 2.9.3 → 2.9.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e0997f6bbf586f6f6c5618c97814c0a291fa98bcb54adbd7736a0449f60edc33
-  data.tar.gz: e73b0849f7b21ffc7bd7510d71c328706b022cfefaf738194836b9e332e4f062
+  metadata.gz: c6940e13676d23d32f7eddfc3cabe9cc6639914fc79f5d53497040dc2987fbfb
+  data.tar.gz: 8079bcd83ef28f77f628ad33fbc0bc89f17e2f6ae130868f3d49f112b4cfd1e3
 SHA512:
-  metadata.gz: 74c4843293dd8fbfa585cc784834866be63a7e330b7c9d21ecbbeb9a9e6753168d5c2502705db0fdecee9f89b2ff3b3d102e699c41384fb398f6332be98464cf
-  data.tar.gz: f152511e4e5022003ea2003a275cd677912cce73ac55bb9dbc8528094b6ddcf529b445627ba3750c4bbcebf5412b7107049c43daa0f3e3f5390539d2ba6c4eff
+  metadata.gz: 99302745a2adbd3a0bce4c9e85153bd6d216f5fd3d6ed67c038b461e465339de41e386b114d1075dd1471fca07c70c72c8492a5e9fcae28bf49fcc3f91c71389
+  data.tar.gz: e5ee5c70326b92c29e9ca02be583930d1e2a1bc9a6308cf0bc90a090a29a2c2e4b9417ce9958065561b8d5844146844544d341464c268f2ff40baec939dc4b6c

data/app/apps/plugins/front_cache/admin_controller.rb

@@ -18,9 +18,7 @@ module Plugins
             skip_posts: params[:cache][:skip_posts] || [],
             cache_login: params[:cache][:cache_login],
             home: params[:cache][:home],
-            preserve_cache_on_restart: params[:cache][:preserve_cache_on_restart],
-            invalidate_only: params[:cache][:invalidate_only],
-            cache_counter: current_site.get_meta('front_cache_elements')[:cache_counter] || 0
+            preserve_cache_on_restart: params[:cache][:preserve_cache_on_restart]
           }
         )
         flash[:notice] = t('plugin.front_cache.message.settings_saved').to_s
@@ -30,6 +28,7 @@ module Plugins
       def clean_cache
         flash[:notice] = t('plugin.front_cache.message.cache_destroyed').to_s
         front_cache_clean
+        front_cache_purge_stored_pages
         redirect_to(request.referer || '/admin/plugins')
       end
     end

data/app/apps/plugins/front_cache/config/locales/translation.yml

@@ -13,7 +13,6 @@ en:
       pages_of: 'Pages of'
       skip_cache_pages: 'Skip Cache Pages'
       preserve_cache_on_restart: 'Preserve cache on restart'
-      invalidate_only: 'Invalidate the cache instead of deleting it. (Recommended only if you use custom caching in your views. Not recommended when using FileStore, which is the Rails default cache)'
       message:
         please_checkpost_need_cache: 'Please check all posts or post types you need to cache.'
         enabled_cache_inner_content_logged_users: 'Enable cache for inner content for logged users'
@@ -34,7 +33,6 @@ es:
       pages_of: 'Página de'
       skip_cache_pages: 'Saltar página del Caché'
       preserve_cache_on_restart: 'Preservar caché al reiniciar'
-      invalidate_only: 'Invalide el caché en lugar de eliminarlo. (Recomendado sólo si utiliza el almacenamiento en caché personalizado en sus vistas No se recomienda cuando se utiliza FileStore, que es la caché predeterminada de Rails)'
       message:
         please_checkpost_need_cache: 'Por favor, compruebe todos los mensajes o los tipos de correos que necesita para almacenar en caché.'
         enabled_cache_inner_content_logged_users: 'Habilitar caché de contenido interno para usuarios registrados'
@@ -56,7 +54,6 @@ nl:
       pages_of: "Inhoud van"
       skip_cache_pages: 'Cache overslaan'
       preserve_cache_on_restart: 'Bewaar cache bij herstarten'
-      invalidate_only: 'De cache ongeldig maken, in plaats van het te verwijderen. (Alleen aanbevolen als u aangepaste caching gebruikt in uw weergaven. Niet aanbevolen bij het gebruik van FileStore, wat is de standaard cache van de Rails)'
       message:
         please_checkpost_need_cache: "Kijk alle berichten of inhoud type's na die je wil cachen."
         enabled_cache_inner_content_logged_users: 'Activeer cache voor gelogde gebruikers'
@@ -77,7 +74,6 @@ pt-BR:
       pages_of: 'Páginas de'
       skip_cache_pages: 'Saltar Cache de Páginas'
       preserve_cache_on_restart: 'Preserve o cache no reinício'
-      invalidate_only: 'Invalide o cache em vez de excluí-lo. (Recomendado apenas se você usar cache personalizado em suas visualizações. Não recomendado quando usar FileStore, que é o cache padrão do Rails)'
       message:
         please_checkpost_need_cache: 'Por favor verifique todas as publicações ou o tipo do publicação que precisa colocar em cache.'
         enabled_cache_inner_content_logged_users: 'Permitir cache para conteúdo interno de utilizadores ligados'
@@ -98,7 +94,6 @@ pt-BR:
       pages_of: 'Páginas de'
       skip_cache_pages: 'Pular Cache de Páginas'
       preserve_cache_on_restart: 'Preserve o cache no reinício'
-      invalidate_only: 'Invalide o cache em vez de excluí-lo. (Recomendado apenas se você usar cache personalizado em suas visualizações. Não recomendado quando usar FileStore, que é o cache padrão do Rails)'
       message:
         please_checkpost_need_cache: 'Por favor cheque todos os posts ou o tipo do post que você precisa cachear.'
         enabled_cache_inner_content_logged_users: 'Permitir cache para conteúdo interno de usuários logados'
@@ -119,7 +114,6 @@ it:
       pages_of: 'Pagine di'
       skip_cache_pages: 'Pagine da non cachare'
       preserve_cache_on_restart: 'Conserva la cache al riavvio'
-      invalidate_only: 'Invalidate la cache invece di cancellarla. (Consigliato solo se si utilizza la cache personalizzata nelle tue viste. Non è consigliata quando si utilizza FileStore, che è la cache predefinita Rails)'
       message:
         please_checkpost_need_cache: 'Per favore, verifica tutti i tipi di messaggi o e-mail che è necessario memorizzare nella cache.'
         enabled_cache_inner_content_logged_users: 'Attiva il contenuto della cache interna per gli utenti registrati'
@@ -140,7 +134,6 @@ zh-CN:
       pages_of: '页'
       skip_cache_pages: '跳过缓存页面'
       preserve_cache_on_restart: '重新启动时保存缓存'
-      invalidate_only: '使缓存无效，而不是删除它。 （仅当您在视图中使用自定义缓存时才推荐使用FileStore时，建议不要使用Rails默认缓存）'
       message:
         please_checkpost_need_cache: '请检查您需要缓存位内容.'
         enabled_cache_inner_content_logged_users: '为已登录的用户启用内部内容的缓存'

data/app/apps/plugins/front_cache/front_cache_helper.rb

@@ -1,10 +1,18 @@
 module Plugins
   module FrontCache
     module FrontCacheHelper
+      # Upper bound on any stored page's life. Stores whose purge is rescued away (RedisCacheStore
+      # and MemCacheStore reject the matcher) would otherwise keep retired or never-revisited
+      # entries forever — and Redis's default maxmemory-policy is noeviction, so TTL-less bodies
+      # would grow until the shared store refuses writes. An expired entry is an ordinary miss: the
+      # page is re-rendered and re-cached.
+      FRONT_CACHE_EXPIRATION = 1.week
       # cache all pages configured in this plugin's settings for public users
       def front_cache_front_before_load
-        if current_site.get_option('refresh_cache') # clear cache every restart server unless option checked in settings
-          front_cache_clean unless current_site.get_meta('front_cache_elements')[:preserve_cache_on_restart]
+        # invalidate the site's cached pages on the first request after a (re)start, unless
+        # preserve_cache_on_restart is checked in the plugin settings
+        if current_site.get_option('refresh_cache')
+          front_cache_clean unless (current_site.get_meta('front_cache_elements') || {})[:preserve_cache_on_restart]
           current_site.set_option('refresh_cache', false)
         end
 
@@ -12,11 +20,18 @@ module Plugins
         return if signin? || Rails.env.development? || Rails.env.test? || !request.get?
 
         cache_key = front_cache_plugin_cache_key
-        @caches = current_site.get_meta('front_cache_elements')
-        if flash.keys.blank? && front_cache_exist?(cache_key) # recover cache item
+        # Fail closed on a missing settings meta: front_cache runs on every frontend request, so an
+        # absent front_cache_elements (never seeded, or hand-deleted) must degrade to "cache nothing"
+        # rather than raise NoMethodError and 500 the whole public site.
+        @caches = current_site.get_meta('front_cache_elements') || {}
+        # Single read: the old exist?-then-get pair issued two store reads, and an entry vanishing
+        # between them (a concurrent admin purge, TTL expiry) left .gsub running on nil — a
+        # visitor-facing 500.
+        cached_body = flash.keys.blank? ? front_cache_get(cache_key) : nil
+        if cached_body # recover cache item
           Rails.logger.info "Camaleon CMS - readed cache: #{front_cache_plugin_get_path(cache_key)}"
           response.headers['PLUGIN_FRONT_CACHE'] = 'TRUE'
-          args = { data: front_cache_get(cache_key).gsub('{{form_authenticity_token}}', form_authenticity_token) }
+          args = { data: cached_body.gsub('{{form_authenticity_token}}', form_authenticity_token) }
           hooks_run('front_cache_reading_cache', args)
           # rubocop:disable Rails/OutputSafety -- This replays a trusted cached page body that was already rendered by Rails.
           render html: args[:data].html_safe
@@ -26,24 +41,24 @@ module Plugins
 
         @_plugin_do_cache = false
         # cache paths and home page
-        if @caches[:paths].include?(request.original_url) || @caches[:paths].include?(request.path_info) ||
+        paths = @caches[:paths] || []
+        if paths.include?(request.original_url) || paths.include?(request.path_info) ||
            front_cache_plugin_match_path_patterns?(request.original_url, request.path_info) ||
            (params[:action] == 'index' && params[:controller] == 'camaleon_cms/frontend' && @caches[:home].present?)
           @_plugin_do_cache = true
         elsif params[:action] == 'post' && params[:controller] == 'camaleon_cms/frontend' && params[:draft_id].blank?
-          if (post = current_site.the_posts.find_by_slug(params[:slug])) # rubocop:disable Rails/DynamicFindBy
-            post = post.decorate
-            # Never cache non-public posts. A password-protected post is unlocked per session (visibility_post
-            # audit M2), but the page cache is keyed on the URL alone, so caching an unlocked render would
-            # serve the protected body to visitors who never entered the password. Private posts are already
-            # excluded; password posts must be too.
-            if post.can_visit? && !%w[private password].include?(post.visibility)
-              if (@caches[:skip_posts] || []).include?(post.id.to_s)
-                @_plugin_do_cache = false
-              elsif (@caches[:post_types] || []).include?(post.post_type_id.to_s) ||
-                    (@caches[:posts] || []).include?(post.id.to_s)
-                @_plugin_do_cache = true
-              end
+          # the_post is a single-record lookup (eager: false) -- no listing preloads for one post
+          # Never cache non-public posts. A password-protected post is unlocked per session (visibility_post
+          # audit M2), but the page cache is keyed on the URL alone, so caching an unlocked render would
+          # serve the protected body to visitors who never entered the password. Private posts are already
+          # excluded; password posts must be too.
+          if (post = current_site.the_post(params[:slug])) && post.can_visit? && !%w[private
+                                                                                     password].include?(post.visibility)
+            if (@caches[:skip_posts] || []).include?(post.id.to_s)
+              @_plugin_do_cache = false
+            elsif (@caches[:post_types] || []).include?(post.post_type_id.to_s) ||
+                  (@caches[:posts] || []).include?(post.id.to_s)
+              @_plugin_do_cache = true
             end
           end
         end
@@ -79,8 +94,7 @@ module Plugins
             post_types: [current_site.post_types.where(slug: 'page').first.id],
             skip_posts: [],
             home: true,
-            cache_login: true,
-            cache_counter: 0
+            cache_login: true
           }
         )
       end
@@ -101,46 +115,80 @@ module Plugins
         arg[:links] << link_to(t('plugin.front_cache.clean_cache'), admin_plugins_front_cache_clean_path)
       end
 
-      # save as cache all post requests
+      # invalidate the page cache on any content-changing request. PUT and DELETE count: a permanent
+      # post deletion rides DELETE (Rack::MethodOverride makes request.post? false for
+      # _method=delete forms), and without a bump the deleted page kept being served from cache.
       def front_cache_post_requests
-        return unless request.post? || request.patch?
+        return unless request.post? || request.put? || request.patch? || request.delete?
+        # A draft autosave (posts/drafts) writes a private draft_child buffer, never published
+        # output, so it must not retire the public page cache — otherwise an open editor's
+        # per-minute autosave keeps the whole site's cache from ever warming.
+        return if params[:controller].to_s.end_with?('posts/drafts')
 
         front_cache_clean
       end
 
-      # clear all frontend cache items
+      # invalidate all cached pages of the current site
       def front_cache_clean
-        @caches = current_site.get_meta('front_cache_elements')
-        if @caches[:invalidate_only]
-          @caches[:cache_counter] += 1
-        else
-          Rails.cache.clear
-          @caches[:cache_counter] = 0
-        end
-        current_site.set_meta('front_cache_elements', @caches)
+        # Security: never Rails.cache.clear — the store is shared, and clearing it on every POST also
+        # destroyed unrelated entries such as the per-IP login brute-force counter (CaptchaHelper),
+        # silently defeating it. Bumping the version compared on every page-cache read (ActiveSupport
+        # `version:`) retires all of this site's pages on any store, with no store enumeration.
+        #
+        # The version lives in its own meta key, apart from the front_cache_elements settings hash:
+        # save_settings rewrites that hash wholesale from an earlier read, so a version stored inside
+        # it could be reverted by a settings save racing a concurrent bump — and a reverted version
+        # resurrects a retired generation as servable.
+        current_site.set_meta('front_cache_counter', front_cache_version + 1)
       end
 
       private
 
+      # Current page-cache version of the site. `.to_i` covers a site that has never invalidated
+      # (missing meta) as version 0 — it must never be nil: an entry written with `version: nil`
+      # would match ANY requested version and become immune to invalidation.
+      def front_cache_version
+        current_site.get_meta('front_cache_counter').to_i
+      end
+
+      # Physically remove every stored page entry of the current site. Only the explicit admin
+      # "Clean cache" action calls this — per-request invalidation is the version bump alone, so the
+      # request path never pays a store walk. The pattern is ^-anchored on purpose: with a store
+      # :namespace, ActiveSupport's key_matcher recognizes only a leading ^ (composing /^ns:<rest>/);
+      # any other source becomes /^ns:.*<source>/, where \A can never match, silently deleting
+      # nothing. Keys are single-line, so ^ cannot over-match. Best-effort: delete_matched is
+      # optional store API (MemCacheStore raises NotImplementedError, RedisCacheStore accepts only
+      # glob Strings, third-party stores raise their own classes) and the version bump has already
+      # retired the pages, so any store error is logged and swallowed.
+      def front_cache_purge_stored_pages
+        Rails.cache.delete_matched(%r{^cama_front_cache/#{current_site.id}/})
+      rescue StandardError, NotImplementedError => e
+        Rails.logger.warn "Camaleon CMS - front_cache purge skipped: #{e.class}: #{e.message}"
+      end
+
       def front_cache_exist?(key)
-        !Rails.cache.read(front_cache_plugin_get_path(key)).nil?
+        !front_cache_get(key).nil?
       end
 
       def front_cache_get(key)
-        Rails.cache.read(front_cache_plugin_get_path(key))
+        Rails.cache.read(front_cache_plugin_get_path(key), version: front_cache_version)
       end
 
+      # One entry per URL: the version is stored inside the entry, so re-caching a page after an
+      # invalidation overwrites the retired body in place on every store — storage is bounded at one
+      # entry per cached URL instead of one per URL per invalidation.
       def front_cache_plugin_cache_create(key, content)
-        Rails.cache.write(front_cache_plugin_get_path(key), content)
+        Rails.cache.write(front_cache_plugin_get_path(key), content,
+                          version: front_cache_version, expires_in: FRONT_CACHE_EXPIRATION)
       end
 
-      # return the physical path of cache directory
+      # return the cache key of a stored page
       # key: (string, optional) the key of the cached page
       def front_cache_plugin_get_path(key = nil)
         if key.nil?
-          "pages/#{@caches[:cache_counter]}/#{current_site.id}"
+          "cama_front_cache/#{current_site.id}"
         else
-          "pages/#{@caches[:cache_counter]}/#{current_site.id}/#{key}"
+          "cama_front_cache/#{current_site.id}/#{key}"
         end
       end
 

data/app/apps/plugins/front_cache/views/admin/settings.html.erb

@@ -61,11 +61,6 @@
             <%= check_box_tag("cache[preserve_cache_on_restart]", 1, @caches[:preserve_cache_on_restart]) %>
         </div>
 
-        <div class="form-group">
-            <label><%= t('plugin.front_cache.invalidate_only') %></label><br>
-            <%= check_box_tag("cache[invalidate_only]", 1, @caches[:invalidate_only]) %>
-        </div>
-
         <!--<div class="form-group">-->
             <!--<label><%#= t('plugin.front_cache.message.enabled_cache_inner_content_logged_users') %></label><br>-->
             <!--<%#= check_box_tag("cache[cache_login]", 1, @caches[:cache_login]) %>-->

data/app/controllers/camaleon_cms/admin/settings/custom_fields_controller.rb

@@ -84,6 +84,9 @@ module CamaleonCms
             # the SameSite=Lax auth cookie) wipes the post's categories, because an omitted `categories`
             # param resolves to [] and update_categories then deletes them all (audit finding M6).
             post.update_categories(cat_ids) if request.post?
+            # An existing post renders its OWN saved categories' field groups (update_categories now
+            # resets the association, so the read is fresh). Do NOT union the request's categories[]
+            # in here, or a read-only GET would render field groups for categories the post lacks.
             args = {}
           else
             # The render-only branch builds a new post of the requested type; gate it on the ability to
@@ -92,6 +95,7 @@ module CamaleonCms
             authorize! :create_post, post_type if post_type
             post = CamaleonCms::Post.new
             post.taxonomy_id = post_type&.id
+            # A new post has no saved categories, so pass the requested ids to preview their field groups.
             args = { cat_ids: cat_ids }
           end
           render partial: 'camaleon_cms/admin/settings/custom_fields/render',

data/app/controllers/camaleon_cms/frontend_controller.rb

@@ -40,7 +40,7 @@ module CamaleonCms
       mark_frontend_category_visited(@category)
       @children = @category.children.no_empty.decorate
       @posts = @category.the_posts.paginate(page: params[:page],
-                                            per_page: current_site.front_per_page).eager_load(:metas)
+                                            per_page: current_site.front_per_page)
       category_slug = @category.the_slug
 
       # specific template category with specific slug within a post-type
@@ -78,7 +78,7 @@ module CamaleonCms
       CurrentRequest.frontend_object = @object
       mark_frontend_post_type_visited(@post_type)
       @posts = @post_type.the_posts.paginate(page: params[:page],
-                                             per_page: current_site.front_per_page).eager_load(:metas)
+                                             per_page: current_site.front_per_page)
       @categories = @post_type.categories.no_empty.eager_load(:metas).decorate
       @post_tags = @post_type.post_tags.eager_load(:metas)
       post_type_slug = "post_types/#{@post_type.the_slug}"
@@ -105,7 +105,7 @@ module CamaleonCms
       CurrentRequest.frontend_object = @object
       mark_frontend_tag_visited(@post_tag)
       @posts = @post_tag.the_posts.paginate(page: params[:page],
-                                            per_page: current_site.front_per_page).eager_load(:metas)
+                                            per_page: current_site.front_per_page)
       slug_post_tag = "post_types/#{@post_type.the_slug}/post_tag"
       r_file = lookup_context.template_exists?(slug_post_tag) ? slug_post_tag : 'post_tag'
       layout_ = lookup_context.template_exists?('layouts/post_tag') ? 'post_tag' : nil
@@ -198,13 +198,15 @@ module CamaleonCms
     # post_or_slug_or_id: slug_post | id post | post object
     # from_url: true/false => true (true, permit eval hooks "on_render_post")
     def render_post(post_or_slug_or_id, from_url = false, status = nil, force_visit = false)
+      # eager: false -- rendering one post must not pay the listing preloads (with_eager)
+      visible_posts = verify_front_visibility(current_site.posts, eager: false)
       @post = case post_or_slug_or_id
               when String # slug
                 # find_by_slug is multi-language aware (matches localized slugs like
                 # "<!--:en-->sample-post<!--:-->..."), unlike find_by(slug:)
-                current_site.the_posts.find_by_slug(post_or_slug_or_id) # rubocop:disable Rails/DynamicFindBy
+                visible_posts.find_by_slug(post_or_slug_or_id) # rubocop:disable Rails/DynamicFindBy
               when Integer # id
-                current_site.the_posts.where(id: post_or_slug_or_id).first
+                visible_posts.where(id: post_or_slug_or_id).first
               else # model
                 post_or_slug_or_id
               end

data/app/decorators/camaleon_cms/post_decorator.rb

@@ -250,7 +250,8 @@ module CamaleonCms
     # @param parent: parent decorated model, like: (PostType *default), Category, PostTag, Site
     # @samples: my_post.the_next_post(), my_post.the_next_post(@category), my_post.the_next_post(current_site)
     def the_next_post(parent = nil)
-      (parent.presence || the_post_type).the_posts.where(
+      # eager: false -- next/prev resolve a single sibling used only for its title/url
+      h.verify_front_visibility((parent.presence || the_post_type).posts, eager: false).where(
         post_order_predicate_gt(object.post_order, object.created_at)
       ).where.not(id: object.id).take.try(:decorate)
     end
@@ -259,9 +260,10 @@ module CamaleonCms
     # @param parent: parent decorated model, like: (PostType *default), Category, PostTag, Site
     # @samples: my_post.the_prev_post(), my_post.the_prev_post(@category), my_post.the_prev_post(current_site)
     def the_prev_post(parent = nil)
-      (parent.presence || the_post_type).the_posts
-        .where(post_order_predicate_lt(object.post_order, object.created_at))
-        .where.not(id: object.id).reorder(post_order: :asc, created_at: :asc).last.try(:decorate)
+      # eager: false -- next/prev resolve a single sibling used only for its title/url
+      h.verify_front_visibility((parent.presence || the_post_type).posts, eager: false)
+       .where(post_order_predicate_lt(object.post_order, object.created_at))
+       .where.not(id: object.id).reorder(post_order: :asc, created_at: :asc).last.try(:decorate)
     end
 
     # return the title with hierarchy prefixed

data/app/decorators/camaleon_cms/site_decorator.rb

@@ -53,23 +53,25 @@ module CamaleonCms
     # slug_or_id: (Array) array of post ids, return multiple posts
     # return post model or nil
     def the_post(slug_or_id)
+      # eager: false -- a single-record lookup must not pay the listing preloads (with_eager)
+      rel = h.verify_front_visibility(object.posts, eager: false)
       if slug_or_id.is_a?(Integer)
         post = begin
-          the_posts.find(slug_or_id)
+          rel.find(slug_or_id)
         rescue StandardError
           nil
         end
       end
       if slug_or_id.is_a?(Array)
         post = begin
-          the_posts.find(slug_or_id)
+          rel.find(slug_or_id)
         rescue StandardError
           nil
         end
       end
       # use find_by_slug (multi-language aware) so posts with localized slugs
       # (e.g. "<!--:en-->sample-post<!--:-->...") are matched instead of returning nil
-      post = the_posts.find_by_slug(slug_or_id) if slug_or_id.is_a?(String) # rubocop:disable Rails/DynamicFindBy
+      post = rel.find_by_slug(slug_or_id) if slug_or_id.is_a?(String) # rubocop:disable Rails/DynamicFindBy
       post&.decorate
     end
 

data/app/helpers/camaleon_cms/frontend/application_helper.rb

@@ -8,8 +8,13 @@ module CamaleonCms
 
       # add where conditionals to filter private/hidden/expired/drafts/unpublished
       # note: only for post records
-      def verify_front_visibility(active_record)
+      # eager: collection listings (the_posts/the_contents) preload metas, categories, post_tags and
+      # the post-type metas up front to avoid N+1. Single-record lookups (the_post, render_post,
+      # the_next_post/the_prev_post) pass eager: false so a one-row find is not charged the listing
+      # preloads it never reads.
+      def verify_front_visibility(active_record, eager: true)
         active_record = active_record.visible_frontend
+        active_record = active_record.with_eager if eager
         r = { active_record: active_record }
         hooks_run('filter_post', r)
         r[:active_record]

data/app/models/camaleon_cms/custom_fields_relationship.rb

@@ -1,5 +1,7 @@
 module CamaleonCms
   class CustomFieldsRelationship < CamaleonRecord
+    include CamaleonCms::ContentShortcodeGate
+
     self.table_name = "#{PluginRoutes.static_system_info['db_prefix']}custom_fields_relationships"
 
     # attr_accessible :objectid, :custom_field_id, :term_order, :value, :object_class,
@@ -24,6 +26,11 @@ module CamaleonCms
     GATED_FIELD_KEYS = (MARKUP_FIELD_KEYS + JSON_MARKUP_FIELD_KEYS + URI_FIELD_KEYS).freeze
 
     validate :reject_untrusted_dangerous_value
+    # Any custom-field value is expanded by do_shortcode at render (CustomFieldsConcern#the_field
+    # and friends), regardless of field type, so gate a shortcode in ANY value behind
+    # content_shortcodes -- broader than the HTML gate above, which only covers markup/URI field
+    # types.
+    gate_content_shortcodes :value
 
     after_save :set_parent_slug
     after_save :update_model_owner # TODO: convert this model into polymorphic

data/app/models/camaleon_cms/post.rb

@@ -1,6 +1,7 @@
 module CamaleonCms
   class Post < CamaleonCms::PostDefault
     include CamaleonCms::CategoriesTagsForPosts
+    include CamaleonCms::ContentShortcodeGate
 
     # Structural, non-executable markup that long-form post content legitimately uses but the
     # sanitizer default drops. Superset of the default so upstream security additions are inherited.
@@ -39,6 +40,9 @@ module CamaleonCms
     default_scope -> { where(post_class: 'Post').order(post_order: :asc, created_at: :desc) }
 
     validate :reject_untrusted_dangerous_content, on: %i[create update]
+    # Shortcodes in post content are expanded by do_shortcode at render (PostDecorator#the_content),
+    # an end-run around post_content_unfiltered_html; gate authorship behind content_shortcodes.
+    gate_content_shortcodes :content
 
     # DEPRECATED
     has_many :post_relationships, class_name: 'CamaleonCms::PostRelationship', foreign_key: :objectid,
@@ -74,11 +78,18 @@ module CamaleonCms
     scope :drafts, -> { where(status: %w[draft draft_child]) }
     scope :pending, -> { where(status: 'pending') }
     scope :latest, -> { reorder(created_at: :desc) }
+    # `preload`, not `includes`: frontend listings run `the_posts` through this scope. If it were
+    # `includes`, a caller that later chains a join/`eager_load`/hash-`where` on one of these tables
+    # (e.g. PostDecorator#the_related_posts joins :categories) would flip the relation to
+    # `eager_loading?` -- one multi-way LEFT JOIN that loads a PARTIAL categories set per post and
+    # duplicates rows in `pluck`/`count`. `preload` issues separate queries, never merged into a join.
+    scope :with_eager, -> { preload(:metas, :categories, :post_tags, post_type: :metas) }
 
     validates_with CamaleonCms::PostUniqValidator
     attr_accessor :show_title_with_parent
 
     before_create :fix_post_order, if: ->(p) { p.post_order.blank? || p.post_order == 0 }
+    before_save :set_published_at_on_publish
 
     # return all parents for current page hierarchy ordered bottom to top
     def parents
@@ -338,5 +349,18 @@ module CamaleonCms
       last_post = post_type.posts.where.not(id: nil).last
       self.post_order = last_post.present? ? (last_post.post_order || 0) + 1 : 1
     end
+
+    # Stamp the publish time at the moment a post becomes published without an explicit date --
+    # the admin Publish action, or any save that transitions the status to 'published'. Keyed to
+    # the status change (or the record being born published), not to every save, so a post created
+    # as a draft keeps a nil published_at until it is actually published, a caller-supplied date
+    # (e.g. a scheduled post) is preserved, and later edits of an already-published post keep the
+    # original date.
+    def set_published_at_on_publish
+      return unless status == 'published' && published_at.blank?
+      return unless new_record? || will_save_change_to_status?
+
+      self.published_at = Time.current.utc
+    end
   end
 end

data/app/models/camaleon_cms/term_taxonomy.rb

@@ -2,6 +2,7 @@ module CamaleonCms
   class TermTaxonomy < CamaleonRecord
     include CamaleonCms::Metas
     include CamaleonCms::CustomFieldsRead
+    include CamaleonCms::ContentShortcodeGate
 
     extend CamaleonCms::NormalizeAttrs
 
@@ -72,6 +73,11 @@ module CamaleonCms
     # validates
     validates :name, :taxonomy, presence: true
     validates_with CamaleonCms::UniqValidator
+    # A taxonomy/widget description is expanded by do_shortcode at render
+    # (TermTaxonomyDecorator#the_content, shortcode_templates/widget.html.erb); STI-covers every
+    # subclass (post types, categories, tags, widgets, sidebars). Gate authorship behind
+    # content_shortcodes -- benign descriptions pass without ever building an Ability.
+    gate_content_shortcodes :description
 
     # relations
     has_many :term_relationships, class_name: 'CamaleonCms::TermRelationship',

data/app/models/camaleon_cms/user_role.rb

@@ -199,6 +199,21 @@ module CamaleonCms
                      'active content there. Site-wide, unlike the per-post-type "Allow unfiltered HTML in post ' \
                      'content" permission.'
           ).to_s
+        },
+        {
+          key: 'content_shortcodes',
+          label: I18n.t('camaleon_cms.admin.users.roles_values.content_shortcodes',
+                        default: 'Allow shortcodes in content').to_s,
+          color: 'danger',
+          description: I18n.t(
+            'camaleon_cms.admin.users.tool_tip.content_shortcodes',
+            default: 'Permit users with this role to publish shortcodes in content that the CMS expands at ' \
+                     'render: post content, custom-field values, taxonomy content and widget descriptions. A ' \
+                     'shortcode makes theme/plugin code emit arbitrary HTML/JS on the page, which the ' \
+                     'content scan cannot judge. Without it, a save carrying a registered shortcode is refused ' \
+                     'rather than cleaned up. Site-wide, and an end-run around the per-post-type "Allow ' \
+                     'unfiltered HTML in post content" permission.'
+          ).to_s
         }
       ]
     }.freeze

data/app/models/concerns/camaleon_cms/categories_tags_for_posts.rb

@@ -27,8 +27,12 @@ module CamaleonCms
     # cats: (Array) array of category ids assigned for this post, sample: [1, 2, 3]
     def update_categories(cats = [])
       rescue_extra_data
-      cats = cats.to_i
-      old_categories = categories.pluck("#{CamaleonCms::TermTaxonomy.table_name}.id")
+      # uniq: duplicate ids (e.g. a crafted `categories[]=5&categories[]=5`) would otherwise create
+      # duplicate term_relationships rows, which duplicate the post in category/tag listings and
+      # inflate will_paginate's total_entries (there is no unique index on the join table)
+      cats = cats.to_i.uniq
+      # reuse the snapshot rescue_extra_data just took instead of plucking the same set again
+      old_categories = manage_categories? ? @cats_before : categories.pluck("#{CamaleonCms::TermTaxonomy.table_name}.id")
       delete_categories = old_categories - cats
       news_categories = cats - old_categories
       term_relationships.where('term_taxonomy_id in (?)', delete_categories).destroy_all if delete_categories.present?
@@ -71,9 +75,6 @@ module CamaleonCms
     # categories_id: (Array) array of category ids to unassign from this post, sample: [1,2,3]
     def unassign_category(categories_id)
       categories_id = [categories_id] if categories_id.is_a?(Integer)
-      # a loaded (stale) categories association would hide the removed ids from the
-      # counter refresh below — check_default_category loads it on every save
-      categories.reset
       rescue_extra_data
       term_relationships.where(term_taxonomy_id: categories_id).destroy_all
       update_counts('categories')
@@ -87,14 +88,25 @@ module CamaleonCms
 
     private
 
-    @cats_before = []
-    @tags_before = []
     # save as a cache previous categories and tags assigned for this post
     def rescue_extra_data
+      # Every writer mutates term_relationships directly, which does NOT invalidate an already-loaded
+      # categories/post_tags/term_relationships proxy -- and the_post preloads categories/post_tags via
+      # with_eager, so the proxy is routinely loaded before a write. Reset here, the single point every
+      # writer (and update_extra_data) calls first, so the snapshots below and every later
+      # pluck/empty?/count read the database rather than a stale in-memory target.
+      reset_term_proxies
       @cats_before = categories.pluck(:id) if manage_categories?
       @tags_before = post_tags.pluck(:id) if manage_tags?
     end
 
+    # drop any loaded category/tag/term_relationship cache so a write starts from DB truth
+    def reset_term_proxies
+      categories.reset
+      post_tags.reset
+      term_relationships.reset
+    end
+
     # Update the quantity of posts assigned for tags and categories assigned to this post
     # if kind is empty, then this will update both: cats and tags
     # kind: (string) tags | categories

data/app/models/concerns/camaleon_cms/content_shortcode_gate.rb

@@ -0,0 +1,73 @@
+# frozen_string_literal: true
+
+module CamaleonCms
+  # Save-time authorization gate for authored content that `do_shortcode` later expands (post
+  # content, custom-field values, taxonomy/widget descriptions). A registered shortcode makes
+  # theme/plugin code emit arbitrary HTML/JS at render, which the content scan cannot judge, so
+  # authorship is GATED behind the default-off `content_shortcodes` manager permission rather than
+  # filtered. The content is never escaped, stripped or rewritten -- a save carrying a shortcode is
+  # refused for an untrusted author, and stored verbatim for a trusted one.
+  #
+  # Conforms to `security-capability-gating` (fail-closed) and the content-shortcode-gating
+  # capability. A model gates an attribute with `gate_content_shortcodes :attr`; a newly added
+  # surface that `do_shortcode` expands MUST adopt this gate (asserted by the coverage spec).
+  module ContentShortcodeGate
+    extend ActiveSupport::Concern
+
+    class_methods do
+      # Gate the named attribute(s) on create/update. Each attribute is scanned in its RAW stored
+      # form -- which contains every locale of a translatable value at once, so a shortcode in any
+      # locale is caught -- and, if a registered shortcode is present and the actor is a
+      # non-administrator lacking `content_shortcodes`, the save is refused with a base error.
+      def gate_content_shortcodes(*attributes, on: %i[create update])
+        gated = attributes.map(&:to_sym)
+        validate(on: on) { cama_reject_unauthorized_shortcodes(gated) }
+      end
+    end
+
+    private
+
+    def cama_reject_unauthorized_shortcodes(attributes)
+      return unless attributes.any? { |attr| cama_shortcode_attr_gated?(attr) }
+      return if cama_trusted_for_shortcodes?
+
+      errors.add(:base, cama_shortcode_rejection_message)
+    end
+
+    # An attribute needs the gate only when it (a) changed on this save (or the record is new) -- so
+    # a title-only edit never re-gates pre-existing shortcode content, mirroring
+    # Post#reject_untrusted_dangerous_content -- and (b) actually contains a registered shortcode.
+    def cama_shortcode_attr_gated?(attr)
+      return false unless new_record? || cama_gate_attribute_changed?(attr)
+
+      value = self[attr]
+      value.present? && CamaleonCms::ShortcodeRegistry.content_has_shortcode?(value.to_s)
+    end
+
+    def cama_gate_attribute_changed?(attr)
+      respond_to?("#{attr}_changed?") ? public_send("#{attr}_changed?") : attribute_changed?(attr.to_s)
+    end
+
+    # Fail closed (the gate applies) without a request context or on any evaluation error, per
+    # security-capability-gating: a background job, rake task or console is untrusted. Administrators
+    # always pass; a non-administrator passes only while holding the `content_shortcodes` manager
+    # permission.
+    def cama_trusted_for_shortcodes?
+      user = CurrentRequest.user
+      site = CurrentRequest.site
+      return false if user.blank? || site.blank?
+      return true if user.admin?
+
+      CamaleonCms::Ability.new(user, site).can?(:manage, :content_shortcodes)
+    rescue StandardError
+      false
+    end
+
+    # Only en.yml carries this key while the process locale follows the current admin/site language
+    # -- fall back to English rather than emit "translation missing".
+    def cama_shortcode_rejection_message
+      key = 'camaleon_cms.admin.shortcodes.message.rejected'
+      I18n.t(key, default: I18n.t(key, locale: :en))
+    end
+  end
+end

data/config/locales/camaleon_cms/admin/en.yml

@@ -287,6 +287,9 @@ en:
         new_site: 'New Site'
         edit_site: 'Edit Site'
         update: 'Update'
+      shortcodes:
+        message:
+          rejected: "This content contains a shortcode that your role is not allowed to publish. Remove the shortcode, or ask an administrator for the shortcode-content permission."
       post:
         add_tag: 'Add a Tag'
         clone: 'Clone'

data/lib/camaleon_cms/engine.rb

@@ -14,15 +14,6 @@ require 'dartsass-sprockets'
 require 'cama_contact_form'
 require 'cama_meta_tag'
 
-# `factory_bot_rails` gem can be added to test, development and/or other environments in the main app, containing the
-# `camaleon_cms` gem.
-# So, being unknown, whether it is defined or not, we're trying requiring the gem, using `rescue` in case of failures.
-begin
-  require 'factory_bot_rails'
-rescue LoadError
-  # do nothing
-end
-
 $camaleon_engine_dir = File.expand_path('../..', __dir__)
 require File.join($camaleon_engine_dir, 'lib', 'plugin_routes').to_s
 require File.join($camaleon_engine_dir, 'lib', 'camaleon_cms', 'setup_token').to_s
@@ -128,10 +119,5 @@ module CamaleonCms
     config.after_initialize do
       PluginRoutes.draw_routes_eagerly
     end
-
-    if defined?(FactoryBotRails)
-      config.factory_bot.definition_file_paths +=
-        [File.expand_path('../../spec/factories', __dir__)]
-    end
   end
 end

data/lib/camaleon_cms/shortcode_registry.rb

@@ -0,0 +1,102 @@
+# frozen_string_literal: true
+
+module CamaleonCms
+  # Process-wide, boot-time registry of shortcode NAMES. It exists so that save-time code can detect
+  # shortcodes without a frontend request: the per-request `CurrentRequest.shortcodes` list is
+  # populated by the active frontend theme's `front_before_load` hook and is therefore empty in the
+  # admin save path, so the save-time gate consults this canonical set instead.
+  #
+  # Providers declare their shortcode names through the `register` DSL at boot. Declarations run with
+  # NO request/site context, so a declaration MUST NOT touch `current_site`/`request` -- only the
+  # names move here; the render-time handler stays in `shortcode_add`. Core declares its own bundled
+  # names (see CORE_SHORTCODES); a theme/plugin gem declares its names from its own boot (an
+  # initializer or engine), e.g. `CamaleonCms::ShortcodeRegistry.register('redirect')`.
+  #
+  # Detection mirrors the engine's `ShortCodeHelper#cama_reg_shortcode` regex shape, sourced from
+  # this registry rather than `CurrentRequest`, so a name is a match only when followed by a space +
+  # attributes or an immediate "]" -- bracketed prose that is not a registered name is never treated
+  # as a shortcode.
+  #
+  # Fail-closed (design D4): an "unavailable" registry -- boot never completed registration -- treats
+  # any non-blank content as gated, so a non-administrator is refused rather than let through on an
+  # empty set. A legitimately empty registry (available, but no provider declared any name) is a
+  # distinct, non-error state that gates nothing.
+  class ShortcodeRegistry
+    # Core-bundled shortcode names, declared through the DSL at boot. Mirrors the shortcodes that
+    # `ShortCodeHelper#shortcodes_init` adds per request; the two are kept in sync by hand (unifying
+    # the boot DSL with the render-time `shortcode_add` registration is a deliberate non-goal -- see
+    # the gate-content-shortcodes design).
+    CORE_SHORTCODES = %w[widget load_libraries asset data].freeze
+
+    class << self
+      # Boot-time DSL: declare one or more shortcode names. Request-independent, idempotent, and
+      # order-independent. Blank names are ignored.
+      def register(*names)
+        names.flatten.each do |name|
+          name = name.to_s.strip
+          registered_names << name unless name.empty?
+        end
+        @regexp = nil
+        self
+      end
+
+      # Mark the registry as successfully built at boot. Called once registration has completed; if
+      # boot raises before this point the registry stays unavailable and detection fails closed.
+      def mark_available!
+        @available = true
+        self
+      end
+
+      def available?
+        @available == true
+      end
+
+      # Frozen snapshot of the registered names.
+      def names
+        registered_names.dup.freeze
+      end
+
+      # Whether `content` contains a registered shortcode. Fails closed when the registry is
+      # unavailable (any non-blank content is treated as gated); a legitimately empty registry
+      # matches nothing.
+      def content_has_shortcode?(content)
+        content = content.to_s
+        return false if content.empty?
+        return true unless available?
+
+        matcher = regexp
+        return false if matcher.nil?
+
+        matcher.match?(content)
+      end
+
+      # Test-only: reset to the unavailable/empty baseline.
+      def reset!
+        @registered_names = nil
+        @regexp = nil
+        @available = false
+        self
+      end
+
+      private
+
+      def registered_names
+        @registered_names ||= Set.new
+      end
+
+      # Mirrors ShortCodeHelper#cama_reg_shortcode: "(\\[(a|b)((\s)((?!\\]).)*|)\\])". In that source
+      # the "\s" is a literal space (a double-quoted-string escape, not the regex whitespace class),
+      # so a code matches only when followed by a literal space + attributes, or an immediate "]".
+      # Names are regex-escaped and ordered longest-first so a name that is a prefix of another
+      # (e.g. media / media_gallery) still matches its own token.
+      def regexp
+        return nil if registered_names.empty?
+
+        @regexp ||= begin
+          codes = registered_names.sort_by { |name| -name.length }.map { |name| Regexp.escape(name) }.join('|')
+          Regexp.new("(\\[(#{codes})((\s)((?!\\]).)*|)\\])")
+        end
+      end
+    end
+  end
+end

data/lib/camaleon_cms/version.rb

@@ -1,3 +1,3 @@
 module CamaleonCms
-  VERSION = '2.9.3'.freeze
+  VERSION = '2.9.4'.freeze
 end

data/lib/camaleon_cms.rb

@@ -11,6 +11,18 @@ require 'camaleon_cms/uploader_image_processing'
 require 'camaleon_cms/uploader_support'
 require 'camaleon_cms/captcha_image_generation'
 require 'camaleon_cms/task_reporter'
+require 'camaleon_cms/shortcode_registry'
 
 module CamaleonCms
 end
+
+# Declare core's bundled shortcode names through the boot DSL, then mark the registry available. This
+# runs at require time (before any request), so the save-time shortcode gate can detect shortcodes
+# with no frontend request. If this ever raises the registry stays unavailable and the gate fails
+# closed (non-administrators are refused) rather than fail open on an empty set.
+begin
+  CamaleonCms::ShortcodeRegistry.register(*CamaleonCms::ShortcodeRegistry::CORE_SHORTCODES)
+  CamaleonCms::ShortcodeRegistry.mark_available!
+rescue StandardError => e
+  warn("CamaleonCms::ShortcodeRegistry boot registration failed (gate fails closed): #{e.message}")
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: camaleon_cms
 version: !ruby/object:Gem::Version
-  version: 2.9.3
+  version: 2.9.4
 platform: ruby
 authors:
 - Owen Peredo Diaz
@@ -57,14 +57,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.1.12
+        version: 0.1.13
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.1.12
+        version: 0.1.13
 - !ruby/object:Gem::Dependency
   name: cama_meta_tag
   requirement: !ruby/object:Gem::Requirement
@@ -956,6 +956,7 @@ files:
 - app/models/camaleon_record.rb
 - app/models/concerns/camaleon_cms/categories_tags_for_posts.rb
 - app/models/concerns/camaleon_cms/common_relationships.rb
+- app/models/concerns/camaleon_cms/content_shortcode_gate.rb
 - app/models/concerns/camaleon_cms/custom_fields_read.rb
 - app/models/concerns/camaleon_cms/metas.rb
 - app/models/concerns/camaleon_cms/normalize_attrs.rb
@@ -1246,6 +1247,7 @@ files:
 - lib/camaleon_cms/engine.rb
 - lib/camaleon_cms/media_security_headers.rb
 - lib/camaleon_cms/setup_token.rb
+- lib/camaleon_cms/shortcode_registry.rb
 - lib/camaleon_cms/svg_content_checker.rb
 - lib/camaleon_cms/task_reporter.rb
 - lib/camaleon_cms/unsafe_markup.rb