comfortable_media_surfer 3.1.7 → 3.2.0

data/app/assets/javascripts/comfy/admin/cms/file_upload.js

@@ -41,7 +41,7 @@ import plupload from "plupload";
 
     destroy() {
       this.uploader.destroy();
-      for (const cleanupFn of this.cleanupFns) {
+      for (const cleanupFn of this.cleanupFns.splice(0)) {
         cleanupFn();
       }
     }
@@ -75,9 +75,13 @@ import plupload from "plupload";
       this.addCleanup(() => {
         document.removeEventListener("dragenter", onDragEnter);
       });
+      const onDragEnd = () => {
+        this.ui.dropElement.classList.remove(DROP_TARGET_ACTIVE_CLASS);
+      };
       for (const eventName of ["drop", "dragleave"]) {
-        this.ui.dropElement.addEventListener(eventName, () => {
-          this.ui.dropElement.classList.remove(DROP_TARGET_ACTIVE_CLASS);
+        this.ui.dropElement.addEventListener(eventName, onDragEnd);
+        this.addCleanup(() => {
+          this.ui.dropElement.removeEventListener(eventName, onDragEnd);
         });
       }
     }
@@ -131,11 +135,9 @@ import plupload from "plupload";
     }
 
     addFile(file) {
-      this.ui.list.insertAdjacentHTML(
-        "afterbegin",
-        FileUpload.buildListItemHTML(file)
-      );
-      this.fileListItem(file)
+      const listItem = FileUpload.buildListItem(file);
+      this.ui.list.prepend(listItem);
+      listItem
         .querySelector(".cms-uploader-file-delete")
         .addEventListener("click", (evt) => {
           evt.preventDefault();
@@ -158,7 +160,7 @@ import plupload from "plupload";
         case plupload.FAILED:
           progressBar.style.width = "100%";
           progressBar.classList.add("progress-bar-danger");
-          progressBar.querySelector("span").innerHTML = file.error_message;
+          progressBar.querySelector("span").textContent = file.error_message;
           break;
       }
     }
@@ -167,19 +169,22 @@ import plupload from "plupload";
       return this.ui.container.querySelector(`#${id}`);
     }
 
-    static buildListItemHTML({ id, name }) {
-      return `<li id='${id}' class='row temp'>
-        <div class='col-md-9 d-flex align-items-center'>
-          <div class='progress'>
-            <div class='progress-bar progress-bar-striped progress-bar-animated'>
-              <span>${name}</span>
-            </div>
+    static buildListItem({ id, name }) {
+      const listItem = document.createElement("li");
+      listItem.id = id;
+      listItem.className = "row temp";
+      listItem.innerHTML = `<div class='col-md-9 d-flex align-items-center'>
+        <div class='progress'>
+          <div class='progress-bar progress-bar-striped progress-bar-animated'>
+            <span></span>
           </div>
         </div>
-        <div class='col-md-3 d-flex align-items-center justify-content-md-end'>
-          <a class='btn btn-sm btn-danger float-right cms-uploader-file-delete' href='#'>Delete</a>
-        </div>
-      </li>`;
+      </div>
+      <div class='col-md-3 d-flex align-items-center justify-content-md-end'>
+        <a class='btn btn-sm btn-danger float-right cms-uploader-file-delete' href='#'>Delete</a>
+      </div>`;
+      listItem.querySelector("span").textContent = name;
+      return listItem;
     }
 
     static defaultUploaderSettings(id) {
@@ -194,12 +199,15 @@ import plupload from "plupload";
     }
   }
 
-  const uploaders = [];
+  const uploaders = new Map();
   window.CMS.fileUpload = {
     init(root = document) {
-      const el = root.querySelector("#cms-uploader");
-      if (el === null) return;
-      uploaders.push(
+      const el = root.matches?.("#cms-uploader")
+        ? root
+        : root.querySelector("#cms-uploader");
+      if (el === null || uploaders.has(el)) return;
+      uploaders.set(
+        el,
         new FileUpload(el, {
           url: el.dataset.cmsUploaderUrl,
           multipart_params: {
@@ -210,11 +218,12 @@ import plupload from "plupload";
         })
       );
     },
-    dispose() {
-      for (const uploader of uploader) {
-        uploader.dispose();
+    dispose(root = null) {
+      for (const [el, uploader] of uploaders) {
+        if (root !== null && el !== root && !root.contains(el)) continue;
+        uploader.destroy();
+        uploaders.delete(el);
       }
-      uploaders.length = 0;
     },
   };
 })();

data/app/assets/javascripts/comfy/admin/cms/files_modal.js

@@ -1,47 +1,97 @@
-import Modal from "bootstrap/js/src/popover";
+import Modal from "bootstrap/js/src/modal";
 
 // Site files modal.
 (() => {
   let modal = null;
+  let modalToggle = null;
+  let modalContainer = null;
+  let modalContent = null;
+  let onModalToggle = null;
+  let onModalContentDragStart = null;
+  let requestId = 0;
 
-  const initModalContent = (modalContent) => {
+  const initModalContent = () => {
     window.CMS.fileUpload.init(modalContent);
     window.CMS.fileLinks(modalContent);
-    modalContent.addEventListener("dragstart", (evt) => {
-      if (
-        evt.target.nodeType === Node.ELEMENT_NODE &&
-        evt.target.matches(".cms-uploader-filelist .item-title a") &&
-        modal != null
-      ) {
-        modal.hide();
-      }
-    });
+  };
+
+  const dispose = () => {
+    requestId += 1;
+    if (modalToggle !== null && onModalToggle !== null) {
+      modalToggle.removeEventListener("click", onModalToggle);
+    }
+    if (modalContent !== null && onModalContentDragStart !== null) {
+      modalContent.removeEventListener("dragstart", onModalContentDragStart);
+      window.CMS.fileUpload.dispose(modalContent);
+      window.CMS.fileLinks.dispose(modalContent);
+    }
+    if (modal !== null) {
+      const wasAnimated = modalContainer.classList.contains("fade");
+      modalContainer.classList.remove("fade");
+      modal.hide();
+      if (wasAnimated) modalContainer.classList.add("fade");
+      modal.dispose();
+    }
+    modal = null;
+    modalToggle = null;
+    modalContainer = null;
+    modalContent = null;
+    onModalToggle = null;
+    onModalContentDragStart = null;
   };
 
   window.CMS.files = {
     init() {
-      const modalToggle = document.querySelector(".cms-files-open-modal");
-      const modalContainer = document.querySelector(".cms-files-modal");
-      if (modalToggle === null || modalContainer === null) return;
-      const modalContent = modalContainer.querySelector(".modal-content");
-      modalToggle.addEventListener("click", (evt) => {
+      const nextModalToggle = document.querySelector(".cms-files-open-modal");
+      const nextModalContainer = document.querySelector(".cms-files-modal");
+      if (nextModalToggle === null || nextModalContainer === null) return;
+      if (
+        modalToggle === nextModalToggle &&
+        modalContainer === nextModalContainer
+      ) {
+        return;
+      }
+
+      dispose();
+      modalToggle = nextModalToggle;
+      modalContainer = nextModalContainer;
+      modalContent = modalContainer.querySelector(".modal-content");
+      onModalContentDragStart = (evt) => {
+        if (
+          evt.target.nodeType === Node.ELEMENT_NODE &&
+          evt.target.matches(".cms-uploader-filelist .item-title a") &&
+          modal !== null
+        ) {
+          modal.hide();
+        }
+      };
+      modalContent.addEventListener("dragstart", onModalContentDragStart);
+      onModalToggle = (evt) => {
         evt.preventDefault();
-        fetch(modalContainer.dataset.url, { credentials: "same-origin" })
+        const currentRequestId = ++requestId;
+        const currentModalContent = modalContent;
+        const url = new URL(modalContainer.dataset.url, document.location.href);
+        url.username = "";
+        url.password = "";
+        fetch(url, { credentials: "same-origin" })
           .then((resp) => resp.text())
           .then((html) => {
+            if (
+              currentRequestId !== requestId ||
+              currentModalContent !== modalContent
+            ) {
+              return;
+            }
+            window.CMS.fileUpload.dispose(modalContent);
+            window.CMS.fileLinks.dispose(modalContent);
             modalContent.innerHTML = `<div class="modal-body">${html}</div>`;
-            initModalContent(modalContent);
+            initModalContent();
           });
         modal = modal || new Modal(modalContainer);
         modal.show();
-      });
-    },
-    dispose() {
-      if (modal !== null) {
-        modal.hide();
-        modal.dispose();
-        modal = null;
-      }
+      };
+      modalToggle.addEventListener("click", onModalToggle);
     },
+    dispose,
   };
 })();

data/app/controllers/comfy/admin/cms/categories_controller.rb

@@ -33,6 +33,6 @@ protected
   end
 
   def category_params
-    params.fetch(:category, {}).permit!
+    params.fetch(:category, {}).permit(:label, :categorized_type)
   end
 end

data/app/controllers/comfy/admin/cms/files_controller.rb

@@ -135,6 +135,6 @@ protected
       params[:file] = {}
       params[:file][:file] = file
     end
-    params.fetch(:file, {}).permit!
+    params.fetch(:file, {}).permit(:label, :description, :file, category_ids: [])
   end
 end

data/app/controllers/comfy/admin/cms/layouts_controller.rb

@@ -64,6 +64,6 @@ protected
   end
 
   def layout_params
-    params.fetch(:layout, {}).permit!
+    params.fetch(:layout, {}).permit(:label, :identifier, :parent_id, :app_layout, :content, :css, :js)
   end
 end

data/app/controllers/comfy/admin/cms/pages_controller.rb

@@ -1,16 +1,21 @@
 # frozen_string_literal: true
 
 class Comfy::Admin::Cms::PagesController < Comfy::Admin::Cms::BaseController
+  FRAGMENT_PARAMS = [
+    :identifier, :tag, :content, :datetime, :boolean, :files,
+    { files: [], file_ids_destroy: [] }
+  ].freeze
+
   include ::Comfy::ReorderAction
 
   self.reorder_action_resource = ::Comfy::Cms::Page
 
   before_action :check_for_layouts, only: %i[new edit]
   before_action :build_page,        only: %i[new create]
-  before_action :load_page,         only: %i[edit update destroy]
+  before_action :load_page,         only: %i[edit update destroy publish_children unpublish_children]
 
   before_action :authorize
-
+  before_action :assign_page_params, only: :update
   before_action :preview_page, only: %i[create update]
 
   def index
@@ -89,8 +94,26 @@ class Comfy::Admin::Cms::PagesController < Comfy::Admin::Cms::BaseController
     render nothing: true
   end
 
+  def publish_children
+    update_children_publication(true, :children_published)
+  end
+
+  def unpublish_children
+    update_children_publication(false, :children_unpublished)
+  end
+
 protected
 
+  def update_children_publication(is_published, message)
+    descendant_ids = @page.descendants.map(&:id)
+    @site.pages
+      .where(id: descendant_ids)
+      .update_all(is_published: is_published, updated_at: Time.current)
+    default = is_published ? 'Child pages published' : 'Child pages unpublished'
+    flash[:success] = I18n.t("comfy.admin.cms.pages.#{message}", default: default)
+    redirect_to action: :edit, id: @page
+  end
+
   def index_for_redactor
     tree_walker = ->(page, list, offset) do
       return unless page.present?
@@ -134,12 +157,15 @@ protected
 
   def load_page
     @page = @site.pages.find(params[:id])
-    @page.attributes = page_params
   rescue ActiveRecord::RecordNotFound
     flash[:danger] = I18n.t('comfy.admin.cms.pages.not_found')
     redirect_to action: :index
   end
 
+  def assign_page_params
+    @page.assign_attributes(page_params)
+  end
+
   def preview_page
     return unless params[:preview]
 
@@ -159,6 +185,9 @@ protected
   end
 
   def page_params
-    params.fetch(:page, {}).permit!
+    params.fetch(:page, {}).permit(
+      :label, :slug, :parent_id, :layout_id, :target_page_id, :is_published,
+      category_ids: [], fragments_attributes: FRAGMENT_PARAMS
+    )
   end
 end

data/app/controllers/comfy/admin/cms/revisions/base_controller.rb

@@ -17,8 +17,8 @@ class Comfy::Admin::Cms::Revisions::BaseController < Comfy::Admin::Cms::BaseCont
   end
 
   def show
-    @current_content    = @record.revision_fields.each_with_object({}) { |f, c| c[f] = @record.send(f) }
-    @versioned_content  = @record.revision_fields.each_with_object({}) { |f, c| c[f] = @revision.data[f] }
+    @current_content    = @record.revision_fields.to_h { |field| [field, @record.send(field)] }
+    @versioned_content  = @record.revision_fields.to_h { |field| [field, @revision.data[field]] }
 
     render 'comfy/admin/cms/revisions/show'
   end

data/app/controllers/comfy/admin/cms/revisions/page_controller.rb

@@ -2,12 +2,12 @@
 
 class Comfy::Admin::Cms::Revisions::PageController < Comfy::Admin::Cms::Revisions::BaseController
   def show
-    @current_content = @record.fragments.each_with_object({}) do |b, c|
-      c[b.identifier] = b.content
+    @current_content = @record.fragments.to_h do |fragment|
+      [fragment.identifier, fragment.content]
     end
-    @versioned_content = @record.fragments.each_with_object({}) do |b, c|
-      d = @revision.data['fragments_attributes'].detect { |r| r[:identifier] == b.identifier }
-      c[b.identifier] = d.try(:[], :content)
+    @versioned_content = @record.fragments.to_h do |fragment|
+      data = @revision.data['fragments_attributes'].detect { |item| item[:identifier] == fragment.identifier }
+      [fragment.identifier, data.try(:[], :content)]
     end
 
     render 'comfy/admin/cms/revisions/show'

data/app/controllers/comfy/admin/cms/revisions/translation_controller.rb

@@ -2,12 +2,12 @@
 
 class Comfy::Admin::Cms::Revisions::TranslationController < Comfy::Admin::Cms::Revisions::BaseController
   def show
-    @current_content = @record.fragments.each_with_object({}) do |b, c|
-      c[b.identifier] = b.content
+    @current_content = @record.fragments.to_h do |fragment|
+      [fragment.identifier, fragment.content]
     end
-    @versioned_content = @record.fragments.each_with_object({}) do |b, c|
-      d = @revision.data['fragments_attributes'].detect { |r| r[:identifier] == b.identifier }
-      c[b.identifier] = d.try(:[], :content)
+    @versioned_content = @record.fragments.to_h do |fragment|
+      data = @revision.data['fragments_attributes'].detect { |item| item[:identifier] == fragment.identifier }
+      [fragment.identifier, data.try(:[], :content)]
     end
 
     render 'comfy/admin/cms/revisions/show'

data/app/controllers/comfy/admin/cms/sites_controller.rb

@@ -1,8 +1,8 @@
 # frozen_string_literal: true
 
 class Comfy::Admin::Cms::SitesController < Comfy::Admin::Cms::BaseController
-  skip_before_action  :load_admin_site,
-                      :load_seeds
+  skip_before_action :load_admin_site,
+                     :load_seeds
 
   before_action :build_site,  only: %i[new create]
   before_action :load_site,   only: %i[edit update destroy]
@@ -63,6 +63,6 @@ protected
   end
 
   def site_params
-    params.fetch(:site, {}).permit!
+    params.fetch(:site, {}).permit(:label, :identifier, :hostname, :path, :locale)
   end
 end

data/app/controllers/comfy/admin/cms/snippets_controller.rb

@@ -61,6 +61,6 @@ protected
   end
 
   def snippet_params
-    params.fetch(:snippet, {}).permit!
+    params.fetch(:snippet, {}).permit(:label, :identifier, :markdown, :content, category_ids: [])
   end
 end

data/app/controllers/comfy/admin/cms/translations_controller.rb

@@ -1,12 +1,18 @@
 # frozen_string_literal: true
 
 class Comfy::Admin::Cms::TranslationsController < Comfy::Admin::Cms::BaseController
+  FRAGMENT_PARAMS = [
+    :identifier, :tag, :content, :datetime, :boolean, :files,
+    { files: [], file_ids_destroy: [] }
+  ].freeze
+
   helper_method :translation_select_options
 
   before_action :load_page
   before_action :build_translation,   only: %i[new create]
   before_action :load_translation,    only: %i[edit update destroy]
   before_action :authorize
+  before_action :assign_translation_params, only: :update
   before_action :preview_translation, only: %i[create update]
 
   def new
@@ -27,7 +33,7 @@ class Comfy::Admin::Cms::TranslationsController < Comfy::Admin::Cms::BaseControl
   end
 
   def update
-    @translation.update!(translation_params)
+    @translation.save!
     flash[:success] = I18n.t('comfy.admin.cms.translations.updated')
     redirect_to action: :edit, id: @translation
   rescue ActiveRecord::RecordInvalid
@@ -74,14 +80,20 @@ private
 
   def load_translation
     @translation = @page.translations.find(params[:id])
-    @translation.attributes = translation_params
   rescue ActiveRecord::RecordNotFound
     flash[:danger] = I18n.t('comfy.admin.cms.translations.not_found')
     redirect_to edit_comfy_admin_cms_site_page_path(@site, @page)
   end
 
+  def assign_translation_params
+    @translation.assign_attributes(translation_params)
+  end
+
   def translation_params
-    params.fetch(:translation, {}).permit!
+    params.fetch(:translation, {}).permit(
+      :locale, :label, :layout_id, :is_published,
+      fragments_attributes: FRAGMENT_PARAMS
+    )
   end
 
   def preview_translation

data/app/controllers/comfy/cms/base_controller.rb

@@ -8,19 +8,28 @@ class Comfy::Cms::BaseController < ComfortableMediaSurfer.config.public_base_con
 protected
 
   def load_cms_site
-    @cms_site ||=
-      if params[:site_id]
-        ::Comfy::Cms::Site.find_by_id(params[:site_id])
-      else
-        ::Comfy::Cms::Site.find_site(request.host_with_port.downcase, request.fullpath)
-      end
+    route_site_id = request.path_parameters[:site_id]
+    @cms_site ||= if route_site_id
+                    find_cms_site_for_asset(route_site_id)
+                  else
+                    ::Comfy::Cms::Site.find_site(request.host_with_port.downcase, request.fullpath)
+                  end
 
     raise ActionController::RoutingError, 'Site Not Found' unless @cms_site
 
-    return unless @cms_site.path.present? && !params[:site_id]
+    return unless @cms_site.path.present? && !route_site_id
     raise ActionController::RoutingError, 'Site Not Found' unless params[:cms_path]&.match(%r{\A#{@cms_site.path}})
 
     params[:cms_path].gsub!(%r{\A#{@cms_site.path}}, '')
     params[:cms_path]&.gsub!(%r{\A/}, '')
   end
+
+  def find_cms_site_for_asset(site_id)
+    site = ::Comfy::Cms::Site.find_by_id(site_id)
+    return site if site && ::Comfy::Cms::Site.one?
+    return unless site
+
+    request_host = ::Comfy::Cms::Site.real_host_from_aliases(request.host_with_port.downcase)
+    site if site.hostname.downcase == request_host
+  end
 end

data/app/controllers/comfy/cms/content_controller.rb

@@ -34,10 +34,10 @@ class Comfy::Cms::ContentController < Comfy::Cms::BaseController
 protected
 
   def render_page(status = :ok)
-    render  inline: @cms_page.content_cache,
-            layout: app_layout,
-            status: status,
-            content_type: mime_type
+    render inline: @cms_page.content_cache,
+           layout: app_layout,
+           status: status,
+           content_type: mime_type
   end
 
   # it's possible to control mimetype of a page by creating a `mime_type` field

data/app/controllers/concerns/comfy/reorder_action.rb

@@ -9,12 +9,11 @@ module Comfy::ReorderAction
 
   def reorder
     resource_class = self.class.reorder_action_resource
+    site_resources = resource_class.where(site_id: @site.id)
     (params.permit(order: [])[:order] || []).each_with_index do |id, index|
-      resource_class.where(id: id).update_all(position: index)
-    end
-    if resource_class == ::Comfy::Cms::Page
-      Comfy::Cms::Page.all.each(&:save!)
+      site_resources.where(id: id).update_all(position: index)
     end
+    @site.pages.each(&:save!) if resource_class == ::Comfy::Cms::Page
     head :ok
   end
 end

data/app/models/comfy/cms/categorization.rb

@@ -11,4 +11,13 @@ class Comfy::Cms::Categorization < ActiveRecord::Base
   # -- Validations -------------------------------------------------------------
   validates :category_id,
             uniqueness: { scope: %i[categorized_type categorized_id] }
+  validate :category_belongs_to_site
+
+private
+
+  def category_belongs_to_site
+    return unless category && categorized.respond_to?(:site_id)
+
+    errors.add(:category_id, :invalid) if category.site_id != categorized.site_id
+  end
 end

data/app/models/comfy/cms/category.rb

@@ -13,7 +13,7 @@ class Comfy::Cms::Category < ActiveRecord::Base
             presence: true,
             uniqueness: { scope: %i[categorized_type site_id] }
   validates :categorized_type,
-            presence:   true
+            presence: true
 
   # -- Scopes ---------------------------------------------------------------
   scope :of_type, ->(type) {

data/app/models/comfy/cms/fragment.rb

@@ -20,6 +20,7 @@ class Comfy::Cms::Fragment < ActiveRecord::Base
   validates :identifier,
             presence: true,
             uniqueness: { scope: :record }
+  validate :record_is_immutable, on: :update
 
   # -- Instance Methods --------------------------------------------------------
 
@@ -38,6 +39,12 @@ class Comfy::Cms::Fragment < ActiveRecord::Base
 
 protected
 
+  def record_is_immutable
+    return unless will_save_change_to_record_id? || will_save_change_to_record_type?
+
+    errors.add(:record, :invalid)
+  end
+
   def remove_attachments
     return unless @file_ids_destroy.present?
 

data/app/models/comfy/cms/layout.rb

@@ -20,13 +20,14 @@ class Comfy::Cms::Layout < ActiveRecord::Base
 
   # -- Validations -------------------------------------------------------------
   validates :site_id,
-            presence:   true
+            presence: true
   validates :label,
-            presence:   true
+            presence: true
   validates :identifier,
             presence: true,
             uniqueness: { scope: :site_id },
             format: { with: %r{\A\w[a-z0-9_-]*\z}i }
+  validate :parent_belongs_to_site
 
   # -- Class Methods -----------------------------------------------------------
   # Tree-like structure for layouts
@@ -101,6 +102,10 @@ class Comfy::Cms::Layout < ActiveRecord::Base
 
 protected
 
+  def parent_belongs_to_site
+    errors.add(:parent_id, :invalid) if site && parent && site_id != parent.site_id
+  end
+
   def assign_label
     self.label = label.blank? ? identifier.try(:titleize) : label
   end

data/app/models/comfy/cms/page.rb

@@ -40,6 +40,7 @@ class Comfy::Cms::Page < ActiveRecord::Base
             }
   validate :validate_target_page
   validate :validate_format_of_unescaped_slug
+  validate :associations_belong_to_site
 
   # -- Scopes ------------------------------------------------------------------
   scope :published, -> { where(is_published: true) }
@@ -106,6 +107,14 @@ class Comfy::Cms::Page < ActiveRecord::Base
 
 protected
 
+  def associations_belong_to_site
+    return unless site
+
+    errors.add(:parent_id, :invalid) if parent && site_id != parent.site_id
+    errors.add(:layout_id, :invalid) if layout && site_id != layout.site_id
+    errors.add(:target_page_id, :invalid) if target_page && site_id != target_page.site_id
+  end
+
   def assigns_label
     self.label = label.blank? ? slug.try(:titleize) : label
   end
@@ -118,18 +127,18 @@ protected
 
   def assign_full_path
     self.full_path =
-      if self.parent
-        [CGI.escape(self.parent.full_path).gsub('%2F', '/'), slug].join('/').squeeze('/')
+      if parent
+        [CGI.escape(parent.full_path).gsub('%2F', '/'), slug].join('/').squeeze('/')
       else
         '/'
       end
   end
 
   def assign_position
-    return unless self.parent
+    return unless parent
     return if position.to_i.positive?
 
-    max = self.parent.children.maximum(:position)
+    max = parent.children.maximum(:position)
     self.position = max ? max + 1 : 0
   end