drg_cms 0.4.39

data/app/controllers/dc_application_controller.rb

@@ -0,0 +1,385 @@
+#coding: utf-8
+#--
+# Copyright (c) 2012+ Damjan Rems
+#
+# Permission is hereby granted, free of charge, to any person obtaining
+# a copy of this software and associated documentation files (the
+# "Software"), to deal in the Software without restriction, including
+# without limitation the rights to use, copy, modify, merge, publish,
+# distribute, sublicense, and/or sell copies of the Software, and to
+# permit persons to whom the Software is furnished to do so, subject to
+# the following conditions:
+#
+# The above copyright notice and this permission notice shall be
+# included in all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+# LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+# OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+# WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+#++
+class DcApplicationController < ActionController::Base
+  protect_from_forgery
+  
+########################################################################
+# Writes anything passed as parameter to log/dump file.
+# 
+# Very usefull for debuging strange errors.
+########################################################################
+def dc_dump(*args)
+  args.each do |arg|
+    File.open(Rails.root.join('log/dump.log'),'a') {|f| f.write(arg.to_s + "\n") }
+  end
+end
+  
+####################################################################
+# return true if in edit mode
+####################################################################
+def dc_edit_mode?
+  session[:edit_mode] > 1
+end
+
+####################################################################
+# Return true if user has required role
+####################################################################
+def dc_user_has_role( role, user=session[:user_id] )
+  if role.class == String
+    rol = role
+    role = DcPolicyRole.find_by(name: rol)
+    role = DcPolicyRole.find_by(system_name: rol) if role.nil?
+  end
+  return false if role.nil?
+# role is found in user_roles
+  session[:user_roles].include?(role._id)
+end
+
+####################################################################
+# Determine site from url and return site record (document)
+####################################################################
+def dc_get_site()
+  return @site if @site 
+  uri  = URI.parse(request.url)
+  @site = DcSite.find_by(name: uri.host)
+# Site can be aliased
+  if @site and !@site.alias_for.blank?
+    @site = DcSite.find_by(name: @site.alias_for)
+  end
+# Development environment. Check if site with name test exists and use 
+# alias_for as pointer to real site.
+  if @site.nil? and ENV["RAILS_ENV"] != 'production'
+    @site = DcSite.find_by(name: 'test')
+    @site = DcSite.find_by(name: @site.alias_for) if @site
+  end 
+  @site = nil if @site and !@site.active # site is disabled
+  @site
+end
+
+####################################################################
+# Determine and return site record from url. It would be nice but it is not working.
+####################################################################
+def self.dc_get_site_()
+  #self.dc_get_site()
+end
+
+########################################################################
+# Searches forms file in forms path and returns it's name.
+########################################################################
+def dc_find_form_file(form)
+  DrgCms.paths(:forms).reverse.each do |path|
+    f = "#{path}/#{form}.yml"
+    return f if File.exist?(f)
+  end
+  p "Form file #{form} not found!"
+  nil
+end
+
+#######################################################################
+# Render 404 error with some debug includded
+########################################################################
+def dc_render_404(where_the_error_is=nil)
+  render(file: "#{Rails.root}/public/404", :status => 404, :layout => false, :formats => [:html], 
+         locals: {error_is: where_the_error_is})
+end
+
+########################################################################
+# Log visit to dc_visit 
+########################################################################
+def dc_log_visit()
+  if request.env["HTTP_USER_AGENT"] and request.env["HTTP_USER_AGENT"].match(/\(.*https?:\/\/.*\)/)
+    logger.info "ROBOT: #{Time.now.strftime('%Y.%m.%d %H:%M:%S')} id=#{@page.id} ip=#{request.remote_ip}."
+    session[:is_robot] = true
+  else
+    DcVisit.create(site_id: @site.id, 
+                   user_id: session[:user_id], 
+                   page_id: @page.id, 
+                   ip: request.remote_ip,
+                   session_id: request.session_options[:id],
+                   time: Time.now )
+  end
+end
+
+protected
+
+#############################################################################
+# Add permissions. Subroutine of dc_user_can
+############################################################################
+def add_permissions_l(table_name=nil) # NODOC
+  perm = table_name.nil? ? DcPermission.find_by(is_default: true) : DcPermission.find_by(table_name: table_name, active: true)
+  (perm.dc_policy_rules.each {|p1| @permissions[p1.dc_policy_role_id] = p1.permission }) if perm
+end
+
+############################################################################
+# Returns true if user's role permits to perform operation on a table(collection) 
+# with required permission.
+# 
+# @example 
+#   dc_user_can(DcPermission::CAN_VIEW, params[:table])
+# 
+# @param [ permission ] Required permission level
+# @param [ table ] Name of table(collection) for which permission is required
+#   Defaults to params[:table]
+############################################################################
+def dc_user_can(permission, table=params[:table])
+  if @permissions.nil?
+    @permissions = {}
+    add_permissions_l # default permission
+    table_name = ''
+# permission can be set for table or object embedded in table. Read all possible values  
+    table.strip.downcase.split(';').each do |t|
+      table_name << (table_name.size > 0 ? ';' : '') + t # table;embedded;another;...
+      add_permissions_l table_name
+    end
+  end
+# Sometimes anonymous user is allowed to use cmsedit. Search for system default role.
+#TODO This might not be the best idea. Check in the future.
+  if session[:user_roles].nil?
+    guest = DcUserRole.find_by(:system_name => 'guest')
+    session[:user_roles] = guest ? [guest.id] : []
+  end
+# Return true if any of the permissions user has is higher or equal to requested permission 
+  session[:user_roles].each {|r| return true if @permissions[r] and @permissions[r] >= permission }
+  false
+end  
+
+####################################################################
+# Detects if called from mobile agent.
+# According to http://detectmobilebrowsers.com/
+####################################################################
+def dc_set_is_mobile
+  is_mobile = /(android|bb\d+|meego).+mobile|avantgo|bada\/|blackberry|blazer|compal|elaine|fennec|hiptop|iemobile|ip(hone|od)|iris|kindle|lge |maemo|midp|mmp|netfront|opera m(ob|in)i|palm( os)?|phone|p(ixi|re)\/|plucker|pocket|psp|series(4|6)0|symbian|treo|up\.(browser|link)|vodafone|wap|windows (ce|phone)|xda|xiino/i.match(request.user_agent) || /1207|6310|6590|3gso|4thp|50[1-6]i|770s|802s|a wa|abac|ac(er|oo|s\-)|ai(ko|rn)|al(av|ca|co)|amoi|an(ex|ny|yw)|aptu|ar(ch|go)|as(te|us)|attw|au(di|\-m|r |s )|avan|be(ck|ll|nq)|bi(lb|rd)|bl(ac|az)|br(e|v)w|bumb|bw\-(n|u)|c55\/|capi|ccwa|cdm\-|cell|chtm|cldc|cmd\-|co(mp|nd)|craw|da(it|ll|ng)|dbte|dc\-s|devi|dica|dmob|do(c|p)o|ds(12|\-d)|el(49|ai)|em(l2|ul)|er(ic|k0)|esl8|ez([4-7]0|os|wa|ze)|fetc|fly(\-|_)|g1 u|g560|gene|gf\-5|g\-mo|go(\.w|od)|gr(ad|un)|haie|hcit|hd\-(m|p|t)|hei\-|hi(pt|ta)|hp( i|ip)|hs\-c|ht(c(\-| |_|a|g|p|s|t)|tp)|hu(aw|tc)|i\-(20|go|ma)|i230|iac( |\-|\/)|ibro|idea|ig01|ikom|im1k|inno|ipaq|iris|ja(t|v)a|jbro|jemu|jigs|kddi|keji|kgt( |\/)|klon|kpt |kwc\-|kyo(c|k)|le(no|xi)|lg( g|\/(k|l|u)|50|54|\-[a-w])|libw|lynx|m1\-w|m3ga|m50\/|ma(te|ui|xo)|mc(01|21|ca)|m\-cr|me(rc|ri)|mi(o8|oa|ts)|mmef|mo(01|02|bi|de|do|t(\-| |o|v)|zz)|mt(50|p1|v )|mwbp|mywa|n10[0-2]|n20[2-3]|n30(0|2)|n50(0|2|5)|n7(0(0|1)|10)|ne((c|m)\-|on|tf|wf|wg|wt)|nok(6|i)|nzph|o2im|op(ti|wv)|oran|owg1|p800|pan(a|d|t)|pdxg|pg(13|\-([1-8]|c))|phil|pire|pl(ay|uc)|pn\-2|po(ck|rt|se)|prox|psio|pt\-g|qa\-a|qc(07|12|21|32|60|\-[2-7]|i\-)|qtek|r380|r600|raks|rim9|ro(ve|zo)|s55\/|sa(ge|ma|mm|ms|ny|va)|sc(01|h\-|oo|p\-)|sdk\/|se(c(\-|0|1)|47|mc|nd|ri)|sgh\-|shar|sie(\-|m)|sk\-0|sl(45|id)|sm(al|ar|b3|it|t5)|so(ft|ny)|sp(01|h\-|v\-|v )|sy(01|mb)|t2(18|50)|t6(00|10|18)|ta(gt|lk)|tcl\-|tdg\-|tel(i|m)|tim\-|t\-mo|to(pl|sh)|ts(70|m\-|m3|m5)|tx\-9|up(\.b|g1|si)|utst|v400|v750|veri|vi(rg|te)|vk(40|5[0-3]|\-v)|vm40|voda|vulc|vx(52|53|60|61|70|80|81|83|85|98)|w3c(\-| )|webc|whit|wi(g |nc|nw)|wmlb|wonu|x700|yas\-|your|zeto|zte\-/i.match(request.user_agent[0..3])
+  session[:is_mobile] = is_mobile ? 1 : 0
+end
+
+
+##########################################################################
+# Merge values from params fields (from site, page ...) into internal @options hash.
+##########################################################################
+def dc_set_options(parameters)
+  @options ||= {}
+  return if parameters.to_s.size < 3
+# parameters are set az YAML. This should be default in future.
+  parms = YAML.load(parameters) rescue nil
+  if parms.nil? # error when loadnig yaml, try the old way parsing manually
+    parms = {}
+    parameters.split("\n").each do |line|
+      line.chomp.split(',').each do |parm|
+        key, value = parm.split(':')
+        parms[key.strip] = value.to_s.strip.gsub(/\'|\"/,'')
+      end
+    end
+  end
+  @options.merge!(parms)
+end
+
+##########################################################################
+# Default request processing.
+##########################################################################
+def dc_process_default_request()
+  session[:edit_mode] ||= 0
+# Initialize parts
+  @parts    = nil
+  @js, @css = '', ''
+# find domain name in sites
+  @site = dc_get_site
+# site is not defined. render 404 error
+  return dc_render_404('Site!') if @site.nil?
+  dc_set_options(@site.settings)
+# HOMEPAGE. When no parameters is set
+  params[:path] = @site.homepage_link if params[:id].nil? and params[:path].nil?
+# Search for page 
+  pageclass = @site.page_table.classify.constantize
+  if params[:id]
+    #Page.where(id: params[:id]).or(subject_link: params[:id]).first    
+    @page = pageclass.find_by(:dc_site_id.in => [@site._id, nil], subject_link: params[:id])
+    @page = pageclass.find(params[:id]) if @page.nil? # I think that there will be more subject_link searchers than id
+  elsif params[:path]
+# path may point direct to page's subject_link
+    @page = pageclass.find_by(:dc_site_id.in => [@site._id, nil], subject_link: params[:path])
+    if @page.nil?
+# no. Find if defined in links
+      link = DcLink.find_by(:dc_site_id.in => [@site._id, nil], name: params[:path])
+      if link
+        #pageclass.find_by(alt_link: params[:path])   
+        dc_set_options link.params
+        @page = pageclass.find(link.page_id)   
+      end
+    end
+  end
+# if @page is not found render 404 error
+  return dc_render_404('Page!') unless @page
+  dc_set_options @page.params
+  dc_set_is_mobile unless session[:is_mobile] # do it only once per session
+# find design if defined. Otherwise design MUST be declared in site
+  if @page.dc_design_id
+    @design = DcDesign.find(@page.dc_design_id)
+    return dc_render_404('Design!') unless @design
+  end
+# Add edit menu
+  layout = 'content'
+  if session[:edit_mode] > 0
+    layout = 'cms'
+    session[:site_id]         = @site.id
+    session[:site_page_table] = @site.page_table
+    session[:page_id]         = @page.id
+  else 
+# Log only visits from non-editors
+    dc_log_visit()
+  end
+  @page_title = @page.subject.empty? ? @site.page_title : @page.subject
+# render view. inline if defined in design
+  view_filename = ''
+  view_filename = @design.rails_view.to_s if @design
+  view_filename = @site.rails_view.to_s   if view_filename.size < 5
+  if view_filename.size < 5
+    @design.body = "<%= render partial: 'cmsedit/edit_stuff' %>\n" + @design.body if session[:edit_mode] > 0 
+    @design.body << '<style type="text/css"><%= @css.html_safe %></style><%= javascript_tag @js %>'
+    render(inline: @design.body, layout: layout)
+  else
+    render view_filename, layout: layout
+  end
+end
+
+########################################################################
+# Decamelizes string. It probably doesn't work very good with non ascii chars.
+# Therefore it is very unwise to use non ascii chars for table (collection) names.
+########################################################################
+def decamelize_type(st)
+  return nil unless st
+  r = ''
+  st.to_s.each_char do |c|
+    r << case 
+      when r.size == 0     then c.downcase
+      when c.downcase != c then '_' + c.downcase
+      else c      
+    end
+  end
+  r
+end
+
+####################################################################
+# Return's error messages for the document formated for display on edit form.
+# 
+# @param [ document ] Document var
+####################################################################
+def dc_error_messages_for(document)
+  return '' unless document.errors.any?
+  msg = ''
+  document.errors.each do |attribute, errors_array|
+    label = t("helpers.label.#{decamelize_type(document.class)}.#{attribute}")
+    msg << "<li>#{label} : #{errors_array}</li>"
+  end
+
+html = <<eot
+<div class="dc-form-error"> 
+  <h2>#{t('drgcms.errors_no')} #{document.errors.size}</h2>  
+  <ul>#{msg}</ul>  
+</div>
+eot
+  html.html_safe
+end
+
+####################################################################
+# Checks if any errors exist on document and writes debug log. It can also 
+# crash if requested. This is mostly usefull in development for debuging 
+# model errors.
+# 
+# @param [ document ] Document var
+# @param [ crash ] Should crash when errors detected. Default = false.
+####################################################################
+def dc_check_model(document, crash=false)
+  return nil unless document.errors.any?
+  msg = ''
+  document.errors.each do |attribute, errors_array|
+    msg << "#{attribute}: #{errors_array}\n"
+  end
+  logger.debug(msg)
+  crash_it if crash
+  msg
+end
+
+######################################################################
+# Can call rake task from controller.
+# @example 
+#   dc_call_rake('clear:all', some_parm: some_id)
+# 
+# @param [ task ] Rake task name
+# @param [ options ] Options that will be send to task as environment variables
+######################################################################
+def dc_call_rake(task, options = {})
+  options[:rails_env] ||= Rails.env
+  args = options.map { |o, v| "#{o.to_s.upcase}='#{v}'" }
+  system "rake #{task} #{args.join(' ')} --trace 2>&1 >> #{Rails.root}/log/rake.log &"
+end
+
+######################################################################
+# Small helper for formating ajax return from controller. This is higly experimental.
+# @example 
+#   dc_render_ajax(operation: :div, prepand: html_code)
+# 
+# @param [ task ] Rake task name
+# @param [ options ] Options that will be send to task as environment variables
+######################################################################
+def dc_render_ajax(opts)
+  result = {}
+  if opts[:operation].to_s == 'div' or opts[:operation].to_s == 'class'
+    selector = opts[:operation].to_s == 'div' ? '#' : '.' # for div . for class
+    key = case
+      when opts[:prepend] then "#{selector}+div"
+      when opts[:append]  then "#{selector}div+"
+    else "#{selector}div"
+    end
+    key << '_' + opts[ opts[:operation].to_sym ] 
+  else
+    key = opts[:operation] + '_'
+  end
+  result[key] = opts[:value] || opts[:url] || ''
+  render inline: result.to_json, formats: 'js'
+end
+
+########################################################################
+# Find document by parameters 
+# @example 
+#   dc_find_document(params[:table], params[:id], params[:ids]
+# 
+# @param [ table ] table (collection) name. Could be dc_page;dc_part;... when embedded document
+# @param [ id ] Id of the document
+# @param [ ids ] Ids of parent documents when document is embedded. Ids are separated by ; char. 
+########################################################################
+def dc_find_document(table, id, ids)
+  tables = table.split(';')
+  if tables.size == 1
+    doc = tables.first.classify.constantize.find(id)
+  else
+    ids = ids.split(';')
+    doc = tables.first.classify.constantize.find(ids.first)                           # top most record
+    1.upto(tables.size - 2) { |i| doc = doc.send(tables[i].pluralize).find(ids[i]) }  # find embedded childrens by ids
+    doc = doc.send(tables.last.pluralize).find(id)   # our record
+  end
+  doc
+end
+
+
+end

data/app/controllers/dc_at_the_beginning_controller.rb

@@ -0,0 +1,120 @@
+#--
+# Copyright (c) 2012-2013 Damjan Rems
+#
+# Permission is hereby granted, free of charge, to any person obtaining
+# a copy of this software and associated documentation files (the
+# "Software"), to deal in the Software without restriction, including
+# without limitation the rights to use, copy, modify, merge, publish,
+# distribute, sublicense, and/or sell copies of the Software, and to
+# permit persons to whom the Software is furnished to do so, subject to
+# the following conditions:
+#
+# The above copyright notice and this permission notice shall be
+# included in all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+# LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+# OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+# WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+#++
+
+########################################################################
+#
+########################################################################
+class DcAtTheBeginningController < DcApplicationController
+
+before_filter :check_if_ok
+ 
+########################################################################
+#
+########################################################################
+def index
+end
+
+########################################################################
+#
+########################################################################
+def create
+  if params['password1'] != params['password2']
+    flash[:error] = "Password doesn't match!"
+    return render action: 'index' 
+  end
+  if params['password1'].size < 8
+    flash[:error] = "Please be more creative. Password should be at least 8 characters long!"
+    return render action: 'index' 
+  end
+# New role
+  role = DcPolicyRole.new
+  role.name = 'superadmin'
+  role.system_name = 'superadmin'
+  role.save
+# User
+  usr = DcUser.new
+  usr.username    =  params['username']
+  usr.password    = params['password1']
+  usr.password_confirmation = params['password2']
+  usr.first_name  = 'superadmin'
+  usr.save
+# user role 
+  r = usr.dc_user_roles.new
+  r.dc_policy_role_id = role._id
+  r.save
+# cmsedit permission
+  permission = DcPermission.new
+  permission.table_name = 'Default permission'
+  permission.is_default = true
+  permission.save
+# 
+  r = permission.dc_policy_rules.new
+  r.dc_policy_role_id = role._id
+  r.permission = DcPermission::SUPERADMIN
+  r.save
+# create login poll
+  poll = DcPoll.new
+  poll.name = 'login'
+  poll.display = 'td'
+  poll.operation = 'link'
+  poll.parameters = '/dc_common/process_login'
+  poll.title = 'Autocreated login form'
+  poll.save
+#
+  i = poll.dc_poll_items.new
+  i.name = 'username'
+  i.size = 15
+  i.text = 'Username'
+  i.type = 'text_field'
+  i.save
+#  
+  i = poll.dc_poll_items.new
+  i.name = 'password'
+  i.size = 15
+  i.text = 'Password'
+  i.type = 'password_field'
+  i.save
+#
+  i = poll.dc_poll_items.new
+  i.name = 'send'
+  i.text = 'Login'
+  i.type = 'submit_tag'
+  i.save
+  
+  redirect_to '/cmsedit/login'
+end  
+
+########################################################################
+#
+########################################################################
+def check_if_ok
+  DcPermission.all.delete  
+  DcUserRole.all.delete
+  DcUser.all.delete
+  return dc_render_404('At the beginning: It can only be done in development!') if ENV["RAILS_ENV"] != 'development'
+  return dc_render_404('At the beginning: Permissions table is not empty!') if DcPermission.all.size > 0 
+  return dc_render_404('At the beginning: Roles table is not empty!') if DcUserRole.all.size > 0 
+  return dc_render_404('At the beginning: Users table is not empty!') if DcUser.all.size > 0 
+end
+
+end