elabs 3.0.0 → 4.0.0

data/config/brakeman.ignore

@@ -1,124 +1,26 @@
 {
   "ignored_warnings": [
     {
-      "warning_type": "Unscoped Find",
-      "warning_code": 82,
-      "fingerprint": "14eb16e2efd5474628f981fdff434cb13c73df4d17b93ceea6b82a8f99a09552",
-      "check_name": "UnscopedFind",
-      "message": "Unscoped call to Album#find",
-      "file": "app/controllers/albums_controller.rb",
-      "line": 18,
-      "link": "https://brakemanscanner.org/docs/warning_types/unscoped_find/",
-      "code": "Album.find(params[:id])",
+      "warning_type": "SQL Injection",
+      "warning_code": 0,
+      "fingerprint": "7d9b0d8fb977bbc2cf5fc42d0ad2c836141fa5ddba8c1ce84fb0dd2108cad6bd",
+      "check_name": "SQL",
+      "message": "Possible SQL injection",
+      "file": "app/controllers/elabs/elabs_public_controller.rb",
+      "line": 48,
+      "link": "https://brakemanscanner.org/docs/warning_types/sql_injection/",
+      "code": "orm_request.where(\"#{details[:type]}_id\" => find_related_id_by_slug(details[:type], details[:slug_field], params[field]))",
       "render_path": null,
       "location": {
         "type": "method",
-        "class": "AlbumsController",
-        "method": "set_album"
+        "class": "Elabs::ElabsPublicController",
+        "method": "build_request_where"
       },
-      "user_input": "params[:id]",
+      "user_input": "details[:type]",
       "confidence": "Weak",
       "note": ""
-    },
-    {
-      "warning_type": "Cross-Site Scripting",
-      "warning_code": 4,
-      "fingerprint": "74d83c9e5d3fb98de33d9c690a9380c40f0e35f3b85f390e871858bb8d34c1fe",
-      "check_name": "LinkToHref",
-      "message": "Potentially unsafe model attribute in link_to href",
-      "file": "app/views/licenses/show.html.haml",
-      "line": 15,
-      "link": "https://brakemanscanner.org/docs/warning_types/link_to_href",
-      "code": "link_to(_(\"TL; DR\"), License.find(params[:id]).tldr_url, :target => \"_blank\")",
-      "render_path": [{"type":"controller","class":"LicensesController","method":"show","line":18,"file":"app/controllers/licenses_controller.rb"}],
-      "location": {
-        "type": "template",
-        "template": "licenses/show"
-      },
-      "user_input": "License.find(params[:id]).tldr_url",
-      "confidence": "Weak",
-      "note": "URLS are set by admins only"
-    },
-    {
-      "warning_type": "Unscoped Find",
-      "warning_code": 82,
-      "fingerprint": "96f2f0238c7611c20a731155fa4ab107874326d762a84e9b1858c0801c10d741",
-      "check_name": "UnscopedFind",
-      "message": "Unscoped call to Note#find",
-      "file": "app/controllers/notes_controller.rb",
-      "line": 18,
-      "link": "https://brakemanscanner.org/docs/warning_types/unscoped_find/",
-      "code": "Note.find(params[:id])",
-      "render_path": null,
-      "location": {
-        "type": "method",
-        "class": "NotesController",
-        "method": "set_note"
-      },
-      "user_input": "params[:id]",
-      "confidence": "Weak",
-      "note": ""
-    },
-    {
-      "warning_type": "Unscoped Find",
-      "warning_code": 82,
-      "fingerprint": "b65152f1b2c4e9e18bcc4a3fd637b7bd5dd4b79421460a2c764bc3ead2ad1aa0",
-      "check_name": "UnscopedFind",
-      "message": "Unscoped call to Project#find",
-      "file": "app/controllers/projects_controller.rb",
-      "line": 23,
-      "link": "https://brakemanscanner.org/docs/warning_types/unscoped_find/",
-      "code": "Project.find(params[:id])",
-      "render_path": null,
-      "location": {
-        "type": "method",
-        "class": "ProjectsController",
-        "method": "set_project"
-      },
-      "user_input": "params[:id]",
-      "confidence": "Weak",
-      "note": ""
-    },
-    {
-      "warning_type": "Unscoped Find",
-      "warning_code": 82,
-      "fingerprint": "c03df681f497ea4ef182b6236295be2dd61879612b212e7a6ea3a1b2e6faf7d0",
-      "check_name": "UnscopedFind",
-      "message": "Unscoped call to Upload#find",
-      "file": "app/controllers/uploads_controller.rb",
-      "line": 17,
-      "link": "https://brakemanscanner.org/docs/warning_types/unscoped_find/",
-      "code": "Upload.find(params[:id])",
-      "render_path": null,
-      "location": {
-        "type": "method",
-        "class": "UploadsController",
-        "method": "set_upload"
-      },
-      "user_input": "params[:id]",
-      "confidence": "Weak",
-      "note": ""
-    },
-    {
-      "warning_type": "Cross-Site Scripting",
-      "warning_code": 4,
-      "fingerprint": "c125f39a448be85c1445467afabaf1a1992e9e1bf59af040b0277b33fa708901",
-      "check_name": "LinkToHref",
-      "message": "Potentially unsafe model attribute in link_to href",
-      "file": "app/views/licenses/show.html.haml",
-      "line": 12,
-      "link": "https://brakemanscanner.org/docs/warning_types/link_to_href",
-      "code": "link_to(_(\"Home page\"), License.find(params[:id]).url, :target => \"_blank\")",
-      "render_path": [{"type":"controller","class":"LicensesController","method":"show","line":18,"file":"app/controllers/licenses_controller.rb"}],
-      "location": {
-        "type": "template",
-        "template": "licenses/show"
-      },
-      "user_input": "License.find(params[:id]).url",
-      "confidence": "Weak",
-      "note": "URLS are set by admins only"
     }
   ],
-  "updated": "2018-08-01 07:04:08 +0200",
+  "updated": "2018-10-09 00:22:09 +0200",
   "brakeman_version": "4.3.1"
 }

data/config/locales/en.yml

@@ -0,0 +1,6 @@
+en:
+  # From rails-i18n:
+  # https://github.com/svenfuchs/rails-i18n/blob/master/rails/locale/
+  time:
+    formats:
+      medium: "%d %b %Y %I:%M %p"

data/config/locales/fr.yml

@@ -0,0 +1,6 @@
+fr:
+  # From rails-i18n:
+  # https://github.com/svenfuchs/rails-i18n/blob/master/rails/locale/
+  time:
+    formats:
+      medium: "%d %b %Y %H:%M"

data/config/routes.rb

@@ -8,50 +8,50 @@ Elabs::Engine.routes.draw do
     unlocks: 'elabs/auth/unlocks'
   }
   # Resources
-  resources :albums,    only: %i[index show] do
+  resources :albums,    only: %i[index show], param: :slug do
     resources :uploads, only: %i[index]
-    post 'comment', to: 'albums#create_comment', as: 'create_comment'
+    post 'comment', to: 'albums#create_comment', as: 'create_comment', param: :slug
   end
-  resources :articles,  only: %i[index show] do
-    post 'comment', to: 'articles#create_comment', as: 'create_comment'
+  resources :articles,  only: %i[index show], param: :slug do
+    post 'comment', to: 'articles#create_comment', as: 'create_comment', param: :slug
   end
-  resources :notes, only: %i[index show] do
-    post 'comment', to: 'notes#create_comment', as: 'create_comment'
+  resources :notes, only: %i[index show], param: :slug do
+    post 'comment', to: 'notes#create_comment', as: 'create_comment', param: :slug
   end
-  resources :projects, only: %i[index show] do
+  resources :projects, only: %i[index show], param: :slug do
     resources :articles, only: %i[index]
     resources :albums,   only: %i[index]
     resources :notes,    only: %i[index]
     resources :uploads,  only: %i[index]
-    post 'comment', to: 'projects#create_comment', as: 'create_comment'
+    post 'comment', to: 'projects#create_comment', as: 'create_comment', param: :slug
   end
-  resources :uploads, only: %i[index show] do
-    post 'comment', to: 'uploads#create_comment', as: 'create_comment'
+  resources :uploads, only: %i[index show], param: :slug do
+    post 'comment', to: 'uploads#create_comment', as: 'create_comment', param: :slug
   end
 
   # Classifiers
-  resources :languages, only: %i[index show] do
+  resources :languages, only: %i[index show], param: :iso639_1 do
     resources :albums,   only: %i[index]
     resources :articles, only: %i[index]
     resources :notes,    only: %i[index]
     resources :projects, only: %i[index]
     resources :uploads,  only: %i[index]
   end
-  resources :licenses, only: %i[index show] do
+  resources :licenses, only: %i[index show], param: :slug do
     resources :albums,   only: %i[index]
     resources :articles, only: %i[index]
     resources :notes,    only: %i[index]
     resources :projects, only: %i[index]
     resources :uploads,  only: %i[index]
   end
-  resources :tags, only: %i[index show] do
+  resources :tags, only: %i[index show], param: :slug do
     resources :albums,   only: %i[index]
     resources :articles, only: %i[index]
     resources :notes,    only: %i[index]
     resources :projects, only: %i[index]
     resources :uploads,  only: %i[index]
   end
-  resources :users, only: %i[index show] do
+  resources :users, only: %i[index show], param: :username do
     resources :albums,   only: %i[index]
     resources :articles, only: %i[index]
     resources :notes,    only: %i[index]
@@ -67,19 +67,19 @@ Elabs::Engine.routes.draw do
 
   # Member
   namespace :member do
-    resources :albums, except: %i[show] do
+    resources :albums, except: %i[show], param: :slug do
       put 'toggle_publication', to: 'albums#toggle_publication', as: :toggle_publication
     end
-    resources :articles, except: %i[show] do
+    resources :articles, except: %i[show], param: :slug do
       put 'toggle_publication', to: 'articles#toggle_publication', as: :toggle_publication
     end
-    resources :notes, except: %i[show] do
+    resources :notes, except: %i[show], param: :slug do
       put 'toggle_publication', to: 'notes#toggle_publication', as: :toggle_publication
     end
-    resources :projects, except: %i[show] do
+    resources :projects, except: %i[show], param: :slug do
       put 'toggle_publication', to: 'projects#toggle_publication', as: :toggle_publication
     end
-    resources :uploads, except: %i[show] do
+    resources :uploads, except: %i[show], param: :slug do
       put 'toggle_publication', to: 'uploads#toggle_publication', as: :toggle_publication
     end
 
@@ -90,32 +90,34 @@ Elabs::Engine.routes.draw do
 
     get '/infos', to: 'users#edit', as: :edit_infos
     patch '/infos', to: 'users#update', as: :update_infos
+
+    post '/markdown_previewer', to: 'markdown_previewer#preview', as: :markdown_preview
   end
 
   # Admin
   namespace :admin do
     # Content resources
-    resources :albums, only: %i[index destroy] do
+    resources :albums, only: %i[index destroy], param: :slug do
       put 'toggle_lock', to: 'albums#toggle_lock', as: :toggle_lock
     end
-    resources :articles, only: %i[index destroy] do
+    resources :articles, only: %i[index destroy], param: :slug do
       put 'toggle_lock', to: 'articles#toggle_lock', as: :toggle_lock
     end
-    resources :notes, only: %i[index destroy] do
+    resources :notes, only: %i[index destroy], param: :slug do
       put 'toggle_lock', to: 'notes#toggle_lock', as: :toggle_lock
     end
-    resources :projects, only: %i[index destroy] do
+    resources :projects, only: %i[index destroy], param: :slug do
       put 'toggle_lock', to: 'projects#toggle_lock', as: :toggle_lock
     end
-    resources :uploads, only: %i[index destroy] do
+    resources :uploads, only: %i[index destroy], param: :slug do
       put 'toggle_lock', to: 'uploads#toggle_lock', as: :toggle_lock
     end
 
     # Basic resources
-    resources :languages, except: %i[show]
-    resources :licenses,  except: %i[show]
+    resources :languages, except: %i[show], param: :iso639_1
+    resources :licenses,  except: %i[show], param: :slug
     resources :reports,   only:   %i[index destroy]
-    resources :tags,      except: %i[create show]
-    resources :users,     only:   %i[index show destroy]
+    resources :tags,      except: %i[create show], param: :slug
+    resources :users,     only:   %i[index show destroy], param: :username
   end
 end

data/db/migrate/20180917133442_add_urls_to_projects.rb

@@ -0,0 +1,6 @@
+class AddUrlsToProjects < ActiveRecord::Migration[5.2]
+  def change
+    add_column :projects, :sources_url, :string
+    add_column :projects, :docs_url,    :string
+  end
+end

data/db/migrate/20181005105642_add_reason_to_acts.rb

@@ -0,0 +1,5 @@
+class AddReasonToActs < ActiveRecord::Migration[5.2]
+  def change
+    add_column :acts, :reason, :string, default: nil, null: true
+  end
+end

data/db/migrate/20181006073541_add_slugs.rb

@@ -0,0 +1,39 @@
+class AddSlugs < ActiveRecord::Migration[5.2]
+  def up
+    %i[licenses tags albums articles notes projects uploads].each do |table|
+      add_column table, :slug, :string, null: true
+    end
+
+    ActiveRecord::Base.record_timestamps = false
+    begin
+      [
+        { model: Elabs::License, actable: false },
+        { model: Elabs::Tag, actable: false },
+        { model: Elabs::Album, actable: true },
+        { model: Elabs::Article, actable: true },
+        { model: Elabs::Note, actable: true },
+        { model: Elabs::Project, actable: true },
+        { model: Elabs::Upload, actable: true }
+      ].each do |table|
+        table[:model].all.each do |record|
+          record.fill_slug
+          record.minor_update = true if table[:actable]
+          record.save!
+        end
+      end
+    ensure
+      ActiveRecord::Base.record_timestamps = true
+    end
+
+    %i[licenses tags albums articles notes projects uploads].each do |table|
+      change_column table, :slug, :string, null: false
+      add_index table, :slug, unique: true
+    end
+  end
+
+  def down
+    %i[licenses tags albums articles notes projects uploads].each do |table|
+      remove_column table, :slug
+    end
+  end
+end

data/docs/migrating.md

@@ -1,5 +1,56 @@
 # Migration guide
 
+## From 3.x to 4.0.0
+
+First of all, read the changelog for the 4.0.0 release.
+
+Use a version control system to manage the changes and the overrides you
+made in your own application.
+
+- Add the Commonmarker gem: `gem 'commonmarker'` if you use the default
+  views
+- Update the base configuration (initializer, languages, ...):
+  `rails g elabs:install` and accept to override everything. Then check
+  changes
+- Apply the last migrations: `rake elabs:install:migrations` then
+  `rails db:migrate`
+
+Don't forget to rebuild the assets...
+
+If you have existing content you need to redirect you can use a runner
+like this one:
+
+```rb
+# Example for Apache
+# Uncomment if you need to enable RewriteEngine (mod_rewrite is required)
+puts "# RewriteEngine  on"
+
+[
+    { model: Elabs::Language, subs: %w[albums articles notes projects uploads] },
+    { model: Elabs::License, subs: %w[albums articles notes projects uploads] },
+    { model: Elabs::Tag, subs: %w[albums articles notes projects uploads] },
+    { model: Elabs::User, subs: %w[albums articles notes projects uploads] },
+    { model: Elabs::Album, subs: [] },
+    { model: Elabs::Article, subs: [] },
+    { model: Elabs::Note, subs: [] },
+    { model: Elabs::Project, subs: %w[albums articles notes uploads] },
+    { model: Elabs::Upload, subs: [] },
+].each do |config|
+  slug_field = config[:model]::SLUG_FIELD
+  endpoint   = config[:model].to_s.demodulize.tableize
+  puts '# Entities redirection'
+  config[:model].all.each do |record|
+    # Entity
+    puts "Redirect 301 /#{endpoint}/#{record.id} /#{endpoint}/#{record.send(slug_field)}"
+
+    # Nested resources
+    config[:subs].each do |sub|
+      puts "Redirect 301 /#{endpoint}/#{record.id}/#{sub} /#{endpoint}/#{record.send(slug_field)}/#{sub}"
+    end
+  end
+end
+```
+
 ## From 2.x to 3.0.0
 
 First of all, read the changelog for the 3.0.0 release

data/docs/setup.md

@@ -37,6 +37,7 @@ gem 'elabs'
 
 # If you want to use the default views:
 gem 'active_link_to'
+gem 'commonmarker'
 gem 'haml-rails'
 gem 'mini_magick'
 ```

data/lib/elabs.rb

@@ -34,9 +34,14 @@ module Elabs
   mattr_accessor :av_formats_video
   @@av_formats_video = ['video/mp4', 'video/webm', 'video/ogg']
 
+  # Whether or not to use avatars. This feature is experimental
   mattr_accessor :use_avatars
   @@use_avatars = false
 
+  # Close the registrations
+  mattr_accessor :users_can_register
+  @@users_can_register = true
+
   def self.setup
     yield self
   end

data/lib/elabs/version.rb

@@ -1,3 +1,3 @@
 module Elabs
-  VERSION = '3.0.0'.freeze
+  VERSION = '4.0.0'.freeze
 end

data/lib/generators/elabs/install_generator.rb

@@ -18,6 +18,7 @@ module Elabs
 
       def copy_files
         template 'elabs.rb', 'config/initializers/elabs.rb'
+        template 'user_model.rb', 'app/models/user.rb'
         template 'fast_gettext.rb', 'config/initializers/fast_gettext.rb'
         directory 'locale'
       end

data/lib/generators/elabs/views_generator.rb

@@ -18,7 +18,6 @@ module Elabs
 
       def copy_views
         directory 'app/views/elabs'
-        directory 'app/views/devise'
       end
     end
   end

data/lib/generators/templates/elabs.rb

@@ -1,3 +1,4 @@
+# Don't forget to restart the server when you edit this file.
 Elabs.setup do |config|
   # Site name, used in menus and other places
   config.site_name = 'A new app'
@@ -28,4 +29,7 @@ Elabs.setup do |config|
   # attached file is deleted on failure, resulting on avatar suppression.
   # Set this value to false to avoid using avatars
   config.use_avatars = false
+
+  # Open/close the registrations
+  config.users_can_register = true
 end