gluttonberg-core 2.6.4 → 3.0.0

data/app/controllers/gluttonberg/admin/settings/embeds_controller.rb

@@ -0,0 +1,79 @@
+# encoding: utf-8
+
+module Gluttonberg
+  module Admin
+    module Settings
+      # this controller manages embed code (shortcodes). 
+      # wysiwyg snippets which can be embed in other content.
+      class EmbedsController < Gluttonberg::Admin::BaseController
+        before_filter :find_embed, :only => [:edit, :update, :delete, :destroy]
+        before_filter :authorize_user , :except => [:destroy , :delete]
+        before_filter :authorize_user_for_destroy , :only => [:destroy , :delete]
+        record_history :@embed
+
+        def index
+          @embeds = Embed.order("created_at ASC")
+        end
+
+        def new
+          @embed = Embed.new
+        end
+
+        def create
+          @embed = Embed.new(params[:gluttonberg_embed])
+          generic_create(@embed, {
+            :name => "embed",
+            :success_path => admin_embeds_path
+          })
+        end
+
+        def edit
+        end
+
+        def update
+          @embed.assign_attributes(params[:gluttonberg_embed])
+          generic_update(@embed, {
+            :name => "embed",
+            :success_path => admin_embeds_path
+          })
+        end
+
+        def delete
+          display_delete_confirmation(
+            :title      => "Delete Embed '#{@embed.name}'?",
+            :url        => admin_embed_path(@embed),
+            :return_url => admin_embeds_path,
+            :warning    => ""
+          )
+        end
+
+        def destroy
+          generic_destroy(@embed, {
+            :name => "embed",
+            :success_path => admin_embeds_path,
+            :failure_path => admin_embeds_path
+          })
+        end
+
+        def list_for_redactor
+          @embeds = Embed.order("created_at ASC")
+          render :layout => false
+        end
+
+        protected
+
+          def find_embed
+            @embed = Embed.where(:id  => params[:id]).first
+          end
+
+          def authorize_user
+            authorize! :manage, Gluttonberg::Embed
+          end
+
+          def authorize_user_for_destroy
+            authorize! :destroy, Gluttonberg::Embed
+          end
+      end # controller
+    end
+  end
+end

data/app/controllers/gluttonberg/admin/settings/locales_controller.rb

@@ -4,7 +4,7 @@ module Gluttonberg
   module  Admin
     module Settings
       class LocalesController < Gluttonberg::Admin::BaseController
-        before_filter :find_locale, :only => [:delete, :edit, :update, :destroy]        
+        before_filter :find_locale, :only => [:delete, :edit, :update, :destroy]
         before_filter :authorize_user
         record_history :@locale
 
@@ -23,52 +23,46 @@ module Gluttonberg
           display_delete_confirmation(
             :title      => "Delete “#{@locale.name}” locale?",
             :url        => admin_locale_path(@locale),
-            :return_url => admin_locales_path , 
+            :return_url => admin_locales_path ,
             :warning    => "Page localizations of this locale will also be deleted."
-          )        
+          )
         end
 
         def create
-          @locale = Locale.new(params["gluttonberg_locale"])
-          if @locale.save
-            flash[:notice] = "The locale was successfully created."
-            redirect_to admin_locales_path
-          else
-            render :new
-          end
+          @locale = Locale.new(params[:gluttonberg_locale])
+          generic_create(@locale, {
+            :name => "locale",
+            :success_path => admin_locales_path
+          })
         end
 
         def update
-          if @locale.update_attributes(params["gluttonberg_locale"]) || !@locale.dirty?
-            flash[:notice] = "The locale was successfully updated."
-            redirect_to admin_locales_path
-          else
-            flash[:error] = "Sorry, The locale could not be updated."
-            render :edit
-          end
+          @locale.assign_attributes(params["gluttonberg_locale"]) || !@locale.dirty?
+          generic_update(@locale, {
+            :name => "locale",
+            :success_path => admin_locales_path
+          })
         end
 
         def destroy
-          if @locale.destroy
-            flash[:notice] = "The locale was successfully deleted."
-            redirect_to admin_locales_path
-          else
-            flash[:error] = "There was an error deleting the locale."
-            redirect_to admin_locales_path
-          end
+          generic_destroy(@locale, {
+            :name => "locale",
+            :success_path => admin_locales_path,
+            :failure_path => admin_locales_path
+          })
         end
 
         private
-      
+
           def find_locale
-            @locale = Locale.find(params[:id])
+            @locale = Locale.where(:id  => params[:id]).first
             raise ActiveRecord::RecordNotFound  unless @locale
           end
-          
+
           def authorize_user
             authorize! :manage, Gluttonberg::Locale
           end
-      
+
       end
     end
   end

data/app/controllers/gluttonberg/admin/settings/stylesheets_controller.rb

@@ -2,75 +2,70 @@
 
 module Gluttonberg
   module Admin
-    module Settings    
+    module Settings
+      # CMS based stylesheets management
       class StylesheetsController < Gluttonberg::Admin::BaseController
         drag_tree Stylesheet , :route_name => :admin_stylesheet_move
         before_filter :find_stylesheet, :only => [:edit, :update, :delete, :destroy]
-        before_filter :authorize_user , :except => [:destroy , :delete]  
+        before_filter :authorize_user , :except => [:destroy , :delete]
         before_filter :authorize_user_for_destroy , :only => [:destroy , :delete]
         record_history :@stylesheet
 
         def index
           @stylesheets = Stylesheet.order("position ASC")
         end
-        
+
         def new
           @stylesheet = Stylesheet.new
         end
-        
+
         def create
           @stylesheet = Stylesheet.new(params[:gluttonberg_stylesheet])
-          if @stylesheet.save
-            flash[:notice] = "The stylesheet was successfully created."
-            redirect_to admin_stylesheets_path
-          else
-            render :edit
-          end
+          generic_create(@stylesheet, {
+            :name => "stylesheet",
+            :success_path => admin_stylesheets_path
+          })
         end
-        
+
         def edit
           unless params[:version].blank?
-            @version = params[:version]  
+            @version = params[:version]
             @stylesheet.revert_to(@version)
           end
         end
-        
+
         def update
-          if @stylesheet.update_attributes(params[:gluttonberg_stylesheet])
-            flash[:notice] = "The stylesheet was successfully updated."
-            redirect_to admin_stylesheets_path
-          else
-            flash[:error] = "Sorry, The stylesheet could not be updated."
-            render :edit
-          end
+          @stylesheet.assign_attributes(params[:gluttonberg_stylesheet])
+          generic_update(@stylesheet, {
+            :name => "stylesheet",
+            :success_path => admin_stylesheets_path
+          })
         end
-                
+
         def delete
           display_delete_confirmation(
             :title      => "Delete Stylesheet '#{@stylesheet.name}'?",
             :url        => admin_stylesheet_path(@stylesheet),
-            :return_url => admin_stylesheets_path, 
+            :return_url => admin_stylesheets_path,
             :warning    => ""
           )
         end
-        
+
         def destroy
-          if @stylesheet.delete
-            flash[:notice] = "The stylesheet was successfully deleted."
-            redirect_to admin_stylesheets_path
-          else
-            flash[:error] = "There was an error deleting the stylesheet."
-            redirect_to admin_stylesheets_path
-          end
+          generic_destroy(@stylesheet, {
+            :name => "stylesheet",
+            :success_path => admin_stylesheets_path,
+            :failure_path => admin_stylesheets_path
+          })
         end
-        
-                
+
+
         protected
-        
+
           def find_stylesheet
-            @stylesheet = Stylesheet.find(params[:id])
+            @stylesheet = Stylesheet.where(:id  => params[:id]).first
           end
-          
+
           def authorize_user
             authorize! :manage, Gluttonberg::Stylesheet
           end
@@ -78,7 +73,7 @@ module Gluttonberg
           def authorize_user_for_destroy
             authorize! :destroy, Gluttonberg::Stylesheet
           end
-          
+
       end
     end
   end

data/app/controllers/gluttonberg/admin/settings/users_controller.rb

@@ -12,45 +12,35 @@ module Gluttonberg
           unless current_user.super_admin? || current_user.admin?
             redirect_to :action => "edit" , :id => current_user.id
           end
-          if current_user.super_admin?
-            unless params[:query].blank?
-              @users = User.order(get_order).where("first_name LIKE '%#{params[:query]}%' OR last_name LIKE '%#{params[:query]}%' OR email LIKE '%#{params[:query]}%' OR bio LIKE '%#{params[:query]}%' " )
-            else
-              @users = User.order(get_order)
-            end
-          else
-            unless params[:query].blank?
-              @users = User.order(get_order).where("role != 'super_admin' AND (first_name LIKE '%#{params[:query]}%' OR last_name LIKE '%#{params[:query]}%' OR email LIKE '%#{params[:query]}%' OR bio LIKE '%#{params[:query]}%' )" )
-            else
-              @users = User.order(get_order).where( ["role != ?" , "super_admin"])
-            end
-          end
-
+          @users = User.search_users(params[:query], current_user, get_order)
           @users = @users.paginate(:page => params[:page] , :per_page => Gluttonberg::Setting.get_setting("number_of_per_page_items") )
         end
 
         def new
           @user = User.new
+          prepare_authorizations
         end
 
         def create
-          role = params[:user].delete(:role) unless params[:user].blank?
-          @user = User.new(params[:user])
-          @user.role = role if current_user.user_valid_roles(@user).include?(role)
+          @user = User.new
+          set_role
+          @user.assign_attributes(params[:user])
+
           if @user.save
             flash[:notice] = "Account registered!"
             redirect_to admin_users_path
           else
+            prepare_authorizations
             render :action => :new
           end
         end
 
         def edit
+          prepare_authorizations
         end
 
         def update
-          role = params[:user].delete(:role) unless params[:user].blank?
-          @user.role = role if current_user.user_valid_roles(@user).include?(role)
+          set_role
           if @user.update_attributes(params[:user])
             flash[:notice] = "Account updated!"
             if current_user.super_admin? || current_user.admin?
@@ -59,6 +49,7 @@ module Gluttonberg
               redirect_to  :action => :edit
             end
           else
+            prepare_authorizations
             flash[:notice] = "Failed to save account changes!"
             render :action => :edit
           end
@@ -73,30 +64,16 @@ module Gluttonberg
         end
 
         def destroy
-          if @user.destroy
-            flash[:notice] = "Account deleted!"
-            redirect_to admin_users_path
-          else
-            flash[:error] = "There was an error deleting the account."
-            redirect_to admin_users_path
-          end
+          generic_destroy(@user, {
+            :name => "user",
+            :success_path => admin_users_path,
+            :failure_path => admin_users_path
+          })
         end
 
-       private
+        private
           def find_user
-            if current_user.super_admin?
-             @user = User.find(params[:id])
-            elsif current_user.admin?
-              @user = User.find(params[:id])
-              if @user.super_admin?
-                @user = nil
-              end
-            else
-              @user = User.find(params[:id])
-              unless @user.id == current_user.id
-                @user =  nil
-              end
-            end
+            @user = User.find_user(params[:id], current_user)
             raise ActiveRecord::RecordNotFound  unless @user
           end
 
@@ -104,6 +81,34 @@ module Gluttonberg
             authorize! :manage, User
           end
 
+          def prepare_authorizations
+            if Rails.configuration.limited_roles.include?(@user.role) && @user.id != current_user.id
+              @user.authorizations.build(:authorizable_type => "Gluttonberg::Page") if @user.authorizations.where(:authorizable_type => "Gluttonberg::Page").first.blank?
+              prepare_authorizations_for_blog
+              @user.authorizations.build(:authorizable_type => "Gluttonberg::Gallery") if Rails.configuration.enable_gallery && @user.authorizations.where(:authorizable_type => "Gluttonberg::Gallery").first.blank?
+              prepare_authorizations_for_custom_models
+            end
+          end
+
+          def prepare_authorizations_for_blog
+            if Gluttonberg.constants.include?(:Blog)
+              Gluttonberg::Blog::Weblog.all.each do |blog|
+                @user.authorizations.build(:authorizable_type => "Gluttonberg::Blog::Weblog", :authorizable_id => blog.id) if @user.authorizations.where(:authorizable_type => "Gluttonberg::Blog::Weblog", :authorizable_id => blog.id).first.blank?
+              end
+            end
+          end
+
+          def prepare_authorizations_for_custom_models
+            Gluttonberg::Components.can_custom_model_list.each do |model_name|
+              @user.authorizations.build(:authorizable_type => model_name) if @user.authorizations.where(:authorizable_type => model_name).first.blank?
+            end
+          end
+
+          def set_role
+            role = params[:user].delete(:role) unless params[:user].blank?
+            @user.role = role if current_user.user_valid_roles(@user).include?(role)
+          end
+
       end
     end
   end

data/app/controllers/gluttonberg/base_controller.rb

@@ -0,0 +1,95 @@
+module Gluttonberg
+  class BaseController < ActionController::Base
+    protect_from_forgery
+
+    # rescue exceptions in production enviroment and renders appropriate error page
+    if Rails.env == "production"
+      rescue_from ActionView::MissingTemplate, :with => :not_found
+      rescue_from ActiveRecord::RecordNotFound, :with => :not_found
+      rescue_from ActionController::RoutingError, :with => :not_found
+      rescue_from CanCan::AccessDenied, :with => :access_denied
+    end
+
+    protected
+      # Below is all the required methods for backend user authentication
+      def current_user_session
+        return @current_user_session if defined?(@current_user_session)
+        @current_user_session = UserSession.find
+      end
+
+      def current_user
+        return @current_user if defined?(@current_user)
+        @current_user = current_user_session && current_user_session.record
+      end
+
+      def require_user
+        unless current_user
+          store_location
+          flash[:error] = "You must be logged in to access this page"
+          redirect_to admin_login_path
+          return false
+        end
+        true
+      end
+
+      def require_backend_access
+        _require_x_user(:have_backend_access?)
+      end
+
+      def require_super_admin_user
+        _require_x_user(:super_admin?)
+      end
+
+      def redirect_back_or_default(default)
+        redirect_to(session[:return_to] || default)
+        session[:return_to] = nil
+      end
+
+      # its a generic code for find user/member from perishable_token
+      # Its used for admin user and public members
+      def generic_find_using_perishable_token(klass)
+        object = klass.where(:perishable_token => params[:id]).first
+        unless object
+          flash[:notice] = t(:reset_password_error)
+          redirect_to admin_root_path
+        end
+        object
+      end
+
+      # its a generic code for updating reset password. 
+      # Its used for admin user and public members
+      def generic_update_reset_password(object, success_path)
+        if object.save
+          flash[:notice] = "Password successfully updated"
+          redirect_to success_path
+        else
+          render :edit
+        end
+      end
+
+    private
+      def _require_x_user(authentication_method)
+        return false unless require_user
+        unless current_user.send(authentication_method)
+          store_location
+          flash[:error] = "You dont have privilege to access this page"
+          redirect_to admin_login_path
+          return false
+        end
+      end
+
+      def current_site_config_name
+        if Rails.configuration.multisite == false
+          nil
+        else
+          config  = Rails.configuration.multisite.find{|key, val| val == request.host_with_port}
+          if config.blank?
+            nil
+          else
+            config.first
+          end
+        end
+      end
+
+  end
+end