inline_forms 8.1.55 → 8.1.57

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7fff4c0c21d69de2e6836a1a6a16e1e293b8c740fe0615a429ab6775f89fd59a
-  data.tar.gz: 479db5cb0c201625bc4c5561f1a3188d3e87ce128387c6a7e08c708d749600b2
+  metadata.gz: 93e0cd0c2bc09c666bd81cf76779b780ab345f4a7e80f8a6535177d7921b150d
+  data.tar.gz: 02e8abc26971fe105a65b8bae7380d171e2635e1e51385c0849917e1a5365c16
 SHA512:
-  metadata.gz: 20499e3a0edf5819e20dc5a2d6893835acb72a08039df25190f184136c93d8c8904de2c5f6def7d3746dd7a1804eb01f51cc3560bd70d5d196e4a95be62911bf
-  data.tar.gz: 809595fc167bab2e5c9015fb034dcc10be2ff6d5dde3b958d24cdf2ae96ed027ed56577342e5e56f4d5e3f6a02311cb7662a736dfe89636456f96961442bb5bb
+  metadata.gz: ecdf5c3b1c43851b0cd0d6b05fdac85a51b227c30584a52bb395c9786c1dffdb9378e549b6d99a1faf5ff11aa8bfc7ecda01ae1b92e494cf2dfdf9750fc3fae4
+  data.tar.gz: df8a5b2b0cd7a9f21a9b14e58a086ed7ace99f9ce6380bd1e8284cae6b65183b4db72e15de2c8ffa332e9366d85780dc6ccb125e12bfa7afa4a24ed204383a7a

data/CHANGELOG.md

@@ -4,6 +4,98 @@ All notable changes to this project are documented in this file.
 
 ## [Unreleased]
 
+## [8.1.57] - 2026-10-05
+
+Fixes from a security/UI review of a host app (StProject), plus missing and hard-coded translations found when StProject switched to `:nl` with `raise_on_missing_translations = :strict`.
+
+### Security
+
+- **Reflected XSS through the nested list's frame id.** `_list` built the list frame as `raw "<turbo-frame id=\"#{update_span}\" …>"`, with `update_span` made from `params[:parent_id]`, and nothing looked the parent up before rendering. So `/incidents?parent_class=Client&ul_needed=1&update=x&parent_id="><img src=x onerror=…>` rendered the payload. Two fixes:
+  - The list body is now captured and wrapped with `tag.turbo_frame(id:, class: "list_container")`, so the id is attribute-escaped. No other view or helper puts a request param into `raw` / `html_safe` markup.
+  - `InlineFormsController` refuses malformed parent params with **400** in `index`, `new`, `create` and `show` (new `before_action :refuse_malformed_parent_params`). `parent_id` must match `/\A\d+\z/`. `parent_class` must name the class of a non-polymorphic `belongs_to` of `@Klass` that is named after it (`Photo#apartment` for `parent_class=Apartment`), which is exactly what the gem's own links send. The check runs before `_list`'s `constantize` and before `new`/`create` write the foreign key, and after `load_and_authorize_resource`, so a host's `check_authorization` stays satisfied.
+- **Stored XSS in `info_list`.** `info_list_show` appended `item._presentation` unescaped and then marked the string `html_safe`. A `_presentation` built from user data (StProject: `User#name` listed on a Role) therefore ran as markup. It is now escaped with `ERB::Util.h`. Audit of the other helpers that mark strings `html_safe`:
+  - `file_field_show` now escapes the stored file name and URL.
+  - The versions list rendered a rich-text changeset with `raw`. It is now passed through `sanitize`, so a body posted outside Trix cannot carry script.
+  - `dropdown`, `dropdown_with_other`, `check_list`, `radio_button`, the list rows, `_close`, `_show` and the trash pages already escaped `_presentation` (via `link_to` / `link_to_inline_edit` / `h` / ERB) and are unchanged.
+  - **Hosts with their own `inline_forms/_versions_list.html.erb` (StProject has one) keep the `raw`** until they apply the same change.
+- **Restoring a trashed file verifies its bytes.** `InlineForms::TrashedFile#restore!` and `InlineForms::StoredFiles.prepare_revert!` (undo of a destroy) now compare the SHA-256 of `data` with the stored `checksum` before writing bytes back into the slot (new `TrashedFile.verify_checksum!`). On a mismatch they log an error (`inline_forms file_trash checksum mismatch entry=<id>`) and raise `NotRestorable`: the transaction rolls back, nothing is written and the row stays in the trash. The field shows "can no longer be restored". The revert answers **422** instead of a 500; this also covers a `NotRestorable` from a concurrent purge.
+- **Inline scripts carry the CSP nonce.** The Turbo module `<script>` in `layouts/inline_forms` and `layouts/application` is now rendered with `nonce: content_security_policy_nonce`, which adds no attribute without a nonce generator. It is also marked `data-turbo-eval="false"`, and both layouts emit `csp_meta_tag`. This is the same as StProject's own layout, so a `script-src 'nonce-…'` policy accepts the gem's layouts.
+
+### Removed
+
+- **`inline_forms/_flash.html.erb`.** It had an inline jQuery `<script>` (no nonce), and neither the gem, the installer, the example app nor StProject rendered it. The layouts show flash themselves, and Devise pages use `devise/sessions/_flash`. A host that still does `render "inline_forms/flash"` must provide its own partial.
+
+### Fixed
+
+- **File-slot actions keep the page's slots.** `FileSlotsConcern` has no per-tab `@inline_forms_attribute_list`. After a remove, restore or undo, the re-rendered field (`_file_slot`) and the versions panel built `slots=` from the model's full attribute list. On a tabbed host (StProject's Client), the next action's trash panel then listed files from other tabs' slots. `inline_forms_file_trash_slots` now uses the action's `@file_trash_slots` for its record. That value comes from the page's own `slots` param and is reduced to declared, listed, readable slots, as before.
+- **Pagination of the top-level list keeps a host's filters, now under test.** A host's own filters (`first_name`, `sorteer`, `group[id]`, `status[id]`, …) stay on page 2. will_paginate already did that: it puts the request's params into every page link (all params on GET, the query string otherwise). The only change is that the redundant explicit `search` param is dropped. The page links deliberately do **not** merge `request.query_parameters` themselves. That skips will_paginate's exclusion of `script_name` / `original_script_name`, so `?script_name=javascript:alert(1)//` would become the start of every page link's `href` (XSS), and `?controller=x` would raise a 500.
+
+- **The create flash was never translated.** `InlineFormsController#create` calls `t("success", message: …)`, but both locale files defined the key as `succes`, so every create looked up a missing translation (and raised under `raise_on_missing_translations`). The key is now `success` (en "%{message} created.", nl "%{message} is aangemaakt."). The misspelled `succes` is dropped: it never received the message, and nothing else used it.
+- **The versions panel is translated.** `_versions` and `_versions_list` hard-coded English: "Versions (n)", Event, When, Done by, Changeset, old value / new value, empty, "(rich text)" and the raw event names. They now use `inline_forms.view.versions` (with `count`), `versions_event`, `versions_when`, `versions_done_by`, `versions_changeset`, `versions_old_value`, `versions_new_value`, `versions_empty`, `versions_rich_text` and `version_events.{create,update,destroy}`. Unknown events fall back to the raw name. en and nl are included, with the same key names as StProject's overrides, so those overrides can be dropped.
+- **Missing view keys:**
+  - nl now has `inline_forms.view.restore`, `list_versions`, `close_versions_list` and `undelete`.
+  - en now has `undelete`, used by the soft-restore link (`link_to_soft_delete`).
+  - Both locales now have `common.more` and `common.logout`, which the engine header uses and which only hosts defined before.
+- **Version timestamps are localized.** The versions list and its file events printed `created_at` / the event time raw (`2026-10-05 15:10:24 UTC`). They now use `l(…, format: :short)`.
+- **`<html lang>`.** `layouts/devise` and `layouts/application` now declare `lang="<%= I18n.locale %>"`, like the `inline_forms` layout.
+- **The sign-in button is translated.** `devise/sessions/_form` used `f.submit :login` (always "login"). It now uses `t("inline_forms.devise.login", default: "login")`: en "login", nl "inloggen".
+
+### Tests
+
+- `test/integration/list_params_test.rb`:
+  - a crafted `parent_id` (frame request and full page) → 400 with the payload never in the body;
+  - a non-association or wrongly cased `parent_class` → 400, and a non-integer `parent_id` → 400;
+  - crafted `new` / `create` / `show` → 400, and `create` creates nothing;
+  - every refusal counts as authorized;
+  - well-formed nested list, new and create still work, including the `not_accessible_through_html?` child;
+  - `_list` escapes the frame id by itself;
+  - page 2 of a filtered list (and back to page 1) carries every filter, and so does the list rendered after a create;
+  - a crafted `script_name` / `original_script_name` / `controller` in the query string never reaches the page links.
+- `test/integration/presentation_escaping_test.rb`: `info_list`, `file_field`, `dropdown_with_other` and the list rows escape `<img src=x onerror=…>`; the versions list sanitizes a rich-text changeset.
+- `test/integration/file_slots_test.rb`:
+  - a restore re-renders with the page's `slots` only, so neither panel lists the other slot's file, and `slots` is reduced to declared slots;
+  - a tampered trash row (bytes or checksum) is refused by `restore_file` and by `restore!` (logged, nothing written);
+  - undo of a destroy with a tampered row → 422 with nothing restored.
+- `test/integration/csp_nonce_test.rb`: the dummy app now runs a nonce CSP (report-only, like StProject). Both layouts' inline scripts carry the request's nonce and publish it in `csp-nonce`, and `inline_forms/_flash` is gone.
+- `test/integration/locale_test.rb`. The dummy app now loads `rails-i18n`, as host Gemfiles do. Tests:
+  - every key above exists in en and nl, and `succes` is gone;
+  - create's flash is translated in nl;
+  - the versions panel and list render in nl with translated labels, event names and a localized timestamp, and in en with the English labels. Both render with missing translations raising, in views and controllers;
+  - the devise and application layouts declare `lang`.
+- Example app:
+  - `example_app_turbo_layout_test.rb` accepts the Turbo module script with its new attributes;
+  - new `example_app_devise_sign_in_test.rb`: the sign-in page has `<html lang>` and the translated submit button.
+
+### Lockstep
+
+- validation_hints 8.1.57 (now ships an nl locale, and `message: :required` hints, i.e. every `belongs_to`, resolve in en and nl), inline_forms_installer 8.1.57, inline_forms_schema_edit 8.1.57.
+
+## [8.1.56] - 2026-10-05
+
+### Fixed
+
+- **HTML requests the engine refuses get an explicit answer instead of falling through to implicit rendering.** Several `InlineFormsController` actions registered `format.html` only behind a guard, or registered it with a block that rendered nothing on the refused path. Rails then rendered implicitly: `ActionController::MissingExactTemplate` (a 500 for browser requests), `UnknownFormat` (406) or a bare 204. That meant error pages and exception-notifier noise. StProject hit it as a 500 on `GET /dagrapportages` by a normal user: `Dagrapportage` is `not_accessible_through_html?` and only exists nested in a Client tab. Now:
+  - `index` of a `not_accessible_through_html?` model without `parent_class` → **404**. The resource has no top-level page.
+  - `new`, `create`, row `show`, `destroy`, `soft_delete`, `soft_restore` and `revert` without the frame context the gem needs (`update`, plus `parent_class` or a nested row frame for `not_accessible_through_html?` models) → **400**. The request is malformed for this UI rather than aimed at a missing resource, so 400 rather than 404. A guard that does not match the request is a refusal of the request.
+  - `destroy` by a user who may not hard-destroy (`destroy_permitted?`, i.e. not superadmin) → **403**, the same answer `revert` already gave. It used to render nothing.
+  - `create`, `destroy`, `soft_delete`, `soft_restore` and `revert` now refuse **before writing**. Before, `create` saved the record, and `destroy`/`revert` changed data, and only then failed to respond.
+  - The refusals happen after `load_and_authorize_resource` / `authorize!`, so a host's CanCan `check_authorization` stays satisfied. The working paths are unchanged, including the turbo_stream responses (open-after-create, revert), nested lists, forms and rows, and accessible models' lists and rows.
+- **File-slot actions under `check_authorization`.** `file_slot_request_permitted?` answered 400 for an unlisted attribute before any `authorize!`, so a host with CanCan's `check_authorization` raised `CanCan::AuthorizationNotPerformed` (500) instead. It now authorizes the record first, then the attribute.
+
+### Tests
+
+- `test/integration/html_refusal_test.rb`, using new dummy model `DailyReport` (a `not_accessible_through_html?` child of `Machine`):
+  - top-level index → 404; show, new and revert without a nested frame → 400; create → 400 with nothing created; destroy → 400 with the record kept;
+  - nested list, new, create, row, destroy and revert still work;
+  - an accessible model's list and row still render, and its new/create without `update` → 400;
+  - a non-superadmin destroy → 403;
+  - a refused file-slot request still counts as authorized.
+  - Every refusal also asserts that authorization ran.
+
+### Lockstep
+
+- validation_hints 8.1.56, inline_forms_installer 8.1.56, inline_forms_schema_edit 8.1.56.
+
 ## [8.1.55] - 2026-10-04
 
 ### Fixed

data/app/controllers/concerns/file_slots_concern.rb

@@ -136,10 +136,16 @@ module FileSlotsConcern
   # Validates the attribute (declared slot shown as :simple_file_field in the
   # attribute list), then authorizes +action+ on it. Renders and returns false
   # when refused.
+  #
+  # The record is authorized first (these actions skip
+  # load_and_authorize_resource): a 400 for an unlisted attribute must still
+  # count as an authorization check, or a host with CanCan's
+  # +check_authorization+ raises AuthorizationNotPerformed (500) instead.
   def file_slot_request_permitted?(action)
     @attribute = params[:attribute].to_s
     @form_element = "simple_file_field"
     @update_span = params[:update]
+    authorize!(action, @object) if cancan_enabled?
     unless inline_forms_file_slot_listed?(@object, @attribute)
       head :bad_request
       return false

data/app/controllers/inline_forms_controller.rb

@@ -32,6 +32,9 @@ class InlineFormsController < ApplicationController
 
   # +revert+ and the file-slot actions authorize themselves (attribute-level).
   load_and_authorize_resource except: [ :revert, *FileSlotsConcern::FILE_SLOT_ACTIONS ], no_params: true if cancan_enabled?
+  # After the authorization above, so a refusal still satisfies a host's
+  # check_authorization (see refuse_malformed_parent_params).
+  before_action :refuse_malformed_parent_params, only: [ :index, :new, :create, :show ]
   # :index shows a list of all objects from class @Klass, using will_paginate,
   # including a link to 'new', that allows you to create a new record.
   def index
@@ -84,6 +87,11 @@ class InlineFormsController < ApplicationController
         format.html do
           if @parent_class.present?
             render_nested_associated_list_html
+          else
+            # No top-level page for this resource. An explicit answer: an
+            # empty block would fall through to implicit rendering and raise
+            # MissingExactTemplate (500).
+            head :not_found
           end
         end
       else
@@ -116,7 +124,7 @@ class InlineFormsController < ApplicationController
 
     @object.inline_forms_attribute_list = @inline_forms_attribute_list if @inline_forms_attribute_list
     respond_to do |format|
-      format.html { render_turbo_new } if html_list_flow_allowed?
+      format.html { html_list_flow_allowed? ? render_turbo_new : head(:bad_request) }
     end
   end
 
@@ -139,6 +147,11 @@ class InlineFormsController < ApplicationController
   def create
     @object ||= @Klass.new
     @update_span = params[:update]
+    @parent_class = params[:parent_class]
+    # Refuse before anything is written: the responses below only exist for
+    # a request from a list or nested-list frame.
+    return head :bad_request unless html_list_flow_allowed?
+
     attributes = @inline_forms_attribute_list || @object.inline_forms_attribute_list
     attributes.each do | attribute, form_element |
       # Skip a row whose column is not migrated yet (model edited, migration
@@ -149,7 +162,6 @@ class InlineFormsController < ApplicationController
       InlineForms.assert_plain_text_column!(object: @object, attribute: attribute, form_element: form_element)
       send("#{form_element}_update", @object, attribute) unless form_element == :associated || (cancan_enabled? && cannot?(:read, @object, attribute))
     end
-    @parent_class = params[:parent_class]
     @parent_id = params[:parent_id]
     # See #index for the order/search/parent-fk decomposition.
     fk_conditions = nil
@@ -171,19 +183,17 @@ class InlineFormsController < ApplicationController
       created_object = @object
       @object = nil
       respond_to do |format|
-        if html_list_flow_allowed?
-          if open_created_row?(created_object, attributes)
-            format.turbo_stream { render_created_row_open_streams(created_object) }
-          end
-          format.html { render_list_frame_after_save }
+        if open_created_row?(created_object, attributes)
+          format.turbo_stream { render_created_row_open_streams(created_object) }
         end
+        format.html { render_list_frame_after_save }
       end
     else
       flash.now[:header] = [ "Kan #{@object.class.to_s.underscore} niet aanmaken." ]
       flash.now[:error] = @object.errors.to_a
       respond_to do |format|
         @object.inline_forms_attribute_list = attributes
-        format.html { render_turbo_new } if html_list_flow_allowed?
+        format.html { render_turbo_new }
       end
     end
   end
@@ -257,10 +267,10 @@ class InlineFormsController < ApplicationController
     if @attribute.nil?
       respond_to do |format|
         @attributes = @object.inline_forms_attribute_list
-        if close
-          format.html { render_row_turbo(:close) } if row_html_turbo_allowed?
-        else
-          format.html { render_row_turbo(:show) } if row_html_turbo_allowed?
+        format.html do
+          next head(:bad_request) unless row_html_turbo_allowed?
+
+          render_row_turbo(close ? :close : :show)
         end
       end
     else
@@ -274,9 +284,11 @@ class InlineFormsController < ApplicationController
   def soft_delete
     @update_span = params[:update]
     @object = referenced_object
+    return head :bad_request unless row_html_turbo_allowed?
+
     @object.soft_delete(current_user)
     respond_to do |format|
-      format.html { render_row_turbo(:close) } if row_html_turbo_allowed?
+      format.html { render_row_turbo(:close) }
     end
   end
 
@@ -284,9 +296,11 @@ class InlineFormsController < ApplicationController
   def soft_restore
     @update_span = params[:update]
     @object = referenced_object
+    return head :bad_request unless row_html_turbo_allowed?
+
     @object.soft_restore
     respond_to do |format|
-      format.html { render_row_turbo(:close) } if row_html_turbo_allowed?
+      format.html { render_row_turbo(:close) }
     end
   end
 
@@ -294,14 +308,17 @@ class InlineFormsController < ApplicationController
   def destroy
     @update_span = params[:update]
     @object = referenced_object
-    if destroy_permitted?
-      @object.destroy
-      # Capture after destroy: `.last` before destroy was the latest *update*
-      # (e.g. a plain_text_area edit), so undo reified the pre-edit state.
-      @undo_version = @object.versions.last
-      respond_to do |format|
-        format.html { render_row_turbo_destroyed } if row_html_turbo_allowed?
-      end
+    # Both refusals answer before anything is destroyed (they used to render
+    # nothing and fall through to implicit rendering: a 500).
+    return head :forbidden unless destroy_permitted?
+    return head :bad_request unless row_html_turbo_allowed?
+
+    @object.destroy
+    # Capture after destroy: `.last` before destroy was the latest *update*
+    # (e.g. a plain_text_area edit), so undo reified the pre-edit state.
+    @undo_version = @object.versions.last
+    respond_to do |format|
+      format.html { render_row_turbo_destroyed }
     end
   end
 
@@ -327,6 +344,7 @@ class InlineFormsController < ApplicationController
     # has the Devise+roles system, otherwise no extra gate beyond CanCan.
     return head :forbidden unless destroy_permitted?
     return head :not_found unless @parent
+    return head :bad_request unless row_html_turbo_allowed?
 
     @object = reify_for_revert(@version)
     # PaperTrail::Version#reify returns nil for `create` events because
@@ -354,8 +372,7 @@ class InlineFormsController < ApplicationController
         @parent = item || @parent
         return head :not_found unless @parent
       end
-      return render_revert_response if row_html_turbo_allowed?
-      return
+      return render_revert_response
     end
     if defined?(ActionText::RichText) && @object.is_a?(ActionText::RichText)
       @rich_text_record = @object
@@ -366,19 +383,60 @@ class InlineFormsController < ApplicationController
     else
       # One transaction: the record, its files coming back out of the trash
       # (undo of a destroy) and its rich texts are restored together or not.
-      @object.class.transaction do
-        file_entries = InlineForms::StoredFiles.prepare_revert!(@object)
-        @parent = persist_reverted_primary!(@object, @version)
-        InlineForms::StoredFiles.finish_revert!(file_entries, by: inline_forms_current_user_id)
-        restore_rich_texts_for_reverted_parent!(@parent)
+      begin
+        @object.class.transaction do
+          file_entries = InlineForms::StoredFiles.prepare_revert!(@object)
+          @parent = persist_reverted_primary!(@object, @version)
+          InlineForms::StoredFiles.finish_revert!(file_entries, by: inline_forms_current_user_id)
+          restore_rich_texts_for_reverted_parent!(@parent)
+        end
+      rescue InlineForms::TrashedFile::NotRestorable
+        # A trashed file failed its checksum, or was purged/restored
+        # concurrently: the transaction rolled back and nothing was restored.
+        # An explicit answer instead of a 500.
+        return head :unprocessable_entity
       end
       @parent.reload
     end
-    render_revert_response if row_html_turbo_allowed?
+    render_revert_response
   end
 
   private
 
+  # +parent_class+ / +parent_id+ come from the nested-list links and are
+  # client-controlled, yet +_list+ constantizes +parent_class+, +new+ and
+  # +create+ write +parent_id+ into the foreign key, and both land in the
+  # list's frame ids. Nothing +find+s the parent before the list renders, so a
+  # crafted +parent_id+ (markup) reached the page (reflected XSS), and any
+  # +parent_class+ string reached +constantize+. Refuse (400) unless
+  # +parent_id+ is a plain integer id and +parent_class+ names the class of a
+  # belongs_to association of @Klass named after it (Photo#apartment for
+  # +parent_class=Apartment+): exactly what the gem's own links send.
+  def refuse_malformed_parent_params
+    parent_class = params[:parent_class]
+    parent_id = params[:parent_id]
+    return if parent_class.blank? && parent_id.blank?
+    return if parent_id_param?(parent_id) && (parent_class.blank? || parent_class_param?(parent_class))
+
+    head :bad_request
+  end
+
+  def parent_id_param?(parent_id)
+    parent_id.is_a?(String) && parent_id.match?(/\A\d+\z/)
+  end
+
+  # Compared against the reflections (no +to_sym+ / +constantize+ of the
+  # param): a non-polymorphic belongs_to whose name is the underscored class.
+  def parent_class_param?(parent_class)
+    return false unless parent_class.is_a?(String)
+
+    @Klass.reflect_on_all_associations(:belongs_to).any? do |reflection|
+      !reflection.polymorphic? &&
+        reflection.class_name == parent_class &&
+        reflection.name.to_s == parent_class.underscore
+    end
+  end
+
   # Single-field requests (edit, update, show with an attribute) name the
   # field and its form element in params, and both are client-controlled.
   # +load_and_authorize_resource+ only authorizes the record: CanCanCan's

data/app/helpers/inline_forms_file_trash_helper.rb

@@ -24,7 +24,17 @@ module InlineFormsFileTrashHelper
 
   # Declared, routed slots among the rows of the attribute list being shown
   # (a Client tab shows only its own slots).
+  #
+  # The file-slot actions (FileSlotsConcern) re-render the field, the trash
+  # panel and the versions panel as streams, and that controller has no
+  # per-tab @inline_forms_attribute_list: falling back to the model's full
+  # list put every tab's slots into the re-rendered links (slots=…), so the
+  # next action's panel listed other tabs' files. Those actions set
+  # @file_trash_slots from the page's own +slots+ param (validated against
+  # the declared, listed, readable slots); use it for their record.
   def inline_forms_file_trash_slots(object, attributes = nil)
+    return Array(@file_trash_slots) if attributes.nil? && !@file_trash_slots.nil? && object == @object
+
     attributes ||= @inline_forms_attribute_list || object.inline_forms_attribute_list
     attributes.filter_map do |attribute, form_element, *|
       next unless form_element.to_s == "simple_file_field"

data/app/models/concerns/inline_forms/stored_files.rb

@@ -56,7 +56,8 @@ module InlineForms::StoredFiles
   # * undo of a destroy (row gone): copy each slot's newest restorable
   #   record_destroyed entry onto the record BEFORE the save, so presence
   #   validations on the filename pass; a slot whose file was purged in the
-  #   meantime comes back empty (never a name without bytes).
+  #   meantime comes back empty (never a name without bytes). An entry whose
+  #   bytes fail their SHA-256 check raises NotRestorable (nothing restored).
   # * row exists already (replayed undo): nothing; persist_reverted_primary!
   #   leaves the slot columns alone.
   def self.prepare_revert!(record)
@@ -73,6 +74,9 @@ module InlineForms::StoredFiles
       entry = InlineForms::TrashedFile.lock.for_slot(record, attribute)
                 .where(reason: "record_destroyed").restorable.newest_first.first
       if entry
+        # Same integrity check as TrashedFile#restore!: a mismatch raises
+        # NotRestorable and the whole revert rolls back.
+        InlineForms::TrashedFile.verify_checksum!(id: entry.id, data: entry.data, checksum: entry.checksum)
         record.send(:write_attribute, slot[:data], entry.data)
         record.send(:write_attribute, attribute.to_s, entry.filename)
         record.send(:write_attribute, slot[:content_type], entry.content_type)

data/app/models/inline_forms/trashed_file.rb

@@ -85,6 +85,18 @@ class InlineForms::TrashedFile < ActiveRecord::Base
     )
   end
 
+  # Restoring writes the stored bytes back into a live slot, so they must be
+  # the bytes that were trashed: compares the SHA-256 recorded by trash!
+  # (nil data has a nil checksum). Raises NotRestorable on a mismatch, before
+  # anything is written, so the caller's transaction rolls back; the mismatch
+  # is logged (a tampered or corrupted trash row needs a look).
+  def self.verify_checksum!(id:, data:, checksum:)
+    return if checksum == (data && Digest::SHA256.hexdigest(data))
+
+    Rails.logger.error("inline_forms file_trash checksum mismatch entry=#{id}: not restored")
+    raise NotRestorable, "this file failed its integrity check and cannot be restored"
+  end
+
   # Purges every trash row whose retention has passed. Returns the number
   # purged. Idempotent; safe to run while users work.
   def self.purge_expired!
@@ -189,14 +201,16 @@ class InlineForms::TrashedFile < ActiveRecord::Base
       record = record_class.unscoped.lock.find_by(record_class.primary_key => record_id)
       raise RecordGone, "the record was deleted" unless record
 
-      payload = self.class.lock.where(id: id).restorable.pick(:data, :filename, :content_type)
+      payload = self.class.lock.where(id: id).restorable.pick(:data, :filename, :content_type, :checksum)
       raise NotRestorable, "this file can no longer be restored" unless payload
 
+      data, filename, content_type, checksum = payload
+      self.class.verify_checksum!(id: id, data: data, checksum: checksum)
+
       now = Time.current
       count = self.class.where(id: id).restorable.update_all(data: nil, restored_at: now, restored_by_id: by, updated_at: now)
       raise NotRestorable, "this file can no longer be restored" unless count == 1
 
-      data, filename, content_type = payload
       record.inline_forms_put_file!(attribute_name, data: data, filename: filename, content_type: content_type, by: by)
       reload
       record

data/app/views/devise/sessions/_form.html.erb

@@ -26,13 +26,13 @@
         <%= f.check_box :remember_me %><label><%= t :remember_me %></label>
       </div>
       <div class="small-7 columns text-right">
-        <%= f.submit :login, class: 'button' %>
+        <%= f.submit t("inline_forms.devise.login", default: "login"), class: 'button' %>
       </div>
     </div>
   <% else %>
     <div class="row">
       <div class="columns text-right">
-        <%= f.submit :login, class: 'button' %>
+        <%= f.submit t("inline_forms.devise.login", default: "login"), class: 'button' %>
       </div>
     </div>
   <% end -%>

data/app/views/inline_forms/_list.html.erb

@@ -42,11 +42,16 @@
   <% end %>
 <% end %>
 
-<%# List root is `<turbo-frame class="list_container">` (Step 4). See SCSS. %>
-<% if ul_needed -%>
-  <%= raw "<turbo-frame id=\"#{update_span}\" class=\"list_container\">" -%>
-<% end -%>
-
+<%#
+  List root is `<turbo-frame class="list_container">` (Step 4). See SCSS.
+  The rows and pagination are captured and wrapped with tag.turbo_frame at
+  the end, so the frame id is attribute-escaped: it is built from request
+  params (parent_class / parent_id / update), and the former
+  `raw "<turbo-frame id=\"#{update_span}\" …>"` put a crafted parent_id
+  straight into the page (reflected XSS). The controller also refuses
+  malformed parent params (refuse_malformed_parent_params).
+-%>
+<% list_body = capture do -%>
 <!--  # list of objects -->
 <% for object in objects %>
   <% if parent_class.nil?  %>
@@ -111,8 +116,17 @@
 <% end -%>
 <!--  # pagination -->
 <% if parent_id.nil? -%>
+  <%#
+    Page 2 of a filtered list must stay filtered (search and a host's own
+    filters such as first_name / sorteer / group[id]). will_paginate does
+    that itself: it puts the request's params (all params on GET, the query
+    string otherwise) into every page link, except script_name and
+    original_script_name. Do not merge request.query_parameters in here:
+    explicit params skip that exclusion, so ?script_name=javascript:… became
+    the start of every page link's href (XSS), and ?controller=x a 500.
+    test/integration/list_params_test.rb covers both.
+  -%>
   <% paginate_params = { update: update_span, ul_needed: true } %>
-  <% paginate_params[:search] = params[:search] if params[:search].present? %>
   <% pagination = will_paginate objects, params: paginate_params %>
 <% else %>
   <% if pagination %>
@@ -144,6 +158,9 @@
     </div>
   </div>
 <% end %>
+<% end -%>
 <% if ul_needed -%>
-  <%= raw "</turbo-frame>" -%>
+  <%= tag.turbo_frame(list_body, id: update_span, class: "list_container") -%>
+<% else -%>
+  <%= list_body -%>
 <% end -%>

data/app/views/inline_forms/_versions.html.erb

@@ -7,7 +7,7 @@
     (parent + rich_text), flickering as the user toggled the panel. -%>
 <div class="row form_element_header associated_auto_header callout">
   <div class='medium-11 large-11 column' >
-    <%= "Versions (#{inline_forms_history_for(object).length})" %>
+    <%= t("inline_forms.view.versions", count: inline_forms_history_for(object).length) %>
   </div>
   <div class='medium-1 large-1 column'>
       <%= link_to_versions_list(

data/app/views/inline_forms/_versions_file_entry.html.erb

@@ -23,7 +23,7 @@
     <%= t("inline_forms.files.event.#{entry[:file_event]}") %>
   </div>
   <div class="small-2 column">
-    <%= entry[:at] %>
+    <%= l(entry[:at], format: :short) %>
   </div>
   <div class="small-2 column">
     <%= inline_forms_file_user_name(entry[:by]) %>

data/app/views/inline_forms/_versions_list.html.erb

@@ -4,7 +4,7 @@
 <% restorable_files = inline_forms_restorable_file_entries(@object, entries.filter_map { |e| e[:entry]&.attribute_name }.uniq) -%>
 <div class="row form_element_header associated_auto_header callout">
   <div class='medium-11 large-11 column' >
-    <%= "Versions (#{entries.length})" %>
+    <%= t("inline_forms.view.versions", count: entries.length) %>
   </div>
   <div class='medium-1 large-1 column'>
     <%= close_versions_list_link(
@@ -32,16 +32,16 @@
     &nbsp;
   </div>
   <div class="small-1 column">
-    <strong>Event</strong>
+    <strong><%= t("inline_forms.view.versions_event") %></strong>
   </div>
   <div class="small-2 column">
-    <strong>When</strong>
+    <strong><%= t("inline_forms.view.versions_when") %></strong>
   </div>
   <div class="small-2 column">
-    <strong>Done by</strong>
+    <strong><%= t("inline_forms.view.versions_done_by") %></strong>
   </div>
   <div class="small-6 column">
-    <strong>Changeset</strong>
+    <strong><%= t("inline_forms.view.versions_changeset") %></strong>
   </div>
 </div>
 <% entries.reverse.each do |entry| %>
@@ -92,17 +92,17 @@
       <% end %>
     </div>
     <div class="small-1 column">
-      <%= version.event -%><% if entry[:kind] == :rich_text %> <em>(rich text)</em><% end %>
+      <%= t("inline_forms.view.version_events.#{version.event}", default: version.event) -%><% if entry[:kind] == :rich_text %> <em>(<%= t("inline_forms.view.versions_rich_text") %>)</em><% end %>
     </div>
     <div class="small-2 column">
-      <%= version.created_at -%>
+      <%= l(version.created_at, format: :short) -%>
     </div>
     <div class="small-2 column">
       <%= version_modified_by version.whodunnit -%>
     </div>
     <div class="small-6 column">
       <% if version.changeset.nil? || version.changeset.empty? %>
-        <em>empty</em>
+        <em><%= t("inline_forms.view.versions_empty") %></em>
       <% else %>
         <% version.changeset.each do |attribute, value| %>
           <% next if attribute == 'updated_at' %>
@@ -116,13 +116,15 @@
               <th></th>
             </tr>
             <tr>
-              <td>old value</td>
-              <td>new value</td>
+              <td><%= t("inline_forms.view.versions_old_value") %></td>
+              <td><%= t("inline_forms.view.versions_new_value") %></td>
             </tr>
             <tr>
               <% if entry[:kind] == :rich_text && attribute == 'body' %>
-                <td><%= raw value[0] %></td>
-                <td><%= raw value[1] %></td>
+                <%# Rich-text HTML as stored in the version: sanitized, never
+                    raw (a body posted outside Trix may carry script). -%>
+                <td><%= sanitize value[0].to_s %></td>
+                <td><%= sanitize value[1].to_s %></td>
               <% else %>
                 <td><%= value[0] %></td>
                 <td><%= value[1] %></td>

data/app/views/layouts/application.html.erb

@@ -1,5 +1,5 @@
 <!DOCTYPE html>
-<html>
+<html lang="<%= I18n.locale %>">
   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
@@ -11,6 +11,9 @@
     <%= stylesheet_link_tag "trix" %>
     <%= inline_forms_user_color_overrides_style %>
     <%= csrf_meta_tags %>
+    <%# Publishes the CSP nonce (nothing without a nonce generator) for the %>
+    <%# scripts Turbo inserts. %>
+    <%= csp_meta_tag %>
   </head>
 
   <body class="<%= inline_forms_body_theme_class %>">
@@ -19,10 +22,14 @@
     <%# Turbo (Hotwire) is loaded as an ES module so it does not collide with %>
     <%# the classic-script Sprockets bundle above. Drive uses the Turbo default %>
     <%# (enabled). %>
-    <script type="module">
+    <%# The nonce: hosts run a CSP with script-src 'nonce-…' (nil, so no %>
+    <%# attribute, without a nonce generator). data-turbo-eval="false": Turbo %>
+    <%# Drive must not re-run it on visits (Turbo is loaded; a re-inserted %>
+    <%# copy would carry a newer nonce the page's policy rejects). %>
+    <%= tag.script type: "module", nonce: content_security_policy_nonce, data: { turbo_eval: false } do %>
       import { Turbo } from "<%= asset_path('turbo.min.js') %>"
       window.Turbo = Turbo
-    </script>
+    <% end %>
     <%# Trix 2 (vendored; no CDN). Self-registers its custom elements on load. %>
     <%= javascript_include_tag "trix.min" %>
   </body>

data/app/views/layouts/devise.html.erb

@@ -1,5 +1,5 @@
 <!DOCTYPE html>
-<html>
+<html lang="<%= I18n.locale %>">
   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />