inline_forms 8.1.56 → 8.1.58

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7ecd64e62be7265a5989cc6012533cdac80dbd62f82ab8b009c17bd4c12343dd
-  data.tar.gz: fb677f7996a52a2a8d571f65264f22225a9ff9ed8c451657a2ac59c268d396d5
+  metadata.gz: e989cef82d52e8f127898955b5741aa163ac8018c5d376a1031d2b7fc4606b36
+  data.tar.gz: 1dd15f90a192376d102aa5247502537a4427388517601dd3b4daba091a4a7385
 SHA512:
-  metadata.gz: a5d4ed8bbb6569904df70ebbbd30b57c4847bb478088dfe70419363c58caf11d19dc6dfb5c67da2fbdaad8a85555c5b74b68847d19484f272d7c5fcbebcc30cf
-  data.tar.gz: a5b41fd5b309e7fd73bec6c652609f775493c1b3efdf977d3aed1503c6e6656d4e8d7e695bac99ca751b914bb2a47be64bdb244233820253d2426e87240515ee
+  metadata.gz: aef0b60a06a818a73ebc92defa6d2466f94aede8a39865870b3b3365e508b00642afafe05614addcc3ac0e3b2bf67a0bf3659531ef834c44050014e2bf2e3401
+  data.tar.gz: 4b478b2e1854e9c6427e13014f0694883f362184c86b6dfecfa25e9c3ef71752ca60c807c66b2d00f78eaa69dbed73b29afdc1138caece51e818ac340b9e3542

data/CHANGELOG.md

@@ -4,6 +4,103 @@ All notable changes to this project are documented in this file.
 
 ## [Unreleased]
 
+## [8.1.58] - 2026-10-21
+
+Three gem issues found in the StProject review (2026-10-04). The fourth it listed, the CSS `@import` of `http://fonts.googleapis.com`, was already fixed in 8.1.22 (self-hosted Open Sans). Also the first step of the Sass `@import` → `@use` move.
+
+### Changed
+
+- **Sass: the entry points load `foundation_and_overrides` with `@use`.** `inline_forms/inline_forms.scss` and `inline_forms/devise.scss` replace `@import 'foundation_and_overrides'` with `@use 'foundation_and_overrides' as *` plus `@forward 'foundation_and_overrides'`. Dart Sass 3 removes `@import`, and these were two of the five gem `@import`s a host build reported.
+  - The compiled `inline_forms.css` and `devise.css` are **byte-identical** to 8.1.57's (compressed, compiled with the host's dartsass-rails command; same SHA-256).
+  - One rule needed spelling out to stay identical: Foundation's flex grid makes `.columns` an alias with `.columns { @extend .column }`, which reached the gem's `.column { padding-right: 0 !important }` only while the file was `@import`ed. That rule is now `.column, .columns`.
+  - The `@forward` keeps the module's API for hosts: Foundation's members (`rem-calc`, `$global-width`, ...) stay visible through `@use "inline_forms/inline_forms" as *`, and the `!default` `$if-*` palette can still be set with `@use "inline_forms/inline_forms" with ($if-accent: ...)`. Without it, both fail to compile.
+  - The URL is relative, so it resolves next to the gem's file first, as the `@import` did; a host's `app/assets/stylesheets/inline_forms/foundation_and_overrides.scss` or anything in `app/assets/builds` cannot shadow it.
+  - Deprecations per entry point (with `--verbose`): 371 → 370 (`[import]` 118 → 117, `[if-function]` 58, `[global-builtin]` 195). Without `--verbose` Sass prints 5 per category and "356 → 355 repetitive deprecation warnings omitted".
+- **Still `@import`, inside `foundation_and_overrides.scss`:** `settings/settings` and `foundation` (foundation-rails 6.9 is `@import`-only and its settings globals feed the overrides), and `theme`. A `@use 'theme'` would have to precede the settings `@import`, which moves the theme's CSS ahead of Foundation's and runs before `$body-background` exists; `meta.load-css` keeps the position but hides the `$if-*` palette from hosts. All three wait for the Foundation decision. The remaining 114 `[import]`, and all `[if-function]` / `[global-builtin]` warnings, are inside foundation-rails. The deadline is a dartsass-rails release that allows sass-embedded ≥ 3 (0.5.1 pins `~> 1.63`), not a date. No `--quiet-deps` / `--silence-deprecation` was added.
+
+### Fixed
+
+- **`dropdown` options are sorted again.** `dropdown_edit` called `values.sort_by { _presentation }` and discarded the result, so the options came out in id order. They are now sorted by their (dropdown) presentation.
+- **The failed-create flash header is translated.** `InlineFormsController#create` set `flash[:header]` to the hard-coded Dutch `"Kan <class_name> niet aanmaken."` (with the underscored class name, e.g. `client`) in every locale. It now uses the new key `inline_forms.view.create_failed` with the model's human name: "Could not create %{model}." (en), "Kan %{model} niet aanmaken." (nl). A host with its own locale needs that key.
+- **"+" and close icons on the gold bands meet WCAG contrast.** `.new_button` / `.close_button` in the model top bar and the associated header were the accent colour on gold: 2.9:1 on the model top bar (below the 3:1 for icons), and white on hover (1.8:1). They now use two new variables, `--if-color-on-band` and `--if-color-on-band-hover` (Sass `$if-on-band` / `$if-on-band-hover`), which clear 4.5:1 on both bands in every preset theme (default, dark, sepia, high-contrast). A host that overrides `--if-color-secondary` / `--if-color-header-band` should set them too. The associated header's close-button hover rule also targeted `.new_button:focus` instead of `.close_button:focus`.
+- **Installer: generated apps compile the gem's SCSS on every Dart Sass build.** The `config/initializers/inline_forms_dartsass_builds.rb` template maps `inline_forms_install/{inline_forms,devise}_main.scss` (`@use "inline_forms/inline_forms" as *`) to `app/assets/builds/inline_forms/{inline_forms,devise}.css`. dartsass-rails passes `app/assets/stylesheets` and then every `config.assets.paths` entry as load paths, and `app/assets/builds` comes before the gem, so from the second build on the `@use` resolved to the app's previous compiled `.css` instead of the gem's `.scss`. Gem stylesheet changes stopped reaching an app after its first build (and the example-app gate did not test them). The template now adds `--load-path=<inline_forms>/app/assets/stylesheets` to `config.dartsass.build_options`, which precede the load paths, as StProject's own initializer already does. **Existing apps** generated by an earlier installer should add the same two lines to their initializer.
+
+### Tests
+
+- `dropdown_test` (options sorted by presentation), `locale_test` (failure header in en and nl, `inline_forms.view.create_failed` in both locale files).
+- Example app: `example_app_sass_deprecations_test` compiles both gem entry points with sass-embedded (verbose) and fails if the gem gains an `@import` beyond the three above, or an entry point has more than 117 `[import]` deprecations.
+- Example app: `example_app_dartsass_build_test` checks that the gem's stylesheet dir is the first load path in the dartsass command, and that `app/assets/builds/inline_forms/{inline_forms,devise}.css` match a direct compile of the gem's entry points (test_helper's `dartsass:build` runs after the installer's, so builds/ already held a previous build).
+
+### Lockstep
+
+- validation_hints 8.1.58, inline_forms_installer 8.1.58, inline_forms_schema_edit 8.1.58.
+
+## [8.1.57] - 2026-10-05
+
+Fixes from a security/UI review of a host app (StProject), plus missing and hard-coded translations found when StProject switched to `:nl` with `raise_on_missing_translations = :strict`.
+
+### Security
+
+- **Reflected XSS through the nested list's frame id.** `_list` built the list frame as `raw "<turbo-frame id=\"#{update_span}\" …>"`, with `update_span` made from `params[:parent_id]`, and nothing looked the parent up before rendering. So `/incidents?parent_class=Client&ul_needed=1&update=x&parent_id="><img src=x onerror=…>` rendered the payload. Two fixes:
+  - The list body is now captured and wrapped with `tag.turbo_frame(id:, class: "list_container")`, so the id is attribute-escaped. No other view or helper puts a request param into `raw` / `html_safe` markup.
+  - `InlineFormsController` refuses malformed parent params with **400** in `index`, `new`, `create` and `show` (new `before_action :refuse_malformed_parent_params`). `parent_id` must match `/\A\d+\z/`. `parent_class` must name the class of a non-polymorphic `belongs_to` of `@Klass` that is named after it (`Photo#apartment` for `parent_class=Apartment`), which is exactly what the gem's own links send. The check runs before `_list`'s `constantize` and before `new`/`create` write the foreign key, and after `load_and_authorize_resource`, so a host's `check_authorization` stays satisfied.
+- **Stored XSS in `info_list`.** `info_list_show` appended `item._presentation` unescaped and then marked the string `html_safe`. A `_presentation` built from user data (StProject: `User#name` listed on a Role) therefore ran as markup. It is now escaped with `ERB::Util.h`. Audit of the other helpers that mark strings `html_safe`:
+  - `file_field_show` now escapes the stored file name and URL.
+  - The versions list rendered a rich-text changeset with `raw`. It is now passed through `sanitize`, so a body posted outside Trix cannot carry script.
+  - `dropdown`, `dropdown_with_other`, `check_list`, `radio_button`, the list rows, `_close`, `_show` and the trash pages already escaped `_presentation` (via `link_to` / `link_to_inline_edit` / `h` / ERB) and are unchanged.
+  - **Hosts with their own `inline_forms/_versions_list.html.erb` (StProject has one) keep the `raw`** until they apply the same change.
+- **Restoring a trashed file verifies its bytes.** `InlineForms::TrashedFile#restore!` and `InlineForms::StoredFiles.prepare_revert!` (undo of a destroy) now compare the SHA-256 of `data` with the stored `checksum` before writing bytes back into the slot (new `TrashedFile.verify_checksum!`). On a mismatch they log an error (`inline_forms file_trash checksum mismatch entry=<id>`) and raise `NotRestorable`: the transaction rolls back, nothing is written and the row stays in the trash. The field shows "can no longer be restored". The revert answers **422** instead of a 500; this also covers a `NotRestorable` from a concurrent purge.
+- **Inline scripts carry the CSP nonce.** The Turbo module `<script>` in `layouts/inline_forms` and `layouts/application` is now rendered with `nonce: content_security_policy_nonce`, which adds no attribute without a nonce generator. It is also marked `data-turbo-eval="false"`, and both layouts emit `csp_meta_tag`. This is the same as StProject's own layout, so a `script-src 'nonce-…'` policy accepts the gem's layouts.
+
+### Removed
+
+- **`inline_forms/_flash.html.erb`.** It had an inline jQuery `<script>` (no nonce), and neither the gem, the installer, the example app nor StProject rendered it. The layouts show flash themselves, and Devise pages use `devise/sessions/_flash`. A host that still does `render "inline_forms/flash"` must provide its own partial.
+
+### Fixed
+
+- **File-slot actions keep the page's slots.** `FileSlotsConcern` has no per-tab `@inline_forms_attribute_list`. After a remove, restore or undo, the re-rendered field (`_file_slot`) and the versions panel built `slots=` from the model's full attribute list. On a tabbed host (StProject's Client), the next action's trash panel then listed files from other tabs' slots. `inline_forms_file_trash_slots` now uses the action's `@file_trash_slots` for its record. That value comes from the page's own `slots` param and is reduced to declared, listed, readable slots, as before.
+- **Pagination of the top-level list keeps a host's filters, now under test.** A host's own filters (`first_name`, `sorteer`, `group[id]`, `status[id]`, …) stay on page 2. will_paginate already did that: it puts the request's params into every page link (all params on GET, the query string otherwise). The only change is that the redundant explicit `search` param is dropped. The page links deliberately do **not** merge `request.query_parameters` themselves. That skips will_paginate's exclusion of `script_name` / `original_script_name`, so `?script_name=javascript:alert(1)//` would become the start of every page link's `href` (XSS), and `?controller=x` would raise a 500.
+
+- **The create flash was never translated.** `InlineFormsController#create` calls `t("success", message: …)`, but both locale files defined the key as `succes`, so every create looked up a missing translation (and raised under `raise_on_missing_translations`). The key is now `success` (en "%{message} created.", nl "%{message} is aangemaakt."). The misspelled `succes` is dropped: it never received the message, and nothing else used it.
+- **The versions panel is translated.** `_versions` and `_versions_list` hard-coded English: "Versions (n)", Event, When, Done by, Changeset, old value / new value, empty, "(rich text)" and the raw event names. They now use `inline_forms.view.versions` (with `count`), `versions_event`, `versions_when`, `versions_done_by`, `versions_changeset`, `versions_old_value`, `versions_new_value`, `versions_empty`, `versions_rich_text` and `version_events.{create,update,destroy}`. Unknown events fall back to the raw name. en and nl are included, with the same key names as StProject's overrides, so those overrides can be dropped.
+- **Missing view keys:**
+  - nl now has `inline_forms.view.restore`, `list_versions`, `close_versions_list` and `undelete`.
+  - en now has `undelete`, used by the soft-restore link (`link_to_soft_delete`).
+  - Both locales now have `common.more` and `common.logout`, which the engine header uses and which only hosts defined before.
+- **Version timestamps are localized.** The versions list and its file events printed `created_at` / the event time raw (`2026-10-05 15:10:24 UTC`). They now use `l(…, format: :short)`.
+- **`<html lang>`.** `layouts/devise` and `layouts/application` now declare `lang="<%= I18n.locale %>"`, like the `inline_forms` layout.
+- **The sign-in button is translated.** `devise/sessions/_form` used `f.submit :login` (always "login"). It now uses `t("inline_forms.devise.login", default: "login")`: en "login", nl "inloggen".
+
+### Tests
+
+- `test/integration/list_params_test.rb`:
+  - a crafted `parent_id` (frame request and full page) → 400 with the payload never in the body;
+  - a non-association or wrongly cased `parent_class` → 400, and a non-integer `parent_id` → 400;
+  - crafted `new` / `create` / `show` → 400, and `create` creates nothing;
+  - every refusal counts as authorized;
+  - well-formed nested list, new and create still work, including the `not_accessible_through_html?` child;
+  - `_list` escapes the frame id by itself;
+  - page 2 of a filtered list (and back to page 1) carries every filter, and so does the list rendered after a create;
+  - a crafted `script_name` / `original_script_name` / `controller` in the query string never reaches the page links.
+- `test/integration/presentation_escaping_test.rb`: `info_list`, `file_field`, `dropdown_with_other` and the list rows escape `<img src=x onerror=…>`; the versions list sanitizes a rich-text changeset.
+- `test/integration/file_slots_test.rb`:
+  - a restore re-renders with the page's `slots` only, so neither panel lists the other slot's file, and `slots` is reduced to declared slots;
+  - a tampered trash row (bytes or checksum) is refused by `restore_file` and by `restore!` (logged, nothing written);
+  - undo of a destroy with a tampered row → 422 with nothing restored.
+- `test/integration/csp_nonce_test.rb`: the dummy app now runs a nonce CSP (report-only, like StProject). Both layouts' inline scripts carry the request's nonce and publish it in `csp-nonce`, and `inline_forms/_flash` is gone.
+- `test/integration/locale_test.rb`. The dummy app now loads `rails-i18n`, as host Gemfiles do. Tests:
+  - every key above exists in en and nl, and `succes` is gone;
+  - create's flash is translated in nl;
+  - the versions panel and list render in nl with translated labels, event names and a localized timestamp, and in en with the English labels. Both render with missing translations raising, in views and controllers;
+  - the devise and application layouts declare `lang`.
+- Example app:
+  - `example_app_turbo_layout_test.rb` accepts the Turbo module script with its new attributes;
+  - new `example_app_devise_sign_in_test.rb`: the sign-in page has `<html lang>` and the translated submit button.
+
+### Lockstep
+
+- validation_hints 8.1.57 (now ships an nl locale, and `message: :required` hints, i.e. every `belongs_to`, resolve in en and nl), inline_forms_installer 8.1.57, inline_forms_schema_edit 8.1.57.
+
 ## [8.1.56] - 2026-10-05
 
 ### Fixed

data/app/assets/stylesheets/inline_forms/_theme.scss

@@ -33,6 +33,11 @@ $if-flash-accent: #fade7a !default; // flash border band
 $if-error-bg: #a70f0f !default;
 $if-success-bg: #4f8d0d !default;
 $if-on-dark: #FFFFFF !default;      // text/icons on primary/secondary bands
+// The "+" / close icons on the gold bands (secondary, header-band). The
+// accent was 2.9:1 on the secondary gold and the white hover 1.8:1; these
+// clear 4.5:1 on both bands.
+$if-on-band: #8F2F18 !default;
+$if-on-band-hover: #4A1A0C !default;
 
 :root {
   --if-color-primary: #{$if-primary};
@@ -48,6 +53,8 @@ $if-on-dark: #FFFFFF !default;      // text/icons on primary/secondary bands
   --if-color-error-bg: #{$if-error-bg};
   --if-color-success-bg: #{$if-success-bg};
   --if-color-on-dark: #{$if-on-dark};
+  --if-color-on-band: #{$if-on-band};
+  --if-color-on-band-hover: #{$if-on-band-hover};
   // Foundation globals, bridged so body/anchors can be re-themed too.
   --if-color-body-bg: #{$body-background};
   --if-color-body-text: #{$body-font-color};
@@ -85,6 +92,8 @@ body.theme-dark {
   --if-color-input-bg-hover: #332e25;
   --if-color-input-bg-focus: #3a352b;
   --if-color-flash-accent: #7a6829;
+  --if-color-on-band: #fdeee5;
+  --if-color-on-band-hover: #ffffff;
   --if-color-body-bg: #1c1a16;
   --if-color-body-text: #e8e4da;
   --if-color-anchor: #e0a179;
@@ -108,6 +117,8 @@ body.theme-sepia {
   --if-color-input-bg-hover: #fffaf0;
   --if-color-input-bg-focus: #fffdf7;
   --if-color-flash-accent: #dcc078;
+  --if-color-on-band: #6e3a20;
+  --if-color-on-band-hover: #3a2418;
   --if-color-body-bg: #f4ecd8;
   --if-color-body-text: #5b4636;
   --if-color-anchor: #8b5e3c;
@@ -124,6 +135,8 @@ body.theme-high-contrast {
   --if-color-input-bg-hover: #f5f5f5;
   --if-color-input-bg-focus: #ffffff;
   --if-color-flash-accent: #ffd500;
+  --if-color-on-band: #b30000;
+  --if-color-on-band-hover: #000000;
   --if-color-body-bg: #ffffff;
   --if-color-body-text: #000000;
   --if-color-anchor: #0000d6;

data/app/assets/stylesheets/inline_forms/devise.scss

@@ -1,6 +1,9 @@
 // Open Sans @font-face lives in inline_forms_fonts.css.erb (self-hosted,
 // Sprockets-served; linked from the layouts) — no external font CDN.
-@import 'foundation_and_overrides';
+// @use / @forward of foundation_and_overrides: see the module-system note
+// in inline_forms.scss.
+@forward 'foundation_and_overrides';
+@use 'foundation_and_overrides' as *;
 
 // Devise pages have only `.contain-to-grid` as the top-bar wrapper (no
 // `.fixed` variant), so constrain it directly to the F5 1000px row

data/app/assets/stylesheets/inline_forms/foundation_and_overrides.scss

@@ -55,6 +55,7 @@ $body-font-family: 'Open Sans', 'Helvetica Neue', Helvetica, Roboto, Arial, sans
 
 // Theme bridge: palette as CSS custom properties (must come after
 // 'foundation' so it can read $body-background / $anchor-color).
+// Stays @import: see the module-system note in inline_forms.scss.
 @import 'theme';
 
 @import '../../../vendor/assets/stylesheets/tippy.css';

data/app/assets/stylesheets/inline_forms/inline_forms.scss

@@ -2,19 +2,34 @@
 // Open Sans @font-face lives in inline_forms_fonts.css.erb (self-hosted,
 // Sprockets-served; linked from the layouts) — no external font CDN.
 //
-// Module-system status (8.1.24): `foundation_icons` is a self-contained
-// partial and loads via @use. Everything else must stay on @import until
-// the Foundation question is settled: foundation-rails 6.9 is @import-only
-// internally and its settings globals ($body-background, rem-calc, ...)
-// flow into foundation_and_overrides/theme/devise, which @use cannot
-// replicate without a Foundation that ships a module API (it never will —
-// the framework is unmaintained). See stuff/improvement-plan.md §1.
+// Module-system status (8.1.58). Loaded with @use:
+// - `foundation_icons` (8.1.24): a self-contained partial.
+// - `foundation_and_overrides`, here and in devise.scss (8.1.58). The
+//   compiled CSS is byte-identical to the @import version (the `.columns`
+//   alias below is the one rule that needed spelling out). The relative URL
+//   resolves next to this file first, as the @import did, so a same-named
+//   host or app/assets/builds file cannot shadow it. The @forward keeps what
+//   hosts saw through `@use "inline_forms/inline_forms"` before: Foundation's
+//   members (rem-calc, $global-width, ...) and the !default `$if-*` palette,
+//   configurable with `with (...)`.
+// Still @import, inside foundation_and_overrides:
+// - 'settings/settings' and 'foundation': foundation-rails 6.9 is
+//   @import-only and its settings globals feed our overrides. Blocked by the
+//   Foundation decision (unmaintained upstream; no module API coming).
+// - 'theme': a @use must precede the settings @import, which would move the
+//   theme's CSS ahead of Foundation's and run before $body-background exists;
+//   meta.load-css keeps the position but hides the `$if-*` palette from hosts
+//   (`with ($if-accent: ...)` stops working). Moves with Foundation.
+// The deadline is a dartsass-rails release that allows sass-embedded >= 3
+// (Dart Sass 3 removes @import; 0.5.1 pins ~> 1.63), not a date.
+// See stuff/improvement-plan.md §1.
 //
 // jQuery UI SCSS (sunny theme + widget styles) was dropped in 8.1.26 along
 // with the last jQuery UI widgets (native date/time/month/range/datalist
 // inputs replaced them).
 @use 'inline_forms/foundation_icons';
-@import 'foundation_and_overrides';
+@forward 'foundation_and_overrides';
+@use 'foundation_and_overrides' as *;
 
 // Foundation 6 makes `.row` a flex container (`display: flex`); a nested
 // `.row` is therefore a flex item and shrinks to its content's intrinsic
@@ -223,12 +238,12 @@ select:hover, select:focus {
   }
   .new_button {
     background-color: var(--if-color-secondary);
-    color: var(--if-color-accent);
+    color: var(--if-color-on-band);
     font-size: 1.3rem;
     padding: 0 2rem 0 1rem;
   }
   .new_button:hover, .new_button:focus {
-    color: white;
+    color: var(--if-color-on-band-hover);
     -webkit-transition-property: color;
     transition-property: color;
   }
@@ -358,26 +373,26 @@ turbo-frame {
   .new_button  {
     background-color: var(--if-color-header-band);
     font-size: 1.5rem;
-    color: var(--if-color-accent);
+    color: var(--if-color-on-band);
     padding: 0 0.5rem 0 1rem;
     margin: 0;
   }
   .new_button:hover, .new_button:focus {
     background-color: var(--if-color-header-band);
-    color: white;
+    color: var(--if-color-on-band-hover);
     -webkit-transition-property: color;
     transition-property: color;
   }
   .close_button  {
     background-color: var(--if-color-header-band);
     font-size: 1.5rem;
-    color: var(--if-color-accent);
+    color: var(--if-color-on-band);
     padding: 0 0.5rem 0 1rem;
     margin: 0;
   }
-  .close_button:hover, .new_button:focus {
+  .close_button:hover, .close_button:focus {
     background-color: var(--if-color-header-band);
-    color: white;
+    color: var(--if-color-on-band-hover);
     -webkit-transition-property: color;
     transition-property: color;
   }
@@ -423,7 +438,11 @@ turbo-frame {
   margin-bottom: 1.5em;
 }
 
-.column {
+// `.columns` named explicitly: Foundation's flex grid aliases it with
+// `.columns { @extend .column }`, which reached this rule while
+// foundation_and_overrides was @imported. Since it is @used (8.1.58),
+// that @extend no longer crosses into this module.
+.column, .columns {
     padding-right: 0 !important;
 }
 

data/app/controllers/inline_forms_controller.rb

@@ -32,6 +32,9 @@ class InlineFormsController < ApplicationController
 
   # +revert+ and the file-slot actions authorize themselves (attribute-level).
   load_and_authorize_resource except: [ :revert, *FileSlotsConcern::FILE_SLOT_ACTIONS ], no_params: true if cancan_enabled?
+  # After the authorization above, so a refusal still satisfies a host's
+  # check_authorization (see refuse_malformed_parent_params).
+  before_action :refuse_malformed_parent_params, only: [ :index, :new, :create, :show ]
   # :index shows a list of all objects from class @Klass, using will_paginate,
   # including a link to 'new', that allows you to create a new record.
   def index
@@ -186,7 +189,7 @@ class InlineFormsController < ApplicationController
         format.html { render_list_frame_after_save }
       end
     else
-      flash.now[:header] = [ "Kan #{@object.class.to_s.underscore} niet aanmaken." ]
+      flash.now[:header] = [ t("inline_forms.view.create_failed", model: @object.class.model_name.human) ]
       flash.now[:error] = @object.errors.to_a
       respond_to do |format|
         @object.inline_forms_attribute_list = attributes
@@ -380,11 +383,18 @@ class InlineFormsController < ApplicationController
     else
       # One transaction: the record, its files coming back out of the trash
       # (undo of a destroy) and its rich texts are restored together or not.
-      @object.class.transaction do
-        file_entries = InlineForms::StoredFiles.prepare_revert!(@object)
-        @parent = persist_reverted_primary!(@object, @version)
-        InlineForms::StoredFiles.finish_revert!(file_entries, by: inline_forms_current_user_id)
-        restore_rich_texts_for_reverted_parent!(@parent)
+      begin
+        @object.class.transaction do
+          file_entries = InlineForms::StoredFiles.prepare_revert!(@object)
+          @parent = persist_reverted_primary!(@object, @version)
+          InlineForms::StoredFiles.finish_revert!(file_entries, by: inline_forms_current_user_id)
+          restore_rich_texts_for_reverted_parent!(@parent)
+        end
+      rescue InlineForms::TrashedFile::NotRestorable
+        # A trashed file failed its checksum, or was purged/restored
+        # concurrently: the transaction rolled back and nothing was restored.
+        # An explicit answer instead of a 500.
+        return head :unprocessable_entity
       end
       @parent.reload
     end
@@ -393,6 +403,40 @@ class InlineFormsController < ApplicationController
 
   private
 
+  # +parent_class+ / +parent_id+ come from the nested-list links and are
+  # client-controlled, yet +_list+ constantizes +parent_class+, +new+ and
+  # +create+ write +parent_id+ into the foreign key, and both land in the
+  # list's frame ids. Nothing +find+s the parent before the list renders, so a
+  # crafted +parent_id+ (markup) reached the page (reflected XSS), and any
+  # +parent_class+ string reached +constantize+. Refuse (400) unless
+  # +parent_id+ is a plain integer id and +parent_class+ names the class of a
+  # belongs_to association of @Klass named after it (Photo#apartment for
+  # +parent_class=Apartment+): exactly what the gem's own links send.
+  def refuse_malformed_parent_params
+    parent_class = params[:parent_class]
+    parent_id = params[:parent_id]
+    return if parent_class.blank? && parent_id.blank?
+    return if parent_id_param?(parent_id) && (parent_class.blank? || parent_class_param?(parent_class))
+
+    head :bad_request
+  end
+
+  def parent_id_param?(parent_id)
+    parent_id.is_a?(String) && parent_id.match?(/\A\d+\z/)
+  end
+
+  # Compared against the reflections (no +to_sym+ / +constantize+ of the
+  # param): a non-polymorphic belongs_to whose name is the underscored class.
+  def parent_class_param?(parent_class)
+    return false unless parent_class.is_a?(String)
+
+    @Klass.reflect_on_all_associations(:belongs_to).any? do |reflection|
+      !reflection.polymorphic? &&
+        reflection.class_name == parent_class &&
+        reflection.name.to_s == parent_class.underscore
+    end
+  end
+
   # Single-field requests (edit, update, show with an attribute) name the
   # field and its form element in params, and both are client-controlled.
   # +load_and_authorize_resource+ only authorizes the record: CanCanCan's

data/app/helpers/inline_forms_file_trash_helper.rb

@@ -24,7 +24,17 @@ module InlineFormsFileTrashHelper
 
   # Declared, routed slots among the rows of the attribute list being shown
   # (a Client tab shows only its own slots).
+  #
+  # The file-slot actions (FileSlotsConcern) re-render the field, the trash
+  # panel and the versions panel as streams, and that controller has no
+  # per-tab @inline_forms_attribute_list: falling back to the model's full
+  # list put every tab's slots into the re-rendered links (slots=…), so the
+  # next action's panel listed other tabs' files. Those actions set
+  # @file_trash_slots from the page's own +slots+ param (validated against
+  # the declared, listed, readable slots); use it for their record.
   def inline_forms_file_trash_slots(object, attributes = nil)
+    return Array(@file_trash_slots) if attributes.nil? && !@file_trash_slots.nil? && object == @object
+
     attributes ||= @inline_forms_attribute_list || object.inline_forms_attribute_list
     attributes.filter_map do |attribute, form_element, *|
       next unless form_element.to_s == "simple_file_field"

data/app/models/concerns/inline_forms/stored_files.rb

@@ -56,7 +56,8 @@ module InlineForms::StoredFiles
   # * undo of a destroy (row gone): copy each slot's newest restorable
   #   record_destroyed entry onto the record BEFORE the save, so presence
   #   validations on the filename pass; a slot whose file was purged in the
-  #   meantime comes back empty (never a name without bytes).
+  #   meantime comes back empty (never a name without bytes). An entry whose
+  #   bytes fail their SHA-256 check raises NotRestorable (nothing restored).
   # * row exists already (replayed undo): nothing; persist_reverted_primary!
   #   leaves the slot columns alone.
   def self.prepare_revert!(record)
@@ -73,6 +74,9 @@ module InlineForms::StoredFiles
       entry = InlineForms::TrashedFile.lock.for_slot(record, attribute)
                 .where(reason: "record_destroyed").restorable.newest_first.first
       if entry
+        # Same integrity check as TrashedFile#restore!: a mismatch raises
+        # NotRestorable and the whole revert rolls back.
+        InlineForms::TrashedFile.verify_checksum!(id: entry.id, data: entry.data, checksum: entry.checksum)
         record.send(:write_attribute, slot[:data], entry.data)
         record.send(:write_attribute, attribute.to_s, entry.filename)
         record.send(:write_attribute, slot[:content_type], entry.content_type)

data/app/models/inline_forms/trashed_file.rb

@@ -85,6 +85,18 @@ class InlineForms::TrashedFile < ActiveRecord::Base
     )
   end
 
+  # Restoring writes the stored bytes back into a live slot, so they must be
+  # the bytes that were trashed: compares the SHA-256 recorded by trash!
+  # (nil data has a nil checksum). Raises NotRestorable on a mismatch, before
+  # anything is written, so the caller's transaction rolls back; the mismatch
+  # is logged (a tampered or corrupted trash row needs a look).
+  def self.verify_checksum!(id:, data:, checksum:)
+    return if checksum == (data && Digest::SHA256.hexdigest(data))
+
+    Rails.logger.error("inline_forms file_trash checksum mismatch entry=#{id}: not restored")
+    raise NotRestorable, "this file failed its integrity check and cannot be restored"
+  end
+
   # Purges every trash row whose retention has passed. Returns the number
   # purged. Idempotent; safe to run while users work.
   def self.purge_expired!
@@ -189,14 +201,16 @@ class InlineForms::TrashedFile < ActiveRecord::Base
       record = record_class.unscoped.lock.find_by(record_class.primary_key => record_id)
       raise RecordGone, "the record was deleted" unless record
 
-      payload = self.class.lock.where(id: id).restorable.pick(:data, :filename, :content_type)
+      payload = self.class.lock.where(id: id).restorable.pick(:data, :filename, :content_type, :checksum)
       raise NotRestorable, "this file can no longer be restored" unless payload
 
+      data, filename, content_type, checksum = payload
+      self.class.verify_checksum!(id: id, data: data, checksum: checksum)
+
       now = Time.current
       count = self.class.where(id: id).restorable.update_all(data: nil, restored_at: now, restored_by_id: by, updated_at: now)
       raise NotRestorable, "this file can no longer be restored" unless count == 1
 
-      data, filename, content_type = payload
       record.inline_forms_put_file!(attribute_name, data: data, filename: filename, content_type: content_type, by: by)
       reload
       record

data/app/views/devise/sessions/_form.html.erb

@@ -26,13 +26,13 @@
         <%= f.check_box :remember_me %><label><%= t :remember_me %></label>
       </div>
       <div class="small-7 columns text-right">
-        <%= f.submit :login, class: 'button' %>
+        <%= f.submit t("inline_forms.devise.login", default: "login"), class: 'button' %>
       </div>
     </div>
   <% else %>
     <div class="row">
       <div class="columns text-right">
-        <%= f.submit :login, class: 'button' %>
+        <%= f.submit t("inline_forms.devise.login", default: "login"), class: 'button' %>
       </div>
     </div>
   <% end -%>

data/app/views/inline_forms/_list.html.erb

@@ -42,11 +42,16 @@
   <% end %>
 <% end %>
 
-<%# List root is `<turbo-frame class="list_container">` (Step 4). See SCSS. %>
-<% if ul_needed -%>
-  <%= raw "<turbo-frame id=\"#{update_span}\" class=\"list_container\">" -%>
-<% end -%>
-
+<%#
+  List root is `<turbo-frame class="list_container">` (Step 4). See SCSS.
+  The rows and pagination are captured and wrapped with tag.turbo_frame at
+  the end, so the frame id is attribute-escaped: it is built from request
+  params (parent_class / parent_id / update), and the former
+  `raw "<turbo-frame id=\"#{update_span}\" …>"` put a crafted parent_id
+  straight into the page (reflected XSS). The controller also refuses
+  malformed parent params (refuse_malformed_parent_params).
+-%>
+<% list_body = capture do -%>
 <!--  # list of objects -->
 <% for object in objects %>
   <% if parent_class.nil?  %>
@@ -111,8 +116,17 @@
 <% end -%>
 <!--  # pagination -->
 <% if parent_id.nil? -%>
+  <%#
+    Page 2 of a filtered list must stay filtered (search and a host's own
+    filters such as first_name / sorteer / group[id]). will_paginate does
+    that itself: it puts the request's params (all params on GET, the query
+    string otherwise) into every page link, except script_name and
+    original_script_name. Do not merge request.query_parameters in here:
+    explicit params skip that exclusion, so ?script_name=javascript:… became
+    the start of every page link's href (XSS), and ?controller=x a 500.
+    test/integration/list_params_test.rb covers both.
+  -%>
   <% paginate_params = { update: update_span, ul_needed: true } %>
-  <% paginate_params[:search] = params[:search] if params[:search].present? %>
   <% pagination = will_paginate objects, params: paginate_params %>
 <% else %>
   <% if pagination %>
@@ -144,6 +158,9 @@
     </div>
   </div>
 <% end %>
+<% end -%>
 <% if ul_needed -%>
-  <%= raw "</turbo-frame>" -%>
+  <%= tag.turbo_frame(list_body, id: update_span, class: "list_container") -%>
+<% else -%>
+  <%= list_body -%>
 <% end -%>

data/app/views/inline_forms/_versions.html.erb

@@ -7,7 +7,7 @@
     (parent + rich_text), flickering as the user toggled the panel. -%>
 <div class="row form_element_header associated_auto_header callout">
   <div class='medium-11 large-11 column' >
-    <%= "Versions (#{inline_forms_history_for(object).length})" %>
+    <%= t("inline_forms.view.versions", count: inline_forms_history_for(object).length) %>
   </div>
   <div class='medium-1 large-1 column'>
       <%= link_to_versions_list(

data/app/views/inline_forms/_versions_file_entry.html.erb

@@ -23,7 +23,7 @@
     <%= t("inline_forms.files.event.#{entry[:file_event]}") %>
   </div>
   <div class="small-2 column">
-    <%= entry[:at] %>
+    <%= l(entry[:at], format: :short) %>
   </div>
   <div class="small-2 column">
     <%= inline_forms_file_user_name(entry[:by]) %>

data/app/views/inline_forms/_versions_list.html.erb

@@ -4,7 +4,7 @@
 <% restorable_files = inline_forms_restorable_file_entries(@object, entries.filter_map { |e| e[:entry]&.attribute_name }.uniq) -%>
 <div class="row form_element_header associated_auto_header callout">
   <div class='medium-11 large-11 column' >
-    <%= "Versions (#{entries.length})" %>
+    <%= t("inline_forms.view.versions", count: entries.length) %>
   </div>
   <div class='medium-1 large-1 column'>
     <%= close_versions_list_link(
@@ -32,16 +32,16 @@
     &nbsp;
   </div>
   <div class="small-1 column">
-    <strong>Event</strong>
+    <strong><%= t("inline_forms.view.versions_event") %></strong>
   </div>
   <div class="small-2 column">
-    <strong>When</strong>
+    <strong><%= t("inline_forms.view.versions_when") %></strong>
   </div>
   <div class="small-2 column">
-    <strong>Done by</strong>
+    <strong><%= t("inline_forms.view.versions_done_by") %></strong>
   </div>
   <div class="small-6 column">
-    <strong>Changeset</strong>
+    <strong><%= t("inline_forms.view.versions_changeset") %></strong>
   </div>
 </div>
 <% entries.reverse.each do |entry| %>
@@ -92,17 +92,17 @@
       <% end %>
     </div>
     <div class="small-1 column">
-      <%= version.event -%><% if entry[:kind] == :rich_text %> <em>(rich text)</em><% end %>
+      <%= t("inline_forms.view.version_events.#{version.event}", default: version.event) -%><% if entry[:kind] == :rich_text %> <em>(<%= t("inline_forms.view.versions_rich_text") %>)</em><% end %>
     </div>
     <div class="small-2 column">
-      <%= version.created_at -%>
+      <%= l(version.created_at, format: :short) -%>
     </div>
     <div class="small-2 column">
       <%= version_modified_by version.whodunnit -%>
     </div>
     <div class="small-6 column">
       <% if version.changeset.nil? || version.changeset.empty? %>
-        <em>empty</em>
+        <em><%= t("inline_forms.view.versions_empty") %></em>
       <% else %>
         <% version.changeset.each do |attribute, value| %>
           <% next if attribute == 'updated_at' %>
@@ -116,13 +116,15 @@
               <th></th>
             </tr>
             <tr>
-              <td>old value</td>
-              <td>new value</td>
+              <td><%= t("inline_forms.view.versions_old_value") %></td>
+              <td><%= t("inline_forms.view.versions_new_value") %></td>
             </tr>
             <tr>
               <% if entry[:kind] == :rich_text && attribute == 'body' %>
-                <td><%= raw value[0] %></td>
-                <td><%= raw value[1] %></td>
+                <%# Rich-text HTML as stored in the version: sanitized, never
+                    raw (a body posted outside Trix may carry script). -%>
+                <td><%= sanitize value[0].to_s %></td>
+                <td><%= sanitize value[1].to_s %></td>
               <% else %>
                 <td><%= value[0] %></td>
                 <td><%= value[1] %></td>