lc_alchemy_cms 3.2.0

data/app/controllers/alchemy/api/base_controller.rb

@@ -0,0 +1,19 @@
+module Alchemy
+  class Api::BaseController < Alchemy::BaseController
+    layout false
+    respond_to :json
+
+    rescue_from CanCan::AccessDenied,         with: :render_not_authorized
+    rescue_from ActiveRecord::RecordNotFound, with: :render_not_found
+
+    private
+
+    def render_not_authorized
+      render json: {error: 'Not authorized'}, status: 403
+    end
+
+    def render_not_found
+      render json: {error: 'Record not found'}, status: 404
+    end
+  end
+end

data/app/controllers/alchemy/api/contents_controller.rb

@@ -0,0 +1,35 @@
+module Alchemy
+  class Api::ContentsController < Api::BaseController
+
+    # Returns all contents as json object
+    #
+    # You can either load all or only these for :element_id param
+    #
+    def index
+      @contents = Content.accessible_by(current_ability, :index)
+      if params[:element_id].present?
+        @contents = @contents.where(element_id: params[:element_id])
+      end
+      respond_with @contents
+    end
+
+    # Returns a json object for content
+    #
+    # You can either load it from :id param
+    # or even more useful via passing the element id and the name of the content
+    #
+    #   $ bin/rake routes
+    #
+    # for more infos on how the url looks like.
+    #
+    def show
+      if params[:id]
+        @content = Content.find(params[:id])
+      elsif params[:element_id] && params[:name]
+        @content = Content.find_by!(element_id: params[:element_id], name: params[:name])
+      end
+      authorize! :show, @content
+      respond_with @content
+    end
+  end
+end

data/app/controllers/alchemy/api/elements_controller.rb

@@ -0,0 +1,29 @@
+module Alchemy
+  class Api::ElementsController < Api::BaseController
+
+    # Returns all elements as json object
+    #
+    # You can either load all or only these for :page_id param
+    #
+    # If you want to only load a specific type of element pass ?named=an_element_name
+    #
+    def index
+      @elements = Element.accessible_by(current_ability, :index)
+      if params[:page_id].present?
+        @elements = @elements.where(page_id: params[:page_id])
+      end
+      if params[:named].present?
+        @elements = @elements.named(params[:named])
+      end
+      respond_with @elements
+    end
+
+    # Returns a json object for element
+    #
+    def show
+      @element = Element.find(params[:id])
+      authorize! :show, @element
+      respond_with @element
+    end
+  end
+end

data/app/controllers/alchemy/api/pages_controller.rb

@@ -0,0 +1,32 @@
+module Alchemy
+  class Api::PagesController < Api::BaseController
+    before_action :load_page, only: [:show]
+
+    # Returns all pages as json object
+    #
+    def index
+      @pages = Page.accessible_by(current_ability, :index)
+      if params[:page_layout].present?
+        @pages = @pages.where(page_layout: params[:page_layout])
+      end
+      respond_with @pages
+    end
+
+    # Returns a json object for page
+    #
+    # You can either load the page via id or its urlname
+    #
+    def show
+      authorize! :show, @page
+      respond_with @page
+    end
+
+    private
+
+    def load_page
+      @page = Page.find_by(id: params[:id]) ||
+              Page.find_by(urlname: params[:urlname]) ||
+              raise(ActiveRecord::RecordNotFound)
+    end
+  end
+end

data/app/controllers/alchemy/attachments_controller.rb

@@ -0,0 +1,35 @@
+module Alchemy
+  class AttachmentsController < BaseController
+    before_action :load_attachment
+    authorize_resource class: Alchemy::Attachment
+
+    # sends file inline. i.e. for viewing pdfs/movies in browser
+    def show
+      send_data(
+        @attachment.file.data,
+        {
+          filename: @attachment.file_name,
+          type: @attachment.file_mime_type,
+          disposition: 'inline'
+        }
+      )
+    end
+
+    # sends file as attachment. aka download
+    def download
+      send_data(
+        @attachment.file.data, {
+          filename: @attachment.file_name,
+          type: @attachment.file_mime_type
+        }
+      )
+    end
+
+    private
+
+    def load_attachment
+      @attachment = Attachment.find(params[:id])
+    end
+
+  end
+end

data/app/controllers/alchemy/base_controller.rb

@@ -0,0 +1,106 @@
+# This is the main Alchemy controller all other controllers inherit from.
+#
+module Alchemy
+  class BaseController < ApplicationController
+    include Alchemy::ConfigurationMethods
+    include Alchemy::ControllerActions
+    include Alchemy::Modules
+    include Alchemy::SSLProtection
+
+    protect_from_forgery
+
+    before_action :mailer_set_url_options
+    before_action :set_locale
+
+    helper 'alchemy/admin/form'
+
+    rescue_from CanCan::AccessDenied do |exception|
+      permission_denied(exception)
+    end
+
+    private
+
+    # Sets +I18n.locale+ to current Alchemy language.
+    #
+    def set_locale
+      ::I18n.locale = Language.current.code
+    end
+
+    def not_found_error!(msg = "Not found \"#{request.fullpath}\"")
+      raise ActionController::RoutingError.new(msg)
+    end
+
+    # Shortcut for Alchemy::I18n.translate method
+    def _t(key, *args)
+      I18n.t(key, *args)
+    end
+
+    # Store current request path into session,
+    # so we can later redirect to it.
+    def store_location
+      session[:redirect_path] = request.path
+    end
+
+    def mailer_set_url_options
+      ActionMailer::Base.default_url_options[:host] = request.host_with_port
+    end
+
+    protected
+
+    def permission_denied(exception = nil)
+      if exception
+        Rails.logger.debug <<-WARN
+
+/!\\ Failed to permit #{exception.action} on #{exception.subject.inspect} for:
+#{current_alchemy_user.inspect}
+WARN
+      end
+      if current_alchemy_user
+        handle_redirect_for_user
+      else
+        handle_redirect_for_guest
+      end
+    end
+
+    def handle_redirect_for_user
+      flash[:warning] = _t('You are not authorized')
+      if can?(:index, :alchemy_admin_dashboard)
+        redirect_or_render_notice
+      else
+        redirect_to('/')
+      end
+    end
+
+    def redirect_or_render_notice
+      if request.xhr?
+        respond_to do |format|
+          format.js do
+            render text: flash.discard(:warning), status: 403
+          end
+          format.html do
+            render partial: 'alchemy/admin/partials/flash',
+              locals: {message: flash[:warning], flash_type: 'warning'}
+          end
+        end
+      else
+        redirect_to(alchemy.admin_dashboard_path)
+      end
+    end
+
+    def handle_redirect_for_guest
+      flash[:info] = _t('Please log in')
+      if request.xhr?
+        render :permission_denied
+      else
+        store_location
+        redirect_to Alchemy.login_path
+      end
+    end
+
+    # Logs the current exception to the error log.
+    def exception_logger(e)
+      Rails.logger.error("\n#{e.class} #{e.message} in #{e.backtrace.first}")
+      Rails.logger.error(e.backtrace[1..50].each { |l| l.gsub(/#{Rails.root.to_s}/, '') }.join("\n"))
+    end
+  end
+end

data/app/controllers/alchemy/elements_controller.rb

@@ -0,0 +1,27 @@
+module Alchemy
+  class ElementsController < Alchemy::BaseController
+    load_and_authorize_resource
+    layout false
+
+    rescue_from CanCan::AccessDenied do |exception|
+      raise ActiveRecord::RecordNotFound
+    end
+
+    # == Renders the element view partial
+    #
+    # === Accepted Formats
+    #
+    # * html
+    # * js (Tries to replace a given +container_id+ with the elements view partial content via jQuery.)
+    #
+    def show
+      @page = @element.page
+      @options = params[:options]
+
+      respond_to do |format|
+        format.html
+        format.js { @container_id = params[:container_id] }
+      end
+    end
+  end
+end

data/app/controllers/alchemy/messages_controller.rb

@@ -0,0 +1,114 @@
+module Alchemy
+  #
+  # == Sending Messages:
+  #
+  # To send Messages via contact forms you can create your form fields in the config.yml
+  #
+  # === Example:
+  #
+  # Make an Element with this options inside your @elements.yml file:
+  #
+  #   - name: contactform
+  #     contents:
+  #     - name: mail_to
+  #       type: EssenceText
+  #     - name: subject
+  #       type: EssenceText
+  #     - name: mail_from
+  #       type: EssenceText
+  #     - name: success_page
+  #       type: EssenceSelect
+  #
+  # The fields +mail_to+, +mail_from+, +subject+ and +success_page+ are recommended.
+  # The +Alchemy::MessagesController+ uses them to send your mails. So your customer has full controll of these values inside his contactform element.
+  #
+  # Then make a page layout for your contact page in the +page_layouts.yml+ file:
+  #
+  #   - name: contact
+  #     unique: true
+  #     cache: false
+  #     elements: [pageheading, heading, contactform]
+  #     autogenerate: [contactform]
+  #
+  # Disabling the page caching is stronlgy recommended!
+  #
+  # The editor view for your element should have this layout:
+  #
+  #   <%= render_essence_editor_by_name(element, 'mail_from') %>
+  #   <%= render_essence_editor_by_name(element, 'mail_to') %>
+  #   <%= render_essence_editor_by_name(element, 'subject') %>
+  #   <%= page_selector(element, 'success_page', page_attribute: :urlname) %>
+  #
+  # Please have a look at the +alchemy/config/config.yml+ file for further Message settings.
+  #
+  class MessagesController < Alchemy::BaseController
+    before_filter :get_page, except: :create
+
+    helper 'alchemy/pages'
+
+    def index #:nodoc:
+      redirect_to show_page_path(urlname: @page.urlname, locale: multi_language? ? @page.language_code : nil)
+    end
+
+    def new #:nodoc:
+      @message = Message.new
+      render template: 'alchemy/pages/show'
+    end
+
+    def create #:nodoc:
+      @message = Message.new(params[:message])
+      @message.ip = request.remote_ip
+      @element = Element.find_by(id: @message.contact_form_id)
+      if @element.nil?
+        raise ActiveRecord::RecordNotFound, "Contact form id not found. Please pass the :contact_form_id in a hidden field. Example: <%= f.hidden_field :contact_form_id, value: element.id %>"
+      end
+      @page = @element.page
+      @root_page = @page.get_language_root
+      if @message.valid?
+        Messages.contact_form_mail(@message, mail_to, mail_from, subject).deliver
+        redirect_to_success_page
+      else
+        render template: 'alchemy/pages/show'
+      end
+    end
+
+    private
+
+    def mailer_config
+      Alchemy::Config.get(:mailer)
+    end
+
+    def mail_to
+      @element.ingredient(:mail_to) || mailer_config['mail_to']
+    end
+
+    def mail_from
+      @element.ingredient(:mail_from) || mailer_config['mail_from']
+    end
+
+    def subject
+      @element.ingredient(:subject) || mailer_config['subject']
+    end
+
+    def redirect_to_success_page
+      flash[:notice] = _t(:success, scope: 'contactform.messages')
+      if @element.ingredient(:success_page)
+        urlname = @element.ingredient(:success_page)
+      elsif mailer_config['forward_to_page'] && mailer_config['mail_success_page']
+        urlname = Page.find_by(urlname: mailer_config['mail_success_page']).urlname
+      else
+        urlname = Language.current_root_page.urlname
+      end
+      redirect_to show_page_path(urlname: urlname, locale: multi_language? ? Language.current.code : nil)
+    end
+
+    def get_page
+      @page = Language.current.pages.find_by(page_layout: mailer_config['page_layout_name'])
+      if @page.blank?
+        raise "Page for page_layout #{mailer_config['page_layout_name']} not found"
+      end
+      @root_page = @page.get_language_root
+    end
+
+  end
+end

data/app/controllers/alchemy/pages_controller.rb

@@ -0,0 +1,211 @@
+module Alchemy
+  class PagesController < Alchemy::BaseController
+
+    before_action :enforce_primary_host_for_site
+    before_action :render_page_or_redirect, only: [:show]
+
+    # Showing page from params[:urlname]
+    #
+    def show
+      authorize! :show, @page
+
+      if render_fresh_page?
+        respond_to do |format|
+          format.html { render layout: !request.xhr? }
+          format.rss do
+            if @page.contains_feed?
+              render layout: false, handlers: [:builder]
+            else
+              render xml: {error: 'Not found'}, status: 404
+            end
+          end
+        end
+      end
+    rescue ActionController::UnknownFormat
+      page_not_found!
+    end
+
+    # Renders a search engine compatible xml sitemap.
+    def sitemap
+      @pages = Page.sitemap
+      respond_to do |format|
+        format.xml { render layout: 'alchemy/sitemap' }
+      end
+    end
+
+    private
+
+    # Load the current page and store it in @page.
+    #
+    def load_page
+      @page ||= if params[:urlname].present?
+        # Load by urlname. If a language is specified in the request parameters,
+        # scope pages to it to make sure we can raise a 404 if the urlname
+        # is not available in that language.
+        Page.contentpages.where(
+          urlname:       params[:urlname],
+          language_id:   Language.current.id,
+          language_code: params[:locale] || Language.current.code
+        ).first
+      else
+        # No urlname was given, so just load the language root for the
+        # currently active language.
+        Language.current_root_page
+      end
+    end
+
+    def enforce_primary_host_for_site
+      if needs_redirect_to_primary_host?
+        redirect_to url_for(host: current_alchemy_site.host), :status => 301
+      end
+    end
+
+    def needs_redirect_to_primary_host?
+      current_alchemy_site.redirect_to_primary_host? &&
+        current_alchemy_site.host != '*' &&
+        current_alchemy_site.host != request.host
+    end
+
+    def render_page_or_redirect
+      @page ||= load_page
+
+      if signup_required?
+        redirect_to Alchemy.signup_path
+      elsif (@page.nil? || request.format.nil?) && last_legacy_url
+        @page = last_legacy_url.page
+        # This drops the given query string.
+        redirect_legacy_page
+      elsif @page.blank?
+        page_not_found!
+      elsif multi_language? && params[:locale].blank?
+        redirect_page(locale: Language.current.code)
+      elsif multi_language? && params[:urlname].blank? && !params[:locale].blank? && configuration(:redirect_index)
+        redirect_page(locale: params[:locale])
+      elsif configuration(:redirect_to_public_child) && !@page.public?
+        redirect_to_public_child
+      elsif params[:urlname].blank? && configuration(:redirect_index)
+        redirect_page
+      elsif !multi_language? && !params[:locale].blank?
+        redirect_page
+      elsif @page.has_controller?
+        redirect_to main_app.url_for(@page.controller_and_action)
+      else
+        # setting the language to page.language to be sure it's correct
+        set_alchemy_language(@page.language)
+        if params[:urlname].blank?
+          @root_page = @page
+        else
+          @root_page = Language.current_root_page
+        end
+      end
+    end
+
+    def signup_required?
+      if Alchemy.user_class.respond_to?(:admins)
+        Alchemy.user_class.admins.size == 0 && @page.nil?
+      end
+    end
+
+    def redirect_to_public_child
+      @page = @page.self_and_descendants.published.not_restricted.first
+      @page ? redirect_page : page_not_found!
+    end
+
+    # Redirects page to given url with 301 status while keeping all additional params
+    def redirect_page(options = {})
+      options = {
+        locale: (multi_language? ? @page.language_code : nil),
+        urlname: @page.urlname
+      }.merge(options)
+
+      redirect_to show_page_path(additional_params.merge(options)), status: 301
+    end
+
+    # Use the bare minimum to redirect to @page
+    # Don't use query string of legacy urlname
+    def redirect_legacy_page(options={})
+      defaults = {
+        locale: (multi_language? ? @page.language_code : nil),
+        urlname: @page.urlname
+      }
+      options = defaults.merge(options)
+      redirect_to show_page_path(options), status: 301
+    end
+
+    # Returns url parameters that are not internal show page params.
+    #
+    # * action
+    # * controller
+    # * urlname
+    # * locale
+    #
+    def additional_params
+      params.symbolize_keys.delete_if do |key, _|
+        [:action, :controller, :urlname, :locale].include?(key)
+      end
+    end
+
+    def legacy_urls
+      # /slug/tree => slug/tree
+      urlname = (request.fullpath[1..-1] if request.fullpath[0] == '/') || request.fullpath
+      LegacyPageUrl.joins(:page).where(urlname: urlname, Page.table_name => {language_id: Language.current.id})
+    end
+
+    def last_legacy_url
+      legacy_urls.last
+    end
+
+    # Returns true if the page cache control headers should be set.
+    #
+    # == Disable Alchemy's page caching globally
+    #
+    #     # config/alchemy/config.yml
+    #     ...
+    #     cache_pages: false
+    #
+    # == Disable caching on page layout level
+    #
+    #     # config/alchemy/page_layouts.yml
+    #     - name: contact
+    #       cache: false
+    #
+    # Note: This only sets the cache control headers and skips rendering of the page body, if the cache is fresh.
+    # This does not disable the fragment caching in the views. So if you don't want a page and it's elements to be cached,
+    # then be sure to not use <% cache element %> in the views.
+    #
+    # @returns Boolean
+    #
+    def cache_page?
+      return false if @page.nil? ||
+        !Rails.application.config.action_controller.perform_caching ||
+        !Alchemy::Config.get(:cache_pages)
+      page_layout = PageLayout.get(@page.page_layout)
+      page_layout['cache'] != false && page_layout['searchresults'] != true
+    end
+
+    # Returns the etag used for response headers.
+    #
+    # If a user is logged in, we append theirs etag to prevent caching of user related content.
+    #
+    # IMPORTANT: If your user does not have a +cache_key+ method (i.e. it's not an ActiveRecord model),
+    # you have to ensure to implement it and return a unique identifier for that particular user.
+    # Otherwise all users will see the same cached page, regardless of user's state.
+    #
+    def page_etag
+      @page.cache_key + current_alchemy_user.try(:cache_key).to_s
+    end
+
+    # We only render the page if either the cache is disabled for this page
+    # or the cache is stale, because it's been republished by the user.
+    #
+    def render_fresh_page?
+      !cache_page? || stale?(etag: page_etag,
+        last_modified: @page.published_at,
+        public: !@page.restricted)
+    end
+
+    def page_not_found!
+      not_found_error!("Alchemy::Page not found \"#{request.fullpath}\"")
+    end
+  end
+end