locomotive_cms 2.0.0.rc7 → 2.0.0.rc8

data/config/locales/{flash.no.yml → flash.nb.yml}

@@ -1,4 +1,4 @@
-"no":
+nb:
   flash:
     locomotive:
       pages:

data/config/locales/{formtastic.no.yml → formtastic.nb.yml}

@@ -1,4 +1,4 @@
-"no":
+nb:
   formtastic:
     titles:
       information: Generell informasjon
@@ -33,37 +33,40 @@
       custom_fields:
         field:
           name: Alias
-      import:
-        new:
-          source: Fil
-          samples: Kopier testdata
-          reset: Reset side
-          default_site_template: "Bruk standardmalen. Klikk <a href='#'>her</a> for å laste opp en mal fra en zip-fil i stedet."
       content_type:
-        item_template: Elementmal
-        api_accounts: Varslede kontoer
+        raw_item_template: Elementmal
+        public_submission_enabled: Kan opprettes utenfra
+        public_submission_accounts: Kontoer som varsles
+        "custom_fields/field":
+          select_options: "Valg"
       content_entry:
         _slug: Permalink
       account:
         edit:
+          locale: Språk
           password: Nytt passord
           password_confirmation: Bekreft nytt passord
       page:
         seo_title: Tittel
+        target_klass_name: Modell
+      site:
+        locales: Språk
 
     hints:
       page:
+        handle: "En unik ID for å hente siden fra en ekstern controller"
         published: "Kun autoriserte kontoer kan se ikke-publiserte sider"
         cache_strategy: "Buffre siden for å bedre ytelsen. \"Enkel\" er et bra kompromiss."
         templatized: "Bruk denne siden som mal for en modell."
         listed: "Styr om siden skal vises i de genererte menyene."
-        content_type_id: "Innholdstypen denne siden skal være mal for."
+        target_klass_name: "Innholdstypen denne siden skal være mal for."
         seo_title: "Definer en egen tittel for siden. Denne blir benyttet av nettleseren. Hvis denne står tom blir standardverdien fra sideinnstillingene benyttet."
         meta_keywords: "Overstyr søkemotor-metadata for denne siden. Separer med komma."
         meta_description: "Overstyr søkemotorbeskrivelsen for denne siden."
       snippet:
         slug: "Denne brukes for å inkludere HTML-snutten i en side."
       site:
+        locales: "Dra et flagg til første posisjon for å sette som standard."
         seo_title: "Definer en global verdi her som brukes som verdi for titteltaggen i sidens head-seksjon."
         meta_keywords: "Meta-nøkkelord blir brukt i head-seksjonen og leses av søkemotorer. Separeres med komma."
         meta_description: "Meta-beskrivelse brukes i head-seksjonen og leses av søkemotorer."
@@ -79,10 +82,6 @@
           source: "Filen er tilgjengelig her: %{url}"
         update:
           source: "Filen er tilgjengelig her: %{url}"
-      custom_fields:
-        field:
-          name: "Verdi tilgjengelig i liquid-maler"
-          hint: "Tekst som vises i skjemaet rett under feltet"
       content_entry:
         _slug: "Verdien brukes til å generere en url for en side som fungerer som en mal for denne innholdstypen (f.eks: \"template_page/{{ your_object._permalink }})\"."
         seo_title: "Verdien benyttes til å erstatte sidetittelen for malen knyttet til modellen. Leses av søkemotorer."
@@ -93,7 +92,12 @@
         samples: "Vil gjøre at importen kopierer innhold og assets"
         reset: "Vil gjøre at alle data slettes for den nye siden importeres."
       content_type:
-        item_template: "Du kan justere teksten som vises for hvert element i listen. Bruk liquid, f.eks: {{ entry.name }}"
-        api_enabled: "Brukes for å la sidebrukere opprette ny elementer (f.eks: meldinger i et kontaktskjema)"
-        api_accounts: "En varslingsepost vil bli sendt til alle kontoene ovenfor når et nytt element blir opprettet."
+        name: "Vi foreslår at du bruker flertals form (E.G: Personer)"
+        slug: "It will be used as the name of the collection in the liquid templates. Ex: <span class='code'>{{ contents.my_projects }}</span>"
+        raw_item_template: "You can customize the text displayed for each item in the list. Simply use Liquid. Ex: <span class='code'>{{ entry.name }})</span>"
+        public_submission_enabled: "It is used to let people from outside to create new entries (example: messages in a contact form)"
+        public_submission_accounts: "If the public submission option is enabled and for each entry created, sends a notification email to the accounts listed above."
+        "custom_fields/field":
+          name: "Name of the property for liquid templates. Ex: <span class='code'>&#123;&#123; your_object.&lt;name_of_your_field&gt; &#125;&#125;</span>"
+          hint: "Text displayed in the model form just below the field"
 

data/config/routes.rb

@@ -68,6 +68,10 @@ Rails.application.routes.draw do
 
       resources :content_entries, :path => 'content_types/:slug/entries'
 
+      resources :sites
+
+      resources :memberships
+
       resource  :current_site, :controller => 'current_site'
 
     end

data/lib/generators/locomotive/install/templates/locomotive.rb

@@ -22,11 +22,11 @@ Locomotive.configure do |config|
   #   :max_content_types  => 4
   # }
 
-  # default locale (for now, only en, de, fr, pt-BR and it are supported)
+  # default locale (for now, only en, de, fr, pt-BR, it and nb are supported)
   config.default_locale = :en
 
   # available locales suggested to "localize" a site. You will have to pick up at least one among that list.
-  # config.site_locales = %w{en de fr pt-BR it nl no es ru}
+  # config.site_locales = %w{en de fr pt-BR it nl nb es ru}
 
   # tell if logs are enabled. Useful for debug purpose.
   config.enable_logs = true
@@ -48,6 +48,13 @@ Locomotive.configure do |config|
   # add extra classes other than the defined content types among a site which will potentially used by the templatized pages.
   # config.models_for_templatization = %w(Product)
 
+  # "Public" forms can be protected from Cross-Site Request Forgery (CSRF) attacks.
+  # By default, that protection is disabled (false) in order to keep backwards compatibility with the existing public forms.
+  #
+  # Note: we strongly recommend to enable it. See the documentation about the "csrf_param" liquid tag.
+  #
+  # config.csrf_protection = true
+
   # Rack-cache settings, mainly used for the inline resizing image module. Default options:
   # config.rack_cache = {
   #   :verbose     => true,

data/lib/locomotive.rb

@@ -12,6 +12,7 @@ require 'locomotive/carrierwave'
 require 'locomotive/custom_fields'
 require 'locomotive/httparty'
 require 'locomotive/action_controller'
+require 'locomotive/rails'
 require 'locomotive/routing'
 require 'locomotive/regexps'
 require 'locomotive/render'

data/lib/locomotive/configuration.rb

@@ -7,8 +7,8 @@ module Locomotive
       :reserved_subdomains    => %w{www admin email blog webmail mail support help site sites},
       # :forbidden_paths      => %w{layouts snippets stylesheets javascripts assets admin system api},
       :reserved_slugs         => %w{stylesheets javascripts assets admin locomotive images api pages edit},
-      :locales                => %w{en de fr pt-BR it nl no es ru},
-      :site_locales           => %w{en de fr pt-BR it nl no es ru},
+      :locales                => %w{en de fr pt-BR it nl nb es ru},
+      :site_locales           => %w{en de fr pt-BR it nl nb es ru},
       :cookie_key             => '_locomotive_session',
       :enable_logs            => false,
       :delayed_job            => false,
@@ -27,7 +27,8 @@ module Locomotive
       },
       :devise_modules             => [:rememberable, :database_authenticatable, :token_authenticatable, :recoverable, :trackable, :validatable, :encryptable, { :encryptor => :sha1 }],
       :context_assign_extensions  => { },
-      :models_for_templatization  => []
+      :models_for_templatization  => [],
+      :csrf_protection            => false
     }
 
     cattr_accessor :settings

data/lib/locomotive/custom_fields.rb

@@ -22,6 +22,7 @@ module CustomFields
   module Types
 
     module File
+
       class FileUploader < ::CarrierWave::Uploader::Base
 
         # Set correct paths
@@ -34,6 +35,7 @@ module CustomFields
         end
 
       end
+
     end
 
   end

data/lib/locomotive/liquid/drops/page.rb

@@ -10,7 +10,7 @@ module Locomotive
         end
 
         def slug
-          self._source.templatized? ? self._source.content_type.slug.singularize : self._source.slug
+          self._source.templatized? ? @context['entry']._slug.singularize : self._source.slug
         end
 
         def parent

data/lib/locomotive/liquid/tags/csrf.rb

@@ -0,0 +1,40 @@
+module Locomotive
+  module Liquid
+    module Tags
+      module Csrf
+
+        class Param < ::Liquid::Tag
+
+          def render(context)
+            controller  = context.registers[:controller]
+            name        = controller.send(:request_forgery_protection_token).to_s
+            value       = controller.send(:form_authenticity_token)
+
+            %(<input type="hidden" name="#{name}" value="#{value}" />)
+          end
+
+        end
+
+        class Meta < ::Liquid::Tag
+
+          def render(context)
+            controller  = context.registers[:controller]
+            name        = controller.send(:request_forgery_protection_token).to_s
+            value       = controller.send(:form_authenticity_token)
+
+            %{
+              <meta name="csrf-param" content="#{name}" />
+              <meta name="csrf-token" content="#{value}" />
+            }
+          end
+
+        end
+
+      end
+
+      ::Liquid::Template.register_tag('csrf_param', Csrf::Param)
+      ::Liquid::Template.register_tag('csrf_meta', Csrf::Meta)
+
+    end
+  end
+end

data/lib/locomotive/liquid/tags/extends.rb

@@ -18,14 +18,7 @@ module Locomotive
 
         def parse_parent_template
           if @template_name == 'parent'
-            if @context[:cached_parent]
-              @context[:parent_page] = @context[:cached_parent] #.clone # parent must not be modified
-
-              @context[:cached_parent].instance_variable_set(:@template, nil) # force to reload the template
-              @context[:cached_parent] = nil
-            else
-              @context[:parent_page] = @context[:page].parent
-            end
+            @context[:parent_page] = @context[:cached_parent] || @context[:page].parent
           else
             locale = ::Mongoid::Fields::I18n.locale
 
@@ -40,7 +33,8 @@ module Locomotive
 
           raise PageNotTranslated.new("Page with fullpath '#{@template_name}' was not translated") if parent_template.nil?
 
-          @context[:parent_page].instance_variable_set(:@template, parent_template)
+          # force the page to restore the original version of its template (from the serialized version)
+          @context[:parent_page].instance_variable_set(:@template, nil)
 
           parent_template
         end

data/lib/locomotive/liquid/tags/nav.rb

@@ -28,7 +28,7 @@ module Locomotive
             if @options[:snippet]
               template = @options[:snippet].include?('{') ? @options[:snippet] : context[:site].snippets.where(:slug => @options[:snippet] ).try(:first).try(:template)
               unless template.blank?
-                @options[:liquid_render] = ::Liquid::Template.parse( template )
+                @options[:liquid_render] = ::Liquid::Template.parse(template)
                 @options[:add_attributes] = ['editable_elements']
               end
             end
@@ -70,12 +70,12 @@ module Locomotive
           @site, @page = context.registers[:site], context.registers[:page]
 
           children = (case @source
-          when 'site'     then @site.pages.root.minimal_attributes( @options[:add_attributes] ).first # start from home page
+          when 'site'     then @site.pages.root.minimal_attributes(@options[:add_attributes]).first # start from home page
           when 'parent'   then @page.parent || @page
           when 'page'     then @page
           else
-            @site.pages.fullpath(@source).minimal_attributes( @options[:add_attributes] ).first
-          end).children_with_minimal_attributes( @options[:add_attributes] ).to_a
+            @site.pages.fullpath(@source).minimal_attributes(@options[:add_attributes]).first
+          end).children_with_minimal_attributes(@options[:add_attributes]).to_a
 
           children.delete_if { |p| !include_page?(p) }
         end
@@ -86,16 +86,16 @@ module Locomotive
 
           icon = @options[:icon] ? '<span></span>' : ''
 
-          title = @options[:liquid_render] ? @options[:liquid_render].render( 'page' => page ) : page.title
+          title = @options[:liquid_render] ? @options[:liquid_render].render('page' => page) : page.title
 
           label = %{#{icon if @options[:icon] != 'after' }#{title}#{icon if @options[:icon] == 'after' }}
 
           link_options = caret = ''
-          href    = "/#{page.fullpath}"
+          href = File.join('/', @site.localized_page_fullpath(page))
 
           if render_children_for_page?(page, depth) && bootstrap?
             css           += ' dropdown'
-            link_options  = %{ class="dropdown-toggle" data-toogle="dropdown"}
+            link_options  = %{ class="dropdown-toggle" data-toggle="dropdown"}
             href          = '#'
             caret         = %{ <b class="caret"></b>}
           end
@@ -116,7 +116,7 @@ module Locomotive
         def render_entry_children(page, depth)
           output = %{}
 
-          children = page.children_with_minimal_attributes( @options[:add_attributes] ).reject { |c| !include_page?(c) }
+          children = page.children_with_minimal_attributes(@options[:add_attributes]).reject { |c| !include_page?(c) }
           if children.present?
             output = %{<ul id="#{@options[:id]}-#{page.slug.to_s.dasherize}" class="#{bootstrap? ? 'dropdown-menu' : ''}">}
             children.each do |c, page|

data/lib/locomotive/mongoid/patches.rb

@@ -28,6 +28,13 @@ module Mongoid#:nodoc:
     end
   end
 
+  module Criterion
+    class Selector < Hash
+      # for some reason, the store method behaves differently than the []= one, causing regression bugs (query not localized)
+      alias :store :[]=
+    end
+  end
+
   # without callback feature
   module Callbacks #:nodoc:
     module ClassMethods #:nodoc:
@@ -41,21 +48,59 @@ module Mongoid#:nodoc:
 
   # make the validators work with localized field
   module Validations #:nodoc:
-    def read_attribute_for_validation_with_localization(attr)
-      if fields[attr.to_s] && fields[attr.to_s].localized?
-        send(attr.to_sym)
-      else
-        read_attribute_for_validation_without_localization(attr)
+
+    class ExclusionValidator < ActiveModel::Validations::ExclusionValidator
+      include Localizable
+    end
+
+    class UniquenessValidator < ActiveModel::EachValidator
+
+      def to_validate_with_localization(document, attribute, value)
+        field = document.fields[attribute.to_s]
+        if field.try(:localized?)
+          # no need of the translations, just the current value
+          value = document.send(attribute.to_sym)
+        end
+        to_validate_without_localization(document, attribute, value)
+      end
+
+      alias_method_chain :to_validate, :localization
+
+    end
+
+    module ClassMethods
+      def validates_exclusion_of(*args)
+        validates_with(ExclusionValidator, _merge_attributes(args))
       end
     end
 
-    alias_method_chain :read_attribute_for_validation, :localization
+    module LocalizedEachValidator
+
+      # Performs validation on the supplied record. By default this will call
+      # +validates_each+ to determine validity therefore subclasses should
+      # override +validates_each+ with validation logic.
+      def validate(record)
+        attributes.each do |attribute|
+          field = record.fields[attribute.to_s]
+
+          # make sure that we use the localized value and not the translations when we test the allow_nil and allow_blank options
+          value = field.try(:localized?) ? record.send(attribute.to_sym) : record.read_attribute_for_validation(attribute)
+
+          next if (value.nil? && options[:allow_nil]) || (value.blank? && options[:allow_blank])
 
-    class PresenceValidator < ActiveModel::EachValidator
-      def validate_each(document, attribute, value)
-        document.errors.add(attribute, :blank, options) if value.blank?
+          # use the translations of the localized field for the next part
+          value = record.read_attribute_for_validation(attribute) if field.try(:localized?)
+
+          validate_each(record, attribute, value)
+        end
       end
+
     end
+
+    [FormatValidator, LengthValidator, PresenceValidator, UniquenessValidator, ExclusionValidator].each do |klass|
+      klass.send(:include, LocalizedEachValidator)
+    end
+
   end
 
 end

data/lib/locomotive/rails.rb

@@ -0,0 +1 @@
+require 'locomotive/rails/action_view'

data/lib/locomotive/rails/action_view.rb

@@ -0,0 +1,9 @@
+# http://jfire.io/blog/2012/04/30/how-to-securely-bootstrap-json-in-a-rails-view/
+class ActionView::Base
+  def json_escape(s)
+    result = s.to_s.gsub('/', '\/')
+    s.html_safe? ? result.html_safe : result
+  end
+
+  alias j json_escape
+end

data/lib/locomotive/render.rb

@@ -11,7 +11,7 @@ module Locomotive
       else
         @page = locomotive_page
 
-        redirect_to(@page.redirect_url) and return if @page.present? && @page.redirect?
+        redirect_to(@page.redirect_url, :status => 301) and return if @page.present? && @page.redirect?
 
         render_no_page_error and return if @page.nil?
 
@@ -53,10 +53,10 @@ module Locomotive
         'url'               => request.url,
         'now'               => Time.now.utc,
         'today'             => Date.today,
-        'locale'            => I18n.locale,
+        'locale'            => I18n.locale.to_s,
         'default_locale'    => current_site.default_locale.to_s,
         'locales'           => current_site.locales,
-	'current_user'      => Locomotive::Liquid::Drops::CurrentUser.new(current_locomotive_account)
+        'current_user'      => Locomotive::Liquid::Drops::CurrentUser.new(current_locomotive_account)
       }
 
       assigns.merge!(Locomotive.config.context_assign_extensions)
@@ -64,7 +64,7 @@ module Locomotive
       assigns.merge!(flash.to_hash.stringify_keys) # data from public submissions
 
       if @page.templatized? # add instance from content type
-        assigns['entry'] = @page.content_entry
+        assigns['content_entry'] = assigns['entry'] = @page.content_entry
         assigns[@page.target_entry_name] = @page.content_entry # just here to help to write readable liquid code
       end
 

data/lib/locomotive/version.rb

@@ -1,3 +1,3 @@
 module Locomotive #:nodoc
-  VERSION = '2.0.0.rc7'
+  VERSION = '2.0.0.rc8'
 end

data/vendor/assets/javascripts/locomotive/backbone.modelbinding.js

@@ -64,10 +64,13 @@ Backbone.ModelBinding = (function(Backbone, _, $){
       this.modelBindings.push({model: model, eventName: eventName, callback: callback});
     }
 
-    this.registerElementBinding = function(element, callback){
+    this.registerElementBinding = function(element, callback, callbackSilently){
       // bind the form changes to the model
       element.bind("change", callback);
       this.elementBindings.push({element: element, eventName: "change", callback: callback});
+
+      if (callbackSilently)
+        element.bind("changeSilently", callbackSilently)
     }
   }
 
@@ -188,18 +191,24 @@ Backbone.ModelBinding = (function(Backbone, _, $){
           element.val(val);
         };
 
-        var setModelValue = function(attr_name, value){
+        var setModelValue = function(attr_name, value, silent){
+          if (typeof(silent) === 'undefined' || silent == null) silent = false
           var data = {};
           data[attr_name] = value;
-          model.set(data);
+          model.set(data, { 'silent': silent });
         };
 
         var elementChange = function(ev){
           setModelValue(attribute_name, view.$(ev.target).val());
         };
 
+        // FIXME (Did): simple solution to update the model without triggering related callbacks (solving a bug with tinymce)
+        var elementChangeSilently = function(ev) {
+          setModelValue(attribute_name, view.$(ev.target).val(), true);
+        }
+
         modelBinder.registerModelBinding(model, attribute_name, modelChange);
-        modelBinder.registerElementBinding(element, elementChange);
+        modelBinder.registerElementBinding(element, elementChange, elementChangeSilently);
 
         // set the default value on the form, from the model
         var attr_value = model.get(attribute_name);