pages_core 3.4.2

data/app/controllers/admin/invites_controller.rb

@@ -0,0 +1,79 @@
+module Admin
+  class InvitesController < Admin::AdminController
+    before_action :require_authentication, except: [:accept, :show]
+    before_action :find_invite, only: [:show, :edit, :update, :destroy, :accept]
+    before_action :require_valid_token,    only: [:show, :accept]
+
+    require_authorization(
+      Invite,
+      proc { @invite },
+      member:     [:show, :edit, :update, :destroy],
+      collection: [:index, :new, :create]
+    )
+
+    def index
+      redirect_to admin_users_url
+    end
+
+    def accept
+      @user = @invite.create_user(user_params)
+      if @user.valid?
+        authenticate!(@user)
+        redirect_to admin_default_url
+      else
+        render action: :show
+      end
+    end
+
+    def show
+      @user = User.new(email: @invite.email)
+    end
+
+    def new
+      @invite = current_user.invites.new
+      Role.roles.each do |role|
+        @invite.roles.new(name: role.name) if role.default
+      end
+    end
+
+    def create
+      @invite = current_user.invites.create(invite_params)
+      if @invite.valid?
+        AdminMailer.invite(
+          @invite,
+          admin_invite_with_token_url(@invite, @invite.token)
+        ).deliver_now
+        @invite.update(sent_at: Time.now)
+        redirect_to admin_invites_url
+      else
+        render action: :new
+      end
+    end
+
+    def destroy
+      flash[:notice] = "The invite to #{@invite.email} has been deleted"
+      @invite.destroy
+      redirect_to admin_invites_url
+    end
+
+    private
+
+    def find_invite
+      @invite = Invite.find(params[:id])
+    end
+
+    def user_params
+      params.require(:user).permit(:name, :email, :password, :confirm_password)
+    end
+
+    def invite_params
+      params.require(:invite).permit(:email, role_names: [])
+    end
+
+    def require_valid_token
+      return if @invite && secure_compare(@invite.token, params[:token])
+      flash[:notice] = "Invalid invite token"
+      redirect_to(login_admin_users_url) && return
+    end
+  end
+end

data/app/controllers/admin/page_comments_controller.rb

@@ -0,0 +1,61 @@
+# encoding: utf-8
+
+module Admin
+  class PageCommentsController < Admin::AdminController
+    before_action :find_page
+    before_action :find_page_comment, only: [:show, :edit, :update, :destroy]
+
+    def index
+      redirect_to admin_page_path(@locale, @page)
+    end
+
+    def show
+    end
+
+    def new
+      @page_comment = @page.comments.new
+    end
+
+    def edit
+    end
+
+    def create
+      @page_comment = @page.comments.create(page_comment_params)
+      if @page_comment.valid?
+        flash[:notice] = "The comment was created"
+        redirect_to admin_page_path(@locale, @page)
+      else
+        render action: :new
+      end
+    end
+
+    def update
+      if @page_comment.update(page_comment_params)
+        flash[:notice] = "The comment was updated"
+        redirect_to admin_page_path(@locale, @page)
+      else
+        render action: :edit
+      end
+    end
+
+    def destroy
+      @page_comment.destroy
+      flash[:notice] = "The comment was deleted"
+      redirect_to admin_page_path(@locale, @page)
+    end
+
+    protected
+
+    def find_page
+      @page = Page.find(params[:page_id])
+    end
+
+    def find_page_comment
+      @page_comment = @page.comments.find(params[:id])
+    end
+
+    def page_comment_params
+      params.require(:page_comment).permit(:name, :email, :url, :body)
+    end
+  end
+end

data/app/controllers/admin/page_files_controller.rb

@@ -0,0 +1,81 @@
+# encoding: utf-8
+
+module Admin
+  class PageFilesController < Admin::AdminController
+    before_action :find_page
+    before_action :find_page_file,   only: [:show, :edit, :update, :destroy]
+    before_action :redirect_to_page, only: [:index, :show, :new, :edit]
+
+    require_authorization(
+      PageFile,
+      proc { @page_file },
+      collection: [:index, :reorder, :new, :create]
+    )
+
+    def index
+    end
+
+    def reorder
+      if params[:ids]
+        files = Array(params[:ids]).map { |id| PageFile.find(id) }
+        files.each_with_index do |file, index|
+          file.update(position: index)
+        end
+      end
+      if request.xhr?
+        render text: "ok"
+      else
+        redirect_to_page
+      end
+    end
+
+    def show
+    end
+
+    def new
+    end
+
+    def create
+      @page_file = @page.files.new
+      @page_file.update(page_file_params.merge(locale: @locale))
+      flash[:notice] = "Error uploading file!" unless @page_file.valid?
+      redirect_to_page
+    end
+
+    def edit
+    end
+
+    def update
+      if @page_file.update(page_file_params)
+        flash[:notice] = "File updated"
+      else
+        flash[:notice] = "Error updating file!"
+      end
+      redirect_to_page
+    end
+
+    def destroy
+      @page_file.destroy
+      flash[:notice] = "File deleted"
+      redirect_to_page
+    end
+
+    protected
+
+    def page_file_params
+      params.require(:page_file).permit(:name, :filename, :file)
+    end
+
+    def redirect_to_page
+      redirect_to(edit_admin_page_path(@locale, @page, anchor: "files"))
+    end
+
+    def find_page
+      @page = Page.find(params[:page_id]).localize(@locale)
+    end
+
+    def find_page_file
+      @page_file = @page.files.find(params[:id])
+    end
+  end
+end

data/app/controllers/admin/page_images_controller.rb

@@ -0,0 +1,116 @@
+# encoding: utf-8
+
+module Admin
+  class PageImagesController < Admin::AdminController
+    before_action :find_page
+    before_action :find_page_image, only: [:show, :edit, :update, :destroy]
+
+    require_authorization(
+      PageImage,
+      proc { @page_image },
+      collection: [:index, :reorder, :new, :create]
+    )
+
+    def index
+      @page_images = @page.page_images
+      respond_to do |format|
+        format.json do
+          render json: @page_images, each_serializer: Admin::PageImageSerializer
+        end
+      end
+    end
+
+    def reorder
+      @page_images = params[:ids].map { |id| PageImage.find(id) }
+      @page_images.each_with_index do |pi, i|
+        pi.update_column(:position, i)
+      end
+      respond_to do |format|
+        format.json do
+          render json: @page_images, each_serializer: Admin::PageImageSerializer
+        end
+      end
+    end
+
+    def show
+    end
+
+    def new
+      @page_image = @page.page_images.new
+    end
+
+    def create
+      if page_images_params?
+        page_images_params.each do |_index, attributes|
+          if attributes[:image]
+            @page.page_images.create(attributes.merge(locale: @locale))
+          end
+        end
+      else
+        @page.page_images.create(page_image_params.merge(locale: @locale))
+      end
+      redirect_to(admin_page_path(@locale, @page, anchor: "images"))
+    end
+
+    def update
+      if @page_image.update(page_image_params)
+        respond_to do |format|
+          format.html do
+            flash[:notice] = "The image was updated"
+            redirect_to(admin_page_path(@locale, @page, anchor: "images"))
+          end
+          format.json do
+            render json: @page_image.to_json
+          end
+        end
+      else
+        render action: :edit
+      end
+    end
+
+    def destroy
+      @page_image.destroy
+      respond_to do |format|
+        format.html do
+          flash[:notice] = "The image was deleted"
+          redirect_to(admin_page_path(@locale, @page, anchor: "images"))
+        end
+        format.json do
+          render json: @page_image.to_json
+        end
+      end
+    end
+
+    protected
+
+    def find_page
+      @page = Page.find(params[:page_id]).localize(@locale)
+    end
+
+    def find_page_image
+      @page_image = @page.page_images.find(params[:id]).localize(@locale)
+    end
+
+    def page_image_params
+      params.require(:page_image).permit(
+        :image, :primary,
+        image_attributes: [
+          :id, :alternative, :caption,
+          :crop_start_x, :crop_start_y, :crop_width, :crop_height
+        ]
+      )
+    end
+
+    def page_images_params
+      params.permit(
+        page_images: [:image, :primary, {
+          image_attributes: [:alternative, :caption]
+        }]
+      )[:page_images]
+    end
+
+    def page_images_params?
+      params[:page_images] ? true : false
+    end
+  end
+end

data/app/controllers/admin/pages_controller.rb

@@ -0,0 +1,179 @@
+# encoding: utf-8
+
+module Admin
+  class PagesController < Admin::AdminController
+    before_action :require_news_pages, only: [:news]
+    before_action :find_page, only: [
+      :show, :edit, :preview, :update, :destroy, :reorder,
+      :delete_meta_image
+    ]
+    before_action :find_categories
+    before_action :find_news_pages, only: [:news, :new_news]
+
+    require_authorization(
+      Page,
+      proc { @page },
+      collection: [:index, :news, :new, :new_news, :create, :reorder_pages]
+    )
+
+    def index
+      @root_pages = Page.roots.in_locale(@locale).visible
+    end
+
+    def news
+      @archive_finder = Page.where(parent_page_id: @news_pages)
+        .visible
+        .order("published_at DESC")
+        .in_locale(@locale)
+        .archive_finder
+
+      @year, @month = year_and_month(@archive_finder)
+      @year ||= Time.now.year
+      @month ||= Time.now.month
+
+      @pages = @archive_finder.by_year_and_month(@year, @month)
+    end
+
+    def reorder_pages
+      pages = params[:ids].map { |id| Page.find(id) }
+      PagesCore::CacheSweeper.once do
+        pages.each_with_index do |page, index|
+          page.update(position: (index + 1))
+        end
+      end
+      render text: "ok" if request.xhr?
+    end
+
+    def show
+      edit
+      render action: :edit
+    end
+
+    def new
+      @authors = User.activated
+      @page = build_page(@locale)
+      if params[:parent]
+        @page.parent = Page.find(params[:parent])
+      elsif @news_pages
+        @page.parent = @news_pages.first
+      end
+    end
+
+    # TODO: Should be refactored
+    def new_news
+      new
+      render action: :new
+    end
+
+    def create
+      @page = build_page(@locale)
+      if @page.update(page_params)
+        @page.update(
+          comments_allowed: @page.template_config.value(:comments_allowed)
+        )
+        @page.categories = param_categories
+        redirect_to edit_admin_page_url(@locale, @page)
+      else
+        render action: :new
+      end
+    end
+
+    def edit
+      @authors = User.activated
+      # Make sure the page author is included in the dropdown
+      # even if the account isn't active.
+      if @authors.any? && @page.author
+        @authors = [@page.author] + @authors.reject { |a| a == @page.author }
+      end
+      @new_image ||= Image.new
+    end
+
+    def update
+      if @page.update(page_params)
+        @page.categories = param_categories
+        flash[:notice] = "Your changes were saved"
+        flash[:save_performed] = true
+        redirect_to edit_admin_page_url(@locale, @page)
+      else
+        edit
+        render action: :edit
+      end
+    end
+
+    def destroy
+      @page = Page.find(params[:id])
+      @page.flag_as_deleted!
+      redirect_to admin_pages_url(@locale)
+    end
+
+    def delete_meta_image
+      @page.meta_image.destroy
+      flash[:notice] = "The image was deleted"
+      redirect_to edit_admin_page_url(@locale, @page, anchor: "metadata")
+    end
+
+    private
+
+    def build_page(locale)
+      Page.new.localize(locale).tap do |page|
+        page.author = default_author || current_user
+      end
+    end
+
+    def default_author
+      return unless PagesCore.config.default_author
+      User.where(email: PagesCore.config.default_author).first
+    end
+
+    def permitted_page_attributes
+      [
+        :template, :user_id, :status, :content_order,
+        :feed_enabled, :published_at, :redirect_to, :comments_allowed,
+        :image_link, :news_page, :unique_name, :pinned,
+        :parent_page_id, :serialized_tags, :meta_image
+      ]
+    end
+
+    def page_params
+      params.require(:page).permit(
+        Page.localized_attributes + permitted_page_attributes
+      )
+    end
+
+    def param_categories
+      if params[:category] && params[:category].length > 0
+        params[:category].map { |k, _| Category.find(k.to_i) }
+      else
+        []
+      end
+    end
+
+    def find_page
+      @page = Page.find(params[:id]).localize(@locale)
+    end
+
+    def find_categories
+      @categories = Category.order("name")
+    end
+
+    def find_news_pages
+      @news_pages = Page.news_pages.in_locale(@locale)
+      return if @news_pages.any?
+      redirect_to(admin_pages_url(@locale))
+    end
+
+    # Redirect away if no news pages has been configured
+    def require_news_pages
+      return if Page.news_pages.any?
+      redirect_to(admin_pages_url(@locale))
+    end
+
+    def year_and_month(archive_finder)
+      if params[:year] && params[:month]
+        [params[:year], params[:month]].map(&:to_i)
+      else
+        archive_finder.latest_year_and_month
+      end
+    end
+  end
+end

data/app/controllers/admin/password_resets_controller.rb

@@ -0,0 +1,83 @@
+# encoding: utf-8
+
+module Admin
+  class PasswordResetsController < Admin::AdminController
+    before_action :find_password_reset_token, only: [:show, :update]
+    before_action :check_for_expired_token, only: [:show, :update]
+    before_action :require_authentication, except: [:create, :show, :update]
+
+    layout "admin"
+
+    def create
+      if params[:username] &&
+          @user = User.find_by_username_or_email(params[:username])
+        @password_reset_token = @user.password_reset_tokens.create
+        deliver_password_reset(@user, @password_reset_token)
+        flash[:notice] = "An email with further instructions has been sent"
+      else
+        flash[:notice] = "Couldn't find a user with that email address"
+      end
+      redirect_to login_url
+    end
+
+    def show
+      @user = @password_reset_token.user
+    end
+
+    def update
+      @user = @password_reset_token.user
+      if !user_params[:password].blank? && @user.update(user_params)
+        @password_reset_token.destroy
+        authenticate!(@user)
+        flash[:notice] = "Your password has been changed"
+        redirect_to login_url
+      else
+        render action: :show
+      end
+    end
+
+    private
+
+    def deliver_password_reset(user, password_reset)
+      AdminMailer.password_reset(
+        user,
+        admin_password_reset_with_token_url(
+          password_reset, password_reset.token
+        )
+      ).deliver_now
+    end
+
+    def login_url
+      # TODO: Validate URL
+      params[:login_url] || login_admin_users_url
+    end
+
+    def user_params
+      params.require(:user).permit(:password, :confirm_password)
+    end
+
+    def valid_token?(pr)
+      pr && secure_compare(pr.token, params[:token])
+    end
+
+    def find_password_reset_token
+      @password_reset_token = begin
+                                PasswordResetToken.find(params[:id])
+                              rescue ActiveRecord::RecordNotFound
+                                nil
+                              end
+
+      return if valid_token?(@password_reset_token)
+
+      flash[:notice] = "Invalid password reset request"
+      redirect_to(login_url) && return
+    end
+
+    def check_for_expired_token
+      return unless @password_reset_token.expired?
+      @password_reset_token.destroy
+      flash[:notice] = "Your password reset link has expired"
+      redirect_to(login_url)
+    end
+  end
+end

data/app/controllers/admin/users_controller.rb

@@ -0,0 +1,102 @@
+# encoding: utf-8
+
+module Admin
+  class UsersController < Admin::AdminController
+    before_action :require_authentication, except: [:new, :create, :login]
+    before_action :require_no_users, only: [:new, :create]
+    before_action(
+      :find_user,
+      only: [:edit, :update, :show, :destroy, :delete_image]
+    )
+
+    require_authorization(
+      User,
+      proc { @user },
+      member:     [:delete_image, :update, :destroy, :edit],
+      collection: [:index, :deactivated, :new, :create]
+    )
+
+    def index
+      @users = User.activated
+      @invites = Invite.all.order("created_at DESC")
+    end
+
+    def deactivated
+      @users = User.deactivated
+      @invites = []
+    end
+
+    def login
+      return unless logged_in?
+      redirect_to admin_default_url
+    end
+
+    def new
+      @user = User.new
+    end
+
+    def create
+      @user = User.create(user_params)
+      if @user.valid?
+        authenticate!(@user)
+        redirect_to admin_default_url
+      else
+        render action: :new
+      end
+    end
+
+    def show
+    end
+
+    def edit
+    end
+
+    def update
+      if @user.update(user_params)
+        flash[:notice] = "Your changed to #{@user.name} were saved."
+        redirect_to admin_users_url
+      else
+        flash.now[:error] = "There were problems saving your changes."
+        render action: :edit
+      end
+    end
+
+    def destroy
+      @user = User.find(params[:id])
+      flash[:notice] = "User <strong>#{@user.email}</strong> has been deleted"
+      @user.destroy
+      redirect_to admin_users_url
+    end
+
+    def delete_image
+      @user.image.destroy
+      respond_to do |format|
+        format.js   { render text: "The profile picture has been deleted." }
+        format.html { redirect_to(edit_admin_user_url(@user)) }
+      end
+    end
+
+    protected
+
+    def find_user
+      @user = User.find(params[:id])
+    end
+
+    def user_params
+      permitted_params = [
+        :name, :email, :image
+      ]
+      permitted_params += [:activated, role_names: []] if policy(User).manage?
+      if !User.any? || (@user && policy(@user).change_password?)
+        permitted_params += [:password, :confirm_password]
+      end
+      params.require(:user).permit(permitted_params)
+    end
+
+    def require_no_users
+      return unless User.any?
+      flash[:error] = "Account holder already exists"
+      redirect_to(admin_users_url)
+    end
+  end
+end