pages_core 3.4.2

data/app/controllers/concerns/pages_core/authentication.rb

@@ -0,0 +1,48 @@
+# encoding: utf-8
+
+module PagesCore
+  module Authentication
+    extend ActiveSupport::Concern
+
+    included do
+      before_action :start_authenticated_session
+      after_action :finalize_authenticated_session
+      helper_method :current_user, :logged_in?
+    end
+
+    # Returns the current user if logged in, or nil.
+    attr_reader :current_user
+
+    # Returns true if the user is logged in.
+    def logged_in?
+      current_user ? true : false
+    end
+
+    def authenticate!(user)
+      user.mark_active!
+      @current_user = user
+    end
+
+    def deauthenticate!
+      @current_user  = nil
+      session[:current_user_id] = nil
+    end
+
+    protected
+
+    def start_authenticated_session
+      if session[:current_user_id]
+        user = User.where(id: session[:current_user_id]).first
+      end
+
+      return unless user && user.can_login?
+
+      authenticate!(user)
+    end
+
+    def finalize_authenticated_session
+      return unless current_user
+      session[:current_user_id] = current_user.id
+    end
+  end
+end

data/app/controllers/concerns/pages_core/domain_based_cache.rb

@@ -0,0 +1,28 @@
+# encoding: utf-8
+
+module PagesCore
+  module DomainBasedCache
+    extend ActiveSupport::Concern
+
+    included do
+      before_action :set_domain_based_cache_path
+    end
+
+    module ClassMethods
+      def default_page_cache_directory
+        @default_page_cache_directory ||=
+          ActionController::Base.page_cache_directory
+      end
+    end
+
+    protected
+
+    def set_domain_based_cache_path
+      return unless PagesCore.config(:domain_based_cache)
+      ActionController::Base.page_cache_directory = File.join(
+        ApplicationController.default_page_cache_directory,
+        request.domain
+      )
+    end
+  end
+end

data/app/controllers/concerns/pages_core/exception_handler.rb

@@ -0,0 +1,114 @@
+# encoding: utf-8
+
+module PagesCore
+  module ExceptionHandler
+    extend ActiveSupport::Concern
+
+    included do
+      unless Rails.application.config.consider_all_requests_local
+        rescue_from Exception,                           with: :handle_exception
+        rescue_from PagesCore::NotAuthorized,            with: :handle_exception
+        rescue_from ActiveRecord::RecordNotFound,        with: :handle_exception
+        rescue_from ActionController::RoutingError,      with: :handle_exception
+        rescue_from ActionController::UnknownController, with: :handle_exception
+        rescue_from AbstractController::ActionNotFound,  with: :handle_exception
+      end
+    end
+
+    # Renders a fancy error page from app/views/errors. If the error name
+    # is numeric, it will also be set as the response status. Example:
+    #
+    #   render_error 404
+    #
+    def render_error(error, options = {})
+      options[:status] ||= error if error.is_a? Numeric
+      options[:template] ||= "errors/#{error}"
+      options[:layout] ||= "errors"
+      @email = logged_in? ? current_user.email : ""
+      render options
+    end
+
+    protected
+
+    def log_error(exception)
+      trace = exception.backtrace
+      ActiveSupport::Deprecation.silence do
+        message = "\n#{exception.class} (#{exception.message}):\n"
+        if exception.respond_to?(:annoted_source_code)
+          message << exception.annoted_source_code.to_s
+        end
+        message << "  " << trace.join("\n  ")
+        logger.fatal("#{message}\n\n")
+      end
+    end
+
+    def env_as_object
+      request.env.each_with_object({}) do |hash, value|
+        if value.first.is_a?(String) && value.last.is_a?(String)
+          hash[value.first] = value.last
+        end
+      end
+    end
+
+    def filtered_backtrace(exception)
+      Rails.backtrace_cleaner.send(:filter, exception.backtrace)
+    end
+
+    def exception_url
+      [
+        "http://",
+        request.env["HTTP_HOST"],
+        request.env["REQUEST_URI"]
+      ].compact.join
+    end
+
+    def error_report(exception)
+      {
+        message: exception.to_s,
+        url: exception_url,
+        params: params,
+        env: env_as_object,
+        session: session.to_hash,
+        backtrace: filtered_backtrace(exception),
+        timestamp: Time.now,
+        user_id: logged_in? ? current_user.id : nil
+      }
+    end
+
+    def write_error(str)
+      sha1_hash = Digest::SHA1.hexdigest(str)
+      error_report_dir  = Rails.root.join("log", "error_reports")
+      error_report_file = error_report_dir.join("#{sha1_hash}.yml")
+      `mkdir -p #{error_report_dir}` unless File.exist?(error_report_dir)
+
+      unless File.exist?(error_report_file)
+        File.open(error_report_file, "w") do |fh|
+          fh.write str
+        end
+      end
+      sha1_hash
+    end
+
+    def handle_exception(exception)
+      log_error exception
+      if exception.is_a?(ActionController::RoutingError) ||
+          exception.is_a?(ActiveRecord::RecordNotFound)
+        render_error 404
+      elsif exception.is_a?(PagesCore::NotAuthorized)
+        render_error 403
+      else
+        session[:error_report] = @error_id = write_error(
+          error_report(exception).to_yaml
+        )
+        logger.error "Logged error #{@error_id}"
+
+        render_error 500
+      end
+    rescue => error
+      logger.fatal "Error in handle_exception"
+      log_error(error)
+      render(template: "errors/500_critical", status: 500, layout: false)
+      return
+    end
+  end
+end

data/app/controllers/concerns/pages_core/policies_helper.rb

@@ -0,0 +1,40 @@
+module PagesCore
+  module PoliciesHelper
+    extend ActiveSupport::Concern
+
+    included do
+      helper_method :policy
+    end
+
+    module ClassMethods
+      def require_authorization(collection, member, options = {})
+        options = {
+          collection: [:index, :new, :create],
+          member:     [:show, :edit, :update, :destroy]
+        }.merge(options)
+        before_action do |controller|
+          action = params[:action].to_sym
+          if options[:collection].include?(action)
+            verify_policy_with_proc(controller, collection)
+          elsif options[:member].include?(action)
+            verify_policy_with_proc(controller, member)
+          end
+        end
+      end
+    end
+
+    def policy(object)
+      Policy.for(current_user, object)
+    end
+
+    def verify_policy_with_proc(controller, record)
+      record = controller.instance_eval(&record) if record.is_a?(Proc)
+      verify_policy(record)
+    end
+
+    def verify_policy(record)
+      return true if policy(record).public_send(params[:action] + "?")
+      fail PagesCore::NotAuthorized
+    end
+  end
+end

data/app/controllers/concerns/pages_core/process_titler.rb

@@ -0,0 +1,44 @@
+# encoding: utf-8
+
+module PagesCore
+  module ProcessTitler
+    extend ActiveSupport::Concern
+
+    included do
+      before_action :set_process_title
+      after_action :unset_process_title
+    end
+
+    class << self
+      attr_accessor :number_of_requests
+
+      def original_title
+        @original_title ||= $PROGRAM_NAME
+      end
+
+      def inc_number_of_requests
+        @number_of_requests ||= 0
+        @number_of_requests += 1
+        yield @number_of_requests
+      end
+
+      def number_of_requests
+        @number_of_requests ||= 0
+      end
+    end
+
+    protected
+
+    def set_process_title
+      PagesCore::ProcessTitler.inc_number_of_requests do |i|
+        $0 = PagesCore::ProcessTitler.original_title +
+          ": Handling #{request.path} (#{i} reqs)"
+      end
+    end
+
+    def unset_process_title
+      $0 = PagesCore::ProcessTitler.original_title +
+        ": Idle (#{PagesCore::ProcessTitler.number_of_requests} reqs)"
+    end
+  end
+end

data/app/controllers/errors_controller.rb

@@ -0,0 +1,45 @@
+# encoding: utf-8
+
+class ErrorsController < ApplicationController
+  layout "errors"
+
+  skip_before_action :verify_authenticity_token
+
+  def report
+    return unless session[:error_report]
+    deliver_error_report(
+      find_error_report,
+      params[:email],
+      params[:description]
+    )
+    @error_id = session[:error_report]
+  end
+
+  def show
+    render_error params[:id].to_i
+  end
+
+  private
+
+  def deliver_error_report(report, from, description)
+    AdminMailer.error_report(report, from, description).deliver_now
+  end
+
+  def find_error_report
+    report = YAML.load_file(error_report_path)
+    if report[:user_id]
+      report[:user] = begin
+                        User.find(report[:user_id])
+                      rescue
+                        nil
+                      end
+    end
+    report
+  end
+
+  def error_report_path
+    Rails.root
+      .join("log", "error_reports")
+      .join("#{session[:error_report]}.yml")
+  end
+end

data/app/controllers/pages_core/admin_controller.rb

@@ -0,0 +1,109 @@
+# encoding: utf-8
+
+# All admin controllers inherit Admin::AdminController, which provides layout,
+# authorization and other common code for the Admin set of controllers.
+module PagesCore
+  class AdminController < ApplicationController
+    before_action :set_i18n_locale
+    before_action :require_authentication
+    before_action :restore_persistent_params
+    after_action :save_persistent_params
+
+    layout "admin"
+
+    def redirect
+      if Page.news_pages.any?
+        redirect_to news_admin_pages_url(@locale)
+      else
+        redirect_to admin_pages_url(@locale)
+      end
+    end
+
+    protected
+
+    def set_i18n_locale
+      I18n.locale = :en
+    end
+
+    # Verifies the login. Redirects to users/new if the users table is empty.
+    # If not, renders the login screen.
+    def require_authentication
+      return if logged_in?
+      if User.count < 1
+        redirect_to(new_admin_user_url) && return
+      else
+        redirect_to(login_admin_users_url) && return
+      end
+    end
+
+    # Loads persistent params from user model and merges with session.
+    def restore_persistent_params
+      return unless current_user && current_user.persistent_data?
+      session[:persistent_params] ||= {}
+      session[:persistent_params] = current_user.persistent_data.merge(
+        session[:persistent_params]
+      )
+    end
+
+    # Saves persistent params from session to User model if applicable.
+    def save_persistent_params
+      return unless current_user && session[:persistent_params]
+      current_user.persistent_data = session[:persistent_params]
+      current_user.save
+    end
+
+    def secure_compare(a, b)
+      return false unless a && b
+      return false unless a.bytesize == b.bytesize
+
+      l = a.unpack "C#{a.bytesize}"
+
+      res = 0
+      b.each_byte { |byte| res |= byte ^ l.shift }
+      res == 0
+    end
+
+    # --- HELPERS ---
+
+    # Get name of class with in lowercase, with underscores.
+    def self.underscore
+      ActiveSupport::Inflector.underscore(to_s).split(/\//).last
+    end
+
+    # Add a stylesheet
+    def add_stylesheet(css_file)
+      @admin_stylesheets ||= []
+      @admin_stylesheets << "admin/#{css_file}"
+    end
+
+    def persistent_params(namespace)
+      session[:persistent_params] ||= {}
+      session[:persistent_params][namespace] ||= {}
+      session[:persistent_params][namespace]
+    end
+
+    def coerce_persistent_param(v)
+      case v
+      when "true"
+        true
+      when "false"
+        false
+      else
+        v
+      end
+    end
+
+    # Get a persistent param
+    def persistent_param(key, default = nil, options = {})
+      namespace = options[:namespace] || self.class.to_s
+
+      value = coerce_persistent_param(params.key?(key) ? params[key] : default)
+
+      if !value.nil? || options[:preserve_nil]
+        persistent_params(namespace)[key] = value
+      end
+
+      value
+    end
+  end
+end

data/app/controllers/pages_core/application_controller.rb

@@ -0,0 +1,31 @@
+# encoding: utf-8
+
+module PagesCore
+  class ApplicationController < ActionController::Base
+    include PagesCore::Authentication
+    include PagesCore::DomainBasedCache
+    include PagesCore::ExceptionHandler
+    include PagesCore::ProcessTitler
+    include PagesCore::PoliciesHelper
+
+    before_action :set_locale
+    after_action :set_content_language_header
+
+    protected
+
+    # Sets @locale from params[:locale], with I18n.default_locale as fallback
+    def set_locale
+      legacy_locales = {
+        "nor" => "nb",
+        "eng" => "en"
+      }
+      @locale = params[:locale] || I18n.default_locale.to_s
+      @locale = legacy_locales[@locale] if legacy_locales[@locale]
+    end
+
+    def set_content_language_header
+      return unless locale
+      headers["Content-Language"] = locale.to_s
+    end
+  end
+end

data/app/controllers/pages_core/frontend/page_files_controller.rb

@@ -0,0 +1,42 @@
+# encoding: utf-8
+
+module PagesCore
+  module Frontend
+    class PageFilesController < ::FrontendController
+      before_action :find_page_file, only: [:show, :edit, :update, :destroy]
+
+      def show
+        if !modified?(@page_file)
+          render(text: "304 Not Modified", status: 304) && return
+        end
+
+        if @page_file.updated_at?
+          response.headers["Last-Modified"] = @page_file.updated_at.httpdate
+        end
+
+        send_data(
+          @page_file.data,
+          filename:    @page_file.filename,
+          type:        @page_file.content_type,
+          disposition: "attachment"
+        )
+      end
+
+      private
+
+      def modified?(page_file)
+        return true unless if_modified_since && page_file.updated_at?
+        page_file.updated_at > if_modified_since
+      end
+
+      def if_modified_since
+        return nil if request.env["HTTP_IF_MODIFIED_SINCE"].blank?
+        Time.rfc2822(request.env["HTTP_IF_MODIFIED_SINCE"])
+      end
+
+      def find_page_file
+        @page_file = PageFile.find(params[:id])
+      end
+    end
+  end
+end