pages_core 3.4.3 → 3.5.1

data/app/controllers/admin/pages_controller.rb

@@ -2,55 +2,26 @@
 
 module Admin
   class PagesController < Admin::AdminController
-    before_action :require_news_pages, only: [:news]
-    before_action :find_page, only: [
-      :show, :edit, :preview, :update, :destroy, :reorder,
-      :delete_meta_image
-    ]
+    include PagesCore::Admin::NewsPageController
+
+    before_action :find_page, only: [:show, :edit, :preview, :update, :destroy,
+                                     :delete_meta_image, :move]
     before_action :find_categories
-    before_action :find_news_pages, only: [:news, :new_news]
 
-    require_authorization(
-      Page,
-      proc { @page },
-      collection: [:index, :news, :new, :new_news, :create, :reorder_pages]
-    )
+    require_authorization(Page, proc { @page },
+                          collection: [:index, :news, :new, :new_news, :create],
+                          member: [:show, :edit, :preview, :update, :destroy,
+                                   :delete_meta_image, :move])
 
     def index
       @root_pages = Page.roots.in_locale(@locale).visible
     end
 
-    def news
-      @archive_finder = Page.where(parent_page_id: @news_pages)
-        .visible
-        .order("published_at DESC")
-        .in_locale(@locale)
-        .archive_finder
-
-      @year, @month = year_and_month(@archive_finder)
-      @year ||= Time.now.year
-      @month ||= Time.now.month
-
-      @pages = @archive_finder.by_year_and_month(@year, @month)
-    end
-
-    def reorder_pages
-      pages = params[:ids].map { |id| Page.find(id) }
-      PagesCore::CacheSweeper.once do
-        pages.each_with_index do |page, index|
-          page.update(position: (index + 1))
-        end
-      end
-      render text: "ok" if request.xhr?
-    end
-
     def show
-      edit
-      render action: :edit
+      redirect_to edit_admin_page_url(@locale, @page)
     end
 
     def new
-      @authors = User.activated
       @page = build_page(@locale)
       if params[:parent]
         @page.parent = Page.find(params[:parent])
@@ -59,50 +30,42 @@ module Admin
       end
     end
 
-    # TODO: Should be refactored
-    def new_news
-      new
-      render action: :new
-    end
-
     def create
-      @page = build_page(@locale)
-      if @page.update(page_params)
-        @page.update(
-          comments_allowed: @page.template_config.value(:comments_allowed)
-        )
-        @page.categories = param_categories
-        redirect_to edit_admin_page_url(@locale, @page)
+      @page = build_page(@locale, page_params, param_categories)
+      if @page.valid?
+        @page.save
+        respond_with_page(@page) do
+          redirect_to(edit_admin_page_url(@locale, @page))
+        end
       else
         render action: :new
       end
     end
 
     def edit
-      @authors = User.activated
-      # Make sure the page author is included in the dropdown
-      # even if the account isn't active.
-      if @authors.any? && @page.author
-        @authors = [@page.author] + @authors.reject { |a| a == @page.author }
-      end
-      @new_image ||= Image.new
+      render action: :edit
     end
 
     def update
       if @page.update(page_params)
         @page.categories = param_categories
-        flash[:notice] = "Your changes were saved"
-        flash[:save_performed] = true
-        redirect_to edit_admin_page_url(@locale, @page)
+        respond_with_page(@page) do
+          flash[:notice] = "Your changes were saved"
+          redirect_to edit_admin_page_url(@locale, @page)
+        end
       else
         edit
-        render action: :edit
       end
     end
 
+    def move
+      parent = params[:parent_id] ? Page.find(params[:parent_id]) : nil
+      @page.update(parent: parent, position: params[:position])
+      respond_with_page(@page) { redirect_to admin_pages_url(@locale) }
+    end
+
     def destroy
-      @page = Page.find(params[:id])
-      @page.flag_as_deleted!
+      Page.find(params[:id]).flag_as_deleted!
       redirect_to admin_pages_url(@locale)
     end
 
@@ -114,9 +77,14 @@ module Admin
 
     private
 
-    def build_page(locale)
+    def build_page(locale, attributes = nil, categories = nil)
       Page.new.localize(locale).tap do |page|
         page.author = default_author || current_user
+        if attributes
+          page.attributes = attributes
+          page.comments_allowed = page.template_config.value(:comments_allowed)
+        end
+        page.categories = categories if categories
       end
     end
 
@@ -125,27 +93,19 @@ module Admin
       User.where(email: PagesCore.config.default_author).first
     end
 
-    def permitted_page_attributes
-      [
-        :template, :user_id, :status, :content_order,
-        :feed_enabled, :published_at, :redirect_to, :comments_allowed,
-        :image_link, :news_page, :unique_name, :pinned,
-        :parent_page_id, :serialized_tags, :meta_image
-      ]
+    def page_attributes
+      [:template, :user_id, :status, :feed_enabled, :published_at,
+       :redirect_to, :comments_allowed, :image_link, :news_page,
+       :unique_name, :pinned, :parent_page_id, :serialized_tags, :meta_image]
     end
 
     def page_params
-      params.require(:page).permit(
-        Page.localized_attributes + permitted_page_attributes
-      )
+      params.require(:page).permit(Page.localized_attributes + page_attributes)
     end
 
     def param_categories
-      if params[:category] && params[:category].length > 0
-        params[:category].map { |k, _| Category.find(k.to_i) }
-      else
-        []
-      end
+      return [] unless params[:category] && params[:category].any?
+      params[:category].map { |k, _| Category.find(k.to_i) }
     end
 
     def find_page
@@ -156,23 +116,10 @@ module Admin
       @categories = Category.order("name")
     end
 
-    def find_news_pages
-      @news_pages = Page.news_pages.in_locale(@locale)
-      return if @news_pages.any?
-      redirect_to(admin_pages_url(@locale))
-    end
-
-    # Redirect away if no news pages has been configured
-    def require_news_pages
-      return if Page.news_pages.any?
-      redirect_to(admin_pages_url(@locale))
-    end
-
-    def year_and_month(archive_finder)
-      if params[:year] && params[:month]
-        [params[:year], params[:month]].map(&:to_i)
-      else
-        archive_finder.latest_year_and_month
+    def respond_with_page(page)
+      respond_to do |format|
+        format.html { yield }
+        format.json { render json: page, serializer: PageTreeSerializer }
       end
     end
   end

data/app/controllers/admin/password_resets_controller.rb

@@ -9,8 +9,8 @@ module Admin
     layout "admin"
 
     def create
-      if params[:username] &&
-          @user = User.find_by_username_or_email(params[:username])
+      @user = find_user_by_email(params[:username])
+      if @user
         @password_reset_token = @user.password_reset_tokens.create
         deliver_password_reset(@user, @password_reset_token)
         flash[:notice] = "An email with further instructions has been sent"
@@ -47,6 +47,11 @@ module Admin
       ).deliver_now
     end
 
+    def find_user_by_email(email)
+      return unless email
+      User.find_by_username_or_email(params[:username])
+    end
+
     def login_url
       # TODO: Validate URL
       params[:login_url] || login_admin_users_url

data/app/controllers/concerns/pages_core/add_comments_controller.rb

@@ -0,0 +1,67 @@
+# encoding: utf-8
+
+module PagesCore
+  module AddCommentsController
+    extend ActiveSupport::Concern
+
+    # Add a comment to a page. Recaptcha is performed if
+    # PagesCore.config(:recaptcha) is set.
+    def add_comment
+      @comment = new_comment(@page)
+
+      unless captcha_verified?
+        @comment.invalid_captcha = true
+        render_page
+        return
+      end
+
+      return unless @page.comments_allowed? && !honeypot_triggered?
+
+      @comment.save
+      deliver_comment_notifications(@page, @comment)
+      redirect_to(page_url(@locale, @page))
+    end
+
+    private
+
+    def captcha_verified?
+      !PagesCore.config(:recaptcha) || verify_recaptcha
+    end
+
+    def comment_recipients(page)
+      PagesCore.config(:comment_notifications)
+               .map { |r| r == :author ? page.author.name_and_email : r }
+               .uniq
+    end
+
+    def deliver_comment_notifications(page, comment)
+      return unless PagesCore.config(:comment_notifications)
+      comment_recipients(page).each do |r|
+        AdminMailer.comment_notification(
+          r,
+          page,
+          comment,
+          page_url(locale, page)
+        ).deliver_now
+      end
+    end
+
+    def honeypot_triggered?
+      PagesCore.config(:comment_honeypot) && !params[:email].to_s.empty?
+    end
+
+    def new_comment(page)
+      PageComment.new(
+        page_comment_params.merge(remote_ip: remote_ip, page_id: page.id)
+      )
+    end
+
+    def page_comment_params
+      params.require(:page_comment).permit(:name, :email, :url, :body)
+    end
+
+    def remote_ip
+      request.env["REMOTE_ADDR"]
+    end
+  end
+end

data/app/controllers/concerns/pages_core/admin/news_page_controller.rb

@@ -0,0 +1,58 @@
+# encoding: utf-8
+
+module PagesCore
+  module Admin
+    module NewsPageController
+      extend ActiveSupport::Concern
+
+      included do
+        before_action :require_news_pages, only: [:news]
+        before_action :find_news_pages, only: [:news, :new_news]
+      end
+
+      def news
+        @archive_finder = archive_finder(@news_pages, @locale)
+        @year, @month = year_and_month(@archive_finder)
+        @year ||= Time.zone.now.year
+        @month ||= Time.zone.now.month
+
+        @pages = @archive_finder.by_year_and_month(@year, @month)
+      end
+
+      def new_news
+        new
+        render action: :new
+      end
+
+      private
+
+      def archive_finder(parents, locale)
+        Page.where(parent_page_id: parents)
+            .visible
+            .order("published_at DESC")
+            .in_locale(locale)
+            .archive_finder
+      end
+
+      def find_news_pages
+        @news_pages = Page.news_pages.in_locale(@locale)
+        return if @news_pages.any?
+        redirect_to(admin_pages_url(@locale))
+      end
+
+      # Redirect away if no news pages has been configured
+      def require_news_pages
+        return if Page.news_pages.any?
+        redirect_to(admin_pages_url(@locale))
+      end
+
+      def year_and_month(archive_finder)
+        if params[:year] && params[:month]
+          [params[:year], params[:month]].map(&:to_i)
+        else
+          archive_finder.latest_year_and_month
+        end
+      end
+    end
+  end
+end

data/app/controllers/concerns/pages_core/authentication.rb

@@ -24,7 +24,7 @@ module PagesCore
     end
 
     def deauthenticate!
-      @current_user  = nil
+      @current_user = nil
       session[:current_user_id] = nil
     end
 

data/app/controllers/concerns/pages_core/exception_handler.rb

@@ -2,10 +2,10 @@
 
 module PagesCore
   module ExceptionHandler
-    extend ActiveSupport::Concern
+    module Rescues
+      extend ActiveSupport::Concern
 
-    included do
-      unless Rails.application.config.consider_all_requests_local
+      included do
         rescue_from Exception,                           with: :handle_exception
         rescue_from PagesCore::NotAuthorized,            with: :handle_exception
         rescue_from ActiveRecord::RecordNotFound,        with: :handle_exception
@@ -15,6 +15,14 @@ module PagesCore
       end
     end
 
+    extend ActiveSupport::Concern
+
+    included do
+      unless Rails.application.config.consider_all_requests_local
+        include PagesCore::ExceptionHandler::Rescues
+      end
+    end
+
     # Renders a fancy error page from app/views/errors. If the error name
     # is numeric, it will also be set as the response status. Example:
     #
@@ -23,13 +31,22 @@ module PagesCore
     def render_error(error, options = {})
       options[:status] ||= error if error.is_a? Numeric
       options[:template] ||= "errors/#{error}"
-      options[:layout] ||= "errors"
+      options[:layout] = error_layout(error) unless options.key?(:layout)
       @email = logged_in? ? current_user.email : ""
       render options
+      true
     end
 
     protected
 
+    def error_layout(error)
+      if error == 404 && PagesCore.config.error_404_layout?
+        PagesCore.config.error_404_layout
+      else
+        "errors"
+      end
+    end
+
     def log_error(exception)
       trace = exception.backtrace
       ActiveSupport::Deprecation.silence do
@@ -56,9 +73,7 @@ module PagesCore
 
     def exception_url
       [
-        "http://",
-        request.env["HTTP_HOST"],
-        request.env["REQUEST_URI"]
+        "http://", request.env["HTTP_HOST"], request.env["REQUEST_URI"]
       ].compact.join
     end
 
@@ -70,7 +85,7 @@ module PagesCore
         env: env_as_object,
         session: session.to_hash,
         backtrace: filtered_backtrace(exception),
-        timestamp: Time.now,
+        timestamp: Time.now.utc,
         user_id: logged_in? ? current_user.id : nil
       }
     end
@@ -89,26 +104,34 @@ module PagesCore
       sha1_hash
     end
 
+    def handle_critical_exception(exception)
+      logger.fatal "Error in handle_exception"
+      log_error(exception)
+      render(template: "errors/500_critical", status: 500, layout: false)
+    end
+
     def handle_exception(exception)
-      log_error exception
+      log_error(exception)
+      return if handle_40x(exception)
+      @error_id = write_error(error_report(exception).to_yaml)
+      session[:error_report] = @error_id
+      logger.error "Logged error #{@error_id}"
+      render_error 500
+    rescue => error
+      handle_critical_exception(error)
+    end
+
+    private
+
+    def handle_40x(exception)
       if exception.is_a?(ActionController::RoutingError) ||
-          exception.is_a?(ActiveRecord::RecordNotFound)
+         exception.is_a?(ActiveRecord::RecordNotFound)
         render_error 404
       elsif exception.is_a?(PagesCore::NotAuthorized)
         render_error 403
       else
-        session[:error_report] = @error_id = write_error(
-          error_report(exception).to_yaml
-        )
-        logger.error "Logged error #{@error_id}"
-
-        render_error 500
+        false
       end
-    rescue => error
-      logger.fatal "Error in handle_exception"
-      log_error(error)
-      render(template: "errors/500_critical", status: 500, layout: false)
-      return
     end
   end
 end