pages_core 3.4.3 → 3.7.0

data/app/controllers/concerns/pages_core/preview_pages_controller.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+module PagesCore
+  module PreviewPagesController
+    extend ActiveSupport::Concern
+
+    included do
+      before_action :disable_xss_protection, only: [:preview]
+    end
+
+    def preview
+      redirect_to(page_url(@locale, @page)) && return unless logged_in?
+
+      @page.attributes = page_params.merge(
+        status: 2,
+        published_at: Time.zone.now,
+        locale: @locale,
+        redirect_to: nil
+      )
+      render_page
+    end
+
+    private
+
+    def disable_xss_protection
+      # Disabling this is probably not a good idea,
+      # but the header causes Chrome to choke when being
+      # redirected back after a submit and the page contains an iframe.
+      response.headers["X-XSS-Protection"] = "0"
+    end
+
+    def permitted_page_attributes
+      %i[template user_id status feed_enabled published_at
+         redirect_to image_link news_page
+         unique_name pinned parent_page_id]
+    end
+
+    def page_params
+      params.require(:page).permit(
+        Page.localized_attributes + permitted_page_attributes
+      )
+    end
+  end
+end

data/app/controllers/concerns/pages_core/process_titler.rb

@@ -1,4 +1,4 @@
-# encoding: utf-8
+# frozen_string_literal: true
 
 module PagesCore
   module ProcessTitler
@@ -10,7 +10,7 @@ module PagesCore
     end
 
     class << self
-      attr_accessor :number_of_requests
+      attr_writer :number_of_requests
 
       def original_title
         @original_title ||= $PROGRAM_NAME
@@ -32,13 +32,13 @@ module PagesCore
     def set_process_title
       PagesCore::ProcessTitler.inc_number_of_requests do |i|
         $0 = PagesCore::ProcessTitler.original_title +
-          ": Handling #{request.path} (#{i} reqs)"
+             ": Handling #{request.path} (#{i} reqs)"
       end
     end
 
     def unset_process_title
       $0 = PagesCore::ProcessTitler.original_title +
-        ": Idle (#{PagesCore::ProcessTitler.number_of_requests} reqs)"
+           ": Idle (#{PagesCore::ProcessTitler.number_of_requests} reqs)"
     end
   end
 end

data/app/controllers/concerns/pages_core/rss_controller.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+module PagesCore
+  module RssController
+    extend ActiveSupport::Concern
+
+    private
+
+    def all_feed_items
+      feeds = Page.enabled_feeds(locale, include_hidden: true)
+      Page.where(parent_page_id: feeds)
+          .order("published_at DESC")
+          .published
+          .limit(20)
+          .localized(locale)
+    end
+
+    def render_rss(items, title: nil)
+      @title = PagesCore.config.site_name
+      @title += ": #{title}" if title
+      @items = items
+      render template: "feeds/pages", layout: false
+    end
+  end
+end

data/app/controllers/concerns/pages_core/static_cache_controller.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+module PagesCore
+  module StaticCacheController
+    extend ActiveSupport::Concern
+
+    module ClassMethods
+      def static_cache(*actions, permanent: false)
+        return unless perform_caching
+
+        if permanent
+          after_action :cache_static_page_permanently, only: actions
+        else
+          after_action :cache_static_page, only: actions
+        end
+      end
+
+      alias caches_page static_cache
+    end
+
+    def disable_static_cache!
+      @static_cache_disabled = true
+    end
+
+    private
+
+    def cache_static_page
+      return unless static_cache_allowed?
+
+      PagesCore::StaticCache.handler.cache_page(
+        self, request, response
+      )
+    end
+
+    def cache_static_page_permanently
+      return unless static_cache_allowed?
+
+      PagesCore::StaticCache.handler.cache_page_permanently(
+        self, request, response
+      )
+    end
+
+    def static_cache_allowed?
+      (request.get? || request.head?) && response.status == 200 &&
+        perform_caching && !@static_cache_disabled
+    end
+  end
+end

data/app/controllers/errors_controller.rb

@@ -1,45 +1,35 @@
-# encoding: utf-8
+# frozen_string_literal: true
 
 class ErrorsController < ::ApplicationController
   layout "errors"
 
-  skip_before_action :verify_authenticity_token
-
-  def report
-    return unless session[:error_report]
-    deliver_error_report(
-      find_error_report,
-      params[:email],
-      params[:description]
-    )
-    @error_id = session[:error_report]
-  end
-
   def show
     render_error params[:id].to_i
   end
 
-  private
+  def forbidden
+    render_error 403
+  end
+
+  def not_found
+    render_error 404
+  end
 
-  def deliver_error_report(report, from, description)
-    AdminMailer.error_report(report, from, description).deliver_now
+  def unacceptable
+    render_error 422
   end
 
-  def find_error_report
-    report = YAML.load_file(error_report_path)
-    if report[:user_id]
-      report[:user] = begin
-                        User.find(report[:user_id])
-                      rescue
-                        nil
-                      end
-    end
-    report
+  def unauthorized
+    render_error 401
   end
 
-  def error_report_path
-    Rails.root
-      .join("log", "error_reports")
-      .join("#{session[:error_report]}.yml")
+  def internal_error
+    exception = request.env["action_dispatch.exception"]
+    if exception
+      wrapper = ActionDispatch::ExceptionWrapper.new(nil, exception)
+      render_error wrapper.status_code
+    else
+      render_error 500
+    end
   end
 end

data/app/controllers/pages_core/admin_controller.rb

@@ -1,16 +1,25 @@
-# encoding: utf-8
+# frozen_string_literal: true
 
 # All admin controllers inherit Admin::AdminController, which provides layout,
 # authorization and other common code for the Admin set of controllers.
 module PagesCore
   class AdminController < ::ApplicationController
+    include PagesCore::Admin::PersistentParams
+
+    protect_from_forgery with: :exception
+
     before_action :set_i18n_locale
     before_action :require_authentication
-    before_action :restore_persistent_params
-    after_action :save_persistent_params
 
     layout "admin"
 
+    class << self
+      # Get name of class with in lowercase, with underscores.
+      def underscore
+        ActiveSupport::Inflector.underscore(to_s).split("/").last
+      end
+    end
+
     def redirect
       if Page.news_pages.any?
         redirect_to news_admin_pages_url(@locale)
@@ -29,81 +38,23 @@ module PagesCore
     # If not, renders the login screen.
     def require_authentication
       return if logged_in?
+
       if User.count < 1
-        redirect_to(new_admin_user_url) && return
+        redirect_to(new_admin_user_url)
       else
-        redirect_to(login_admin_users_url) && return
+        redirect_to(login_admin_users_url)
       end
     end
 
-    # Loads persistent params from user model and merges with session.
-    def restore_persistent_params
-      return unless current_user && current_user.persistent_data?
-      session[:persistent_params] ||= {}
-      session[:persistent_params] = current_user.persistent_data.merge(
-        session[:persistent_params]
-      )
-    end
-
-    # Saves persistent params from session to User model if applicable.
-    def save_persistent_params
-      return unless current_user && session[:persistent_params]
-      current_user.persistent_data = session[:persistent_params]
-      current_user.save
-    end
-
-    def secure_compare(a, b)
-      return false unless a && b
-      return false unless a.bytesize == b.bytesize
+    def secure_compare(compare, other)
+      return false unless compare && other
+      return false unless compare.bytesize == other.bytesize
 
-      l = a.unpack "C#{a.bytesize}"
+      l = compare.unpack "C#{compare.bytesize}"
 
       res = 0
-      b.each_byte { |byte| res |= byte ^ l.shift }
-      res == 0
-    end
-
-    # --- HELPERS ---
-
-    # Get name of class with in lowercase, with underscores.
-    def self.underscore
-      ActiveSupport::Inflector.underscore(to_s).split(/\//).last
-    end
-
-    # Add a stylesheet
-    def add_stylesheet(css_file)
-      @admin_stylesheets ||= []
-      @admin_stylesheets << "admin/#{css_file}"
-    end
-
-    def persistent_params(namespace)
-      session[:persistent_params] ||= {}
-      session[:persistent_params][namespace] ||= {}
-      session[:persistent_params][namespace]
-    end
-
-    def coerce_persistent_param(v)
-      case v
-      when "true"
-        true
-      when "false"
-        false
-      else
-        v
-      end
-    end
-
-    # Get a persistent param
-    def persistent_param(key, default = nil, options = {})
-      namespace = options[:namespace] || self.class.to_s
-
-      value = coerce_persistent_param(params.key?(key) ? params[key] : default)
-
-      if !value.nil? || options[:preserve_nil]
-        persistent_params(namespace)[key] = value
-      end
-
-      value
+      other.each_byte { |byte| res |= byte ^ l.shift }
+      res.zero?
     end
   end
 end

data/app/controllers/pages_core/attachments_controller.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+module PagesCore
+  class AttachmentsController < ::ApplicationController
+    before_action :verify_signed_params
+    before_action :find_attachment, only: %i[show download]
+
+    static_cache :show, permanent: true
+
+    def show
+      send_attachment
+    end
+
+    def download
+      send_attachment disposition: "attachment"
+    end
+
+    private
+
+    def find_attachment
+      @attachment = Attachment.find(params[:id])
+    end
+
+    def send_attachment(disposition: "inline")
+      unless stale?(etag: @attachment, last_modified: @attachment.updated_at)
+        return
+      end
+
+      send_data(@attachment.data,
+                filename: @attachment.filename,
+                type: @attachment.content_type,
+                disposition: disposition)
+    end
+
+    def verify_signed_params
+      key = params[:id].to_i.to_s
+      Attachment.verifier.verify(key, params[:digest])
+    end
+  end
+end

data/app/controllers/pages_core/{application_controller.rb → base_controller.rb}

@@ -1,30 +1,35 @@
-# encoding: utf-8
+# frozen_string_literal: true
 
 module PagesCore
-  class ApplicationController < ActionController::Base
+  class BaseController < ActionController::Base
     include PagesCore::Authentication
-    include PagesCore::DomainBasedCache
-    include PagesCore::ExceptionHandler
+    include PagesCore::ErrorRenderer
+    include PagesCore::ErrorReporting
     include PagesCore::ProcessTitler
     include PagesCore::PoliciesHelper
+    include PagesCore::StaticCacheController
 
     before_action :set_locale
     after_action :set_content_language_header
 
     protected
 
+    def append_info_to_payload(payload)
+      super
+      payload[:remote_ip] = request.remote_ip
+      payload.merge!(current_user_context)
+    end
+
     # Sets @locale from params[:locale], with I18n.default_locale as fallback
     def set_locale
-      legacy_locales = {
-        "nor" => "nb",
-        "eng" => "en"
-      }
+      legacy_locales = { "nor" => "nb", "eng" => "en" }
       @locale = params[:locale] || I18n.default_locale.to_s
       @locale = legacy_locales[@locale] if legacy_locales[@locale]
     end
 
     def set_content_language_header
       return unless locale
+
       headers["Content-Language"] = locale.to_s
     end
   end

data/app/controllers/pages_core/frontend/page_files_controller.rb

@@ -1,39 +1,22 @@
-# encoding: utf-8
+# frozen_string_literal: true
 
 module PagesCore
   module Frontend
     class PageFilesController < ::FrontendController
-      before_action :find_page_file, only: [:show, :edit, :update, :destroy]
+      include PagesCore::AttachmentsHelper
 
-      def show
-        if !modified?(@page_file)
-          render(text: "304 Not Modified", status: 304) && return
-        end
+      before_action :find_page_file, only: %i[show]
 
-        if @page_file.updated_at?
-          response.headers["Last-Modified"] = @page_file.updated_at.httpdate
+      def show
+        unless stale?(etag: @page_file, last_modified: @page_file.updated_at)
+          return
         end
 
-        send_data(
-          @page_file.data,
-          filename:    @page_file.filename,
-          type:        @page_file.content_type,
-          disposition: "attachment"
-        )
+        redirect_to attachment_path(@page_file.attachment)
       end
 
       private
 
-      def modified?(page_file)
-        return true unless if_modified_since && page_file.updated_at?
-        page_file.updated_at > if_modified_since
-      end
-
-      def if_modified_since
-        return nil if request.env["HTTP_IF_MODIFIED_SINCE"].blank?
-        Time.rfc2822(request.env["HTTP_IF_MODIFIED_SINCE"])
-      end
-
       def find_page_file
         @page_file = PageFile.find(params[:id])
       end