publify_core 10.0.3 → 11.0.0

data/config/locales/ro.yml

@@ -19,6 +19,8 @@ ro:
           attributes:
             title:
               blank: can't be blank
+        user:
+          weak_password: is too weak
   admin:
     articles:
       access_granted:
@@ -824,8 +826,7 @@ ro:
   layouts:
     administration:
       powered_by: is proudly powered by
-    default:
-      designed_by: Designed by %{designed_by}
+    application:
       powered_by_html: Powered by %{powered_by}
   notes:
     note:

data/config/locales/ru.yml

@@ -19,6 +19,8 @@ ru:
           attributes:
             title:
               blank: не может быть пустым
+        user:
+          weak_password: is too weak
   admin:
     articles:
       access_granted:
@@ -838,8 +840,7 @@ ru:
   layouts:
     administration:
       powered_by: с гордостью работает на
-    default:
-      designed_by: Designed by %{designed_by}
+    application:
       powered_by_html: Powered by %{powered_by}
   notes:
     note:

data/config/locales/zh-CN.yml

@@ -19,6 +19,8 @@ zh-CN:
           attributes:
             title:
               blank: can't be blank
+        user:
+          weak_password: is too weak
   admin:
     articles:
       access_granted:
@@ -793,8 +795,7 @@ zh-CN:
   layouts:
     administration:
       powered_by: is proudly powered by
-    default:
-      designed_by: Designed by %{designed_by}
+    application:
       powered_by_html: Powered by %{powered_by}
   notes:
     note:

data/config/locales/zh-TW.yml

@@ -19,6 +19,8 @@ zh-TW:
           attributes:
             title:
               blank: can't be blank
+        user:
+          weak_password: is too weak
   admin:
     articles:
       access_granted:
@@ -794,8 +796,7 @@ zh-TW:
   layouts:
     administration:
       powered_by: is proudly powered by
-    default:
-      designed_by: Designed by %{designed_by}
+    application:
       powered_by_html: Powered by %{powered_by}
   notes:
     note:

data/config/routes.rb

@@ -53,17 +53,6 @@ Rails.application.routes.draw do
 
   resources :authors, path: "author", only: :show
 
-  # ThemeController
-  scope controller: "theme", filename: /.*/ do
-    get "stylesheets/theme/:filename", action: "stylesheets", format: false
-    get "javascripts/theme/:filename", action: "javascripts", format: false
-    get "images/theme/:filename", action: "images", format: false
-    get "fonts/theme/:filename", action: "fonts", format: false
-  end
-
-  # For the tests
-  get "theme/static_view_test", format: false
-
   # For the statuses
   get "/notes", to: "notes#index", format: false
   get "/notes/page/:page", to: "notes#index", format: false

data/db/migrate/114_fixes_buggy_articles_and_notes.rb

@@ -34,14 +34,14 @@ class FixesBuggyArticlesAndNotes < ActiveRecord::Migration[4.2]
   def self.up
     say "Fixing contents permalinks, this may take some time"
 
-    contents = Content.where("permalink is ? or permalink = ?", nil, "")
+    contents = Content.where(permalink: nil).or Content.where(permalink: "")
     contents.each do |c|
       c.set_permalink
       c.save
     end
 
     say "Fixes empty notes GUID"
-    notes = Note.where("guid is ? or guid = ?", nil, "")
+    notes = Note.where(guid: nil).or Note.where(guid: "")
     notes.each do |n|
       n.create_guid
       n.save

data/db/migrate/20150807134129_simplify_redirect_relations.rb

@@ -9,7 +9,7 @@ class SimplifyRedirectRelations < ActiveRecord::Migration[4.2]
     add_column :redirects, :content_id, :integer
     Redirect.find_each do |redirect|
       redirections = Redirection.where(redirect_id: redirect.id)
-      if redirections.count > 1
+      if redirections.many?
         raise "Expected zero or one redirections, found #{redirections.count}"
       end
 

data/db/migrate/20160605154632_remove_profiles.rb

@@ -2,7 +2,7 @@
 
 class RemoveProfiles < ActiveRecord::Migration[4.2]
   class Profile < ActiveRecord::Base
-    serialize :modules
+    serialize :modules, coder: YAML
   end
 
   def up

data/db/migrate/20190208152646_move_text_filter_to_name.rb

@@ -19,8 +19,8 @@ class MoveTextFilterToName < ActiveRecord::Migration[5.2]
   end
 
   class TextFilter < ActiveRecord::Base
-    serialize :filters, Array
-    serialize :params, Hash
+    serialize :filters, type: Array, coder: YAML
+    serialize :params, type: Hash, coder: YAML
   end
 
   def up

data/lib/format.rb

@@ -2,8 +2,8 @@
 
 module Format
   # Laxly matches an IP Address , would also pass numbers > 255 though
-  IP_ADDRESS = /^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.freeze
+  IP_ADDRESS = /^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/
 
   # Laxly matches an HTTP(S) URI
-  HTTP_URI = %r{^https?://\S+$}.freeze
+  HTTP_URI = %r{^https?://\S+$}
 end

data/lib/publify_core/engine.rb

@@ -14,6 +14,12 @@ module PublifyCore
       end
     end
 
+    initializer "publify_core.assets" do |app|
+      Theme.find_each do |theme|
+        app.config.assets.paths += theme.asset_paths
+      end
+    end
+
     initializer "publify_core.assets.precompile" do |app|
       app.config.assets.precompile += %w(
         publify.js
@@ -21,10 +27,14 @@ module PublifyCore
         publify_admin.js
         publify_admin.css
         accounts.css
+        bootstrap.css
         user-styles.css
         spinner-blue.gif
         spinner.gif
       )
+      Theme.find_each do |theme|
+        app.config.assets.precompile += theme.assets
+      end
     end
   end
 end

data/lib/publify_core/string_ext.rb

@@ -18,7 +18,7 @@ module PublifyCore
         string = string.tr(key.join, value)
       end
       string = string.tr("'", "-")
-      string.gsub(/<[^>]*>/, "").to_url
+      Rails::HTML5::FullSanitizer.new.sanitize(string).to_url
     end
 
     # Returns a-string-with-dashes when passed 'a string with dashes'.
@@ -34,18 +34,6 @@ module PublifyCore
     def to_title(item, settings, params)
       TitleBuilder.new(self).build(item, settings, params)
     end
-
-    # Strips any html markup from a string
-    TYPO_TAG_KEY = TYPO_ATTRIBUTE_KEY = /[\w:_-]+/.freeze
-    TYPO_ATTRIBUTE_VALUE = /(?:[A-Za-z0-9]+|(?:'[^']*?'|"[^"]*?"))/.freeze
-    TYPO_ATTRIBUTE = /(?:#{TYPO_ATTRIBUTE_KEY}(?:\s*=\s*#{TYPO_ATTRIBUTE_VALUE})?)/.freeze
-    TYPO_ATTRIBUTES = /(?:#{TYPO_ATTRIBUTE}(?:\s+#{TYPO_ATTRIBUTE})*)/.freeze
-    TAG =
-      %r{<[!/?\[]?(?:#{TYPO_TAG_KEY}|--)(?:\s+#{TYPO_ATTRIBUTES})?\s*(?:[!/?\]]+|--)?>}
-        .freeze
-    def strip_html
-      gsub(TAG, "").gsub(/\s+/, " ").strip
-    end
   end
 end
 

data/lib/publify_core/testing_support/fixtures/like_plain.html

@@ -0,0 +1,2 @@
+Detected as plain, but secretly contains HTML.
+<script>alert("hello")</script>

data/lib/publify_core/text_filter/markdown.rb

@@ -46,7 +46,11 @@ module PublifyCore::TextFilter
     def self.filtertext(text)
       # FIXME: Workaround for <publify:foo> not being interpreted as an HTML tag.
       escaped_macros = text.gsub(%r{(</?publify):}, '\1X')
-      html = CommonMarker.render_html(escaped_macros, :UNSAFE)
+      html = Commonmarker.to_html(escaped_macros,
+                                  options: {
+                                    extension: { header_ids: nil },
+                                    render: { unsafe: true }
+                                  })
       html.gsub(%r{(</?publify)X}, '\1:').strip
     end
   end

data/lib/publify_core/text_filter/markdown_smartquotes.rb

@@ -13,7 +13,12 @@ module PublifyCore::TextFilter
     def self.filtertext(text)
       # FIXME: Workaround for <publify:foo> not being interpreted as an HTML tag.
       escaped_macros = text.gsub(%r{(</?publify):}, '\1X')
-      html = CommonMarker.render_doc(escaped_macros, :SMART).to_html(:UNSAFE)
+      html = Commonmarker.to_html(escaped_macros,
+                                  options: {
+                                    parse: { smart: true },
+                                    extension: { header_ids: nil },
+                                    render: { unsafe: true }
+                                  })
       html.gsub(%r{(</?publify)X}, '\1:').strip
     end
   end

data/lib/publify_core/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module PublifyCore
-  VERSION = "10.0.3"
+  VERSION = "11.0.0"
 end

data/lib/publify_core.rb

@@ -2,7 +2,6 @@
 
 require "devise"
 require "devise-i18n"
-require "devise_zxcvbn"
 
 require "publify_core/version"
 require "publify_core/engine"
@@ -12,9 +11,9 @@ require "publify_core/text_filter/none"
 require "publify_core/text_filter/markdown"
 require "publify_core/text_filter/markdown_smartquotes"
 require "publify_core/text_filter/smartypants"
-require "publify_core/text_filter/twitterfilter"
 require "publify_core/string_ext"
 
+require "bootstrap"
 require "carrierwave"
 require "jquery-rails"
 require "jquery-ui-rails"
@@ -23,6 +22,7 @@ require "rails-i18n"
 require "rails-timeago"
 require "recaptcha/rails"
 require "sassc-rails"
+require "zxcvbn"
 
 require "email_notify"
 require "publify_guid"

data/lib/text_filter_plugin.rb

@@ -100,8 +100,8 @@ class TextFilterPlugin
     ""
   end
 
-  def self.sanitize(*args)
-    (@sanitizer ||= Rails::Html::WhiteListSanitizer.new).sanitize(*args)
+  def self.sanitize(*)
+    (@sanitizer ||= Rails::Html::WhiteListSanitizer.new).sanitize(*)
   end
 
   def self.default_helper_module!; end
@@ -118,6 +118,10 @@ class TextFilterPlugin
   def self.abstract_filter!
     @@filter_map.delete short_name
   end
+
+  def self.filtertext(_text)
+    raise NotImplementedError, "Must be implemented by subclasses"
+  end
 end
 
 class TextFilterPlugin::PostProcess < TextFilterPlugin
@@ -129,24 +133,6 @@ class TextFilterPlugin::PostProcess < TextFilterPlugin
 end
 
 module TextFilterPlugin::MacroMethods
-  # Utility function -- hand it a XML string like <a href="foo" title="bar">
-  # and it'll give you back { "href" => "foo", "title" => "bar" }
-  def attributes_parse(string)
-    attributes = {}
-
-    string.gsub(/([^ =]+="[^"]*")/) do |match|
-      key, value = match.split("=", 2)
-      attributes[key] = value.delete('"')
-    end
-
-    string.gsub(/([^ =]+='[^']*')/) do |match|
-      key, value = match.split("=", 2)
-      attributes[key] = value.delete("'")
-    end
-
-    attributes
-  end
-
   def filtertext(text)
     regex1 = %r{<publify:#{short_name}(?:[ \t][^>]*)?/>}
     regex2 = %r{<publify:#{short_name}([ \t][^>]*)?>(.*?)</publify:#{short_name}>}m
@@ -155,10 +141,22 @@ module TextFilterPlugin::MacroMethods
       macrofilter(attributes_parse(match))
     end
 
-    new_text.gsub(regex2) do |_match|
-      macrofilter(attributes_parse(Regexp.last_match[1].to_s), Regexp.last_match[2].to_s)
+    new_text.gsub(regex2) do |match|
+      macrofilter(attributes_parse(match), Regexp.last_match[2].to_s)
     end
   end
+
+  def macrofilter(...)
+    raise NotImplementedError, "Must be implemented by subclasses"
+  end
+
+  private
+
+  # Return a hash of attributes of the HMTL element represented by string
+  def attributes_parse(string)
+    elem = Nokogiri::HTML5.fragment(string).children.first
+    elem.attribute_nodes.to_h { [_1.name, _1.value] }
+  end
 end
 
 class TextFilterPlugin::MacroPre < TextFilterPlugin

data/lib/theme.rb

@@ -5,14 +5,7 @@ class Theme
 
   def initialize(name, path)
     @name = name
-    @path = path
-  end
-
-  def layout(action = :default)
-    if action.to_s == "view_page"
-      return "layouts/pages" if File.exist? "#{view_path}/layouts/pages.html.erb"
-    end
-    "layouts/default"
+    @path = Pathname.new path
   end
 
   def description
@@ -39,45 +32,71 @@ class Theme
     File.join(path, filename)
   end
 
-  # Find a theme, given the theme name
-  def self.find(name)
-    registered_themes[name]
+  def assets
+    list_assets("fonts", "*.*") +
+      list_assets("images", "*.*") +
+      list_assets("javascripts", "*.js") +
+      list_assets("stylesheets", "*.css")
   end
 
-  # List all themes
-  def self.find_all
-    registered_themes.values
+  def asset_paths
+    [
+      path.join("fonts"),
+      path.join("images"),
+      path.join("javascripts"),
+      path.join("stylesheets")
+    ]
   end
 
-  def self.register_theme(path)
-    theme = theme_from_path(path)
-    registered_themes[theme.name] = theme
+  private
+
+  def list_assets(type, glob)
+    dir = path.join type
+    dir.glob("#{name}/#{glob}").map { _1.relative_path_from(dir).to_s }
   end
 
-  def self.register_themes(themes_root)
-    search_theme_directory(themes_root).each do |path|
-      register_theme path
+  class << self
+    # Find a theme, given the theme name
+    def find(name)
+      registered_themes[name]
     end
-  end
 
-  # Private
+    # List all themes
+    def find_all
+      registered_themes.values
+    end
 
-  def self.registered_themes
-    @registered_themes ||= {}
-  end
+    def find_each
+      find_all.each { yield _1 }
+    end
 
-  def self.theme_from_path(path)
-    name = path.scan(/[-\w]+$/i).flatten.first
-    new(name, path)
-  end
+    def register_theme(path)
+      theme = theme_from_path(path)
+      registered_themes[theme.name] = theme
+    end
 
-  def self.search_theme_directory(themes_root)
-    glob = "#{themes_root}/[a-zA-Z0-9]*"
-    Dir.glob(glob).select do |file|
-      File.readable?("#{file}/about.markdown")
-    end.compact
-  end
+    def register_themes(themes_root)
+      search_theme_directory(themes_root).each do |path|
+        register_theme path
+      end
+    end
+
+    private
+
+    def registered_themes
+      @registered_themes ||= {}
+    end
+
+    def theme_from_path(path)
+      name = File.basename(path)
+      new(name, path)
+    end
 
-  private_class_method :search_theme_directory,
-                       :theme_from_path, :registered_themes
+    def search_theme_directory(themes_root)
+      glob = "#{themes_root}/[a-zA-Z0-9]*"
+      Dir.glob(glob).select do |file|
+        File.readable?("#{file}/about.markdown")
+      end.compact
+    end
+  end
 end