publify_core 10.0.4 → 11.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cb863f2b83b8da8700912e96e0c744d024e7a3e4ffa362d9ad935f058ce9e9a5
-  data.tar.gz: 49608e62a576f90c263501a080e78aa54aa9c46277ef49e8d7fbde9af7891ca4
+  metadata.gz: 54204326dfdc03206645e1fd7500d9bfa643d6dda4322ac507f274cb5f54f6f4
+  data.tar.gz: 707f57d3ee216361b5c8609dca39d9530a1028d88a7ad6074ada18ce54161339
 SHA512:
-  metadata.gz: d5d506b38f535284cc378b38d22afc611036ababfc81a5c8be05afe6736128fc76f6dd3639997ee7a7b3180e27d4071ab07cf1c5f69ad4c8f90093a384f0e94b
-  data.tar.gz: a1fa53f2e4d0ceffc96b32f67961cb23b09806c4ded69bdba2fffbcad4dbd4198694b2f145fb6a4971f9e4bfd7ce7c6edd1a0ef1347af5245739519be3676324
+  metadata.gz: 5f605221ed9190fa5cf50af34c8f0cde8d328bc5390a36fb251953d599b6ee2b307e6238a9d1f53379d87308562f33fb6d2bd2074afe5dcbb5096c6e727d0813
+  data.tar.gz: 43abbedcaa37557670340fbd8d6304404b758d1b860f62594b03ab48e4ee2278cbc1b197de224db29cb75b71a4232e4dd7439a7551603eff21b1efb31aef79de

data/CHANGELOG.md

@@ -1,5 +1,182 @@
 # Changelog
 
+## 11.0.1 / 2026-10-23
+
+This release fixes a security issue where a user with publisher role can update
+any other user's articles.
+
+* Support Rails 8.0 ([#270] by [mvz])
+* Update `mini_magick` dependency ([#271] by [mvz])
+* Support Rails 8.1 ([#272] by [mvz])
+* Check user update rights in admin article create action ([#274] by [mvz])
+
+[#270]: https://github.com/publify/publify_core/pull/270
+[#271]: https://github.com/publify/publify_core/pull/271
+[#272]: https://github.com/publify/publify_core/pull/272
+[#274]: https://github.com/publify/publify_core/pull/274
+
+## 11.0.0 / 2026-10-04
+
+This major release updates Rails to version 7.2, and updates supported Ruby
+versions to 3.2 through 4.0. It also includes breaking changes to theming
+support.
+
+### Security
+
+* Refuse attempts to upload a file detected as text with an html extension ([#268] by [mvz])
+
+### Ruby support
+
+PublifyCore 11.0 supports Ruby 3.2 through 4.0, dropping support for older versions:
+
+* Support Ruby 3.0 and up ([#136] by [mvz])
+* Add Ruby 3.4 to the GitHub Actions matrix ([#167] by [mvz])
+* Drop support for Ruby 3.0 and 3.1 ([#189] by [mvz])
+* Test with Ruby 4.0 in CI ([#221] by [mvz])
+
+### Rails support
+
+PublifyCore 11.0 supports Rails 7.1 and 7.2:
+
+* Drop support for Rails 6.1 ([#195] by [mvz])
+* Set explicit coder for serialized attributes ([#198] by [mvz])
+* Support Rails 7.2 ([#261] by [mvz])
+* Handle Rails 7.1 deprecation warnings ([#222] by [mvz])
+* Drop support for Rails 7.0 ([#215] by [mvz])
+* Make old migration work with Postgres in Rails 7.2 ([#262] by [mvz])
+
+### Theming
+
+This release includes breaking changes to theming. Themes must now use the
+default Rails layout name, `application`. All theme assets are served via the
+asset pipeline. To avoid asset name conflicts, themes must namespace their
+assets with the theme name.
+
+For example for a theme named 'foo', this results in the following setup:
+
+* Layout in `themes/foo/views/layouts/application.html.erb`
+* In the layout, links to style sheets and javascript files that automatically
+  prefix the theme name:
+
+  ```erb
+  <%= themeable_stylesheet_link_tag :theme %>
+  <%= themeable_javascript_include_tag :theme %>
+  ```
+
+* Asset files:
+   * `themes/foo/javascripts/foo/theme.js`
+   * `themes/foo/stylesheets/foo/theme.css`
+
+Related pull requests:
+
+* Simplify derivation of a theme's name from its path ([#240] by [mvz])
+* Remove translation only used in Typographic theme ([#245] by [mvz])
+* Always use the standard Rails layout name for the content pages ([#244] by [mvz])
+* Use the asset pipeline for theme assets ([#247] by [mvz])
+
+### Dependencies
+
+* Port Admin views to Bootstrap 4 ([#178] by [mvz])
+* Upgrade to commonmarker version 2.3 ([#193] by [mvz])
+* Upgrade to bootstrap 5.3 ([#234] by [mvz])
+* Update Devise to version 5.0.4 ([#226] by [mvz])
+
+### Miscellaneous
+
+* Upgrade `html_pipeline` to version 3.2 and port custom filters ([#211] by [mvz])
+* Replace `devise_zxcvbn` with direct integration of `zxcvbn` ([#217] by [mvz])
+* Add specs for `ContentBase#excerpt_text` ([#228] by [mvz])
+* Remove monkey-patched `String#strip_html` method ([#231] by [mvz])
+* Clean up deprecations ([#233] by [mvz])
+* Remove EkkoLightbox ([#235] by [mvz])
+* Remove old password fallback mechanism ([#236] by [mvz])
+* Clean up textfilter macro methods ([#238] by [mvz])
+* Replace ad-hoc excerpt code with `#excerpt_text` ([#239] by [mvz])
+* Remove useless `Redirect#to_url` method ([#252] by [mvz])
+* Remove html tags the Rails way when generating permalinks ([#249] by [mvz])
+
+### Internal
+
+* Allow starting the GitHub Actions workflow manually ([#140] by [mvz])
+* Pull in latest changes from 10-0-stable ([#164] by [mvz])
+* Pull in latest changes from 10-0-stable ([#152] by [mvz])
+* Fix linting job in GitHub Actions ([#158] by [mvz])
+* Provide needed graphics processing dependency in CI ([#169] by [mvz])
+* Test with all supported Rails versions in CI ([#168] by [mvz])
+* Use rake-manifest to generate the manifest ([#170] by [mvz])
+* Prevent manifest task definition from being loaded in dependent projects
+  ([11727f5] by [mvz])
+* Update RuboCop dependencies and configuration and fix new offenses ([#173] by [mvz])
+* Clarify logic in `CommentsController#recaptcha_ok_for?` ([#174] by [mvz])
+* Switch to weekly dependabot updates ([#188] by [mvz])
+* Use new official name for `erb_lint` ([#190] by [mvz])
+* Remove scheduled CI runs ([#204] by [mvz])
+* Pull in changelog for version 10.0.3 ([#194] by [mvz])
+* Remove obsolete `before_action` ([#196] by [mvz])
+* Remove exceptions from `login_required` before_action ([#197] by [mvz])
+* Refactor notes rendering ([#210] by [mvz])
+* Remove any permissions from `GITHUB_TOKEN` in CI ([#253] by [mvz])
+* Remove dummy application layout view ([#246] by [mvz])
+* Make 'rails server' work with the dummy test app ([#216] by [mvz])
+* Update rubocop dependencies and handle new offenses ([#223] by [mvz])
+* Remove dependency on pry ([#165] by [mvz])
+* Loosen development dependencies ([#266] by [mvz])
+
+[#136]: https://github.com/publify/publify_core/pull/136
+[#140]: https://github.com/publify/publify_core/pull/140
+[#152]: https://github.com/publify/publify_core/pull/152
+[#158]: https://github.com/publify/publify_core/pull/158
+[#164]: https://github.com/publify/publify_core/pull/164
+[#165]: https://github.com/publify/publify_core/pull/165
+[#167]: https://github.com/publify/publify_core/pull/167
+[#168]: https://github.com/publify/publify_core/pull/168
+[#169]: https://github.com/publify/publify_core/pull/169
+[#170]: https://github.com/publify/publify_core/pull/170
+[#173]: https://github.com/publify/publify_core/pull/173
+[#174]: https://github.com/publify/publify_core/pull/174
+[#178]: https://github.com/publify/publify_core/pull/178
+[#188]: https://github.com/publify/publify_core/pull/188
+[#189]: https://github.com/publify/publify_core/pull/189
+[#190]: https://github.com/publify/publify_core/pull/190
+[#193]: https://github.com/publify/publify_core/pull/193
+[#194]: https://github.com/publify/publify_core/pull/194
+[#195]: https://github.com/publify/publify_core/pull/195
+[#196]: https://github.com/publify/publify_core/pull/196
+[#197]: https://github.com/publify/publify_core/pull/197
+[#198]: https://github.com/publify/publify_core/pull/198
+[#204]: https://github.com/publify/publify_core/pull/204
+[#210]: https://github.com/publify/publify_core/pull/210
+[#211]: https://github.com/publify/publify_core/pull/211
+[#215]: https://github.com/publify/publify_core/pull/215
+[#216]: https://github.com/publify/publify_core/pull/216
+[#217]: https://github.com/publify/publify_core/pull/217
+[#221]: https://github.com/publify/publify_core/pull/221
+[#222]: https://github.com/publify/publify_core/pull/222
+[#223]: https://github.com/publify/publify_core/pull/223
+[#226]: https://github.com/publify/publify_core/pull/226
+[#228]: https://github.com/publify/publify_core/pull/228
+[#231]: https://github.com/publify/publify_core/pull/231
+[#233]: https://github.com/publify/publify_core/pull/233
+[#234]: https://github.com/publify/publify_core/pull/234
+[#235]: https://github.com/publify/publify_core/pull/235
+[#236]: https://github.com/publify/publify_core/pull/236
+[#238]: https://github.com/publify/publify_core/pull/238
+[#239]: https://github.com/publify/publify_core/pull/239
+[#240]: https://github.com/publify/publify_core/pull/240
+[#244]: https://github.com/publify/publify_core/pull/244
+[#245]: https://github.com/publify/publify_core/pull/245
+[#246]: https://github.com/publify/publify_core/pull/246
+[#247]: https://github.com/publify/publify_core/pull/247
+[#249]: https://github.com/publify/publify_core/pull/249
+[#252]: https://github.com/publify/publify_core/pull/252
+[#253]: https://github.com/publify/publify_core/pull/253
+[#261]: https://github.com/publify/publify_core/pull/261
+[#262]: https://github.com/publify/publify_core/pull/262
+[#266]: https://github.com/publify/publify_core/pull/266
+[#268]: https://github.com/publify/publify_core/pull/268
+
+[11727f5]: https://github.com/publify/publify_core/commit/11727f5a2826ea351964c2367d36a979dfab212d
+
 ## 10.0.4 / 2026-10-04
 
 * Refuse attempts to upload a file detected as text with an html extension ([#267] by [mvz])
@@ -84,60 +261,88 @@
 
 ### Breaking changes
 
-* Remove support for Textile as a text format [publify#1001](https://github.com/publify/publify/pull/1001)
+* Remove support for Textile as a text format
+  [publify#1001](https://github.com/publify/publify/pull/1001)
 
 ### Other changes
 
 * Improve feedback listings [publify#1005](https://github.com/publify/publify/pull/1005)
-* Link to article from article feedback admin page [publify#1007](https://github.com/publify/publify/pull/1007)
+* Link to article from article feedback admin page
+  [publify#1007](https://github.com/publify/publify/pull/1007)
 * Link to blog from admin menu [publify#1008](https://github.com/publify/publify/pull/1008)
-* Handle markdown links in notes correctly [publify#1009](https://github.com/publify/publify/pull/1009)
-* Make notes twitterfilter robust [publify#1010](https://github.com/publify/publify/pull/1010)
+* Handle markdown links in notes correctly
+  [publify#1009](https://github.com/publify/publify/pull/1009)
+* Make notes twitterfilter robust
+  [publify#1010](https://github.com/publify/publify/pull/1010)
 * Miscellaneous admin fixes [publify#1012](https://github.com/publify/publify/pull/1012)
-* Add arabic language to the project [publify#1060](https://github.com/publify/publify/pull/1060) by [ahmedhamid13](https://github.com/ahmedhamid13)
+* Add arabic language to the project
+  [publify#1060](https://github.com/publify/publify/pull/1060) by [ahmedhamid13](https://github.com/ahmedhamid13)
 
 ### Internal changes
 
 * Remove use of 'notextile' [publify#1002](https://github.com/publify/publify/pull/1002)
-* Remove `TextFilter.filter_text` in favor of `#filter_text` [publify#1003](https://github.com/publify/publify/pull/1003)
-* Replace BlueCloth with CommonMarker for Markdown processing [publify#810](https://github.com/publify/publify/pull/810)
-* Rename Admin::ContentController to Admin::ArticlesController [publify#1004](https://github.com/publify/publify/pull/1004)
-* Remove unneeded wrapping elements from admin layout [publify#1006](https://github.com/publify/publify/pull/1006)
-* Split the factories into individual files [publify#1031](https://github.com/publify/publify/pull/1031) by [VictorPS](https://github.com/VictorPS)
-* Ensure `auto_link` helper is loaded on time [publify#1040](https://github.com/publify/publify/pull/1040)
-* Remove `sitealizer` table [publify#1089](https://github.com/publify/publify/pull/1089) by [SupriyaMedankar](https://github.com/SupriyaMedankar)
-* Remove itunes fields from resources [publify#1092](https://github.com/publify/publify/pull/1092) by [SupriyaMedankar](https://github.com/SupriyaMedankar)
-* Remove `page_caches` table [publify#1090](https://github.com/publify/publify/pull/1090) by [SupriyaMedankar](https://github.com/SupriyaMedankar)
-* Remove obsolete Sidebar code [publify_core#58](https://github.com/publify/publify_core/pull/58)
+* Remove `TextFilter.filter_text` in favor of `#filter_text`
+  [publify#1003](https://github.com/publify/publify/pull/1003)
+* Replace BlueCloth with CommonMarker for Markdown processing
+  [publify#810](https://github.com/publify/publify/pull/810)
+* Rename Admin::ContentController to Admin::ArticlesController
+  [publify#1004](https://github.com/publify/publify/pull/1004)
+* Remove unneeded wrapping elements from admin layout
+  [publify#1006](https://github.com/publify/publify/pull/1006)
+* Split the factories into individual files
+  [publify#1031](https://github.com/publify/publify/pull/1031) by [VictorPS](https://github.com/VictorPS)
+* Ensure `auto_link` helper is loaded on time
+  [publify#1040](https://github.com/publify/publify/pull/1040)
+* Remove `sitealizer` table
+  [publify#1089](https://github.com/publify/publify/pull/1089) by [SupriyaMedankar](https://github.com/SupriyaMedankar)
+* Remove itunes fields from resources
+  [publify#1092](https://github.com/publify/publify/pull/1092) by [SupriyaMedankar](https://github.com/SupriyaMedankar)
+* Remove `page_caches` table
+  [publify#1090](https://github.com/publify/publify/pull/1090) by [SupriyaMedankar](https://github.com/SupriyaMedankar)
+* Remove obsolete Sidebar code
+  [publify_core#58](https://github.com/publify/publify_core/pull/58)
 
 ## 9.2.10 / 2023-01-08
 
 * Bump Rails version to 5.2.8.1 [publify#1070](https://github.com/publify/publify/pull/1070)
-* Limit length of settings values [publify#1072](https://github.com/publify/publify/pull/1072)
-* Require login to stay unique when updating a User [publify#1073](https://github.com/publify/publify/pull/1073)
-* Validate lengths of string attributes [publify#1077](https://github.com/publify/publify/pull/1077)
-* Strip EXIF data from resource uploads [publify#1078](https://github.com/publify/publify/pull/1078)
-* Require user passwords to be strong [publify#1086](https://github.com/publify/publify/pull/1086)
+* Limit length of settings values
+  [publify#1072](https://github.com/publify/publify/pull/1072)
+* Require login to stay unique when updating a User
+  [publify#1073](https://github.com/publify/publify/pull/1073)
+* Validate lengths of string attributes
+  [publify#1077](https://github.com/publify/publify/pull/1077)
+* Strip EXIF data from resource uploads
+  [publify#1078](https://github.com/publify/publify/pull/1078)
+* Require user passwords to be strong
+  [publify#1086](https://github.com/publify/publify/pull/1086)
 
 ## 9.2.9 / 2022-05-22
 
-* Fix admin article access control [publify#1065](https://github.com/publify/publify/pull/1065)
-* Refuse html files as resources even if declared to be plain text [publify#1066](https://github.com/publify/publify/pull/1066)
+* Fix admin article access control
+  [publify#1065](https://github.com/publify/publify/pull/1065)
+* Refuse html files as resources even if declared to be plain text
+  [publify#1066](https://github.com/publify/publify/pull/1066)
 
 ## 9.2.8 / 2022-05-14
 
-* Fix password protected article reveal [publify#1049](https://github.com/publify/publify/pull/1049)
-* Disallow comments on draft articles [publify#1048](https://github.com/publify/publify/pull/1048)
+* Fix password protected article reveal
+  [publify#1049](https://github.com/publify/publify/pull/1049)
+* Disallow comments on draft articles
+  [publify#1048](https://github.com/publify/publify/pull/1048)
 * Clean up Feedback validation [publify#1051](https://github.com/publify/publify/pull/1051)
 * Disallow images in comments [publify#1054](https://github.com/publify/publify/pull/1054)
 * Fix password reset process [publify#1055](https://github.com/publify/publify/pull/1055)
-* Hide bodies of password-protected articles in search results [publify#1057](https://github.com/publify/publify/pull/1057)
-* Provide correct `article_id` input in bulkops form [publify#1058](https://github.com/publify/publify/pull/1058)
-* Do not create article meta description for password-protected articles [publify#1061](https://github.com/publify/publify/pull/1061)
+* Hide bodies of password-protected articles in search results
+  [publify#1057](https://github.com/publify/publify/pull/1057)
+* Provide correct `article_id` input in bulkops form
+  [publify#1058](https://github.com/publify/publify/pull/1058)
+* Do not create article meta description for password-protected articles
+  [publify#1061](https://github.com/publify/publify/pull/1061)
 
 ## 9.2.7 / 2022-02-07
 
-* Fix setting the article password from the Admin [publify#1044](https://github.com/publify/publify/pull/1044)
+* Fix setting the article password from the Admin
+  [publify#1044](https://github.com/publify/publify/pull/1044)
 
 ## 9.2.6 / 2022-01-07
 
@@ -232,41 +437,41 @@ Additionally, it includes the following changes:
 * Let first-run users pick their own password instead of generating one (mvz)
 
 * Dependencies
-  - Update dependencies (mvz)
-  - Drop support for Ruby 2.1 (mvz)
+   * Update dependencies (mvz)
+   * Drop support for Ruby 2.1 (mvz)
 
 * Removing of old/outdated functionality
-  - Remove support for feedburner (mvz)
-  - Drop old redirects (mvz)
-  - Remove RSD end point (mvz)
+   * Remove support for feedburner (mvz)
+   * Drop old redirects (mvz)
+   * Remove RSD end point (mvz)
 
 * Feedback
-  - Stop sending trackbacks and pingbacks (mvz)
-  - Stop accepting trackbacks (mvz)
+   * Stop sending trackbacks and pingbacks (mvz)
+   * Stop accepting trackbacks (mvz)
 
 * Improve Atom/RSS feeds
-  - Fix URLs used for resources (mvz)
-  - Fix URL/alternate links to not just point to the site root (mvz)
-  - Unify comment and trackback feeds into feedback feed (mvz)
-  - Add caching for feeds (mvz)
-  - Fix atom entry publication date (mvz)
-  - Fix ordering of feedback feed by using created_at (mvz)
+   * Fix URLs used for resources (mvz)
+   * Fix URL/alternate links to not just point to the site root (mvz)
+   * Unify comment and trackback feeds into feedback feed (mvz)
+   * Add caching for feeds (mvz)
+   * Fix atom entry publication date (mvz)
+   * Fix ordering of feedback feed by using created_at (mvz)
 
 * Bug fixes
-  - Fix user resource image display when using Fog (mvz)
-  - Fix sending of welcome email (mvz)
-  - Fix Tag page description (mvz)
-  - Handle setting published_at to blank (mvz)
-  - Handle preview of articles without publication date (mvz)
-  - Include CSRF meta tag so remote forms work (mvz)
-  - Fix sidebar field rendering in admin (mvz)
-  - Fix formatting of settings forms in admin (mvz)
+   * Fix user resource image display when using Fog (mvz)
+   * Fix sending of welcome email (mvz)
+   * Fix Tag page description (mvz)
+   * Handle setting published_at to blank (mvz)
+   * Handle preview of articles without publication date (mvz)
+   * Include CSRF meta tag so remote forms work (mvz)
+   * Fix sidebar field rendering in admin (mvz)
+   * Fix formatting of settings forms in admin (mvz)
 
 * Code improvements
-  - Performance improvements (mvz)
-  - Improve tags controller (mvz)
-  - Clean up archives and authors page code (mvz)
-  - Unify content models more to improve performance when mixing models (mvz)
+   * Performance improvements (mvz)
+   * Improve tags controller (mvz)
+   * Clean up archives and authors page code (mvz)
+   * Unify content models more to improve performance when mixing models (mvz)
 
 ## 9.0.0.pre6 / 2016-12-23
 

data/app/assets/javascripts/publify.js

@@ -5,7 +5,6 @@
 //= require rails-timeago-all
 //= require set-timeago-lang
 //= require jquery_ujs
-//= require lightbox
 //= require markup_help_popup
 //= require observe
 //= require optional_field_toggle

data/app/assets/javascripts/publify_admin.js

@@ -3,13 +3,13 @@
 //= require jquery
 //= require jquery_ujs
 //= require jquery-ui
+//= require popper
 //= require bootstrap-sprockets
 //= require quicktags
 //= require tagmanager
 //= require typeahead
 //= require sidebar
 //= require spinnable
-//= require lightbox
 //
 //= require_self
 
@@ -69,12 +69,13 @@ $(document).ready(function() {
   $('#article_form').each(function(e){tag_manager()});
   $('#checkall').click(function(e){check_all(e.target)});
 
-  // DropDown
-  $(".dropdown-toggle").dropdown();
+  const lightboxModal = document.getElementById('image-lightbox-modal');
+  if (lightboxModal) {
+    lightboxModal.addEventListener('show.bs.modal', event => {
+      const triggerElem = event.relatedTarget;
+      const imageUrl = triggerElem.getAttribute('data-bs-imageurl');
+      const imageElem = lightboxModal.querySelector('.modal-body img')
+      imageElem.src = imageUrl;
+    })
+  }
 });
-
-$(document).delegate('*[data-toggle="lightbox"]', 'click',
-    function(event) {
-      event.preventDefault();
-      $(this).ekkoLightbox();
-    });

data/app/assets/stylesheets/accounts.css.scss

@@ -1,5 +1,3 @@
-// "bootstrap-sprockets" must be imported before "bootstrap" and "bootstrap/variables"
-@import "bootstrap-sprockets";
 @import "bootstrap";
 
 body {

data/app/assets/stylesheets/administration_structure.css.scss

@@ -58,10 +58,6 @@ tr .action {
 .page-title { display:inline-block }
 /* Classes for menu icons */
 
-.btn-action {
-  padding: 4px;
-}
-
 #article_title,
 #page_title {
   font-size: 2.3em;

data/app/assets/stylesheets/publify.css.scss

@@ -1,6 +1,5 @@
 /*
  *= require coderay
- *= require lightbox
  */
 
 .statuses_sidebar {

data/app/assets/stylesheets/publify_admin.css.scss

@@ -4,6 +4,4 @@
  *= require tagmanager
  *= require sidebar_admin
  */
-// "bootstrap-sprockets" must be imported before "bootstrap" and "bootstrap/variables"
-@import "bootstrap-sprockets";
 @import "bootstrap";

data/app/assets/stylesheets/sidebar_admin.css.scss

@@ -27,10 +27,4 @@
   h3 {
     margin-top: 0;
   }
-  .deletion_link {
-    position: absolute;
-    top: 20px;
-    right: 20px;
-    display: inline-block;
-  }
 }

data/app/controllers/admin/articles_controller.rb

@@ -37,7 +37,10 @@ class Admin::ArticlesController < Admin::BaseController
 
   def create
     article_factory = Article::Factory.new(this_blog, current_user)
-    @article = article_factory.get_or_build_from(params[:article][:id])
+    id = params[:article][:id].presence
+    return if id && !access_granted?(id)
+
+    @article = article_factory.get_or_build_from(id)
 
     update_article_attributes
 
@@ -116,7 +119,7 @@ class Admin::ArticlesController < Admin::BaseController
     @article.text_filter_name ||= default_text_filter
 
     if @article.title.blank?
-      lastid = Article.order("id desc").first.id
+      lastid = Article.order(id: :desc).first.id
       @article.title = "Draft article #{lastid}"
     end
 

data/app/controllers/admin/base_controller.rb

@@ -9,7 +9,7 @@ class Admin::BaseController < BaseController
   @@look_for_migrations = true
   layout "administration"
 
-  before_action :login_required, except: [:login, :signup]
+  before_action :login_required
   before_action :no_caching
 
   private
@@ -18,7 +18,7 @@ class Admin::BaseController < BaseController
     @record = klass_to_destroy.find(params[:id])
     if @record.respond_to?(:access_by?) && !@record.access_by?(current_user)
       flash[:error] = I18n.t("admin.base.not_allowed")
-      return(redirect_to action: "index")
+      return redirect_to action: "index"
     end
     @record.destroy
     flash[:notice] = I18n.t("admin.base.successfully_deleted",

data/app/controllers/admin/redirects_controller.rb

@@ -4,13 +4,13 @@ class Admin::RedirectsController < Admin::BaseController
   before_action :set_redirect, only: [:edit, :update, :destroy]
 
   def index
-    @redirects = Redirect.where(content_id: nil).order("id desc").page(params[:page])
+    @redirects = Redirect.where(content_id: nil).order(id: :desc).page(params[:page])
       .per(this_blog.admin_display_elements)
     @redirect = Redirect.new
   end
 
   def edit
-    @redirects = Redirect.where(content_id: nil).order("id desc").page(params[:page])
+    @redirects = Redirect.where(content_id: nil).order(id: :desc).page(params[:page])
       .per(this_blog.admin_display_elements)
   end
 

data/app/controllers/admin/resources_controller.rb

@@ -18,7 +18,7 @@ class Admin::ResourcesController < Admin::BaseController
 
   def index
     @r = Resource.new
-    @resources = Resource.order("created_at DESC").page(params[:page])
+    @resources = Resource.order(created_at: :desc).page(params[:page])
       .per(this_blog.admin_display_elements)
   end
 

data/app/controllers/admin/seo_controller.rb

@@ -4,6 +4,8 @@ class Admin::SeoController < Admin::BaseController
   before_action :set_setting
   before_action :set_section
 
+  VALID_SECTIONS = %w(general titles permalinks).freeze
+
   def show
     if @setting.permalink_format != "/%year%/%month%/%day%/%title%" &&
         @setting.permalink_format != "/%year%/%month%/%title%" &&
@@ -37,8 +39,6 @@ class Admin::SeoController < Admin::BaseController
     @setting.settings_keys + [:custom_permalink]
   end
 
-  VALID_SECTIONS = %w(general titles permalinks).freeze
-
   def set_section
     section = params[:section]
     @section = VALID_SECTIONS.include?(section) ? section : "general"

data/app/controllers/admin/settings_controller.rb

@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
 class Admin::SettingsController < Admin::BaseController
+  VALID_ACTIONS = %w(index write feedback display).freeze
+
   def index
     this_blog.base_url = blog_base_url if this_blog.base_url.blank?
     load_settings
@@ -33,8 +35,6 @@ class Admin::SettingsController < Admin::BaseController
 
   private
 
-  VALID_ACTIONS = %w(index write feedback display).freeze
-
   def settings_params
     @settings_params ||= params.require(:setting).permit(@setting.settings_keys)
   end

data/app/controllers/admin/tags_controller.rb

@@ -51,7 +51,7 @@ class Admin::TagsController < Admin::BaseController
   end
 
   def fetch_tags
-    @tags = Tag.order("display_name").page(params[:page])
+    @tags = Tag.order(:display_name).page(params[:page])
       .per(this_blog.admin_display_elements)
   end
 end

data/app/controllers/admin/users_controller.rb

@@ -4,7 +4,7 @@ class Admin::UsersController < Admin::BaseController
   before_action :set_user, only: [:edit, :update, :destroy]
 
   def index
-    @users = User.order("login asc").page(params[:page])
+    @users = User.order(:login).page(params[:page])
       .per(this_blog.admin_display_elements)
   end
 
@@ -38,7 +38,7 @@ class Admin::UsersController < Admin::BaseController
   end
 
   def destroy
-    @user.destroy if User.where("profile = ? and id != ?", User::ADMIN, @user.id).count > 1
+    @user.destroy if User.where("profile = ? and id != ?", User::ADMIN, @user.id).many?
     redirect_to admin_users_url
   end
 

data/app/controllers/articles_controller.rb

@@ -5,9 +5,6 @@ class ArticlesController < ContentController
 
   before_action :login_required, only: [:preview, :preview_page]
   before_action :verify_config
-  before_action :auto_discovery_feed, only: [:show, :index]
-
-  layout :theme_layout, except: [:trackback]
 
   helper :"admin/base"
 
@@ -98,7 +95,7 @@ class ArticlesController < ContentController
     r = Redirect.find_by!(from_path: from)
     # TODO: If linked to article, directly redirect to the article.
     # Let redirection made outside of the blog on purpose (deal with it, Brakeman!)
-    redirect_to r.full_to_path, status: :moved_permanently if r
+    redirect_to r.full_to_path, allow_other_host: true, status: :moved_permanently if r
   end
 
   def archives
@@ -154,7 +151,7 @@ class ArticlesController < ContentController
   def verify_config
     if !this_blog.configured?
       redirect_to controller: "setup", action: "index"
-    elsif User.count == 0
+    elsif User.none?
       redirect_to new_user_registration_path
     else
       true

data/app/controllers/authors_controller.rb

@@ -1,8 +1,6 @@
 # frozen_string_literal: true
 
 class AuthorsController < ContentController
-  layout :theme_layout
-
   def show
     @author = User.find_by(login: params[:id])
     raise ActiveRecord::RecordNotFound unless @author