publify_core 10.0.1 → 10.0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f07659f73a5dbeb0204128c9d42e6fcec4092ed7d4e920dceac39f1d104531f3
-  data.tar.gz: cef962bcdc17d957b1824f6e529534c48fdadb473280c910a33198cbcb49d2e7
+  metadata.gz: a80ae8a43965fcfb378504dd7b9d0cf6f13d5bc87df95fd9fb937caca4eb401f
+  data.tar.gz: d18535211810991287441d7e851786062d1ae0dea3b7835f47a102d20c0c179f
 SHA512:
-  metadata.gz: 5f1262b50e741c94cf9bfcf2cc9d30dade5ae00fccbb5a33206789e7a900af47d280246b204b4f6671f2baaf18547fa1c98aad558d890500347ce58cf97d14f6
-  data.tar.gz: 58e3228983425a5a802714855453184d726f351b81475c0f36f63acf19486c61c0be3f54b26a5cb205f0db48924158840a978fb83888c33cbbcaeaddc9d65b98
+  metadata.gz: 4154fcce63f81d06ea49c427307cebe10dec30c90dfeb16d4955fd9fca6e40be98a6d95a00b2582d0dd41d81ed82535a5f6b4ee3fc403ebfd04f924aa5e3bb59
+  data.tar.gz: 8dfb7191f158518c34cac975d53f89ed74539c14340db36f67fc6f5951e3f8a90004881d1a2a74c0740368040c19f424d29f0d830ddae9dcbe2b260b69c81846

data/CHANGELOG.md

@@ -1,5 +1,37 @@
 # Changelog
 
+## 10.0.2 / 2024-06-28
+
+### Security updates
+
+* Safely link target URLs for Redirects in admin ([#148] by [mvz])
+* Upgrade jquery-ui-rails to version 7.0 ([#149] by [mvz])
+
+### Functional changes
+
+* Use native datetime inputs in the Admin ([#121] by [mvz])
+* Display Theme description nicely in the admin ([#151] by [mvz])
+
+### Internal changes
+
+* Stop using and depending on REXML ([#123] by [mvz])
+* Remove inline javascript ([#124] by [mvz])
+* Switch to no-trailing-comma style ([#127] by [mvz])
+* Remove inline styles assigned in ERB templates ([#128] by [mvz])
+* Make Content.searchstring scope code more transparent ([#150] by [mvz])
+* Add erb-lint and fix initial warnings ([#125] by [mvz])
+
+[#121]: https://github.com/publify/publify_core/pull/121
+[#123]: https://github.com/publify/publify_core/pull/123
+[#124]: https://github.com/publify/publify_core/pull/124
+[#125]: https://github.com/publify/publify_core/pull/125
+[#127]: https://github.com/publify/publify_core/pull/127
+[#128]: https://github.com/publify/publify_core/pull/128
+[#148]: https://github.com/publify/publify_core/pull/148
+[#149]: https://github.com/publify/publify_core/pull/149
+[#150]: https://github.com/publify/publify_core/pull/150
+[#151]: https://github.com/publify/publify_core/pull/151
+
 ## 10.0.1 / 2023-10-28
 
 * Update CarrierWave dependency to version 3.0 ([#102] by [mvz])
@@ -18,7 +50,6 @@
 [#118]: https://github.com/publify/publify_core/pull/118
 [#119]: https://github.com/publify/publify_core/pull/119
 [mvz]: https://github.com/mvz
-[dependabot]: https://github.com/apps/dependabot
 
 ## 10.0.0 / 2023-06-25
 

data/app/assets/javascripts/markup_help_popup.js

@@ -0,0 +1,25 @@
+$(document).ready(function() {
+  $('.markup-help-popup-link').on("click", function(e){
+    var dialog = document.getElementById(e.target.dataset["target"]);
+    var url = e.target.dataset.url;
+
+    $.ajax({
+      url: url,
+      type: 'get',
+      dataType: 'html',
+      success: function(data) {
+        dialog.getElementsByClassName("content-target").item(0).innerHTML = data;
+        dialog.showModal();
+      }
+    });
+    e.preventDefault();
+  });
+  $('.markup-help-popup-close').on("click", function(e) {
+    e.target.closest('dialog').close();
+  });
+  $('.markup-help-popup').on("click", function(e) {
+    if (e.target == e.currentTarget) {
+      e.target.close();
+    }
+  });
+});

data/app/assets/javascripts/optional_field_toggle.js

@@ -0,0 +1,7 @@
+$(document).ready(function() {
+  $('.optional_field').hide();
+  $('.optional-field-toggle').on("click", function(e){
+    $('.optional_field').fadeToggle();
+    e.preventDefault();
+  });
+});

data/app/assets/javascripts/preview_comment.js

@@ -0,0 +1,10 @@
+$(document).ready(function() {
+  $('.preview-comment-link').on("click", function(e) {
+    var lnk = e.currentTarget;
+    var preview_url = lnk.dataset.previewUrl;
+    var comment_form_selector = lnk.dataset.targetForm;
+
+    $.post(preview_url, $(comment_form_selector).serialize());
+    e.preventDefault();
+  });
+});

data/app/assets/javascripts/publify.js

@@ -6,7 +6,10 @@
 //= require set-timeago-lang
 //= require jquery_ujs
 //= require lightbox
+//= require markup_help_popup
 //= require observe
+//= require optional_field_toggle
+//= require preview_comment
 //= require check_password
 //
 //= require_self

data/app/assets/javascripts/publify_admin.js

@@ -3,23 +3,6 @@
 //= require jquery
 //= require jquery_ujs
 //= require jquery-ui
-//= require jquery-ui/i18n/datepicker-da
-//= require jquery-ui/i18n/datepicker-de
-//= require jquery-ui/i18n/datepicker-es
-//= require jquery-ui/i18n/datepicker-fr
-//= require jquery-ui/i18n/datepicker-he
-//= require jquery-ui/i18n/datepicker-it
-//= require jquery-ui/i18n/datepicker-ja
-//= require jquery-ui/i18n/datepicker-lt
-//= require jquery-ui/i18n/datepicker-nb
-//= require jquery-ui/i18n/datepicker-nl
-//= require jquery-ui/i18n/datepicker-pl
-//= require jquery-ui/i18n/datepicker-pt-BR
-//= require jquery-ui/i18n/datepicker-ro
-//= require jquery-ui/i18n/datepicker-ru
-//= require jquery-ui/i18n/datepicker-zh-CN
-//= require jquery-ui/i18n/datepicker-zh-TW
-//= require datetimepicker
 //= require bootstrap-sprockets
 //= require quicktags
 //= require tagmanager
@@ -84,14 +67,7 @@ $(document).ready(function() {
   $('#article_form').each(function(e){autosave_request(e)});
   $('#article_form').submit(function(e){save_article_tags()});
   $('#article_form').each(function(e){tag_manager()});
-
-  // DatePickers
-  $('.datepicker').each(function() {
-    $(this).datepicker($.datepicker.regional[this.dataset.locale]);
-  });
-
-  // Date time picker (not related to date picker at all!)
-  $( "#article_published_at" ).datetimepicker();
+  $('#checkall').click(function(e){check_all(e.target)});
 
   // DropDown
   $(".dropdown-toggle").dropdown();

data/app/assets/javascripts/spinnable.js

@@ -1,5 +1,10 @@
 // Show and hide spinners on Ajax requests.
 $(document).ready(function(){
-  $('form.spinnable').on('ajax:before', function(evt, xhr, status){ $('#spinner').show();})
-  $('form.spinnable').on('ajax:complete', function(evt, xhr, status){ $('#spinner').hide();})
+  $('#spinner').hide().removeClass("hidden");
+  $('form.spinnable').on('ajax:before', function(evt, xhr, status){
+    $('#spinner').show();
+  });
+  $('form.spinnable').on('ajax:complete', function(evt, xhr, status){
+    $('#spinner').hide();
+  });
 });

data/app/assets/stylesheets/administration_structure.css.scss

@@ -1,7 +1,7 @@
 /* General */
 
 body {
-  padding-top: 40px;
+  padding-top: 60px;
 }
 
 footer {

data/app/assets/stylesheets/publify.css.scss

@@ -7,3 +7,46 @@
   border-bottom: #eee 1px solid;
   font-size: 0.9em;
 }
+
+.markup-help-popup {
+  padding: 0;
+}
+
+.markup-help-popup > div {
+  padding: 1em;
+}
+
+.markup-help-popup-close {
+  float: right;
+  cursor: pointer;
+}
+
+.admintools {
+  display: none;
+}
+
+.admin-tools-reveal:hover .admintools {
+  display: block;
+}
+
+.tag-sidebar-tag-cloud {
+  overflow: hidden;
+}
+
+.tag-sidebar-tag-67 { font-size: 0.67em; }
+.tag-sidebar-tag-75 { font-size: 0.75em; }
+.tag-sidebar-tag-83 { font-size: 0.83em; }
+.tag-sidebar-tag-91 { font-size: 0.91em; }
+.tag-sidebar-tag-100 { font-size: 1em; }
+.tag-sidebar-tag-112 { font-size: 1.12em; }
+.tag-sidebar-tag-125 { font-size: 1.25em; }
+.tag-sidebar-tag-137 { font-size: 1.37em; }
+.tag-sidebar-tag-150 { font-size: 1.50em; }
+.tag-sidebar-tag-162 { font-size: 1.62em; }
+.tag-sidebar-tag-175 { font-size: 1.75em; }
+.tag-sidebar-tag-187 { font-size: 1.87em; }
+.tag-sidebar-tag-200 { font-size: 2em; }
+
+.hidden {
+  display: none;
+}

data/app/assets/stylesheets/publify_admin.css.scss

@@ -3,7 +3,6 @@
  *= require jquery-ui
  *= require tagmanager
  *= require sidebar_admin
- *= require datetimepicker
  */
 // "bootstrap-sprockets" must be imported before "bootstrap" and "bootstrap/variables"
 @import "bootstrap-sprockets";

data/app/controllers/admin/articles_controller.rb

@@ -123,9 +123,9 @@ class Admin::ArticlesController < Admin::BaseController
     if @article.save
       flash[:success] = I18n.t("admin.articles.autosave.success")
       @must_update_calendar =
-        (params[:article][:published_at] and
-         params[:article][:published_at].to_time.to_i < Time.zone.now.to_time.to_i and
-         @article.parent_id.nil?)
+        params[:article][:published_at] and
+        params[:article][:published_at].to_time.to_i < Time.zone.now.to_time.to_i and
+        @article.parent_id.nil?
       respond_to do |format|
         format.js
       end

data/app/controllers/admin/dashboard_controller.rb

@@ -1,10 +1,6 @@
 # frozen_string_literal: true
 
 class Admin::DashboardController < Admin::BaseController
-  require "open-uri"
-  require "time"
-  require "rexml/document"
-
   def index
     today = Time.zone.now.strftime("%Y-%m-%d 00:00")
 

data/app/controllers/admin/themes_controller.rb

@@ -1,22 +1,14 @@
 # frozen_string_literal: true
 
-require "open-uri"
-require "time"
-require "rexml/document"
-
 class Admin::ThemesController < Admin::BaseController
   def index
     @themes = Theme.find_all
-    @themes.each do |theme|
-      # TODO: Move to Theme
-      theme.description_html = TextFilter.none.filter_text(theme.description)
-    end
     @active = this_blog.current_theme
   end
 
   def preview
     theme = Theme.find(params[:theme])
-    send_file File.join(theme.path, "preview.png"),
+    send_file theme.theme_file("preview.png"),
               type: "image/png", disposition: "inline", stream: false
   end
 

data/app/controllers/articles_controller.rb

@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
 class ArticlesController < ContentController
+  include ActionView::Helpers::SanitizeHelper
+
   before_action :login_required, only: [:preview, :preview_page]
   before_action :verify_config
   before_action :auto_discovery_feed, only: [:show, :index]
@@ -127,7 +129,7 @@ class ArticlesController < ContentController
   def markup_help
     filter = TextFilter.make_filter(params[:id])
     if filter
-      render html: filter.commenthelp
+      render html: sanitize(filter.commenthelp)
     else
       render plain: "Unknown filter"
     end

data/app/controllers/comments_controller.rb

@@ -32,7 +32,7 @@ class CommentsController < BaseController
 
   def recaptcha_ok_for?(comment)
     use_recaptcha = comment.blog.use_recaptcha
-    ((use_recaptcha && verify_recaptcha(model: comment)) || !use_recaptcha)
+    (use_recaptcha && verify_recaptcha(model: comment)) || !use_recaptcha
   end
 
   def new_comment_defaults

data/app/helpers/admin/feedback_helper.rb

@@ -16,7 +16,7 @@ module Admin::FeedbackHelper
       change_status(item, context),
       button_to_edit_comment(item),
       button_to_delete_comment(item),
-      button_to_conversation(item),
+      button_to_conversation(item)
     ], " "
   end
 

data/app/helpers/base_helper.rb

@@ -71,21 +71,29 @@ module BaseHelper
 
   def markup_help_popup(markup, text)
     if markup && markup.commenthelp.size > 1
-      link_to(text,
-              url_for(controller: "articles", action: "markup_help", id: markup.name),
-              onclick: "return popup(this, 'Publify Markup Help')")
+      modal = tag.dialog id: "this_markup_help_popup_dialog", class: "markup-help-popup" do
+        tag.div do
+          close_div = tag.div tag.span("\u2a09", class: "markup-help-popup-close")
+          content = tag.div class: "content-target"
+          safe_join [close_div, content]
+        end
+      end
+
+      url = url_for(controller: "articles", action: "markup_help", id: markup.name)
+
+      link = link_to(text, "#", class: "markup-help-popup-link",
+                                data: { target: "this_markup_help_popup_dialog",
+                                        url: url })
+
+      safe_join [modal, link]
     else
       ""
     end
   end
 
-  def onhover_show_admin_tools(type, id = nil)
-    admin_id = "#admin_#{[type, id].compact.join("_")}"
-    tag = []
-    tag << %{ onmouseover="if (getCookie('publify_user_profile') == 'admin')\
-             { $('#{admin_id}').show(); }" }
-    tag << %{ onmouseout="$('#{admin_id}').hide();" }
-    safe_join(tag, " ")
+  # This method's original implementation was broken. Now it does nothing.
+  def onhover_show_admin_tools(_type, _id = nil)
+    ""
   end
 
   def feed_title
@@ -190,7 +198,7 @@ module BaseHelper
   end
 
   def stop_index_robots?(blog)
-    stop = (params[:year].present? || params[:page].present?)
+    stop = params[:year].present? || params[:page].present?
     stop = blog.unindex_tags if controller_name == "tags"
     stop = blog.unindex_categories if controller_name == "categories"
     stop
@@ -216,7 +224,7 @@ module BaseHelper
     elsif !@article.nil?
       @article.feed_url(type)
     elsif !@auto_discovery_url_atom.nil?
-      instance_variable_get("@auto_discovery_url_#{type}")
+      instance_variable_get(:"@auto_discovery_url_#{type}")
     end
   end
 

data/app/models/archives_sidebar.rb

@@ -36,7 +36,7 @@ class ArchivesSidebar < Sidebar
         name: I18n.l(Date.new(year, month), format: "%B %Y"),
         month: month,
         year: year,
-        article_count: entry.count,
+        article_count: entry.count
       }
     end
   end

data/app/models/content.rb

@@ -25,10 +25,15 @@ class Content < ApplicationRecord
   scope :drafts, -> { where(state: "draft").order("created_at DESC") }
   scope :no_draft, -> { where.not(state: "draft").order("published_at DESC") }
   scope :searchstring, lambda { |search_string|
+    result = where(state: "published")
+
     tokens = search_string.split(" ").map { |c| "%#{c.downcase}%" }
-    matcher = "(LOWER(body) LIKE ? OR LOWER(extended) LIKE ? OR LOWER(title) LIKE ?)"
-    template = "state = ? AND #{([matcher] * tokens.size).join(" AND ")}"
-    where(template, "published", *tokens.map { |token| [token] * 3 }.flatten)
+    tokens.each do |token|
+      result = result
+        .where("(LOWER(body) LIKE ? OR LOWER(extended) LIKE ? OR LOWER(title) LIKE ?)",
+               token, token, token)
+    end
+    result
   }
 
   scope :published_at_like, lambda { |date_at|

data/app/models/redirect.rb

@@ -17,8 +17,8 @@ class Redirect < ApplicationRecord
     return path if %r{^(https?)://([^/]*)(.*)}.match?(path)
 
     url_root = blog.root_path
-    unless url_root.nil? || path[0, url_root.length] == url_root
-      path = File.join(url_root, path)
+    if url_root.length == 0 || path[0, url_root.length] != url_root
+      path = blog.url_for(path, only_path: true)
     end
     path
   end

data/app/models/tag_sidebar.rb

@@ -18,12 +18,34 @@ class TagSidebar < Sidebar
     average = total.to_f / @tags.size
     @sizes = tags.reduce({}) do |h, tag|
       size = tag.content_counter.to_f / average
-      h.merge tag => size.clamp(2.0 / 3.0, 2) * 100
+      h.merge tag => bucket(size)
     end
   end
 
-  def font_multiplier
-    80
+  BUCKETS = [
+    67,
+    75,
+    83,
+    91,
+    100,
+    112,
+    125,
+    137,
+    150,
+    162,
+    175,
+    187,
+    200
+  ].freeze
+
+  private
+
+  def bucket(size)
+    base_size = size.clamp(2.0 / 3.0, 2) * 100
+    BUCKETS.each do |sz|
+      return sz if sz >= base_size
+    end
+    BUCKETS.last
   end
 end
 

data/app/models/text_filter.rb

@@ -65,7 +65,7 @@ class TextFilter
       markdown,
       smartypants,
       markdown_smartypants,
-      none,
+      none
     ]
   end
 

data/app/uploaders/resource_uploader.rb

@@ -30,7 +30,7 @@ class ResourceUploader < CarrierWave::Uploader::Base
   end
 
   def dynamic_resize_to_fit(size)
-    resize_setting = model.blog.send("image_#{size}_size").to_i
+    resize_setting = model.blog.send(:"image_#{size}_size").to_i
 
     resize_to_fit(resize_setting, resize_setting)
   end

data/app/views/admin/articles/_form.html.erb

@@ -9,7 +9,7 @@
       <span id="preview_link">
         <%= link_to(t('.preview'), { controller: '/articles', action: 'preview', id: @article.id }, { target: 'new', class: 'btn btn-default' }) if @article.id %>
       </span>
-      <input id="save_draft" type="submit" value="<%= t('.save_as_draft') %>" name="article[draft]" class="btn btn-default" />
+      <input id="save_draft" type="submit" value="<%= t('.save_as_draft') %>" name="article[draft]" class="btn btn-default">
       <!-- Button trigger modal -->
       <button class="btn btn-success" data-toggle="modal" type="button" data-target="#publishOptions">
         <%= controller.action_name == 'new' ? t('.publish') : t('.save') %>
@@ -144,7 +144,7 @@
               <%= toggle_element('publish') %>
               </p>
               <div id="publish" class="collapse">
-                <%= text_field 'article', 'published_at' %>
+                <%= datetime_field 'article', 'published_at' %>
                 <p>
                 <span class="btn btn-mini btn-default">
                   <%= toggle_element('publish', t('.ok')) %>

data/app/views/admin/articles/index.html.erb

@@ -8,7 +8,7 @@
 <%= form_tag({ action: 'index' }, { method: :get, name: 'article', remote: true, class: 'form-inline spinnable', "data-update-success": 'articleList' }) do %>
 
   <% if params[:search] and params[:search]['state'] %>
-    <input type="hidden" name="search[state]" value="<%= params[:search]['state'] %>" />
+    <input type="hidden" name="search[state]" value="<%= params[:search]['state'] %>">
   <% end %>
 
   <p>
@@ -20,7 +20,7 @@
   </p>
 
   <div class="panel panel-default">
-    <div class="panel-heading">
+    <div class="panel-heading clearfix">
       <div class="pull-right">
         <div class="form-group">
           <%= select_tag('search[user_id]', options_from_collection_for_select(User.all, 'id', 'name'), prompt: t('.select_an_author'), class: 'form-control') %>
@@ -29,14 +29,13 @@
           <%= select_tag('search[published_at]', options_for_select(Article.publication_months), prompt: t('.publication_date'), class: 'form-control') %>
         </div>
         <div class="form-group">
-          <input id="search" type="text" name="search[searchstring]" class="form-control" />
+          <input id="search" type="text" name="search[searchstring]" class="form-control" autocomplete="off">
         </div>
         <div class="form-group">
           <%= submit_tag(t('.search'), class: 'btn btn-success') %>
-          <span id="spinner" style="display:none;"><%= image_tag('spinner.gif') %></span>
+          <span id="spinner" class="hidden"><%= image_tag('spinner.gif') %></span>
         </div>
       </div>
-      <br style="clear: both" />
     </div>
   </div>
   <table class="table table-hover">

data/app/views/admin/dashboard/_comment.html.erb

@@ -12,7 +12,7 @@
     <%= comment.html.strip_html.slice(0..300) %>
     </p>
     <%= button_to_conversation(comment) %>
-    <hr />
+    <hr>
     </li>
   <% end %>
 <% end %>

data/app/views/admin/dashboard/_drafts.html.erb

@@ -16,7 +16,7 @@
             <%= display_date_and_time(post.created_at) %>
           </h5>
           <p><%= post.body&.strip_html&.slice(0, 300) %></p>
-          <hr />
+          <hr>
           </li>
         <% end %>
       <% end %>

data/app/views/admin/feedback/_ham.html.erb

@@ -1,5 +1,5 @@
 <td>
-  <input class="feedback_check" type="checkbox" name="feedback_check[<%= comment.id %>]" />
+  <input class="feedback_check" type="checkbox" name="feedback_check[<%= comment.id %>]">
 </td>
 <td>
   <%= avatar_tag(email: comment.email, url: comment.url, size: 36, class: 'img-circle') %>

data/app/views/admin/feedback/article.html.erb

@@ -16,7 +16,7 @@
     <thead>
       <tr class='noborder'>
         <th>
-          <input type="checkbox" name="checkall" id="checkall" onclick="check_all(this);" />
+          <input type="checkbox" name="checkall" id="checkall">
         </th>
         <th><%= t(".author") %></th>
         <th><%= t(".created_at") %></th>

data/app/views/admin/feedback/edit.html.erb

@@ -50,7 +50,7 @@
     </div>
     <div class='row'>
       <div class='form-group col-md-12'>
-        <hr />
+        <hr>
         <%= t('.action_or_other_html', first_action: link_to(t('.cancel'), action: 'index'), second_action: submit_tag(t('.save'), class: 'btn btn-primary')) %>
       </div>
     </div>

data/app/views/admin/feedback/index.html.erb

@@ -27,7 +27,7 @@
     <thead>
       <tr class='noborder'>
         <th>
-          <input type="checkbox" name="checkall" id="checkall" onclick="check_all(this);" />
+          <input type="checkbox" name="checkall" id="checkall">
         </th>
         <th><%= t(".author") %></th>
         <th><%= t(".created_at") %></th>
@@ -52,4 +52,4 @@
   </table>
 <% end %>
 
-<br class='clear' />
+<br class='clear'>

data/app/views/admin/migrations/show.html.erb

@@ -29,7 +29,7 @@
           <p><strong><%= t('.you_are_up_to_date') %></strong></p>
         </div>
       <% else %>
-        <hr />
+        <hr>
         <%= submit_tag(t('.update_database_now'), class: 'btn btn-success') %>
         <small><%= t('.may_take_a_moment') %></small>
       <% end %>

data/app/views/admin/notes/_form.html.erb

@@ -25,11 +25,10 @@
   </div>
   <div class='form-group'>
     <label for='note_published_at'><%= t('.publish_at') %></label>
-    <%= n.text_field :published_at, class: 'form-control datepicker',
-                                    placeholder: t('.now'), data: { locale: I18n.locale } %>
+    <%= n.datetime_field :published_at, class: 'form-control' %>
   </div>
   <div class='form-group'>
-    <hr />
+    <hr>
     <%= link_to(t('.cancel'), action: 'index') %>
     <%= t('.or') %>
     <%= submit_tag(t('.publish'), class: 'btn btn-success') %>

data/app/views/admin/notes/_note.html.erb

@@ -3,10 +3,10 @@
     <%= h(note.body.strip_html.slice(0..140)) %>
   </td>
   <td>
-    <%= author_link(note) %><br />
+    <%= author_link(note) %><br>
   </td>
   <td>
-    <%= l(note.published_at) %>
+    <%= l(note.published_at) if note.published_at %>
   </td>
   <td>
     <%= note.text_filter_name %>