radiant 0.6.0 → 0.6.1

data/CHANGELOG

@@ -1,6 +1,20 @@
 == Change Log
 
-=== 0.6.0 Lapidary
+=== 0.6.1 Stone Cutter (May 5, 2007)
+* Fixed a security vulnerability which caused passwords to appear in the logs
+* Fixed a bug in the site map code which caused it to forget which rows were
+  expanded
+* The find_by_url method has been optimized to improve performance [Daniel
+  Sheppard]
+* GET requests are now the only requests that are cached [Daniel Sheppard] 
+* Added rudimentary support for extension depencency specification through
+  directory prefixing [Daniel Sheppard]
+* Fixed syntax error in fixture loading extension [Sean Cribbs]
+* Minor documentation fix for date tag [Sean Cribbs]
+* Fixed a bug in the migrations that prevented 0.5.x users from upgrading
+  properly [Sean Cribbs]
+
+=== 0.6.0 Lapidary (April 24, 2007)
 * Added support for extensions--an extremely flexible way to extend radiant
 * Merged Behaviors into the Page class; subclass page now instead
 * Improved database support for Postgres and Sqlite
@@ -28,13 +42,13 @@
 * Created the r:cycle tag to make alternating tables and lists possible
 * Added popups for filter and tag documentation inside the page editing 
   interface
-* Added support for optimistic locking for all models [Daniel Shepherd]
+* Added support for optimistic locking for all models [Daniel Sheppard]
 * Added support to Radiant::Config for boolean values [Sean Cribbs]
 * Caching no longer stores the headers and body in the same file [Daniel 
-  Shepherd]
+  Sheppard]
 * Added support for the X-Sendfile header that works in conjunction with 
   caching to speed it up (by default X-Sendfile support is off) [Daniel 
-  Shepherd]
+  Sheppard]
 * Moved the images and stylesheets into images/admin and stylesheets/admin
   respectively to make it easier for Radiant's assets to coexist easily with
   the site's assets
@@ -53,11 +67,11 @@
 * Updated icons for layouts
 * Migrations are now repaired so that you can run `rake migrate` to create the
   initial database. (`script/setup_database` is still the recommended method.)
-  (closes ticket #46) [Daniel Shepherd]
+  (closes ticket #46) [Daniel Sheppard]
 * When you collapse a branch in the admin page tree view and move to another
   tab the collapsed status is now saved so that when you return, the collapsed
   status is preserved. Also the status of collapsed branches is preserved when
-  collapsing and expanding parent nodes. (closes ticket #29) [Daniel Shepherd]
+  collapsing and expanding parent nodes. (closes ticket #29) [Daniel Sheppard]
 * Fixed documentation problem in response_cache.rb (closes ticket #142) [Paul
   Smith]
 * Fixed problem with timezones on fixtures causing tests to fail in Japan

data/CONTRIBUTORS

@@ -4,6 +4,10 @@
 The following people have submitted changes which have been applied to the
 core:
 
+=== 0.6.1 Stone Cutter
+* Sean Cribbs
+* Daniel Sheppard
+
 === 0.6.0 Lapidary
 * Alexander Horn
 * Adam Williams

data/app/controllers/admin/page_controller.rb

@@ -1,5 +1,5 @@
 class Admin::PageController < Admin::AbstractModelController
-  model_class Page
+  model_class Page
   before_filter :initialize_meta_rows_and_buttons, :only => [:new, :edit]
   attr_accessor :cache
 
@@ -79,43 +79,43 @@ class Admin::PageController < Admin::AbstractModelController
         "The page was successfully removed from the site."
       end
     end
-
+    
+    def announce_cache_cleared
+      flash[:notice] = "The page cache was successfully cleared."
+    end
+    
     def initialize_meta_rows_and_buttons
       @buttons_partials ||= []
       @meta ||= []
       @meta << {:field => "slug", :type => "text_field", :args => [{:class => 'textbox', :maxlength => 100}]}
       @meta << {:field => "breadcrumb", :type => "text_field", :args => [{:class => 'textbox', :maxlength => 160}]}
     end
-     
-    def announce_cache_cleared
-      flash[:notice] = "The page cache was successfully cleared."
-    end
-    
-    def save
-      parts = @page.parts
-      parts_to_update = {}
-      (params[:part]||{}).each {|k,v| parts_to_update[v[:name]] = v }
-      
-      parts_to_remove = []
-      @page.parts.each do |part|
-        if(attrs = parts_to_update.delete(part.name))
-          part.attributes = part.attributes.merge(attrs)
-        else
-          parts_to_remove << part
-        end
-      end
-      parts_to_update.values.each do |attrs|
-        @page.parts.build(attrs)
-      end
-      if result = @page.save
-        new_parts = @page.parts - parts_to_remove
-        new_parts.each {|x| x.save}
-        @page.parts = new_parts
-      end
-      result
-    end
-    
-    def clear_model_cache
-      @cache.expire_response(@page.url)      
+    
+    def save
+      parts = @page.parts
+      parts_to_update = {}
+      (params[:part]||{}).each {|k,v| parts_to_update[v[:name]] = v }
+      
+      parts_to_remove = []
+      @page.parts.each do |part|
+        if(attrs = parts_to_update.delete(part.name))
+          part.attributes = part.attributes.merge(attrs)
+        else
+          parts_to_remove << part
+        end
+      end
+      parts_to_update.values.each do |attrs|
+        @page.parts.build(attrs)
+      end
+      if result = @page.save
+        new_parts = @page.parts - parts_to_remove
+        new_parts.each { |part| part.save }
+        @page.parts = new_parts
+      end
+      result
+    end
+    
+    def clear_model_cache
+      @cache.expire_response(@page.url)      
     end
 end

data/app/controllers/application.rb

@@ -7,6 +7,8 @@ end
 class ApplicationController < ActionController::Base
   include LoginSystem
   
+  filter_parameter_logging :password, :password_confirmation
+  
   before_filter :set_current_user
   before_filter :set_javascripts_and_stylesheets
   

data/app/controllers/site_controller.rb

@@ -13,7 +13,7 @@ class SiteController < ApplicationController
   def show_page
     response.headers.delete('Cache-Control')
     url = params[:url].to_s
-    if live? and (@cache.response_cached?(url))
+    if (request.get? || request.head?) and live? and (@cache.response_cached?(url))
       @cache.update_response(url, response, request)
       @performed_render = true
     else
@@ -36,7 +36,7 @@ class SiteController < ApplicationController
       @page = find_page(url)
       unless @page.nil?
         process_page(@page)
-        @cache.cache_response(url, response) if live? and @page.cache?
+        @cache.cache_response(url, response) if request.get? and live? and @page.cache?
         @performed_render = true
       else
         render :template => 'site/not_found', :status => 404

data/app/helpers/admin/page_helper.rb

@@ -11,7 +11,8 @@ module Admin::PageHelper
     else
       []
     end
-    (rows << homepage.id).uniq
+    (rows << homepage.id).uniq if homepage
+    rows
   end
   
   def meta_errors?

data/app/models/page.rb

@@ -125,15 +125,20 @@ class Page < ActiveRecord::Base
   end
   
   def find_by_url(url, live = true, clean = true)
+    return nil if virtual?
     url = clean_url(url) if clean
-    if (self.url == url) && (not live or published?)
+    my_url = self.url
+    if (my_url == url) && (not live or published?)
       self
-    else
+    elsif (url =~ /^#{Regexp.quote(my_url)}([^\/]*)/)
+      slug_child = children.find_by_slug($1)
+      if slug_child
+        found = slug_child.find_by_url(url, live, clean)
+        return found if found
+      end
       children.each do |child|
-        if (url =~ Regexp.compile( '^' + Regexp.quote(child.url))) and (not child.virtual?)
-          found = child.find_by_url(url, live, clean)
-          return found if found
-        end
+        found = child.find_by_url(url, live, clean)
+        return found if found
       end
       children.find(:first, :conditions => "class_name = 'FileNotFoundPage'")
     end
@@ -251,4 +256,4 @@ class Page < ActiveRecord::Base
   
 end
 
-Page.load_subclasses
+Page.load_subclasses

data/app/models/response_cache.rb

@@ -122,8 +122,8 @@ class ResponseCache
 
     def client_has_cache?(metadata, request)
         return false unless request
-        request_time = Time.rfc2822(request.env["HTTP_IF_MODIFIED_SINCE"]) rescue nil
-        response_time = Time.rfc2822(metadata['headers']['Last-Modified']) rescue nil
+        request_time = Time.httpdate(request.env["HTTP_IF_MODIFIED_SINCE"]) rescue nil
+        response_time = Time.httpdate(metadata['headers']['Last-Modified']) rescue nil
         return request_time && response_time && response_time <= request_time
     end
     

data/app/models/standard_tags.rb

@@ -318,7 +318,7 @@ module StandardTags
     current date/time, regardless of the  page.
    
     *Usage:*  
-    <pre><code><r:date [format="%A, %B %d, %Y"] [when="published_at"]/></code></pre>
+    <pre><code><r:date [format="%A, %B %d, %Y"] [for="published_at"]/></code></pre>
   }
   tag 'date' do |tag|
     page = tag.locals.page
@@ -331,7 +331,7 @@ module StandardTags
       when ['published_at', 'created_at', 'updated_at'].include?(time_attr)
         page[time_attr]
       else
-        raise TagError, "Invalid value for 'when' attribute."
+        raise TagError, "Invalid value for 'for' attribute."
       end
     else
       page.published_at || page.created_at

data/app/views/admin/page/index.rhtml

@@ -1,4 +1,5 @@
 <% include_javascript 'sitemap' -%>
+
 <h1>Pages</h1>
 
 <table id="site-map" class="index" cellpadding="0" cellspacing="0" border="0">
@@ -21,7 +22,7 @@
 </table>
 <script type="text/javascript">
 // <![CDATA[
-  new SiteMap('site-map');
+  new SiteMap('site-map', <%= expanded_rows.to_json %>);
 // ]]>
 </script>
 <form action="<%= clear_cache_url %>" method="post">

data/db/migrate/010_merge_behaviors_and_pages.rb

@@ -11,7 +11,7 @@ class MergeBehaviorsAndPages < ActiveRecord::Migration
   
   def self.up
     announce "converting behavior names to class names"
-    Page.find(:all).each do |page|
+    OldPage.find(:all).each do |page|
       unless page.behavior_id.blank?
         page.behavior_id = page_name(page.behavior_id)
         page.save!

data/lib/plugins/extension_patches/init.rb

@@ -1,5 +1,7 @@
 require 'routing_extension'
 require 'view_paths_extension'
 require 'mailer_view_paths_extension'
-require 'generator_base_extension'
+if RAILS_ENV != 'production'
+  require 'generator_base_extension' 
+end
 require 'fixture_loading_extension'

data/lib/plugins/extension_patches/lib/fixture_loading_extension.rb

@@ -19,7 +19,7 @@ module Radiant
           begin
             directory = paths.pop
             fixtures_map[table_name] = Fixtures.new(connection, File.split(table_name.to_s).last, class_names[table_name.to_sym], File.join(directory, table_name))
-          rescue e
+          rescue Exception => e
             retry unless paths.empty?
             raise e
           end

data/lib/radiant.rb

@@ -5,7 +5,7 @@ unless defined? Radiant::Version
     module Version
       Major = '0'
       Minor = '6'
-      Tiny  = '0'
+      Tiny  = '1'
     
       class << self
         def to_s
@@ -21,4 +21,4 @@ unless defined? Radiant::Version
       end
     end
   end
-end
+end

data/lib/radiant/extension_loader.rb

@@ -66,7 +66,7 @@ module Radiant
     def activate_extensions(enabled_extensions = nil)
       initializer.initialize_default_admin_tabs
       activated_extensions = @extension_roots.select do |root|
-        extension_file = "#{File.basename(root)}_extension"
+        extension_file = "#{File.basename(root).sub(/^\d+_/,'')}_extension"
         extension = extension_file.camelize.constantize
         extension.root = root
         extension.unloadable

data/public/javascripts/sitemap.js

@@ -5,16 +5,9 @@ Object.extend(SiteMap.prototype, {
 
   ruledTableInitialize: RuledTable.prototype.initialize,
   
-  initialize: function(id) {
+  initialize: function(id, expanded) {
     this.ruledTableInitialize(id);
-    this.expandedRows = this.parseCookieExpandedRows();
-  },
-  
-  parseCookieExpandedRows: function () {
-    var cookieExpandedRows = [];
-    if(document.cookie.length > 0 && document.cookie.match(/expanded_rows=(.*);/))
-       cookieExpandedRows = RegExp.$1.split(/,/).reject(function (value, index){ return value.length == 0; }).uniq();
-    return cookieExpandedRows;
+    this.expandedRows = expanded
   },
   
   onRowSetup: function(row) {
@@ -67,7 +60,7 @@ Object.extend(SiteMap.prototype, {
   },     
   
   saveExpandedCookie: function() {
-    document.cookie = "expanded_rows="+this.expandedRows.uniq().join(",")+"; path=/admin";
+    document.cookie = "expanded_rows=" + this.expandedRows.uniq().join(",") + "; path=/admin";
   }, 
   
   hideBranch: function(row, img) {
@@ -82,9 +75,9 @@ Object.extend(SiteMap.prototype, {
     }
     var pageId = this.extractPageId(row);
     var newExpanded = [];
-    for(i=0; i < this.expandedRows.length; i++)
-        if(this.expandedRows[i] != pageId)
-            newExpanded.push(this.expandedRows[i]);
+    for(i = 0; i < this.expandedRows.length; i++)
+      if(this.expandedRows[i] != pageId)
+        newExpanded.push(this.expandedRows[i]);
     this.expandedRows = newExpanded;
     this.saveExpandedCookie();
     if (img == null)

data/test/functional/admin/user_controller_test.rb

@@ -7,12 +7,17 @@ class Admin::UserController; def rescue_action(e) raise e end; end
 class Admin::UserControllerTest < Test::Unit::TestCase
   
   fixtures :users
+  test_helper :user, :logging
 
   def setup
     @controller = Admin::UserController.new
     @request = ActionController::TestRequest.new
     @response = ActionController::TestResponse.new
-    @user = @request.session['user'] = users(:existing)
+    @user = @request.session['user'] = create_test_user
+  end
+  
+  def teardown
+    destroy_test_user
   end
 
   def test_ancestors
@@ -46,11 +51,9 @@ class Admin::UserControllerTest < Test::Unit::TestCase
     assigned_user = assigns(:user)
     assert_equal @user, assigned_user
     assert @user.object_id != assigned_user.object_id
-    assert_equal 'existing.user@gmail.com', assigned_user.email
+    assert_equal 'jdoe@gmail.com', assigned_user.email
   end
   def test_preferences__post
-    @user = User.new(:name => 'Test', :login => 'pref_test', :password => 'whoa!', :password_confirmation => 'whoa!')
-    assert @user.save
     post(
       :preferences,
       { :user => { :password => '', :password_confirmation => '', :email => 'updated@gmail.com' } },
@@ -59,13 +62,26 @@ class Admin::UserControllerTest < Test::Unit::TestCase
     @user = User.find(@user.id)
     assert_redirected_to page_index_url
     assert_match /preferences.*?saved/i, flash[:notice] 
-    assert_equal('updated@gmail.com', @user.email)
-    @user.destroy
+    assert_equal 'updated@gmail.com', @user.email
   end
   def test_preferences__post_with_bad_data
     get :preferences, 'user' => { :login => 'superman' }
     assert_response :success
     assert_match /bad form data/i, flash[:error]
   end
+  
+  def test_change_password
+    @user = User.create!(:name => 'Test', :login => 'pref_test', :password => 'whoa!', :password_confirmation => 'whoa!')
+    post(
+      :preferences,
+      { :user => { :password => 'funtimes', :password_confirmation => 'funtimes' } },
+      { 'user' => @user }
+    )
+    @user = User.find(@user.id)
+    assert_equal User.sha1('funtimes'), @user.password
+    
+    assert !log_matches(/"password"=>"funtimes"/)
+    assert !log_matches(/"password_confirmation"=>"funtimes"/)
+  end
 
 end

data/test/functional/admin/welcome_controller_test.rb

@@ -6,6 +6,7 @@ class Admin::WelcomeController; def rescue_action(e) raise e end; end
 
 class Admin::WelcomeControllerTest < Test::Unit::TestCase
   
+  test_helper :logging
   fixtures :users
   
   def setup
@@ -30,6 +31,8 @@ class Admin::WelcomeControllerTest < Test::Unit::TestCase
     user = session['user']
     assert_kind_of User, user
     assert_equal 'existing', user.login
+    
+    assert !log_matches(/"password"=>"password"/)
   end
   def test_login__post_invalid_user
     post :login, 'user' => { :login => 'invalid', :password => 'password' }

data/test/functional/extension_initialization_test.rb

@@ -12,7 +12,7 @@ class ExtensionInitializationTest < Test::Unit::TestCase
   
   def test_load_paths
     assert_nothing_raised { BasicExtension }
-    assert_equal File.join(File.expand_path(RADIANT_ROOT), 'test', 'fixtures', 'extensions', 'basic'), BasicExtension.root
+    assert_equal File.join(File.expand_path(RADIANT_ROOT), 'test', 'fixtures', 'extensions', '01_basic'), BasicExtension.root
     assert_equal 'Basic', BasicExtension.extension_name
     assert_nothing_raised { BasicExtensionController }
     assert_nothing_raised { BasicExtensionModel }

data/test/functional/site_controller_test.rb

@@ -161,7 +161,25 @@ class SiteControllerTest < Test::Unit::TestCase
     get :show_page, :url => 'documentation'
     assert_response :success
     assert_equal 'This is the documentation section.', @response.body
-  end
+  end
+  
+  def test_show_page__no_cache_if_post 
+    @controller.cache.perform_caching = true 
+    @cache.clear 
+    post :show_page, :url => 'documentation' 
+    assert_response :success 
+    assert !File.exists?(cache_file('documentation')) 
+  end 
+
+  def test_show_page__no_cache_if_post__cached 
+    @controller.cache.perform_caching = true 
+    @request.host = 'dev.site.com' 
+    @cache.cache_response('documentation', response(:body => 'expired body')) 
+    post :show_page, :url => 'documentation' 
+    assert_response :success 
+    assert_equal 'This is the documentation section.', @response.body 
+  end 
+  
   
   def test_show_page__no_pages
     Page.destroy_all

data/test/helpers/logging_test_helper.rb

@@ -0,0 +1,10 @@
+module LoggingTestHelper
+  def log_matches(regexp)
+    result = false
+    open(RAILS_ROOT + '/log/test.log') do |f|
+      lines = f.readlines.to_s
+      result = true if regexp.match(lines)
+    end
+    result
+  end
+end

data/test/helpers/user_test_helper.rb

@@ -3,7 +3,8 @@ module UserTestHelper
     :name => 'John Doe',
     :login => 'jdoe',
     :password => 'coolness',
-    :password_confirmation => 'coolness'
+    :password_confirmation => 'coolness',
+    :email => 'jdoe@gmail.com'
   }
   
   def user_params(options = {})

data/test/unit/standard_tags_test.rb

@@ -198,7 +198,7 @@ class StandardTagsTest < Test::Unit::TestCase
     assert_renders 'Monday, January 30, 2006', '<r:date for="created_at" />'
     assert_renders 'Tuesday, January 31, 2006', '<r:date for="updated_at" />'
     assert_renders 'Monday, January 30, 2006', '<r:date for="published_at" />'
-    assert_render_error "Invalid value for 'when' attribute.", '<r:date for="blah" />'
+    assert_render_error "Invalid value for 'for' attribute.", '<r:date for="blah" />'
   end
   
   def test_tag_link

metadata

@@ -3,8 +3,8 @@ rubygems_version: 0.9.2
 specification_version: 1
 name: radiant
 version: !ruby/object:Gem::Version 
-  version: 0.6.0
-date: 2007-04-24 00:00:00 -04:00
+  version: 0.6.1
+date: 2007-05-05 00:00:00 -04:00
 summary: A no-fluff content management system designed for small teams.
 require_paths: 
 - lib
@@ -322,32 +322,32 @@ files:
 - test/fixtures/sample.txt
 - test/fixtures/snippets.yml
 - test/fixtures/users.yml
-- test/fixtures/extensions/basic
-- test/fixtures/extensions/overriding
-- test/fixtures/extensions/basic/app
-- test/fixtures/extensions/basic/basic_extension.rb
-- test/fixtures/extensions/basic/db
-- test/fixtures/extensions/basic/lib
-- test/fixtures/extensions/basic/app/controllers
-- test/fixtures/extensions/basic/app/models
-- test/fixtures/extensions/basic/app/views
-- test/fixtures/extensions/basic/app/controllers/basic_extension_controller.rb
-- test/fixtures/extensions/basic/app/models/basic_extension_mailer.rb
-- test/fixtures/extensions/basic/app/models/basic_extension_model.rb
-- test/fixtures/extensions/basic/app/views/basic_extension
-- test/fixtures/extensions/basic/app/views/basic_extension_mailer
-- test/fixtures/extensions/basic/app/views/basic_extension/index.rhtml
-- test/fixtures/extensions/basic/app/views/basic_extension/override.rhtml
-- test/fixtures/extensions/basic/app/views/basic_extension_mailer/message.rhtml
-- test/fixtures/extensions/basic/db/migrate
-- test/fixtures/extensions/basic/db/migrate/001_create_initial_schema.rb
-- test/fixtures/extensions/basic/db/migrate/002_modify_initial_schema.rb
-- test/fixtures/extensions/basic/lib/tasks
-- test/fixtures/extensions/overriding/app
-- test/fixtures/extensions/overriding/overriding_extension.rb
-- test/fixtures/extensions/overriding/app/views
-- test/fixtures/extensions/overriding/app/views/basic_extension
-- test/fixtures/extensions/overriding/app/views/basic_extension/override.rhtml
+- test/fixtures/extensions/01_basic
+- test/fixtures/extensions/02_overriding
+- test/fixtures/extensions/01_basic/app
+- test/fixtures/extensions/01_basic/basic_extension.rb
+- test/fixtures/extensions/01_basic/db
+- test/fixtures/extensions/01_basic/lib
+- test/fixtures/extensions/01_basic/app/controllers
+- test/fixtures/extensions/01_basic/app/models
+- test/fixtures/extensions/01_basic/app/views
+- test/fixtures/extensions/01_basic/app/controllers/basic_extension_controller.rb
+- test/fixtures/extensions/01_basic/app/models/basic_extension_mailer.rb
+- test/fixtures/extensions/01_basic/app/models/basic_extension_model.rb
+- test/fixtures/extensions/01_basic/app/views/basic_extension
+- test/fixtures/extensions/01_basic/app/views/basic_extension_mailer
+- test/fixtures/extensions/01_basic/app/views/basic_extension/index.rhtml
+- test/fixtures/extensions/01_basic/app/views/basic_extension/override.rhtml
+- test/fixtures/extensions/01_basic/app/views/basic_extension_mailer/message.rhtml
+- test/fixtures/extensions/01_basic/db/migrate
+- test/fixtures/extensions/01_basic/db/migrate/001_create_initial_schema.rb
+- test/fixtures/extensions/01_basic/db/migrate/002_modify_initial_schema.rb
+- test/fixtures/extensions/01_basic/lib/tasks
+- test/fixtures/extensions/02_overriding/app
+- test/fixtures/extensions/02_overriding/overriding_extension.rb
+- test/fixtures/extensions/02_overriding/app/views
+- test/fixtures/extensions/02_overriding/app/views/basic_extension
+- test/fixtures/extensions/02_overriding/app/views/basic_extension/override.rhtml
 - test/functional/admin
 - test/functional/application_controller_test.rb
 - test/functional/extension_initialization_test.rb
@@ -366,6 +366,7 @@ files:
 - test/helpers/extension_fixture_test_helper.rb
 - test/helpers/extension_tag_test_helper.rb
 - test/helpers/layout_test_helper.rb
+- test/helpers/logging_test_helper.rb
 - test/helpers/page_part_test_helper.rb
 - test/helpers/page_test_helper.rb
 - test/helpers/render_test_helper.rb