radiant 0.6.6 → 0.6.7

data/CHANGELOG

@@ -1,5 +1,20 @@
 == Change Log
 
+=== Edge
+* Fix Haml rendering errors. [Thomas Watson Steen]
+
+=== 0.6.7 Mordant
+* Integrate shards extension into core. [Sean Cribbs]
+* Convert all views to Haml. [Sean Cribbs, John Long]
+* Avoid authenticity check when listing page children. [Sean Cribbs]
+* Add radiant:extensions:update_all task. [Josh French]
+* Tweak LoginSystem to allow attempted URL redirection after login and 
+auto-redirect from login URL if logged in. [Josh French]
+* Add per-user salting to password encryption. [Sean Cribbs]
+* Address CSRF vulnerabilities in forms. [Sean Cribbs]
+* Remove clear cache action, always clear cache after saving a page. [Sean 
+Cribbs]
+
 === 0.6.6 Chiseled
 * Make sure extension view paths override Radiant view paths. [Josh French]
 * Fix problem in framework.rake when public/javascripts/admin doesn't exist.

data/CONTRIBUTORS

@@ -4,6 +4,14 @@
 The following people have submitted changes which have been applied to the
 core:
 
+=== Edge
+* Thomas Watson Steen
+
+=== 0.6.7 Mordant
+* John Long
+* Josh French
+* Sean Cribbs
+
 === 0.6.6 Chiseled
 * Josh French
 * Sean Cribbs

data/app/controllers/admin/page_controller.rb

@@ -35,16 +35,6 @@ class Admin::PageController < Admin::AbstractModelController
     end
   end
 
-  def clear_cache
-    if request.post?
-      @cache.clear
-      announce_cache_cleared
-      redirect_to page_index_url
-    else
-      render :text => 'Do not access this URL directly.'
-    end
-  end
-
   def add_part
     part = PagePart.new(params[:part])
     @index = params[:index].to_i if params[:index]
@@ -120,6 +110,6 @@ class Admin::PageController < Admin::AbstractModelController
     end
     
     def clear_model_cache
-      @cache.expire_response(@old_page_url || @page.url)      
+      @cache.clear
     end
 end

data/app/controllers/admin/welcome_controller.rb

@@ -9,12 +9,11 @@ class Admin::WelcomeController < ApplicationController
     if request.post?
       login = params[:user][:login]
       password = params[:user][:password]
-      self.current_user = User.authenticate(login, password)
-      if current_user
-        redirect_to welcome_url
-      else
-        announce_invalid_user
-      end
+      announce_invalid_user unless self.current_user = User.authenticate(login, password)
+    end
+    if current_user
+      redirect_to (session[:return_to] || welcome_url)
+      session[:return_to] = nil
     end
   end
   

data/app/controllers/application.rb

@@ -5,6 +5,8 @@ class ApplicationController < ActionController::Base
   
   filter_parameter_logging :password, :password_confirmation
   
+  protect_from_forgery :secret => "sweet-harmonious-biscuits"
+  
   before_filter :set_current_user
   before_filter :set_javascripts_and_stylesheets
   

data/app/controllers/site_controller.rb

@@ -1,5 +1,6 @@
 class SiteController < ApplicationController
   session :off
+  skip_before_filter :verify_authenticity_token
   
   no_login_required
   

data/app/helpers/admin/page_helper.rb

@@ -30,4 +30,40 @@ module Admin::PageHelper
   def homepage
     @homepage ||= Page.find_by_parent_id(nil)
   end
+  
+  def page_edit_javascripts
+    <<-CODE
+    var last_type = "#{@page.class_name}";
+    function load_tag_reference(part) {
+      page_type = $F('page_class_name');
+      popup = $('tag-reference-popup');
+      if(last_type != page_type) {
+        url = "#{tag_reference_url}";
+        params = "class_name=" + page_type;
+        new Effect.Highlight('tag-reference-link-'+ part);
+        req = new Ajax.Request(url, { method: 'get', parameters: params, evalScripts: true });
+      } else {
+         center(popup);
+         Element.toggle(popup);
+      }
+      return false;
+    }
+    var last_filter = "#{default_filter_name}";
+    function load_filter_reference(part) {
+      filter_type = $F("part_" + part + "_filter_id");
+      popup = $('filter-reference-popup');
+      if(last_filter != filter_type) {
+        url = "#{filter_reference_url}";
+        params = "filter_name=" + filter_type;
+        new Effect.Highlight('filter-reference-link-'+ part);
+        req = new Ajax.Request(url, { method: 'get', parameters: params, evalScripts: true });
+      } else {
+        center(popup);
+        Element.toggle(popup);
+      }
+      return false;
+    }
+    
+    CODE
+  end
 end

data/app/helpers/admin/regions_helper.rb

@@ -0,0 +1,28 @@
+module Admin::RegionsHelper
+  def render_region(region, options={}, &block)
+    lazy_initialize_region_set    
+    default_partials = Radiant::AdminUI::RegionPartials.new(@template)
+    if block_given?
+      junk = capture(default_partials, &block) 
+      (options[:locals] ||= {}).merge!(:defaults => default_partials)
+    end
+    output = @region_set[region].compact.map do |partial|
+      begin
+        render options.merge(:partial => partial)
+      rescue ::ActionView::TemplateError => e # error in template
+        raise e
+      rescue ::ActionView::ActionViewError # couldn't find template
+        default_partials[partial]
+      end
+    end.join
+    block_given? ? concat(output, block.binding) : output
+  end
+  
+  def lazy_initialize_region_set
+    unless @region_set
+      @controller_name ||= @controller.controller_name
+      @template_name ||= File.basename(@first_render).split(".").last
+      @region_set = admin.send(@controller_name).send(@template_name)
+    end
+  end
+end

data/app/helpers/admin/user_helper.rb

@@ -1,2 +1,8 @@
 module Admin::UserHelper
+  def roles(user)
+    roles = []
+    roles << 'Administrator' if user.admin?
+    roles << 'Developer' if user.developer?
+    roles.join(', ')
+  end
 end

data/app/helpers/application_helper.rb

@@ -1,5 +1,6 @@
 module ApplicationHelper
   include LocalTime
+  include Admin::RegionsHelper
   
   def config
     Radiant::Config
@@ -121,7 +122,7 @@ module ApplicationHelper
     when :meta, :meta_less
       meta_errors?
     end
-    ' style="display: none"' unless v
+    v ? {} : {:style => "display:none"}
   end
   
   def meta_errors?

data/app/models/user.rb

@@ -25,18 +25,16 @@ class User < ActiveRecord::Base
   validates_length_of :email, :maximum => 255, :allow_nil => true, :message => '%d-character limit'
   
   validates_numericality_of :id, :only_integer => true, :allow_nil => true, :message => 'must be a number'
-  
-  cattr_accessor :salt
-  @@salt = 'sweet harmonious biscuits' # historic value
-  
+    
   attr_writer :confirm_password
   
-  def self.sha1(phrase)
-    Digest::SHA1.hexdigest("--#{@@salt}--#{phrase}--")
+  def sha1(phrase)
+    Digest::SHA1.hexdigest("--#{salt}--#{phrase}--")
   end
   
   def self.authenticate(login, password)
-    find_by_login_and_password(login, sha1(password))
+    user = find_by_login(login)
+    user if user && user.password == user.sha1(password)
   end
   
   def after_initialize
@@ -55,7 +53,8 @@ class User < ActiveRecord::Base
   
     before_create :encrypt_password
     def encrypt_password
-      self.password = self.class.sha1(password)
+      self.salt = Digest::SHA1.hexdigest("--#{Time.now}--#{login}--sweet harmonious biscuits--")
+      self.password = sha1(password)
     end
   
     before_update :encrypt_password_unless_empty_or_unchanged

data/app/views/admin/extension/index.html.haml

@@ -0,0 +1,28 @@
+- content_for :page_css do
+  :sass
+    table.index 
+      h4
+        font-size: 110%
+        margin-top: .5em
+        margin-bottom: .25em
+      p
+        margin-top: .25em
+        margin-bottom: .5em
+
+%h1 Extensions
+
+%table#extensions.index{:cellspacing=>"0", :border=>"0", :cellpadding=>"0"}
+  %thead
+    %tr
+      %th.extension Extension
+      %th.website Website
+      %th.version Version
+  %tbody
+    - @extensions.each do |extension|
+      %tr.node.level-1
+        %td.extension
+          %h4= h extension.extension_name
+          %p= h extension.description
+        %td.website
+          = extension.url.nil? || extension.url.empty? ? "" : link_to("Website", extension.url, :target => "_blank")
+        %td.version= h extension.version

data/app/views/admin/layout/edit.html.haml

@@ -0,0 +1,44 @@
+- render_region :main do |main|
+  - main.edit_header do
+    - if @layout.new_record?
+      %h1 New Layout
+    - else
+      %h1 Edit Layout
+  - main.edit_form do
+    - form_tag do
+      .form-area
+        = render_region :form_top
+        = hidden_field 'layout', 'lock_version'
+        - render_region :form do |form|
+          - form.edit_title do
+            %p.title
+              %label{:for=>"layout_name"} Name
+              = text_field 'layout', 'name', :maxlength => 100, :class => "textbox"
+          - form.edit_extended_metadata do
+            #extended-metadata.row{meta_visible(:meta)}
+              %table.fieldset{:cellpadding=>"0", :cellspacing=>"0", :border=>"0"}
+                %tr
+                  %th.label
+                    %label{:for=>"layout_content_type"} Content‑Type
+                  %td.field
+                    = text_field 'layout', 'content_type', :maxlength => 40, :class => "textbox"
+                = render_region :extended_metadata
+            %p.more-or-less
+              %small
+                %a#more-extended-metadata{meta_visible(:meta_more), :href => "#", :onclick=>toggle_javascript_for('extended-metadata')} More
+                %a#less-extended-metadata{meta_visible(:meta_less), :href => "#", :onclick=>toggle_javascript_for('extended-metadata')} Less
+          - form.edit_content do
+            %p.content
+              %label{:for=>"layout_content"} Body
+              ~ text_area 'layout', 'content', :size => '40x20', :style => 'width: 100%', :class => "textarea"
+          - form.edit_timestamp do
+            = updated_stamp @layout
+
+      = javascript_tag "$('layout_name').activate()"
+      - render_region :form_bottom do |form_bottom|
+        - form_bottom.edit_buttons do
+          %p.buttons
+            = save_model_button @layout
+            = save_model_and_continue_editing_button @layout
+            or
+            = link_to "Cancel", layout_index_url

data/app/views/admin/layout/index.html.haml

@@ -0,0 +1,25 @@
+%h1 Layouts
+
+%p
+  Use layouts to apply a visual look to a  Web page. Layouts can contain special tags to include
+  page content and other elements such as the header or footer. Click on a layout name below to
+  edit it or click <code>Remove</code> to delete it.
+
+%table#layouts.index{:cellspacing=>"0", :border=>"0", :cellpadding=>"0" }
+  %thead
+    %tr
+      %th.layout
+        Layout
+      %th.modify
+        Modify
+  %tbody
+    - @layouts.each do |layout|
+      %tr.node.level-1
+        %td.layout
+          = image('layout', :alt => 'layout-icon')
+          = link_to layout.name, layout_edit_url(:id => layout)
+        %td.remove
+          = link_to image('remove', :alt => 'Remove Layout'), layout_remove_url(:id => layout)
+
+%p
+  = link_to image('new-layout', :alt => "New Layout"), layout_new_url

data/app/views/admin/layout/remove.html.haml

@@ -0,0 +1,16 @@
+%h1 Remove Layout
+
+%p Are you sure you want to <strong class="warning">permanently remove</strong> the following layout?
+
+%table.index#layouts{:cellpadding=>0, :cellspacing=>0, :border=>0}
+  %tbody
+    %tr.node.level-1
+      %td.layout
+        = image('layout', :alt => 'layout-icon')
+        = h @layout.name
+
+- form_tag do
+  %p.buttons
+    %input.button{:type=>"submit", :value=>"Delete Layout"}/
+    or
+    = link_to 'Cancel', layout_index_url

data/app/views/admin/page/_meta_row.html.haml

@@ -0,0 +1,6 @@
+%tr
+  %th.label
+    %label{:for => "page_#{meta_row[:field]}"}
+      = meta_row[:label] || meta_row[:field].humanize
+  %td.field
+    = send(meta_row[:type], 'page', meta_row[:field], *meta_row[:args])

data/app/views/admin/page/_node.html.haml

@@ -0,0 +1,25 @@
+%tr.node{:id => "page-#{page.id}", :class =>"level-#{level}#{children_class}#{virtual_class}"}
+  - render_region :node, :locals => {:page => page, :level => level, :simple => simple} do |node|
+    - node.title_column do
+      %td.page{:style => "padding-left: #{padding_left(level)}px"}
+        %span.w1
+          - if simple
+            = icon
+            = node_title
+          - else
+            = expander + link_to("#{icon} #{node_title}", page_edit_url(:id => page), :title => page.url)
+            = page_type
+            = spinner
+    - node.status_column do
+      - unless simple
+        %td.status{:class => "#{page.status.name.downcase}-status"}= page.status.name
+    - node.add_child_column do
+      - unless simple
+        %td.add-child= link_to image('add-child', :alt => 'add child'), page_new_url(:parent_id => page)
+    - node.remove_column do
+      - unless simple
+        %td.remove= link_to image('remove', :alt => 'remove page'), page_remove_url(:id => page)
+
+- if expanded
+  - page.children.each do |child|
+    = render_node child, :level => level + 1, :simple => simple

data/app/views/admin/page/_part.html.haml

@@ -0,0 +1,17 @@
+- @index ||= 0
+.page{:id => "page-#{@index+1}"}
+  .part{:id => "part-#{@index+1}"}
+    = hidden_field_tag "part[#{@index}][name]", part.name, :id => "part_#{@index}_name"
+    %p
+      %label{:for => "part_#{@index}_filter_id"} Filter
+      = select_tag "part[#{@index}][filter_id]", options_for_select([['<none>', '']] + TextFilter.descendants.map { |s| s.filter_name }.sort, part.filter_id), :id => "part_#{@index}_filter_id"
+      %span#reference-links
+        Reference:
+        %span{:id => "filter-reference-link-#{@index}"}
+          = link_to_function "Filter", "load_filter_reference(#{@index});"
+        %span{:id => "tag-reference-link-#{@index}"}
+          = link_to_function 'Available Tags', "load_tag_reference(#{@index});"
+      = render_region :part_controls
+    %div
+      ~ text_area_tag "part[#{@index}][content]", h(part.content), :class => "textarea", :style => "width: 100%", :id => "part_#{@index}_content"
+- @index += 1

data/app/views/admin/page/_tag_reference.html.haml

@@ -0,0 +1,3 @@
+.tag-description
+  %h4= "<r:#{tag_name} />"
+  %div= description

data/app/views/admin/page/children.html.haml

@@ -0,0 +1,2 @@
+- @parent.children.each do |child|
+  = render_node child, :expand => 1, :level => @level + 1

data/app/views/admin/page/edit.html.haml

@@ -0,0 +1,114 @@
+- content_for 'page_scripts', page_edit_javascripts
+- content_for 'page_css' do
+  :sass
+    #content
+      #extended-metadata
+        .fieldset
+          margin-left: 0
+          margin-right: 0
+          margin-bottom: .5em
+          padding: 0
+          td.label
+            text-align: left
+            width: 15%
+            .textbox
+              width: 90%
+- render_region :main do |main|
+  - main.edit_header do
+    - if @page.new_record?
+      %h1 New Page
+    - else
+      %h1 Edit Page
+  - main.edit_form do
+    - form_tag({}, {:multipart => true}) do
+      = hidden_field 'page', 'lock_version'
+      = render_region :form_top
+      .form-area
+        - render_region :form do |form|
+          - form.edit_title do
+            %p.title
+              %label{:for=>"page_title"}
+                Page Title
+              = text_field "page", "title", :class => 'textbox', :maxlength => 255
+          - form.edit_extended_metadata do
+            #extended-metadata.row{meta_visible(:meta)}
+              %table.fieldset
+                = render :partial => "meta_row", :collection => @meta
+                = render_region :extended_metadata
+            %p.more-or-less
+              %small
+                %a#more-extended-metadata{meta_visible(:meta_more), :href => "#", :onclick=>toggle_javascript_for('extended-metadata')} More
+                %a#less-extended-metadata{meta_visible(:meta_less), :href => "#", :onclick=>toggle_javascript_for('extended-metadata')} Less
+          - form.edit_page_parts do
+            #tab-control
+              #tabs.tabs
+                #tab-toolbar
+                  = link_to_function image('plus', :alt => 'plus'), 'toggle_add_part_popup()', :title => 'Add Tab'
+                  = link_to_function image('minus', :alt => 'minus'), 'if(confirm(\'Delete the current tab?\')) { tabControl.removeTab(tabControl.selected) }', :title => 'Remove Tab'
+
+              #pages.pages
+                = render :partial => 'part', :collection => @page.parts
+            - render_region :parts_bottom do |parts_bottom|
+              - parts_bottom.edit_layout_and_type do
+                .row
+                  %p
+                    %label{:for=>"page_layout_id"}
+                      Layout
+                    = select "page", "layout_id", [['<inherit>', '']] + Layout.find(:all).map { |s| [s.name, s.id] }
+                  %p
+                    %label{:for=>"page_class_name"}
+                      Page Type
+                    = select "page", "class_name", [['<normal>', 'Page']] + Page.descendants.map { |p| [p.display_name, p.name] }.sort_by { |p| p.first }
+                  %p
+                    %label{:for=>"page_status_id"}
+                      Status
+                    = select "page", "status_id", Status.find_all.map { |s| [s.name, s.id] }, {}
+                  %p#publication-date{:style => "display: none"}
+                    %label{:for=>"page_published_at"}
+                      Published At
+                    = datetime_select "page", "published_at", :disabled => true
+                  = render_region :layout_row
+                %span.clear &nbsp;
+              - parts_bottom.edit_timestamp do
+                = updated_stamp @page
+      - render_region :form_bottom do |form_bottom|
+        - form_bottom.edit_buttons do
+          - @buttons_partials.each do |partial|
+            = render :partial => partial
+          %p.buttons
+            = save_model_button(@page)
+            = save_model_and_continue_editing_button(@page)
+            or
+            = link_to 'Cancel', page_index_url
+  - main.edit_popups do
+    - content_for 'popups' do
+      #add-part-popup.popup{:style => "display: none"}
+        #busy.busy{:style => "display: none"}= image 'spinner.gif'
+        %h3 Add Part
+        - form_remote_tag(:url => page_add_part_url, :update => "pages", :position => :bottom, :loading => 'part_loading()', :complete => 'part_added()', :condition => 'valid_part_name()') do
+          %div
+            = hidden_field_tag 'index', @index, :id => 'part-index-field'
+            = text_field_tag "part[name]", "", :id => 'part-name-field', :maxlength => 100
+            = submit_tag "Add Part", :id => 'add-part-button'
+          %p
+            = link_to_function 'Close', "$(this).up('.popup').hide()", :class => 'close-link'
+
+      #tag-reference-popup.popup{ :style => "display:none;" }
+        %div{ :style => "float:right" }
+          %label{:for=> 'search-tag-reference'} Search Tags:
+          %input#search-tag-reference{ :type => "text" }/
+        %h3
+          Available Tags for
+          %span#page-type= @page.class.display_name
+        #tag-reference= tag_reference(@page.class.name)
+        %p
+          = link_to 'Close', '#', :class => 'close'
+
+      #filter-reference-popup.popup{ :style => "display:none;" }
+        %h3
+          %span#filter-type= default_filter_name
+          Reference
+        #filter-reference= filter_reference(default_filter_name)
+        %p
+          = link_to_function 'Close', "Element.hide('filter-reference-popup')", :class => 'close-link'
+      = render_region :popups