redpen-rails 0.1.0 → 0.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 39dd26115a7ab4e0acfeda34e39d2a3f663d441d3f7301985df839bc1bef8889
-  data.tar.gz: be286165894bce577539b1ab7438f2b9041d8c90771a9cc535b310a5616f1552
+  metadata.gz: 28bef384bf0816760a2312e367eb019fe05615fb2fc3dc214785f354bc8608e3
+  data.tar.gz: b9ac0d19df074e91d0a494c1eb3d23113e11a3023bc842e6a49d944b435442e9
 SHA512:
-  metadata.gz: 9db7f16ee197699140d766ea670df403bc51c24065e3ba1d618a92a2bd052df93c77158eaaf4e5d5dd6332f64d6ed9dd86a4ed215cbf15443570b89a389baecf
-  data.tar.gz: 1ca4e0ff51280541db1c08eb9928f32890acee01d177b6492f18ac5ed80ecb7ad692e2506cda6f96a583577f584977514fce5d95c77f82cee1d7a168345d8e6a
+  metadata.gz: 3c6c9601879d15fd5b46636bb8a1285698666fae5a363f9cbfd7b0566fc2b0866de0a4757d82c863fc0aa5003bed64f2f318bcf980dc49006dd4c84e8ddf32f1
+  data.tar.gz: 6987d5b87a81e471c58fd0d83a7100e0ed33c5a59556dcbfa97a5d8b55d1f27227f4465b3d37a09e8f326d66b458a6df4185c26e770567d7f0c5247051af646f

data/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.1.2 — 2026-09-18
+
+**Security.** `NotesController` asked `Redpen.annotatable` about `params[:path]` whenever the query named one, while `create` wrote the note to `note[path]` and `destroy` removed whatever note the id named. A signed-in author allowed on any one page could therefore add a note to, or delete a note from, a page they may not pen, by naming their own page in the query. The gate now asks about the page the request actually touches: the query's path for the index, the note's own path for create and destroy. Resolving and reopening were never affected. Found reviewing Curated Connections' landing pages.
+
+## 0.1.1 — 2026-09-16
+
+Helpers register in `to_prepare` instead of an engine initializer. A host that loads `ActionController::Base` during boot (Curated Connections requires a lib from `application.rb` that does) fired the `on_load` hook before the autoloader existed, and `Redpen::RailHelper` failed to resolve. Found on the first day of the second host.
+
 ## 0.1.0 — 2026-09-16
 
 First extraction, from nityesh.com. Notes pinned to elements by path + CSS selector, a pen UI as one Stimulus controller, resolve/reopen as a resolution resource, `redpen_rail` and `redpen_inject` helpers, `redpen:install` and `redpen:views` generators. Sprockets and Propshaft, import maps only.

data/app/controllers/redpen/notes_controller.rb

@@ -26,8 +26,15 @@ module Redpen
         @note ||= Note.find(params[:id])
       end
 
+      # The page the gate is asked about is the page this request reads or writes: the
+      # query's path for the index, the note's own path for create and destroy. Taking it
+      # from anywhere else would let a request pass the gate for one page and land on another.
       def path
-        @path ||= params[:path].presence || params.dig(:note, :path).presence || note.path
+        @path ||= case action_name
+          when "index"  then params[:path]
+          when "create" then note_params[:path]
+          else note.path
+        end
       end
 
       def note_params

data/lib/redpen/engine.rb

@@ -25,8 +25,12 @@ module Redpen
       end
     end
 
-    # `redpen_rail` and `redpen_inject` in every host view and controller.
-    initializer "redpen.helpers" do
+    # `redpen_rail` and `redpen_inject` in every host view and controller. Not an
+    # initializer: a host that loads ActionController::Base at boot (an initializer
+    # referencing it, a lib required from application.rb) would fire the hook before
+    # the autoloader exists, and Redpen::RailHelper would not resolve. to_prepare runs
+    # once the autoloader is up, and again on every reload in development.
+    config.to_prepare do
       ActiveSupport.on_load(:action_controller_base) { helper Redpen::RailHelper }
     end
   end

data/lib/redpen/version.rb

@@ -1,3 +1,3 @@
 module Redpen
-  VERSION = "0.1.0"
+  VERSION = "0.1.2"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: redpen-rails
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.2
 platform: ruby
 authors:
 - Nityesh Agarwal