refinerycms-pages 3.0.3 → 3.0.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 4933d54bda49d54b6458ba369411b14d07c4296d
-  data.tar.gz: 7d9b0ffdaa544522cd7e58c2aa262795ba722ae2
+  metadata.gz: f8308e3073c942d0214a2decd15f895cb59337a2
+  data.tar.gz: 7bdadb6128ddc13e5bc6d82417bd6aa8218f22fe
 SHA512:
-  metadata.gz: 7930a05fc308a3d86bfb85e606bcdd8e672c6c44aed78ba99ca47aff029421cde7031fa766a3d0f23c8941944f20c49adc5eada1dd797b37f57bc566e1890104
-  data.tar.gz: 3e26bcbe3eb57580e81276f6e1750081b1c72f07fde92387692094d8aefe59cd212eb1768c0ffd5476cb427a104efbb0319e8208fe5b222363826bde76bbccbd
+  metadata.gz: ab53d5bb3c0f277efae545eb8ad0fe8baf2d2f7ef6c5d2839647c6bae25b9835bf6b8fe7c98553614051b9b75b0f6546fd6f5bc7250554cd1496d8e723eda8cd
+  data.tar.gz: 78d2d2482e752f92ec9c5ba6288e7c5d90986b363075fd1e8992d520f8c182dddf8959366f94c7e4b8400cb1f1f58ce3f31286fa035922faa741a6ae89b10d82

data/app/controllers/refinery/admin/pages_controller.rb

@@ -108,7 +108,7 @@ module Refinery
         nested_url = page.nested_url
         {
           new_refinery_edit_page_path: refinery.admin_edit_page_path(nested_url),
-          new_refinery_page_path: refinery.admin_page_path(nested_url),
+          new_refinery_page_path: refinery.admin_update_page_path(nested_url),
           new_page_path: refinery.pages_admin_preview_page_path(nested_url)
         }
       end

data/app/controllers/refinery/pages/admin/preview_controller.rb

@@ -10,8 +10,6 @@ module Refinery
 
         skip_before_action :error_404, :set_canonical
 
-        layout :layout
-
         def show
           render_with_templates?
         end
@@ -33,16 +31,18 @@ module Refinery
         end
         alias_method :page, :find_page
 
-        def layout
-          'application'
+        def page_params
+          params.require(:page).permit(permitted_page_params)
         end
 
-        def page_params
-          params.require(:page).permit(
+        private
+
+        def permitted_page_params
+          [
             :browser_title, :draft, :link_url, :menu_title, :meta_description,
             :parent_id, :skip_to_first_child, :show_in_menu, :title, :view_template,
-            :layout_template, parts_attributes: [:id, :title, :body, :position]
-          )
+            :layout_template, :custom_slug, parts_attributes: [:id, :title, :slug, :body, :position]
+          ]
         end
       end
     end

data/app/controllers/refinery/pages_controller.rb

@@ -68,12 +68,7 @@ module Refinery
     end
 
     def find_page(fallback_to_404 = true)
-      @page ||= case action_name
-                when "home"
-                  Refinery::Page.find_by(link_url: '/')
-                when "show"
-                  Refinery::Page.friendly.find_by_path_or_id(params[:path], params[:id])
-                end
+      @page ||= action_page_finder.call(params) if action_has_page_finder?
       @page || (error_404 if fallback_to_404)
     end
 
@@ -89,5 +84,28 @@ module Refinery
         cache_page(response.body, File.join('', 'refinery', 'cache', 'pages', request.path).to_s)
       end
     end
+
+    private
+    def action_has_page_finder?
+      Finders.const_defined? action_name.classify
+    end
+
+    def action_page_finder
+      Finders.const_get action_name.classify
+    end
+
+    module Finders
+      class Home
+        def self.call(_params)
+          Refinery::Page.find_by link_url: "/"
+        end
+      end
+
+      class Show
+        def self.call(params)
+          Refinery::Page.friendly.find_by_path_or_id params[:path], params[:id]
+        end
+      end
+    end
   end
 end

data/app/helpers/refinery/admin/pages_helper.rb

@@ -40,6 +40,14 @@ module Refinery
           ::I18n.t('hidden', :scope => 'refinery.admin.pages.page')
         end unless page.show_in_menu?
 
+        meta_information << content_tag(:span, :class => 'label') do
+          ::I18n.t('skip_to_first_child', :scope => 'refinery.admin.pages.page')
+        end if page.skip_to_first_child?
+
+        meta_information << content_tag(:span, :class => 'label') do
+          ::I18n.t('redirected', :scope => 'refinery.admin.pages.page')
+        end if page.link_url?
+
         meta_information << content_tag(:span, :class => 'label notice') do
           ::I18n.t('draft', :scope => 'refinery.admin.pages.page')
         end if page.draft?

data/app/presenters/refinery/pages/section_presenter.rb

@@ -1,3 +1,5 @@
+require 'diffy'
+
 module Refinery
   module Pages
     # Knows how to build the html for a section. A section is part of the visible html, that has
@@ -48,7 +50,7 @@ module Refinery
         "no_#{id}"
       end
 
-    protected
+      protected
 
       def content_html(can_use_fallback)
         override_html.presence || html_from_fallback(can_use_fallback)
@@ -58,17 +60,49 @@ module Refinery
         fallback_html.presence if can_use_fallback
       end
 
-    private
+      private
 
       attr_writer :id, :fallback_html, :hidden
 
       def wrap_content_in_tag(content)
-        content = sanitize(content,
-          tags: Refinery::Pages::whitelist_elements,
-          attributes: Refinery::Pages::whitelist_attributes
-        )
-        content_tag(:section, content_tag(:div, content, :class => 'inner'), :id => id)
+        content_tag(:section, content_tag(:div, sanitize_content(content), :class => 'inner'), :id => id)
+      end
+
+      def sanitize_content(input)
+        output = sanitize(input, scrubber: CustomScrubber.new(Refinery::Pages::whitelist_elements,
+                                                              Refinery::Pages::whitelist_attributes))
+
+        if input != output
+          warning = "\n-- SANITIZED CONTENT WARNING --\n"
+          warning << "Refinery::Pages::SectionPresenter#wrap_content_in_tag\n"
+          warning << "HTML attributes and/or elements content has been sanitized\n"
+          warning << "#{::Diffy::Diff.new(input, output).to_s(:color)}\n"
+          warn warning
+        end
+
+        return output
+      end
+    end
+
+    class CustomScrubber < Rails::Html::PermitScrubber
+      def initialize(tags, attributes)
+        @direction = :bottom_up
+        @tags = tags
+        @attributes = attributes
+      end
+
+      def allowed_node?(node)
+        tags.include?(node.name)
+      end
+
+      def skip_node?(node)
+        node.text?
+      end
+
+      def scrub_attribute?(name)
+        attributes.exclude?(name) && name !~ /\Adata-[\w-]+\z/
       end
+
     end
   end
 end

data/app/views/refinery/admin/pages/_page.html.erb

@@ -4,7 +4,7 @@
   delete_url = refinery.admin_delete_page_path(page.nested_url)
   delete_options = {
      class: "cancel confirm-delete",
-            data: {confirm: t('message',  scope: 'refinery.admin.delete', title: page_title_with_translations(page))}
+            data: {confirm: t('message',  scope: 'refinery.admin.delete', title: translated_field(page, :title))}
           }
  %>
 

data/app/views/refinery/admin/pages_dialogs/_page_link.html.erb

@@ -11,7 +11,7 @@
                 :rel => page_link.title,
                 :class => 'page_link'
               }.merge(link_args) do %>
-    <%= page_title_with_translations page_link %>
+    <%= translated_field(page_link, :title) %>
     <%= page_meta_information page_link %>
   <% end %>
 </li>

data/config/locales/en.yml

@@ -37,9 +37,11 @@ en:
         new: Add a new child page
         expand_collapse: Expand or collapse sub pages
         page:
-          view_live_html: View this page live <br/><em>(opens in a new window)</em>
-          hidden: hidden
           draft: draft
+          hidden: hidden
+          redirected: Redirected
+          skip_to_first_child: Skip to first child
+          view_live_html: View this page live <br/><em>(opens in a new window)</em>
         form:
           preview: Preview
           preview_changes: Preview your changes before making them live

data/config/locales/ru.yml

@@ -3,7 +3,6 @@ ru:
     plugins:
       refinery_pages:
         title: Страницы
-        article: feminine
         description: Управление страницами с содержимым
     admin:
       pages_dialogs:
@@ -38,14 +37,17 @@ ru:
         new: Добавить новую подстраницу
         expand_collapse: Развернуть или свернуть подстраницу
         page:
-          view_live_html: Показать эту страницу вживую <br/><em>(откроется в новом окне)</em>
-          hidden: скрытая
           draft: черновик
+          hidden: скрытая
+          redirected: Перенаправлена
+          skip_to_first_child: Пропуск страницы верхнего уровня
+          view_live_html: Показать эту страницу вживую <br/><em>(откроется в новом окне)</em>
         form:
           preview: Посмотреть
           preview_changes: Посмотреть свои изменения перед сохранением
         form_new_page_parts:
           title: Заголовок
+          slug: Slug
         form_page_parts:
           create_content_section: Добавить колонку
           delete_content_section: Удалить колонку

data/lib/generators/refinery/pages/templates/config/initializers/refinery/pages.rb.erb

@@ -66,7 +66,13 @@ Refinery::Pages.configure do |config|
 
   # config.show_title_in_body = <%= Refinery::Pages.show_title_in_body.inspect %>
 
+  # You can add new HTML elements not already supported by Loofah::HTML5::WhiteList::ALLOWED_ELEMENTS
+  # For more information on whitelist see ALLOWED_ELEMENTS 
+  # (https://github.com/flavorjones/loofah/blob/v2.0.3/lib/loofah/html5/whitelist.rb#L151)
   # config.add_whitelist_elements = <%= Refinery::Pages.add_whitelist_elements.inspect %>
-
+  
+  # You can add new HTML attributes not already supported by Loofah::HTML5::WhiteList::ALLOWED_ATTRIBUTES
+  # For more information on whitelist see ALLOWED_ATTRIBUTES 
+  # (https://github.com/flavorjones/loofah/blob/v2.0.3/lib/loofah/html5/whitelist.rb#L152)
   # config.add_whitelist_attributes = <%= Refinery::Pages.add_whitelist_attributes.inspect %>
 end

data/lib/refinery/pages/configuration.rb

@@ -23,6 +23,7 @@ module Refinery
     self.cache_pages_full = false
     self.layout_template_whitelist = ["application"]
     self.add_whitelist_elements = %w[ source track ]
+    # Note: "data-" attributes are whitelisted by default. See https://github.com/refinery/refinerycms/pull/3187
     self.add_whitelist_attributes = %w[ kind srclang placeholder controls ]
 
 

data/refinerycms-pages.gemspec

@@ -26,6 +26,12 @@ Gem::Specification.new do |s|
   s.add_dependency 'refinerycms-core',            version
   s.add_dependency 'babosa',                      '!= 0.3.6'
   s.add_dependency 'speakingurl-rails',           '~> 8.0.0'
+  s.add_dependency 'diffy',                       '~> 3.1.0'
 
   s.required_ruby_version = Refinery::Version.required_ruby_version
+
+  s.cert_chain  = [File.expand_path("../../certs/parndt.pem", __FILE__)]
+  if $0 =~ /gem\z/ && ARGV.include?("build") && ARGV.include?(__FILE__)
+    s.signing_key = File.expand_path("~/.ssh/gem-private_key.pem")
+  end
 end

data/spec/features/refinery/admin/pages_spec.rb

@@ -193,16 +193,19 @@ module Refinery
       end
 
       describe "edit/update" do
-        before do
-          Page.create :title => "Update me"
+        let(:updateable_page_parent) { Page.create title: "Parent page" }
+        let!(:updateable_page) {
+          updateable_page_parent.children.create title: "Update me"
+        }
 
+        before do
           visit refinery.admin_pages_path
           expect(page).to have_content("Update me")
         end
 
         context 'when saving and returning to index' do
-          it "updates page", js:true do
-            find('a[tooltip="Edit this page"]').trigger(:click)
+          it "updates page", js: true do
+            find("a[href$='#{updateable_page.slug}/edit']").trigger(:click)
 
             fill_in "Title", :with => "Updated"
             find("#submit_button").click
@@ -211,25 +214,33 @@ module Refinery
           end
         end
 
-        context 'when saving and continuing to edit' do
+        context 'when saving and continuing to edit', js: true do
           before :each do
-            expect(page).to have_selector('a[tooltip^=Edit]', visible: true)
-            find('a[tooltip^=Edit]').click
+            expect(page).to have_selector("a[href$='#{updateable_page.slug}/edit']", visible: true)
+            find("a[href$='#{updateable_page.slug}/edit']").click
 
-            fill_in "Title", :with => "Updated"
+            fill_in "Title", :with => "Updated you"
             find("#submit_continue_button").click
             find('#flash').visible?
           end
 
-          it "updates page", js: true do
-            expect(page).to have_content("'Updated' was successfully updated.")
+          it "updates page" do
+            expect(page).to have_content("'Updated you' was successfully updated.")
+          end
+
+          # Regression test for https://github.com/refinery/refinerycms/issues/3179
+          # We expect this to end with /updated-you rather than /updated%2Fyou
+          it "doesn't have an encoded URL" do
+            updateable_page.reload # the slug will be different now
+            expect(page).not_to have_selector("form[action$='%2F#{updateable_page.slug}']")
+            expect(page).to have_selector("form[action$='/#{updateable_page.slug}']")
           end
 
           # Regression test for https://github.com/refinery/refinerycms/issues/1892
           context 'when saving to exit (a second time)' do
-            it 'updates page', js: true do
+            it 'updates page' do
               find("#submit_button").click
-              expect(page).to have_content("'Updated' was successfully updated.")
+              expect(page).to have_content("'Updated you' was successfully updated.")
             end
           end
         end

data/spec/features/refinery/pages_spec.rb

@@ -332,6 +332,7 @@ module Refinery
 
         within ".active * > .selected a" do
           expect(page).to have_content(child_page.title)
+          expect(page).to_not have_content(::I18n.t('skip_to_first_child', scope: 'refinery.skip_to_first_child_page_message'))
         end
       end
     end

data/spec/helpers/refinery/pages/admin/pages_helper_spec.rb

@@ -63,6 +63,26 @@ module Refinery
           end
         end
 
+        context "when skip_to_first_child is true" do
+          it "adds 'skip to first child' label" do
+            page.skip_to_first_child = true
+
+            expect(helper.page_meta_information(page)).to eq(
+              %Q{<span class="label">#{::I18n.t('refinery.admin.pages.page.skip_to_first_child')}</span>}
+            )
+          end
+        end
+
+        context "when link_url is present" do
+          it "adds 'redirected' label" do
+            page.link_url = '/redirect'
+
+            expect(helper.page_meta_information(page)).to eq(
+              %Q{<span class="label">#{::I18n.t('refinery.admin.pages.page.redirected')}</span>}
+            )
+          end
+        end
+
         context "when draft is true" do
           it "adds 'draft' label" do
             page.draft = true

data/spec/presenters/refinery/pages/section_presenter_spec.rb

@@ -2,8 +2,6 @@ require "spec_helper"
 
 module Refinery
   module Pages
-
-
     describe SectionPresenter do
       it "can build a css class for when it is not present based on id" do
         section = SectionPresenter.new(:fallback_html => 'foobar', :id => 'mynode')
@@ -28,6 +26,14 @@ module Refinery
       end
 
       describe "when building html for a section" do
+        before do
+          @errors = StringIO.new
+          @old_err = $stderr
+          $stderr = @errors
+        end
+
+        after(:each) { $stderr = @old_err }
+
         it "wont show a hidden section" do
           section = SectionPresenter.new(:fallback_html => 'foobar', :hidden => true)
           expect(section.has_content?(true)).to be_falsey
@@ -47,7 +53,6 @@ module Refinery
           expect(section.wrapped_html(true)).to xml_eq('<section id="mynode"><div class="inner">foobar</div></section>')
         end
 
-
         # Regression tests for https://github.com/refinery/refinerycms-inquiries/issues/168
         describe "#whitelist_elements" do
           context "when an element is not in a whitelist" do
@@ -95,6 +100,28 @@ module Refinery
               )
             end
           end
+
+          context 'data attributes' do
+            it 'all data attributes passed thru' do
+              section = SectionPresenter.new
+              section.override_html = %Q{<a data-foo-bar="value"></a>}
+              expect(section.wrapped_html(true)).to xml_eq(
+                  %Q{<section><div class="inner"><a data-foo-bar="value"></a></div></section>}
+              )
+            end
+          end
+        end
+
+        describe "#sanitize_content" do
+          it "shows a sanitized content warning" do
+            section = SectionPresenter.new
+            section.override_html = %Q{<dummy></dummy>}
+            section.wrapped_html(true)
+            @errors.rewind
+            expect(@errors.read).to eq(
+              %Q{\n-- SANITIZED CONTENT WARNING --\nRefinery::Pages::SectionPresenter#wrap_content_in_tag\nHTML attributes and/or elements content has been sanitized\n\e[31m-<dummy></dummy>\e[0m\n\\n\n}
+            )
+          end
         end
 
         describe "if allowed to use fallback html" do

data.tar.gz.sig

@@ -0,0 +1,2 @@
+O��������w�]�!3|�e�umğ�3�C�w�c6�^����<�F��n#�5�2ě�̎��K��!�*6��{:Rn�ބ~���_����i��K����Q.�y���fC�|�;��T'F+i����GY���%�;|�yŬ����
+xU�ꭙc�3����\��$��u&���+Pե#i�ua��g�GL��F�Z��	V��S���r)�Sb�n��[��!�3W.oɸ�m��"��9�x

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: refinerycms-pages
 version: !ruby/object:Gem::Version
-  version: 3.0.3
+  version: 3.0.4
 platform: ruby
 authors:
 - Philip Arndt
@@ -9,8 +9,30 @@ authors:
 - Rob Yurkowski
 autorequire: 
 bindir: bin
-cert_chain: []
-date: 2016-04-27 00:00:00.000000000 Z
+cert_chain:
+- |
+  -----BEGIN CERTIFICATE-----
+  MIIDhjCCAm6gAwIBAgIBATANBgkqhkiG9w0BAQUFADBNMQ0wCwYDVQQDDARnZW1z
+  MREwDwYKCZImiZPyLGQBGRYBcDEVMBMGCgmSJomT8ixkARkWBWFybmR0MRIwEAYK
+  CZImiZPyLGQBGRYCaW8wHhcNMTYwNjEwMDMwNjQyWhcNMTcwNjEwMDMwNjQyWjBN
+  MQ0wCwYDVQQDDARnZW1zMREwDwYKCZImiZPyLGQBGRYBcDEVMBMGCgmSJomT8ixk
+  ARkWBWFybmR0MRIwEAYKCZImiZPyLGQBGRYCaW8wggEiMA0GCSqGSIb3DQEBAQUA
+  A4IBDwAwggEKAoIBAQDMLLiiRX/NrRDQxcNO/bPNe51IhKeyACDjTTx0VGCG696t
+  qdD23FjUrAYuQTW5P7Auh9qdcCnvPHJSwf31m+EGTshy/hcNYz2k/mrbwAfdytv3
+  GAR+sFnMYtWvVQNeHBWXIaYMiSDP0WtbT6QqQx3SuA6ZpXNXD1dbm64MzHgMHqXP
+  uHnLf2s0VCnTLorPH2J6CO5Y+Sx+IBqJi9/nO2oEEIXQCQRLgRevHk+TovDisW5V
+  OMEPX7fo29R5J2T7mjkNLGJ5Ae1KiU9A60LsMco37HMWE8DM90pg1ues5tg6MfJT
+  yuX4N0rJWdIC5ciHDsyJ4pi21s8fdUulk0YmJALDAgMBAAGjcTBvMAkGA1UdEwQC
+  MAAwCwYDVR0PBAQDAgSwMB0GA1UdDgQWBBSqXg48+kmcdOxIrkZhhgSV1flD1jAa
+  BgNVHREEEzARgQ9nZW1zQHAuYXJuZHQuaW8wGgYDVR0SBBMwEYEPZ2Vtc0BwLmFy
+  bmR0LmlvMA0GCSqGSIb3DQEBBQUAA4IBAQBSSS4nOXpPPMdAK4ApGHxbzS+/u77p
+  V8gLBJX4hKMpbMNmdI+n6YsqvG6kMljgYBamucfrAkKdmHWn9ydST3o8RQAcYxS8
+  bz49gD3c4Nm4P6eEVKFmebO9/MoiM7rMb0lk/xH1drtey/9ulohrg8Dz+BoQJ+9T
+  m2lJzojOU7w461lPVZtKlDlseu68KvEQ2AdUBBa1b6w3S/EFkcdhErOT7dyQpePI
+  +wsbjPvdIWsjWQMn6MasZYIVTnenwP2jg+z9HSNxW0NL2vZx8VabpsWGWfrb+koj
+  rE1h12GTgwaC3r9FOkdnSpClgPYAzTTCJ8kD74qO2zC9pGegrUXdWFM6
+  -----END CERTIFICATE-----
+date: 2016-07-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: friendly_id
@@ -86,14 +108,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 3.0.3
+        version: 3.0.4
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 3.0.3
+        version: 3.0.4
 - !ruby/object:Gem::Dependency
   name: babosa
   requirement: !ruby/object:Gem::Requirement
@@ -122,6 +144,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: 8.0.0
+- !ruby/object:Gem::Dependency
+  name: diffy
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 3.1.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 3.1.0
 description: The default content extension of Refinery CMS. This extension handles
   the administration and display of user-editable pages.
 email: refinerycms@p.arndt.io