spina 2.12.0 → 2.13.0

data/app/presenters/spina/menu_presenter.rb

@@ -8,13 +8,13 @@ module Spina
 
     # Configuration
     config_accessor :menu_tag, :menu_css,
-                    :list_tag, :list_css,
-                    :list_item_tag, :list_item_css,
-                    :link_tag_css,
-                    :active_list_item_css,
-                    :current_list_item_css,
-                    :include_drafts,
-                    :depth # root nodes are at depth 0
+      :list_tag, :list_css,
+      :list_item_tag, :list_item_css,
+      :link_tag_css,
+      :active_list_item_css,
+      :current_list_item_css,
+      :include_drafts,
+      :depth # root nodes are at depth 0
 
     # Default configuration
     self.menu_tag = :nav
@@ -32,67 +32,67 @@ module Spina
 
     private
 
-      def roots
-        return collection.navigation_items.roots if collection.is_a?(Navigation)
-        collection.roots
-      end
+    def roots
+      return collection.navigation_items.roots if collection.is_a?(Navigation)
+      collection.roots
+    end
 
-      def render_menu(collection)
-        content_tag(menu_tag, class: menu_css) do
-          render_items(scoped_collection(collection))
-        end
+    def render_menu(collection)
+      content_tag(menu_tag, class: menu_css) do
+        render_items(scoped_collection(collection))
       end
+    end
 
-      def render_items(collection)
-        content_tag(list_tag, class: list_css) do
-          collection.inject(ActiveSupport::SafeBuffer.new) do |buffer, item|
-            buffer << render_item(item)
-          end
+    def render_items(collection)
+      content_tag(list_tag, class: list_css) do
+        collection.inject(ActiveSupport::SafeBuffer.new) do |buffer, item|
+          buffer << render_item(item)
         end
       end
+    end
 
-      def render_item(item)
-        return nil unless item.materialized_path
+    def render_item(item)
+      return nil unless item.materialized_path
 
-        children = scoped_collection(item.children)
+      children = scoped_collection(item.children)
 
-        content_tag(list_item_tag, class: item_css(item), data: { page_id: item.page_id, draft: (true if item.draft?) }) do
-          buffer = ActiveSupport::SafeBuffer.new
-          buffer << link_to(item.menu_title, item.materialized_path, class: link_tag_css)
-          buffer << render_items(children) if render_children?(item) && children.any?
-          buffer
-        end
+      content_tag(list_item_tag, class: item_css(item), data: {page_id: item.page_id, draft: (true if item.draft?)}) do
+        buffer = ActiveSupport::SafeBuffer.new
+        buffer << link_to(item.menu_title, item.materialized_path, class: link_tag_css)
+        buffer << render_items(children) if render_children?(item) && children.any?
+        buffer
       end
+    end
 
-      def scoped_collection(collection)
-        scoped = collection.regular_pages.active.in_menu.sorted
-        include_drafts ? scoped : scoped.live
-      end
+    def scoped_collection(collection)
+      scoped = collection.regular_pages.active.in_menu.sorted
+      include_drafts ? scoped : scoped.live
+    end
 
-      def render_children?(item)
-        return true unless depth
-        item.depth < depth
-      end
-      
-      def item_css(item)
-        return current_list_item_css if apply_current_css?(item)
-        return active_list_item_css if apply_active_css?(item)
-        list_item_css
-      end
+    def render_children?(item)
+      return true unless depth
+      item.depth < depth
+    end
 
-      def apply_current_css?(item)
-        return false if current_list_item_css.nil?
-        Spina::Current.page == item
-      end
+    def item_css(item)
+      return current_list_item_css if apply_current_css?(item)
+      return active_list_item_css if apply_active_css?(item)
+      list_item_css
+    end
 
-      def apply_active_css?(item)
-        return false if apply_current_css?(item)
-        parent_of_current?(item)
-      end
+    def apply_current_css?(item)
+      return false if current_list_item_css.nil?
+      Spina::Current.page == item
+    end
 
-      def parent_of_current?(item)
-        return false if item.homepage?
-        Spina::Current.page.materialized_path.starts_with? item.materialized_path
-      end
+    def apply_active_css?(item)
+      return false if apply_current_css?(item)
+      parent_of_current?(item)
+    end
+
+    def parent_of_current?(item)
+      return false if item.homepage?
+      Spina::Current.page.materialized_path.starts_with? item.materialized_path
+    end
   end
 end

data/app/presenters/spina/rich_text_presenter.rb

@@ -1,45 +1,44 @@
 module Spina
   class RichTextPresenter
     attr_reader :html, :view_context
-    
+
     EMBED_CONTENT_TYPE = "application/vnd+spina.embed+html"
-    
+
     def initialize(view_context, html)
       @view_context = view_context || Spina::Current.page&.view_context
       @html = html
     end
-    
+
     def to_s
       ActiveSupport::SafeBuffer.new(render_embeds(html))
     end
-    
+
     private
-    
-      def embed_selector
-        "figure[data-trix-content-type=\"#{EMBED_CONTENT_TYPE}\"]"
-      end
-    
-      def render_embeds(html)
-        doc = Nokogiri::HTML.fragment(html)
-        doc.css(embed_selector).each do |node|
-          node.replace render_embed(node.first_element_child)
-        end
-        doc.to_s
-      end
-      
-      def render_embed(element)
-        embeddable = element_to_embeddable(element)
-        view_context.render(embeddable)
-      end
-      
-      def element_to_embeddable(element)
-        embeddable = Spina::Embeds.constantize(element["data-embed-type"])
-        embeddable&.from_json(element["data-embed-attributes"]) || null_object
-      end
-      
-      def null_object
-        {inline: ""}
+
+    def embed_selector
+      "figure[data-trix-content-type=\"#{EMBED_CONTENT_TYPE}\"]"
+    end
+
+    def render_embeds(html)
+      doc = Nokogiri::HTML.fragment(html)
+      doc.css(embed_selector).each do |node|
+        node.replace render_embed(node.first_element_child)
       end
+      doc.to_s
+    end
+
+    def render_embed(element)
+      embeddable = element_to_embeddable(element)
+      view_context.render(embeddable)
+    end
+
+    def element_to_embeddable(element)
+      embeddable = Spina::Embeds.constantize(element["data-embed-type"])
+      embeddable&.from_json(element["data-embed-attributes"]) || null_object
+    end
 
+    def null_object
+      {inline: ""}
+    end
   end
 end

data/app/serializers/spina/api/base_serializer.rb

@@ -3,4 +3,4 @@ module Spina::Api
     include JSONAPI::Serializer
     singleton_class.include Spina::Engine.routes.url_helpers
   end
-end
+end

data/app/serializers/spina/api/image_serializer.rb

@@ -1,20 +1,20 @@
 module Spina::Api
-  class ImageSerializer < BaseSerializer    
+  class ImageSerializer < BaseSerializer
     set_type :image
-    
+
     attributes :id
-    
+
     attribute :original_url do |image, params|
       params[:view_context].main_app.url_for(image.file)
     end
-    
+
     attribute :thumbnail_url do |image, params|
       params[:view_context].main_app.url_for(image.variant(resize_to_fill: Spina.config.thumbnail_image_size))
     end
-    
+
     attribute :embedded_image_size_url do |image, params|
       resize_key = Spina.config.embedded_image_size.is_a?(Array) ? :resize_to_limit : :resize
-      params[:view_context].main_app.url_for(image.variant(Hash[resize_key, Spina.config.embedded_image_size]))
+      params[:view_context].main_app.url_for(image.variant({resize_key => Spina.config.embedded_image_size}))
     end
   end
 end

data/app/serializers/spina/api/navigation_serializer.rb

@@ -1,15 +1,14 @@
 module Spina::Api
-  class NavigationSerializer < BaseSerializer    
+  class NavigationSerializer < BaseSerializer
     set_type :navigation
-    
+
     attributes :name, :label
-    
+
     attribute :tree do |navigation|
       items_to_tree(navigation.navigation_items.sorted.roots.in_menu.live.joins(:page))
     end
-    
+
     class << self
-      
       def items_to_tree(collection)
         collection.map do |item|
           {
@@ -23,8 +22,6 @@ module Spina::Api
           }
         end
       end
-      
     end
-    
   end
 end

data/app/serializers/spina/api/page_serializer.rb

@@ -1,28 +1,25 @@
 module Spina::Api
-  class PageSerializer < BaseSerializer    
+  class PageSerializer < BaseSerializer
     set_type :page
-    
+
     attributes :title, :seo_title, :menu_title, :materialized_path, :name, :description, :view_template
-    
+
     attribute(:content) { |page| page_content(page) }
-    
+
     belongs_to :resource
 
     class << self
-      
       def page_content(page)
         return [] unless view_template(page)
-        
-        view_template(page)[:parts].map do |part| 
-          { part => page.content(part) }
+
+        view_template(page)[:parts].map do |part|
+          {part => page.content(part)}
         end
       end
-      
+
       def view_template(page)
-        Spina::Current.theme.view_templates.find{|view_template| view_template[:name] == page.view_template}
+        Spina::Current.theme.view_templates.find { |view_template| view_template[:name] == page.view_template }
       end
-      
     end
-    
   end
 end

data/app/serializers/spina/api/resource_serializer.rb

@@ -1,12 +1,12 @@
 module Spina::Api
   class ResourceSerializer < BaseSerializer
     set_type :resource
-    
+
     attributes :name, :label, :view_template, :order_by, :slug
-    
+
     has_many :pages, lazy_load_data: true, links: {
-      self: -> (object) { api_resource_path(object.id) },
-      related: -> (object) { api_resource_pages_path(object.id) }
-    }, meta: -> (resource) { {count: resource.pages.live.length} }
+      self: ->(object) { api_resource_path(object.id) },
+      related: ->(object) { api_resource_pages_path(object.id) }
+    }, meta: ->(resource) { {count: resource.pages.live.length} }
   end
 end

data/app/views/layouts/spina/admin/application.html.erb

@@ -22,6 +22,7 @@
   </head>
 
   <body>
+    <%= render "spina/admin/shared/version" %>
     <%= content_for?(:body) ? yield(:body) : yield %>
   </body>
 </html>

data/app/views/spina/admin/parts/attachments/_attachment.html.erb

@@ -0,0 +1,3 @@
+<option value="<%= attachment.id %>" signed-blob-id="<%= attachment.file&.blob&.signed_id %>" filename="<%= attachment.file&.filename %>" selected>
+  <%= attachment.file&.filename %>
+</option>

data/app/views/spina/admin/parts/attachments/_form.html.erb

@@ -5,5 +5,26 @@
   <%= f.hidden_field :signed_blob_id, data: {attachment_picker_target: 'signedBlobId'} %>
   <%= f.hidden_field :filename, data: {attachment_picker_target: 'filename'} %>
 
-  <%= f.select :attachment_id, Spina::Attachment.sorted.map{|attachment| [attachment.file&.filename, attachment.id, data: {signed_blob_id: attachment.file&.blob&.signed_id, filename: attachment.file&.filename}]}, {include_blank: t("spina.attachments.choose_attachment")}, {class: "form-select mt-1", data: {action: "attachment-picker#pick"}} %>
+  <div class="flex items-center space-x-3 mt-1">
+    <% select_id = dom_id(f.object, f.object.object_id) %>
+    
+    <%= f.select :attachment_id, Spina::Attachment.sorted.map{|attachment| [attachment.file&.filename, attachment.id, data: {signed_blob_id: attachment.file&.blob&.signed_id, filename: attachment.file&.filename}]}, {include_blank: t("spina.attachments.choose_attachment")}, {id: select_id, class: "form-select", data: {action: "attachment-picker#pick"}} %>
+    
+    <div class="text-gray-400 font-medium text-sm">
+      <%=t 'spina.ui.or' %>
+    </div>
+    
+    <%= form_with model: [:admin, Spina::Attachment.new], url: spina.inline_upload_admin_attachments_path, data: {controller: "form loading-button", loading_message: t('spina.media_library.uploading'), action: "turbo:submit-end->loading-button#doneLoading"} do |f| %>
+      <%= hidden_field_tag :select_id, select_id %>
+      <% file_field_id = "file_#{f.object.object_id}" %>
+      
+      <%= f.file_field :file, id: file_field_id, class: 'hidden', data: {action: "loading-button#loading form#requestSubmit"} %>
+      
+      <button type="button" class="btn btn-default" data-controller="delegate-click" data-action="delegate-click#click" data-loading-button-target="button" data-delegate-click-target="#<%= file_field_id %>">
+        <%= heroicon("upload", style: :solid, class: "w-4 h-4 -ml-1 mr-1") %>
+        <%=t 'spina.attachments.upload_one' %>
+      </button>
+    <% end %>
+
+  </div>
 </div>

data/app/views/spina/admin/parts/repeaters/_fields.html.erb

@@ -13,6 +13,6 @@
   <% end %>
 
   <div class="text-right">
-    <%= button_tag t('spina.ui.delete'), type: :button, class: 'btn btn-default bg-transparent hover:bg-white hover:text-red-500 h-8 px-3 inline-block mt-3', data: {action: "repeater#removeFields", id: "pane_#{f.object.object_id}"} %>
+    <%= button_tag t('spina.ui.delete_item', item: item_name), type: :button, class: 'btn btn-default bg-transparent hover:bg-white hover:text-red-500 h-8 px-3 inline-block mt-3', data: {action: "repeater#removeFields", id: "pane_#{f.object.object_id}"} %>
   </div>
-</div>
+</div>

data/app/views/spina/admin/parts/repeaters/_form.html.erb

@@ -4,11 +4,11 @@
 
   <div class="-mt-4 flex flex-col md:flex-row" data-controller="tabs" data-tabs-active="bg-spina-dark bg-opacity-10 text-gray-900" data-tabs-inactive="text-gray-500">
     <div class="md:w-64 md:pr-6">
-      <% 
+      <%
         # Fields
         repeater_content = Spina::Parts::RepeaterContent.new(name: f.object.name, title: f.object.title)
         fields = f.fields_for(:content, [repeater_content], child_index: repeater_content.object_id) do |builder|
-          render("spina/admin/parts/repeaters/fields", f: builder)
+          render("spina/admin/parts/repeaters/fields", f: builder, item_name: f.object.item_name)
         end.gsub("\n", "")
       %>
 
@@ -31,8 +31,8 @@
 
     <div class="flex-1 pl-6 md:pl-0" data-repeater-target="content">
       <%= f.fields_for :content do |ff| %>
-        <%= render 'spina/admin/parts/repeaters/fields', f: ff %>
+        <%= render 'spina/admin/parts/repeaters/fields', f: ff, item_name: f.object.item_name %>
       <% end %>
     </div>
   </div>
-</div>
+</div>

data/app/views/spina/admin/shared/_navigation.html.erb

@@ -61,7 +61,9 @@
       <ul class="md:block">
         <li>
           <%= link_to logout_path, class: 'p-3 w-14 block flex justify-center opacity-50 hover:opacity-100 transition duration-200 ease', data: {turbo: false} do %>
-            <%= heroicon('logout', style: :solid, class: 'h-8 w-8 text-white') %>
+            <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 256 256" fill="currentColor" class="h-7 w-7 text-white">
+              <path fill-rule="evenodd" d="M128,256 C93.81,256 61.666,242.686 37.49,218.509 C13.315,194.334 0,162.19 0,128 C0,93.81 13.315,61.668 37.49,37.491 C43.739,31.242 53.869,31.242 60.118,37.491 C66.367,43.739 66.367,53.87 60.118,60.118 C41.985,78.25 32,102.357 32,128 C32,153.643 41.985,177.75 60.118,195.882 C78.25,214.014 102.357,224 128,224 C153.643,224 177.75,214.014 195.882,195.882 C214.015,177.75 224,153.643 224,128 C224,102.357 214.015,78.25 195.882,60.118 C189.633,53.87 189.633,43.739 195.882,37.491 C202.13,31.243 212.261,31.243 218.51,37.491 C242.686,61.668 256,93.809 256,128 C256,162.191 242.685,194.334 218.51,218.509 C194.334,242.686 162.19,256 128,256 L128,256 L128,256 Z M128,144 C136.837,144 144,136.837 144,128 L144,16 C144,7.163 136.837,0 128,0 C119.163,0 112,7.163 112,16 L112,128 C112,136.837 119.163,144 128,144 L128,144 L128,144 Z" clip-rule="evenodd" />
+            </svg>
           <% end %>
         </li>
       </ul>

data/app/views/spina/admin/shared/_version.html.erb

@@ -0,0 +1,18 @@
+<% unless defined?(Spina::Pro) %>
+  <%= link_to "https://spinacms.com/pro", class: "fixed bottom-0 right-0 px-5 py-4 group text-gray-400 text-xs font-medium", target: :blank do %>
+    <div class="flex items-center justify-end">
+      <svg viewBox="0 0 100 100" class="h-3 w-3 mr-1 text-gray-400 group-hover:text-spina" xmlns="http://www.w3.org/2000/svg" fill="currentColor">
+        <path d="M48.6582924,96.1623174 L0.472662785,39.1647593 C-0.121452015,38.4619959 -0.159345587,37.4445295 0.380849751,36.699521 L20.3780861,9.12040239 C20.6765111,8.70883071 21.1204689,8.42634978 21.6197077,8.33038495 L49.1629705,3.03595601 C49.3934881,2.99164538 49.6300066,2.9882617 49.8616974,3.02595987 L78.3181435,7.65607741 C78.8410521,7.74115931 79.30884,8.0302376 79.6188319,8.45986224 L99.9955684,36.7004267 C100.533013,37.4452826 100.494021,38.460456 99.9010274,39.1618937 L51.7129756,96.1623174 C50.999859,97.0058449 49.7379497,97.1115638 48.8944223,96.3984473 C48.8092674,96.3264575 48.7302822,96.2474723 48.6582924,96.1623174 Z"></path>
+      </svg>
+      
+      Spina CMS v<%= Spina::VERSION %>
+    </div>
+    
+    <div class="mt-1">
+      Upgrade to Spina 
+      <span class="bg-gray-400 group-hover:bg-pink-500 text-white rounded px-1 py-0.5 uppercase tracking-wider" style="font-size: 10px">
+        Pro
+      </span>
+    </div>
+  <% end %>
+<% end %>

data/app/views/spina/sitemaps/show.xml.builder

@@ -19,4 +19,4 @@ xml.urlset "xmlns" => "http://www.google.com/schemas/sitemap/0.9", "xmlns:xhtml"
       xml.priority 0.9
     end
   end
-end
+end

data/config/initializers/importmap.rb

@@ -3,10 +3,10 @@ Spina.config.importmap.draw do
   pin "@hotwired/stimulus", to: "stimulus.js"
   pin "@hotwired/stimulus-loading", to: "stimulus-loading.js"
   pin "@hotwired/turbo-rails", to: "turbo.js"
-  
+
   # Spina entrypoint
   pin "application", to: "spina/application.js"
-  
+
   pin_all_from Spina::Engine.root.join("app/assets/javascripts/spina/controllers"), under: "controllers", to: "spina/controllers"
   pin_all_from Spina::Engine.root.join("app/assets/javascripts/spina/libraries"), under: "libraries", to: "spina/libraries"
-end
+end

data/config/initializers/yaml_column_permitted_classes.rb

@@ -1,12 +1,12 @@
 # CVE-2022-32224 RAILS
-# 
+#
 # There was a bug in Rails allowing YAML-serialized data to be vulnerable to RCE.
 # Spina uses the serialize method to store various preferences stored using symbols.
 # We've now changed this so preferences are stored with strings as keys instead of
-# symbols, but in order to not break existing projects we're adding 'Symbol' to the 
+# symbols, but in order to not break existing projects we're adding 'Symbol' to the
 # list of permitted classes.
 # This can be removed in the future.
-# 
+#
 # More information:
 # https://discuss.rubyonrails.org/t/cve-2022-32224-possible-rce-escalation-bug-with-serialized-columns-in-active-record/81017
 

data/config/locales/de.yml

@@ -347,6 +347,7 @@ de:
     ui:
       cancel: Abbrechen
       delete: Löschen
+      delete_item: "%{item} löschen"
       load_more: Weitere laden
       move_to: Verschieben nach
       new_entry: Neuer Eintrag

data/config/locales/en.yml

@@ -131,6 +131,7 @@ en:
       insert: Insert document
       insert_multiple: Insert documents
       upload: Upload files
+      upload_one: Upload file
     cancel: Cancel
     choose_from_library: Choose from library
     close: Close
@@ -344,10 +345,12 @@ en:
     ui:
       cancel: Cancel
       delete: Delete
+      delete_item: "Delete %{item}"
       load_more: Load more
       move_to: Move to
       new_entry: New entry
       optional: Optional
+      or: or
       rename: Rename
       replace: Replace
       save_changes: Save changes

data/config/locales/nl.yml

@@ -108,7 +108,8 @@ nl:
       delete_confirmation_html: Weet je het zeker? Het kan zijn dat dit document in gebruik is op een pagina.
       insert: Document toevoegen
       insert_multiple: Documenten toevoegen
-      upload: 
+      upload: Upload documenten
+      upload_one: Upload document
     cancel: Annuleren
     choose_from_library: Kies uit bibliotheek
     close: Sluiten
@@ -315,10 +316,12 @@ nl:
     ui:
       cancel: Annuleer
       delete: Verwijder
+      delete_item: "Verwijder %{item}"
       load_more: Meer laden
       move_to: Verplaats naar
       new_entry: Nieuw item
       optional: Optioneel
+      or: of
       rename: Hernoemen
       replace: Vervangen
       save_changes: Wijzigingen opslaan

data/config/routes.rb

@@ -11,7 +11,6 @@ Rails.application.routes.draw do
 end
 
 Spina::Engine.routes.draw do
-  
   # API
   namespace :api, path: Spina.config.api_path do
     resources :pages, only: [:index, :show]
@@ -33,7 +32,7 @@ Spina::Engine.routes.draw do
     patch "/settings/:plugin", to: "settings#update", as: :settings
 
     resources :users
-    
+
     # Sessions
     resources :sessions
     get "login" => "sessions#new"
@@ -48,7 +47,7 @@ Spina::Engine.routes.draw do
         get :edit_template
         get :children
       end
-      
+
       resource :move, controller: "move_pages"
 
       post :sort, on: :collection
@@ -60,18 +59,13 @@ Spina::Engine.routes.draw do
 
     resources :resources, only: [:show, :edit, :update]
 
-    resources :navigations do
+    resources :navigations, only: [:index, :edit, :update] do
       post :sort, on: :member
       resources :navigation_items
     end
 
     resources :attachments do
-      collection do
-        get 'select/:page_part_id' => 'attachments#select', as: :select
-        post 'insert/:page_part_id' => 'attachments#insert', as: :insert
-        get 'select_collection/:page_part_id' => 'attachments#select_collection', as: :select_collection
-        post 'insert_collection/:page_part_id' => 'attachments#insert_collection', as: :insert_collection
-      end
+      post :inline_upload, on: :collection
     end
     resources :rename_files
 
@@ -80,9 +74,9 @@ Spina::Engine.routes.draw do
     end
 
     resources :images
-    
+
     resource :media_picker, controller: "media_picker", only: [:show]
-    
+
     resources :embeds, only: [:new, :create]
   end
 
@@ -94,12 +88,11 @@ Spina::Engine.routes.draw do
     root to: "pages#homepage"
 
     # Pages
-    get '/:locale/*id' => 'pages#show', constraints: {locale: /#{Spina.locales.join('|')}/ }
-    get '/:locale/' => 'pages#homepage', constraints: {locale: /#{Spina.locales.join('|')}/ }
-    get '/*id' => 'pages#show', as: "page", controller: 'pages', constraints: -> (request) {
+    get "/:locale/*id" => "pages#show", :constraints => {locale: /#{Spina.locales.join('|')}/}
+    get "/:locale/" => "pages#homepage", :constraints => {locale: /#{Spina.locales.join('|')}/}
+    get "/*id" => "pages#show", :as => "page", :controller => "pages", :constraints => ->(request) {
       request.path.exclude?(ActiveStorage.routes_prefix) &&
-      !(Rails.env.development? && request.path.starts_with?('/rails/'))
+        !(Rails.env.development? && request.path.starts_with?("/rails/"))
     }
   end
-
 end