storytime 2.1.6 → 2.1.7

data/lib/storytime/concerns/action_controller_extension.rb

@@ -0,0 +1,36 @@
+module Storytime
+  module ActionControllerExtension
+    
+    def self.included(base)
+      base.extend(ClassMethods)
+      base.helper_method :current_tab, :current_tab? if base.respond_to?(:helper_method)
+    end
+
+    def set_tab(name, namespace = nil)
+      tab_stack[namespace || :default] = name
+    end
+
+    def current_tab(namespace = nil)
+      tab_stack[namespace || :default]
+    end
+
+    def current_tab?(name, namespace = nil)
+      current_tab(namespace).to_s == name.to_s
+    end
+
+    def tab_stack
+      @tab_stack ||= {}
+    end
+
+    module ClassMethods
+      def set_tab(*args)
+        options = args.extract_options!
+        name, namespace = args
+
+        before_action(options) do |controller|
+          controller.send(:set_tab, name, namespace)
+        end
+      end
+    end
+  end
+end

data/lib/storytime/constraints/page_constraint.rb

@@ -4,9 +4,15 @@ module Storytime
       include Storytime::Concerns::CurrentSite
 
       def matches?(request)
+        id = request.params[:id].to_s
+        # Reject path traversal: params[:id] comes from the "/*id" glob route, so it
+        # can contain "/" and ".." segments. sanitize() only strips HTML, not "../",
+        # which would let the File.exist? below probe arbitrary filesystem paths
+        return false if id.include?("..")
+
         site = current_storytime_site(request)
-        site.pages.friendly.exists?(request.params[:id]) ||
-        File.exists?(Rails.root.join('app', 'views', "storytime/#{site.custom_view_path}/pages/#{ActionController::Base.helpers.sanitize(request.params[:id])}.html.erb"))
+        site.pages.friendly.exists?(id) ||
+        File.exist?(Rails.root.join('app', 'views', "storytime/#{site.custom_view_path}/pages/#{ActionController::Base.helpers.sanitize(id)}.html.erb"))
       end
     end
   end

data/lib/storytime/engine.rb

@@ -8,18 +8,17 @@ require 'jbuilder'
 require 'jquery-rails'
 require 'jquery-ui-rails'
 require 'kaminari'
-require 'leather'
 require 'nokogiri'
 require 'pundit'
 require 'simple_form'
-require 'codemirror-rails'
-require 'storytime_admin'
 require 'cocoon'
 require 'acts_as_list'
+require 'devise'
 
 require 'storytime/concerns/has_versions'
 require 'storytime/concerns/storytime_user'
 require 'storytime/concerns/controller_content_for'
+require 'storytime/concerns/action_controller_extension'
 require 'storytime/concerns/current_site'
 require 'storytime/constraints/blog_homepage_constraint'
 require 'storytime/constraints/page_homepage_constraint'
@@ -39,7 +38,6 @@ module Storytime
 
     initializer "storytime.view_helpers" do
       ActiveSupport.on_load(:action_view) do
-        include Storytime::ApplicationHelper
         include Storytime::StorytimeHelpers
       end
     end
@@ -47,6 +45,7 @@ module Storytime
     initializer "storytime.controller_helpers" do
       ActiveSupport.on_load(:action_controller) do
         include Storytime::ControllerHelpers
+        include Storytime::ActionControllerExtension
         include Storytime::Concerns::CurrentSite
         helper_method :current_storytime_site
 
@@ -67,7 +66,6 @@ module Storytime
     initializer "storytime.configure_carrierwave" do
       CarrierWave.configure do |config|
         if Storytime.media_storage == :s3
-          config.fog_provider = 'fog/aws'
           config.fog_credentials = {
             provider:              'AWS',
             aws_access_key_id:     Storytime.aws_access_key_id,

data/lib/storytime/migrators/v1.rb

@@ -65,7 +65,7 @@ module Storytime
         site = Storytime::Site.first
         Storytime::Post.all.each do |post|
           if post.site_id.blank?
-            post.update_attributes(site_id: site.id)
+            post.update(site_id: site.id)
           end
         end
       end
@@ -74,7 +74,7 @@ module Storytime
         site = Storytime::Site.first
         Storytime::Snippet.all.each do |snippet|
           if snippet.site_id.blank?
-            snippet.update_attributes(site_id: site.id)
+            snippet.update(site_id: site.id)
           end
         end
       end
@@ -83,7 +83,7 @@ module Storytime
         site = Storytime::Site.first
         Storytime::Tag.all.each do |tag|
           if tag.site_id.blank?
-            tag.update_attributes(site_id: site.id)
+            tag.update(site_id: site.id)
           end
         end
       end

data/lib/storytime/post_notifier.rb

@@ -6,7 +6,7 @@ module Storytime
       return if post.nil?
 
       unless post.notifications_sent_at
-        post.update_attributes(notifications_sent_at: Time.now)
+        post.update(notifications_sent_at: Time.now)
 
         post.site.active_email_subscriptions.each do |subscription|
           mail = Storytime::SubscriptionMailer.new_post_email(post, subscription)

data/lib/storytime/post_url_handler.rb

@@ -1,6 +1,19 @@
 module Storytime
   module PostUrlHandler
 
+    
+    if Rails::VERSION::MAJOR > 6 || (Rails::VERSION::MAJOR == 6 && Rails::VERSION::MINOR >= 1)
+      def url_for(options, route_name = nil, url_strategy = ActionDispatch::Routing::RouteSet::UNKNOWN, method_name = nil, reserved = ActionDispatch::Routing::RouteSet::RESERVED_OPTIONS)
+        Storytime::PostUrlHandler.handle_url(options)
+        super(options, route_name, url_strategy, method_name, reserved)
+      end
+    elsif Rails::VERSION::MAJOR > 5 || (Rails::VERSION::MAJOR == 5 && Rails::VERSION::MINOR >= 1)
+      def url_for(options, route_name = nil, url_strategy = ActionDispatch::Routing::RouteSet::UNKNOWN)
+        Storytime::PostUrlHandler.handle_url(options)
+        super(options, route_name, url_strategy)
+      end
+    end
+
     def self.handle_url(options)
       return unless options[:controller] == "storytime/posts" && options[:action] == "show"
 
@@ -15,7 +28,7 @@ module Storytime
         when "default"
           options[:component_1] = "posts"
           options[:id] = post
-        when "day_and_name" 
+        when "day_and_name"
           date = post.created_at.to_date
           options[:component_1] = date.strftime("%Y") # 4 digit year
           options[:component_2] = date.strftime("%m") # 2 digit month
@@ -31,17 +44,17 @@ module Storytime
           options[:id] = post.id
         end
       end
-    
+
     end
 
     def self.site(options)
-      if Storytime::Site.current_id.present? 
+      if Storytime::Site.current_id.present?
         Storytime::Site.find(Storytime::Site.current_id)
       elsif options[:host]
         Storytime::Site.find_by!(custom_domain: options[:host])
       end
     end
-      
+
 
   end
-end
+end

data/lib/storytime/storytime_helpers.rb

@@ -10,5 +10,9 @@ module Storytime
 
       render partial: "storytime/snippets/snippet", locals: {snippet: snippet}
     end
+
+    def logged_in_storytime_user?
+      user_signed_in? && current_user.respond_to?(:storytime_user?) && current_user.storytime_user?(current_storytime_site)
+    end
   end
 end

data/lib/storytime/version.rb

@@ -1,3 +1,3 @@
 module Storytime
-  VERSION = "2.1.6"
+  VERSION = "2.1.7"
 end

data/lib/storytime.rb

@@ -62,7 +62,7 @@ module Storytime
       attributes = Loofah::HTML5::WhiteList::ALLOWED_ATTRIBUTES
     end
 
-    attributes << "style"
+    attributes += ["style", "data-toggle", "data-trigger", "data-placement", "data-html", "data-container", "data-content"]
 
     white_list_sanitizer.sanitize(draft_content, tags: tags, attributes: attributes)
   end

data/spec/controllers/dashboard_controller_spec.rb

@@ -10,23 +10,22 @@ describe Storytime::DashboardController, type: :controller do
 
     it "requires login" do
       get :index
-      flash[:alert].should == I18n.t('devise.failure.unauthenticated')
+      expect(flash[:alert]).to eq(I18n.t('devise.failure.unauthenticated'))
       expect(response).to redirect_to(Rails.application.class.routes.url_helpers.new_user_session_path)
     end
 
     it "requires authorization" do
-      controller.view_paths.unshift(ActionView::FixtureResolver.new("widgets/index.html.erb" => ""))
-      FactoryGirl.create(:site)
-      sign_in FactoryGirl.create(:writer)
+      FactoryBot.create(:site)
+      sign_in FactoryBot.create(:writer)
       get :index
       expect(flash[:error]).to eq("You are not authorized to perform this action.")
     end
 
     it "redirects to site setup if none exists" do
       allow(Storytime::Site).to receive(:count).and_return(0)
-      sign_in FactoryGirl.create(:writer)
+      sign_in FactoryBot.create(:writer)
       get :index
-      response.should redirect_to(new_dashboard_site_path)
+      expect(response).to redirect_to(new_dashboard_site_path)
     end
   end
 end

data/spec/dummy/app/assets/config/manifest.js

@@ -0,0 +1,3 @@
+//= link_tree ../images
+//= link_directory ../javascripts .js
+//= link_directory ../stylesheets .css

data/spec/dummy/config/database.yml

@@ -7,10 +7,10 @@
 default: &default
   adapter: postgresql
   encoding: unicode
-  host: localhost
+  host: <%= ENV.fetch('PGHOST', 'localhost') %>
   pool: 5
-  username: <%= ENV['USER'] %>
-  password:
+  username: <%= ENV.fetch('PGUSER', ENV['USER']) %>
+  password: <%= ENV.fetch('PGPASSWORD', '') %>
   
 
 development:

data/spec/dummy/config/initializers/devise.rb

@@ -4,7 +4,7 @@ Devise.setup do |config|
   # The secret key used by Devise. Devise uses this key to generate
   # random tokens. Changing this key will render invalid all existing
   # confirmation, reset password and unlock tokens in the database.
-  config.secret_key = Rails.application.secrets.secret_key_base
+  config.secret_key = ENV["SECRET_KEY_BASE"]
 
   # ==> Mailer Configuration
   # Configure the e-mail address which will be shown in Devise::Mailer,

data/spec/dummy/db/migrate/20140530185250_devise_create_users.rb

@@ -1,4 +1,4 @@
-class DeviseCreateUsers < ActiveRecord::Migration
+class DeviseCreateUsers < ActiveRecord::Migration[4.2]
   def change
     create_table(:users) do |t|
       ## Database authenticatable

data/spec/dummy/db/migrate/20150127172846_create_widgets.rb

@@ -1,4 +1,4 @@
-class CreateWidgets < ActiveRecord::Migration
+class CreateWidgets < ActiveRecord::Migration[4.2]
   def change
     create_table :widgets do |t|
       t.string :name

data/spec/dummy/db/migrate/20150206203824_add_video_url_to_storytime_posts.rb

@@ -1,4 +1,4 @@
-class AddVideoUrlToStorytimePosts < ActiveRecord::Migration
+class AddVideoUrlToStorytimePosts < ActiveRecord::Migration[4.2]
   def change
     add_column :storytime_posts, :video_url, :string
   end