tina4ruby 3.10.86 → 3.10.89

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c48ff6ca420828c13d58b56461236b1cc88f183d8c26ef07d659a5fdbae0387b
-  data.tar.gz: c97876faf8d439dbb7c843708dceaac560c68261d5ba3e10c370b5986e8f0458
+  metadata.gz: b288a6697081e0aced7f44fc2171066896d54095b241ac94e03632510c6209ea
+  data.tar.gz: b9e8b8b832f351b11ec5c3af1acd81c336e7b20efdf106e74955a9b9c82665f7
 SHA512:
-  metadata.gz: 81043f5493f03b8abe8fed8291bba748df5c770cd711a8825837cff14ee9ab855d30736fcf4d2b5f0d5dea9148b6e2b29fbc4fb44c6bbbeb1918741be0d219bc
-  data.tar.gz: b918fb9ee51de4a14412ec5b5f0503da65ff7669244c6ff1653c77ab2af02898e4cafc73e7f3b2c95ab07f927f61415cc9318882292d38e2582e55b8eb140d93
+  metadata.gz: ab190740cf6616a0acb9219e4a9cc728bfd61bad84b2c08b6089e1cc1e9310eaf66a4fca88c0a7fa6d025a8f61cdbce50d9c60a1f28c99a06bbc0a29d805c374
+  data.tar.gz: fcb851edb3e8939a2c828229f9bee1d9e7a017f7e73bc2ee0a664e10104e3af7133b089bf24daa8a3b9b909ccb6f8ef24f05ee4be4f526483689a08aa9b7effa

data/lib/tina4/frond.rb

@@ -1842,7 +1842,10 @@ module Tina4
 
         # -- Utility --
         "default"  => ->(v, *a) { (v.nil? || v.to_s.empty?) ? (a[0] || "") : v },
-        "dump"     => ->(v, *_a) { v.inspect },
+        # dump filter — gated on TINA4_DEBUG=true via Frond.render_dump.
+        # Both the |dump filter and the dump() global delegate to the same
+        # helper so they produce identical output and obey the same gating.
+        "dump"     => ->(v, *_a) { Frond.render_dump(v) },
         "string"   => ->(v, *_a) { v.to_s },
         "truncate" => ->(v, *a) {
           len = a[0] ? a[0].to_i : 50
@@ -1886,6 +1889,32 @@ module Tina4
       @globals["form_token"] = ->(descriptor = "") { Frond.generate_form_token(descriptor.to_s) }
       @globals["formTokenValue"] = ->(descriptor = "") { Frond.generate_form_token_value(descriptor.to_s) }
       @globals["form_token_value"] = ->(descriptor = "") { Frond.generate_form_token_value(descriptor.to_s) }
+
+      # Debug helper: {{ dump(x) }} — gated on TINA4_DEBUG=true.
+      # Both this global and the |dump filter call Frond.render_dump which
+      # returns an empty SafeString in production so dump never leaks state.
+      @globals["dump"] = ->(value = nil) { Frond.render_dump(value) }
+    end
+
+    # Render a value as a pre-formatted inspect() wrapped in <pre> tags.
+    #
+    # Gated on TINA4_DEBUG=true. In production (TINA4_DEBUG unset or false)
+    # this returns an empty SafeString to avoid leaking internal state,
+    # object shapes, or sensitive values into rendered HTML.
+    #
+    # Shared by the {{ value|dump }} filter and the {{ dump(value) }}
+    # global function so both produce identical output and obey the same
+    # gating.
+    def self.render_dump(value)
+      return SafeString.new("") unless ENV.fetch("TINA4_DEBUG", "").downcase == "true"
+
+      dumped = value.inspect
+      escaped = dumped
+        .gsub("&", "&amp;")
+        .gsub("<", "&lt;")
+        .gsub(">", "&gt;")
+        .gsub('"', "&quot;")
+      SafeString.new("<pre>#{escaped}</pre>")
     end
 
     # Generate a JWT form token and return a hidden input element.

data/lib/tina4/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Tina4
-  VERSION = "3.10.86"
+  VERSION = "3.10.89"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: tina4ruby
 version: !ruby/object:Gem::Version
-  version: 3.10.86
+  version: 3.10.89
 platform: ruby
 authors:
 - Tina4 Team