tina4ruby 3.13.26 → 3.13.27

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 37b3d1b2d32cd45ef6a97096e97bd5c6a39009ace98ead88dac0fdc89e786528
-  data.tar.gz: c02fc34b91be2c3dbad1f577b590be80d1eae9043803cd0fa2819ec465f47dce
+  metadata.gz: 22585d14a68f2f43593a60d1cd6f6173cd0c6103ef715f381195f8a4f006588e
+  data.tar.gz: a89a7168c5175e862ef902b7501ffb85a1fa195298dd4d5b981f69695fa49cfb
 SHA512:
-  metadata.gz: 6efda648bfaf41d5fba86200f2a3d063e186982cf1325721dcbc49660933592492526802e4c052850e710887dbefd10275001738a2fb149d3abb1bae620e9445
-  data.tar.gz: af138286dcc50de2e72defd69f535b9854ccbe5236b54c320a33b2a9e08487ff3ad557a90b6ae8486dd882c34c02d99d707b5abb8c344feb6a1e34b00a9d03d0
+  metadata.gz: f3cb82ae2d3b78cc1fecc97427200181298c6a4da3fbb1ce5820cce8f066621bacd04f8345ee33636ea2fc1ed0b2b8f905d48358c09d0294448edc87aab54af7
+  data.tar.gz: e551aea110d6e9e86e44d003522145a734221da3942120c2c563df98e05b4092c66919afebeecaae01ed78ca2c533fc6b8ef6eb2a78bf4ebbf0f604c0656ba46

data/lib/tina4/frond.rb

@@ -10,6 +10,7 @@ require "json"
 require "digest"
 require "base64"
 require "cgi"
+require "erb"
 require "uri"
 require "date"
 require "time"
@@ -738,7 +739,7 @@ module Tina4
                   when "title"      then value.to_s.split.map(&:capitalize).join(" ")
                   when "string"     then value.to_s
                   when "int"        then value.to_i
-                  when "escape", "e" then Frond.escape_html(value.to_s)
+                  when "escape", "e" then Tina4::SafeString.new(Frond.escape_html(value.to_s))
                   else value
                   end
           next
@@ -1042,9 +1043,26 @@ module Tina4
     # ── Literal values: strings, numbers, booleans, null ──
 
     def eval_literal(expr)
-      if (expr.start_with?('"') && expr.end_with?('"')) ||
-         (expr.start_with?("'") && expr.end_with?("'"))
-        return expr[1..-2]
+      if expr.length >= 2 && (expr[0] == '"' || expr[0] == "'") && expr[-1] == expr[0]
+        # Only a SINGLE complete string literal — i.e. the opening quote's
+        # match is the final char. Without this check, `'a' ~ 'b'` and
+        # `'Y' if x else 'N'` (which merely start and end with a quote) get
+        # their outer quotes stripped here before concat / inline-if run.
+        q = expr[0]
+        i = 1
+        single = false
+        while i < expr.length
+          if expr[i] == "\\"
+            i += 2
+            next
+          end
+          if expr[i] == q
+            single = (i == expr.length - 1)
+            break
+          end
+          i += 1
+        end
+        return expr[1..-2] if single
       end
       return expr.to_i if expr =~ INTEGER_RE
       return expr.to_f if expr =~ FLOAT_RE
@@ -1894,8 +1912,8 @@ module Tina4
         "striptags"  => ->(v, *_a) { v.to_s.gsub(STRIPTAGS_RE, "") },
 
         # -- Encoding --
-        "escape"        => ->(v, *_a) { Frond.escape_html(v.to_s) },
-        "e"             => ->(v, *_a) { Frond.escape_html(v.to_s) },
+        "escape"        => ->(v, *_a) { Tina4::SafeString.new(Frond.escape_html(v.to_s)) },
+        "e"             => ->(v, *_a) { Tina4::SafeString.new(Frond.escape_html(v.to_s)) },
         "raw"           => ->(v, *_a) { v },
         "safe"          => ->(v, *_a) { v },
         "json_encode"   => ->(v, *_a) { JSON.generate(v) rescue v.to_s },
@@ -1914,7 +1932,7 @@ module Tina4
             v.to_s
           end
         },
-        "url_encode"    => ->(v, *_a) { CGI.escape(v.to_s) },
+        "url_encode"    => ->(v, *_a) { ERB::Util.url_encode(v.to_s) },
 
         # -- JSON / JS --
         "to_json" => ->(v, *a) {
@@ -2058,7 +2076,7 @@ module Tina4
           lines.join("\n")
         },
         "slug"   => ->(v, *_a) { v.to_s.downcase.gsub(SLUG_CLEAN_RE, "-").gsub(SLUG_TRIM_RE, "") },
-        "nl2br"  => ->(v, *_a) { v.to_s.gsub("\n", "<br>\n") },
+        "nl2br"  => ->(v, *_a) { Tina4::SafeString.new(Frond.escape_html(v.to_s).gsub("\n", "<br />\n")) },
         "format" => ->(v, *a) {
           if a.any?
             v.to_s % a

data/lib/tina4/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Tina4
-  VERSION = "3.13.26"
+  VERSION = "3.13.27"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: tina4ruby
 version: !ruby/object:Gem::Version
-  version: 3.13.26
+  version: 3.13.27
 platform: ruby
 authors:
 - Tina4 Team