trek 2.3.1 → 2.3.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d6ee08de9f89d342f41a9c9139580e2b9bdc3196278a25093c32f4fdb252f2a8
-  data.tar.gz: c9117839af6d9cbcec4951468913246ac20af148628d67a7930d0f8b8d74a3be
+  metadata.gz: 3749a9dc01b378419fbbaacdbf9e8251100d9bdd6281b308a9d44cf9dd18d182
+  data.tar.gz: d61b12a1f80494ebaf0c664bbfcfdf2d24b682632ef9c268117b4de23fb7e1b5
 SHA512:
-  metadata.gz: 79a68fecd5c544d8e3184a9388196e9cc80403b4b788614dc4db7f98ca9734a5a14543a56eeb7cd2b777f96ad3dd57fe29883687ef3771362f6c12f2b7e34123
-  data.tar.gz: 66358069ffd43f58794febe08082171cb2d47855e5f701436d5c38a87eb7c929490c7a4ae4837cdc7422765f6c1f57f1ee1214254b779300dcdb499eb01b5c3b
+  metadata.gz: e9083e34869370a8b22b69a8c9aadb3f404e74f9d4b32097c48f51ad024d750aed71769a203112b78f19b74c7489ec46f512340bdd728dfebfef76f6bd37ec27
+  data.tar.gz: 9800e5d16a2639e2a51644ce67bb488bd1e4c34930867f08311b7df56992dd7dcf42b37a926d4097a5bd5f9a1a59bc476f5d2c70091b9eb2f54efc11ee14dcfc

data/CHANGELOG.md

@@ -1,5 +1,12 @@
 ## [Unreleased]
 
+## [2.3.2] - 2026-10-02
+
+### Fixed
+
+- **Security:** `Trek::Scopes#apply_scopes` called any name found in `params[:scopes]` that the relation answered to, not only the controller's `available_scopes`, which let a request run unintended methods on the listed records. Only the names in `available_scopes` are applied now; others are ignored. **Upgrade note:** update Trek as soon as possible. A controller passing `apply_scopes` a scope name it does not list in `available_scopes` must add it there.
+- The generated admin sign-in, password reset request and new password pages rendered their actions with the default aspect of `Trek::Form::ActionsComponent`, whose sticky action bar (top margin, padding, background) is meant for edit forms: inside those small cards, the button and the « forgotten password » link sat in a padded bar. They now use the `seamless` aspect. **Upgrade note:** in apps generated before this version, pass `aspect: :seamless` to `Trek::Form::ActionsComponent.new` in `app/views/admin/user_sessions/new.html.slim` and `app/views/admin/user_password_resets/{new,edit}.html.slim`.
+
 ## [2.3.1] - 2026-10-02
 
 ### Changed

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    trek (2.3.1)
+    trek (2.3.2)
       action_policy (~> 0.6)
       actioncable
       acts_as_list (~> 1.1)

data/app/controllers/concerns/trek/scopes.rb

@@ -19,8 +19,13 @@ module Trek
     def apply_scopes(scope, filters)
       return scope if filters.blank?
 
+      # Only the controller's own scopes: the names come from the request, and a relation also
+      # answers to destroy_all, delete_all…
+      allowed = available_scopes.map(&:to_s)
+
       filters.each do |filter, value|
         next if value.blank?
+        next unless allowed.include?(filter.to_s)
 
         scope = scope.public_send(filter) if scope.respond_to?(filter)
       end
@@ -31,7 +36,7 @@ module Trek
     def apply_scopes!
       @scopes_applied = true
       @unscoped_objects = @objects
-      @objects = apply_scopes(@objects, params[:scopes])
+      @objects = apply_scopes(@objects, scope_params)
       scope_counts
     end
 
@@ -65,8 +70,10 @@ module Trek
       []
     end
 
+    # The requested scopes, permitted to the available ones; nil when params[:scopes] isn't a hash
     def scope_params
-      params[:scopes]&.permit(*available_scopes)
+      scopes = params[:scopes]
+      scopes.permit(*available_scopes) if scopes.respond_to?(:permit)
     end
 
     private def ensure_scopes_applied

data/docs/reference/controllers.md

@@ -75,7 +75,7 @@ with the chosen filter:
 ### Scopes
 
 `Trek::Scopes` filters by **named model scopes** rather than raw attributes. Declare the allowed scopes via
-`available_scopes`, then call `apply_scopes!` in your `index`. It also exposes `scope_counts` and
+`available_scopes`, then call `apply_scopes!` in your `index`; any other name in `params[:scopes]` is ignored. It also exposes `scope_counts` and
 `unscoped_objects` helpers (the per-scope match counts and the pre-scope collection) for building scope tabs:
 
 ```ruby

data/lib/generators/trek/templates/spec/requests/admin/user_password_resets_spec.rb

@@ -9,6 +9,12 @@ RSpec.describe "Admin password resets", type: :request do
     expect(response).to have_http_status(:ok)
   end
 
+  it "keeps the reset request actions in the card, out of the sticky action bar" do
+    get new_admin_user_password_reset_path
+
+    expect(response.body).to include("c-trek--form--actions-aspect-seamless")
+  end
+
   it "emails a reset link to a privileged user" do
     expect { post admin_user_password_resets_path, params: { email: editor.email } }
       .to have_enqueued_mail(Admin::PasswordsMailer, :reset)
@@ -31,6 +37,12 @@ RSpec.describe "Admin password resets", type: :request do
     expect(response).to have_http_status(:ok)
   end
 
+  it "keeps the new password actions in the card, out of the sticky action bar" do
+    get edit_admin_user_password_reset_path(editor.password_reset_token)
+
+    expect(response.body).to include("c-trek--form--actions-aspect-seamless")
+  end
+
   it "renders the new password form from an invitation link" do
     get edit_admin_user_password_reset_path(editor.generate_token_for(:invite))
 

data/lib/generators/trek/templates/spec/requests/admin/user_sessions_spec.rb

@@ -9,6 +9,12 @@ RSpec.describe "Admin sign-in", type: :request do
     expect(response).to have_http_status(:ok)
   end
 
+  it "keeps the sign-in actions in the card, out of the sticky action bar" do
+    get new_admin_user_session_path
+
+    expect(response.body).to include("c-trek--form--actions-aspect-seamless")
+  end
+
   it "signs a privileged user in and opens the dashboard" do
     post admin_user_session_path, params: { email: editor.email, password: users.password }
     follow_redirect!

data/lib/generators/trek/templates/views/admin/user_password_resets/edit.html.slim

@@ -7,7 +7,7 @@
           maxlength: 72,
           minlength: 8
 
-    = render Trek::Form::ActionsComponent.new do |c|
+    = render Trek::Form::ActionsComponent.new(aspect: :seamless) do |c|
       ruby:
         c.with_button(
           type: "submit",

data/lib/generators/trek/templates/views/admin/user_password_resets/new.html.slim

@@ -6,7 +6,7 @@
           autofocus: true,
           autocomplete: "username"
 
-    = render Trek::Form::ActionsComponent.new do |c|
+    = render Trek::Form::ActionsComponent.new(aspect: :seamless) do |c|
       ruby:
         c.with_button(
           type: "submit",

data/lib/generators/trek/templates/views/admin/user_sessions/new.html.slim

@@ -15,7 +15,7 @@
           maxlength: 72,
           minlength: 8
 
-    = render Trek::Form::ActionsComponent.new do |c|
+    = render Trek::Form::ActionsComponent.new(aspect: :seamless) do |c|
       ruby:
         c.with_button(
           type: "submit",

data/lib/trek/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Trek
-  VERSION = "2.3.1"
+  VERSION = "2.3.2"
 end

data/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trek",
-  "version": "2.3.1",
+  "version": "2.3.2",
   "description": "A modern content management & back-office system for Ruby on Rails",
   "homepage": "https://trek.etamin.studio",
   "license": "MIT",

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: trek
 version: !ruby/object:Gem::Version
-  version: 2.3.1
+  version: 2.3.2
 platform: ruby
 authors:
 - Mohamed Bengrich