Class: CamaleonCms::Admin::InstallersController

Inherits:
CamaleonController
  • Object
show all
Defined in:
app/controllers/camaleon_cms/admin/installers_controller.rb

Constant Summary

Constants included from UploaderImageProcessing

UploaderImageProcessing::SVG_EXT_PATTERN

Constants included from UploaderContentSecurity

UploaderContentSecurity::COMPRESSED_MARKUP_EXTENSIONS, UploaderContentSecurity::GZIP_MAGIC, UploaderContentSecurity::HTML_MODE_EXTENSIONS, UploaderContentSecurity::MARKUP_EXTENSIONS, UploaderContentSecurity::MAX_DECOMPRESSED_MARKUP_BYTES, UploaderContentSecurity::SCRIPT_EXTENSIONS

Constants included from CaptchaImageGeneration

CaptchaImageGeneration::CAPTCHA_DEFAULT_LENGTH, CaptchaImageGeneration::CAPTCHA_MAX_LENGTH, CaptchaImageGeneration::CAPTCHA_MIN_LENGTH

Constants included from CaptchaHelper

CaptchaHelper::CAMA_ATTACK_WINDOW

Instance Method Summary collapse

Methods inherited from CamaleonController

#captcha, #render_error

Methods included from UploaderSupport

#cama_file_path_to_url, #cama_uploader, #cama_url_to_file_path, #slugify, #slugify_folder, #uploader_verify_name

Methods included from UploaderImageProcessing

#cama_crop_image, #cama_resize_and_crop, #cama_resize_upload, #cama_uploader_generate_thumbnail

Methods included from UploaderPipeline

#cama_tmp_upload, #cama_uploader_ct, #cama_uploader_human_size, #cama_uploader_t, #upload_file

Methods included from UploaderPathSecurity

#cama_allowed_upload_roots, #cama_base64_decoded_size, #cama_canonical_upload_path, #cama_extra_upload_roots, #cama_private_upload_mode?, #cama_private_upload_root, #cama_purge_staged_file, #cama_upload_failure, #path_within?, #same_host?, #same_site_url?, #site_url_path, #strip_locale_prefix

Methods included from UploaderContentSecurity

#cama_trusted_for_unfiltered_upload?, #content_unsafe?, #file_content_unsafe?, #svg_upload?

Methods included from CaptchaImageGeneration

#cama_captcha_build

Methods included from RuntimeAdminMenuConcern

#admin_menu_add_menu, #admin_menu_append_menu_item, #admin_menu_insert_menu_after, #admin_menu_insert_menu_before, #admin_menu_prepend_menu_item, #admin_menus_add_commons, #cama_comments_get_common_data

Methods included from RuntimeHtmlContentConcern

#append_asset_content, #append_asset_libraries, #append_pre_asset_content, #breadcrumb_add, #cama_draw_custom_assets, #cama_draw_pre_asset_contents, #cama_html_helpers_init, #cama_load_libraries, #theme_init

Methods included from ContentHelper

#cama_content_after_draw, #cama_content_append, #cama_content_before_draw, #cama_content_init, #cama_content_prepend

Methods included from RuntimeShortcodeThemeConcern

#cama_shortcode_data, #cama_shortcode_model_parser, #resolve_shortcode_theme_asset, #shortcode_add, #shortcode_asset_reference, #shortcode_descriptions, #shortcode_keys, #shortcode_templates, #shortcodes_init

Methods included from ThemeHelper

#self_theme_key, #theme_asset_file_path, #theme_asset_path, #theme_asset_url, #theme_home_page, #theme_init, #theme_layout, #theme_view

Methods included from HookLifecycleConcern

#hook_run, #hook_skip, #hooks_run

Methods included from RequestContextConcern

#current_site

Methods included from SiteHelper

#cama_current_site_host_port, #cama_get_list_layouts_files, #cama_get_list_template_files, #cama_is_test_request?, #current_locale, #current_site, #current_theme, #site_after_install, #site_install_theme, #site_uninstall_theme

Methods included from SessionRuntimeConcern

#auth_session_error, #cama_register_user, #login_user_with_password

Methods included from CaptchaHelper

#cama_captcha_attack_ip_count, #cama_captcha_attack_ip_key, #cama_captcha_increment_attack, #cama_captcha_reset_attack, #cama_captcha_tag, #cama_captcha_tags_if_under_attack, #cama_captcha_total_attacks, #cama_captcha_under_attack?, #cama_captcha_verified?, #captcha_verify_if_under_attack

Methods included from EmailHelper

#cama_send_email, #cama_send_mail_to_admin, #send_email, #send_password_reset_email, #send_user_confirm_email

Methods included from HooksHelper

#hook_run, #hook_skip, #hooks_run

Methods included from PluginsHelper

#current_plugin, #plugin_asset_path, #plugin_asset_url, #plugin_destroy, #plugin_install, #plugin_layout, #plugin_load_helpers, #plugin_uninstall, #plugin_upgrade, #plugin_view, #plugins_initialize, #self_plugin_key

Methods included from SessionHelper

#cama_authenticate, #cama_current_role, #cama_current_user, #cama_get_session_id, #cama_impersonation_parent_user, #cama_logout_user, #cama_on_heroku?, #cama_register_user, #cama_sign_in?, #cookie_auth_token_complete?, #cookie_split_auth_token, #login_user, #login_user_with_password, #session_back_to_parent, #session_switch_user, #user_auth_token_from_cookie

Methods included from CamaleonHelper

#cama_cache_fetch, #cama_edit_link, #cama_is_admin_request?, #cama_pluralize_text, #cama_sitemap_cats_generator, #cama_t, #ct

Instance Method Details

#index ⇒ Object 



11
12
13
14
15
16
17
18
 
# File 'app/controllers/camaleon_cms/admin/installers_controller.rb', line 11

def index
  # Ensure the setup token exists (and is logged) so a remote operator can read it and enter it
  # below. Local installs are exempt (require_setup_token), so no token is generated for them.
  CamaleonCms::SetupToken.value if CamaleonCms::SetupToken.required? && !request.local?
  @site ||= CamaleonCms::Site.new
  @site.slug = request.original_url.to_s.parse_domain
  render 'form'
end

#installer_verification ⇒ Object 



42
43
44
 
# File 'app/controllers/camaleon_cms/admin/installers_controller.rb', line 42

def installer_verification
  redirect_to cama_root_url unless CamaleonCms::Site.count == 0
end

#require_setup_token ⇒ Object

Refuse to provision unless the request carries the setup token (readable only from the server's environment or filesystem). Only enforced while no site exists; afterwards installer_verification has already closed the installer.



49
50
51
52
53
54
55
56
57
58
59
60
61
62
 
# File 'app/controllers/camaleon_cms/admin/installers_controller.rb', line 49

def require_setup_token
  return unless CamaleonCms::SetupToken.required?
  # Loopback requests (a local console/dev install, or an SSH tunnel) already prove host access,
  # so the token is required only for remote requests. request.local? is true only when the
  # computed client IP is loopback, so a real remote client behind a proxy that forwards
  # X-Forwarded-For is still gated. See harden-installer-default-admin.
  return if request.local?
  return if CamaleonCms::SetupToken.valid?(params[:setup_token])

  flash[:error] = t('camaleon_cms.admin.installer.invalid_setup_token',
                    default: 'A valid setup token is required to install. See the server log or ' \
                             'tmp/camaleon_setup_token.')
  redirect_to cama_admin_installers_path
end

#save ⇒ Object 



20
21
22
23
24
25
26
27
28
29
30
31
32
33
 
# File 'app/controllers/camaleon_cms/admin/installers_controller.rb', line 20

def save
  @site = CamaleonCms::Site.new(params[:site].permit(:slug, :name)).decorate
  if @site.save
    site_after_install(@site, params[:theme])
    CamaleonCms::SetupToken.clear! # single-use: the installer is closed now that a site exists
    # Carry the generated admin password to the welcome page for a single, session-scoped display.
    flash[:generated_admin_password] = @site.generated_admin_password
    session[:cama_installer_welcome] = true
    flash[:notice] = t('camaleon_cms.admin.sites.message.created')
    redirect_to action: :welcome
  else
    index
  end
end

#welcome ⇒ Object 



35
36
37
38
39
40
 
# File 'app/controllers/camaleon_cms/admin/installers_controller.rb', line 35

def welcome
  # Only the operator who just completed setup may see the credentials; the marker is one-time.
  return redirect_to  unless session.delete(:cama_installer_welcome)

  @generated_admin_password = flash[:generated_admin_password]
end