Class: CamaleonCms::Admin::Settings::CustomFieldsController

Inherits:
CamaleonCms::Admin::SettingsController show all
Defined in:
app/controllers/camaleon_cms/admin/settings/custom_fields_controller.rb

Instance Method Summary collapse

Methods inherited from CamaleonCms::Admin::SettingsController

#languages, #save_languages, #save_theme, #shortcodes, #site, #site_saved, #test_email, #theme

Methods inherited from CamaleonCms::AdminController

#ajax, #cama_get_i18n_frontend, #dashboard, #search

Instance Method Details

#create ⇒ Object

create a new custom field group



45
46
47
48
49
50
51
52
 
# File 'app/controllers/camaleon_cms/admin/settings/custom_fields_controller.rb', line 45

def create
  @field_group = current_site.custom_field_groups.new(@post_data)
  if @field_group.save && _save_fields(@field_group)
    redirect_to action: :edit, id: @field_group.id
  else
    new
  end
end

#destroy ⇒ Object

destroy a custom field group



55
56
57
58
59
 
# File 'app/controllers/camaleon_cms/admin/settings/custom_fields_controller.rb', line 55

def destroy
  @field_group.destroy
  flash[:notice] = t('camaleon_cms.admin.custom_field.message.deleted', default: 'Custom Field Group Deleted.')
  redirect_to action: :index
end

#edit ⇒ Object 



25
26
27
28
 
# File 'app/controllers/camaleon_cms/admin/settings/custom_fields_controller.rb', line 25

def edit
  add_breadcrumb I18n.t('camaleon_cms.admin.button.edit')
  render 'form'
end

#get_items ⇒ Object 



18
19
20
21
 
# File 'app/controllers/camaleon_cms/admin/settings/custom_fields_controller.rb', line 18

def get_items
  @key = params[:key]
  render partial: 'get_items', layout: false
end

#index ⇒ Object 



11
12
13
14
15
16
 
# File 'app/controllers/camaleon_cms/admin/settings/custom_fields_controller.rb', line 11

def index
  @field_groups = current_site.custom_field_groups.visible_group.eager_load(:site)
  @field_groups = @field_groups.where(object_class: params[:c]) if params[:c].present?
  @field_groups = @field_groups.where(objectid: params[:id]) if params[:id].present?
  @field_groups = @field_groups.paginate(page: params[:page], per_page: current_site.admin_per_page)
end

#list ⇒ Object 



71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
 
# File 'app/controllers/camaleon_cms/admin/settings/custom_fields_controller.rb', line 71

def list
  p = params.permit(:post_type, :post_id)
  cat_ids = current_site.full_categories.where(id: params[:categories]).pluck(:id)
  if p[:post_id].present? && (post = current_site.the_post(p[:post_id].to_i)).present?
    # The action carries no before_action, so authorize against the resolved post: a caller who
    # cannot update it may neither read its custom-field values (GET) nor rewrite its categories
    # (POST). This scopes an otherwise any-signed-in-user endpoint to the post's own editors.
    authorize! :update, post
    # The category write is state-changing, so it runs only on a POST — the sole verb on this
    # route that protect_from_forgery verifies, because Rails exempts HEAD from CSRF checks
    # just like GET (an `unless request.get?` guard would let a CSRF-exempt HEAD through). A GET
    # or HEAD renders the current fields without mutating the post. Otherwise a bare
    # GET .../custom_fields/list?post_id=N (CSRF through a top-level navigation, which carries
    # the SameSite=Lax auth cookie) wipes the post's categories, because an omitted `categories`
    # param resolves to [] and update_categories then deletes them all (audit finding M6).
    post.update_categories(cat_ids) if request.post?
    args = {}
  else
    # The render-only branch builds a new post of the requested type; gate it on the ability to
    # create posts of that type so the field-group structure is not disclosed to other roles.
    post_type = current_site.the_post_type(p[:post_type].to_i)
    authorize! :create_post, post_type if post_type
    post = CamaleonCms::Post.new
    post.taxonomy_id = post_type&.id
    args = { cat_ids: cat_ids }
  end
  render partial: 'camaleon_cms/admin/settings/custom_fields/render',
         locals: { record: post, field_groups: post.get_field_groups(args),
                   show_shortcode: true }
end

#new ⇒ Object 



38
39
40
41
42
 
# File 'app/controllers/camaleon_cms/admin/settings/custom_fields_controller.rb', line 38

def new
  add_breadcrumb I18n.t('camaleon_cms.admin.button.new')
  @field_group ||= current_site.custom_field_groups.new
  render 'form'
end

#reorder ⇒ Object

reorder custom fields group



62
63
64
65
66
67
68
69
 
# File 'app/controllers/camaleon_cms/admin/settings/custom_fields_controller.rb', line 62

def reorder
  params[:values].to_a.each_with_index do |value, index|
    current_site.custom_field_groups.find(value)
                .update_column(:field_order, index) # rubocop:disable Rails/SkipsModelValidations
  end
  json = { size: params[:values].size }
  render json: json
end

#show ⇒ Object 



23
 
# File 'app/controllers/camaleon_cms/admin/settings/custom_fields_controller.rb', line 23

def show; end

#update ⇒ Object 



30
31
32
33
34
35
36
 
# File 'app/controllers/camaleon_cms/admin/settings/custom_fields_controller.rb', line 30

def update
  if @field_group.update(@post_data) && _save_fields(@field_group)
    redirect_to action: :edit, id: @field_group.id
  else
    render 'form'
  end
end