Class: CamaleonCms::AdminController

Inherits:
CamaleonController
  • Object
show all
Defined in:
app/controllers/camaleon_cms/admin_controller.rb

Instance Method Summary collapse

Instance Method Details

#ajax ⇒ Object

ajax requests for admin panel you need to send a param mode to control the action to to do



42
43
44
45
46
47
48
49
50
 
# File 'app/controllers/camaleon_cms/admin_controller.rb', line 42

def ajax
  case params[:mode]
  when 'save_intro'
    current_site.set_option('save_intro', true)
  when 'save_intro_post'
    current_site.set_option('save_intro_post', true)
  end
  render plain: ''
end

#cama_get_i18n_frontend ⇒ Object

Decorators use this helper while rendering admin pages to keep public URLs in the site's frontend language instead of the admin interface language.



101
102
103
 
# File 'app/controllers/camaleon_cms/admin_controller.rb', line 101

def cama_get_i18n_frontend
  @cama_i18n_frontend
end

#dashboard ⇒ Object

render admin dashboard



53
54
55
 
# File 'app/controllers/camaleon_cms/admin_controller.rb', line 53

def dashboard
  index
end

#index ⇒ Object

render admin dashboard



36
37
38
 
# File 'app/controllers/camaleon_cms/admin_controller.rb', line 36

def index
  render 'dashboard'
end

#search ⇒ Object

render search results receive params receive params: define de type of the results type (content|category|tag) => default content if this is receiving a param, then will render only results view



61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
 
# File 'app/controllers/camaleon_cms/admin_controller.rb', line 61

def search
  add_breadcrumb I18n.t('camaleon_cms.admin.button.search')
  params[:kind] = 'content' if params[:kind].blank?
  # A crafted ?q[]=x / ?q[a]=b arrives as an Array / Parameters, which has no #downcase; treat any
  # non-String q as an empty query instead of 500ing.
  params[:q] = params[:q].is_a?(String) ? params[:q].downcase : ''
  # Security (audit 2026-08-11 M12): the action had no authorization and no status filter, so any
  # admin-area user (e.g. a client with no content rights) could enumerate every post title/slug in
  # every status -- draft, pending, private, trash -- plus post types, categories and tags they
  # cannot access. Scope every kind to the post types the caller may manage: content and post types
  # by :posts, categories and tags by their own :categories / :post_tags abilities (the roles UI
  # grants manage_categories / manage_tags independently of any post edit right).
  table_name = case params[:kind]
               when 'post_type'
                 base_query = current_site.post_types.where(id: cama_admin_searchable_post_type_ids)
                 Cama::PostType.table_name
               when 'category'
                 pt_ids = cama_admin_searchable_post_type_ids(:categories)
                 # A category's post type lives in post_type_id (the status column) at every nesting
                 # level; parent_id points at the parent *category* for children, so filtering by it
                 # would drop every nested category.
                 base_query = current_site.full_categories.where(post_type_id: pt_ids)
                 Cama::Category.table_name
               when 'tag'
                 pt_ids = cama_admin_searchable_post_type_ids(:post_tags)
                 base_query = current_site.post_tags.where(parent_id: pt_ids)
                 Cama::PostTag.table_name
               else
                 base_query = cama_admin_searchable_posts
                 Cama::Post.table_name
               end
  @items = base_query.where(
    items_sql_by_name(table_name), "%#{params[:q]}%", "%#{params[:q]}%", "%#{params[:q]}%"
  )

  @items = @items.paginate(page: params[:page], per_page: current_site.admin_per_page)
end