Class: CamaleonCms::CustomFieldGroup

Inherits:
CustomField
  • Object
show all
Defined in:
app/models/camaleon_cms/custom_field_group.rb

Instance Method Summary collapse

Instance Method Details

#add_fields(items, item_options) ⇒ Object

only used by form on admin panel (protected) return array of failed_fields and full_fields [[failed fields], [all fields]] items: hash of field items item_options: hash of options for each item



70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
 
# File 'app/models/camaleon_cms/custom_field_group.rb', line 70

def add_fields(items, item_options)
  fields.where.not(id: items.to_h.map { |_k, obj| obj['id'] }.uniq).destroy_all
  cache_fields = []
  order_index = 0
  errors_saved = []
  if items.present?
    items.each do |i, item|
      # allow string or symbol keys for incoming params
      id_val = item['id'] || item[:id]

      item[:field_order] = order_index
      options = item_options[i] || {}
      if id_val.present? && (field_item = fields.find_by(id: id_val)).present?
        # If this is an existing select_eval field (or the incoming data would
        # make it a select_eval) ensure the current actor has explicit
        # permission. For updates, we preserve the form-like behaviour by
        # collecting an error-like non-persisted field in errors_saved and
        # skipping the update when unauthorized.
        existing_key = (field_item.options || {})[:field_key].to_s
        # consider field_key coming from the per-item options (options) or the item itself
        incoming_key = (options[:field_key] || item[:field_key]).to_s
        if (existing_key == 'select_eval' || incoming_key == 'select_eval') && !can?(:manage, :select_eval)
          field_item.errors.add(:base, 'Not authorized to modify select_eval field')
          errors_saved << field_item
          next
        end

        saved = field_item.update(item)
        cache_fields << field_item
      else
        # Check if the incoming options request creation of select_eval
        incoming_key = (options[:field_key] || item[:field_key]).to_s
        if incoming_key == 'select_eval' && !can?(:manage, :select_eval)
          # Add an error-like non-persisted field to errors_saved to preserve behaviour
          field_item = fields.new(item)
          field_item.errors.add(:base, 'Not authorized to create select_eval field')
          errors_saved << field_item
          next
        end
        field_item = fields.new(item)
        cache_fields << field_item
        saved = field_item.save
        auto_save_default_values(field_item, options) if saved
        errors_saved << field_item unless saved
      end
      if saved
        field_item.set_meta('_default', options)
        order_index += 1
      end
    end
  end
  [errors_saved, cache_fields]
end

#add_manual_field(item, options) ⇒ Object Also known as: add_field

add fields to group item:

  • sample: "slug"=>"my_slug", "description"=>"my description (optional)"
  • options (textbox sample): "translate":"1"
  • field_key (string) | translate (boolean) | default_value (unique value) | default_values (array - multiple values for this field) | multiple_options (array)
  • multiple_options (used for select, radio and checkboxes ): [Title", "value"=>"2", "default"=>"1", "value"=>"3"] ****** check all options for each case in Admin::CustomFieldsHelper **** SAMPLE: my_model.add_field(Title", "slug"=>"subtitle", "translate"=>true, default_value: "Get in Touch") Adds a manual field to the group (used by admin UI) item: field attributes options: field options


42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
 
# File 'app/models/camaleon_cms/custom_field_group.rb', line 42

def add_manual_field(item, options)
  # Prevent creation of dangerous field types (select_eval) unless the actor is allowed.
  if options[:field_key] == 'select_eval'
    can?(:manage, :select_eval) ||
      raise(CanCan::AccessDenied, 'Not authorized to create select_eval fields')
  end

  c = get_field(item[:slug] || item['slug'])
  return c if c.present?

  field_item = fields.new(item)
  if field_item.save
    field_item.set_options(options)
    auto_save_default_values(field_item, options)
  end
  field_item
end

#get_caption ⇒ Object

generate the caption for this group The caption is rendered with raw by admin/settings/custom_fields/index.html.erb, so every interpolated value is escaped here, at the source: the_title already returns an escaped SafeBuffer, and the plain attributes below are escaped explicitly. object_class is included because the placement check admits any class name paired with the current site's id, so it is attacker-settable text like the model names are.



130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
 
# File 'app/models/camaleon_cms/custom_field_group.rb', line 130

def get_caption
  caption = ''
  begin
    case object_class
    when 'PostType_Post'
      caption = "Fields for Contents in <b>#{site.post_types.find(objectid).decorate.the_title}</b>"
    when 'PostType_Category'
      caption = "Fields for Categories in <b>#{site.post_types.find(objectid).decorate.the_title}</b>"
    when 'PostType_PostTag'
      caption = "Fields for Post tags in <b>#{site.post_types.find(objectid).decorate.the_title}</b>"
    when 'Main'
      widget_name = CamaleonCms::Widget::Main.find(objectid).name.translate
      caption = "Fields for Widget <b>(#{ERB::Util.html_escape(widget_name)})</b>"
    when 'Theme'
      theme_name = begin
        site.themes.find(objectid).name
      rescue StandardError
        objectid
      end
      caption = "Field settings for Theme <b>(#{ERB::Util.html_escape(theme_name)})</b>"
    when 'NavMenu'
      menu_name = CamaleonCms::NavMenu.find(objectid).name
      caption = "Field settings for Menus <b>(#{ERB::Util.html_escape(menu_name)})</b>"
    when 'Site'
      caption = 'Field settings the site'
    when 'PostType'
      caption = 'Fields for all <b>Post_Types</b>'
    when 'Post'
      p = CamaleonCms::Post.find(objectid).decorate
      caption = "Fields for content <b>(#{p.the_title})</b>"
    else # 'Plugin' or other class
      caption = "Fields for <b>#{ERB::Util.html_escape(object_class)}</b>"
    end
  rescue StandardError => e
    Rails.logger.debug "Camaleon CMS - Menu Item Error: #{e.message} ==> Attrs: #{attributes}"
  end
  # rubocop:disable Rails/OutputSafety -- every interpolated value above is escaped at the source
  caption.html_safe
  # rubocop:enable Rails/OutputSafety
end

#get_field(slug) ⇒ Object

return a field with slug = slug from the current group



62
63
64
 
# File 'app/models/camaleon_cms/custom_field_group.rb', line 62

def get_field(slug)
  fields.find_by_slug(slug) # rubocop:disable Rails/DynamicFindBy
end