Module: CamaleonCms::ContentShortcodeGate

Extended by:

ActiveSupport::Concern

Included in:

CustomFieldsRelationship, Post, TermTaxonomy

Defined in:

app/models/concerns/camaleon_cms/content_shortcode_gate.rb

Overview

Save-time authorization gate for authored content that do_shortcode later expands (post content, custom-field values, taxonomy/widget descriptions). A registered shortcode makes theme/plugin code emit arbitrary HTML/JS at render, which the content scan cannot judge, so authorship is GATED behind the default-off content_shortcodes manager permission rather than filtered. The content is never escaped, stripped or rewritten -- a save carrying a shortcode is refused for an untrusted author, and stored verbatim for a trusted one.

Conforms to security-capability-gating (fail-closed) and the content-shortcode-gating capability. A model gates an attribute with gate_content_shortcodes :attr; a newly added surface that do_shortcode expands MUST adopt this gate (asserted by the coverage spec).