diff --git a/app/controllers/admin/application_controller.rb b/app/controllers/admin/application_controller.rb index 3c0947c60eb6ea704e0e47cc1dd791299916c656..5a98ff54f8810af2844520e7a79ce801542235b5 100644 --- a/app/controllers/admin/application_controller.rb +++ b/app/controllers/admin/application_controller.rb @@ -1,6 +1,7 @@ class Admin::ApplicationController < ApplicationController layout 'admin/layouts/application' + before_action :redirect_if_context_is_not_an_university! before_action :load_block_copy_cookie include Admin::Filterable @@ -37,4 +38,11 @@ class Admin::ApplicationController < ApplicationController # If the block doesn't exist anymore end + private + + def redirect_if_context_is_not_an_university! + # Currently (Nov 2023), context can be: an extranet, an university (admin) or none. + redirect_to root_path unless current_context.is_a?(University) + end + end diff --git a/app/controllers/admin/communication/websites/agenda/events_controller.rb b/app/controllers/admin/communication/websites/agenda/events_controller.rb index 048c50b996dc8a117a2a3363fe97896f2e34bfaf..3017939ab810cf1493c42585de7f732729f581ac 100644 --- a/app/controllers/admin/communication/websites/agenda/events_controller.rb +++ b/app/controllers/admin/communication/websites/agenda/events_controller.rb @@ -1,5 +1,5 @@ class Admin::Communication::Websites::Agenda::EventsController < Admin::Communication::Websites::Agenda::ApplicationController - load_and_authorize_resource class: Communication::Website::Agenda::Event, + load_and_authorize_resource class: Communication::Website::Agenda::Event, through: :website before_action :load_categories @@ -23,7 +23,7 @@ class Admin::Communication::Websites::Agenda::EventsController < Admin::Communic def static @about = @event - render layout: false + render_as_plain_text end def new @@ -39,7 +39,7 @@ class Admin::Communication::Websites::Agenda::EventsController < Admin::Communic @event.website = @website @event.add_photo_import params[:photo_import] if @event.save_and_sync - redirect_to admin_communication_website_agenda_event_path(@event), + redirect_to admin_communication_website_agenda_event_path(@event), notice: t('admin.successfully_created_html', model: @event.to_s) else breadcrumb @@ -50,7 +50,7 @@ class Admin::Communication::Websites::Agenda::EventsController < Admin::Communic def update @event.add_photo_import params[:photo_import] if @event.update_and_sync(event_params) - redirect_to admin_communication_website_agenda_event_path(@event), + redirect_to admin_communication_website_agenda_event_path(@event), notice: t('admin.successfully_updated_html', model: @event.to_s) else breadcrumb @@ -66,7 +66,7 @@ class Admin::Communication::Websites::Agenda::EventsController < Admin::Communic def destroy @event.destroy - redirect_to admin_communication_website_agenda_events_url, + redirect_to admin_communication_website_agenda_events_url, notice: t('admin.successfully_destroyed_html', model: @event.to_s) end protected @@ -87,7 +87,7 @@ class Admin::Communication::Websites::Agenda::EventsController < Admin::Communic .permit( :title, :subtitle, :meta_description, :summary, :published, :slug, :featured_image, :featured_image_delete, :featured_image_infos, :featured_image_alt, :featured_image_credit, - :from_day, :from_hour, :to_day, :to_hour, + :from_day, :from_hour, :to_day, :to_hour, category_ids: [] ) .merge( diff --git a/app/controllers/admin/communication/websites/menus_controller.rb b/app/controllers/admin/communication/websites/menus_controller.rb index 441bbd9987c6aa6991a6d4760ef9bbe28454ea61..93991c1a1f6535e81256ad2b36c89eaa5faac7fe 100644 --- a/app/controllers/admin/communication/websites/menus_controller.rb +++ b/app/controllers/admin/communication/websites/menus_controller.rb @@ -16,7 +16,7 @@ class Admin::Communication::Websites::MenusController < Admin::Communication::We def static @about = @menu - render layout: false + render_as_plain_text end def new diff --git a/app/controllers/admin/communication/websites/pages_controller.rb b/app/controllers/admin/communication/websites/pages_controller.rb index ec188547031ffc785b57ac48e146945991b8e978..58492a51cb2411e0b4d91cd51c14a6dd90fe76a4 100644 --- a/app/controllers/admin/communication/websites/pages_controller.rb +++ b/app/controllers/admin/communication/websites/pages_controller.rb @@ -56,7 +56,7 @@ class Admin::Communication::Websites::PagesController < Admin::Communication::We def static @about = @page - render layout: false + render_as_plain_text end def preview diff --git a/app/controllers/admin/communication/websites/posts/categories_controller.rb b/app/controllers/admin/communication/websites/posts/categories_controller.rb index c0c9f4eefad9fa15431b8e07d1f58fd0cd910597..209c45735edfff34107140f3bf111633704aa080 100644 --- a/app/controllers/admin/communication/websites/posts/categories_controller.rb +++ b/app/controllers/admin/communication/websites/posts/categories_controller.rb @@ -41,7 +41,7 @@ class Admin::Communication::Websites::Posts::CategoriesController < Admin::Commu def static @about = @category - render layout: false + render_as_plain_text end def new diff --git a/app/controllers/admin/communication/websites/posts_controller.rb b/app/controllers/admin/communication/websites/posts_controller.rb index 76a073d459c253bffe9c2ea932cb19f2407d38f4..17eb86cbc10159668860cb70ce6bb64490cb45f3 100644 --- a/app/controllers/admin/communication/websites/posts_controller.rb +++ b/app/controllers/admin/communication/websites/posts_controller.rb @@ -53,7 +53,7 @@ class Admin::Communication::Websites::PostsController < Admin::Communication::We def static @about = @post - render layout: false + render_as_plain_text end def new diff --git a/app/controllers/admin/communication/websites_controller.rb b/app/controllers/admin/communication/websites_controller.rb index cd77a57143929e40b4a99e477a2451577cae5599..f8b20c0c138057d7af02ae5217dc8a446737fe84 100644 --- a/app/controllers/admin/communication/websites_controller.rb +++ b/app/controllers/admin/communication/websites_controller.rb @@ -35,7 +35,7 @@ class Admin::Communication::WebsitesController < Admin::Communication::Websites: def static @about = @website - render layout: false + render_as_plain_text end def new @@ -77,7 +77,7 @@ class Admin::Communication::WebsitesController < Admin::Communication::Websites: def website_params attribute_names = [ :name, :url, :repository, :about_type, :about_id, :in_production, - :git_provider, :git_endpoint, :git_branch, :plausible_url, + :git_provider, :git_endpoint, :git_branch, :plausible_url, :feature_posts, :feature_agenda, :deuxfleurs_hosting, :default_image, :default_image_delete, :social_mastodon, :social_x, :social_linkedin, :social_youtube, :social_vimeo, :social_peertube, :social_instagram, :social_facebook, :social_tiktok, :social_email, :social_github, diff --git a/app/controllers/admin/education/diplomas_controller.rb b/app/controllers/admin/education/diplomas_controller.rb index fdde0bd5b0974af274e4917e5ab64cd6e3280731..2be48e2e1d74abfdd859a32c461ebe500350f381 100644 --- a/app/controllers/admin/education/diplomas_controller.rb +++ b/app/controllers/admin/education/diplomas_controller.rb @@ -14,7 +14,7 @@ class Admin::Education::DiplomasController < Admin::Education::ApplicationContro def static @about = @diploma @website = @diploma.websites&.first - render layout: false + render_as_plain_text end def new diff --git a/app/controllers/admin/education/programs_controller.rb b/app/controllers/admin/education/programs_controller.rb index 2e94f58bf2e07621db23aa0193ef21150335fd78..30e6561f067ae08e94c3bbbb490ce7a771ddcfaf 100644 --- a/app/controllers/admin/education/programs_controller.rb +++ b/app/controllers/admin/education/programs_controller.rb @@ -55,7 +55,7 @@ class Admin::Education::ProgramsController < Admin::Education::ApplicationContro def static @about = @program @website = @program.websites&.first - render layout: false + render_as_plain_text end def preview diff --git a/app/controllers/admin/research/hal/publications_controller.rb b/app/controllers/admin/research/hal/publications_controller.rb index cefc974e8690c32ed6519bb63b205ad1425f756f..884b4efab6f4b776266f9f85045213aea7c71f80 100644 --- a/app/controllers/admin/research/hal/publications_controller.rb +++ b/app/controllers/admin/research/hal/publications_controller.rb @@ -13,7 +13,7 @@ class Admin::Research::Hal::PublicationsController < Admin::Research::Hal::Appli def static @about = @publication @website = @publication.websites&.first || current_university.websites.first - render layout: false + render_as_plain_text end def destroy diff --git a/app/controllers/admin/research/journals/papers/kinds_controller.rb b/app/controllers/admin/research/journals/papers/kinds_controller.rb index 7d27734cb2e5eab7ebc53b4e55d0d2bba13cfb70..15ebd50ff9c043f175b39a5c314ccc8f13c970d9 100644 --- a/app/controllers/admin/research/journals/papers/kinds_controller.rb +++ b/app/controllers/admin/research/journals/papers/kinds_controller.rb @@ -17,7 +17,7 @@ class Admin::Research::Journals::Papers::KindsController < Admin::Research::Jour if @website.nil? render plain: "Pas de site Web lié au journal" else - render layout: false + render_as_plain_text end end diff --git a/app/controllers/admin/research/journals/papers_controller.rb b/app/controllers/admin/research/journals/papers_controller.rb index 03d30393273b012bac8475e3e6c917aaa0aa6c64..accf983073002ae7e1e4a5e405c0077f6a8aee23 100644 --- a/app/controllers/admin/research/journals/papers_controller.rb +++ b/app/controllers/admin/research/journals/papers_controller.rb @@ -17,7 +17,7 @@ class Admin::Research::Journals::PapersController < Admin::Research::Journals::A if @website.nil? render plain: "Pas de site Web lié au journal" else - render layout: false + render_as_plain_text end end diff --git a/app/controllers/admin/research/journals/volumes_controller.rb b/app/controllers/admin/research/journals/volumes_controller.rb index 343b40ce0ae0a8a97f505c7324c59f643dc6a1e1..c1134e5a753565fd82c2c50c8d7bf7e39d08e13a 100644 --- a/app/controllers/admin/research/journals/volumes_controller.rb +++ b/app/controllers/admin/research/journals/volumes_controller.rb @@ -17,7 +17,7 @@ class Admin::Research::Journals::VolumesController < Admin::Research::Journals:: if @website.nil? render plain: "Pas de site Web lié au journal" else - render layout: false + render_as_plain_text end end diff --git a/app/controllers/admin/university/organizations_controller.rb b/app/controllers/admin/university/organizations_controller.rb index 0c3247502426e9b2038b7264bb4029f18611b15b..9387ec97d8a38e96367eeb84b849fa69b837a304 100644 --- a/app/controllers/admin/university/organizations_controller.rb +++ b/app/controllers/admin/university/organizations_controller.rb @@ -32,8 +32,8 @@ class Admin::University::OrganizationsController < Admin::University::Applicatio .search_by_siren_or_name(@term) .ordered @organizations = @organizations.joins(:language) - .where(languages: { - iso_code: language.iso_code + .where(languages: { + iso_code: language.iso_code }) if language.present? end @@ -56,7 +56,7 @@ class Admin::University::OrganizationsController < Admin::University::Applicatio def static @about = @organization @website = @organization.websites&.first - render layout: false + render_as_plain_text end def new diff --git a/app/controllers/admin/university/people_controller.rb b/app/controllers/admin/university/people_controller.rb index 40e865f399bf0aa612cbe789d05e16611b3d23cd..d67706aa5df03b24ebcfca286d45778b29609162 100644 --- a/app/controllers/admin/university/people_controller.rb +++ b/app/controllers/admin/university/people_controller.rb @@ -54,7 +54,7 @@ class Admin::University::PeopleController < Admin::University::ApplicationContro def static @about = @person @website = @person.websites&.first - render layout: false + render_as_plain_text end def new diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index 6b668bc7371d0108d2459933469068b08fde5f06..044259dca12a0f943c60f8d81f8c87787f803ad2 100644 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -11,6 +11,12 @@ class ApplicationController < ActionController::Base add_breadcrumb t('home'), root_path end + protected + + def render_as_plain_text + render layout: false, content_type: "text/plain; charset=utf-8" + end + private def current_ability diff --git a/app/models/communication/website/with_deuxfleurs.rb b/app/models/communication/website/with_deuxfleurs.rb index bf16cc778761fae0fabf6f96092bfbe882de7cc6..6a31cd5127fc1771ae7dc79d53d56d850d8c888b 100644 --- a/app/models/communication/website/with_deuxfleurs.rb +++ b/app/models/communication/website/with_deuxfleurs.rb @@ -50,19 +50,27 @@ module Communication::Website::WithDeuxfleurs update_columns access_token: ENV['GITHUB_ACCESS_TOKEN'], repository: deuxfleurs_default_github_repository, deployment_status_badge: deuxfleurs_default_badge_url - git_repository.init_from_template(deuxfleurs_default_identifier) + git_repository.init_from_template(deuxfleurs_default_github_repository_name) end + # cartographie.agit.osuny.site def deuxfleurs_default_identifier "#{to_s.parameterize}.#{university.identifier}.osuny.site" end + # https://cartographie.agit.osuny.site def deuxfleurs_default_url "https://#{deuxfleurs_default_identifier}" end + # agit-cartographie + def deuxfleurs_default_github_repository_name + "#{university.identifier}-#{to_s.parameterize}" + end + + # noesya/agit-cartographie def deuxfleurs_default_github_repository - "noesya/#{university.identifier}-#{to_s.parameterize}" + "noesya/#{deuxfleurs_default_github_repository_name}" end def deuxfleurs_default_badge_url diff --git a/app/views/admin/communication/blocks/components/code/_show.html.erb b/app/views/admin/communication/blocks/components/code/_show.html.erb index c3042cff636692d6a07ac30c4e82ea8b28cba5a0..0d0439bacd31985e78c51931ab9a2f5b4020dece 100644 --- a/app/views/admin/communication/blocks/components/code/_show.html.erb +++ b/app/views/admin/communication/blocks/components/code/_show.html.erb @@ -1 +1,14 @@ -<%= value.html_safe %> +<% +unsanitized_value = value.html_safe +sanitized_value = sanitize(value) if strip_javascript +%> + +<% if strip_javascript %> + <%= sanitized_value %> + + <% if sanitized_value != unsanitized_value %> + <p><small><em><%= t('admin.communication.blocks.components.code.preview.sanitized_notice') %></em></small></p> + <% end %> +<% else %> + <%= unsanitized_value %> +<% end %> \ No newline at end of file diff --git a/app/views/admin/communication/blocks/content/_show.html.erb b/app/views/admin/communication/blocks/content/_show.html.erb index 2f17df1b5a48ca57e56863125755ba4ec1ac613a..3af7a1e7daf3e6203335de961657465ca89206db 100644 --- a/app/views/admin/communication/blocks/content/_show.html.erb +++ b/app/views/admin/communication/blocks/content/_show.html.erb @@ -1,6 +1,7 @@ +<% strip_javascript ||= false %> <% about.blocks.without_heading.published.ordered.each do |block| %> - <%= render "admin/communication/blocks/templates/#{block.template_kind}/show", block: block %> + <%= render "admin/communication/blocks/templates/#{block.template_kind}/show", block: block, strip_javascript: strip_javascript %> <% end %> <% about.headings.root.ordered.each do |heading| %> - <%= render 'admin/communication/blocks/headings/show', heading: heading %> + <%= render 'admin/communication/blocks/headings/show', heading: heading, strip_javascript: strip_javascript %> <% end %> diff --git a/app/views/admin/communication/blocks/headings/_show.html.erb b/app/views/admin/communication/blocks/headings/_show.html.erb index 236eaa9f5add13e8df7be9d8f104d9ed50fded2b..7268a2abc351412c5bfb4421a0533f0e76c2fd56 100644 --- a/app/views/admin/communication/blocks/headings/_show.html.erb +++ b/app/views/admin/communication/blocks/headings/_show.html.erb @@ -2,8 +2,8 @@ <h2><%= heading %></h2> </div> <% heading.blocks.published.ordered.each do |block| %> - <%= render "admin/communication/blocks/templates/#{block.template_kind}/show", block: block %> + <%= render "admin/communication/blocks/templates/#{block.template_kind}/show", block: block, strip_javascript: strip_javascript %> <% end %> <% heading.children.ordered.each do |child| %> - <%= render 'admin/communication/blocks/headings/show', heading: child %> + <%= render 'admin/communication/blocks/headings/show', heading: child, strip_javascript: strip_javascript %> <% end %> diff --git a/app/views/admin/communication/blocks/templates/embed/_show.html.erb b/app/views/admin/communication/blocks/templates/embed/_show.html.erb index 78e33a0e233e70545c2fede36a8c123dbe807763..a5b17ae7f6489c047920ca8df9fcd8b8739fe298 100644 --- a/app/views/admin/communication/blocks/templates/embed/_show.html.erb +++ b/app/views/admin/communication/blocks/templates/embed/_show.html.erb @@ -1,5 +1,5 @@ <% - class_name = "block block-embed" + class_name = "block block-embed" unless block.title.blank? class_name += " block-with-title" end @@ -14,7 +14,7 @@ </div> <% end %> - <%= block_component_show block, :code %> + <%= block_component_show block, :code, strip_javascript: strip_javascript %> <% unless block.template.transcription.blank? %> <div class="transcription"> @@ -29,6 +29,3 @@ </div> </div> </div> - - - diff --git a/app/views/admin/communication/extranets/posts/categories/preview.html.erb b/app/views/admin/communication/extranets/posts/categories/preview.html.erb index 3a5cdcc3c76ca4c11387e92c619494cd5631d2ca..c67306c9fc30210119cc31c6b02c4b9b7a70a3e4 100644 --- a/app/views/admin/communication/extranets/posts/categories/preview.html.erb +++ b/app/views/admin/communication/extranets/posts/categories/preview.html.erb @@ -1,3 +1,3 @@ <% content_for :title, @post.title %> <% content_for :image, kamifusen_tag(@post.featured_image) if @post.featured_image.attached? %> -<%= render 'admin/communication/blocks/content/show', about: @post %> +<%= render 'admin/communication/blocks/content/show', about: @post, strip_javascript: true %> diff --git a/app/views/admin/communication/extranets/posts/preview.html.erb b/app/views/admin/communication/extranets/posts/preview.html.erb index 3a5cdcc3c76ca4c11387e92c619494cd5631d2ca..c67306c9fc30210119cc31c6b02c4b9b7a70a3e4 100644 --- a/app/views/admin/communication/extranets/posts/preview.html.erb +++ b/app/views/admin/communication/extranets/posts/preview.html.erb @@ -1,3 +1,3 @@ <% content_for :title, @post.title %> <% content_for :image, kamifusen_tag(@post.featured_image) if @post.featured_image.attached? %> -<%= render 'admin/communication/blocks/content/show', about: @post %> +<%= render 'admin/communication/blocks/content/show', about: @post, strip_javascript: true %> diff --git a/app/views/admin/communication/websites/pages/preview.html.erb b/app/views/admin/communication/websites/pages/preview.html.erb index 437385c9a0e09a548d305576ad0e99d4774eb29d..ec8c0ab3b6a9ed6ec0e64c05428b13671d6941f9 100644 --- a/app/views/admin/communication/websites/pages/preview.html.erb +++ b/app/views/admin/communication/websites/pages/preview.html.erb @@ -1,4 +1,4 @@ <% content_for :title, @page.title %> <% content_for :summary, @page.summary %> <% content_for :image, kamifusen_tag(@page.best_featured_image) if @page.best_featured_image.attached? %> -<%= render 'admin/communication/blocks/content/show', about: @page %> +<%= render 'admin/communication/blocks/content/show', about: @page, strip_javascript: true %> diff --git a/app/views/admin/communication/websites/posts/preview.html.erb b/app/views/admin/communication/websites/posts/preview.html.erb index 7946b0bfc17dc1a815be884e018d6bef7b629860..f6d4a372e7837ead0f84e0fd6c35ecf34a3f1fc8 100644 --- a/app/views/admin/communication/websites/posts/preview.html.erb +++ b/app/views/admin/communication/websites/posts/preview.html.erb @@ -1,4 +1,4 @@ <% content_for :title, @post.title %> <% content_for :summary, @post.summary %> <% content_for :image, kamifusen_tag(@post.featured_image) if @post.featured_image.attached? %> -<%= render 'admin/communication/blocks/content/show', about: @post %> +<%= render 'admin/communication/blocks/content/show', about: @post, strip_javascript: true %> diff --git a/app/views/admin/education/programs/preview.html.erb b/app/views/admin/education/programs/preview.html.erb index 48d60a29a1c8225d75831845ce13030aa6292c99..d2c323d0df80a4f984cb781d0d91b1cc7d76050d 100644 --- a/app/views/admin/education/programs/preview.html.erb +++ b/app/views/admin/education/programs/preview.html.erb @@ -49,7 +49,7 @@ </section> <div class="blocks"> - <%= render 'admin/communication/blocks/content/show', about: @program %> + <%= render 'admin/communication/blocks/content/show', about: @program, strip_javascript: true %> </div> <section id="pedagogy"> diff --git a/app/views/extranet/posts/posts/show.html.erb b/app/views/extranet/posts/posts/show.html.erb index 8f4abc748c08039223d8409b47045a711cec1857..003461e6968cbd979bb8fef9653bb5f01fcf492d 100644 --- a/app/views/extranet/posts/posts/show.html.erb +++ b/app/views/extranet/posts/posts/show.html.erb @@ -1,5 +1,5 @@ <% content_for :header do %> - <% + <% if @post.featured_image.attached? image_classes = 'col-md-3 offset-2' image_width = 400 diff --git a/config/locales/communication/contents/en.yml b/config/locales/communication/contents/en.yml index 40ec14283366c29281c254f3a2232da9af39959e..e5279f58b42a55fbc7321a417efe04799b5eabbf 100644 --- a/config/locales/communication/contents/en.yml +++ b/config/locales/communication/contents/en.yml @@ -19,12 +19,9 @@ en: label: Utility blocks description: Purely practical and technical features components: - text: - label: Text - placeholder: Enter text - transcription: - label: Text transcript - placeholder: Enter text transcript + code: + preview: + sanitized_notice: For security reasons, the content has been filtered. Scripts will not be loaded and/or executed, and the apparence may be altered. file: input: label: File @@ -40,10 +37,16 @@ en: label: Credit placeholder: Enter credit layouts: - label: Layout button: Choose the layout + label: Layout link: - target_blank: Open in new window + target_blank: Open in new window + text: + label: Text + placeholder: Enter text + transcription: + label: Text transcript + placeholder: Enter text transcript time_slot: from: From to: to diff --git a/config/locales/communication/contents/fr.yml b/config/locales/communication/contents/fr.yml index 29545085793dd11c52c451fc9f055f81773dca6a..460bd127828f24e55738462cb661befee84d3033 100644 --- a/config/locales/communication/contents/fr.yml +++ b/config/locales/communication/contents/fr.yml @@ -19,12 +19,9 @@ fr: label: Blocs techniques description: Des fonctionnalités pratiques, purement utilitaires components: - text: - label: Texte - placeholder: Entrer le texte - transcription: - label: Transcription textuelle du contenu - placeholder: Entrer ici la transcription + code: + preview: + sanitized_notice: Pour des raisons de sécurité, le contenu a été filtré. Les scripts ne sont pas chargés et/ou exécutés, et l'apparence peut être alterée. file: input: label: Fichier @@ -40,10 +37,16 @@ fr: label: Crédit placeholder: Entrer le crédit layouts: - label: Mise en page button: Choisir la mise en page + label: Mise en page link: target_blank: Ouvrir dans une nouvelle fenêtre + text: + label: Texte + placeholder: Entrer le texte + transcription: + label: Transcription textuelle du contenu + placeholder: Entrer ici la transcription time_slot: from: De to: Ã