| Age | Commit message (Collapse) | Author |
|---|
|
by many views inside. The inner ones are gone
nodes#edit's becomes #body_field, which is what #edit_grid places in its
full-width row.
Rows now reach into the label band themselves rather than depending on a
page wrapper to do it. The label column plus its gap equals the escape, so
a row's content starts at the gutter on every page; #edit_grid's rows are
exempt because the grid already steps back.
share one left edge. #new_node's -118px was compensating for that 10px and
left the page 7px out once it went. standalone_action_bar was overridden
everywhere it appeared.
page_translations#edit no longer uses #edit_grid: it has no metadata column,
so the two-column template pushed its abstract into the empty half.
nodes#edit's lower action bar was inside #edit_grid, so it was a grid item
inheriting the escape and sat 125px left of the form above it.
|
|
|
|
row_primary and row_secondary replace four names for a row's title and five
for its supporting line, across the tables and the sitemap. Actions cells no
longer sit flush against the row edge
Header rows move into thead, which retires the .header class from the CSS,
the tr.header:hover suppression, and .no_hover
Replace variety of nodes_table, assets_table, events_table, revisions_table,
user_table and sitemap with a shared class admin_table
|
|
|
|
Builder escapes by default; the three feed templates no longer call
CGI.escapeHTML. This fixes two sites that never escaped at all: the tag
feed's externally supplied :tag segment, interpolated into its title, self
link and id, and dc:creator in the RDF template.
Subscribers see one difference: quotes and apostrophes arrive raw, which is
valid in element text.
config/initializers/xmlparser.rb, which redefined Builder::XmlBase#_escape
as the identity function, is gone. XML::Node#replace_with went with it, no
callers.
|
|
diff_against gained external_url, published_at and user. The view renders
each metadata section only when that attribute changed, and says so once
when none did.
Metadata now precedes the locale pointer, which speaks only of translations:
above the metadata it read as "nothing changed" on a revision that had moved
the page.
|
|
|
|
|
|
The picker moves from assets/edit to assets/show, where the list of attached
pages already is.
A member route, POST assets/:id/attach_to_node, replaces the ride on #update.
Supersedes the picker wiring in the previous commit; what remains of it is
@attach_node in #create, the flash composition and the corrected hint.
|
|
Node#attach_asset! writes to the node's draft alone, creating one from the
head when none is pending. It refuses when another user holds the lock, and
when an autosave already exists
The asset_attach verb goes with it. create_new_draft names the editor on the
draft it creates and the publish entry's asset delta reports the attachment.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
- Collapse page headers into one action row with an optional hint
- limit will_paginate to one row
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Any holder may add or remove another account, witnessed as
redaktion_grant/revoke so the vouching is legible. Not behind elevation:
onboarding must not wait for a keyholder, and a compromised Redaktion
account can already publish.
|
|
A banner appears while elevated, counting down in minutes and carrying
extend and drop controls. Three extensions of 30 minutes are allowed, so
the window is at most two hours without a fresh code; a code resets the
budget. The countdown is advisory, the server-side check authoritative, so
it says "expired" rather than vanishing.
The post-login flash tells an admin the timer has started.
|
|
Administrative actions are gated behind a 30-minute elevation window:
creating and retiring accounts, editing roles, clearing a second factor.
Reading the list is not gated, and content work is untouched.
elevated? is tied to is_admin?, so losing the role closes the window at
once. The window opens when the second factor verifies at login, so an
admin heading straight for user management is already elevated, and closes
on logout with the other session state. Five wrong codes end the session,
mirroring the login challenge.
users#update carries no elevation filter, since self-service reaches it;
the role field is gated in user_params instead and fails closed.
|
|
RoleRequired supplies require_redaktion and require_admin for surfaces that
are not nodes and so cannot be reached by Node#restricted?.
Navigation is content rather than plumbing, so menu_items requires
redaktion. User management is janitorial and requires admin: index, new,
create, reset_otp, deactivate, reactivate. verify_status now also covers
show, without which any logged-in user could read any account by walking a
small id space. Editing your own account stays open.
The dashboard hides the Users and Navigation buttons from those who cannot
use them; everything else stays visible to everyone. Both denials share one
message and land on the dashboard.
Adds redella (redaktion) and alufa (redaktion + alumni) fixtures.
|
|
nodes#new marks the kinds that place under /updates, derived from each kind's
own path_prefix. The three parent pickers mark candidates the current user
cannot publish into; menu_search returns needs_redaktion per result, computed
per user rather than as a bare restricted flag, and the menu-item picker opts
out.
restore_from_trash! checks its destination: the restore is the move, applied
rather than staged, so no later publish would have caught it. The node
returns as a draft either way.
|
|
nodes#show renders publish and trash as disabled_action spans with a hint
naming what an editor can still do, matching how locked_by_other already
reads. Editing and reverting stay live: drafting is free everywhere.
|
|
CccConventions::TAG_SCOPES maps "update" and "pressemitteilung" to /updates
and "disclosure" to /disclosure. Page.aggregate applies the mapping, so an
aggregate over one of those tags is bounded by its subtree regardless of what
the shortcode says. Tags stay unrestricted; positions are publish-gated.
Both RSS actions call Page.aggregate rather than repeating its tag join.
Empty feeds no longer crash: Atom falls back to the current time for the
required <updated>, and the optional dc:date is omitted.
|
|
Deactivation adds the alumni role and leaves the others in place, so
reactivation is lossless and nobody has to remember what an account held.
login_from_session checks alumni? on every request, so a signed-in user is
locked out on their next one without any session invalidation. Guards
prevent deactivating yourself or the last active admin, and both verbs are
witnessed in the action log.
|
|
Replaces the two-way admin/user split with four groups ordered by
capability: administration, Redaktion, editors, alumni. alumni takes
precedence over capability in role_group, so a retired admin appears at the
bottom rather than the top.
Forms now offer the three roles as checkboxes rather than a single admin
checkbox, with a trailing hidden blank so an empty set can be posted, and
user_params permits roles only for admins. Three create buttons prefill the
common combinations.
|
|
|
|
|
|
|
