| Age | Commit message (Collapse) | Author |
|---|
|
cccms:mysql_to_postgres was the one-time MySQL to PostgreSQL import. It uses
set_table_name and globalize_translations, removed from Rails and Globalize
respectively, so it raises on its first class definition.
ci:run_ci configured Integrity, a CI server this project no longer uses. It
copies config/database.sqlite3-sample.yml, which does not exist, over
config/database.yml, which is a live local file.
|
|
|
|
|
|
The column moved to page.rb and was now written only by publish_draft!
and by the chapter seed, and read by nothing.
lib/tasks/pages.rake goes with it. backfill_external_url reads the dropped
column. backfill_address is spent and no longer safe to re-run.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
A banner appears while elevated, counting down in minutes and carrying
extend and drop controls. Three extensions of 30 minutes are allowed, so
the window is at most two hours without a fresh code; a code resets the
budget. The countdown is advisory, the server-side check authoritative, so
it says "expired" rather than vanishing.
The post-login flash tells an admin the timer has started.
|
|
Administrative actions are gated behind a 30-minute elevation window:
creating and retiring accounts, editing roles, clearing a second factor.
Reading the list is not gated, and content work is untouched.
elevated? is tied to is_admin?, so losing the role closes the window at
once. The window opens when the second factor verifies at login, so an
admin heading straight for user management is already elevated, and closes
on logout with the other session state. Five wrong codes end the session,
mirroring the login challenge.
users#update carries no elevation filter, since self-service reaches it;
the role field is gated in user_params instead and fails closed.
|
|
|
|
|
|
CccConventions::TAG_SCOPES maps "update" and "pressemitteilung" to /updates
and "disclosure" to /disclosure. Page.aggregate applies the mapping, so an
aggregate over one of those tags is bounded by its subtree regardless of what
the shortcode says. Tags stay unrestricted; positions are publish-gated.
Both RSS actions call Page.aggregate rather than repeating its tag join.
Empty feeds no longer crash: Atom falls back to the current time for the
required <updated>, and the optional dc:date is omitted.
|
|
publish_draft!, trash!, destroy_from_trash!, attach_asset! and
Asset#destroy_witnessed! now refuse unless the acting user holds redaktion,
and only when the subject is on a restricted surface: the front page, the
updates tree that feeds ~100k subscribers, or disclosure. Drafting,
autosaving, tagging and creating stay free everywhere for everyone.
Enforcement is in the models rather than the controllers, since attach_asset!
and the rest are reachable from rake tasks and internal paths. It follows the
errors.add-plus-bare-raise pattern the rest of Node already uses, so every
existing RecordInvalid rescue reports it with a localised message; only
assets_controller#destroy needed a rescue added.
A nil user is treated as a system context and bypasses the gate. The default
nil on three of those verbs is what makes that reachable, and removing those
defaults once every call site passes a user is the next tightening.
|
|
Replaces the two-way admin/user split with four groups ordered by
capability: administration, Redaktion, editors, alumni. alumni takes
precedence over capability in role_group, so a retired admin appears at the
bottom rather than the top.
Forms now offer the three roles as checkboxes rather than a single admin
checkbox, with a trailing hidden blank so an empty set can be posted, and
user_params permits roles only for admins. Three create buttons prefill the
common combinations.
|
|
|
|
Enforced at restore via a login-time stamp, written only at genuine
logins so the limit stays absolute rather than sliding. The cookie
name rotation logs everyone out once at deploy. Second-factor users
are deliberately not treated worse than password-only ones.
|
|
|
|
|
|
|
|
|
|
|
|
- related_assets gains a `headline` boolean (DB-enforced: at most one
per page), replacing "first image by position" as the headline
rule. A rake task backfills the current first image on every live
head/draft, so nothing changes visually until an editor changes it.
- The image picker sidebar gets a star toggle reflecting the flag;
the TinyMCE inline-image picker's badge now reads it too, instead
of assuming position 0.
- No headline chosen (or none attached) now falls back to the
gallery-count caption itself becoming the lightbox trigger, instead
of the gallery being unreachable.
- Assets gain creator, source_url, and license_key (against a new
config/asset_licenses.yml dictionary). asset_credit renders a
degrading attribution line, reused as a hidden per-image glightbox
caption so credit is one click away for every image, not only the
headline's always-visible one.
- Fixed: asset thumbnails rendered unconditionally regardless of
whether a real variant exists on disk. Asset#has_variant? checks
file existence, not content type -- some legacy PDFs have real
pre-rewrite thumbnails a content-type check would have hidden.
- assets#new/edit rebuilt onto the same node_description/node_content
layout as assets#show, picking up the three new fields in the
process.
|
|
|
|
password_required? treated a blank crypted_password as "needs a
password", but after bcrypt migration crypted_password is nil by
design -- every subsequent save of a migrated or new user failed
validation. The predicate now requires a password only when both
the legacy and the bcrypt credential are absent, or when one is
actually being set.
|
|
Add has_secure_password and bcrypt while retaining compatibility with
legacy SHA-1 password hashes. Existing users are upgraded to
password_digest on their next successful login.
Add regression tests covering both legacy and modern authentication
paths.
|
|
|
|
|
|
Regenerates ImageMagick variants from each asset's stored original --
needed because assets uploaded before :headline existed in
FileAttachment::STYLES never had that file generated, producing a 404
rather than a distorted image. Supports ASSET_ID=N scoping so a single
asset can be tested before committing to a full, expensive sweep
across everything.
Doesn't touch the separate, still-open problem of :headline's forced
non-uniform stretch (460x250!) -- this task faithfully regenerates
whatever geometry the style defines, correctly. Fixing the distortion
itself is its own, later piece.
|
|
Extracted from admin#index's inline table into NodesController#sitemap.
Nested <details>/<summary> per branch, one linear pass over the
existing flat [node, level] list (no added queries) -- each node's own
descendant count computed the same way, via a small stack rather than
re-walking the tree per node. Branches under updates/, club/erfas,
club/chaostreffs, and disclosure start collapsed by default
(CccConventions::SITEMAP_COLLAPSED_PATHS); any branch currently
collapsed, whether by that default or because someone just closed it,
is highlighted via a plain :not([open]) selector -- no state tracked
outside the DOM itself.
Dropped the update?-post exclusion this view used to rely on -- no
longer needed now that updates/ collapses instead of being filtered
out, so its real children (previously silently absent) now show up
correctly. admin#index's own, separate @sitemap query is unchanged;
that view has no collapse mechanism to compensate and wasn't part of
this.
|
|
sdiff aligned an inserted paragraph break correctly, but the renderer
wrapped the raw </p>/<p> tokens in <ins> regardless -- invalid nesting
that browsers silently repair by dropping the unmatched closing tag,
leaving everything downstream rendered inside an <ins> with nothing
left to close it. Same failure mode as the retired cacycle_diff.js,
different cause.
Tag tokens now render as a plain-text pilcrow with a tooltip naming
the actual tag, never as literal markup inside <ins>/<del>. Applies to
both inline and side-by-side. Side-by-side's new panel flattening a
real paragraph break into a marker, rather than showing its own true
structure, is a known, accepted trade-off for now -- not the same
problem, and not fixed here.
|
|
Revisions#diff now computes an inline or side-by-side word diff
server-side (Page#diff_against, lib/html_word_diff.rb) instead of
shipping raw/escaped content to the browser for a 2008-era vendored
JS differ to mangle. View mode is picked via a `view` param, settable
either on the diff page itself or directly from the revisions#index
sticky bar next to "Diff revisions".
Also fixes a pre-existing bug in RevisionsController#diff's single-
revision branch, which set params[:start]/params[:end] instead of
params[:start_revision]/params[:end_revision].
|
|
parent_match Procs on CccConventions::NODE_KINDS, matched against
unique_path, decide which "add child" kinds show on a given node. Fixes
nodes#new not honoring a pre-selected kind (radio group and parent-field
visibility both defaulted to "generic" unconditionally).
|
|
The following changes were already announced in the last commit, but
the files forgotten. Here's them actually attached.
lib/ccc_conventions.rb: NODE_KINDS registry replaces the kind-specific
branches previously scattered across nodes_controller#create (tags),
unique_path-position check). Each kind declares its parent lookup
(a Proc - Update's "update"/"press_release" continue to genuinely
find-or-create their year-folder via Update.find_or_create_parent;
erfa/chaostreff use a plain find_by_unique_name!, since their parent
nodes are fixed and a missing one should fail loudly, not be silently
created), its tags, and (new) its default template.
New read-only admin/conventions view dumps the NODE_KINDS registry as
a reference table for whoever's confused later about how a given kind
behaves - deliberately just renders the same label/hint text used on
nodes#new rather than re-describing parent/tags/template separately,
since decomposing the parent Proc would mean either invoking it
(Update's has a real side effect - creates the year folder) or
re-stating its logic a second time in a different shape, either of
which risks drifting from the actual behavior.
|
|
- Bump Rails to 7.2.3, Ruby to 3.2.11 (new gemset rails7-upgrade)
- pg pinned to 1.4.6 (bridge: Ruby 3.2 compatible, PostgreSQL 9.6 tolerant)
- acts-as-taggable-on → 12.x (Rails 7.2 + Ruby 3.2 support)
- awesome_nested_set → 3.7.0 (Rails 7.2 support, avoids 3.9.0 lft/rgt bug)
- globalize → 7.0 (Rails 7.x required)
- libxml-ruby → 5.x (Ruby 3.2 required)
- unicorn → 6.x; fix unicorn.rb: RAILS_ROOT→Rails.root, RAILS_ENV→ENV,
File.exists?→File.exist?
- Add puma for development server
- Remove dead initializers: assets.rb, ruby2.rb, backtrace_silencers.rb,
new_rails_defaults.rb
- Fix File.exists? → File.exist? in page.rb and authors_importer.rb
- Add routing_filter_rails71_patch.rb (restores params[:locale] on Rails 7.1+)
|
|
- routing-filter 0.6.3 -> 0.7.0 (Rails 6.1 compatibility)
- RSS named routes rss_xml/rss_rdf added
- RouteWithParams workarounds: will_paginate_patch, content_path shim, safe_path helper
- Paperclip removed, replaced with FileAttachment concern (preserves URL scheme)
- Assets resource moved to /admin/assets (Sprockets middleware conflict)
- ApplicationRecord base class added, all models migrated
- Strong parameters added to Assets, Occurrences, Events, MenuItems controllers
- update_attributes -> update throughout
- render :nothing -> head :ok/:not_found throughout
- language_selector rewritten (removes :overwrite_params)
- Environment files updated for Rails 6.1 (eager_load, public_file_server, ActionMailer)
- Arel::Visitors::DepthFirst and Integer/Float duration patches removed from test_helper
- AssetsController tests added (10 tests covering upload, variants, destroy, auth)
- ImageMagick geometry: 460x250! for headline crop (not # which is invalid in IM6)
129 runs, 311 assertions, 5 failures (all pre-existing), 0 errors
|
|
- Replace tagged_with calls in Page.aggregate, TagsController, RssController
with direct SQL joins (acts-as-taggable-on 3.5 broken on Rails 3.2)
- Fix Paperclip :path/:url to use plain :id format matching existing uploads
- Add proper regression tests for aggregator, tags, and rss controllers
- Fix assert_select assertions to target div.body div.article_partial
|
|
- Converted plugins to gems (Gemfile)
- Updated config structure (application.rb, boot.rb, environment.rb)
- Converted routes to Rails 3 DSL
- Converted named_scope to scope throughout models
- Converted find(:all, :conditions) to where() chains
- Fixed has_many :order to use ordering scope
- Updated session store and secret token configuration
- Fixed exception_notification middleware configuration
- Patched Ruby 2.4 / Rails 3.2 incompatibilities:
- Integer/Float duration arithmetic (ActiveSupport)
- Arel visit_Integer for PostgreSQL adapter
- create_database String/Integer coercion
- ActionController consider_all_requests_local
- Migrated taggings schema for acts-as-taggable-on
- Replaced dynamic_form gem with custom form_error_messages helper
- Fixed Rails 3 block helper syntax (form_for, form_tag, fields_for)
- Fixed admin layout yield
- Updated test suite for Rails 3 APIs
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
