Allowlist aggregate order columns and template names

Page.aggregate interpolated order_by into SQL unchecked while
already allowlisting order_direction; the column is now normalized
and checked against the sortable columns, falling back to pages.id.
Its values arrive from editor-authored aggregate shortcodes, so
this was editor-gated, but the asymmetry was wrong regardless.

template_name and default_template_name now validate inclusion in
Page.custom_templates -- names render as filesystem paths, so only
names actually present in the template directory are acceptable.
Validated only on change: legacy rows whose template file has since
vanished stay saveable, and valid_template's render-time fallback
to standard_template continues to cover them. Two tests that wrote
fabricated template names through the front door now arrange their
state correctly (update_column for the stale-name fallback test, a
real template for the update-persists test).

1 files changed, 5 insertions, 0 deletions

diff --git a/app/models/node.rb b/app/models/node.rb
index 4f585e1..70ed4da 100644
--- a/app/models/node.rb
+++ b/app/models/node.rb
@@ -22,6 +22,11 @@ class Node < ApplicationRecord
   validates_uniqueness_of :slug, :scope => :parent_id, :unless => -> { parent_id.nil? }
   validates_presence_of   :parent_id,                  :unless => -> { Node.root.nil? }
 
+  validates :default_template_name,
+            :inclusion => { :in => ->(_) { Page.custom_templates } },
+            :allow_nil => true,
+            :if        => :default_template_name_changed?
+
   # Class methods
 
   # Returns a page for a given node. If no revision is supplied, it returns