Allowlist aggregate order columns and template names

Page.aggregate interpolated order_by into SQL unchecked while
already allowlisting order_direction; the column is now normalized
and checked against the sortable columns, falling back to pages.id.
Its values arrive from editor-authored aggregate shortcodes, so
this was editor-gated, but the asymmetry was wrong regardless.

template_name and default_template_name now validate inclusion in
Page.custom_templates -- names render as filesystem paths, so only
names actually present in the template directory are acceptable.
Validated only on change: legacy rows whose template file has since
vanished stay saveable, and valid_template's render-time fallback
to standard_template continues to cover them. Two tests that wrote
fabricated template names through the front door now arrange their
state correctly (update_column for the stale-name fallback test, a
real template for the update-persists test).

4 files changed, 54 insertions, 4 deletions

diff --git a/test/controllers/content_controller_test.rb b/test/controllers/content_controller_test.rb
index e8bc55f..2449a0c 100644
--- a/test/controllers/content_controller_test.rb
+++ b/test/controllers/content_controller_test.rb
@@ -73,8 +73,7 @@ class ContentControllerTest < ActionController::TestCase
   def test_nonexistant_custom_template_defaults_to_standard_template
     new_node = create_node_under_root "fnord"
     draft = find_or_create_draft(new_node, @user1)
-    draft.template_name = "huchibu"
-    draft.save
+    draft.update_column(:template_name, "huchibu")
     new_node.publish_draft!
     
     get :render_page, params: { :locale => 'de', :page_path => ["fnord"] }
diff --git a/test/controllers/nodes_controller_test.rb b/test/controllers/nodes_controller_test.rb
index 5b66bd3..b0d7416 100644
--- a/test/controllers/nodes_controller_test.rb
+++ b/test/controllers/nodes_controller_test.rb
@@ -140,7 +140,7 @@ class NodesControllerTest < ActionController::TestCase
       :page => {
         :title => "Hello",
         :body => "There",
-        :template_name => "Foobar"
+        :template_name => "title_only"
       }
     }
 
@@ -148,7 +148,17 @@ class NodesControllerTest < ActionController::TestCase
     test_node.reload
     assert_equal "Hello", test_node.head.title
     assert_equal "There", test_node.head.body
-    assert_equal "Foobar", test_node.head.template_name
+    assert_equal "title_only", test_node.head.template_name
+  end
+
+  def test_update_rejects_a_template_name_not_on_disk
+    test_node = Node.root.children.create! :slug => "test_node"
+    login_as :quentin
+    put :update, params: { :id => test_node.id,
+                           :page => { :title => "Hello", :template_name => "Foobar" } }
+
+    test_node.reload
+    assert_not_equal "Foobar", test_node.draft&.template_name
   end
 
   test "publish draft with staged_slug unqueal slug" do
diff --git a/test/models/node_test.rb b/test/models/node_test.rb
index c8e49e5..4401651 100644
--- a/test/models/node_test.rb
+++ b/test/models/node_test.rb
@@ -761,4 +761,13 @@ class NodeTest < ActiveSupport::TestCase
     assert_equal "Second",    action.metadata.dig("title", "from")
     assert_equal "First",     action.metadata.dig("title", "to")
   end
+
+  test "default_template_name rejects values not present in the template directory" do
+    node = Node.root.children.build(:slug => "template_guard_test",
+                                     :default_template_name => "../../layouts/admin")
+    assert_not node.valid?
+
+    node.default_template_name = "standard_template"
+    assert node.valid?
+  end
 end
diff --git a/test/models/page_test.rb b/test/models/page_test.rb
index edb7c37..58794d5 100644
--- a/test/models/page_test.rb
+++ b/test/models/page_test.rb
@@ -370,4 +370,36 @@ class PageTest < ActiveSupport::TestCase
     assert en_entry[:changed]
     refute en_entry[:exists_there]
   end
+
+  test "aggregate ignores order_by values outside the allowlist" do
+    sql = Page.aggregate(:order_by => "pages.id; DROP TABLE pages--").to_sql
+
+    assert_not_includes sql, "DROP"
+    assert_includes sql, "pages.id ASC"
+  end
+
+  test "aggregate accepts allowlisted order columns, bare or prefixed" do
+    assert_includes Page.aggregate(:order_by => "published_at").to_sql,
+                    "pages.published_at ASC"
+    assert_includes Page.aggregate(:order_by => "pages.published_at").to_sql,
+                    "pages.published_at ASC"
+  end
+
+  test "template_name rejects values not present in the template directory" do
+    page = Page.create!(:title => "Template guard")
+
+    page.template_name = "../../partials/_article"
+    assert_not page.valid?
+
+    page.template_name = "standard_template"
+    assert page.valid?
+  end
+
+  test "a stale legacy template_name does not block unrelated saves" do
+    page = Page.create!(:title => "Stale template")
+    page.update_column(:template_name, "long_deleted_template")
+
+    page.reload
+    assert page.update(:abstract => "still saveable")
+  end
 end