7 files changed, 98 insertions, 14 deletions

diff --git a/app/controllers/admin_controller.rb b/app/controllers/admin_controller.rb
index 37fd78b..d9cf1be 100644
--- a/app/controllers/admin_controller.rb
+++ b/app/controllers/admin_controller.rb
@@ -6,7 +6,7 @@ class AdminController < ApplicationController
 
   def index
     @drafts = Node.drafts_and_autosaves(current_user_id: current_user.id).limit(5)
-    @recent_changes = Node.recently_changed.limit(5)
+    @actions = NodeAction.order(:occurred_at => :desc, :id => :desc).limit(5)
   end
 
   def conventions
@@ -71,4 +71,11 @@ class AdminController < ApplicationController
       end
     end
   end
+
+  # Deliberately raises, to verify the error-log tripwire end to end.
+  # Behind login_required like the rest of the controller; harmless --
+  # the visitor gets the ordinary 500 page.
+  def boom
+    raise "Deliberate test exception via admin/boom"
+  end
 end
diff --git a/app/controllers/content_controller.rb b/app/controllers/content_controller.rb
index 8d33105..8be4bfb 100644
--- a/app/controllers/content_controller.rb
+++ b/app/controllers/content_controller.rb
@@ -31,7 +31,7 @@ class ContentController < ApplicationController
   def render_gallery
     unless @page.nil?
       @images = @page.assets.images
-      render :file => "content/gallery"
+      render :template => 'content/gallery'
     else
       head :not_found
     end
diff --git a/app/controllers/csp_reports_controller.rb b/app/controllers/csp_reports_controller.rb
new file mode 100644
index 0000000..5a3b55e
--- /dev/null
+++ b/app/controllers/csp_reports_controller.rb
@@ -0,0 +1,22 @@
+class CspReportsController < ApplicationController
+  # Browsers POST application/csp-report with no CSRF token, no session.
+  skip_before_action :verify_authenticity_token
+
+  def create
+    request.body.rewind if request.body.respond_to?(:rewind)
+    raw = request.body.read(8192)
+    raw = request.raw_post if raw.blank?
+
+    report = (JSON.parse(raw)["csp-report"] rescue nil)
+
+    if report
+      directive = report["effective-directive"] || report["violated-directive"]
+      at = (URI.parse(report["document-uri"]).path rescue "unparsed")
+      CSP_LOGGER.warn("CSP violation: #{directive} blocked=#{report['blocked-uri']} at=#{at}")
+    else
+      CSP_LOGGER.warn("CSP violation: unparseable report (#{raw.to_s.bytesize} bytes)")
+    end
+
+    head :no_content
+  end
+end
diff --git a/app/controllers/node_actions_controller.rb b/app/controllers/node_actions_controller.rb
new file mode 100644
index 0000000..6e46719
--- /dev/null
+++ b/app/controllers/node_actions_controller.rb
@@ -0,0 +1,14 @@
+class NodeActionsController < ApplicationController
+
+  before_action :login_required
+
+  layout 'admin'
+
+  def index
+    @actions = NodeAction.order(:occurred_at => :desc, :id => :desc)
+    @actions = @actions.where(:node_id => params[:node_id]) if params[:node_id].present?
+    @actions = @actions.where(:user_id => params[:user_id]) if params[:user_id].present?
+    @actions = @actions.includes(:node, :user)
+                       .paginate(:page => params[:page], :per_page => 50)
+  end
+end
diff --git a/app/controllers/nodes_controller.rb b/app/controllers/nodes_controller.rb
index bff1733..6caa827 100644
--- a/app/controllers/nodes_controller.rb
+++ b/app/controllers/nodes_controller.rb
@@ -13,7 +13,9 @@ class NodesController < ApplicationController
                               :publish,
                               :unlock,
                               :autosave,
-                              :revert
+                              :revert,
+                              :trash,
+                              :restore_from_trash
                             ]
 
   around_action :pin_to_default_locale, :only => [:show, :edit, :update, :autosave]
@@ -27,10 +29,7 @@ class NodesController < ApplicationController
   def new
     @node = Node.new node_params
     @selected_kind = CccConventions::NODE_KINDS.key?(params[:kind]) ? params[:kind] : "generic"
-    if params.has_key?(:parent_id)
-      @parent_id = params[:parent_id]
-      @parent_name = Node.find(@parent_id).title
-    end
+    @parent = Node.find(params[:parent_id]) if params.has_key?(:parent_id)
   end
 
   def create
@@ -48,14 +47,14 @@ class NodesController < ApplicationController
       @node.draft.save!
 
       @node.update!(default_template_name: config[:template]) if config && config[:template]
+      NodeAction.record!(:node => @node, :page => @node.draft, :user => current_user,
+                          :action => "create",
+                          :title => params[:title], :path => @node.unique_name)
 
       redirect_to(edit_node_path(@node))
     else
       @selected_kind = CccConventions::NODE_KINDS.key?(params[:kind]) ? params[:kind] : "generic"
-      if params[:parent_id].present?
-        @parent_id = params[:parent_id]
-        @parent_name = Node.find(@parent_id).title
-      end
+      @parent = Node.find(params[:parent_id]) if params.has_key?(:parent_id)
       render :new
     end
   end
@@ -63,6 +62,9 @@ class NodesController < ApplicationController
   def show
     @page = @node.draft || @node.head
     @translations = @page.translation_summary
+    @page_actions = NodeAction.where(:page_id => @node.pages.select(:id))
+                              .order(:occurred_at, :id)
+                              .group_by(&:page_id)
   end
 
   def edit
@@ -142,12 +144,44 @@ class NodesController < ApplicationController
     redirect_to node_path(@node)
   end
 
+ def trash
+    if @node.trash!(current_user)
+      flash[:notice] = "Page has been moved to the Trash"
+      redirect_to trashed_nodes_path
+    else
+      flash[:notice] = "Page is already in the Trash"
+      redirect_to node_path(@node)
+    end
+  rescue ActiveRecord::RecordInvalid, LockedByAnotherUser => e
+    flash[:error] = e.message
+    redirect_to node_path(@node)
+  end
+
+  def restore_from_trash
+    parent = Node.find(params[:parent_id])
+    @node.restore_from_trash!(parent, current_user)
+    flash[:notice] = "Page has been restored from the Trash"
+    redirect_to node_path(@node)
+  rescue ActiveRecord::RecordNotFound
+    flash[:error] = "Restore target not found"
+    redirect_to node_path(@node)
+  rescue ActiveRecord::RecordInvalid => e
+    flash[:error] = e.message
+    redirect_to node_path(@node)
+  end
+
   def destroy
-    @node.destroy
+    @node.destroy_from_trash!(current_user)
+    flash[:notice] = "Page has been permanently deleted"
+    redirect_to trashed_nodes_path
+
+  rescue ActiveRecord::RecordInvalid, ActiveRecord::RecordNotDestroyed => e
+    flash[:error] = e.message
+    redirect_to node_path(@node)
   end
 
   def publish
-    @node.publish_draft!
+    @node.publish_draft!(current_user)
     flash[:notice] = "Draft has been published"
     redirect_to node_path(@node)
   end
@@ -217,6 +251,11 @@ class NodesController < ApplicationController
     @sitemap_descendant_counts = descendant_counts_for(@sitemap)
   end
 
+  def trashed
+    @nodes = Node.trash.children.order(:slug)
+                 .paginate(:page => params[:page], :per_page => 50)
+  end
+
   private
 
     def slug_for(title)
diff --git a/app/controllers/related_assets_controller.rb b/app/controllers/related_assets_controller.rb
index 479ebec..5af73fc 100644
--- a/app/controllers/related_assets_controller.rb
+++ b/app/controllers/related_assets_controller.rb
@@ -27,6 +27,8 @@ class RelatedAssetsController < ApplicationController
       asset_id: asset.id,
       name: asset.name,
       thumb_url: asset.upload.url(:thumb),
+      large_url: asset.upload.url(:large),
+      original_url: asset.upload.url,
       url: node_related_asset_path(@node, related)
     }
   end
diff --git a/app/controllers/revisions_controller.rb b/app/controllers/revisions_controller.rb
index c5932a4..c1237a9 100644
--- a/app/controllers/revisions_controller.rb
+++ b/app/controllers/revisions_controller.rb
@@ -49,7 +49,7 @@ class RevisionsController < ApplicationController
 
   def restore
     page = Page.find(params[:id])
-    page.node.restore_revision! page.revision
+    page.node.restore_revision! page.revision, current_user
     flash[:notice] = "Revision #{page.revision} restored"
     redirect_to node_path(page.node)
   end