12 files changed, 220 insertions, 52 deletions

diff --git a/config/initializers/activesupport_duration_patch.rb b/config/initializers/activesupport_duration_patch.rb
new file mode 100644
index 0000000..c2b431d
--- /dev/null
+++ b/config/initializers/activesupport_duration_patch.rb
@@ -0,0 +1,53 @@
+class Integer
+  def days
+    ActiveSupport::Duration.new(self * 86400, [[:days, self]])
+  end
+  alias :day :days
+
+  def weeks
+    ActiveSupport::Duration.new(self * 7 * 86400, [[:days, self * 7]])
+  end
+  alias :week :weeks
+
+  def hours
+    ActiveSupport::Duration.new(self * 3600, [[:seconds, self * 3600]])
+  end
+  alias :hour :hours
+
+  def minutes
+    ActiveSupport::Duration.new(self * 60, [[:seconds, self * 60]])
+  end
+  alias :minute :minutes
+
+  def seconds
+    ActiveSupport::Duration.new(self, [[:seconds, self]])
+  end
+  alias :second :seconds
+
+  def months
+    ActiveSupport::Duration.new(self * 30 * 86400, [[:months, self]])
+  end
+  alias :month :months
+
+  def years
+    ActiveSupport::Duration.new((self * 365.25 * 86400).to_i, [[:years, self]])
+  end
+  alias :year :years
+end
+
+class Float
+  def days
+    ActiveSupport::Duration.new((self * 86400).to_i, [[:days, self]])
+  end
+  alias :day :days
+
+  def hours
+    ActiveSupport::Duration.new((self * 3600).to_i, [[:seconds, (self * 3600).to_i]])
+  end
+  alias :hour :hours
+
+  def minutes
+    ActiveSupport::Duration.new((self * 60).to_i, [[:seconds, (self * 60).to_i]])
+  end
+  alias :minute :minutes
+end
diff --git a/config/initializers/backtrace_silencers.rb b/config/initializers/backtrace_silencers.rb
deleted file mode 100644
index c2169ed..0000000
--- a/config/initializers/backtrace_silencers.rb
+++ /dev/null
@@ -1,7 +0,0 @@
-# Be sure to restart your server when you modify this file.
-
-# You can add backtrace silencers for libraries that you're using but don't wish to see in your backtraces.
-# Rails.backtrace_cleaner.add_silencer { |line| line =~ /my_noisy_library/ }
-
-# You can also remove all the silencers if you're trying do debug a problem that might steem from framework code.
-# Rails.backtrace_cleaner.remove_silencers!
\ No newline at end of file
diff --git a/config/initializers/content_security_policy.rb b/config/initializers/content_security_policy.rb
new file mode 100644
index 0000000..d51d713
--- /dev/null
+++ b/config/initializers/content_security_policy.rb
@@ -0,0 +1,29 @@
+# Be sure to restart your server when you modify this file.
+
+# Define an application-wide content security policy.
+# See the Securing Rails Applications Guide for more information:
+# https://guides.rubyonrails.org/security.html#content-security-policy-header
+
+# Rails.application.configure do
+#   config.content_security_policy do |policy|
+#     policy.default_src :self, :https
+#     policy.font_src    :self, :https, :data
+#     policy.img_src     :self, :https, :data
+#     policy.object_src  :none
+#     policy.script_src  :self, :https
+#     policy.style_src   :self, :https
+#     # Specify URI for violation reports
+#     # policy.report_uri "/csp-violation-report-endpoint"
+#   end
+#
+#   # Generate session nonces for permitted importmap, inline scripts, and inline styles.
+#   config.content_security_policy_nonce_generator = ->(request) { request.session.id.to_s }
+#   config.content_security_policy_nonce_directives = %w(script-src style-src)
+#
+#   # Automatically add `nonce` to `javascript_tag`, `javascript_include_tag`, and `stylesheet_link_tag`
+#   # if the corresponding directives are specified in `content_security_policy_nonce_directives`.
+#   # config.content_security_policy_nonce_auto = true
+#
+#   # Report violations without enforcing the policy.
+#   # config.content_security_policy_report_only = true
+# end
diff --git a/config/initializers/exception_notifier.rb b/config/initializers/exception_notifier.rb
new file mode 100644
index 0000000..bc7c385
--- /dev/null
+++ b/config/initializers/exception_notifier.rb
@@ -0,0 +1,6 @@
+Cccms::Application.config.middleware.use ExceptionNotification::Rack,
+  :email => {
+    :email_prefix => "[CCCMS] ",
+    :sender_address => %("CCCMS Error" <error@www.ccc.de>),
+    :exception_recipients => %w(erdgeist@ccc.de)
+  }
diff --git a/config/initializers/filter_parameter_logging.rb b/config/initializers/filter_parameter_logging.rb
new file mode 100644
index 0000000..c0b717f
--- /dev/null
+++ b/config/initializers/filter_parameter_logging.rb
@@ -0,0 +1,8 @@
+# Be sure to restart your server when you modify this file.
+
+# Configure parameters to be partially matched (e.g. passw matches password) and filtered from the log file.
+# Use this to limit dissemination of sensitive information.
+# See the ActiveSupport::ParameterFilter documentation for supported notations and behaviors.
+Rails.application.config.filter_parameters += [
+  :passw, :email, :secret, :token, :_key, :crypt, :salt, :certificate, :otp, :ssn, :cvv, :cvc
+]
diff --git a/config/initializers/i18n.rb b/config/initializers/i18n.rb
deleted file mode 100644
index 0190f63..0000000
--- a/config/initializers/i18n.rb
+++ /dev/null
@@ -1,3 +0,0 @@
-require "i18n/backend/fallbacks"
-I18n::Backend::Simple.send(:include, I18n::Backend::Fallbacks)
-I18n.fallbacks.map "en" => ["de"]
diff --git a/config/initializers/inflections.rb b/config/initializers/inflections.rb
index d531b8b..3860f65 100644
--- a/config/initializers/inflections.rb
+++ b/config/initializers/inflections.rb
@@ -1,10 +1,16 @@
 # Be sure to restart your server when you modify this file.
 
-# Add new inflection rules using the following format 
-# (all these examples are active by default):
-# ActiveSupport::Inflector.inflections do |inflect|
-#   inflect.plural /^(ox)$/i, '\1en'
-#   inflect.singular /^(ox)en/i, '\1'
-#   inflect.irregular 'person', 'people'
+# Add new inflection rules using the following format. Inflections
+# are locale specific, and you may define rules for as many different
+# locales as you wish. All of these examples are active by default:
+# ActiveSupport::Inflector.inflections(:en) do |inflect|
+#   inflect.plural /^(ox)$/i, "\\1en"
+#   inflect.singular /^(ox)en/i, "\\1"
+#   inflect.irregular "person", "people"
 #   inflect.uncountable %w( fish sheep )
 # end
+
+# These inflection rules are supported but not enabled by default:
+# ActiveSupport::Inflector.inflections(:en) do |inflect|
+#   inflect.acronym "RESTful"
+# end
diff --git a/config/initializers/new_framework_defaults_8_1.rb b/config/initializers/new_framework_defaults_8_1.rb
new file mode 100644
index 0000000..8569b5b
--- /dev/null
+++ b/config/initializers/new_framework_defaults_8_1.rb
@@ -0,0 +1,74 @@
+# Be sure to restart your server when you modify this file.
+#
+# This file eases your Rails 8.1 framework defaults upgrade.
+#
+# Uncomment each configuration one by one to switch to the new default.
+# Once your application is ready to run with all new defaults, you can remove
+# this file and set the `config.load_defaults` to `8.1`.
+#
+# Read the Guide for Upgrading Ruby on Rails for more info on each option.
+# https://guides.rubyonrails.org/upgrading_ruby_on_rails.html
+
+###
+# Skips escaping HTML entities and line separators. When set to `false`, the
+# JSON renderer no longer escapes these to improve performance.
+#
+# Example:
+#   class PostsController < ApplicationController
+#     def index
+#       render json: { key: "\u2028\u2029<>&" }
+#     end
+#   end
+#
+# Renders `{"key":"\u2028\u2029\u003c\u003e\u0026"}` with the previous default, but `{"key":"

<>&"}` with the config
+# set to `false`.
+#
+# Applications that want to keep the escaping behavior can set the config to `true`.
+#++
+# Rails.configuration.action_controller.escape_json_responses = false
+
+###
+# Skips escaping LINE SEPARATOR (U+2028) and PARAGRAPH SEPARATOR (U+2029) in JSON.
+#
+# Historically these characters were not valid inside JavaScript literal strings but that changed in ECMAScript 2019.
+# As such it's no longer a concern in modern browsers: https://caniuse.com/mdn-javascript_builtins_json_json_superset.
+#++
+# Rails.configuration.active_support.escape_js_separators_in_json = false
+
+###
+# Raises an error when order dependent finder methods (e.g. `#first`, `#second`) are called without `order` values
+# on the relation, and the model does not have any order columns (`implicit_order_column`, `query_constraints`, or
+# `primary_key`) to fall back on.
+#
+# The current behavior of not raising an error has been deprecated, and this configuration option will be removed in
+# Rails 8.2.
+#++
+# Rails.configuration.active_record.raise_on_missing_required_finder_order_columns = true
+
+###
+# Controls how Rails handles path relative URL redirects.
+# When set to `:raise`, Rails will raise an `ActionController::Redirecting::UnsafeRedirectError`
+# for relative URLs without a leading slash, which can help prevent open redirect vulnerabilities.
+#
+# Example:
+#   redirect_to "example.com"     # Raises UnsafeRedirectError
+#   redirect_to "@attacker.com"   # Raises UnsafeRedirectError
+#   redirect_to "/safe/path"      # Works correctly
+#
+# Applications that want to allow these redirects can set the config to `:log` (previous default)
+# to only log warnings, or `:notify` to send ActiveSupport notifications.
+#++
+# Rails.configuration.action_controller.action_on_path_relative_redirect = :raise
+
+###
+# Use a Ruby parser to track dependencies between Action View templates
+#++
+# Rails.configuration.action_view.render_tracker = :ruby
+
+###
+# When enabled, hidden inputs generated by `form_tag`, `token_tag`, `method_tag`, and the hidden parameter fields
+# included in `button_to` forms will omit the `autocomplete="off"` attribute.
+#
+# Applications that want to keep generating the `autocomplete` attribute for those tags can set it to `false`.
+#++
+# Rails.configuration.action_view.remove_hidden_field_autocomplete = true
diff --git a/config/initializers/new_rails_defaults.rb b/config/initializers/new_rails_defaults.rb
deleted file mode 100644
index 8ec3186..0000000
--- a/config/initializers/new_rails_defaults.rb
+++ /dev/null
@@ -1,19 +0,0 @@
-# Be sure to restart your server when you modify this file.
-
-# These settings change the behavior of Rails 2 apps and will be defaults
-# for Rails 3. You can remove this initializer when Rails 3 is released.
-
-if defined?(ActiveRecord)
-  # Include Active Record class name as root for JSON serialized output.
-  ActiveRecord::Base.include_root_in_json = true
-
-  # Store the full class name (including module namespace) in STI type column.
-  ActiveRecord::Base.store_full_sti_class = true
-end
-
-# Use ISO 8601 format for JSON serialized times and dates.
-ActiveSupport.use_standard_json_time_format = true
-
-# Don't escape HTML entities in JSON, leave that for the #json_escape helper.
-# if you're including raw json in an HTML page.
-ActiveSupport.escape_html_entities_in_json = false
\ No newline at end of file
diff --git a/config/initializers/postgresql_adapter_patch.rb b/config/initializers/postgresql_adapter_patch.rb
new file mode 100644
index 0000000..57df6a2
--- /dev/null
+++ b/config/initializers/postgresql_adapter_patch.rb
@@ -0,0 +1,30 @@
+require 'active_record/connection_adapters/postgresql_adapter'
+
+module ActiveRecord
+  module ConnectionAdapters
+    class PostgreSQLAdapter
+      def create_database(name, options = {})
+        options = options.reverse_merge(:encoding => "utf8")
+
+        option_string = options.symbolize_keys.inject("") do |memo, (key, value)|
+          memo + case key
+          when :owner
+            " OWNER = \"#{value}\""
+          when :template
+            " TEMPLATE = \"#{value}\""
+          when :encoding
+            " ENCODING = '#{value}'"
+          when :tablespace
+            " TABLESPACE = \"#{value}\""
+          when :connection_limit
+            " CONNECTION LIMIT = #{value}"
+          else
+            ""
+          end
+        end
+
+        execute "CREATE DATABASE #{quote_table_name(name)}#{option_string}"
+      end
+    end
+  end
+end
diff --git a/config/initializers/session_store.rb b/config/initializers/session_store.rb
index b3e1098..507dc3c 100644
--- a/config/initializers/session_store.rb
+++ b/config/initializers/session_store.rb
@@ -1,15 +1 @@
-# Be sure to restart your server when you modify this file.
-
-# Your secret key for verifying cookie session data integrity.
-# If you change this key, all old sessions will become invalid!
-# Make sure the secret is at least 30 characters and all random, 
-# no regular words or you'll be exposed to dictionary attacks.
-ActionController::Base.session = {
-  :key         => '_cccms_session',
-  :secret      => 'b50f62033369e6039f2ece511f83f10f70301024709e189ab28d42379a26b7bfd0739fb83d89b6b76dba350569e5b9d83ee4abedbd9da468deea963512e4102b'
-}
-
-# Use the database for sessions instead of the cookie-based default,
-# which shouldn't be used to store highly confidential information
-# (create the session table with "rake db:sessions:create")
-# ActionController::Base.session_store = :active_record_store
+Cccms::Application.config.session_store :cookie_store, :key => '_cccms_session'
diff --git a/config/initializers/xmlparser.rb b/config/initializers/xmlparser.rb
index 9c3f1c8..1d5e06d 100644
--- a/config/initializers/xmlparser.rb
+++ b/config/initializers/xmlparser.rb
@@ -1,14 +1,19 @@
 class XML::Node
-  def replace_with(other) 
+  def replace_with(other)
     self.next = other
     remove!
   end
 end
 
+# Builder 3.x escapes content by default. Override _escape to pass text
+# through raw, preserving existing behaviour from the Rails 2 era.
+# Note: require builder first to ensure XmlBase < BasicObject is already
+# defined before we reopen it.
+require 'builder'
 module Builder
   class XmlBase
     def _escape(text)
       text
     end
   end
-end
\ No newline at end of file
+end