15 files changed, 332 insertions, 185 deletions

diff --git a/config/application.rb b/config/application.rb
index d92802f..3ddad2d 100644
--- a/config/application.rb
+++ b/config/application.rb
@@ -1,62 +1,20 @@
-# Put this in config/application.rb
-require File.expand_path('../boot', __FILE__)
+require_relative "boot"
 
-require 'rails/all'
+require "rails/all"
 
-Bundler.require(:default, Rails.env) if defined?(Bundler)
-
-require 'action_controller'
-
-module ActionController
-  class Base
-    def self.consider_all_requests_local=(val)
-      # no-op: controlled via config.consider_all_requests_local in environment files
-    end
-  end
-end
+Bundler.require(*Rails.groups)
 
 module Cccms
   class Application < Rails::Application
-    config.autoload_paths += [config.root.join('lib')]
-    config.encoding = 'utf-8'
-    # Settings in config/environments/* take precedence over those specified here.
-    # Application configuration should go into files in config/initializers
-    # -- all .rb files in that directory are automatically loaded.
-  
-    # Add additional load paths for your own custom dirs
-    # config.load_paths += %W( #{RAILS_ROOT}/extras )
-  
-    # Only load the plugins named here, in the order given (default is alphabetical).
-    # :all can be used as a placeholder for all plugins not explicitly named
-    # config.plugins = [ :exception_notification, :ssl_requirement, :all ]
-  
-    # Allowed Tags
-    # strong em b i p code pre tt samp kbd var sub sup dfn cite big small
-    # address hr br div span h1 h2 h3 h4 h5 h6 ul ol li dt dd abbr
-    # acronym a img blockquote del ins
-  
-    # Allowed Attributes:
-    # href src width height alt cite datetime title class name xml:lang abbr))
-  
-    # Add tags to whitelist with:
-    # config.action_view.sanitized_allowed_tags = 'table', 'tr', 'td'
-  
-    # Add attributes to whitelist with:
-    # config.action_view.sanitized_allowed_attributes = 'id', 'class', 'style'
-  
-    # Activate observers that should always be running
-    # config.active_record.observers = :cacher, :garbage_collector, :forum_observer
-  
-    # Set Time.zone default to the specified zone and make Active Record auto-convert to this zone.
-    # Run "rake -D time" for a list of tasks for finding time zone names.
+    config.load_defaults 8.1
+
+    config.autoload_lib(ignore: %w[assets tasks])
+
     config.time_zone = 'Berlin'
-  
-    # The default locale is :en and all translations from config/locales/*.rb,yml are auto loaded.
-    # config.i18n.load_path += Dir[Rails.root.join('my', 'locales', '*.{rb,yml}')]
+
     config.i18n.default_locale = :de
     config.i18n.fallbacks = { en: [:en, :de] }
 
     config.filter_parameters += [:password, :password_confirmation]
-    config.serve_static_files = true
   end
 end
diff --git a/config/boot.rb b/config/boot.rb
index b92444f..2820116 100644
--- a/config/boot.rb
+++ b/config/boot.rb
@@ -1,2 +1,3 @@
-require 'rubygems'
-require 'bundler/setup'
+ENV["BUNDLE_GEMFILE"] ||= File.expand_path("../Gemfile", __dir__)
+
+require "bundler/setup" # Set up gems listed in the Gemfile.
diff --git a/config/cable.yml b/config/cable.yml
new file mode 100644
index 0000000..0c11ddb
--- /dev/null
+++ b/config/cable.yml
@@ -0,0 +1,10 @@
+development:
+  adapter: async
+
+test:
+  adapter: test
+
+production:
+  adapter: redis
+  url: <%= ENV.fetch("REDIS_URL") { "redis://localhost:6379/1" } %>
+  channel_prefix: cccms_production
diff --git a/config/environment.rb b/config/environment.rb
index 6fdeb06..cac5315 100644
--- a/config/environment.rb
+++ b/config/environment.rb
@@ -1,2 +1,5 @@
-require File.expand_path('../application', __FILE__)
-Cccms::Application.initialize!
+# Load the Rails application.
+require_relative "application"
+
+# Initialize the Rails application.
+Rails.application.initialize!
diff --git a/config/environments/development.rb b/config/environments/development.rb
index 1c26f7d..56174f8 100644
--- a/config/environments/development.rb
+++ b/config/environments/development.rb
@@ -1,26 +1,38 @@
-# Settings specified here will take precedence over those in config/environment.rb
+require "active_support/core_ext/integer/time"
 
-Cccms::Application.configure do
-  # In the development environment your application's code is reloaded on
-  # every request.  This slows down response time but is perfect for development
-  # since you don't have to restart the webserver when you make code changes.
+Rails.application.configure do
   config.enable_reloading = true
+  config.eager_load = false
+
+  config.consider_all_requests_local = true
+  config.server_timing = true
 
-  # Log error messages when you accidentally call methods on nil.
+  if Rails.root.join("tmp/caching-dev.txt").exist?
+    config.action_controller.perform_caching = true
+    config.action_controller.enable_fragment_cache_logging = true
+    config.public_file_server.headers = { "cache-control" => "public, max-age=#{2.days.to_i}" }
+  else
+    config.action_controller.perform_caching = false
+  end
 
-  # Show full error reports and disable caching
-  config.action_controller.consider_all_requests_local = true
-  config.action_controller.perform_caching             = false
+  config.cache_store = :memory_store
 
-  # Don't care if the mailer can't send
   config.action_mailer.raise_delivery_errors = false
+  config.action_mailer.perform_caching = false
+  config.action_mailer.default_url_options = { host: "localhost", port: 3000 }
 
   config.active_support.deprecation = :log
-  config.public_file_server.enabled = true
-  config.eager_load = false
 
-  config.hosts.clear
+  config.active_record.migration_error = :page_load
+  config.active_record.verbose_query_logs = true
+  config.active_record.query_log_tags_enabled = true
+
+  config.active_job.verbose_enqueue_logs = true
+  config.action_dispatch.verbose_redirect_logs = true
+  config.action_view.annotate_rendered_view_with_filenames = true
+  config.action_controller.raise_on_missing_callback_actions = true
 
+  config.hosts.clear
   config.middleware.delete ExceptionNotification::Rack
 
   config.assets.debug = false
diff --git a/config/environments/production.rb b/config/environments/production.rb
index 82b918a..f8d078e 100644
--- a/config/environments/production.rb
+++ b/config/environments/production.rb
@@ -1,34 +1,20 @@
-# Settings specified here will take precedence over those in config/environment.rb
+require "active_support/core_ext/integer/time"
 
-Cccms::Application.configure do
-  # The production environment is meant for finished, "live" apps.
-  # Code is not reloaded between requests
-  config.cache_classes = true
-
-  # Full error reports are disabled and caching is turned on
-  config.action_controller.consider_all_requests_local = false
-  config.action_controller.perform_caching             = true
-
-  # See everything in the log (default is :info)
-  config.log_level = :info
-
-  config.active_support.deprecation = :notify
+Rails.application.configure do
+  config.enable_reloading = false
   config.eager_load = true
+  config.assume_ssl = true
 
-  # Use a different logger for distributed setups
-  # config.logger = SyslogLogger.new
+  config.consider_all_requests_local = false
+  config.action_controller.perform_caching = true
 
-  # Use a different cache store in production
-  # config.cache_store = :mem_cache_store
+  config.public_file_server.headers = { "cache-control" => "public, max-age=#{1.year.to_i}" }
 
-  # Enable serving of images, stylesheets, and javascripts from an asset server
-  # config.action_controller.asset_host = "http://assets.example.com"
+  config.log_tags = [ :request_id ]
+  config.logger   = ActiveSupport::TaggedLogging.logger(STDOUT)
+  config.log_level = ENV.fetch("RAILS_LOG_LEVEL", "info")
 
-  # Disable delivery errors, bad email addresses will be ignored
-  # config.action_mailer.raise_delivery_errors = false
-
-  # Enable threaded mode
-  # config.threadsafe!
+  config.active_support.report_deprecations = false
 
   config.action_mailer.delivery_method = :sendmail
   config.action_mailer.sendmail_settings = {
@@ -37,4 +23,10 @@ Cccms::Application.configure do
   }
   config.action_mailer.perform_deliveries = true
   config.action_mailer.raise_delivery_errors = true
+  config.action_mailer.default_url_options = { host: "ccc.de" }
+
+  config.i18n.fallbacks = true
+
+  config.active_record.dump_schema_after_migration = false
+  config.active_record.attributes_for_inspect = [ :id ]
 end
diff --git a/config/environments/test.rb b/config/environments/test.rb
index 48aafe8..bb89065 100644
--- a/config/environments/test.rb
+++ b/config/environments/test.rb
@@ -1,17 +1,55 @@
-Cccms::Application.configure do
+# The test environment is used exclusively to run your application's
+# test suite. You never need to work with it otherwise. Remember that
+# your test database is "scratch space" for the test suite and is wiped
+# and recreated between test runs. Don't rely on the data there!
 
+Rails.application.configure do
+  # Settings specified here will take precedence over those in config/application.rb.
+
+  # While tests run files are not watched, reloading is not necessary.
   config.enable_reloading = false
 
-  config.action_controller.consider_all_requests_local = true
-  config.action_controller.perform_caching             = false
+  # Eager loading loads your entire application. When running a single test locally,
+  # this is usually not necessary, and can slow down your test suite. However, it's
+  # recommended that you enable it in continuous integration systems to ensure eager
+  # loading is working properly before deploying your code.
+  config.eager_load = ENV["CI"].present?
+
+  # Configure public file server for tests with cache-control for performance.
+  config.public_file_server.headers = { "cache-control" => "public, max-age=3600" }
+
+  # Show full error reports.
+  config.consider_all_requests_local = true
+  config.cache_store = :null_store
+
+  # Render exception templates for rescuable exceptions and raise for other exceptions.
+  config.action_dispatch.show_exceptions = :rescuable
+
+  # Disable request forgery protection in test environment.
+  config.action_controller.allow_forgery_protection = false
 
-  config.action_controller.allow_forgery_protection    = false
+  # Store uploaded files on the local file system in a temporary directory.
+  config.active_storage.service = :test
 
+  # Tell Action Mailer not to deliver emails to the real world.
+  # The :test delivery method accumulates sent emails in the
+  # ActionMailer::Base.deliveries array.
   config.action_mailer.delivery_method = :test
 
-  config.active_support.deprecation = :log
+  # Set host to be used by links generated in mailer templates.
+  config.action_mailer.default_url_options = { host: "example.com" }
+
+  # Print deprecation notices to the stderr.
+  config.active_support.deprecation = :stderr
+
+  # Raises error for missing translations.
+  # config.i18n.raise_on_missing_translations = true
+
+  # Annotate rendered view with file names.
+  # config.action_view.annotate_rendered_view_with_filenames = true
+
+  # Raise error when a before_action's only/except options reference missing actions.
+  config.action_controller.raise_on_missing_callback_actions = true
 
-  config.eager_load = false
-  config.public_file_server.enabled = true
-  config.public_file_server.headers = { 'Cache-Control' => 'public, max-age=3600' }
+  config.assets.raise_runtime_errors = false
 end
diff --git a/config/initializers/content_security_policy.rb b/config/initializers/content_security_policy.rb
new file mode 100644
index 0000000..d51d713
--- /dev/null
+++ b/config/initializers/content_security_policy.rb
@@ -0,0 +1,29 @@
+# Be sure to restart your server when you modify this file.
+
+# Define an application-wide content security policy.
+# See the Securing Rails Applications Guide for more information:
+# https://guides.rubyonrails.org/security.html#content-security-policy-header
+
+# Rails.application.configure do
+#   config.content_security_policy do |policy|
+#     policy.default_src :self, :https
+#     policy.font_src    :self, :https, :data
+#     policy.img_src     :self, :https, :data
+#     policy.object_src  :none
+#     policy.script_src  :self, :https
+#     policy.style_src   :self, :https
+#     # Specify URI for violation reports
+#     # policy.report_uri "/csp-violation-report-endpoint"
+#   end
+#
+#   # Generate session nonces for permitted importmap, inline scripts, and inline styles.
+#   config.content_security_policy_nonce_generator = ->(request) { request.session.id.to_s }
+#   config.content_security_policy_nonce_directives = %w(script-src style-src)
+#
+#   # Automatically add `nonce` to `javascript_tag`, `javascript_include_tag`, and `stylesheet_link_tag`
+#   # if the corresponding directives are specified in `content_security_policy_nonce_directives`.
+#   # config.content_security_policy_nonce_auto = true
+#
+#   # Report violations without enforcing the policy.
+#   # config.content_security_policy_report_only = true
+# end
diff --git a/config/initializers/filter_parameter_logging.rb b/config/initializers/filter_parameter_logging.rb
new file mode 100644
index 0000000..c0b717f
--- /dev/null
+++ b/config/initializers/filter_parameter_logging.rb
@@ -0,0 +1,8 @@
+# Be sure to restart your server when you modify this file.
+
+# Configure parameters to be partially matched (e.g. passw matches password) and filtered from the log file.
+# Use this to limit dissemination of sensitive information.
+# See the ActiveSupport::ParameterFilter documentation for supported notations and behaviors.
+Rails.application.config.filter_parameters += [
+  :passw, :email, :secret, :token, :_key, :crypt, :salt, :certificate, :otp, :ssn, :cvv, :cvc
+]
diff --git a/config/initializers/inflections.rb b/config/initializers/inflections.rb
index d531b8b..3860f65 100644
--- a/config/initializers/inflections.rb
+++ b/config/initializers/inflections.rb
@@ -1,10 +1,16 @@
 # Be sure to restart your server when you modify this file.
 
-# Add new inflection rules using the following format 
-# (all these examples are active by default):
-# ActiveSupport::Inflector.inflections do |inflect|
-#   inflect.plural /^(ox)$/i, '\1en'
-#   inflect.singular /^(ox)en/i, '\1'
-#   inflect.irregular 'person', 'people'
+# Add new inflection rules using the following format. Inflections
+# are locale specific, and you may define rules for as many different
+# locales as you wish. All of these examples are active by default:
+# ActiveSupport::Inflector.inflections(:en) do |inflect|
+#   inflect.plural /^(ox)$/i, "\\1en"
+#   inflect.singular /^(ox)en/i, "\\1"
+#   inflect.irregular "person", "people"
 #   inflect.uncountable %w( fish sheep )
 # end
+
+# These inflection rules are supported but not enabled by default:
+# ActiveSupport::Inflector.inflections(:en) do |inflect|
+#   inflect.acronym "RESTful"
+# end
diff --git a/config/initializers/new_framework_defaults_8_1.rb b/config/initializers/new_framework_defaults_8_1.rb
new file mode 100644
index 0000000..8569b5b
--- /dev/null
+++ b/config/initializers/new_framework_defaults_8_1.rb
@@ -0,0 +1,74 @@
+# Be sure to restart your server when you modify this file.
+#
+# This file eases your Rails 8.1 framework defaults upgrade.
+#
+# Uncomment each configuration one by one to switch to the new default.
+# Once your application is ready to run with all new defaults, you can remove
+# this file and set the `config.load_defaults` to `8.1`.
+#
+# Read the Guide for Upgrading Ruby on Rails for more info on each option.
+# https://guides.rubyonrails.org/upgrading_ruby_on_rails.html
+
+###
+# Skips escaping HTML entities and line separators. When set to `false`, the
+# JSON renderer no longer escapes these to improve performance.
+#
+# Example:
+#   class PostsController < ApplicationController
+#     def index
+#       render json: { key: "\u2028\u2029<>&" }
+#     end
+#   end
+#
+# Renders `{"key":"\u2028\u2029\u003c\u003e\u0026"}` with the previous default, but `{"key":"

<>&"}` with the config
+# set to `false`.
+#
+# Applications that want to keep the escaping behavior can set the config to `true`.
+#++
+# Rails.configuration.action_controller.escape_json_responses = false
+
+###
+# Skips escaping LINE SEPARATOR (U+2028) and PARAGRAPH SEPARATOR (U+2029) in JSON.
+#
+# Historically these characters were not valid inside JavaScript literal strings but that changed in ECMAScript 2019.
+# As such it's no longer a concern in modern browsers: https://caniuse.com/mdn-javascript_builtins_json_json_superset.
+#++
+# Rails.configuration.active_support.escape_js_separators_in_json = false
+
+###
+# Raises an error when order dependent finder methods (e.g. `#first`, `#second`) are called without `order` values
+# on the relation, and the model does not have any order columns (`implicit_order_column`, `query_constraints`, or
+# `primary_key`) to fall back on.
+#
+# The current behavior of not raising an error has been deprecated, and this configuration option will be removed in
+# Rails 8.2.
+#++
+# Rails.configuration.active_record.raise_on_missing_required_finder_order_columns = true
+
+###
+# Controls how Rails handles path relative URL redirects.
+# When set to `:raise`, Rails will raise an `ActionController::Redirecting::UnsafeRedirectError`
+# for relative URLs without a leading slash, which can help prevent open redirect vulnerabilities.
+#
+# Example:
+#   redirect_to "example.com"     # Raises UnsafeRedirectError
+#   redirect_to "@attacker.com"   # Raises UnsafeRedirectError
+#   redirect_to "/safe/path"      # Works correctly
+#
+# Applications that want to allow these redirects can set the config to `:log` (previous default)
+# to only log warnings, or `:notify` to send ActiveSupport notifications.
+#++
+# Rails.configuration.action_controller.action_on_path_relative_redirect = :raise
+
+###
+# Use a Ruby parser to track dependencies between Action View templates
+#++
+# Rails.configuration.action_view.render_tracker = :ruby
+
+###
+# When enabled, hidden inputs generated by `form_tag`, `token_tag`, `method_tag`, and the hidden parameter fields
+# included in `button_to` forms will omit the `autocomplete="off"` attribute.
+#
+# Applications that want to keep generating the `autocomplete` attribute for those tags can set it to `false`.
+#++
+# Rails.configuration.action_view.remove_hidden_field_autocomplete = true
diff --git a/config/initializers/routing_filter_rails71_patch.rb b/config/initializers/routing_filter_rails71_patch.rb
deleted file mode 100644
index 35e3576..0000000
--- a/config/initializers/routing_filter_rails71_patch.rb
+++ /dev/null
@@ -1,38 +0,0 @@
-# routing-filter 0.7.0 is broken on Rails 7.1+ due to a change in how
-# ActionDispatch::Journey::Router#find_routes yields results (lazy iterator
-# vs eager enumerable). This patch restores the expected behaviour.
-# See: https://github.com/svenfuchs/routing-filter/pull/87
-# Remove this file if routing-filter ever releases a fixed version,
-# or when routing-filter is replaced with native Rails i18n scope routing.
-
-if Gem.loaded_specs['routing-filter'].version > Gem::Version.new('0.7.0')
-  raise 'routing-filter has been updated — check if this patch is still needed and remove it if so.'
-end
-
-ActionDispatchJourneyRouterWithFiltering.remove_method(:find_routes)
-
-module RoutingFilterRails71Fix
-  def find_routes(env)
-    path = env.is_a?(Hash) ? env['PATH_INFO'] : env.path_info
-    filter_parameters = {}
-    original_path = path.dup
-
-    @routes.filters.run(:around_recognize, path, env) do
-      filter_parameters
-    end
-
-    super(env) do |match, parameters, route|
-      parameters = parameters.merge(filter_parameters)
-
-      if env.is_a?(Hash)
-        env['PATH_INFO'] = original_path
-      else
-        env.path_info = original_path
-      end
-
-      yield [match, parameters, route]
-    end
-  end
-end
-
-ActionDispatch::Journey::Router.prepend(RoutingFilterRails71Fix)
diff --git a/config/puma.rb b/config/puma.rb
new file mode 100644
index 0000000..38c4b86
--- /dev/null
+++ b/config/puma.rb
@@ -0,0 +1,42 @@
+# This configuration file will be evaluated by Puma. The top-level methods that
+# are invoked here are part of Puma's configuration DSL. For more information
+# about methods provided by the DSL, see https://puma.io/puma/Puma/DSL.html.
+#
+# Puma starts a configurable number of processes (workers) and each process
+# serves each request in a thread from an internal thread pool.
+#
+# You can control the number of workers using ENV["WEB_CONCURRENCY"]. You
+# should only set this value when you want to run 2 or more workers. The
+# default is already 1. You can set it to `auto` to automatically start a worker
+# for each available processor.
+#
+# The ideal number of threads per worker depends both on how much time the
+# application spends waiting for IO operations and on how much you wish to
+# prioritize throughput over latency.
+#
+# As a rule of thumb, increasing the number of threads will increase how much
+# traffic a given process can handle (throughput), but due to CRuby's
+# Global VM Lock (GVL) it has diminishing returns and will degrade the
+# response time (latency) of the application.
+#
+# The default is set to 3 threads as it's deemed a decent compromise between
+# throughput and latency for the average Rails application.
+#
+# Any libraries that use a connection pool or another resource pool should
+# be configured to provide at least as many connections as the number of
+# threads. This includes Active Record's `pool` parameter in `database.yml`.
+threads_count = ENV.fetch("RAILS_MAX_THREADS", 3)
+threads threads_count, threads_count
+
+# Specifies the `port` that Puma will listen on to receive requests; default is 3000.
+port ENV.fetch("PORT", 3000)
+
+# Allow puma to be restarted by `bin/rails restart` command.
+plugin :tmp_restart
+
+# Run the Solid Queue supervisor inside of Puma for single-server deployments.
+plugin :solid_queue if ENV["SOLID_QUEUE_IN_PUMA"]
+
+# Specify the PID file. Defaults to tmp/pids/server.pid in development.
+# In other environments, only set the PID file if requested.
+pidfile ENV["PIDFILE"] if ENV["PIDFILE"]
diff --git a/config/routes.rb b/config/routes.rb
index c3fd5c6..9d4b41d 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -1,60 +1,65 @@
 Cccms::Application.routes.draw do
-  filter :locale
 
-  root :to => 'content#render_page', :page_path => ['home'], :locale => 'de'
+  # Provides the locale prefix url scheme
+  scope '(:locale)', locale: ->(v) { I18n.available_locales.map(&:to_s).include?(v) } do
 
-  resources :tags
-  resources :occurrences
-  resources :events
+    root :to => 'content#render_page', :page_path => ['home'], :locale => 'de'
 
-  resources :pages do
-    member do
-      get :preview
-      put :sort_images
-    end
-  end
+    resources :tags
+    resources :occurrences
+    resources :events
 
-  resources :nodes do
-    member do
-      put :unlock
-      put :publish
+    resources :pages do
+      member do
+        get :preview
+        put :sort_images
+      end
     end
 
-    resources :revisions do
-      collection do
-        post :diff
-      end
+    resources :nodes do
       member do
-        put :restore
+        put :unlock
+        put :publish
+      end
+
+      resources :revisions do
+        collection do
+          post :diff
+        end
+        member do
+          put :restore
+        end
       end
     end
-  end
 
-  scope '/admin' do
-    resources :assets
-  end
+    scope '/admin' do
+      resources :assets
+    end
 
-  match '/logout'      => 'sessions#destroy', :as => :logout,       :via => :delete
-  match '/login'       => 'sessions#new',     :as => :login,        :via => :get
-  match 'admin'        => 'admin#index',      :as => :admin,        :via => :get
-  match 'admin/search' => 'admin#search',     :as => :admin_search, :via => :get
-  match 'search'       => 'search#index',     :as => :search,       :via => :get
+    match '/logout'      => 'sessions#destroy', :as => :logout,       :via => :delete
+    match '/login'       => 'sessions#new',     :as => :login,        :via => :get
+    match 'admin'        => 'admin#index',      :as => :admin,        :via => :get
+    match 'admin/search' => 'admin#search',     :as => :admin_search, :via => :get
+    match 'search'       => 'search#index',     :as => :search,       :via => :get
 
-  resources :users
+    resources :users
 
-  resources :menu_items do
-    member do
-      post :sort
+    resources :menu_items do
+      member do
+        post :sort
+      end
     end
-  end
 
-  resource :session
+    resource :session
+
+    get  'rss/updates',         :to => 'rss#updates', :as => :rss
+    get  'rss/updates.:format', :to => 'rss#updates', :as => :rss_feed,
+           :constraints => { :format => /xml|rdf/ }
+    get  'rss/recent_changes',  :to => 'rss#recent_changes'
 
-  get  'rss/updates',          :to => 'rss#updates', :as => :rss
-  get  'rss/updates.:format',  :to => 'rss#updates', :as => :rss_feed,
-         :constraints => { :format => /xml|rdf/ }
-  get  'rss/recent_changes',   :to => 'rss#recent_changes'
+    match 'galleries/*page_path' => 'content#render_gallery', :via => :get
+    match '/*page_path'          => 'content#render_page', :as => :content, :via => :get
+
+  end
 
-  match 'galleries/*page_path' => 'content#render_gallery', :via => :get
-  match '/*page_path' => 'content#render_page', :as => :content, :via => :get
 end
diff --git a/config/tinymce.yml b/config/tinymce.yml
new file mode 100644
index 0000000..a97fbe7
--- /dev/null
+++ b/config/tinymce.yml
@@ -0,0 +1,7 @@
+license_key: gpl
+plugins:
+  - paste
+toolbar: bold italic underline | bullist numlist | link unlink | blocks | code
+extended_valid_elements: "aggregate[tags|limit|order_by|order_direction|partial|conditions]"
+relative_urls: false
+entity_encoding: raw