From 04450e10866fc56890426525062fd5cdf56c4300 Mon Sep 17 00:00:00 2001 From: erdgeist Date: Fri, 17 Jul 2026 19:30:43 +0200 Subject: Allowlist aggregate order columns and template names Page.aggregate interpolated order_by into SQL unchecked while already allowlisting order_direction; the column is now normalized and checked against the sortable columns, falling back to pages.id. Its values arrive from editor-authored aggregate shortcodes, so this was editor-gated, but the asymmetry was wrong regardless. template_name and default_template_name now validate inclusion in Page.custom_templates -- names render as filesystem paths, so only names actually present in the template directory are acceptable. Validated only on change: legacy rows whose template file has since vanished stay saveable, and valid_template's render-time fallback to standard_template continues to cover them. Two tests that wrote fabricated template names through the front door now arrange their state correctly (update_column for the stale-name fallback test, a real template for the update-persists test). --- app/models/node.rb | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'app/models/node.rb') diff --git a/app/models/node.rb b/app/models/node.rb index 4f585e1..70ed4da 100644 --- a/app/models/node.rb +++ b/app/models/node.rb @@ -22,6 +22,11 @@ class Node < ApplicationRecord validates_uniqueness_of :slug, :scope => :parent_id, :unless => -> { parent_id.nil? } validates_presence_of :parent_id, :unless => -> { Node.root.nil? } + validates :default_template_name, + :inclusion => { :in => ->(_) { Page.custom_templates } }, + :allow_nil => true, + :if => :default_template_name_changed? + # Class methods # Returns a page for a given node. If no revision is supplied, it returns -- cgit v1.3