Merge pull request #2 from q-m/compatibility-changes

2023 compatibility updates (only support Ruby 2.7+, Rails 6.1+)

.github/workflows/rspec.yml

@@ -0,0 +1,34 @@
+name: RSpec
+
+on: push
+
+jobs:
+  tests:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        # Maintained versions: 3.0, 3.1, 3.2
+        # Security updates only: 2.7 (EOL: 2023-03-31)
+        # Source: https://www.ruby-lang.org/en/downloads/branches/
+        ruby:
+          - "2.7"
+          - "3.0"
+          - "3.1"
+          - "3.2"
+        gemfile:
+          - rails-6.1.x
+          - rails-7.0.x
+    env:
+      BUNDLE_GEMFILE: ${{ github.workspace }}/gemfiles/${{ matrix.gemfile }}.gemfile
+      RAILS_ENV: test
+    name: "Ruby ${{ matrix.ruby }}, ${{ matrix.gemfile }}"
+    steps:
+      - uses: actions/checkout@v2
+      - name: Set up Ruby & bundle gems
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: ${{ matrix.ruby }}
+          bundler-cache: true
+      - name: Run the tests
+        run: bundle exec rake spec

CHANGELOG.md

@@ -1,3 +1,11 @@
+## Unreleased
+
+* Require Rails 6.1+ and Ruby 2.7+
+* Drop official support for Rails 6.0 and lower, Ruby 2.6 and lower
+* Added CI for Rails 7.0, Ruby 3.x to test compatibility
+* Require Ransack to be at least 4.0 (security concerns)
+* Replace paperclip with kt-paperclip (compatibility fork)
+
 ## 2.6.0
 
 * Redirect to original page after login

README.md

@@ -1,3 +1,16 @@
+# About this fork
+
+Migrating away from a CMS is a lot of work. A more pragmatic approach for us was to make Brightcontent work newer Ruby and Rails versions.
+
+Specific issues we've addressed:
+
+- Port CI from Travis to Github Actions (Travis no longer works)
+- Dropped support for Rails lower than 6.1 and Ruby lower than 2.7
+- Rails v6.1 + Ruby 2.7 compatibility (extended CI to test them, no code changes needed)
+- Investigating: Rails v7.0 + Ruby 3.x compatibility (extended CI to test them, no code changes yet)
+- Require Ransack 4.0 or higher (security issues with lower versions)
+- Replace paperclip with kt-paperclip (compatibility fork)
+
 Brightcontent
 =============
 
@@ -15,7 +28,7 @@ Brightcontent, yet another rails CMS / admin panel
 * No standard 'cms-modules', we hate those, making custom is easy enough
 * Built in the rails way, use your normals models, only controllers and views are provided
 * Only exception: Page model is provided with tree structure, sorting, hidden and pretty urls like `/services/cleaning/houses`
-* Supports Rails 4.2 and above
+* Supports Rails 5.2 and above
 * Strong Parameters support
 
 ![Brightcontent preview](doc/browser.jpg)

Rakefile

@@ -8,6 +8,7 @@ end
 PROJECTS = %w{core pages attachments}
 
 PROJECTS.each do |name|
+  desc "Run tests for #{name}"
   task "spec_#{name}" do
     sh "cd #{name} && bundle exec rake db:schema:load spec RAILS_ENV=test"
   end

attachments/brightcontent-attachments.gemspec

@@ -16,6 +16,6 @@ Gem::Specification.new do |s|
   s.require_paths = ["lib"]
 
   s.add_dependency "brightcontent-core", version
-  s.add_dependency "paperclip", ">= 3.0.0"
+  s.add_dependency "kt-paperclip", ">= 6.0.0"
   s.add_dependency "jquery-fileupload-rails"
 end

core/app/controllers/brightcontent/application_controller.rb

@@ -27,6 +27,12 @@ def current_user
     end
     helper_method :current_user
 
+    def ransack_auth_object
+      current_user
+    end
+    helper_method :ransack_auth_object
+
+
     def user_resources
       @user_resources ||= @current_user.resources
     end

core/brightcontent-core.gemspec

@@ -15,7 +15,7 @@ Gem::Specification.new do |s|
   s.test_files    = `git ls-files -- spec/*`.split("\n")
   s.require_paths = ["lib"]
 
-  s.add_dependency "rails", ">= 4.2.0"
+  s.add_dependency "rails", ">= 6.1.0"
   s.add_dependency "bcrypt"
   s.add_dependency "bootstrap-sass", ">= 3.4.0"
   s.add_dependency "bootstrap-wysihtml5-rails", ">= 0.3.2"
@@ -25,7 +25,7 @@ Gem::Specification.new do |s|
   s.add_dependency "sassc-rails", ">= 2.0"
   s.add_dependency "simple_form"
   s.add_dependency "will_paginate"
-  s.add_dependency "ransack", ">= 1.1"
+  s.add_dependency "ransack", ">= 4.0"
 
   s.add_development_dependency "rake"
   s.add_development_dependency "sqlite3"

core/lib/brightcontent/base_controller_ext/filtering.rb

@@ -10,7 +10,7 @@ module Filtering
       end
 
       def ransack_search
-        @_ransack_search ||= base_collection.ransack(params[:q])
+        @_ransack_search ||= base_collection.ransack(params[:q], auth_object: ransack_auth_object)
       end
 
       def collection

core/lib/brightcontent/view_lookup/filter_field.rb

@@ -11,12 +11,16 @@ def controller
         view_context.controller
       end
 
+      def ransack_auth_object
+        view_context.current_user
+      end
+
       def column?
         resource_class.column_names.include? options[:field].to_s
       end
 
       def scope?
-        resource_class.ransackable_scopes.include?(options[:field].to_sym)
+        resource_class.ransackable_scopes(ransack_auth_object).include?(options[:field].to_sym)
       end
 
       def belongs_to_association?

core/spec/dummy/app/models/application_record.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+class ApplicationRecord < ActiveRecord::Base
+  self.abstract_class = true
+
+  # Safe default: expose no attributes
+  def self.ransackable_attributes(auth_object = nil)
+    []
+  end
+
+  # Safe default: expose no associations
+  def self.ransackable_associations(auth_object = nil)
+    []
+  end
+end

core/spec/dummy/app/models/author.rb

@@ -1,3 +1,3 @@
-class Author < ActiveRecord::Base
+class Author < ApplicationRecord
   has_many :blogs
 end

core/spec/dummy/app/models/blog.rb

@@ -1,4 +1,4 @@
-class Blog < ActiveRecord::Base
+class Blog < ApplicationRecord
   belongs_to :author
   has_many :comments
 
@@ -8,4 +8,12 @@ class Blog < ActiveRecord::Base
   def self.ransackable_scopes(auth = nil)
     [:exclude_inactive]
   end
+
+  def self.ransackable_attributes(auth_object = nil)
+    ["active", "author_id", "body", "created_at", "featured", "id", "name", "updated_at"]
+  end
+
+  def self.ransackable_associations(auth_object = nil)
+    ["author", "comments"]
+  end
 end

core/spec/dummy/app/models/comment.rb

@@ -1,3 +1,7 @@
-class Comment < ActiveRecord::Base
+class Comment < ApplicationRecord
   belongs_to :blog
+
+  def self.ransackable_attributes(auth_object = nil)
+    ["blog_id", "created_at", "id", "text", "updated_at"]
+  end
 end

core/spec/dummy/app/models/grouped_blog.rb

@@ -1,4 +1,4 @@
-class GroupedBlog < ActiveRecord::Base
+class GroupedBlog < ApplicationRecord
   belongs_to :author
 
   scope :exclude_inactive, ->{ where(active: true) }

gemfiles/rails-5.2.x.gemfile → gemfiles/rails-6.1.x.gemfile

@@ -1,6 +1,7 @@
 source "https://rubygems.org"
 
-gem "rails", "~> 5.2.0"
+gem "rails", "~> 6.1.0"
+gem "sprockets", "< 4.0"
 
 gemspec name: "brightcontent-core", path: "../core", group: :core
 gemspec name: "brightcontent-attachments", path: "../attachments", group: :attachments

gemfiles/rails-4.2.x.gemfile → gemfiles/rails-7.0.x.gemfile

@@ -1,7 +1,7 @@
 source "https://rubygems.org"
 
-gem "rails", "~> 4.2.0"
-gem "sqlite3", "~> 1.3.6"
+gem "rails", "~> 7.0.0"
+gem "sprockets", "< 4.0"
 
 gemspec name: "brightcontent-core", path: "../core", group: :core
 gemspec name: "brightcontent-attachments", path: "../attachments", group: :attachments