7 files changed, 95 insertions, 18 deletions

diff --git a/app/controllers/admin_controller.rb b/app/controllers/admin_controller.rb
index 37fd78b..d9cf1be 100644
--- a/app/controllers/admin_controller.rb
+++ b/app/controllers/admin_controller.rb
@@ -6,7 +6,7 @@ class AdminController < ApplicationController
 
   def index
     @drafts = Node.drafts_and_autosaves(current_user_id: current_user.id).limit(5)
-    @recent_changes = Node.recently_changed.limit(5)
+    @actions = NodeAction.order(:occurred_at => :desc, :id => :desc).limit(5)
   end
 
   def conventions
@@ -71,4 +71,11 @@ class AdminController < ApplicationController
       end
     end
   end
+
+  # Deliberately raises, to verify the error-log tripwire end to end.
+  # Behind login_required like the rest of the controller; harmless --
+  # the visitor gets the ordinary 500 page.
+  def boom
+    raise "Deliberate test exception via admin/boom"
+  end
 end
diff --git a/app/controllers/content_controller.rb b/app/controllers/content_controller.rb
index 8d33105..8be4bfb 100644
--- a/app/controllers/content_controller.rb
+++ b/app/controllers/content_controller.rb
@@ -31,7 +31,7 @@ class ContentController < ApplicationController
   def render_gallery
     unless @page.nil?
       @images = @page.assets.images
-      render :file => "content/gallery"
+      render :template => 'content/gallery'
     else
       head :not_found
     end
diff --git a/app/controllers/csp_reports_controller.rb b/app/controllers/csp_reports_controller.rb
new file mode 100644
index 0000000..5a3b55e
--- /dev/null
+++ b/app/controllers/csp_reports_controller.rb
@@ -0,0 +1,22 @@
+class CspReportsController < ApplicationController
+  # Browsers POST application/csp-report with no CSRF token, no session.
+  skip_before_action :verify_authenticity_token
+
+  def create
+    request.body.rewind if request.body.respond_to?(:rewind)
+    raw = request.body.read(8192)
+    raw = request.raw_post if raw.blank?
+
+    report = (JSON.parse(raw)["csp-report"] rescue nil)
+
+    if report
+      directive = report["effective-directive"] || report["violated-directive"]
+      at = (URI.parse(report["document-uri"]).path rescue "unparsed")
+      CSP_LOGGER.warn("CSP violation: #{directive} blocked=#{report['blocked-uri']} at=#{at}")
+    else
+      CSP_LOGGER.warn("CSP violation: unparseable report (#{raw.to_s.bytesize} bytes)")
+    end
+
+    head :no_content
+  end
+end
diff --git a/app/controllers/node_actions_controller.rb b/app/controllers/node_actions_controller.rb
new file mode 100644
index 0000000..6e46719
--- /dev/null
+++ b/app/controllers/node_actions_controller.rb
@@ -0,0 +1,14 @@
+class NodeActionsController < ApplicationController
+
+  before_action :login_required
+
+  layout 'admin'
+
+  def index
+    @actions = NodeAction.order(:occurred_at => :desc, :id => :desc)
+    @actions = @actions.where(:node_id => params[:node_id]) if params[:node_id].present?
+    @actions = @actions.where(:user_id => params[:user_id]) if params[:user_id].present?
+    @actions = @actions.includes(:node, :user)
+                       .paginate(:page => params[:page], :per_page => 50)
+  end
+end
diff --git a/app/controllers/nodes_controller.rb b/app/controllers/nodes_controller.rb
index ed5f8ef..6caa827 100644
--- a/app/controllers/nodes_controller.rb
+++ b/app/controllers/nodes_controller.rb
@@ -13,7 +13,9 @@ class NodesController < ApplicationController
                               :publish,
                               :unlock,
                               :autosave,
-                              :revert
+                              :revert,
+                              :trash,
+                              :restore_from_trash
                             ]
 
   around_action :pin_to_default_locale, :only => [:show, :edit, :update, :autosave]
@@ -27,12 +29,7 @@ class NodesController < ApplicationController
   def new
     @node = Node.new node_params
     @selected_kind = CccConventions::NODE_KINDS.key?(params[:kind]) ? params[:kind] : "generic"
-    if params.has_key?(:parent_id)
-      @parent_id = params[:parent_id]
-      parent = Node.find(@parent_id)
-      @parent_name = parent.title
-      @parent_unique_name = parent.current_unique_name
-    end
+    @parent = Node.find(params[:parent_id]) if params.has_key?(:parent_id)
   end
 
   def create
@@ -50,14 +47,14 @@ class NodesController < ApplicationController
       @node.draft.save!
 
       @node.update!(default_template_name: config[:template]) if config && config[:template]
+      NodeAction.record!(:node => @node, :page => @node.draft, :user => current_user,
+                          :action => "create",
+                          :title => params[:title], :path => @node.unique_name)
 
       redirect_to(edit_node_path(@node))
     else
       @selected_kind = CccConventions::NODE_KINDS.key?(params[:kind]) ? params[:kind] : "generic"
-      if params[:parent_id].present?
-        @parent_id = params[:parent_id]
-        @parent_name = Node.find(@parent_id).title
-      end
+      @parent = Node.find(params[:parent_id]) if params.has_key?(:parent_id)
       render :new
     end
   end
@@ -65,6 +62,9 @@ class NodesController < ApplicationController
   def show
     @page = @node.draft || @node.head
     @translations = @page.translation_summary
+    @page_actions = NodeAction.where(:page_id => @node.pages.select(:id))
+                              .order(:occurred_at, :id)
+                              .group_by(&:page_id)
   end
 
   def edit
@@ -144,8 +144,40 @@ class NodesController < ApplicationController
     redirect_to node_path(@node)
   end
 
+ def trash
+    if @node.trash!(current_user)
+      flash[:notice] = "Page has been moved to the Trash"
+      redirect_to trashed_nodes_path
+    else
+      flash[:notice] = "Page is already in the Trash"
+      redirect_to node_path(@node)
+    end
+  rescue ActiveRecord::RecordInvalid, LockedByAnotherUser => e
+    flash[:error] = e.message
+    redirect_to node_path(@node)
+  end
+
+  def restore_from_trash
+    parent = Node.find(params[:parent_id])
+    @node.restore_from_trash!(parent, current_user)
+    flash[:notice] = "Page has been restored from the Trash"
+    redirect_to node_path(@node)
+  rescue ActiveRecord::RecordNotFound
+    flash[:error] = "Restore target not found"
+    redirect_to node_path(@node)
+  rescue ActiveRecord::RecordInvalid => e
+    flash[:error] = e.message
+    redirect_to node_path(@node)
+  end
+
   def destroy
-    @node.destroy
+    @node.destroy_from_trash!(current_user)
+    flash[:notice] = "Page has been permanently deleted"
+    redirect_to trashed_nodes_path
+
+  rescue ActiveRecord::RecordInvalid, ActiveRecord::RecordNotDestroyed => e
+    flash[:error] = e.message
+    redirect_to node_path(@node)
   end
 
   def publish
@@ -219,6 +251,11 @@ class NodesController < ApplicationController
     @sitemap_descendant_counts = descendant_counts_for(@sitemap)
   end
 
+  def trashed
+    @nodes = Node.trash.children.order(:slug)
+                 .paginate(:page => params[:page], :per_page => 50)
+  end
+
   private
 
     def slug_for(title)
diff --git a/app/controllers/page_translations_controller.rb b/app/controllers/page_translations_controller.rb
index be4f488..38a7c4f 100644
--- a/app/controllers/page_translations_controller.rb
+++ b/app/controllers/page_translations_controller.rb
@@ -63,9 +63,6 @@ class PageTranslationsController < ApplicationController
     draft.translations.where(:locale => @locale).delete_all
     draft.reload
 
-    NodeAction.record!(:node => @node, :page => draft, :user => current_user,
-                        :action => "translation_destroy", :locale => @locale)
-
     flash[:notice] = "#{@locale.upcase} translation removed from the draft. Publish to make this permanent."
     redirect_to node_path(@node)
   rescue LockedByAnotherUser => e
diff --git a/app/controllers/revisions_controller.rb b/app/controllers/revisions_controller.rb
index c5932a4..c1237a9 100644
--- a/app/controllers/revisions_controller.rb
+++ b/app/controllers/revisions_controller.rb
@@ -49,7 +49,7 @@ class RevisionsController < ApplicationController
 
   def restore
     page = Page.find(params[:id])
-    page.node.restore_revision! page.revision
+    page.node.restore_revision! page.revision, current_user
     flash[:notice] = "Revision #{page.revision} restored"
     redirect_to node_path(page.node)
   end