Merge branch 'master' of github.com:railsadminteam/rails_admin

* 'master' of github.com:railsadminteam/rails_admin:
  Tidy up gemfiles
  Bump jRuby
  Test against Mongoid 8
  Test against Rails 7.1
  Mitigate jRuby build failures
  Upgrade node and vite to fix the vite build
  Un-pin turbo-rails to fix Rails 6.1 builds
  Follow-up for railsadminteam#3555
  Resolved a problem with embedded mongoid documents and boolean selectors (railsadminteam#3555)
  Stop using update_only to decide to show subform on create (railsadminteam#3649)
  Follow-up for railsadminteam#3643
  Basic vite integration attempt (railsadminteam#3643)
  Support client-side dynamic scoping
  Fix Rubocop offense
  Revive the live demo
  Unlock webrick version
  Fix typo: tripple ==> triple (railsadminteam#3637)
  Replace &rdquo; entity with inline <q> element (railsadminteam#3636)
  Vulnerability fix: validate return_to param using request.host (railsadminteam#3627)
  Fix Rubocop offense

Author: jklimke

.github/workflows/test.yml

@@ -12,7 +12,7 @@ jobs:
           - "3.0"
           - "3.1"
           - "3.2"
-        gemfile: [gemfiles/rails_7.0.gemfile]
+        gemfile: [gemfiles/rails_7.1.gemfile]
         orm: [active_record]
         adapter: [sqlite3]
         asset: [webpack]
@@ -32,17 +32,27 @@ jobs:
             orm: active_record
             adapter: sqlite3
             asset: webpacker
-          - ruby: "3.0"
+          - ruby: "3.2"
             gemfile: gemfiles/rails_7.0.gemfile
             orm: active_record
+            adapter: sqlite3
+            asset: sprockets
+          - ruby: "3.2"
+            gemfile: gemfiles/rails_7.1.gemfile
+            orm: active_record
             adapter: mysql2
             asset: importmap
-          - ruby: "3.0"
-            gemfile: gemfiles/rails_7.0.gemfile
+          - ruby: "3.2"
+            gemfile: gemfiles/rails_7.1.gemfile
             orm: active_record
             adapter: postgresql
             asset: sprockets
-          - ruby: "3.0"
+          - ruby: "3.2"
+            gemfile: gemfiles/rails_7.1.gemfile
+            orm: active_record
+            adapter: sqlite3
+            asset: vite
+          - ruby: "3.2"
             gemfile: gemfiles/composite_primary_keys.gemfile
             orm: active_record
             adapter: sqlite3
@@ -57,13 +67,23 @@ jobs:
             orm: mongoid
             adapter: sqlite3
             asset: sprockets
-          - ruby: jruby-9.3
-            gemfile: gemfiles/rails_6.1.gemfile
+          - ruby: "3.1"
+            gemfile: gemfiles/rails_7.0.gemfile
+            orm: mongoid
+            adapter: sqlite3
+            asset: sprockets
+          - ruby: "3.2"
+            gemfile: gemfiles/rails_7.1.gemfile
+            orm: mongoid
+            adapter: sqlite3
+            asset: sprockets
+          - ruby: jruby-9.4
+            gemfile: gemfiles/rails_7.0.gemfile
             orm: active_record
             adapter: mysql2
             asset: sprockets
-          - ruby: jruby-9.3
-            gemfile: gemfiles/rails_6.1.gemfile
+          - ruby: jruby-9.4
+            gemfile: gemfiles/rails_7.0.gemfile
             orm: mongoid
             adapter: sqlite3
             asset: sprockets
@@ -106,13 +126,14 @@ jobs:
       - name: Set up Node
         uses: actions/setup-node@v3
         with:
-          node-version: "14"
+          node-version: "18"
       - name: Setup application
         env:
           BUNDLE_GEMFILE: ../../${{ matrix.gemfile }}
           CI_ASSET: ${{ matrix.asset }}
           CI_DB_ADAPTER: ${{ matrix.adapter }}
           RAILS_ENV: test
+          NODE_OPTIONS: --openssl-legacy-provider
         run: |
           yarn install
           cd spec/dummy_app
@@ -166,7 +187,7 @@ jobs:
       - name: Set up Ruby
         uses: ruby/setup-ruby@v1
         with:
-          ruby-version: "3.0"
+          ruby-version: "3.2"
       - name: Cache gems
         uses: actions/cache@v3
         with:

Appraisals

@@ -2,21 +2,12 @@
 
 appraise 'rails-6.0' do
   gem 'rails', '~> 6.0.0'
-  gem 'sassc-rails', '~> 2.1'
-  gem 'devise', '~> 4.7'
 
   group :test do
-    gem 'cancancan', '~> 3.0'
-    gem 'kt-paperclip'
     gem 'pundit', '~> 2.1.0'
-    gem 'rspec-rails', '>= 4.0.0.beta2'
-    gem 'shrine', '~> 3.0'
   end
 
   group :active_record do
-    gem 'pg', '>= 1.0.0', platforms: :ruby
-    gem 'paper_trail', '>= 12.0'
-
     platforms :jruby do
       gem 'activerecord-jdbcmysql-adapter', '~> 60.0'
       gem 'activerecord-jdbcpostgresql-adapter', '~> 60.0'
@@ -26,31 +17,13 @@ appraise 'rails-6.0' do
 
   group :mongoid do
     gem 'mongoid', '~> 7.0'
-    gem 'kaminari-mongoid'
-    gem 'mongoid-paperclip', '>= 0.0.8', require: 'mongoid_paperclip'
-    gem 'carrierwave-mongoid', '>= 0.6.3', require: 'carrierwave/mongoid'
-    gem 'cancancan-mongoid'
-    gem 'shrine-mongoid', '~> 1.0'
   end
 end
 
 appraise 'rails-6.1' do
   gem 'rails', '~> 6.1.0'
-  gem 'sassc-rails', '~> 2.1'
-  gem 'devise', '~> 4.7'
-  gem 'turbo-rails', platform: :jruby, github: 'hotwired/turbo-rails'
-
-  group :test do
-    gem 'cancancan', '~> 3.2'
-    gem 'kt-paperclip'
-    gem 'rspec-rails', '>= 4.0.0.beta2'
-    gem 'shrine', '~> 3.0'
-  end
 
   group :active_record do
-    gem 'pg', '>= 1.0.0', platforms: :ruby
-    gem 'paper_trail', '>= 12.0'
-
     platforms :jruby do
       gem 'activerecord-jdbcmysql-adapter', '~> 61.0'
       gem 'activerecord-jdbcpostgresql-adapter', '~> 61.0'
@@ -60,47 +33,39 @@ appraise 'rails-6.1' do
 
   group :mongoid do
     gem 'mongoid', '~> 7.0'
-    gem 'kaminari-mongoid'
-    gem 'mongoid-paperclip', '>= 0.0.8', require: 'mongoid_paperclip'
-    gem 'carrierwave-mongoid', '>= 0.6.3', require: 'carrierwave/mongoid'
-    gem 'cancancan-mongoid'
-    gem 'shrine-mongoid', '~> 1.0'
   end
 end
 
 appraise 'rails-7.0' do
   gem 'rails', '~> 7.0.0'
   gem 'importmap-rails', require: false
-  gem 'sassc-rails', '~> 2.1'
-  gem 'devise', '~> 4.8'
 
-  group :test do
-    gem 'cancancan', '~> 3.2'
-    gem 'kt-paperclip'
-    gem 'rspec-rails', '>= 4.0.0.beta2'
-    gem 'shrine', '~> 3.0'
+  group :active_record do
+    platforms :jruby do
+      gem 'activerecord-jdbcmysql-adapter', '~> 70.0'
+      gem 'activerecord-jdbcpostgresql-adapter', '~> 70.0'
+      gem 'activerecord-jdbcsqlite3-adapter', '~> 70.0'
+    end
   end
 
-  group :active_record do
-    gem 'pg', '>= 1.0.0', platforms: :ruby
-    gem 'paper_trail', '>= 12.0'
+  group :mongoid do
+    gem 'mongoid', '~> 8.0'
   end
 end
 
-appraise 'composite_primary_keys' do
-  gem 'rails', '~> 7.0.0'
-  gem 'sassc-rails', '~> 2.1'
-  gem 'devise', '~> 4.8'
+appraise 'rails-7.1' do
+  gem 'rails', '~> 7.1.0'
+  gem 'importmap-rails', require: false
 
-  group :test do
-    gem 'cancancan', '~> 3.2'
-    gem 'kt-paperclip'
-    gem 'rspec-rails', '>= 4.0.0.beta2'
-    gem 'shrine', '~> 3.0'
+  group :mongoid do
+    gem 'mongoid', '~> 8.0'
   end
+end
+
+appraise 'composite_primary_keys' do
+  gem 'rails', '~> 7.0.0'
 
   group :active_record do
     gem 'composite_primary_keys'
-    gem 'paper_trail', '>= 12.0'
   end
 end

Gemfile

@@ -3,20 +3,13 @@
 source 'https://rubygems.org'
 
 gem 'appraisal', '>= 2.0'
-gem 'devise'
+gem 'devise', '~> 4.7'
 gem 'net-smtp', require: false
 gem 'rails'
+gem 'sassc-rails', '~> 2.1'
+gem 'vite_rails', require: false
 gem 'webpacker', require: false
-gem 'webrick', '~> 1.7'
-
-group :active_record do
-  gem 'paper_trail'
-
-  platforms :ruby, :mswin, :mingw, :x64_mingw do
-    gem 'mysql2', '>= 0.3.14'
-    gem 'sqlite3', '>= 1.3'
-  end
-end
+gem 'webrick'
 
 group :development, :test do
   gem 'pry', '>= 0.9'
@@ -31,15 +24,17 @@ group :test do
   gem 'dragonfly', '~> 1.0'
   gem 'factory_bot', '>= 4.2'
   gem 'generator_spec', '>= 0.8'
+  gem 'kt-paperclip'
   gem 'launchy', '>= 2.2'
   gem 'mini_magick', '>= 3.4'
   gem 'pundit'
   gem 'rack-cache', require: 'rack/cache'
   gem 'rspec-expectations', '!= 3.8.3'
-  gem 'rspec-rails', '>= 2.14'
+  gem 'rspec-rails', '>= 4.0.0.beta2'
   gem 'rspec-retry'
   gem 'rubocop', ['~> 1.20', '!= 1.22.2'], require: false
   gem 'rubocop-performance', require: false
+  gem 'shrine', '~> 3.0'
   gem 'simplecov', '>= 0.9', require: false
   gem 'simplecov-lcov', require: false
   gem 'timecop', '>= 0.5'
@@ -48,4 +43,22 @@ group :test do
   gem 'tzinfo-data', platforms: %i[mingw mswin x64_mingw jruby]
 end
 
+group :active_record do
+  gem 'paper_trail', '>= 12.0'
+
+  platforms :ruby, :mswin, :mingw, :x64_mingw do
+    gem 'mysql2', '>= 0.3.14'
+    gem 'pg', '>= 1.0.0'
+    gem 'sqlite3', '>= 1.3'
+  end
+end
+
+group :mongoid do
+  gem 'cancancan-mongoid'
+  gem 'carrierwave-mongoid', '>= 0.6.3', require: 'carrierwave/mongoid'
+  gem 'kaminari-mongoid'
+  gem 'mongoid-paperclip', '>= 0.0.8', require: 'mongoid_paperclip'
+  gem 'shrine-mongoid', '~> 1.0'
+end
+
 gemspec

README.md

@@ -19,8 +19,8 @@ RailsAdmin is a Rails engine that provides an easy-to-use interface for managing
 - Check out [the docs][docs].
 - Try the [live demo][demo]. ([Source code][dummy_app])
 
-[demo]: http://rails-admin-tb.herokuapp.com/
-[dummy_app]: https://github.com/bbenezech/dummy_app
+[demo]: https://rails-admin.fly.dev/admin/
+[dummy_app]: https://github.com/railsadminteam/rails_admin/tree/master/spec/dummy_app
 [docs]: https://github.com/railsadminteam/rails_admin/wiki
 
 ## Features

app/assets/javascripts/rails_admin/application.js.erb

@@ -9,6 +9,7 @@
 //=  require 'rails_admin/popper'
 //=  require 'rails_admin/bootstrap'
 
+//=  require 'rails_admin/abstract-select'
 //=  require 'rails_admin/filter-box'
 //=  require 'rails_admin/filtering-multiselect'
 //=  require 'rails_admin/filtering-select'

app/controllers/rails_admin/main_controller.rb

@@ -56,7 +56,11 @@ def respond_to_missing?(sym, include_private)
     end
 
     def back_or_index
-      params[:return_to].presence && params[:return_to].include?(request.host) && (params[:return_to] != request.fullpath) ? params[:return_to] : index_path
+      allowed_return_to?(params[:return_to].to_s) ? params[:return_to] : index_path
+    end
+
+    def allowed_return_to?(url)
+      url != request.fullpath && url.start_with?(request.base_url, '/') && !url.start_with?('//')
     end
 
     def get_sort_hash(model_config)

app/views/layouts/rails_admin/_head.html.erb

@@ -12,6 +12,8 @@
     <%= stylesheet_link_tag "rails_admin/application.css", media: :all, data: {'turbo-track': 'reload'} %>
     <%= javascript_include_tag "rails_admin/application.js", defer: true, data: {'turbo-track': 'reload'} %>
   <% end %>
+<% when :vite %>
+  <%= vite_javascript_tag "rails_admin", defer: true, data: {'turbo-track': 'reload'} %>
 <% when :webpack %>
   <%= stylesheet_link_tag "rails_admin.css", media: :all, data: {'turbo-track': 'reload'} %>
   <%= javascript_include_tag "rails_admin.js", defer: true, data: {'turbo-track': 'reload'} %>
@@ -26,4 +28,4 @@
   <%= javascript_import_module_tag 'rails_admin' %>
 <% else
      raise "Unknown asset_source: #{RailsAdmin::config.asset_source}"
-   end %>
+   end %>

app/views/rails_admin/main/_form_boolean.html.erb

@@ -2,9 +2,9 @@
   <div class="btn-group" role="group">
     <% {'1': [true, 'btn-outline-success'], '0': [false, 'btn-outline-danger'], '': [nil, 'btn-outline-secondary']}.each do |text, (value, btn_class)| %>
       <%= form.radio_button field.method_name, text, field.html_attributes.reverse_merge({ checked: field.form_value == value, required: field.required, class: 'btn-check' }) %>
-      <label for="<%= form.object_name %>_<%= field.method_name %>_<%= text %>" class="<%= field.css_classes[value] %> btn <%= btn_class %>">
+      <%= form.label "#{field.method_name}_#{text}", class: "#{field.css_classes[value]} btn #{btn_class}" do %>
         <%= field.labels[value].html_safe %>
-      </label>
+      <% end %>
     <% end %>
   </div>
 <% else %>

app/views/rails_admin/main/_form_filtering_multiselect.html.erb

@@ -20,6 +20,7 @@
     xhr: xhr,
     :'edit-url' => (field.inline_edit && authorized?(:edit, config.abstract_model) ? edit_path(model_name: config.abstract_model.to_param, id: '__ID__') : ''),
     remote_source: index_path(config.abstract_model, source_object_id: form.object.id, source_abstract_model: source_abstract_model.to_param, associated_collection: field.name, current_action: current_action, compact: true),
+    scopeBy: field.dynamic_scope_relationships,
     sortable: !!field.orderable,
     removable: !!field.removable,
     cacheAll: !!field.associated_collection_cache_all,

app/views/rails_admin/main/_form_filtering_select.html.erb

@@ -12,7 +12,8 @@
 
   js_data = {
     xhr: xhr,
-    remote_source: index_path(config.abstract_model.to_param, source_object_id: form.object.id, source_abstract_model: source_abstract_model.to_param, associated_collection: field.name, current_action: current_action, compact: true)
+    remote_source: index_path(config.abstract_model.to_param, source_object_id: form.object.id, source_abstract_model: source_abstract_model.to_param, associated_collection: field.name, current_action: current_action, compact: true),
+    scopeBy: field.dynamic_scope_relationships
   }
 %>