fix(views): guard against nil values and fix flash CSS classes

Fix params_to_s pushing [string] instead of string and add URL encoding
via CGI.escape. Fix Flash component using "notices" CSS class for all
message types instead of "warnings"/"errors". Add nil guard on
Head#style_links and Store#prepare_sections navbar. Add rescue in
Support.to_date for values that do not respond to to_date.

Author: blocknotes

lib/tiny_admin/store.rb

@@ -22,29 +22,26 @@ def prepare_sections(sections, logout:)
         end
 
         slug = section[:slug].to_s
-        case section[:type]&.to_sym
-        when :content
-          list << add_content_section(slug, section)
-        when :page
-          list << add_page_section(slug, section)
-        when :resource
-          list << add_resource_section(slug, section)
-        when :url
-          list << add_url_section(slug, section)
+        item = case section[:type]&.to_sym
+        when :content then add_content_section(slug, section)
+        when :page then add_page_section(slug, section)
+        when :resource then add_resource_section(slug, section)
+        when :url then add_url_section(slug, section)
         end
+        list << item if item
       end
       navbar << logout if logout
     end
 
     private
 
     def add_content_section(slug, section)
-      pages[slug] = { class: settings.content_page, content: section[:content], widgets: section[:widgets] }
+      pages[slug] = {class: settings.content_page, content: section[:content], widgets: section[:widgets]}
       TinyAdmin::Section.new(name: section[:name], slug: slug)
     end
 
     def add_page_section(slug, section)
-      pages[slug] = { class: to_class(section[:page]) }
+      pages[slug] = {class: to_class(section[:page])}
       TinyAdmin::Section.new(name: section[:name], slug: slug)
     end
 
@@ -56,7 +53,7 @@ def add_resource_section(slug, section)
         repository: to_class(section[:repository] || settings.repository)
       )
 
-      hidden = section[:options] && (section[:options].include?(:hidden) || section[:options].include?('hidden'))
+      hidden = section[:options] && (section[:options].include?(:hidden) || section[:options].include?("hidden"))
       TinyAdmin::Section.new(name: section[:name], slug: slug) unless hidden
     end
 

lib/tiny_admin/support.rb

@@ -24,11 +24,13 @@ def round(value, options: [])
       end
 
       def strftime(value, options: [])
-        value&.strftime(options&.first || '%Y-%m-%d %H:%M')
+        value&.strftime(options&.first || "%Y-%m-%d %H:%M")
       end
 
       def to_date(value, options: [])
-        value.to_date.to_s if value
+        value&.to_date&.to_s
+      rescue NoMethodError, ArgumentError
+        value&.to_s
       end
 
       def upcase(value, options: [])

lib/tiny_admin/utils.rb

@@ -1,17 +1,19 @@
 # frozen_string_literal: true
 
+require "cgi"
+
 module TinyAdmin
   module Utils
     def params_to_s(params)
       list = params.each_with_object([]) do |(param, value), result|
         if value.is_a?(Hash)
-          values = value.map { |key, val| "#{param}[#{key}]=#{val}" }
+          values = value.map { |key, val| "#{CGI.escape(param.to_s)}[#{CGI.escape(key.to_s)}]=#{CGI.escape(val.to_s)}" }
           result.concat(values)
         else
-          result.push(["#{param}=#{value}"])
+          result.push("#{CGI.escape(param.to_s)}=#{CGI.escape(value.to_s)}")
         end
       end
-      list.join('&')
+      list.join("&")
     end
 
     def prepare_page(page_class, slug: nil, attributes: nil, options: nil, params: nil)
@@ -28,7 +30,7 @@ def prepare_page(page_class, slug: nil, attributes: nil, options: nil, params: n
         )
         attrs = attributes || {}
         attrs[:params] = params if params
-        attrs[:widgets] = attrs[:widgets].map { to_class(_1) } if attrs[:widgets]
+        attrs[:widgets] = attrs[:widgets].map { to_class(it) } if attrs[:widgets]
         page.update_attributes(attrs) unless attrs.empty?
         yield(page) if block_given?
         page.setup if page.respond_to?(:setup)
@@ -40,9 +42,9 @@ def to_class(klass)
     end
 
     def humanize(string)
-      return '' unless string
+      return "" unless string
 
-      string.respond_to?(:humanize) ? string.humanize : string.tr('_', ' ').capitalize
+      string.respond_to?(:humanize) ? string.humanize : string.tr("_", " ").capitalize
     end
   end
 end

lib/tiny_admin/views/components/flash.rb

@@ -12,10 +12,10 @@ def view_template
           warnings = messages[:warnings]
           errors = messages[:errors]
 
-          div(class: 'flash') {
-            div(class: 'notices alert alert-success', role: 'alert') { notices.join(', ') } if notices&.any?
-            div(class: 'notices alert alert-warning', role: 'alert') { warnings.join(', ') } if warnings&.any?
-            div(class: 'notices alert alert-danger', role: 'alert') { errors.join(', ') } if errors&.any?
+          div(class: "flash") {
+            div(class: "notices alert alert-success", role: "alert") { notices.join(", ") } if notices&.any?
+            div(class: "warnings alert alert-warning", role: "alert") { warnings.join(", ") } if warnings&.any?
+            div(class: "errors alert alert-danger", role: "alert") { errors.join(", ") } if errors&.any?
           }
         end
       end

lib/tiny_admin/views/components/head.rb

@@ -8,12 +8,12 @@ class Head < BasicComponent
 
         def view_template
           head {
-            meta charset: 'utf-8'
-            meta name: 'viewport', content: 'width=device-width, initial-scale=1'
+            meta charset: "utf-8"
+            meta name: "viewport", content: "width=device-width, initial-scale=1"
             title {
               page_title
             }
-            style_links.each do |style_link|
+            (style_links || []).each do |style_link|
               link(**style_link)
             end
             style { extra_styles } if extra_styles

spec/lib/tiny_admin/support_spec.rb

@@ -88,6 +88,11 @@
     it "returns nil when value is nil" do
       expect(described_class.to_date(nil)).to be_nil
     end
+
+    it "falls back to to_s when to_date raises an error" do
+      value = "not-a-date"
+      expect(described_class.to_date(value)).to eq("not-a-date")
+    end
   end
 
   describe ".label_for" do