5 files changed, 70 insertions, 29 deletions

diff --git a/config/initializers/content_security_policy.rb b/config/initializers/content_security_policy.rb
index d51d713..1569942 100644
--- a/config/initializers/content_security_policy.rb
+++ b/config/initializers/content_security_policy.rb
@@ -4,26 +4,29 @@
 # See the Securing Rails Applications Guide for more information:
 # https://guides.rubyonrails.org/security.html#content-security-policy-header
 
-# Rails.application.configure do
-#   config.content_security_policy do |policy|
-#     policy.default_src :self, :https
-#     policy.font_src    :self, :https, :data
-#     policy.img_src     :self, :https, :data
-#     policy.object_src  :none
-#     policy.script_src  :self, :https
-#     policy.style_src   :self, :https
-#     # Specify URI for violation reports
-#     # policy.report_uri "/csp-violation-report-endpoint"
-#   end
-#
-#   # Generate session nonces for permitted importmap, inline scripts, and inline styles.
-#   config.content_security_policy_nonce_generator = ->(request) { request.session.id.to_s }
-#   config.content_security_policy_nonce_directives = %w(script-src style-src)
-#
-#   # Automatically add `nonce` to `javascript_tag`, `javascript_include_tag`, and `stylesheet_link_tag`
-#   # if the corresponding directives are specified in `content_security_policy_nonce_directives`.
-#   # config.content_security_policy_nonce_auto = true
-#
-#   # Report violations without enforcing the policy.
-#   # config.content_security_policy_report_only = true
-# end
+Rails.application.configure do
+  config.content_security_policy do |policy|
+    policy.default_src    :self
+    policy.script_src     :self
+    policy.style_src      :self, :unsafe_inline
+    policy.img_src        :self, :data
+    policy.font_src       :self
+    policy.object_src     :none
+    policy.frame_ancestors :none
+    policy.base_uri       :self
+    policy.form_action    :self
+    policy.report_uri     "/csp_reports"
+  end
+
+  # Per-request nonce; script-src only. style-src keeps unsafe_inline
+  # deliberately: TinyMCE emits img[style] in body content and the
+  # public layout carries style attributes -- CSS injection is a
+  # low-yield channel, script-src is where the protection lives.
+  config.content_security_policy_nonce_generator  = ->(request) { SecureRandom.base64(16) }
+  config.content_security_policy_nonce_directives = %w[script-src]
+
+  # Report-only: nothing blocks. Enforcement is a later, deliberate
+  # flip once the reports have mapped reality (admin inline scripts,
+  # legacy hotlinked images in old bodies, embeds).
+  config.content_security_policy_report_only = true
+end
diff --git a/config/initializers/error_log.rb b/config/initializers/error_log.rb
new file mode 100644
index 0000000..74117cb
--- /dev/null
+++ b/config/initializers/error_log.rb
@@ -0,0 +1,20 @@
+# Every controller-level exception (the 500s) in one lean file,
+# independent of the base log level -- log/production.log can stay
+# quiet without losing error visibility.
+if Rails.env.production?
+  error_logger = ActiveSupport::Logger.new(Rails.root.join("log", "errors.log"))
+
+  ActiveSupport::Notifications.subscribe("process_action.action_controller") do |*, payload|
+    if (exception = payload[:exception_object])
+      status = ActionDispatch::ExceptionWrapper.status_code_for_exception(exception.class.name)
+      next if status < 500
+
+      error_logger.error(
+        "#{Time.now.iso8601} [#{status}] #{payload[:controller]}##{payload[:action]} #{payload[:path]} " \
+        "-- #{exception.class}: #{exception.message}\n    " +
+        Array(exception.backtrace).first(5).join("\n    ")
+      )
+    end
+  end
+end
+
diff --git a/config/locales/de.yml b/config/locales/de.yml
index 9de6aac..f64f6cd 100644
--- a/config/locales/de.yml
+++ b/config/locales/de.yml
@@ -89,14 +89,14 @@ de:
     backfilled: "rekonstruiert"
     show_changes: "Änderungen an Übersetzungen"
     view_revision: "Diese Revision ansehen"
-    unknown: "%{actor} hat %{action} auf %{subject} aus"
+    unknown: "%{actor} hat %{action} auf %{subject} ausgeführt"
     publish: "%{actor} hat %{revision} von %{subject} veröffentlicht"
     publish_rollback: "%{actor} hat %{subject} auf %{revision} zurückgesetzt"
     publish_first: "%{actor} hat %{subject} zum ersten Mal veröffentlicht"
     publish_first_with_author: "%{actor} hat %{subject} zum ersten Mal veröffentlicht (Autor: %{author})"
     create: "%{actor} hat %{subject} unter %{path} angelegt"
     move: "%{actor} hat %{subject} von %{from} nach %{to} verschoben"
-    discard_autosave: "%{actor} hat ungespeicherte Änderungen an %{subject} verschoben"
+    discard_autosave: "%{actor} hat ungespeicherte Änderungen an %{subject} verworfen"
     destroy_draft: "%{actor} hat den Entwurf von %{subject} verworfen"
     locale_added: "Übersetzung angelegt, Titel \"%{title}\""
     locale_removed: "Übersetzung entfernt, letzter Titel \"%{title}\""
@@ -110,3 +110,9 @@ de:
     detail_tags: "Tags %{from} → %{to}"
     template_changed: "Template geändert"
     assets_changed: "Bildliste geändert"
+    trash: "%{actor} hat %{subject} in den Papierkorb verschoben (vorher unter %{from})"
+    restore_from_trash: "%{actor} hat %{subject} aus dem Papierkorb nach %{to} wiederhergestellt"
+    destroy: "%{actor} hat %{subject} endgültig gelöscht (zuletzt unter %{path})"
+    revision_created: "angelegt am %{date} von %{actor}"
+    revision_published: "veröffentlicht am %{date} von %{actor}"
+    revision_restored: "wiederhergestellt am %{date} von %{actor}"
diff --git a/config/locales/en.yml b/config/locales/en.yml
index f1856c1..8a8acc1 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -62,3 +62,9 @@ en:
     detail_tags: "tags %{from} → %{to}"
     template_changed: "template changed"
     assets_changed: "attached images changed"
+    trash: "%{actor} moved %{subject} to the Trash (was at %{from})"
+    restore_from_trash: "%{actor} restored %{subject} from the Trash to %{to}"
+    destroy: "%{actor} permanently deleted %{subject} (last at %{path})"
+    revision_created: "created %{date} by %{actor}"
+    revision_published: "published %{date} by %{actor}"
+    revision_restored: "restored %{date} by %{actor}"
diff --git a/config/routes.rb b/config/routes.rb
index c2b9590..6ddf48c 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -9,6 +9,8 @@ Cccms::Application.routes.draw do
       defaults: { page_path: ['home'] },
       constraints: { locale: /de|en/ }
 
+  post 'csp_reports' => 'csp_reports#create'
+
   # All application routes are scoped under an optional two-letter locale
   # prefix: /de/... and /en/... Both forms are valid; the prefix is omitted
   # for the default locale (:de) in generated URLs via default_url_options
@@ -44,6 +46,7 @@ Cccms::Application.routes.draw do
           get :mine
           get :chapters
           get :sitemap
+          get :trashed
         end
 
         member do
@@ -53,6 +56,8 @@ Cccms::Application.routes.draw do
           put :revoke_shared_preview
           put :autosave
           put :revert
+          put :trash
+          put :restore_from_trash
         end
 
         resources :translations, controller: 'page_translations',
@@ -87,6 +92,7 @@ Cccms::Application.routes.draw do
       match 'conventions'      => 'admin#conventions',      :as => :admin_conventions,      :via => :get
       match 'dashboard_search' => 'admin#dashboard_search', :as => :admin_dashboard_search, :via => :get
       match 'log'              => 'node_actions#index',     :as => :admin_log,              :via => :get
+      match 'boom'             => 'admin#boom',             :as => :admin_boom,             :via => :get
     end
 
     match '/logout'      => 'sessions#destroy', :as => :logout,       :via => :delete
@@ -103,11 +109,11 @@ Cccms::Application.routes.draw do
 
     resource :session
 
-    get  'rss/updates',         :to => 'rss#updates', :as => :rss
-    get  'rss/updates.:format', :to => 'rss#updates', :as => :rss_feed,
+    get  'rss/updates',         :to => 'rss#updates', :as => :rss,      :defaults => { :format => :xml }
+    get  'rss/updates.:format', :to => 'rss#updates', :as => :rss_feed, :defaults => { :format => :xml },
            :constraints => { :format => /xml|rdf/ }
-    get  'rss/tags/:tag/updates',         :to => 'rss#tag_updates', :as => :rss_tag
-    get  'rss/tags/:tag/updates.:format', :to => 'rss#tag_updates', :as => :rss_tag_feed,
+    get  'rss/tags/:tag/updates',         :to => 'rss#tag_updates', :as => :rss_tag, :defaults => { :format => :xml }
+    get  'rss/tags/:tag/updates.:format', :to => 'rss#tag_updates', :as => :rss_tag_feed, :defaults => { :format => :xml },
            :constraints => { :format => /xml/ }
 
     match 'galleries/*page_path' => 'content#render_gallery', :via => :get