Escape user input before building regexps

revert Optimize to avoid 502 errors caused by multiple queries

app/assets/javascripts/seminar-field-forms-submission.js

@@ -110,6 +110,7 @@ function setData(l, type, ol) {
 			_markup:				fields+"["+l+"][markup]",
 			_option_list:			["option_list_"+l+"_"+ol, fields+"["+l+"]["+type+"][option_list]["+ol+"]", "option_list_"+ol],
 			_placeholder:			["placeholder_"			+l, fields+"["+l+"]["+type+"][placeholder]"],
+			_instructions:			["instructions_"			+l, fields+"["+l+"]["+type+"][instructions]"],
 			_title_translations:	["title_translations_"	+l, fields+"["+l+"][title_translations]"],
 			_destroy:				["destroy_"			+l, fields+"["+l+"][_destroy]"],
 			_to_require:			["to_require_"		    +l, fields+"["+l+"][to_require]"],
@@ -117,6 +118,34 @@ function setData(l, type, ol) {
 	return data;
 }
 
+// Deinit Template HTML (ex: ckeditor)
+function deinit_template_html(_this) {
+	var ckeditor_areas = _this.find('.ckeditor');
+	if (typeof(CKEDITOR) == 'object') {
+		ckeditor_areas.each(function(i,v) {
+			var name = $(v).attr('name');
+			if (CKEDITOR.instances[name]) {
+				CKEDITOR.instances[name].destroy();
+			}
+		})
+	}
+	return _this;
+}
+
+// Init Template HTML (ex: ckeditor)
+function init_template_html(_this) {
+	var ckeditor_areas = _this.find('.ckeditor');
+	if (typeof(CKEDITOR) == 'object') {
+		ckeditor_areas.each(function(i,v) {
+			var name = $(v).attr('name');
+			if (!CKEDITOR.instances[name]) {
+				CKEDITOR.replace(name);
+			}
+		})
+	}
+	return _this;
+}
+
 // Get Default Address Form
 function getAddressForm(trigger, element, decide) {
 	if(decide) {
@@ -256,11 +285,11 @@ $(function() {
 				nameNumber = nameNumber.match(/[^[\D\]]+(?=])/g)[0];
 				seminar_mainType = $(this).data('seminar_mains')
 				if($(this).hasClass('textInput')) {
-					$("#template-text").tmpl().appendTo($(this).closest('.controls').find('.add-target'));
+					init_template_html($("#template-text").tmpl().appendTo($(this).closest('.controls').find('.add-target')));
 				} else if ($(this).hasClass('textLengInput')) {
-					$("#template-text-language").tmpl().appendTo($(this).closest('.controls').find('.add-target'));
+					init_template_html($("#template-text-language").tmpl().appendTo($(this).closest('.controls').find('.add-target')));
 				} else if ($(this).hasClass('address')) {
-					$("#template-address").tmpl().appendTo($(this).closest('.controls').find('.add-target'));
+					init_template_html($("#template-address").tmpl().appendTo($(this).closest('.controls').find('.add-target')));
 				} 
 				inputAppendLength();
 			};
@@ -288,7 +317,7 @@ $(function() {
 			};
 		    attributesHeaderLength = $('.attributes:not(:hidden)').length+1;
 		    attributesLength = $('#attributes-area .attributes').length;
-		    $("#template-attributes").tmpl(setData(attributesLength, default_templateType, appendIndex)).appendTo( "#attributes-area" );
+		    init_template_html($("#template-attributes").tmpl(setData(attributesLength, default_templateType, appendIndex)).appendTo( "#attributes-area" ));
 		    $('.toggle-check').togglebox();
 		});
 
@@ -439,7 +468,7 @@ $(function() {
 				console.log(appendIndex)
 				attributeIndex = $(this).closest('.attributes').index();
 				templateType = $(this).closest('.attributes').find('.dataType').children("option:selected").attr('ref');
-				$("#template-input-append").tmpl(setData(attributeIndex, templateType, appendIndex)).appendTo($(this).closest('.controls').find('.add-target'));
+				init_template_html($("#template-input-append").tmpl(setData(attributeIndex, templateType, appendIndex)).appendTo($(this).closest('.controls').find('.add-target')));
 				inputAppendLength();
 			};
 			if($(this).hasClass('remove-input')) {
@@ -454,6 +483,7 @@ $(function() {
 		$('#attributes-area').delegate('.dataType', 'change', function() {
 	        $(this).children("option:selected").each(function () {
 	        	var target = $(this).closest('.attributes').find('.field-type').not('.default');
+	        	deinit_template_html(target);
 	    		attributeIndex = $(this).closest('.attributes').index();
 	        	appendIndex = 0
 	        	// $(this).closest('.attributes').find('.add-target').find('.input-append').length;
@@ -467,7 +497,7 @@ $(function() {
 			        	if($(this).attr('ref')) {
 			        		templateType = $(this).attr('ref');
 				        	target.removeAttr('class').addClass('field-type fade in ' + templateType).empty();
-				        	$("#template-type").tmpl(setData(attributeIndex, templateType, appendIndex)).appendTo(target);
+				        	init_template_html($("#template-type").tmpl(setData(attributeIndex, templateType, appendIndex)).appendTo(target));
 				        	if(templateType == 'typeB' || templateType == 'typeE' || templateType == 'typeF') {
 				        		inputAppendLength();
 				        	}
@@ -481,7 +511,7 @@ $(function() {
 		        	if($(this).attr('ref')) {
 		        		templateType = $(this).attr('ref');
 			        	target.removeAttr('class').addClass('field-type fade in ' + templateType).empty();
-			        	$("#template-type").tmpl(setData(attributeIndex, templateType, appendIndex)).appendTo(target);
+			        	init_template_html($("#template-type").tmpl(setData(attributeIndex, templateType, appendIndex)).appendTo(target));
 			        	if(templateType == 'typeB' || templateType == 'typeE' || templateType == 'typeF') {
 			        		inputAppendLength();
 			        	}

app/assets/javascripts/seminar-field-forms.js

@@ -110,6 +110,7 @@ function setData(l, type, ol) {
 			_markup:				fields+"["+l+"][markup]",
 			_option_list:			["option_list_"+l+"_"+ol, fields+"["+l+"]["+type+"][option_list]["+ol+"]", "option_list_"+ol],
 			_placeholder:			["placeholder_"			+l, fields+"["+l+"]["+type+"][placeholder]"],
+			_instructions:			["instructions_"			+l, fields+"["+l+"]["+type+"][instructions]"],
 			_title_translations:	["title_translations_"	+l, fields+"["+l+"][title_translations]"],
 			_destroy:				["destroy_"			+l, fields+"["+l+"][_destroy]"],
 			_to_require:			["to_require_"		    +l, fields+"["+l+"][to_require]"],
@@ -117,6 +118,34 @@ function setData(l, type, ol) {
 	return data;
 }
 
+// Deinit Template HTML (ex: ckeditor)
+function deinit_template_html(_this) {
+	var ckeditor_areas = _this.find('.ckeditor');
+	if (typeof(CKEDITOR) == 'object') {
+		ckeditor_areas.each(function(i,v) {
+			var name = $(v).attr('name');
+			if (CKEDITOR.instances[name]) {
+				CKEDITOR.instances[name].destroy();
+			}
+		})
+	}
+	return _this;
+}
+
+// Init Template HTML (ex: ckeditor)
+function init_template_html(_this) {
+	var ckeditor_areas = _this.find('.ckeditor');
+	if (typeof(CKEDITOR) == 'object') {
+		ckeditor_areas.each(function(i,v) {
+			var name = $(v).attr('name');
+			if (!CKEDITOR.instances[name]) {
+				CKEDITOR.replace(name);
+			}
+		})
+	}
+	return _this;
+}
+
 // Get Default Address Form
 function getAddressForm(trigger, element, decide) {
 	if(decide) {
@@ -256,11 +285,11 @@ $(function() {
 				nameNumber = nameNumber.match(/[^[\D\]]+(?=])/g)[0];
 				seminar_mainType = $(this).data('seminar_mains')
 				if($(this).hasClass('textInput')) {
-					$("#template-text").tmpl().appendTo($(this).closest('.controls').find('.add-target'));
+					init_template_html($("#template-text").tmpl().appendTo($(this).closest('.controls').find('.add-target')));
 				} else if ($(this).hasClass('textLengInput')) {
-					$("#template-text-language").tmpl().appendTo($(this).closest('.controls').find('.add-target'));
+					init_template_html($("#template-text-language").tmpl().appendTo($(this).closest('.controls').find('.add-target')));
 				} else if ($(this).hasClass('address')) {
-					$("#template-address").tmpl().appendTo($(this).closest('.controls').find('.add-target'));
+					init_template_html($("#template-address").tmpl().appendTo($(this).closest('.controls').find('.add-target')));
 				} 
 				inputAppendLength();
 			};
@@ -288,7 +317,7 @@ $(function() {
 			};
 		    attributesHeaderLength = $('.attributes:not(:hidden)').length+1;
 		    attributesLength = $('#attributes-area .attributes').length;
-		    $("#template-attributes").tmpl(setData(attributesLength, default_templateType, appendIndex)).appendTo( "#attributes-area" );
+		    init_template_html($("#template-attributes").tmpl(setData(attributesLength, default_templateType, appendIndex)).appendTo( "#attributes-area" ));
 		    $('.toggle-check').togglebox();
 		});
 
@@ -438,7 +467,7 @@ $(function() {
 				appendIndex = parseInt(appendIndex.match(/[^[\D\]]+(?=])/g)[1])+1;
 				attributeIndex = $(this).closest('.attributes').index();
 				templateType = $(this).closest('.attributes').find('.dataType').children("option:selected").attr('ref');
-				$("#template-input-append").tmpl(setData(attributeIndex, templateType, appendIndex)).appendTo($(this).closest('.controls').find('.add-target'));
+				init_template_html($("#template-input-append").tmpl(setData(attributeIndex, templateType, appendIndex)).appendTo($(this).closest('.controls').find('.add-target')));
 				inputAppendLength();
 			};
 			if($(this).hasClass('remove-input')) {
@@ -453,6 +482,7 @@ $(function() {
 		$('#attributes-area').delegate('.dataType', 'change', function() {
 	        $(this).children("option:selected").each(function () {
 	        	var target = $(this).closest('.attributes').find('.field-type').not('.default');
+	        	deinit_template_html(target);
 	    		attributeIndex = $(this).closest('.attributes').index();
 	        	appendIndex = 0
 	        	// $(this).closest('.attributes').find('.add-target').find('.input-append').length;
@@ -466,7 +496,7 @@ $(function() {
 			        	if($(this).attr('ref')) {
 			        		templateType = $(this).attr('ref');
 				        	target.removeAttr('class').addClass('field-type fade in ' + templateType).empty();
-				        	$("#template-type").tmpl(setData(attributeIndex, templateType, appendIndex)).appendTo(target);
+				        	init_template_html($("#template-type").tmpl(setData(attributeIndex, templateType, appendIndex)).appendTo(target));
 				        	if(templateType == 'typeB' || templateType == 'typeE' || templateType == 'typeF') {
 				        		inputAppendLength();
 				        	}
@@ -480,7 +510,7 @@ $(function() {
 		        	if($(this).attr('ref')) {
 		        		templateType = $(this).attr('ref');
 			        	target.removeAttr('class').addClass('field-type fade in ' + templateType).empty();
-			        	$("#template-type").tmpl(setData(attributeIndex, templateType, appendIndex)).appendTo(target);
+			        	init_template_html($("#template-type").tmpl(setData(attributeIndex, templateType, appendIndex)).appendTo(target));
 			        	if(templateType == 'typeB' || templateType == 'typeE' || templateType == 'typeF') {
 			        		inputAppendLength();
 			        	}

app/controllers/admin/seminar_signups_controller.rb

@@ -3,18 +3,26 @@ class Admin::SeminarSignupsController < OrbitAdminController
   include Admin::SeminarsHelper
   before_action ->(module_app = @app_title) { set_variables module_app }
   before_action :check_manager_for_seminar
+  skip_before_action :check_for_nil_categories
   def initialize
     super
     @app_title = "seminar"
   end
   def check_manager_for_seminar
     OrbitHelper.set_params(params,current_user)
+    OrbitHelper.set_this_module_app("seminar")
     access_level = OrbitHelper.user_access_level?
-    if (access_level.nil? || access_level == "user")
+    if access_level.nil? || access_level == "user"
       @seminar = SeminarSignup.find(params[:id]).seminar_main rescue nil
       if (@seminar.organizer_id != current_user.member_profile_id rescue true)
         render_401
       end
+    elsif access_level == "sub_manager"
+      @seminar = SeminarSignup.find(params[:id]).seminar_main rescue nil
+      approved_category_ids = current_user.approved_categories.collect{|c| c.id}
+      unless approved_category_ids.include?(@seminar.category_id) || (@seminar.organizer_id == current_user.member_profile_id rescue false)
+        render_401
+      end
     end
   end
   def edit

app/controllers/admin/seminars_controller.rb

@@ -5,10 +5,10 @@ class Admin::SeminarsController < OrbitAdminController
   include Admin::SeminarsHelper
   helper Admin::SeminarsFieldHelper
   before_action ->(module_app = @app_title) { set_variables module_app }
-  before_action :set_seminar, only: [:edit, :set_write_off, :seminar_signup, :destroy,:seminar_signup_admin_setting,:update_seminar_signup_admin_setting,:get_reviewer_block,:get_session_block,:update_seminar_review,:update_seminar_session,:reviewer_setting,:update_reviewer_setting,:template_setting,:update_template_setting,:sub_page_setting]
+  before_action :set_seminar, only: [:edit, :set_write_off, :seminar_signup, :destroy,:seminar_signup_admin_setting,:update_seminar_signup_admin_setting,:get_reviewer_block,:get_session_block,:update_seminar_review,:update_seminar_session,:reviewer_setting,:update_reviewer_setting,:template_setting,:update_template_setting,:sub_page_setting,:export]
   before_action :set_seminar_signup_admin_setting, only: [:seminar_signup,:seminar_signup_admin_setting,:update_seminar_signup_admin_setting,:get_reviewer_block,:get_session_block]
-  before_action :check_permission_for_seminar, only: [:seminar_signup,:get_reviewer_block,:get_session_block]
-  before_action :check_manager_for_seminar, only: [:seminar_signup_admin_setting,:update_seminar_signup_admin_setting,:update_seminar_review,:update_seminar_session,:reviewer_setting,:update_reviewer_setting,:template_setting,:update_template_setting]
+  before_action :check_permission_for_seminar, only: [:seminar_signup,:get_reviewer_block,:get_session_block,:export]
+  before_action :check_manager_for_seminar, only: [:seminar_signup_admin_setting,:update_seminar_signup_admin_setting,:update_seminar_review,:update_seminar_session,:reviewer_setting,:update_reviewer_setting,:template_setting,:update_template_setting,:sub_page_setting]
   def initialize
     super
     @app_title = "seminar"
@@ -39,6 +39,10 @@ class Admin::SeminarsController < OrbitAdminController
       else
         @user_authenticated_categories = ['all']
       end
+    elsif access_level == "sub_manager"
+      unless can_see_seminar_signup(@seminar)
+        render_401
+      end
     end
   end
   def template_setting
@@ -171,7 +175,7 @@ class Admin::SeminarsController < OrbitAdminController
       @seminar_signup_admin_setting = SeminarSignupAdminSetting.create(:seminar_main_id=>"enquiry_for_applicants")
     end
     if params[:name].present?
-      @seminar_signups = SeminarSignup.where(:name => /#{params[:name]}/).sort_ordered.page(params[:page]).per(10)
+      @seminar_signups = SeminarSignup.where(:name => /#{Regexp.escape(params[:name].to_s)}/).sort_ordered.page(params[:page]).per(10)
     else
       @seminar_signups = []
     end
@@ -407,7 +411,7 @@ class Admin::SeminarsController < OrbitAdminController
         }
       end
     else
-      render :nothing => true
+      render_401     
     end
   end
   def copy
@@ -602,7 +606,7 @@ class Admin::SeminarsController < OrbitAdminController
       if params[:search].to_i != 0
         @seminar_signups = @seminar.seminar_signups.where(:serial_number=>params[:search].to_i)
       else
-        @seminar_signups = @seminar.seminar_signups.where(:name=>/#{params[:search]}/)
+        @seminar_signups = @seminar.seminar_signups.where(:name=>/#{Regexp.escape(params[:search].to_s)}/)
       end
     elsif params[:type] == "session"
       assigned_seminar_signups = @seminar.seminar_sessions.pluck(:seminar_signup_ids,:default_seminar_signup_ids).flatten
@@ -612,13 +616,15 @@ class Admin::SeminarsController < OrbitAdminController
       if @seminar.assign_mode != 0
         unassigned_seminar_signup_ids = @seminar.unassigned_mode_1_seminar_signup_ids
       end
-      @seminar_signups = @seminar.seminar_signups.where(:id.in => unassigned_seminar_signup_ids, :name=>/#{params[:search]}/)
+      @seminar_signups = @seminar.seminar_signups.where(:id.in => unassigned_seminar_signup_ids, :name=>/#{Regexp.escape(params[:search].to_s)}/)
     end
     OrbitHelper.set_params(params,current_user)
     @access_level = OrbitHelper.user_access_level?
     @can_edit = true
     if @access_level == "user" || @access_level.nil?
       @can_edit = false
+    elsif @access_level == "sub_manager"
+      @can_edit = can_edit_or_delete?(@seminar)
     end
     unless @can_edit
       @can_edit = (@seminar.organizer_id == current_user.member_profile_id rescue false)

app/controllers/seminars_controller.rb

@@ -334,6 +334,7 @@ class SeminarsController < ApplicationController
     seminar_url = (@prefix_url ? @prefix_url : OrbitHelper.url_to_show(seminar.to_param))
     if !registration_is_open
       sign_up = t('seminar.sign_up_not_open')
+      sign_up_not_yet = true
     elsif sign_up_not_yet
       sign_up = t('seminar.sign_up_not_yet')
     elsif sign_up_overdue
@@ -345,7 +346,7 @@ class SeminarsController < ApplicationController
       sign_up = link_to(sign_up_text, seminar.get_frontend_url(seminar_url), :target=>'_blank', :title=>sign_up_text)
     end
 
-    if !seminar.registration_status.blank? && seminar.registration_status.include?('C') && seminar.contribute_start_date <= time_now && ( seminar.contribute_end_date.nil? || seminar.contribute_end_date+1 >= time_now )
+    if !seminar.registration_status.blank? && seminar.registration_status.include?('C') && (seminar.contribute_start_date.nil? || seminar.contribute_start_date <= time_now) && ( seminar.contribute_end_date.nil? || seminar.contribute_end_date+1 >= time_now )
       if @@session[:seminar_signup_id].present? && @@session[:seminar_main_id] == seminar.id
         button_text = t('seminar_signup.uploads')
         contribute_action = link_to(button_text, seminar.get_frontend_url(seminar_url, :con_upload), :title=>button_text)
@@ -360,6 +361,7 @@ class SeminarsController < ApplicationController
       'sign_up' => sign_up,
       'contribute_action' => contribute_action,
       'time_now' => time_now,
+      'sign_up_not_yet' => sign_up_not_yet, 
       'contribute_time_range' => SeminarMain.time_range(seminar.contribute_start_date, seminar.contribute_end_date),
       'sign_up_time_range' => SeminarMain.time_range(seminar.signup_start_date, seminar.signup_end_date),
       'seminar_time_range' => SeminarMain.time_range(seminar.seminar_start_date, seminar.seminar_end_date)
@@ -522,20 +524,24 @@ class SeminarsController < ApplicationController
 
   def add_file_proc
 
-    update_params = seminar_signup_contribute_params.merge('seminar_submission_values'=>params['seminar_submission_values'])
+    update_params = seminar_signup_contribute_params.merge('seminar_submission_values'=>params['seminar_submission_values'].to_h)
     flag = true
     update_params.permit!
-    if !update_params['seminar_submission_values'].nil?
-      if update_params['seminar_submission_values']['0']['value'].class==String
-        value = update_params['seminar_submission_values']['0']['value']
-        if !value.to_s.blank?
-          flag = false
-        end
+    if update_params['seminar_submission_values'].present?
+      if update_params['seminar_submission_values']['0']['value'].nil?
+        flag = false
       else
-        update_params['seminar_submission_values']['0']['value'].each do |key,value|
-        if !value.to_s.blank?
+        if update_params['seminar_submission_values']['0']['value'].class==String
+          value = update_params['seminar_submission_values']['0']['value']
+          if !value.to_s.blank?
             flag = false
           end
+        else
+          update_params['seminar_submission_values']['0']['value'].each do |key,value|
+          if !value.to_s.blank?
+              flag = false
+            end
+          end
         end
       end
     else
@@ -544,6 +550,10 @@ class SeminarsController < ApplicationController
     if flag
       update_params['seminar_submission_values']['0']['value']['en'] = ' '
     end
+    if session[:seminar_signup_id].blank?
+      redirect_to "#{params[:referer_url].to_s.chomp('/')}/?method=con_upload" and return
+    end
+    update_params['seminar_signup_id'] = session[:seminar_signup_id].to_s
     @con = SeminarSignupContribute.new(update_params)
     if @con.save
       signup = SeminarSignup.where(id:update_params['seminar_signup_id']).first
@@ -567,27 +577,36 @@ class SeminarsController < ApplicationController
       @seminar.save
       redirect_to "#{params[:referer_url].to_s.chomp('/')}/?method=con_upload"
     else
-      redirect_to "#{params[:referer_url]}", :notice => t('recaptcha.errors.verification_failed')
+      msg = @con.errors[:file].present? ? t('recaptcha.errors.file_type_not_allowed') : t('recaptcha.errors.verification_failed')
+      redirect_to "#{params[:referer_url].to_s.chomp('/')}/?method=con_upload&notice=#{msg}", :notice => msg
     end
 
   end
 
   def update
     @con = SeminarSignupContribute.find(params[:seminar_signup_contribute][:id])
-    update_params = seminar_signup_contribute_params.merge('seminar_submission_values'=>params['seminar_submission_values'])
+    if session[:seminar_signup_id].blank? || @con.seminar_signup_id.to_s != session[:seminar_signup_id].to_s
+      redirect_to "#{params[:referer_url].to_s.chomp('/')}/?method=con_upload" and return
+    end
+    update_params = seminar_signup_contribute_params.merge('seminar_submission_values'=>params['seminar_submission_values'].to_h)
     update_params.permit!
-    unless update_params['seminar_submission_values'].nil?
-      flag = true
-      if update_params['seminar_submission_values']['0']['value'].class==String
-        value = update_params['seminar_submission_values']['0']['value']
-        if !value.to_s.blank?
-          flag = false
-        end
+    update_params['seminar_signup_id'] = @con.seminar_signup_id.to_s
+    if update_params['seminar_submission_values'].present?
+      if update_params['seminar_submission_values']['0']['value'].nil?
+        flag = false
       else
-        update_params['seminar_submission_values']['0']['value'].each do |key,value|
-        if !value.to_s.blank?
+        flag = true
+        if update_params['seminar_submission_values']['0']['value'].class==String
+          value = update_params['seminar_submission_values']['0']['value']
+          if !value.to_s.blank?
             flag = false
           end
+        else
+          update_params['seminar_submission_values']['0']['value'].each do |key,value|
+          if !value.to_s.blank?
+              flag = false
+            end
+          end
         end
       end
       if flag
@@ -617,7 +636,8 @@ class SeminarsController < ApplicationController
       @seminar.save
       redirect_to "#{params[:referer_url].to_s.chomp('/')}/?method=con_upload"
     else
-      redirect_to "#{params[:referer_url]}", :notice => t('recaptcha.errors.verification_failed')
+      msg = @con.errors[:file].present? ? t('recaptcha.errors.file_type_not_allowed') : t('recaptcha.errors.verification_failed')
+      redirect_to "#{params[:referer_url].to_s.chomp('/')}/?method=con_upload&notice=#{msg}", :notice => msg
     end
 
   end
@@ -626,6 +646,10 @@ class SeminarsController < ApplicationController
 
     con = SeminarSignupContribute.find(params[:con_no])
 
+    if session[:seminar_signup_id].blank? || con.seminar_signup_id.to_s != session[:seminar_signup_id].to_s
+      redirect_to "#{params[:referer_url].to_s.chomp('/')}/?method=con_upload" and return
+    end
+
     # seminar_signup = SeminarSignup.find_by(_id: con.seminar_signup_id )
     # seminar = SeminarMain.find_by(_id: seminar_signup.seminar_main_id )
     signup = con.seminar_signup
@@ -678,7 +702,8 @@ class SeminarsController < ApplicationController
       seminar = {}
       seminar_signup = {}
     end
-    con = SeminarSignupContribute.find(params[:con_no])
+    con = SeminarSignupContribute.where(id: params[:con_no]).first                                     
+    con = nil if con.nil? || @@session[:seminar_signup_id].blank? || con.seminar_signup_id.to_s != @@session[:seminar_signup_id].to_s
     {
       'con' => con,
       'seminar' => seminar,
@@ -756,7 +781,7 @@ class SeminarsController < ApplicationController
   end
 
   def seminar_signup_contribute_params
-    params.require(:seminar_signup_contribute).permit!
+    params.require(:seminar_signup_contribute).permit(:title, :file, :description, description: []) 
   end
 
   def seminar_signup_values_params

app/helpers/admin/seminars_field_helper.rb

@@ -26,7 +26,21 @@ module Admin::SeminarsFieldHelper
   end
 
   def lang_tab(str,lang)
-      content_tag(:div,str,:class=>"tab-pane fade",:id=>(get_field_name_base+"tab_#{lang}"))
+    content_tag(:div,str,:class=>"tab-pane fade",:id=>(get_field_name_base+"tab_#{lang}"))
+  end
+
+  def render_instructions
+    control_group_wrapper_for_sm do |key,value|
+      if !@prefiled_value.nil?
+        value = can_muti_lang_input_for_sm? ?  @prefiled_value[key] : @prefiled_value
+      else
+        value = nil
+      end
+      key = can_muti_lang_input_for_sm? ? "#{key}" : I18n.locale
+      instructions = (typeG["instructions"].blank? ? "" : typeG["instructions"][key])
+      name1 = can_muti_lang_input_for_sm? ? (get_field_name_base + "[#{key}]") : get_field_name_base
+      instructions.html_safe
+    end
   end
 
   def render_address

app/models/seminar_signup_contribute.rb

@@ -7,7 +7,7 @@ class SeminarSignupContribute
   field :abstract_number , type: String , default: ""
   field :presentation_type , type: String , default: ""
   field :sort_number , type: Integer, default: 10000
-  mount_uploader :file, AssetUploader
+  mount_uploader :file, SeminarContributeUploader 
   field :filename, type: String
   field :description
   field :preferred_session
@@ -62,4 +62,4 @@ class SeminarSignupContribute
     end
     self.filename
   end
-end
+end

app/models/seminar_signup_field.rb

@@ -24,6 +24,7 @@ class SeminarSignupField
   field :typeD, type: Hash, default: {cross_lang: false}
   field :typeE, type: Hash, default: {}
   field :typeF, type: Hash, default: {}
+  field :typeG, type: Hash, default: {}
   belongs_to :seminar_main
   has_many :seminar_signup_values, autosave: true, dependent: :destroy
   accepts_nested_attributes_for :seminar_signup_values, :allow_destroy => true

app/models/seminar_submission_field.rb

@@ -24,6 +24,7 @@ class SeminarSubmissionField
   field :typeD, type: Hash, default: {cross_lang: false}
   field :typeE, type: Hash, default: {}
   field :typeF, type: Hash, default: {cross_lang: "true"}
+  field :typeG, type: Hash, default: {}
   belongs_to :seminar_main
   has_many :seminar_submission_values, autosave: true, dependent: :destroy
   accepts_nested_attributes_for :seminar_submission_values, :allow_destroy => true

app/uploaders/seminar_contribute_uploader.rb

@@ -0,0 +1,14 @@
+# encoding: utf-8
+
+# 研討會投稿是「外部訪客」上傳，與後台可信上傳不同。
+# 繼承核心 AssetUploader（沿用 store_dir、檔名截短），僅加上危險副檔名黑名單，
+# 擋掉會在瀏覽器執行腳本、或可能被伺服器端執行的類型，防止 XSS。
+class SeminarContributeUploader < AssetUploader
+  def extension_blacklist
+    %w[
+      html htm xhtml shtml mhtml svg xml js mjs
+      php php3 php4 php5 phtml pht cgi pl py rb asp aspx jsp jspx sh bash
+      htaccess swf jar hta vbs
+    ]
+  end
+end

app/views/admin/seminars/_attribute_field.html.erb

@@ -129,6 +129,34 @@
       <%= render :partial=>"shared/attribute_field/list_block",:locals=>{:field_name=>"#{@field_name}[seminar_signup_fields_attributes][#{@af_counter}][typeE][option_list]",:values=>attribute_field["typeE"]["option_list"]}%>
     <% end if show_seminar_type_panel(attribute_field,"typeE") != 'typeE hide' %>
 
+    <%= content_tag :div,:class=>"field-type default fade in #{show_seminar_type_panel(attribute_field,"typeG")}" do%>
+      <% typeG_field_name = "#{@field_name}[seminar_signup_fields_attributes][#{@af_counter}][typeG][instructions]" %>
+      <%= content_tag :div, class: "control-group" do %>
+        <label class="control-label muted" for=""><%= t('lists.markups.instructions') %></label>
+        <div class="controls">
+          <div class="input-append">
+            <div class="btn-group-clearfix">
+              <div class="btn-group" data-toggle="buttons-radio">
+                <% @site_in_use_locales.each do |locale| %>
+                  <% active = (locale == @site_in_use_locales.first ? "active" : "") %>
+                  <%= link_to t(locale).to_s,"##{name_to_id(typeG_field_name)}_#{locale}",:class=>"btn #{active}",:data=>{:toggle=>"tab"}%>
+                <% end %>
+              </div>
+            </div>
+            <div class="tab-content">
+              <% @site_in_use_locales.each do |locale| %>
+                <% active = (locale == @site_in_use_locales.first ? "active in" : "'") %>
+                <%= content_tag :div, {class: "tab-pane fade #{active}", id: "#{name_to_id(typeG_field_name)}_#{locale}"} do %>
+                  <% locale_value = (attribute_field["typeG"].present? ? attribute_field["typeG"]["instructions"][locale.to_s] : "") %>
+                  <%= text_area(typeG_field_name, locale, value: locale_value, placeholder: "#{t(locale).to_s}", data: {:type=>"lang_#{locale}"}, class: 'ckeditor') %>
+                <% end %>
+              <% end %>
+            </div>
+          </div>
+        </div>
+      <% end %>
+    <% end if show_seminar_type_panel(attribute_field,"typeG") != 'typeG hide' %>
+
     <%= hidden_field "#{@field_name}[seminar_signup_fields_attributes][#{@af_counter}]","id",:value=>attribute_field.id%>
 
 </div>

app/views/admin/seminars/_attribute_submission_field.html.erb

@@ -128,6 +128,7 @@
     <%= content_tag :div,:class=>"field-type default fade in #{show_seminar_type_panel(attribute_submission_field,"typeE")}" do%>
       <%= render :partial=>"shared/attribute_field/list_block",:locals=>{:field_name=>"#{@field_name}[seminar_submission_fields_attributes][#{@af_counter}][typeE][option_list]",:values=>attribute_submission_field["typeE"]["option_list"]}%>
     <% end if show_seminar_type_panel(attribute_submission_field,"typeE") != 'typeE hide' %>
+
     <%= content_tag :div,:class=>"field-type default fade in #{show_seminar_type_panel(attribute_submission_field,"typeF")}" do%>
       <div class="control-group">
         <label class="control-label muted" for=""><%= t(:options)%></label>
@@ -140,6 +141,35 @@
         </div>
       </div>
     <% end if show_seminar_type_panel(attribute_submission_field,"typeF") != 'typeF hide' %>
+
+    <%= content_tag :div,:class=>"field-type default fade in #{show_seminar_type_panel(attribute_submission_field,"typeG")}" do%>
+      <% typeG_field_name = "#{@field_name}[seminar_signup_fields_attributes][#{@af_counter}][typeG][instructions]" %>
+      <%= content_tag :div, class: "control-group" do %>
+        <label class="control-label muted" for=""><%= t('lists.markups.instructions') %></label>
+        <div class="controls">
+          <div class="input-append">
+            <div class="btn-group-clearfix">
+              <div class="btn-group" data-toggle="buttons-radio">
+                <% @site_in_use_locales.each do |locale| %>
+                  <% active = (locale == @site_in_use_locales.first ? "active" : "") %>
+                  <%= link_to t(locale).to_s,"##{name_to_id(typeG_field_name)}_#{locale}",:class=>"btn #{active}",:data=>{:toggle=>"tab"}%>
+                <% end %>
+              </div>
+            </div>
+            <div class="tab-content">
+              <% @site_in_use_locales.each do |locale| %>
+                <% active = (locale == @site_in_use_locales.first ? "active in" : "'") %>
+                <%= content_tag :div, {class: "tab-pane fade #{active}", id: "#{name_to_id(typeG_field_name)}_#{locale}"} do %>
+                  <% locale_value = (attribute_submission_field["typeG"].present? ? attribute_submission_field["typeG"]["instructions"][locale.to_s] : "") %>
+                  <%= text_area(typeG_field_name, locale, value: locale_value, placeholder: "#{t(locale).to_s}", data: {:type=>"lang_#{locale}"}, class: 'ckeditor') %>
+                <% end %>
+              <% end %>
+            </div>
+          </div>
+        </div>
+      <% end %>
+    <% end if show_seminar_type_panel(attribute_submission_field,"typeG") != 'typeG hide' %>
+
     <%= hidden_field "#{@field_name}[seminar_submission_fields_attributes][#{@af_counter}]","id",:value=>attribute_submission_field.id%>
 
 </div>

app/views/admin/seminars/_index.html.erb

@@ -40,14 +40,24 @@
         </td>
         <td><%= SeminarMain.time_range(seminar.seminar_start_date, seminar.seminar_end_date) %></td>
         <td><%= SeminarMain.time_range(seminar.signup_start_date, seminar.signup_end_date) %></td>
-        <td><a href="/admin/seminars/<%=seminar.id.to_s%>/seminar_signup">
+        <td>
           <% @seminar_review = seminar.seminar_reviews.where(:reviewer_id => current_user.member_profile_id.to_s).first %>
-          <% if @seminar_review.present? && !@can_edit %>
-            <%= @seminar_review.get_all_seminar_signup_ids.count %>
+          <% if can_see_seminar_signup(seminar) %>
+            <a href="/admin/seminars/<%=seminar.id.to_s%>/seminar_signup">
+              <% if @seminar_review.present? && !@can_edit %>
+                <%= @seminar_review.get_all_seminar_signup_ids.count %>
+              <% else %>
+                <%= seminar.seminar_signups.count %>
+              <% end %>
+            </a>
           <% else %>
-            <%= seminar.seminar_signups.count %>
+            <% if @seminar_review.present? && !@can_edit %>
+              <%= @seminar_review.get_all_seminar_signup_ids.count %>
+            <% else %>
+              <%= seminar.seminar_signups.count %>
+            <% end %>
           <% end %>
-          </a></td>
+        </td>
         <td>
           <% if can_see_seminar_signup(seminar) %>
             <a href="/admin/seminars/<%=seminar.id.to_s%>/export?format=xlsx" target="_blank"><%= t('seminar.export') %></a>
@@ -62,4 +72,4 @@
   content_tag :div, class: "bottomnav clearfix" do
     content_tag :div, paginate(@seminars), class: "pagination pagination-centered"
   end
-%>
+%>

app/views/admin/seminars/_support_member_form_js.erb

@@ -112,7 +112,7 @@
 
 
 <script id="template-type" type="text/x-tmpl">
-  {{if templateType == 'typeA' || templateType == 'typeD' || templateType == 'typeG'}}
+  {{if templateType == 'typeA' || templateType == 'typeD'}}
     <div class="control-group">
       <label class="control-label muted"><%= t(:enabled_for)%></label>
       <div class="controls">
@@ -122,7 +122,7 @@
             <%=  t(:cross_lang) %>
           </label>
         {{/if}}
-        {{if templateType == 'typeA' || templateType == 'typeG'}}
+        {{if templateType == 'typeA'}}
           <label class="checkbox inline">
             <input type="checkbox" data-type="extendable_field" id="${_add_more[0]}" name="${_add_more[1]}" value="true">
             <%= t(:add_more)%>
@@ -257,6 +257,35 @@
       </div>
     </div>
   {{/if}}
+  {{if templateType == 'typeG'}}
+    <div class="control-group">
+      <label class="control-label muted">
+        <%= t('lists.markups.instructions') %>
+      </label>
+      <div class="controls">
+        <div class="input-append">
+          <div class="btn-group-clearfix">
+            <div class="btn-group" data-toggle="buttons-radio">
+              <% @site_in_use_locales.each do |locale| %>
+                <% active = (locale == @site_in_use_locales.first ? "active" : "") %>
+                <a class="btn <%= active %>" href="${'#'+_instructions[0]+'_<%= locale %>'}" data-toggle="tab">
+                  <%= t(locale).to_s %>
+                </a>
+              <% end %>
+            </div>
+          </div>
+          <div class="tab-content">
+            <% @site_in_use_locales.each do |locale| %>
+              <% active = (locale == @site_in_use_locales.first ? "active" : "") %>
+              <div class="tab-pane <%= active %> fade in" id="${_instructions[0]+'_<%= locale %>'}">
+                <textarea class="ckeditor" data-type="lang_<%= locale %>" placeholder="<%= t(locale).to_s %>" name="${_instructions[1]+'[<%= locale %>]'}"></textarea>
+              </div>
+            <% end %>
+          </div>
+        </div>
+      </div>
+    </div>
+  {{/if}}
 </script>
 
 

app/views/admin/seminars/export.xlsx.axlsx

@@ -2,7 +2,12 @@
 
 wb = xlsx_package.workbook
 
-wb.add_worksheet(name: (@seminar.title.to_s[0..27]+'...')) do |sheet|
+illegal_chars = /[:\\\/\[\]\*\?]/
+
+sanitized_title = @seminar.title.to_s.gsub(illegal_chars, ' ').strip
+sheet_name = (sanitized_title[0..27] + '...').gsub(/\.{4,}/, '...')
+
+wb.add_worksheet(name: sheet_name) do |sheet|
 
   row = [t('seminar_signup.signup_time')]
 
@@ -26,7 +31,7 @@ wb.add_worksheet(name: (@seminar.title.to_s[0..27]+'...')) do |sheet|
 
   seminar_signup_fields = @seminar.seminar_signup_fields.where(:disabled=>false).asc(:sort_number, :_id).to_a
 
-  seminar_signup_fields.each  do |rf| 
+  seminar_signup_fields.each do |rf|
     if rf.can_muti_lang_input?
       @site_in_use_locales.each do |l|
         row << rf.title + " (#{t(l.to_s)})"
@@ -35,9 +40,10 @@ wb.add_worksheet(name: (@seminar.title.to_s[0..27]+'...')) do |sheet|
       row << rf.title
     end
   end
+  
   highlight_style = wb.styles.add_style(
     :bg_color => 'ffeb3b',
-    :b        => true,
+    :b => true,
     :border => { :style => :thick, :color => "000000", :edges => [:top, :left, :bottom, :right] },
     :alignment => {:horizontal => :center, :vertical => :center, :wrap_text => true}
   )
@@ -46,25 +52,36 @@ wb.add_worksheet(name: (@seminar.title.to_s[0..27]+'...')) do |sheet|
   wrap_text_style = wb.styles.add_style({:alignment => {:horizontal => :center, :vertical => :center, :wrap_text => true}})
   types = [:time]
   styles = [date_time_style]
+  
+  # 優化：一次性載入所有資料，避免 N+1 查詢
+  signup_ids = @seminar_signups.map(&:id)
+  signup_values_index = {}
+  SeminarSignupValue.where(:seminar_signup_id.in => signup_ids).each do |sv|
+    key = "#{sv.seminar_signup_id}_#{sv.seminar_signup_field_id}"
+    signup_values_index[key] = sv
+  end
+  
   @seminar_signups.each_with_index do |signup, i|
     row2 = []
     row2 << signup.created_at
     row2 << "#{signup.display_serial_number}"
     row2 << "#{signup[:name]} "
     row2 << "#{signup.unit} "
-    row2 << "#{signup[:tel]} "
+    row2 << "#{signup.tel} "
     row2 << "#{signup[:phone]} "
     row2 << "#{signup[:fax]} "
     row2 << "#{signup.address} "
     row2 << "#{signup[:email]} "
     row2 << "#{signup.note} "
-    seminar_signup_fields.each  do |rf| 
+    seminar_signup_fields.each do |rf|
+      key = "#{signup.id}_#{rf.id}"
+      signup_value = signup_values_index[key]
       if rf.can_muti_lang_input?
         @site_in_use_locales.each do |l|
-          row2 << (@seminar.get_attribute_value(rf,signup.id).get_value_by_locale(l) rescue '')
+          row2 << (signup_value&.get_value_by_locale(l) rescue '')
         end
       else
-        row2 << (@seminar.get_attribute_value(rf,signup.id).get_value_by_locale(I18n.locale) rescue '')
+        row2 << (signup_value&.get_value_by_locale(I18n.locale) rescue '')
       end
     end
     if i == 0
@@ -77,4 +94,3 @@ wb.add_worksheet(name: (@seminar.title.to_s[0..27]+'...')) do |sheet|
   end
 
 end
-

app/views/admin/seminars/seminar_signup_field.html.erb

@@ -1,16 +1,16 @@
 <% content_for :page_specific_css do -%>
-    <%= stylesheet_link_tag "lib/wrap-nav.css" %>
-    <%= stylesheet_link_tag "lib/pageslide.css" %>
-    <%= stylesheet_link_tag "lib/main-forms.css" %>
-    <%= stylesheet_link_tag "lib/togglebox.css" %>
+  <%= stylesheet_link_tag "lib/wrap-nav.css" %>
+  <%= stylesheet_link_tag "lib/pageslide.css" %>
+  <%= stylesheet_link_tag "lib/main-forms.css" %>
+  <%= stylesheet_link_tag "lib/togglebox.css" %>
 <% end -%>
 
 <% content_for :page_specific_javascript do -%>
-    <%= javascript_include_tag "lib/jquery.tmpl.min.js" %>
-    <%= javascript_include_tag "seminar-field-forms.js" %>
+  <%= javascript_include_tag "lib/jquery.tmpl.min.js" %>
+  <%= javascript_include_tag "seminar-field-forms.js" %>
 <% end -%>
 
-<%= form_for @attribute,:url => admin_seminar_path(@attribute) , :html => { :class=> "form-horizontal main-forms" } do |f| %>
+<%= form_for @attribute, url: admin_seminar_path(@attribute) , html: { class: "form-horizontal main-forms" } do |f| %>
   <% if flash.now[:notice].present? %>
     <%= flash.now[:notice]%>
   <% end %>
@@ -19,7 +19,7 @@
   <fieldset>
 
     <div id="attributes-area" class="input-area sortable">
-      <%= render partial: "attribute_field",collection: @attribute.seminar_signup_fields.asc(:sort_number, :_id)%>
+      <%= render partial: "attribute_field", collection: @attribute.seminar_signup_fields.asc(:sort_number, :_id)%>
     </div>
 
     <div class="form-actions">

app/views/admin/seminars/seminar_submission_field.html.erb

@@ -1,15 +1,15 @@
 <% content_for :page_specific_css do -%>
-    <%= stylesheet_link_tag "lib/wrap-nav.css" %>
-    <%= stylesheet_link_tag "lib/pageslide.css" %>
-    <%= stylesheet_link_tag "lib/main-forms.css" %>
-    <%= stylesheet_link_tag "lib/togglebox.css" %>
+  <%= stylesheet_link_tag "lib/wrap-nav.css" %>
+  <%= stylesheet_link_tag "lib/pageslide.css" %>
+  <%= stylesheet_link_tag "lib/main-forms.css" %>
+  <%= stylesheet_link_tag "lib/togglebox.css" %>
 <% end -%>
 
 <% content_for :page_specific_javascript do -%>
-    <%= javascript_include_tag "lib/jquery.tmpl.min.js" %>
-    <%= javascript_include_tag "seminar-field-forms-submission.js" %>
+  <%= javascript_include_tag "lib/jquery.tmpl.min.js" %>
+  <%= javascript_include_tag "seminar-field-forms-submission.js" %>
 <% end -%>
-<%= form_for @attribute,:url => admin_seminar_path(@attribute) , :html => { :class=> "form-horizontal main-forms" } do |f| %>
+<%= form_for @attribute, url: admin_seminar_path(@attribute) , html: { class: "form-horizontal main-forms" } do |f| %>
   <% if flash.now[:notice].present? %>
     <%= flash.now[:notice]%>
   <% end %>

app/views/seminars/_contribute_form.html.erb

@@ -94,7 +94,6 @@
       <input type="hidden" name="referer_url" value="<%= request.original_url.split(request.env["HTTP_HOST"]).last.split('?').first %>">
       <input type="hidden" name="seminar_signup_contribute[seminar_signup_id]" value="<%= session[:seminar_signup_id] %>">
       <%= f.submit "Submit", class: 'btn btn-primary', :id => 'button-mail' %>
-      <%= f.button "Delete", type: 'reset', class: 'btn' %>
     </div>
   </div>
 </fieldset>
@@ -136,4 +135,4 @@
     float: left;
     cursor: pointer;
   }
-</style>
+</style>

app/views/seminars/con_login.html.erb

@@ -9,7 +9,7 @@
     color: red;
   }
 </style>
-<% if (@seminar.contribute_start_date <= @time_now && (@seminar.contribute_end_date.nil? or @seminar.contribute_end_date+1 >= @time_now ) rescue false) %>
+<% if (@seminar.contribute_start_date.nil? || @seminar.contribute_start_date <= @time_now) && (@seminar.contribute_end_date.nil? or @seminar.contribute_end_date+1 >= @time_now ) %>
 
 <section id="main-wrap">
   <div class="sign-in have-other-sign-in">

app/views/seminars/con_upload.html.erb

@@ -9,9 +9,9 @@
 	data1 = @seminar.seminar_submission_field_sets.select{|v| v.field_name=='title'}[0]
 	data2 = @seminar.seminar_submission_field_sets.select{|v| v.field_name=='description'}[0]
 	data3 = @seminar.seminar_submission_field_sets.select{|v| v.field_name=='file'}[0]
-	show1 = !(data1.disabled) rescue false
-	show2 = !(data2.disabled) rescue false
-	show3 = !(data3.disabled) rescue false
+	show1 = data1 ? !(data1.disabled) : false
+	show2 = data2 ? !(data2.disabled) : false
+	show3 = data3 ? !(data3.disabled) : false
 	name1 = data1['name'][I18n.locale]
 	name2 = data2['name'][I18n.locale]
 	name3 = data3['name'][I18n.locale]
@@ -22,7 +22,14 @@
 		prefix_url = OrbitHelper.url_to_show(@seminar.to_param)
 	end
 %>
-<% if @seminar.contribute_start_date <= @time_now and ( @seminar.contribute_end_date.nil? or @seminar.contribute_end_date+1 >= @time_now ) %>
+<% notice = (params[:notice] rescue nil) %>
+<% if notice.present? %>
+  <%= content_tag :p, notice, :class => ["notice alert alert-error in fade"], :style => "color: red; font-weight: bold;" %>
+  <script type="text/javascript">
+    window.alert("<%= notice %>");
+  </script>
+<% end %>
+<% if (@seminar.contribute_start_date.nil? || @seminar.contribute_start_date <= @time_now) && ( @seminar.contribute_end_date.nil? || @seminar.contribute_end_date+1 >= @time_now ) %>
 	<% begin %>
 	<% if !session[:seminar_signup_id].blank? %>
 	<%=t('seminar_signup.serial_number') %>: <%=@seminar_signup.display_serial_number rescue ""%>
@@ -109,4 +116,4 @@
 	end%>
 <% else %>
 	<%= t("seminar.out_of_date") %>
-<% end %>
+<% end %>

app/views/seminars/edit_file.html.erb

@@ -11,7 +11,7 @@
   @seminar_signup = data["seminar_signup"]
   @form_index = 0
 %>
-<% if !session[:seminar_signup_id].blank? %>
+<% if !session[:seminar_signup_id].blank? && @con %> 
 
 <%= form_for @con, url: edit_file_proc_seminars_path, html: {class: "content form-horizontal" , :id=>"new-seminar-signup-contribute"} do |f| %>
   <% begin %>
@@ -23,4 +23,4 @@
 
 <% else %>
 請登入
-<% end %>
+<% end %>

app/views/seminars/show_data.html.erb

@@ -9,7 +9,8 @@
   @sign_up_time_range = data["sign_up_time_range"]
   @seminar_time_range = data["seminar_time_range"]
   @contribute_time_range = data["contribute_time_range"]
-	@contribute_action = data["contribute_action"]
+  @contribute_action = data["contribute_action"]
+  @sign_up_not_yet = data["sign_up_not_yet"]
 %>
 
 
@@ -19,7 +20,7 @@
       <th class="seminarive-title-field"><%= t(:category) %></th>
       <td class="seminarive-title-value"><%= @seminar.category.title %></td>
     </tr>
-    <tr>
+    <tr <%= 'class="hidden"'.html_safe if @seminar_time_range.blank? %>>
       <th class="seminarive-title-field"><i class="fa fa-calendar fa-fw"></i><%= t('seminar.event_during') %></th>
       <td class="seminarive-title-value"><%= @seminar_time_range %></td>
     </tr>
@@ -39,7 +40,7 @@
       <td class="seminarive-title-value"><%= nl2br(@seminar.content) %></td>
     </tr>
     <% end %>
-    <tr>
+    <tr <%= 'class="hidden"'.html_safe if @sign_up_time_range.blank? %>>
       <th class="seminarive-title-field"><i class="fa fa-calendar fa-fw"></i><%= t('seminar.signup_during') %></th>
       <td class="seminarive-title-value"><%= @sign_up_time_range %></td>
     </tr>
@@ -49,7 +50,7 @@
       <td class="seminarive-title-value"><%= @contribute_time_range %></td>
     </tr>
     <% end %>
-    <tr>
+    <tr <%= 'class="hidden"'.html_safe if @sign_up_not_yet && @contribute_action.blank? %>>
       <th class="seminarive-title-field"><%= t('seminar.signup') %></th>
       <td class="seminarive-title-value"><%= @sign_up %><br /><%= @contribute_action %></td>
     </tr>

config/list.yml

@@ -45,3 +45,7 @@ markups:
     ext_support: false
     panel: typeF
     display_only: seminar_submission_field
+  instructions:
+    muti_lang_input_supprt: false
+    ext_support: false
+    panel: typeG

config/locales/en.yml

@@ -5,7 +5,9 @@ en:
     label: ""
   lists:
     markups:
-        seminar_preferred_session: Preferred Session
+      seminar_preferred_session: Preferred Session
+      instructions: Instructions
+
   restful_actions:
     edit_seminar_review: Review
     copy: Copy
@@ -21,6 +23,7 @@ en:
   recaptcha:
     errors:
       verification_failed: Verification Failed #驗證碼錯誤
+      file_type_not_allowed: This file type is not allowed
   helpers:
     label:
       seminar_review_result:
@@ -46,12 +49,12 @@ en:
     home_setting: Home Setting
     sub_page_setting: Sub Page Setting
     menu:
-        introduction: Introduction
-        news: News
-        registration: Registration
-        registered_participants: Registered Participants
-        submission: Submission
-        album: Album
+      introduction: Introduction
+      news: News
+      registration: Registration
+      registered_participants: Registered Participants
+      submission: Submission
+      album: Album
     introduction: Introduction
     announcement_limit: Announcement ;imit
     album_limit: Album limit
@@ -160,7 +163,7 @@ en:
     contribute_file_count: Count of Contribute Files #投稿檔案數
 
     frontend:
-        seminar: Semianr #研討會前台
+      seminar: Semianr #研討會前台
 
   seminar_item:
     new_item: New Item #新增項目
@@ -205,11 +208,11 @@ en:
     email_address: Email address
     _password: Password
     login: Login
-    new_: 'Load abstract'
+    new_: 'UpLoad'
     load_file: load file
     enable_summary_choice: Enable summary choice
     summary_choice_type: Summary choice type
     select: Select box
     checkbox: Multiple choice
     radio: Single choice
-    choices: Choices
+    choices: Choices

config/locales/zh_tw.yml

@@ -5,7 +5,8 @@ zh_tw:
     label: ""
   lists:
     markups:
-        seminar_preferred_session: Preferred Session
+      seminar_preferred_session: Preferred Session
+      instructions: "說明文字 Instructions"
 
   restful_actions:
     edit_seminar_review: 審查
@@ -22,6 +23,7 @@ zh_tw:
   recaptcha:
     errors:
       verification_failed: 驗證碼錯誤
+      file_type_not_allowed: 檔案格式不允許上傳
   helpers:
     label:
       seminar_review_result:
@@ -47,12 +49,12 @@ zh_tw:
     home_setting: 首頁設定
     sub_page_setting: 內頁設定
     menu:
-        introduction: 介紹
-        news: 公告
-        registration: 註冊
-        registered_participants: 註冊參與者
-        submission: 投稿
-        album: 相簿
+      introduction: 介紹
+      news: 公告
+      registration: 註冊
+      registered_participants: 註冊參與者
+      submission: 投稿
+      album: 相簿
     introduction: 介紹
     announcement_limit: 公告上限
     album_limit: 相簿上限
@@ -161,7 +163,7 @@ zh_tw:
     contribute_file_count: 投稿檔案數
 
     frontend:
-        seminar: 研討會前台
+      seminar: 研討會前台
 
   seminar_item:
     new_item: 新增項目
@@ -206,11 +208,11 @@ zh_tw:
     email_address: Email address
     _password: Password
     login: Login
-    new_: '新增(load abstract)'
+    new_: '新增(Upload)'
     load_file: load file
     enable_summary_choice: 開啟摘要選項
     summary_choice_type: 摘要選項類型
     select: 下拉選單
     checkbox: 多選
     radio: 單選
-    choices: 選項
+    choices: 選項

config/routes.rb

@@ -102,7 +102,7 @@ Rails.application.routes.draw do
         post 'con_login_proc', to: 'seminars#con_login_proc'
         post 'con_logout_proc', to: 'seminars#con_logout_proc'
         post 'add_file_proc', to: 'seminars#add_file_proc'
-        post 'edit_file_proc', to: 'seminars#edit_file_proc'
+        post 'edit_file_proc', to: 'seminars#update'
         post 'del_file', to: 'seminars#del_file'
       end
     end

custom_announcement/app/controllers/custom_bulletins_controller.rb

@@ -12,7 +12,7 @@ class CustomBulletinsController < ApplicationController
 
     I18n.locale = :zh_tw
     if !params[:keyword].blank?
-      keyword = Regexp.new(".*"+params[:keyword]+".*")
+      keyword = Regexp.new(".*"+Regexp.escape(params[:keyword].to_s)+".*")
       custom_bulletins = CustomBulletin.any_of({:title=>keyword},{:subtitle=>keyword},{:text=>keyword})
     else
       custom_bulletins = CustomBulletin.all
@@ -20,7 +20,7 @@ class CustomBulletinsController < ApplicationController
 
     if !params[:category].blank?
       module_id = ModuleApp.where(:key=>"custom_announcement").first.id
-      category = Regexp.new(".*"+params[:category]+".*")
+      category = Regexp.new(".*"+Regexp.escape(params[:category].to_s)+".*")
       category_id = Category.where(:title => category, :module_app_id => module_id).first.id
       custom_bulletins = custom_bulletins.where(:category_id => category_id)
     else
@@ -83,7 +83,7 @@ class CustomBulletinsController < ApplicationController
 
     # 計算總筆數 Start
     if !params[:keyword].blank?
-      keyword = Regexp.new(".*"+params[:keyword]+".*")
+      keyword = Regexp.new(".*"+Regexp.escape(params[:keyword].to_s)+".*")
       custom_bulletin_count = CustomBulletin.any_of({:title=>keyword},{:subtitle=>keyword},{:text=>keyword})
     else
       custom_bulletin_count = CustomBulletin.all

custom_announcement/app/helpers/custom_announcements_helper.rb

@@ -320,9 +320,9 @@ module CustomAnnouncementsHelper
     if @target_action == "index"
       filename = overridehtml.nil? ? params[:layout_type] : overridehtml
       f = File.join(Rails.root, 'app', 'templates', "#{@key}", 'modules', 'custom_announcement', "#{filename}.html.erb")
-      if !File.exists?f
+      if !File.exist?(f)
         f = File.join(Rails.root, 'app', 'templates', "#{@key}", 'modules', 'custom_announcement', "index.html.erb")
-        if !File.exists?f
+        if !File.exist?(f)
           return "<div class='well'>Maybe the administrator has changed the theme, please select the index page design again from the page settings.</div>".html_safe
         end
       end
@@ -333,7 +333,7 @@ module CustomAnnouncementsHelper
       begin 
         data = @data# rescue nil
       rescue Exception => e  
-       write_debug_file(e,'custom_announcements',@target_action) if Site::DEBUG
+        write_debug_file(e,'custom_announcements',@target_action) if Site::DEBUG
       end 
       if !data.nil?
         wrap_elements = doc.css("*[data-list][data-level='0']")
@@ -362,7 +362,7 @@ module CustomAnnouncementsHelper
     else
       filename = overridehtml.nil? ? @target_action : overridehtml
       f = File.join(Rails.root, 'app', 'templates', "#{@key}", 'modules', 'custom_announcement', "#{filename}.html.erb")
-      if File.exists?f
+      if File.exist?(f)
         file =  File.open(f)
         doc = Nokogiri::HTML(file, nil, "UTF-8")
         file.close
@@ -464,7 +464,7 @@ module CustomAnnouncementsHelper
     layout_types = []
     @key = Site.first.template
     f = File.join("#{Rails.root}/app/templates/#{@key}/modules/#{module_app}/info.json")
-    if File.exists?f
+    if File.exist?(f)
       info = File.read(f)
       hash = JSON.parse(info) rescue {}
       frontends = hash["frontend"] || []

custom_announcement/config/initializers/scheduler.rb

@@ -1,9 +1,11 @@
 require 'rufus-scheduler'
 
-scheduler = Rufus::Scheduler.new
+unless defined?(Rails::Console) || Rails.env.test? || File.split($0).last == 'rake'
+  scheduler = Rufus::Scheduler.new(lockfile: Rails.root.join('tmp', 'custom_bulletin_scheduler.lock').to_s)
 
-#return if defined?(Rails::Console) || Rails.env.test? || File.split($0).last == 'rake'
-
-scheduler.cron '43 2 * * *' do
-  system('bundle exec rake custom_bulletin:remove_preview_custom_bulletins')
+  if scheduler.up?
+    scheduler.cron '43 2 * * *' do
+      CustomBulletin.where(is_preview: true).destroy_all
+    end
+  end
 end

custom_announcement/lib/custom_announcement/engine.rb

@@ -2,153 +2,155 @@ require "yaml"
 module CustomAnnouncement
   class Engine < ::Rails::Engine
     initializer "custom_announcement" do
-      begin
-        translate_data = Dir["#{CustomAnnouncement::Engine.root}/config/locales/*.yml"] .map{|yaml_file| YAML.load(File.read(yaml_file))}
-        data = {}
-        key1 = {}
-        key2 = {}
-        key3 = {}
-        key4 = {}
-        key1_attr = []
-        key2_attr = []
-        key3_attr = []
-        key4_attr = []
-        data_item = {}
-        key_item1 = {}
-        key_item2 = {}
-        key_item3 = {}
-        value_item1 = {}
-        value_item2 = {}
-        value_item3 = {}
-        value2_item1 = {}
-        value2_item2 = {}
-        key1_options = ['small_size','medium_size','orignal_size']
-        key2_options = ['not_enable_tabs','enable_tabs_with_categories_include_all','enable_tabs_with_categories']
-        key3_options = ['default','upper_left','lower_left','upper_right','lower_right']
-        key4_options = ['the_same_as_data_count','display_all_in_other_tabs']
-        key1_options.each_with_index do |k,i|
-          key1_attr[i] = {}
-        end
-        key2_options.each_with_index do |k,i|
-          key2_attr[i] = {}
-        end
-        key3_options.each_with_index do |k,i|
-          key3_attr[i] = {}
-        end
-        key4_options.each_with_index do |k,i|
-          key4_attr[i] = {}
-        end
-        translate_data.each do |t_data|
-          v = t_data.values
-          k = t_data.keys[0]
-          key1[k] = v[0]['custom_announcement']['picture_showing_size']
-          key2[k] = v[0]['custom_announcement']['tabs_options']
-          key3[k] = v[0]['custom_announcement']['read_more_position_options']
-          key4[k] = v[0]['custom_announcement']['all_tabs_setting']
-          key1_options.each_with_index do |kk,i|
-            key1_attr[i][k] = v[0]['custom_announcement'][kk]
-          end
-          key2_options.each_with_index do |kk,i|
-            key2_attr[i][k] = v[0]['custom_announcement'][kk]
-          end
-          key3_options.each_with_index do |kk,i|
-            key3_attr[i][k] = v[0]['custom_announcement'][kk]
-          end
-          key4_options.each_with_index do |kk,i|
-            key4_attr[i][k] = v[0]['custom_announcement'][kk]
-          end
-          key_item1[k] = v[0]['custom_announcement']['showing_back_and_next']
-          key_item2[k] = v[0]['custom_announcement']['enable_search']
-          value_item1[k] = v[0]['custom_announcement']['not_show']
-          value_item2[k] = v[0]['custom_announcement']['show_bottom']
-          value_item3[k] = v[0]['custom_announcement']['show_top']
-          value2_item1[k] = v[0]['custom_announcement']['no']
-          value2_item2[k] = v[0]['custom_announcement']['yes']
-        end
-        data[key1] = key1_attr
-        data[key2] = key2_attr
-        data[key3] = key3_attr
-        data[key4] = key4_attr
-        data_item[key_item1] = [value_item1,value_item2,value_item3]
-        data_item[key_item2] = [value2_item1,value2_item2]
-        require File.expand_path('../../../app/models/custom_anns_cache', __FILE__)
-        if defined? CustomAnnsCache
-          CustomAnnsCache.destroy_all
-        end
-      rescue  => e
-        puts ['error in custom_announcement',e]
-      end
-      OrbitApp.registration "CustomAnnouncement", :type => "ModuleApp" do
-        module_label "custom_announcement.custom_announcement"
-        base_url File.expand_path File.dirname(__FILE__)
-        widget_methods ["widget","random_custom_announcement_widget", "tag_cloud"]
-        widget_settings [{"data_count"=>30,"enable_custom_widget_data"=>true}]
-        taggable "CustomBulletin"
-        categorizable
-        authorizable
-        frontend_enabled
-        feeds_url "/xhr/custom_announcements/feeds"
-        data_count 1..30
+      Rails.application.config.to_prepare do
         begin
-          show_options data
-          show_option_items data_item
-        rescue => e
-          puts ['there_was_no_show_option_method',e]
+          translate_data = Dir["#{CustomAnnouncement::Engine.root}/config/locales/*.yml"] .map{|yaml_file| YAML.load(File.read(yaml_file))}
+          data = {}
+          key1 = {}
+          key2 = {}
+          key3 = {}
+          key4 = {}
+          key1_attr = []
+          key2_attr = []
+          key3_attr = []
+          key4_attr = []
+          data_item = {}
+          key_item1 = {}
+          key_item2 = {}
+          key_item3 = {}
+          value_item1 = {}
+          value_item2 = {}
+          value_item3 = {}
+          value2_item1 = {}
+          value2_item2 = {}
+          key1_options = ['small_size','medium_size','orignal_size']
+          key2_options = ['not_enable_tabs','enable_tabs_with_categories_include_all','enable_tabs_with_categories']
+          key3_options = ['default','upper_left','lower_left','upper_right','lower_right']
+          key4_options = ['the_same_as_data_count','display_all_in_other_tabs']
+          key1_options.each_with_index do |k,i|
+            key1_attr[i] = {}
+          end
+          key2_options.each_with_index do |k,i|
+            key2_attr[i] = {}
+          end
+          key3_options.each_with_index do |k,i|
+            key3_attr[i] = {}
+          end
+          key4_options.each_with_index do |k,i|
+            key4_attr[i] = {}
+          end
+          translate_data.each do |t_data|
+            v = t_data.values
+            k = t_data.keys[0]
+            key1[k] = v[0]['custom_announcement']['picture_showing_size']
+            key2[k] = v[0]['custom_announcement']['tabs_options']
+            key3[k] = v[0]['custom_announcement']['read_more_position_options']
+            key4[k] = v[0]['custom_announcement']['all_tabs_setting']
+            key1_options.each_with_index do |kk,i|
+              key1_attr[i][k] = v[0]['custom_announcement'][kk]
+            end
+            key2_options.each_with_index do |kk,i|
+              key2_attr[i][k] = v[0]['custom_announcement'][kk]
+            end
+            key3_options.each_with_index do |kk,i|
+              key3_attr[i][k] = v[0]['custom_announcement'][kk]
+            end
+            key4_options.each_with_index do |kk,i|
+              key4_attr[i][k] = v[0]['custom_announcement'][kk]
+            end
+            key_item1[k] = v[0]['custom_announcement']['showing_back_and_next']
+            key_item2[k] = v[0]['custom_announcement']['enable_search']
+            value_item1[k] = v[0]['custom_announcement']['not_show']
+            value_item2[k] = v[0]['custom_announcement']['show_bottom']
+            value_item3[k] = v[0]['custom_announcement']['show_top']
+            value2_item1[k] = v[0]['custom_announcement']['no']
+            value2_item2[k] = v[0]['custom_announcement']['yes']
+          end
+          data[key1] = key1_attr
+          data[key2] = key2_attr
+          data[key3] = key3_attr
+          data[key4] = key4_attr
+          data_item[key_item1] = [value_item1,value_item2,value_item3]
+          data_item[key_item2] = [value2_item1,value2_item2]
+          require File.expand_path('../../../app/models/custom_anns_cache', __FILE__)
+          if defined? CustomAnnsCache
+            CustomAnnsCache.destroy_all
+          end
+        rescue  => e
+          puts ['error in custom_announcement',e]
         end
-        side_bar do
-          set_sidebar_order(100) rescue nil
-          head_label_i18n 'custom_announcement.custom_announcement', icon_class: "icon-bullhorn"
-          available_for "users"
-          active_for_controllers (['admin/custom_announcements'])
-          head_link_path "admin_custom_announcements_path"
+        OrbitApp.registration "CustomAnnouncement", :type => "ModuleApp" do
+          module_label "custom_announcement.custom_announcement"
+          base_url File.expand_path File.dirname(__FILE__)
+          widget_methods ["widget","random_custom_announcement_widget", "tag_cloud"]
+          widget_settings [{"data_count"=>30,"enable_custom_widget_data"=>true}]
+          taggable "CustomBulletin"
+          categorizable
+          authorizable
+          frontend_enabled
+          feeds_url "/xhr/custom_announcements/feeds"
+          data_count 1..30
+          begin
+            show_options data
+            show_option_items data_item
+          rescue => e
+            puts ['there_was_no_show_option_method',e]
+          end
+          side_bar do
+            set_sidebar_order(100) rescue nil
+            head_label_i18n 'custom_announcement.custom_announcement', icon_class: "icon-bullhorn"
+            available_for "users"
+            active_for_controllers (['admin/custom_announcements'])
+            head_link_path "admin_custom_announcements_path"
+
+            context_link 'custom_announcement.all_articles',
+                                  :link_path=>"admin_custom_announcements_path" ,
+                                  :priority=>1,
+                                  :active_for_action=>{'admin/custom_announcements'=>'index'},
+                                  :available_for => 'users'
+            # context_link 'new_', 
+            #                       :link_path=>"new_admin_custom_announcement_path" ,
+            #                       :priority=>2,
+            #                       :active_for_action=>{'admin/custom_announcements'=>'new'},
+            #                       :available_for => 'sub_managers'
+            context_link 'categories',
+                                  :link_path=>"admin_module_app_categories_path" ,
+                                  :link_arg=>"{:module_app_id=>ModuleApp.find_by(:key=>'custom_announcement').id}",
+                                  :priority=>3,
+                                  :active_for_action=>{'admin/custom_announcements'=>'categories'},
+                                  :active_for_category => 'CustomAnnouncement',
+                                  :available_for => 'managers'
+            context_link 'tags',
+                                  :link_path=>"admin_module_app_tags_path" ,
+                                  :link_arg=>"{:module_app_id=>ModuleApp.find_by(:key=>'custom_announcement').id}",
+                                  :priority=>4,
+                                  :active_for_action=>{'admin/custom_announcements'=>'tags'},
+                                  :active_for_tag => 'CustomAnnouncement',
+                                  :available_for => 'managers'
+            context_link 'custom_announcement.feed_list',
+                                  :link_path=>"admin_custom_announcement_feed_path" ,
+                                  :priority=>5,
+                                  :active_for_action=>{'admin/custom_announcements'=>'feed'},
+                                  :available_for => 'managers'
+             context_link 'custom_announcement.import',
+                                  :link_path=>"admin_custom_announcement_import_path" ,
+                                  :priority=>6,
+                                  :active_for_action=>{'admin/custom_announcements'=>'import'},
+                                  :available_for => 'managers'
+            context_link 'custom_announcement.settings',
+                                  :link_path=>"admin_custom_announcement_settings_path" ,
+                                  :priority=>6,
+                                  :active_for_action=>{'admin/custom_announcements'=>'settings'},
+                                  :available_for => 'managers'
+          end
 
-          context_link 'custom_announcement.all_articles',
-                                :link_path=>"admin_custom_announcements_path" ,
-                                :priority=>1,
-                                :active_for_action=>{'admin/custom_announcements'=>'index'},
-                                :available_for => 'users'
-          # context_link 'new_', 
-          #                       :link_path=>"new_admin_custom_announcement_path" ,
-          #                       :priority=>2,
-          #                       :active_for_action=>{'admin/custom_announcements'=>'new'},
-          #                       :available_for => 'sub_managers'
-          context_link 'categories',
-                                :link_path=>"admin_module_app_categories_path" ,
-                                :link_arg=>"{:module_app_id=>ModuleApp.find_by(:key=>'custom_announcement').id}",
-                                :priority=>3,
-                                :active_for_action=>{'admin/custom_announcements'=>'categories'},
-                                :active_for_category => 'CustomAnnouncement',
-                                :available_for => 'managers'
-          context_link 'tags',
-                                :link_path=>"admin_module_app_tags_path" ,
-                                :link_arg=>"{:module_app_id=>ModuleApp.find_by(:key=>'custom_announcement').id}",
-                                :priority=>4,
-                                :active_for_action=>{'admin/custom_announcements'=>'tags'},
-                                :active_for_tag => 'CustomAnnouncement',
-                                :available_for => 'managers'
-          context_link 'custom_announcement.feed_list',
-                                :link_path=>"admin_custom_announcement_feed_path" ,
-                                :priority=>5,
-                                :active_for_action=>{'admin/custom_announcements'=>'feed'},
-                                :available_for => 'managers'
-           context_link 'custom_announcement.import',
-                                :link_path=>"admin_custom_announcement_import_path" ,
-                                :priority=>6,
-                                :active_for_action=>{'admin/custom_announcements'=>'import'},
-                                :available_for => 'managers'
-          context_link 'custom_announcement.settings',
-                                :link_path=>"admin_custom_announcement_settings_path" ,
-                                :priority=>6,
-                                :active_for_action=>{'admin/custom_announcements'=>'settings'},
-                                :available_for => 'managers'
         end
-
+        # temp = YAML.load_file(File.join(Rails.root,"config","mongoid.yml"))
+        # dbsettings = temp["production"]["sessions"]["default"]
+        # s = Moped::Session.new(dbsettings["hosts"])
+        # s.use dbsettings["database"] 
+        # s[:custom_bulletins].indexes.create({expirable_created_at: 1},{ expireAfterSeconds: 180 })
       end
-      # temp = YAML.load_file(File.join(Rails.root,"config","mongoid.yml"))
-      # dbsettings = temp["production"]["sessions"]["default"]
-      # s = Moped::Session.new(dbsettings["hosts"])
-      # s.use dbsettings["database"] 
-      # s[:custom_bulletins].indexes.create({expirable_created_at: 1},{ expireAfterSeconds: 180 })
     end
   end
 end

custom_gallery/app/controllers/admin/custom_galleries_controller.rb

@@ -502,7 +502,7 @@ class Admin::CustomGalleriesController < OrbitAdminController
                  theater_link: admin_image_path(values),
                  description: values.description,
                  title: values.title,
-                 file: values.file.as_json[:file],
+                 file: values.file.as_json,
                  custom_gallery_custom_album_id: values.custom_album_id,
                  order: values.order,
                  tags: values.tags}

custom_gallery/app/controllers/custom_galleries_controller.rb

@@ -242,7 +242,7 @@ class CustomGalleriesController < ApplicationController
                   title: values.title,
                   alt_title: alt_text,
                   url: values.file.url,
-                  file: values.file.as_json[:file],
+                  file: values.file.as_json,
                   custom_gallery_custom_album_id: values.custom_album_id,
                   tags: values.tags}
     end

custom_gallery/lib/custom_gallery/engine.rb

@@ -1,94 +1,96 @@
 module CustomGallery
   class Engine < ::Rails::Engine
     initializer "custom_gallery" do
-      begin
-        translate_data = Dir["#{CustomGallery::Engine.root}/config/locales/*.yml"] .map{|yaml_file| YAML.load(File.read(yaml_file))}
-        data = {}
-        key1 = {}
-        value1 = {}
-        value2 = {}
-        value3 = {}
-        translate_data.each do |t_data|
-          v = t_data.values
-          k = t_data.keys[0]
-          key1[k] = v[0]['custom_gallery']['inner_page_layout']
-          value1[k] = v[0]['custom_gallery']['grid_style']
-          value2[k] = v[0]['custom_gallery']['card_style']
-          value3[k] = v[0]['custom_gallery']['slideshow_style']
+      Rails.application.config.to_prepare do
+        begin
+          translate_data = Dir["#{CustomGallery::Engine.root}/config/locales/*.yml"] .map{|yaml_file| YAML.load(File.read(yaml_file))}
+          data = {}
+          key1 = {}
+          value1 = {}
+          value2 = {}
+          value3 = {}
+          translate_data.each do |t_data|
+            v = t_data.values
+            k = t_data.keys[0]
+            key1[k] = v[0]['custom_gallery']['inner_page_layout']
+            value1[k] = v[0]['custom_gallery']['grid_style']
+            value2[k] = v[0]['custom_gallery']['card_style']
+            value3[k] = v[0]['custom_gallery']['slideshow_style']
+          end
+          data[key1] = [value1,value2,value3]
+        rescue  => e
+          puts ['error in custom_gallery',e]
         end
-        data[key1] = [value1,value2,value3]
-      rescue  => e
-        puts ['error in custom_gallery',e]
-      end
 
-      require File.expand_path('../../../app/models/custom_album_setting', __FILE__)
-      if defined?(CustomAlbumSetting)
-        if CustomAlbumSetting.first.nil?
-          CustomAlbumSetting.create()
-        elsif CustomAlbumSetting.count > 1
-          CustomAlbumSetting.all.to_a[1..-1].each do |custom_album_setting|
-            custom_album_setting.destroy
+        require File.join(CustomGallery::Engine.root, 'app/models/custom_album_setting')
+        if defined?(CustomAlbumSetting)
+          if CustomAlbumSetting.first.nil?
+            CustomAlbumSetting.create()
+          elsif CustomAlbumSetting.count > 1
+            CustomAlbumSetting.all.to_a[1..-1].each do |custom_album_setting|
+              custom_album_setting.destroy
+            end
           end
         end
-      end
-      
-      OrbitApp.registration "CustomGallery", :type => "ModuleApp" do
-        module_label "custom_gallery.custom_gallery"
-          base_url File.expand_path File.dirname(__FILE__)
-          widget_methods ["widget","custom_album_widget"]
-          # widget_settings []
-          widget_settings [{"data_count"=>30,"enable_custom_widget_data"=>true}]
-          models_to_cache [:custom_album,:custom_album_image]
-          taggable "CustomAlbum"
-          categorizable
-          authorizable
-          frontend_enabled
-          data_count 1..30
-          begin
-            show_option_items data
-          rescue => e
-            puts ['there_was_no_show_option_method',e]
-          end
-          side_bar do
-            set_sidebar_order(100) rescue nil
-            head_label_i18n 'custom_gallery.custom_gallery', icon_class: "fa fa-file-image-o"
-            available_for "users"
-            active_for_controllers (['admin/custom_galleries','admin/images'])
-            head_link_path "admin_custom_galleries_path"
+        
+        OrbitApp.registration "CustomGallery", :type => "ModuleApp" do
+          module_label "custom_gallery.custom_gallery"
+            base_url File.expand_path File.dirname(__FILE__)
+            widget_methods ["widget","custom_album_widget"]
+            # widget_settings []
+            widget_settings [{"data_count"=>30,"enable_custom_widget_data"=>true}]
+            models_to_cache [:custom_album,:custom_album_image]
+            taggable "CustomAlbum"
+            categorizable
+            authorizable
+            frontend_enabled
+            data_count 1..30
+            begin
+              show_option_items data
+            rescue => e
+              puts ['there_was_no_show_option_method',e]
+            end
+            side_bar do
+              set_sidebar_order(100) rescue nil
+              head_label_i18n 'custom_gallery.custom_gallery', icon_class: "fa fa-file-image-o"
+              available_for "users"
+              active_for_controllers (['admin/custom_galleries','admin/images'])
+              head_link_path "admin_custom_galleries_path"
 
-            context_link 'custom_gallery.all',
-              :link_path=>"admin_custom_galleries_path" ,
-              :priority=>1,
-              :active_for_action=>{'admin/custom_galleries'=>"index"},
-              :available_for => 'users'
+              context_link 'custom_gallery.all',
+                :link_path=>"admin_custom_galleries_path" ,
+                :priority=>1,
+                :active_for_action=>{'admin/custom_galleries'=>"index"},
+                :available_for => 'users'
 
-            # context_link 'custom_gallery.new',
-            #   :link_path=>"new_admin_custom_gallery_path" ,
-            #   :priority=>2,
-            #   :active_for_action=>{'admin/custom_galleries'=>"new"},
-            #   :available_for => 'sub_managers'
+              # context_link 'custom_gallery.new',
+              #   :link_path=>"new_admin_custom_gallery_path" ,
+              #   :priority=>2,
+              #   :active_for_action=>{'admin/custom_galleries'=>"new"},
+              #   :available_for => 'sub_managers'
 
-            context_link 'categories',
-              :link_path=>"admin_module_app_categories_path" ,
-              :link_arg=>"{:module_app_id=>ModuleApp.find_by(:key=>'custom_gallery').id}",
-              :priority=>3,
-              :active_for_action=>{'admin/custom_galleries'=>'categories'},
-              :active_for_category => 'CustomGallery',
-              :available_for => 'managers'
-                              
-            context_link 'tags',
-              :link_path=>"admin_module_app_tags_path" ,
-              :link_arg=>"{:module_app_id=>ModuleApp.find_by(:key=>'custom_gallery').id}",
-              :priority=>4,
-              :active_for_action=>{'admin/custom_galleries'=>'tags'},
-              :active_for_tag => 'CustomGallery',
-              :available_for => 'managers'
-            context_link 'setting',
-              :link_path=>"admin_custom_galleries_setting_path" ,
-              :priority=>5,
-              :active_for_action=>{'admin/custom_galleries'=>'setting'},
-              :available_for => 'managers'
-          end
+              context_link 'categories',
+                :link_path=>"admin_module_app_categories_path" ,
+                :link_arg=>"{:module_app_id=>ModuleApp.find_by(:key=>'custom_gallery').id}",
+                :priority=>3,
+                :active_for_action=>{'admin/custom_galleries'=>'categories'},
+                :active_for_category => 'CustomGallery',
+                :available_for => 'managers'
+                                
+              context_link 'tags',
+                :link_path=>"admin_module_app_tags_path" ,
+                :link_arg=>"{:module_app_id=>ModuleApp.find_by(:key=>'custom_gallery').id}",
+                :priority=>4,
+                :active_for_action=>{'admin/custom_galleries'=>'tags'},
+                :active_for_tag => 'CustomGallery',
+                :available_for => 'managers'
+              context_link 'setting',
+                :link_path=>"admin_custom_galleries_setting_path" ,
+                :priority=>5,
+                :active_for_action=>{'admin/custom_galleries'=>'setting'},
+                :available_for => 'managers'
+            end
+        end
       end
     end
   end

lib/seminar/engine.rb

@@ -1,55 +1,56 @@
 module Seminar
   class Engine < ::Rails::Engine
-    initializer "seminar" do 
-      OrbitApp.registration "Seminar", :type => "ModuleApp" do
-        module_label "seminar.seminar"
-        base_url File.expand_path File.dirname(__FILE__)
-        authorizable
-        categorizable
-        frontend_enabled
-        data_count 1..20
-        widget_methods ["widget"]
-        widget_settings [{"data_count"=>30}]
-        side_bar do
-          head_label_i18n 'seminar.seminar', icon_class: "icon-globe"
-          available_for "users"
-          active_for_controllers (['admin/seminars'])
-          head_link_path "admin_seminars_path"
+    initializer "seminar" do
+      Rails.application.config.to_prepare do
+        OrbitApp.registration "Seminar", :type => "ModuleApp" do
+          module_label "seminar.seminar"
+          base_url File.expand_path File.dirname(__FILE__)
+          authorizable
+          categorizable
+          frontend_enabled
+          data_count 1..20
+          widget_methods ["widget"]
+          widget_settings [{"data_count"=>30}]
+          side_bar do
+            head_label_i18n 'seminar.seminar', icon_class: "icon-globe"
+            available_for "users"
+            active_for_controllers (['admin/seminars'])
+            head_link_path "admin_seminars_path"
 
-          context_link 'list_',
-                                :link_path=>"admin_seminars_path" ,
-                                :priority=>1,
-                                :active_for_action=>{'admin/seminars'=>'index'},
-                                :available_for => 'users'
-          context_link 'new_', 
-                                :link_path=>"new_admin_seminar_path" ,
-                                :priority=>2,
-                                :active_for_action=>{'admin/seminars'=>'new'},
-                                :available_for => 'sub_managers'
-          context_link 'categories',
-                                :link_path=>"admin_module_app_categories_path" ,
-                                :link_arg=>"{:module_app_id=>ModuleApp.find_by(:key=>'seminar').id}",
-                                :priority=>3,
-                                :active_for_action=>{'admin/seminars'=>'categories'},
-                                :active_for_category => 'Seminar',
-                                :available_for => 'managers'
-          context_link 'seminar.set_seminar_items',
-                                :link_path=>"admin_seminar_items_path" ,
-                                :priority=>4,
-                                :active_for_action=>{'admin/seminars'=>'seminar_items'},
-                                :available_for => 'managers'
-          context_link 'seminar.set_seminar_agreements',
-                                :link_path=>"admin_seminar_agreements_path" ,
-                                :priority=>5,
-                                :active_for_action=>{'admin/seminars'=>'seminar_agreements'},
-                                :available_for => 'managers'
-          context_link 'seminar.enquiry_for_applicants',
-                                :link_path=>"admin_seminar_enquiry_for_applicants_path" ,
-                                :priority=>6,
-                                :active_for_action=>{'admin/seminars'=>'enquiry_for_applicants'},
-                                :available_for => 'users'
+            context_link 'list_',
+                                  :link_path=>"admin_seminars_path" ,
+                                  :priority=>1,
+                                  :active_for_action=>{'admin/seminars'=>'index'},
+                                  :available_for => 'users'
+            context_link 'new_', 
+                                  :link_path=>"new_admin_seminar_path" ,
+                                  :priority=>2,
+                                  :active_for_action=>{'admin/seminars'=>'new'},
+                                  :available_for => 'sub_managers'
+            context_link 'categories',
+                                  :link_path=>"admin_module_app_categories_path" ,
+                                  :link_arg=>"{:module_app_id=>ModuleApp.find_by(:key=>'seminar').id}",
+                                  :priority=>3,
+                                  :active_for_action=>{'admin/seminars'=>'categories'},
+                                  :active_for_category => 'Seminar',
+                                  :available_for => 'managers'
+            context_link 'seminar.set_seminar_items',
+                                  :link_path=>"admin_seminar_items_path" ,
+                                  :priority=>4,
+                                  :active_for_action=>{'admin/seminars'=>'seminar_items'},
+                                  :available_for => 'managers'
+            context_link 'seminar.set_seminar_agreements',
+                                  :link_path=>"admin_seminar_agreements_path" ,
+                                  :priority=>5,
+                                  :active_for_action=>{'admin/seminars'=>'seminar_agreements'},
+                                  :available_for => 'managers'
+            context_link 'seminar.enquiry_for_applicants',
+                                  :link_path=>"admin_seminar_enquiry_for_applicants_path" ,
+                                  :priority=>6,
+                                  :active_for_action=>{'admin/seminars'=>'enquiry_for_applicants'},
+                                  :available_for => 'users'
+          end
         end
-
       end
     end
   end