(feat) Check SCSS syntax before saving home page style

CHANGELOG.md

@@ -10,6 +10,7 @@
 - Filter projects by status
 - Maximum validity period for trainings authorizations
 - Automatically cancel trainings with insufficient attendees
+- Check SCSS syntax before saving home page style
 - Fix a bug: cannot cancel a subscription after offering free days
 - Fix a bug: event image updates are not reflected unless the browser's cache is purged
 - Fix a bug: schedules jobs are not launched at the right time

app/controllers/api/settings_controller.rb

@@ -14,6 +14,9 @@ class API::SettingsController < API::ApiController
     render status: :not_modified and return if setting_params[:value] == @setting.value
     render status: :locked, json: { error: I18n.t('settings.locked_setting') } and return unless SettingService.update_allowed?(@setting)
 
+    error = SettingService.check_before_update({ name: params[:name], value: setting_params[:value] })
+    render status: :unprocessable_entity, json: { error: error } and return if error
+
     if @setting.save && @setting.history_values.create(value: setting_params[:value], invoicing_profile: current_user.invoicing_profile)
       SettingService.run_after_update([@setting])
       render status: :ok
@@ -32,13 +35,18 @@ class API::SettingsController < API::ApiController
         next if !setting[:name] || !setting[:value] || setting[:value].blank?
 
         db_setting = Setting.find_or_initialize_by(name: setting[:name])
-        if !SettingService.update_allowed?(db_setting)
+        if SettingService.update_allowed?(db_setting)
-          db_setting.errors.add(:-, "#{I18n.t("settings.#{setting[:name]}")}: #{I18n.t('settings.locked_setting')}")
+          error = SettingService.check_before_update(setting)
-        elsif db_setting.save
+          if error
-          if db_setting.value != setting[:value] &&
+            db_setting.errors.add(:-, "#{I18n.t("settings.#{setting[:name]}")}: #{error}")
-             db_setting.history_values.create(value: setting[:value], invoicing_profile: current_user.invoicing_profile)
+          elsif db_setting.save
-            updated_settings.push(db_setting)
+            if db_setting.value != setting[:value] &&
+               db_setting.history_values.create(value: setting[:value], invoicing_profile: current_user.invoicing_profile)
+              updated_settings.push(db_setting)
+            end
           end
+        else
+          db_setting.errors.add(:-, "#{I18n.t("settings.#{setting[:name]}")}: #{I18n.t('settings.locked_setting')}")
         end
 
         @settings.push db_setting

app/services/setting_service.rb

@@ -12,6 +12,12 @@ class SettingService
       true
     end
 
+    # @param setting [Hash{Symbol->String}]
+    # @return [StandardError,NilClass]
+    def check_before_update(setting)
+      check_home_scss(setting)
+    end
+
     # @param settings [Array<Setting>]
     def run_after_update(settings)
       update_theme_stylesheet(settings)
@@ -37,6 +43,17 @@ class SettingService
       Stylesheet.theme&.rebuild!
     end
 
+    # validate that the provided SCSS has a valid syntax
+    def check_home_scss(setting)
+      return nil unless setting[:name] == 'home_css'
+
+      engine = SassC::Engine.new(".home-page { #{setting[:value]} }", style: :compressed)
+      engine.render
+      nil
+    rescue StandardError => e
+      e
+    end
+
     # rebuild the home page stylesheet
     # @param settings [Array<Setting>]
     def update_home_stylesheet(settings)

config/locales/app.admin.en.yml

@@ -1654,7 +1654,7 @@ en:
         slot_duration: "slots duration"
         advanced: "Advanced settings"
         customize_home_page_css: "Customise the stylesheet of the home page"
-        home_css_notice_html: "You can customize the stylesheet which will apply to the home page, using the <a href=\"https://sass-lang.com/documentation\" target=\"_blank\">SASS</a> syntax. These styles will be automatically subordinated to the <code>.home-page</code> selector to prevent any risk of breaking the application. Meanwhile please be careful, any changes in the home page editor at the top of the page may broke your styles, always refer to the HTML code."
+        home_css_notice_html: "You can customize the stylesheet which will apply to the home page, using the <a href=\"https://sass-lang.com/documentation\" target=\"_blank\">SCSS</a> syntax. These styles will be automatically subordinated to the <code>.home-page</code> selector to prevent any risk of breaking the application. Meanwhile please be careful, any changes in the home page editor at the top of the page may broke your styles, always refer to the HTML code."
         error_SETTING_locked: "Unable to update the setting: {SETTING} is locked. Please contact your system administrator."
         an_error_occurred_saving_the_setting: "An error occurred while saving the setting. Please try again later."
         book_overlapping_slots_info: "Allow / prevent the reservation of overlapping slots"