Merge pull request #3501 from AlchemyCMS/fix-user-seeder

fix(seeder): Use YAML.safe_load to load users.yml

Author: tvdeyen

lib/alchemy/seeder.rb

@@ -68,7 +68,7 @@ def seed_users
               "Please use `rake db:reset' if you want to rebuild your database.", :skip
           false
         else
-          users = YAML.load_file(user_seeds_file)
+          users = load_yaml_file(user_seeds_file)
           users.each do |draft|
             user = Alchemy.user_class.create!(draft)
             log "Created user: #{user.try(:email) || user.try(:login) || user.id}"
@@ -83,9 +83,15 @@ def page_seeds_file
       end
 
       def page_yml
-        @_page_yml ||= YAML.safe_load(
-          page_seeds_file.read,
-          permitted_classes: [Date],
+        @_page_yml ||= load_yaml_file(
+          page_seeds_file
+        )
+      end
+
+      def load_yaml_file(file)
+        YAML.safe_load_file(
+          file,
+          permitted_classes: [Date, Symbol],
           aliases: true
         )
       end

spec/features/user_seeder_spec.rb

@@ -11,6 +11,7 @@
     before do
       FileUtils.mkdir_p(Rails.root.join("db/seeds/alchemy"))
       FileUtils.cp(seeds_file, Rails.root.join("db/seeds/alchemy/users.yml"))
+      allow_any_instance_of(DummyUser).to receive(:confirmed_at=)
     end
 
     it "seeds users" do

spec/fixtures/users.yml

@@ -1,9 +1,11 @@
 - email: admin@example.com
   password: test123
+  confirmed_at: 2025-01-01
   alchemy_roles:
     - admin
 
 - email: member@example.com
   password: test123
+  confirmed_at: 2025-01-01
   alchemy_roles:
     - member