decidim-core 0.18.1 → 0.19.0

data/app/controllers/concerns/decidim/devise_controllers.rb

@@ -17,6 +17,7 @@ module Decidim
       include Decidim::LocaleSwitcher
       include ImpersonateUsers
       include NeedsPermission
+      include Decidim::SafeRedirect
 
       helper Decidim::TranslationsHelper
       helper Decidim::MetaTagsHelper
@@ -43,9 +44,9 @@ module Decidim
       end
 
       def store_current_location
-        return if params[:redirect_url].blank? || !request.format.html?
+        return if redirect_url.blank? || !request.format.html?
 
-        store_location_for(:user, params[:redirect_url])
+        store_location_for(:user, redirect_url)
       end
     end
   end

data/app/controllers/concerns/decidim/force_authentication.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+module Decidim
+  # Shared behaviour for force_users_to_authenticate_before_access_organization
+  module ForceAuthentication
+    extend ActiveSupport::Concern
+
+    included do
+      before_action :ensure_authenticated!, unless: :allow_unauthorized_path?
+    end
+
+    private
+
+    # For Devise helper functions, see:
+    # https://github.com/plataformatec/devise#getting-started
+    #
+    # Breaks the request lifecycle, if user is not authenticated.
+    # Otherwise returns.
+    def ensure_authenticated!
+      return true unless current_organization.force_users_to_authenticate_before_access_organization
+
+      # Next stop: Let's check whether auth is ok
+      unless user_signed_in?
+        flash[:warning] = t("actions.login_before_access", scope: "decidim.core")
+        return redirect_to decidim.new_user_session_path
+      end
+    end
+
+    # Check for all paths that should be allowed even if the user is not yet
+    # authorized
+    def allow_unauthorized_path?
+      # Changing the locale
+      return true if %r{^\/locale}.match?(request.path) || %r{^\/cookies}.match?(request.path)
+
+      false
+    end
+  end
+end

data/app/controllers/concerns/decidim/impersonate_users.rb

@@ -36,6 +36,7 @@ module Decidim
       # Returns the managed user impersonated by an admin if exists
       def managed_user
         return unless can_impersonate_users?
+
         impersonation_log&.user
       end
 

data/app/controllers/concerns/decidim/locale_switcher.rb

@@ -10,19 +10,18 @@ module Decidim
     included do
       around_action :switch_locale
       helper_method :current_locale, :available_locales, :default_locale
-      before_action :set_locale
 
       # Sets the locale for the current session.
-      #
+      # Saves current locale in a session variable in case some links are locale-orphaned
       # Returns nothing.
       def switch_locale(&action)
-        locale = if params["locale"]
-                   params["locale"]
-                 elsif current_user && current_user.locale.present?
-                   current_user.locale
-                 end
-
-        I18n.with_locale(available_locales.include?(locale) ? locale : default_locale, &action)
+        locale = detect_locale
+        if available_locales.include?(locale)
+          session[:user_locale] = locale
+        else
+          locale = default_locale
+        end
+        I18n.with_locale(locale, &action)
       end
 
       # Adds the current locale to all the URLs generated by url_for so users
@@ -57,17 +56,45 @@ module Decidim
         @default_locale ||= (current_organization || Decidim).public_send(:default_locale)
       end
 
-      # Save current locale in session variable
-      # to prevent unnecessary redirects
-      def set_locale
-        session[:user_locale] = params[:locale] if params[:locale].present?
-        locale = session[:user_locale] || extract_locale_from_accept_language_header
-        I18n.locale = available_locales.include?(locale) ? locale : I18n.default_locale
+      # Detects the locale priority: query string, user saved, session, browser
+      def detect_locale
+        if params[:locale].present?
+          params[:locale]
+        elsif current_user && current_user.locale.present?
+          current_user.locale
+        elsif session[:user_locale].present?
+          session[:user_locale]
+        else
+          extract_locale_from_accept_language_header
+        end
       end
 
+      # Finds a suitable language or returns nil
+      # Follows the RFC 2616 rules with this particularities:
+      # if no language matches, goes for the 2 chars prefixes
+      # i.e.: pt-BR is available locale but user requests pt, then pt-BR will be served
+      #     pt is available locale but user requests pt-BR, then pt will be served
       def extract_locale_from_accept_language_header
-        lang = request.env["HTTP_ACCEPT_LANGUAGE"] || I18n.locale.to_s
-        lang.scan(/\A^[a-z]{2}\z/).first
+        return nil unless request.env["HTTP_ACCEPT_LANGUAGE"]
+
+        accept_langs = request.env["HTTP_ACCEPT_LANGUAGE"].gsub(/[^a-z0-9\-;,=.]/i, "")
+
+        langs_and_qs = accept_langs.split(",").each_with_index.map do |l, i|
+          l += ";q=1.0" unless l =~ /;q=\d+(?:\.\d+)?$/
+          parts = l.split(";q=")
+          [parts[0], parts[1].to_f - (i.to_f / 1000)]
+        end
+        langs_and_qs = langs_and_qs.sort_by { |(_l, q)| q }.reverse
+        lang = langs_and_qs.detect do |(locale, _q)|
+          locale == "*" || available_locales.map(&:to_s).include?(locale.to_s)
+        end
+
+        lang &&= lang.first
+        # if no language detected go for RFC 2616 non-compliant (check prefixes)
+        lang ||= available_locales.detect do |available|
+          langs_and_qs.any? { |locale, _q| locale.to_s[0..1] == available.to_s[0..1] }
+        end
+        lang == "*" ? nil : lang
       end
     end
   end

data/app/controllers/concerns/decidim/needs_tos_accepted.rb

@@ -13,6 +13,7 @@ module Decidim
     private
 
     def tos_accepted_by_user
+      return true unless request.format.html?
       return true unless current_user
       return if current_user.tos_accepted?
       return if permitted_paths?
@@ -40,6 +41,13 @@ module Decidim
     end
 
     def redirect_to_tos
+      # Store the location where the user needs to be redirected to after the
+      # TOS is agreed.
+      store_location_for(
+        current_user,
+        stored_location_for(current_user) || request.path
+      )
+
       flash[:notice] = flash[:notice] if flash[:notice]
       flash[:secondary] = t("required_review.alert", scope: "decidim.pages.terms_and_conditions")
       redirect_to tos_path

data/app/controllers/concerns/decidim/orderable.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+require "active_support/concern"
+
+module Decidim
+  # Common logic to ordering resources
+  module Orderable
+    extend ActiveSupport::Concern
+
+    included do
+      helper_method :order, :available_orders, :random_seed
+
+      private
+
+      # Gets how the proposals should be ordered based on the choice
+      # made by the user.
+      def order
+        @order ||= detect_order(params[:order]) || default_order
+      end
+
+      def detect_order(candidate)
+        available_orders.detect { |order| order == candidate }
+      end
+
+      def default_order
+        "random"
+      end
+
+      # Returns: A random float number between -1 and 1 to be used as a
+      # random seed at the database.
+      def random_seed
+        @random_seed ||= session.fetch(:random_seed, (rand * 2 - 1)).to_f
+      end
+    end
+  end
+end

data/app/controllers/concerns/decidim/participatory_space_context.rb

@@ -50,6 +50,7 @@ module Decidim
       )
 
       raise NotImplementedError unless manifest
+
       manifest
     end
 
@@ -72,6 +73,7 @@ module Decidim
 
     def check_current_user_can_visit_space
       return if current_user_can_visit_space?
+
       flash[:alert] = I18n.t("participatory_space_private_users.not_allowed", scope: "decidim")
       redirect_to action: "index"
     end

data/app/controllers/concerns/decidim/safe_redirect.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+require "active_support/concern"
+
+module Decidim
+  # This concern groups methods and helpers related to redirecting the user from URL params.
+  module SafeRedirect
+    extend ActiveSupport::Concern
+
+    included do
+      helper_method :redirect_url
+
+      # Sanitizes the redirect url only allowing relative paths or absolute URLs
+      # that match the current organization.
+      def redirect_url
+        return if params[:redirect_url].blank?
+        return params[:redirect_url] unless params[:redirect_url].start_with?("http")
+        return if URI.parse(params[:redirect_url]).host != current_organization.host
+
+        params[:redirect_url]
+      end
+    end
+  end
+end

data/app/controllers/decidim/application_controller.rb

@@ -11,6 +11,8 @@ module Decidim
     include NeedsTosAccepted
     include HttpCachingDisabler
     include ActionAuthorization
+    include ForceAuthentication
+    include SafeRedirect
 
     helper Decidim::MetaTagsHelper
     helper Decidim::DecidimFormHelper
@@ -50,12 +52,26 @@ module Decidim
     # In Devise controllers we only store the URL if it's from the params, we don't
     # want to overwrite the stored URL for a Devise one.
     def store_current_location
-      return if (devise_controller? && params[:redirect_url].blank?) || !request.format.html?
+      return if skip_store_location?
 
-      value = params[:redirect_url] || request.url
+      value = redirect_url || request.url
       store_location_for(:user, value)
     end
 
+    def skip_store_location?
+      # Skip if Devise already handles the redirection
+      return true if devise_controller? && redirect_url.blank?
+      # Skip for all non-HTML requests"
+      return true unless request.format.html?
+      # Skip if a signed in user requests the TOS page without having agreed to
+      # the TOS. Most of the times this is because of a redirect to the TOS
+      # page (in which case the desired location is somewhere else after the
+      # TOS is agreed).
+      return true if current_user && !current_user.tos_accepted? && request.path == tos_path
+
+      false
+    end
+
     def user_has_no_permission_path
       decidim.root_path
     end
@@ -77,6 +93,7 @@ module Decidim
 
     def track_continuity_badge
       return unless current_user
+
       Decidim::ContinuityBadgeTracker.new(current_user).track!(Time.zone.today)
     end
   end

data/app/controllers/decidim/devise/confirmations_controller.rb

@@ -8,6 +8,12 @@ module Decidim
 
       helper_method :new_user_group_session_path
 
+      def create
+        super do |resource|
+          resource.errors.delete(:decidim_organization_id) if resource.errors.any?
+        end
+      end
+
       # Since we're using a single Devise installation for multiple
       # organizations, and user emails can be repeated across organizations,
       # we need to identify the user by both the email and the organization.

data/app/controllers/decidim/devise/invitations_controller.rb

@@ -25,10 +25,14 @@ module Decidim
       # When a managed user accepts the invitation is promoted to non-managed user.
       def accept_resource
         resource = resource_class.accept_invitation!(update_resource_params)
-        resource.update!(newsletter_notifications_at: Time.current) if update_resource_params[:newsletter_notifications]
-        resource.update!(managed: false) if resource.managed?
-        resource.update!(accepted_tos_version: resource.organization.tos_version)
-        Decidim::Gamification.increment_score(resource.invited_by, :invitations) if resource.invited_by
+
+        if resource.valid? && resource.invitation_accepted?
+          resource.update!(newsletter_notifications_at: Time.current) if update_resource_params[:newsletter_notifications]
+          resource.update!(managed: false) if resource.managed?
+          resource.update!(accepted_tos_version: resource.organization.tos_version)
+          Decidim::Gamification.increment_score(resource.invited_by, :invitations) if resource.invited_by
+        end
+
         resource
       end
 

data/app/controllers/decidim/devise/omniauth_registrations_controller.rb

@@ -24,7 +24,8 @@ module Decidim
               set_flash_message :notice, :success, kind: @form.provider.capitalize
             else
               expire_data_after_sign_in!
-              redirect_to root_path
+              user.resend_confirmation_instructions unless user.confirmed?
+              redirect_to decidim.root_path
               flash[:notice] = t("devise.registrations.signed_up_but_unconfirmed")
             end
           end
@@ -66,6 +67,7 @@ module Decidim
 
       def action_missing(action_name)
         return send(:create) if devise_mapping.omniauthable? && User.omniauth_providers.include?(action_name.to_sym)
+
         raise AbstractController::ActionNotFound, "The action '#{action_name}' could not be found for Decidim::Devise::OmniauthCallbacksController"
       end
 
@@ -79,6 +81,7 @@ module Decidim
       # Since we are using trusted omniauth data we are generating a valid signature.
       def user_params_from_oauth_hash
         return nil if oauth_data.empty?
+
         {
           provider: oauth_data[:provider],
           uid: oauth_data[:uid],

data/app/controllers/decidim/errors_controller.rb

@@ -2,6 +2,9 @@
 
 module Decidim
   class ErrorsController < Decidim::ApplicationController
+    skip_before_action :verify_authenticity_token
+    skip_after_action :verify_same_origin_request
+
     def not_found
       render status: :not_found
     end

data/app/controllers/decidim/follows_controller.rb

@@ -17,7 +17,7 @@ module Decidim
         end
 
         on(:invalid) do
-          render json: { error: I18n.t("follows.destroy.error", scope: "decidim") }, status: 422
+          render json: { error: I18n.t("follows.destroy.error", scope: "decidim") }, status: :unprocessable_entity
         end
       end
     end
@@ -33,7 +33,7 @@ module Decidim
         end
 
         on(:invalid) do
-          render json: { error: I18n.t("follows.create.error", scope: "decidim") }, status: 422
+          render json: { error: I18n.t("follows.create.error", scope: "decidim") }, status: :unprocessable_entity
         end
       end
     end

data/app/controllers/decidim/messaging/conversations_controller.rb

@@ -37,7 +37,7 @@ module Decidim
           end
 
           on(:invalid) do
-            render json: { error: I18n.t("messaging.conversations.create.error", scope: "decidim") }, status: 422
+            render json: { error: I18n.t("messaging.conversations.create.error", scope: "decidim") }, status: :unprocessable_entity
           end
         end
       end
@@ -67,7 +67,7 @@ module Decidim
           end
 
           on(:invalid) do
-            render json: { error: I18n.t("messaging.conversations.update.error", scope: "decidim") }, status: 422
+            render json: { error: I18n.t("messaging.conversations.update.error", scope: "decidim") }, status: :unprocessable_entity
           end
         end
       end

data/app/controllers/decidim/profiles_controller.rb

@@ -16,6 +16,7 @@ module Decidim
     def show
       return redirect_to profile_timeline_path(nickname: params[:nickname]) if profile_holder == current_user
       return redirect_to profile_members_path if profile_holder.is_a?(Decidim::UserGroup)
+
       redirect_to profile_activity_path(nickname: params[:nickname])
     end
 
@@ -64,10 +65,12 @@ module Decidim
     end
 
     def ensure_profile_holder
-      raise ActionController::RoutingError, "No user or user group with the given nickname" unless profile_holder
+      raise ActionController::RoutingError, "No user or user group with the given nickname" if !profile_holder || profile_holder.nickname.blank?
     end
 
     def profile_holder
+      return if params[:nickname].blank?
+
       @profile_holder ||= Decidim::User.find_by(
         nickname: params[:nickname],
         organization: current_organization

data/app/controllers/decidim/scopes_controller.rb

@@ -8,12 +8,11 @@ module Decidim
     def picker
       enforce_permission_to :pick, :scope
 
-      title = params[:title] || t("decidim.scopes.picker.title", field: params[:field]&.downcase)
-      root = current_organization.scopes.find(params[:root]) if params[:root]
       context = root ? { root: root.id, title: title } : { title: title }
       required = params[:required] && params[:required] != "false"
-      if params[:current]
-        current = (root&.descendants || current_organization.scopes).find_by(id: params[:current]) || root
+      current = (root&.descendants || current_organization.scopes).find_by(id: params[:current]) if params[:current].present?
+
+      if current
         scopes = current.children
         parent_scopes = current.part_of_scopes(root)
       else
@@ -21,8 +20,21 @@ module Decidim
         scopes = root&.children || current_organization.scopes.top_level
         parent_scopes = [root].compact
       end
+
       render :picker, layout: nil, locals: { required: required, title: title, root: root, current: current, scopes: scopes.order(name: :asc),
                                              parent_scopes: parent_scopes, global_value: params[:global_value], context: context }
     end
+
+    private
+
+    def title
+      @title ||= params[:title] || t("decidim.scopes.picker.title", field: params[:field]&.downcase)
+    end
+
+    def root
+      return if params[:root].blank?
+
+      @root ||= current_organization.scopes.find(params[:root])
+    end
   end
 end