decidim-core 0.20.1 → 0.23.1

data/app/uploaders/decidim/homepage_image_uploader.rb

@@ -2,7 +2,7 @@
 
 module Decidim
   # This class deals with uploading hero images to organizations.
-  class HomepageImageUploader < ImageUploader
+  class HomepageImageUploader < RecordImageUploader
     version :big do
       process resize_to_fill: [1920, 666]
     end

data/app/uploaders/decidim/image_uploader.rb

@@ -11,9 +11,7 @@ module Decidim
     # CarrierWave automatically calls this method and validates the content
     # type fo the temp file to match against any of these options.
     def content_type_whitelist
-      [
-        %r{image\/}
-      ]
+      extension_whitelist.map { |ext| "image/#{ext}" }
     end
 
     # Strips out all embedded information from the image
@@ -24,10 +22,29 @@ module Decidim
       end
     end
 
+    # Fetches info about different versions, their processors and dimensions
+    def dimensions_info
+      if versions.any?
+        versions.map do |version, info|
+          [
+            version,
+            {
+              processor: info.processors[0][0],
+              dimensions: info.processors[0][1]
+            }
+          ]
+        end.to_h
+      else
+        processors.map do |info|
+          [:default, { processor: info[0], dimensions: info[1] }]
+        end.to_h
+      end
+    end
+
     # Add a white list of extensions which are allowed to be uploaded.
     # For images you might use something like this:
-    def extension_white_list
-      %w(jpg jpeg gif png bmp ico)
+    def extension_whitelist
+      Decidim.organization_settings(model).upload_allowed_file_extensions_image
     end
 
     # A simple check to avoid DoS with maliciously crafted images, or just to
@@ -43,7 +60,7 @@ module Decidim
 
     def validate_size
       manipulate! do |image|
-        validation_error!(I18n.t("carrierwave.errors.image_too_big")) if image.size > Decidim.maximum_attachment_size
+        validation_error!(I18n.t("carrierwave.errors.image_too_big")) if image.size > maximum_upload_size
         image
       end
     end
@@ -52,11 +69,22 @@ module Decidim
       3840
     end
 
+    def manipulate!
+      super
+    rescue CarrierWave::ProcessingError => e
+      Rails.logger.error(e)
+      raise CarrierWave::ProcessingError, I18n.t("carrierwave.errors.general")
+    end
+
     private
 
     def validation_error!(text)
       model.errors.add(mounted_as, text)
       raise CarrierWave::IntegrityError, text
     end
+
+    def maximum_upload_size
+      Decidim.organization_settings(model).upload_maximum_file_size
+    end
   end
 end

data/app/uploaders/decidim/newsletter_template_image_uploader.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+module Decidim
+  # This class deals with uploading images to newsletters.
+  class NewsletterTemplateImageUploader < ImageUploader
+    process resize_to_fit: [550, 300]
+
+    def max_image_height_or_width
+      8000
+    end
+
+    # Overwrite: If the content block is in preview mode, then we show the
+    # preview image. Otherwise, we use the default behavior.
+    def url(*args)
+      return preview_url if in_preview?
+
+      super
+    end
+
+    def preview_url(*_args)
+      manifest_images = model.content_block.manifest.images
+      image = manifest_images.find { |manifest_image| manifest_image[:name] == mounted_as } || {}
+      preview = image[:preview]
+
+      if preview && preview.respond_to?(:call)
+        preview.call
+      else
+        preview
+      end
+    end
+
+    def in_preview?
+      model.content_block.in_preview
+    end
+  end
+end

data/app/uploaders/decidim/oauth_application_logo_uploader.rb

@@ -2,7 +2,7 @@
 
 module Decidim
   # This class deals with uploading hero images to ParticipatoryProcesses.
-  class OAuthApplicationLogoUploader < ImageUploader
+  class OAuthApplicationLogoUploader < RecordImageUploader
     process resize_to_fit: [75, 75]
   end
 end

data/app/uploaders/decidim/official_image_footer_uploader.rb

@@ -2,7 +2,7 @@
 
 module Decidim
   # This class deals with uploading hero images to ParticipatoryProcesses.
-  class OfficialImageFooterUploader < ImageUploader
+  class OfficialImageFooterUploader < RecordImageUploader
     process resize_to_fit: [600, 180]
   end
 end

data/app/uploaders/decidim/official_image_header_uploader.rb

@@ -2,7 +2,7 @@
 
 module Decidim
   # This class deals with uploading hero images to ParticipatoryProcesses.
-  class OfficialImageHeaderUploader < ImageUploader
+  class OfficialImageHeaderUploader < RecordImageUploader
     process resize_to_fit: [160, 160]
   end
 end

data/app/uploaders/decidim/organization_logo_uploader.rb

@@ -2,7 +2,7 @@
 
 module Decidim
   # This class deals with uploading the organization's logo.
-  class OrganizationLogoUploader < ImageUploader
+  class OrganizationLogoUploader < RecordImageUploader
     version :medium do
       process resize_to_fit: [600, 160]
     end

data/app/uploaders/decidim/record_image_uploader.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+module Decidim
+  # This class deals with uploading record specific images that have more
+  # limited content types than the defaults.
+  class RecordImageUploader < ImageUploader
+    def content_type_whitelist
+      %w(image/jpeg image/png)
+    end
+
+    def extension_whitelist
+      %w(jpeg jpg png)
+    end
+  end
+end

data/app/validators/etiquette_validator.rb

@@ -8,7 +8,6 @@ class EtiquetteValidator < ActiveModel::EachValidator
 
     validate_caps(record, attribute, value)
     validate_marks(record, attribute, value)
-    validate_long_words(record, attribute, value)
     validate_caps_first(record, attribute, value)
     validate_length(record, attribute, value)
   end
@@ -27,12 +26,6 @@ class EtiquetteValidator < ActiveModel::EachValidator
     record.errors.add(attribute, options[:message] || :too_many_marks)
   end
 
-  def validate_long_words(record, attribute, value)
-    return if value.scan(/[A-z]{35,}/).empty?
-
-    record.errors.add(attribute, options[:message] || :long_words)
-  end
-
   def validate_caps_first(record, attribute, value)
     return if value.scan(/\A[a-z]{1}/).empty?
 

data/app/validators/geocoding_validator.rb

@@ -4,10 +4,9 @@
 # an existing address and computes its coordinates.
 class GeocodingValidator < ActiveModel::EachValidator
   def validate_each(record, attribute, value)
-    if Decidim.geocoder.present? && record.component.present?
-      organization = record.component.organization
-      Geocoder.configure(Geocoder.config.merge(http_headers: { "Referer" => organization.host }))
-      coordinates = Geocoder.coordinates(value)
+    if Decidim::Map.available?(:geocoding) && record.component.present?
+      geocoder = geocoder_for(record.component.organization)
+      coordinates = geocoder.coordinates(value)
 
       if coordinates.present?
         record.latitude = coordinates.first
@@ -19,4 +18,10 @@ class GeocodingValidator < ActiveModel::EachValidator
       record.errors.add(attribute, :invalid)
     end
   end
+
+  private
+
+  def geocoder_for(organization)
+    Decidim::Map.geocoding(organization: organization)
+  end
 end

data/app/validators/passthru_validator.rb

@@ -0,0 +1,111 @@
+# frozen_string_literal: true
+
+# This validator passes through the file upload validations on a record
+# attribute to an associated record. Useful e.g. with the forms that are not
+# aware of the actual record's validators but they still need to apply the same
+# validators as in the model they represent. Needs to be configured with the
+# target class and optionally the target attribute where the validators are
+# fetched from. By default the attribute name matches the attribute the
+# validator is set for. Works only for each validators.
+#
+# Example:
+#
+#   class ParticipantForm < Decidim::Form
+#     # Passes both the validator class only
+#     validates :avatar_image, passthru: { to: Person }
+#
+#     # Passes both the validator class and attribute
+#     validates :image, passthru: { to: Person, attribute: :avatar_image }
+#   end
+class PassthruValidator < ActiveModel::EachValidator
+  def validate_each(record, attribute, value)
+    return unless target_class
+
+    dummy_attr = target_attribute(attribute)
+
+    # Create a dummy record for which the validations are actually run on
+    dummy = validation_record(record)
+
+    target_validators(attribute).each do |validator|
+      next unless validator.is_a?(ActiveModel::EachValidator)
+      next unless check_validator_conditions(dummy, validator)
+
+      dummy.errors.clear
+      validator.validate_each(dummy, dummy_attr, value)
+      dummy.errors[dummy_attr].each do |err|
+        record.errors.add(attribute, err)
+      end
+    end
+  end
+
+  # Creates a dummy validation record that passes the correct file upload
+  # validation context from the original record for the validators.
+  def validation_record(record)
+    dummy = target_instance(record)
+    if dummy.is_a?(Decidim::Attachment)
+      if record.respond_to?(:attached_to)
+        dummy.attached_to = record.attached_to
+      elsif record.respond_to?(:organization)
+        dummy.attached_to = record.organization
+      end
+    elsif dummy.respond_to?(:organization=) && record.respond_to?(:organization)
+      dummy.organization = record.organization
+    end
+    dummy
+  end
+
+  def target_validators(attribute)
+    target_class.validators_on(target_attribute(attribute))
+  end
+
+  def target_class
+    options[:to]
+  end
+
+  def target_attribute(default = nil)
+    options[:attribute] || default
+  end
+
+  def target_instance(record)
+    instance_attributes = begin
+      if options[:with].respond_to?(:call)
+        options[:with].call(record)
+      else
+        options[:with] || {}
+      end
+    end
+    instance_attributes.each do |key, val|
+      instance_attributes[key] = val.call(record) if val.respond_to?(:call)
+    end
+
+    target_class.new(instance_attributes)
+  end
+
+  private
+
+  def check_validator_conditions(record, validator)
+    if (condition = validator.options[:if])
+      if_result = begin
+        if condition.respond_to?(:call)
+          condition.call(record)
+        else
+          record.public_send(condition)
+        end
+      end
+      return false unless if_result
+    end
+
+    if (condition = validator.options[:unless])
+      unless_result = begin
+        if condition.respond_to?(:call)
+          condition.call(record)
+        else
+          record.public_send(condition)
+        end
+      end
+      return false if unless_result
+    end
+
+    true
+  end
+end

data/app/validators/scope_belongs_to_component_validator.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+# This validator ensures the scope is a scope of a component scope
+class ScopeBelongsToComponentValidator < ActiveModel::EachValidator
+  def validate_each(record, attribute, value)
+    return unless component_for(record)
+
+    record.errors.add(attribute, :invalid) if component_for(record).out_of_scope?(Decidim::Scope.find_by(id: value))
+  end
+
+  private
+
+  def component_for(record)
+    record.try(:component) || record.try(:current_component)
+  end
+end

data/app/validators/time_zone_validator.rb

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+# This validator ensures timezones are valid. This is, supported by ActiveSupport::TimeZone
+class TimeZoneValidator < ActiveModel::EachValidator
+  def validate_each(record, attribute, value)
+    return if value.blank?
+
+    record.errors.add(attribute, options[:message] || :invalid_time_zone) unless ActiveSupport::TimeZone[value]
+  end
+end

data/app/validators/uploader_content_type_validator.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+# This validator ensures the files to be uploaded match the attached uploader's
+# content types. This prevents CarrierWave from uploading the records before
+# they pass the content type validations.
+class UploaderContentTypeValidator < ActiveModel::Validations::FileContentTypeValidator
+  def validate_each(record, attribute, value)
+    begin
+      values = parse_values(value)
+    rescue JSON::ParserError
+      record.errors.add attribute, :invalid
+      return
+    end
+
+    return if values.empty?
+
+    uploader = record.send(attribute)
+    return unless uploader
+    return unless uploader.is_a?(Decidim::ApplicationUploader)
+
+    mode = option_value(record, :mode)
+    allowed_types = uploader.content_type_whitelist || []
+    forbidden_types = uploader.content_type_blacklist || []
+
+    values.each do |val|
+      val_mode = mode
+
+      # The :strict mode would be more robust for the content type detection if
+      # the value does not know its own content type. However, this would
+      # require the command line utility named `file` which is only available in
+      # *nix. This would also require adding a new gem dependency for running
+      # the CLI utility, Terrapin or Cocaine in older versions of the
+      # file_validators gem. The :relaxed mode detects the content type based on
+      # the file extension through the mime-types gem.
+      val_mode = :relaxed if val_mode.blank? && !val.respond_to?(:content_type)
+
+      content_type = get_content_type(val, val_mode)
+      validate_whitelist(record, attribute, content_type, allowed_types)
+      validate_blacklist(record, attribute, content_type, forbidden_types)
+    end
+  end
+
+  def check_validity!; end
+end

data/app/views/decidim/account/delete.html.erb

@@ -1,20 +1,23 @@
+<% add_decidim_page_title(t("delete_my_account", scope: "layouts.decidim.user_profile")) %>
+<% content_for(:subtitle) { t("delete_my_account", scope: "layouts.decidim.user_profile") } %>
+
 <div class="row">
   <div class="columns large-8 end">
     <div class="callout alert">
       <p><%= t(".alert") %></p>
     </div>
     <p><%= t(".explanation") %></p>
-    <%= decidim_form_for(@form, url: account_path, method: :delete, html: { class: "user-form delete-account" }) do |f| %>
+    <%= decidim_form_for(@form, url: account_path, method: :delete, namespace: "delete_user", html: { class: "user-form delete-account" }) do |f| %>
       <div>
         <label>
           <span class="user-form__label"><%= t("activemodel.attributes.account.delete_reason") %></span>
           <%= f.text_area :delete_reason, rows: 2, label: false %>
         </label>
       </div>
-      <input type="submit" class="button open-modal-button" value="<%= t(".confirm.title") %>">
+      <button class="button open-modal-button"><%= t(".confirm.title") %></button>
     <% end %>
     <div class="tiny reveal" id="deleteConfirm" data-reveal>
-      <%= decidim_form_for(@form, url: account_path, method: :delete, html: { class: "user-form delete-account-modal" }) do |f| %>
+      <%= decidim_form_for(@form, url: account_path, method: :delete, namespace: "delete_user_confirm", html: { class: "user-form delete-account-modal" }) do |f| %>
         <%= f.hidden_field :delete_reason %>
 
         <p><%= t(".confirm.question") %></p>

data/app/views/decidim/account/show.html.erb

@@ -1,11 +1,16 @@
+<% add_decidim_page_title(t("profile", scope: "layouts.decidim.user_menu")) %>
+<% content_for(:subtitle) { t("profile", scope: "layouts.decidim.user_menu") } %>
+
 <div class="row">
-  <%= decidim_form_for(@account, url: account_path, method: :put, html: { autocomplete: "nope" }) do |f| %>
+  <%= decidim_form_for(@account, url: account_path, method: :put, html: { autocomplete: "off" }) do |f| %>
     <input autocomplete="off" name="hidden" type="password" style="display:none;">
     <div class="columns large-4">
       <%= f.upload :avatar %>
     </div>
 
     <div class="columns large-8 end">
+      <%= form_required_explanation %>
+
       <%= f.text_field :name %>
       <%= f.text_field :nickname %>
       <%= f.email_field :email %>
@@ -15,15 +20,17 @@
       <% if @account.errors[:password].any? || @account.errors[:password_confirmation].any? %>
         <%= render partial: "password_fields", locals: { form: f } %>
       <% else %>
-        <p>
-          <a data-toggle="passwordChange" class="change-password"><%= t ".change_password" %></a>
-        </p>
-        <div id="passwordChange" class="toggle-show" data-toggler=".is-expanded">
-          <%= render partial: "password_fields", locals: { form: f } %>
-        </div>
+        <% if current_organization.sign_in_enabled? %>
+          <p>
+            <a data-toggle="passwordChange" class="change-password"><%= t ".change_password" %></a>
+          </p>
+          <div id="passwordChange" class="toggle-show" data-toggler=".is-expanded">
+            <%= render partial: "password_fields", locals: { form: f } %>
+          </div>
+        <% end %>
       <% end %>
 
-      <%= f.submit t(".update_account"), disable_with: true %>
-    <% end %>
-  </div>
+      <%= f.submit t(".update_account") %>
+    </div>
+  <% end %>
 </div>