decidim-core 0.20.1 → 0.23.1

data/lib/decidim/content_parsers/user_parser.rb

@@ -5,8 +5,7 @@ module Decidim
     # A parser that searches user mentions in content.
     #
     # A word starting with `@` will be considered as a possible mention if
-    # they only contains letters, numbers or underscores. If the `@` is
-    # followed with an underscore, then it is not considered.
+    # they only contains letters, numbers or underscores.
     #
     # @see BaseParser Examples of how to use a content parser
     class UserParser < BaseParser
@@ -16,9 +15,8 @@ module Decidim
       #   @return [Array] an array of Decidim::User mentioned in content
       Metadata = Struct.new(:users)
 
-      # Matches a nickname if it starts with a letter or number
-      # and only contains letters, numbers or underscores.
-      MENTION_REGEX = /\B@([a-zA-Z0-9]\w*)\b/.freeze
+      # Matches a nickname if contains letters, numbers or underscores.
+      MENTION_REGEX = /\B@(\w*)\b/.freeze
 
       # Replaces found mentions matching a nickname of an existing
       # user in the current organization with a global id. Other

data/lib/decidim/content_processor.rb

@@ -51,50 +51,75 @@ module Decidim
     #
     # @return [Result] a Result object with the content rewritten and the metadata
     def self.parse(content, context)
-      parsed = Decidim.content_processors.each_with_object(rewrite: content, metadata: {}) do |type, result|
-        parser = parser_klass(type).constantize.new(result[:rewrite], context)
-        result[:rewrite] = parser.rewrite
-        result[:metadata][type] = parser.metadata
+      Decidim.content_processors.each_with_object(Result.new(content, {})) do |type, result|
+        parse_with_processor(type, result, context)
       end
-
-      Result.new(parsed[:rewrite], parsed[:metadata])
     end
 
-    def self.parse_with_processor(_type, content, context)
-      parsed = if content.is_a?(Hash)
-                 Decidim.content_processors.each_with_object(rewrite: content, metadata: {}) do |type, result|
-                   next unless type == :hashtag
-
-                   result[:rewrite].each do |key, value|
-                     parser = parser_klass(type).constantize.new(value, context)
-                     result[:rewrite][key] = parser.rewrite
-                     result[:metadata][type] = parser.metadata
-                   end
-                 end
+    # Public: Calls the specified processors to process the given content with
+    # it. For example, to convert hashtags to its Global ID representation.
+    #
+    # @param type [String] the name of the processor to use.
+    # @param content [String] already rewritten content or regular content
+    # @param context [Hash] with information to inject to the parsers as context
+    #
+    # @return [Result] a Result object with the content rewritten and the metadata
+    def self.parse_with_processor(type, content, context)
+      result = if content.is_a?(Result)
+                 content
                else
-                 Decidim.content_processors.each_with_object(rewrite: content, metadata: {}) do |type, result|
-                   next unless type == :hashtag
-
-                   parser = parser_klass(type).constantize.new(result[:rewrite], context)
-                   result[:rewrite] = parser.rewrite
-                   result[:metadata][type] = parser.metadata
-                 end
+                 Result.new(content, {})
                end
-      Result.new(parsed[:rewrite], parsed[:metadata])
+
+      if result.rewrite.is_a?(Hash)
+        result.rewrite.each do |key, value|
+          child_result = Result.new(value, {})
+          child_result = parse_with_processor(type, child_result, context)
+
+          result.rewrite.update(key => child_result.rewrite)
+          result.metadata.update(child_result.metadata)
+        end
+      else
+        parser = parser_klass(type).constantize.new(result.rewrite, context)
+        result.rewrite = parser.rewrite
+        result.metadata.update(type => parser.metadata)
+      end
+
+      result
     end
 
     # This calls all registered processors one after the other and returns
     # the processed content ready to display.
     #
+    # @param content [String] with the content to be rendered.
+    # @param wrapper_tag [String] with the HTML tag to wrap the content.
+    # @param options [Hash] with options to pass to the renderer.
+    #
     # @return [String] the content processed and ready to display (it is expected to include HTML)
-    def self.render(content)
+    def self.render(content, wrapper_tag = "p", options = {})
       simple_format(
-        Decidim.content_processors.reduce(content) do |result, type|
-          renderer_klass(type).constantize.new(result).render
-        end
+        render_without_format(content, options),
+        {},
+        wrapper_tag: wrapper_tag
       )
     end
 
+    # This calls all registered processors one after the other and returns
+    # the processed content ready to display without wrapping the content in
+    # HTML.
+    #
+    # @param content [String] with the content to be rendered.
+    # @param options [Hash] with options to pass to the renderer.
+    #
+    # @return [String] the content processed and ready to display.
+    def self.render_without_format(content, options = {})
+      return content if content.blank?
+
+      Decidim.content_processors.reduce(content) do |result, type|
+        renderer_klass(type).constantize.new(result).render(options)
+      end
+    end
+
     # This method overwrites the views `sanitize` method. This is required to
     # ensure the content does not include any weird HTML that could harm the end
     # user.

data/lib/decidim/content_renderers.rb

@@ -4,6 +4,7 @@ module Decidim
   module ContentRenderers
     autoload :BaseRenderer, "decidim/content_renderers/base_renderer"
     autoload :UserRenderer, "decidim/content_renderers/user_renderer"
+    autoload :UserGroupRenderer, "decidim/content_renderers/user_group_renderer"
     autoload :HashtagRenderer, "decidim/content_renderers/hashtag_renderer"
     autoload :LinkRenderer, "decidim/content_renderers/link_renderer"
   end

data/lib/decidim/content_renderers/base_renderer.rb

@@ -29,7 +29,7 @@ module Decidim
       #
       # @abstract Subclass is expected to implement it
       # @return [String] the content processed and ready to display
-      def render
+      def render(_options = nil)
         content
       end
     end

data/lib/decidim/content_renderers/hashtag_renderer.rb

@@ -21,6 +21,8 @@ module Decidim
       #
       # @return [String] the content ready to display (contains HTML)
       def render(links: true, extras: true)
+        return content unless content.respond_to?(:gsub)
+
         content.gsub(GLOBAL_ID_REGEX) do |hashtag_gid|
           id, extra, cased_name = hashtag_gid.scan(GLOBAL_ID_REGEX).flatten
           hashtag = hashtags[id.to_i]

data/lib/decidim/content_renderers/link_renderer.rb

@@ -16,7 +16,10 @@ module Decidim
     # @see BaseRenderer Examples of how to use a content renderer
     class LinkRenderer < BaseRenderer
       # @return [String] the content ready to display (contains HTML)
-      def render(options = { target: "_blank", rel: "noopener" })
+      def render(options = {})
+        return content unless content.is_a?(String)
+
+        options = { target: "_blank", rel: "nofollow noopener" }.merge(options)
         Anchored::Linker.auto_link(content, options)
       end
     end

data/lib/decidim/content_renderers/user_group_renderer.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+module Decidim
+  module ContentRenderers
+    # A renderer that searches Global IDs representing users in content
+    # and replaces it with a link to their profile with the nickname.
+    #
+    # e.g. gid://<APP_NAME>/Decidim::UserGroup/1
+    #
+    # @see BaseRenderer Examples of how to use a content renderer
+    class UserGroupRenderer < BaseRenderer
+      # Matches a global id representing a Decidim::UserGroup
+      GLOBAL_ID_REGEX = %r{gid://\S+/Decidim::UserGroup/\d+}.freeze
+
+      # Replaces found Global IDs matching an existing user with
+      # a link to their profile. The Global IDs representing an
+      # invalid Decidim::UserGroup are replaced with an empty string.
+      #
+      # @return [String] the content ready to display (contains HTML)
+      def render(_options = nil)
+        return content unless content.respond_to?(:gsub)
+
+        content.gsub(GLOBAL_ID_REGEX) do |user_gid|
+          user = GlobalID::Locator.locate(user_gid)
+          Decidim::UserGroupPresenter.new(user).display_mention
+        rescue ActiveRecord::RecordNotFound => _e
+          ""
+        end
+      end
+    end
+  end
+end

data/lib/decidim/content_renderers/user_renderer.rb

@@ -17,7 +17,9 @@ module Decidim
       # invalid Decidim::User are replaced with an empty string.
       #
       # @return [String] the content ready to display (contains HTML)
-      def render
+      def render(_options = nil)
+        return content unless content.respond_to?(:gsub)
+
         content.gsub(GLOBAL_ID_REGEX) do |user_gid|
           user = GlobalID::Locator.locate(user_gid)
           Decidim::UserPresenter.new(user).display_mention

data/lib/decidim/core.rb

@@ -5,8 +5,10 @@ require "decidim/core/api"
 require "decidim/core/version"
 # Decidim configuration.
 module Decidim
+  autoload :Deprecations, "decidim/deprecations"
   autoload :ActsAsAuthor, "decidim/acts_as_author"
   autoload :TranslatableAttributes, "decidim/translatable_attributes"
+  autoload :TranslatableResource, "decidim/translatable_resource"
   autoload :JsonbAttributes, "decidim/jsonb_attributes"
   autoload :FormBuilder, "decidim/form_builder"
   autoload :AuthorizationFormBuilder, "decidim/authorization_form_builder"
@@ -23,7 +25,9 @@ module Decidim
   autoload :Participable, "decidim/participable"
   autoload :Publicable, "decidim/publicable"
   autoload :Scopable, "decidim/scopable"
+  autoload :ScopableParticipatorySpace, "decidim/scopable_participatory_space"
   autoload :ScopableComponent, "decidim/scopable_component"
+  autoload :ScopableResource, "decidim/scopable_resource"
   autoload :ContentParsers, "decidim/content_parsers"
   autoload :ContentRenderers, "decidim/content_renderers"
   autoload :ContentProcessor, "decidim/content_processor"
@@ -69,18 +73,25 @@ module Decidim
   autoload :Fingerprintable, "decidim/fingerprintable"
   autoload :DataPortability, "decidim/data_portability"
   autoload :DataPortabilitySerializers, "decidim/data_portability_serializers"
-  autoload :DataPortabilityFileReader, "decidim/data_portability_file_reader"
-  autoload :DataPortabilityFileZipper, "decidim/data_portability_file_zipper"
+  autoload :DataPortabilityExporter, "decidim/data_portability_exporter"
   autoload :Amendable, "decidim/amendable"
   autoload :Gamification, "decidim/gamification"
   autoload :Hashtag, "decidim/hashtag"
-  autoload :Hashtaggable, "decidim/hashtaggable"
   autoload :Paddable, "decidim/paddable"
   autoload :OpenDataExporter, "decidim/open_data_exporter"
   autoload :IoEncoder, "decidim/io_encoder"
   autoload :HasResourcePermission, "decidim/has_resource_permission"
   autoload :PermissionsRegistry, "decidim/permissions_registry"
   autoload :Randomable, "decidim/randomable"
+  autoload :Endorsable, "decidim/endorsable"
+  autoload :ActionAuthorization, "decidim/action_authorization"
+  autoload :Map, "decidim/map"
+  autoload :Geocodable, "decidim/geocodable"
+  autoload :Snippets, "decidim/snippets"
+  autoload :OrganizationSettings, "decidim/organization_settings"
+  autoload :HasUploadValidations, "decidim/has_upload_validations"
+  autoload :FileValidatorHumanizer, "decidim/file_validator_humanizer"
+  autoload :ShareableWithToken, "decidim/shareable_with_token"
 
   include ActiveSupport::Configurable
   # Loads seeds from all engines.
@@ -131,9 +142,19 @@ module Decidim
   # the mails.
   config_accessor :mailer_sender
 
+  # Whether SSL should be enabled or not.
+  config_accessor :force_ssl do
+    true
+  end
+
   # Exposes a configuration option: The application available locales.
   config_accessor :available_locales do
-    %w(en ar ca de es es-MX es-PY eu fi-pl fi fr gl hu id it nl no pl pt pt-BR ru sv tr uk)
+    %w(en bg ar ca cs da de el eo es es-MX es-PY et eu fi-pl fi fr fr-CA ga gl hr hu id is it ja lt lv mt nl no pl pt pt-BR ro ru sk sl sr sv tr uk)
+  end
+
+  # Exposes a configuration option: The application default locale.
+  config_accessor :default_locale do
+    :en
   end
 
   # Exposes a configuration option: an array of symbols representing processors
@@ -153,14 +174,13 @@ module Decidim
     []
   end
 
-  # Exposes a configuration option: The application default locale.
-  config_accessor :default_locale do
-    :en
-  end
-
   # Exposes a configuration option: an object to configure geocoder
   config_accessor :geocoder
 
+  # Exposes a configuration option: an object to configure the mapping
+  # functionality. See Decidim::Map for more information.
+  config_accessor :maps
+
   # Exposes a configuration option: a custom method to generate references.
   # If overwritten, it should handle both component resources and participatory spaces.
   # Default: Calculates a unique reference for the model in
@@ -192,6 +212,11 @@ module Decidim
     end
   end
 
+  # Exposes a configuration option: the whitelist ips
+  config_accessor :system_accesslist_ips do
+    []
+  end
+
   # Exposes a configuration option: the currency unit
   config_accessor :currency_unit do
     "€"
@@ -202,17 +227,7 @@ module Decidim
     80
   end
 
-  # Exposes a configuration option: The maximum file size of an attachment.
-  config_accessor :maximum_attachment_size do
-    10.megabytes
-  end
-
-  # Exposes a configuration option: The maximum file size for user avatar images.
-  config_accessor :maximum_avatar_size do
-    5.megabytes
-  end
-
-  # The number of reports which an object can receive before hiding it
+  # The number of reports which a resource can receive before hiding it
   config_accessor :max_reports_before_hiding do
     3
   end
@@ -247,39 +262,82 @@ module Decidim
     2.days
   end
 
+  # Allow machine translations
+  config_accessor :enable_machine_translations do
+    false
+  end
+
+  # How long can a user remained logged in before the session expires
+  config_accessor :expire_session_after do
+    1.day
+  end
+
   # Exposes a configuration option: an object to configure Etherpad
-  config_accessor :etherpad
+  config_accessor :etherpad do
+    # {
+    #   server: <your url>,
+    #   api_key: <your key>,
+    #   api_version: <your version>
+    # }
+  end
 
   # A base path for the uploads. If set, make sure it ends in a slash.
   # Uploads will be set to `<base_path>/uploads/`. This can be useful if you
   # want to use the same uploads place for both staging and production
   # environments, but in different folders.
-  config_accessor :base_uploads_path
+  config_accessor :base_uploads_path do
+    nil
+  end
 
-  # Exposes a configuration option: an object to deliver SMS codes to users.
-  config_accessor :sms_gateway_service
+  # The name of the class to deliver SMS codes to users.
+  #
+  # Check the example in `decidim-verifications`.
+  config_accessor :sms_gateway_service do
+    # "MyGatewayClass"
+  end
 
-  # Exposes a configuration option: an object to generate a timestamp from a
-  # document
-  config_accessor :timestamp_service
+  # The name of the class used to generate a timestamp from a document.
+  #
+  # Check the example in `decidim-initiatives`
+  config_accessor :timestamp_service do
+    # "MyTimestampService"
+  end
 
-  # Exposes a configuration option: an object to process a pdf and add a
-  # signature to the document
-  config_accessor :pdf_signature_service
+  # The name of the class used to process a pdf and add a signature to the
+  # document.
+  #
+  # Check the example in `decidim-initiatives`
+  config_accessor :pdf_signature_service do
+    # "MyPDFSignatureService"
+  end
 
-  # Exposes a configuration option: Decidim::Exporters::CSV's default column separator
+  # The name of the class to translate user content.
+  #
+  config_accessor :machine_translation_service do
+    # "MyTranslationService"
+  end
+
+  # The Decidim::Exporters::CSV's default column separator
   config_accessor :default_csv_col_sep do
     ";"
   end
 
-  # Exposes a configuration option: An Array of Strings with the roles of a Decidim::User.
+  # Exposes a configuration option: HTTP_X_FORWADED_HOST header follow-up.
+  # If a caching system is in place, it can also allow cache and log poisoning attacks,
+  # allowing attackers to control the contents of caches and logs that could be used for other attacks.
+  config_accessor :follow_http_x_forwarded_host do
+    false
+  end
+
+  # The list of roles a user can have, not considering the space-specific roles.
   config_accessor :user_roles do
     %w(admin user_manager)
   end
 
-  # Exposes a configuration option: An Array of Strings that serve both as
-  # locale keys and values to construct the input collection in
+  # The list of visibility options for amendments. An Array of Strings that
+  # serve both as locale keys and values to construct the input collection in
   # Decidim::Amendment::VisibilityStepSetting::options.
+  #
   # This collection is used in Decidim::Admin::SettingsHelper to generate a
   # radio buttons collection input field form for a Decidim::Component
   # step setting :amendments_visibility.
@@ -287,6 +345,18 @@ module Decidim
     %w(all participants)
   end
 
+  # Exposes a configuration option: The maximum length for conversation
+  # messages.
+  config_accessor :maximum_conversation_message_length do
+    1_000
+  end
+
+  # Defines the name of the cookie used to check if the user allows Decidim to
+  # set cookies.
+  config_accessor :consent_cookie_name do
+    "decidim-cc"
+  end
+
   # Public: Registers a global engine. This method is intended to be used
   # by component engines that also offer unscoped functionality
   #
@@ -471,4 +541,33 @@ module Decidim
   def self.metrics_operation
     @metrics_operation ||= MetricOperation.new
   end
+
+  # Public: Returns the correct settings object for the given organization or
+  # the default settings object when the organization cannot be determined. The
+  # model to be passed to this method can be any model that responds to the
+  # `organization` method or the organization itself. If the given model is not
+  # an organization or does not respond to the organization method, returns the
+  # default organization settings.
+  #
+  # model - The target model for which to fetch the settings object, either an
+  #         organization or a model responding to the `organization` method.
+  #
+  def self.organization_settings(model)
+    organization = begin
+      if model.is_a?(Decidim::Organization)
+        model
+      elsif model.respond_to?(:organization)
+        model.organization
+      end
+    end
+    return Decidim::OrganizationSettings.defaults unless organization
+
+    Decidim::OrganizationSettings.for(organization)
+  end
+
+  def self.machine_translation_service_klass
+    return unless Decidim.enable_machine_translations
+
+    Decidim.machine_translation_service.to_s.safe_constantize
+  end
 end