decidim-core 0.23.0 → 0.24.0.rc1

data/app/commands/decidim/gallery_methods.rb

@@ -39,13 +39,13 @@ module Decidim
       @gallery.map! do |photo|
         photo.attached_to = gallery_attached_to
         photo.save!
-        @form.photos << photo.id.to_s
+        @form.photos << photo
       end
     end
 
     def photo_cleanup!
       gallery_attached_to.photos.each do |photo|
-        photo.destroy! if @form.photos.exclude? photo.id.to_s
+        photo.destroy! if @form.photos.map(&:id).exclude? photo.id
       end
       # manually reset cached photos
       gallery_attached_to.reload

data/app/commands/decidim/multiple_attachments_methods.rb

@@ -16,26 +16,30 @@ module Decidim
     end
 
     def attachments_invalid?
-      @documents.each do |file|
-        if file.invalid? && file.errors.has_key?(:file)
-          @form.errors.add(:add_documents, file.errors[:file])
-          return true
+      @documents.each do |document|
+        next if document.valid? || !document.errors.has_key?(:file)
+
+        document.errors[:file].each do |error|
+          @form.errors.add(:add_documents, error)
         end
+
+        return true
       end
+
       false
     end
 
     def create_attachments
-      @documents.map! do |file|
-        file.attached_to = documents_attached_to
-        file.save!
-        @form.documents << file.id.to_s
+      @documents.map! do |document|
+        document.attached_to = documents_attached_to
+        document.save!
+        @form.documents << document
       end
     end
 
     def document_cleanup!
-      documents_attached_to.documents.each do |file|
-        file.destroy! if @form.documents.exclude? file.id.to_s
+      documents_attached_to.documents.each do |document|
+        document.destroy! if @form.documents.map(&:id).exclude? document.id
       end
 
       documents_attached_to.reload

data/app/commands/decidim/search.rb

@@ -82,8 +82,11 @@ module Decidim
     end
 
     def filtered_query_for(class_name)
-      query = SearchableResource.where(organization: organization, locale: I18n.locale)
-      query = query.where(resource_type: class_name)
+      query = SearchableResource.where(
+        organization: organization,
+        locale: I18n.locale,
+        resource_type: class_name
+      )
 
       clean_filters.each_pair do |attribute_name, value|
         query = query.where(attribute_name => value)

data/app/commands/decidim/update_notifications_settings.rb

@@ -28,6 +28,7 @@ module Decidim
       @user.newsletter_notifications_at = @form.newsletter_notifications_at
       @user.notification_types = @form.notification_types
       @user.direct_message_types = @form.direct_message_types
+      @user.email_on_moderations = @form.email_on_moderations
     end
   end
 end

data/app/commands/decidim/update_user_group.rb

@@ -8,6 +8,7 @@ module Decidim
     # form - A form object with the params.
     # user_group - The user group to update
     def initialize(form, user_group)
+      form.avatar = user_group.avatar if form.avatar.blank?
       @form = form
       @user_group = user_group
     end

data/app/controllers/concerns/decidim/devise_controllers.rb

@@ -19,6 +19,7 @@ module Decidim
       include NeedsPermission
       include Decidim::SafeRedirect
       include NeedsSnippets
+      include UserBlockedChecker
 
       helper Decidim::TranslationsHelper
       helper Decidim::MetaTagsHelper

data/app/controllers/concerns/decidim/flaggable.rb

@@ -10,11 +10,15 @@ module Decidim
     extend ActiveSupport::Concern
 
     included do
-      helper_method :flaggable_controller?
+      helper_method :flaggable_controller?, :report_form
 
       def flaggable_controller?
         true
       end
+
+      def report_form
+        Decidim::ReportForm.from_params(reason: "spam")
+      end
     end
   end
 end

data/app/controllers/concerns/decidim/force_authentication.rb

@@ -23,17 +23,25 @@ module Decidim
       unless user_signed_in?
         flash[:warning] = t("actions.login_before_access", scope: "decidim.core")
         store_location_for(:user, request.path)
-        return redirect_to decidim.new_user_session_path
+        redirect_to decidim.new_user_session_path
       end
     end
 
     # Check for all paths that should be allowed even if the user is not yet
     # authorized
     def allow_unauthorized_path?
-      # Changing the locale
-      return true if %r{^\/locale}.match?(request.path) || %r{^\/cookies}.match?(request.path)
+      return true if unauthorized_paths.any? { |path| /^#{path}/.match?(request.path) }
 
       false
     end
+
+    def unauthorized_paths
+      # /locale is for changing the locale
+      # /cookies is for accepting the cookies
+      %w(/locale /cookies) + Decidim::StaticPage.where(
+        organization: current_organization,
+        allow_public_access: true
+      ).pluck(Arel.sql("CONCAT('/pages/', slug)"))
+    end
   end
 end

data/app/controllers/concerns/decidim/locale_switcher.rb

@@ -69,6 +69,9 @@ module Decidim
         end
       end
 
+      # rubocop: disable Metrics/CyclomaticComplexity
+      # rubocop: disable Metrics/PerceivedComplexity
+
       # Finds a suitable language or returns nil
       # Follows the RFC 2616 rules with this particularities:
       # if no language matches, goes for the 2 chars prefixes
@@ -96,6 +99,8 @@ module Decidim
         end
         lang == "*" ? nil : lang
       end
+      # rubocop: enable Metrics/CyclomaticComplexity
+      # rubocop: enable Metrics/PerceivedComplexity
     end
   end
 end

data/app/controllers/concerns/decidim/needs_permission.rb

@@ -21,7 +21,13 @@ module Decidim
       # them they are not authorized.
       def user_has_no_permission
         flash[:alert] = t("actions.unauthorized", scope: "decidim.core")
-        redirect_to(request.referer || user_has_no_permission_path)
+        redirect_to(user_has_no_permission_referer || user_has_no_permission_path)
+      end
+
+      def user_has_no_permission_referer
+        return if request.referer == request.original_url
+
+        request.referer
       end
 
       def user_has_no_permission_path

data/app/controllers/concerns/decidim/orderable.rb

@@ -29,7 +29,9 @@ module Decidim
       # Returns: A random float number between -1 and 1 to be used as a
       # random seed at the database.
       def random_seed
-        @random_seed ||= session.fetch(:random_seed, (rand * 2 - 1)).to_f
+        @random_seed ||= begin
+          session[:random_seed] ||= rand * 2 - 1
+        end.to_f
       end
     end
   end

data/app/controllers/concerns/decidim/user_blocked_checker.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+require "active_support/concern"
+
+module Decidim
+  module UserBlockedChecker
+    extend ActiveSupport::Concern
+
+    included do
+      before_action :check_user_not_blocked
+    end
+
+    def check_user_not_blocked
+      check_user_block_status(current_user)
+    end
+
+    def check_user_block_status(user)
+      if user.present? && user.blocked?
+        sign_out user
+        flash.delete(:notice)
+        flash[:error] = t("decidim.account.blocked")
+        root_path
+      end
+    end
+  end
+end

data/app/controllers/decidim/application_controller.rb

@@ -17,6 +17,7 @@ module Decidim
     include ForceAuthentication
     include SafeRedirect
     include NeedsSnippets
+    include UserBlockedChecker
 
     helper Decidim::MetaTagsHelper
     helper Decidim::DecidimFormHelper
@@ -63,6 +64,27 @@ module Decidim
       store_location_for(:user, value)
     end
 
+    # This overrides Devise's method for extracting the path from the URL. We
+    # want to ensure the path to be stored in the cookie is not too long in
+    # order to avoid ActionDispatch::Cookies::CookieOverflow exception. If the
+    # session cookie (containing all the session data) is over 4 KB in length,
+    # it would lead to an exception if the cookie store is being used. This is
+    # a hard constraint set by ActionDispatch because some browsers do not allow
+    # cookies over 4 KB.
+    #
+    # Original code in Devise: https://git.io/Jt6wt
+    def extract_path_from_location(location)
+      path = super
+      return path unless Rails.application.config.session_store == ActionDispatch::Session::CookieStore
+
+      # Allow 3 KB size for the path because there can be also some other
+      # session variables out there.
+      return path if path.bytesize <= ActionDispatch::Cookies::MAX_COOKIE_SIZE - 1024
+
+      # For too long paths, remove the URL parameters
+      path.split("?").first
+    end
+
     # We store whether the user is requesting to toggle the translations or not.
     # We need to store it this way because if we use an instance variable, then
     # we're not able to access that value from inside the presenters, and we

data/app/controllers/decidim/devise/omniauth_registrations_controller.rb

@@ -46,7 +46,9 @@ module Decidim
       end
 
       def after_sign_in_path_for(user)
-        if !pending_redirect?(user) && first_login_and_not_authorized?(user)
+        if user.present? && user.blocked?
+          check_user_block_status(user)
+        elsif !pending_redirect?(user) && first_login_and_not_authorized?(user)
           decidim_verifications.authorizations_path
         else
           super

data/app/controllers/decidim/devise/sessions_controller.rb

@@ -6,19 +6,23 @@ module Decidim
     class SessionsController < ::Devise::SessionsController
       include Decidim::DeviseControllers
 
+      # rubocop: disable Rails/LexicallyScopedActionFilter
       before_action :check_sign_in_enabled, only: :create
-
-      def create
-        super
-      end
+      # rubocop: enable Rails/LexicallyScopedActionFilter
 
       def destroy
         current_user.invalidate_all_sessions!
-        super
+        if params[:translation_suffix].present?
+          super { set_flash_message! :notice, params[:translation_suffix], { scope: "decidim.devise.sessions" } }
+        else
+          super
+        end
       end
 
       def after_sign_in_path_for(user)
-        if first_login_and_not_authorized?(user) && !user.admin? && !pending_redirect?(user)
+        if user.present? && user.blocked?
+          check_user_block_status(user)
+        elsif first_login_and_not_authorized?(user) && !user.admin? && !pending_redirect?(user)
           decidim_verifications.first_login_authorizations_path
         else
           super

data/app/controllers/decidim/errors_controller.rb

@@ -2,7 +2,7 @@
 
 module Decidim
   class ErrorsController < Decidim::ApplicationController
-    skip_before_action :verify_authenticity_token
+    skip_before_action :verify_authenticity_token, :tos_accepted_by_user
     skip_after_action :verify_same_origin_request
 
     def not_found

data/app/controllers/decidim/locales_controller.rb

@@ -16,7 +16,7 @@ module Decidim
 
     def referer_with_new_locale
       uri = URI(request.referer || "/")
-      query = uri.query.to_s.gsub(/locale\=[a-zA-Z\-]{2,5}/, "")
+      query = uri.query.to_s.gsub(/locale=[a-zA-Z\-]{2,5}/, "")
       params = URI.decode_www_form(query) << ["locale", current_locale]
       uri.query = URI.encode_www_form(params)
 

data/app/controllers/decidim/profiles_controller.rb

@@ -4,6 +4,7 @@ module Decidim
   # The controller to handle the user's public profile page.
   class ProfilesController < Decidim::ApplicationController
     include UserGroups
+    include Flaggable
 
     helper Decidim::Messaging::ConversationHelper
 
@@ -12,6 +13,7 @@ module Decidim
     before_action :ensure_profile_holder
     before_action :ensure_profile_holder_is_a_group, only: [:members]
     before_action :ensure_profile_holder_is_a_user, only: [:groups, :following]
+    before_action :ensure_user_not_blocked, only: [:following, :followers, :badges]
 
     def show
       return redirect_to profile_timeline_path(nickname: params[:nickname]) if profile_holder == current_user
@@ -62,6 +64,10 @@ module Decidim
 
     private
 
+    def ensure_user_not_blocked
+      raise ActionController::RoutingError, "Blocked User" if profile_holder&.blocked? && !current_user&.admin?
+    end
+
     def ensure_profile_holder_is_a_group
       raise ActionController::RoutingError, "No user group with the given nickname" unless profile_holder.is_a?(Decidim::UserGroup)
     end

data/app/controllers/decidim/report_users_controller.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+module Decidim
+  class ReportUsersController < ApplicationController
+    include FormFactory
+    include NeedsPermission
+
+    before_action :authenticate_user!
+
+    def create
+      enforce_permission_to :create, :user_report
+
+      @form = form(Decidim::ReportForm).from_params(params)
+
+      CreateUserReport.call(@form, reportable, current_user) do
+        on(:ok) do
+          flash[:notice] = I18n.t("decidim.reports.create.success")
+          redirect_back fallback_location: root_path
+        end
+
+        on(:invalid) do
+          flash[:alert] = I18n.t("decidim.reports.create.error")
+          redirect_back fallback_location: root_path
+        end
+      end
+    end
+
+    private
+
+    def reportable
+      @reportable ||= GlobalID::Locator.locate_signed params[:sgid]
+    end
+
+    def permission_class_chain
+      [Decidim::ReportUserPermissions, Decidim::Permissions]
+    end
+
+    def permission_scope
+      :public
+    end
+  end
+end

data/app/controllers/decidim/scopes_controller.rb

@@ -8,17 +8,10 @@ module Decidim
     def picker
       enforce_permission_to :pick, :scope
 
-      context = root ? { root: root.id, title: title, max_depth: max_depth } : { title: title, max_depth: max_depth }
-      required = params[:required] && params[:required] != "false"
+      context = picker_context(root, title, max_depth)
+      required = params&.[](:required) != "false"
 
-      if current
-        scopes = current.children unless scope_depth_limit?
-        parent_scopes = current.part_of_scopes(root)
-      else
-        scopes = root&.children || current_organization.scopes.top_level unless scope_depth_limit?
-
-        parent_scopes = [root].compact
-      end
+      scopes, parent_scopes = resolve_picker_scopes(root, current)
 
       render(
         :picker,
@@ -40,6 +33,22 @@ module Decidim
 
     private
 
+    def picker_context(root, title, max_depth)
+      root ? { root: root.id, title: title, max_depth: max_depth } : { title: title, max_depth: max_depth }
+    end
+
+    def resolve_picker_scopes(root, current)
+      scopes = nil
+      if current
+        scopes = current.children unless scope_depth_limit?
+        parent_scopes = current.part_of_scopes(root)
+      else
+        scopes = root&.children || current_organization.scopes.top_level unless scope_depth_limit?
+        parent_scopes = [root].compact
+      end
+      [scopes, parent_scopes]
+    end
+
     def title
       @title ||= params[:title] || t("decidim.scopes.picker.title", field: params[:field]&.downcase)
     end

data/app/controllers/decidim/timeouts_controller.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+require "active_support/concern"
+
+module Decidim
+  # Tells/Extends time before inactivity warning or automatic logout.
+  class TimeoutsController < Decidim::ApplicationController
+    prepend_before_action :skip_timeout, only: :seconds_until_timeout
+
+    def skip_timeout
+      request.env["devise.skip_timeoutable"] = true
+    end
+
+    def seconds_until_timeout
+      time_remaining = current_user ? ::Devise.timeout_in - (Time.current - Time.zone.at(user_session["last_request_at"])) : 0
+      respond_to do |format|
+        format.json { render json: { seconds_remaining: time_remaining.to_i }, status: :ok }
+      end
+    end
+
+    # If user wants to continue session after inactivity warning.
+    def heartbeat
+      respond_to do |format|
+        format.js
+      end
+    end
+  end
+end