decidim-core 0.23.5 → 0.24.2

data/app/uploaders/decidim/downloader.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+module Decidim
+  class Downloader < CarrierWave::Downloader::Base
+    def skip_ssrf_protection?(_uri)
+      true
+    end
+  end
+end

data/app/uploaders/decidim/image_uploader.rb

@@ -3,15 +3,13 @@
 module Decidim
   # This class deals with uploading hero images to ParticipatoryProcesses.
   class ImageUploader < ApplicationUploader
-    include CarrierWave::MiniMagick
-
     process :validate_size, :validate_dimensions, :strip
     process quality: Decidim.image_uploader_quality
 
     # CarrierWave automatically calls this method and validates the content
     # type fo the temp file to match against any of these options.
-    def content_type_whitelist
-      extension_whitelist.map { |ext| "image/#{ext}" }
+    def content_type_allowlist
+      extension_allowlist.map { |ext| "image/#{ext}" }
     end
 
     # Strips out all embedded information from the image
@@ -25,15 +23,12 @@ module Decidim
     # Fetches info about different versions, their processors and dimensions
     def dimensions_info
       if versions.any?
-        versions.map do |version, info|
-          [
-            version,
-            {
-              processor: info.processors[0][0],
-              dimensions: info.processors[0][1]
-            }
-          ]
-        end.to_h
+        versions.transform_values do |info|
+          {
+            processor: info.processors[0][0],
+            dimensions: info.processors[0][1]
+          }
+        end
       else
         processors.map do |info|
           [:default, { processor: info[0], dimensions: info[1] }]
@@ -43,7 +38,7 @@ module Decidim
 
     # Add a white list of extensions which are allowed to be uploaded.
     # For images you might use something like this:
-    def extension_whitelist
+    def extension_allowlist
       Decidim.organization_settings(model).upload_allowed_file_extensions_image
     end
 
@@ -69,13 +64,6 @@ module Decidim
       3840
     end
 
-    def manipulate!
-      super
-    rescue CarrierWave::ProcessingError => e
-      Rails.logger.error(e)
-      raise CarrierWave::ProcessingError, I18n.t("carrierwave.errors.general")
-    end
-
     private
 
     def validation_error!(text)

data/app/uploaders/decidim/open_data_uploader.rb

@@ -14,5 +14,10 @@ module Decidim
 
       default_path
     end
+
+    # Sets the validation that the associated model is always within an organization to true
+    def validate_inside_organization
+      true
+    end
   end
 end

data/app/uploaders/decidim/record_image_uploader.rb

@@ -4,11 +4,11 @@ module Decidim
   # This class deals with uploading record specific images that have more
   # limited content types than the defaults.
   class RecordImageUploader < ImageUploader
-    def content_type_whitelist
+    def content_type_allowlist
       %w(image/jpeg image/png)
     end
 
-    def extension_whitelist
+    def extension_allowlist
       %w(jpeg jpg png)
     end
   end

data/app/validators/etiquette_validator.rb

@@ -9,7 +9,6 @@ class EtiquetteValidator < ActiveModel::EachValidator
     validate_caps(record, attribute, value)
     validate_marks(record, attribute, value)
     validate_caps_first(record, attribute, value)
-    validate_length(record, attribute, value)
   end
 
   private
@@ -31,10 +30,4 @@ class EtiquetteValidator < ActiveModel::EachValidator
 
     record.errors.add(attribute, options[:message] || :must_start_with_caps)
   end
-
-  def validate_length(record, attribute, value)
-    return if value.length > 15
-
-    record.errors.add(attribute, options[:message] || :too_short)
-  end
 end

data/app/validators/uploader_content_type_validator.rb

@@ -4,6 +4,7 @@
 # content types. This prevents CarrierWave from uploading the records before
 # they pass the content type validations.
 class UploaderContentTypeValidator < ActiveModel::Validations::FileContentTypeValidator
+  # rubocop: disable Metrics/CyclomaticComplexity
   def validate_each(record, attribute, value)
     begin
       values = parse_values(value)
@@ -19,8 +20,8 @@ class UploaderContentTypeValidator < ActiveModel::Validations::FileContentTypeVa
     return unless uploader.is_a?(Decidim::ApplicationUploader)
 
     mode = option_value(record, :mode)
-    allowed_types = uploader.content_type_whitelist || []
-    forbidden_types = uploader.content_type_blacklist || []
+    allowed_types = uploader.content_type_allowlist || []
+    forbidden_types = uploader.content_type_denylist || []
 
     values.each do |val|
       val_mode = mode
@@ -39,6 +40,7 @@ class UploaderContentTypeValidator < ActiveModel::Validations::FileContentTypeVa
       validate_blacklist(record, attribute, content_type, forbidden_types)
     end
   end
+  # rubocop: enable Metrics/CyclomaticComplexity
 
   def check_validity!; end
 end

data/app/views/decidim/application/_document.html.erb

@@ -1,7 +1,7 @@
 <div class="card--list__item">
   <div class="card--list__text">
     <div>
-      <a href="<%= document.url %>" class="card__link">
+      <a href="<%= document.url %>" class="card__link" target="_blank">
         <h4 class="card--list__heading heading6">
           <%= attachment_title(document) %> <small><%= document.file_type %> <%= number_to_human_size(document.file_size) %></small>
         </h4>

data/app/views/decidim/block_user_mailer/notify.html.erb

@@ -0,0 +1,7 @@
+<p><%= t ".hello" %></p>
+
+<p><%= t ".body_1", organization_name: h(@organization.name) %></p>
+
+<p><%= t ".body_2", justification: h(@justification) %></p>
+
+<p><%= t(".greetings", organization_name: h(@organization.name), organization_url: decidim.root_url(host: @organization.host)).html_safe %></p>

data/app/views/decidim/devise/confirmations/new.html.erb

@@ -13,7 +13,7 @@
       <div class="card">
         <div class="card__content">
           <%= decidim_form_for(resource, namespace: "confirmation", as: resource_name, url: confirmation_path(resource_name), html: { method: :post, class: "register-form new_user" }) do |f| %>
-            <%= devise_error_messages! %>
+            <%= render "devise/shared/error_messages", resource: resource %>
 
             <div class="field">
               <%= f.email_field :email, autofocus: true, value: (resource.pending_reconfirmation? ? resource.unconfirmed_email : resource.email) %>

data/app/views/decidim/devise/registrations/edit.html.erb

@@ -1,7 +1,7 @@
 <h2><%= t("devise.registrations.edit.title", resource: resource_class.model_name.human) %></h2>
 
 <%= decidim_form_for(resource, namespace: "registration", as: resource_name, url: registration_path(resource_name), html: { method: :put }) do |f| %>
-  <%= devise_error_messages! %>
+  <%= render "devise/shared/error_messages", resource: resource %>
   <%= form_required_explanation %>
   <%= invisible_captcha %>
 

data/app/views/decidim/devise/unlocks/new.html.erb

@@ -13,7 +13,7 @@
         <div class="card">
           <div class="card__content">
             <%= decidim_form_for(resource, namespace: "unlock", as: resource_name, url: unlock_path(resource_name), html: { method: :post, class: "register-form new_user" }) do |f| %>
-              <%= devise_error_messages! %>
+              <%= render "devise/shared/error_messages", resource: resource %>
 
               <div class="field">
                 <%= f.email_field :email, autofocus: true, autocomplete: "email" %>

data/app/views/decidim/messaging/conversations/_conversation.html.erb

@@ -17,7 +17,7 @@
         <% if conversation.interlocutors(current_user).count == 1 %>
           <%= t("from", scope: "decidim.messaging.conversations.index") %>: <strong><%= conversation.interlocutors(current_user).first.name %> <span class="muted">@<%= conversation.interlocutors(current_user).first.nickname %></span></strong>
         <% else %>
-          <%= t("from", scope: "decidim.messaging.conversations.index") %>: <strong><%= username_list(conversation.interlocutors(current_user), true) %></strong>
+          <%= t("from", scope: "decidim.messaging.conversations.index") %>: <strong><%= username_list(conversation.interlocutors(current_user), shorten: true) %></strong>
         <% end %>
         <br>
         <span class="muted">

data/app/views/decidim/messaging/conversations/_messages.html.erb

@@ -1,5 +1,5 @@
 <div class="conversation-chat<%= " conversation-chat--offset" if sender_is_user?(sender) %>">
-  <%= link_to sender.personal_url do %>
+  <%= link_to profile_path(sender.nickname) do %>
     <%= image_tag sender.avatar_url, alt: t("decidim.author.avatar") %>
   <% end %>
   <div>

data/app/views/decidim/messaging/conversations/_show.html.erb

@@ -15,12 +15,12 @@
               <%= icon "chevron-left", role: "img", aria_label: t(".back") %>
             <% end %>
           </div>
-          <%= link_to decidim.conversations_path do %>
-            <% if participants.count == 1 %>
+          <% if participants.count == 1 %>
+            <%= link_to profile_path(participants.first.nickname) do %>
               <%= image_tag participants.first.avatar_url, alt: t("decidim.author.avatar") %>
-            <% else %>
-              <%= image_tag current_user.avatar.default_multiuser_url, alt: t("decidim.author.avatar") %>
             <% end %>
+          <% else %>
+            <%= image_tag current_user.avatar.default_multiuser_url, alt: t("decidim.author.avatar") %>
           <% end %>
 
           <div class="ml-s">

data/app/views/decidim/notifications_settings/show.html.erb

@@ -46,6 +46,17 @@
       </label>
     </div>
 
+    <% if @notifications_settings.user_is_moderator?(current_user) %>
+      <p><strong><%= t(".administrators") %></strong></p>
+      <div class="switch tiny switch-with-label email_on_moderations">
+        <label>
+          <%= f.check_box :email_on_moderations, label: false, class: "switch-input" %>
+          <span class="switch-paddle"></span>
+          <span class="switch-label"><%= t(".email_on_moderations") %></span>
+        </label>
+      </div>
+    <% end %>
+
     <%= f.submit t(".update_notifications_settings") %>
   <% end %>
 </div>

data/app/views/decidim/pages/_standalone.html.erb

@@ -15,7 +15,9 @@
         </div>
       </div>
 
-      <%= cell "decidim/tos_page", :form %>
+      <div class="columns small-12">
+        <%= cell "decidim/tos_page", :form %>
+      </div>
     </main>
   </div>
 </div>

data/app/views/decidim/reported_mailer/report.html.erb

@@ -10,7 +10,7 @@
 <p><%= l @report.created_at, format: :short %></p>
 
 <p><b><%= t(".participatory_space") %></b></p>
-<p><%= translated_attribute @participatory_space.title %></p>
+<p><%= link_to translated_attribute(@participatory_space.title), resource_locator(@participatory_space).url %></p>
 
 <p><b><%= t(".reason") %></b></p>
 <p><%= t(@report.reason, organization_name: @participatory_space.organization.name, scope: "decidim.shared.flag_modal") %></p>
@@ -22,20 +22,28 @@
   </blockquote>
 <% end %>
 
-<% if @content.present? %>
-  <p><b><%= t(".content") %></b></p>
-  <blockquote>
-    <h5><%= translated_attribute @content[:title] %></h5>
-    <p><%= translated_attribute @content[:body] %></p>
-  </blockquote>
+<% if @original_language.present? %>
+  <p><b><%= t(".content_original_language") %></b></p>
+  <p><%= I18n.t("locale.name", locale: @original_language) %></p>
 <% end %>
 
+<p><b><%= t(".content") %></b> (<%= t(".id") %>: <%= @reportable.id %>)</p>
+<%= reported_content_cell %>
+
 <% if @author.present? %>
   <p><b><%= t(".authors") %></b></p>
   <% if author_profile_url.present? %>
     <p><%= link_to @author.name, author_profile_url, target: :blank %></p>
   <% else %>
-    <p><%= @author.name %></p>
+    <p>
+      <%=
+        if @author.respond_to?(:name)
+          @author.name
+        elsif @author.respond_to?(:title)
+          translated_attribute(@author.title)
+        end
+      %>
+    </p>
   <% end %>
 <% end %>
 <br>
@@ -46,7 +54,7 @@
       <table>
         <tr>
           <td>
-            <%= link_to t(".manage_moderations"), manage_moderations_url, class: "button",  target: "_blank" %>
+            <%= link_to t(".see_report"), report_url, class: "button",  target: "_blank" %>
           </td>
         </tr>
       </table>

data/app/views/decidim/searches/_filters_small_view.html.erb

@@ -13,6 +13,6 @@
     </button>
   </div>
   <div class="filters">
-    <%= render partial: "filters" %>
+    <%= render partial: "filters", locals: { type: :small } %>
   </div>
 </div>

data/app/views/decidim/shared/_check_boxes_tree.html.erb

@@ -12,10 +12,10 @@
                        check_boxes_tree_options(
                          collection.leaf.value,
                          collection.leaf.label,
-                         {
+                         **({
                            "data-checkboxes-tree": data_checkboxes_tree_id,
                            is_root_check_box: is_root_check_box
-                         }.merge(options)),
+                         }.merge(options))),
                          collection.leaf.value.to_s, nil %>
 
     <% unless is_root_check_box %>
@@ -46,7 +46,7 @@
                                 check_boxes_tree_options(
                                   item.value,
                                   item.label,
-                                  options
+                                  **options
                                 ),
                                 item.value, nil %>
           <% end %>

data/app/views/decidim/shared/_component_announcement.html.erb

@@ -1,5 +1,5 @@
 <% if translated_attribute(current_settings.announcement).present? %>
-  <%= render partial: "decidim/shared/announcement", locals: { announcement: current_settings.announcement } %>
+  <%= cell("decidim/announcement", current_settings.announcement) %>
 <% elsif translated_attribute(component_settings.announcement).present? %>
-  <%= render partial: "decidim/shared/announcement", locals: { announcement: component_settings.announcement } %>
+  <%= cell("decidim/announcement", component_settings.announcement) %>
 <% end %>

data/app/views/decidim/shared/participatory_space_filters/_filters.html.erb

@@ -1,6 +1,6 @@
 <%= filter_form_for filter do |form| %>
   <div class="columns mediumlarge-6 large-5">
-    <%= scopes_picker_filter form, :scope_id, checkboxes_on_top %>
+    <%= scopes_picker_filter form, :scope_id, checkboxes_on_top: checkboxes_on_top %>
   </div>
   <div class="columns mediumlarge-6 large-5">
     <%= form.areas_select :area_id,

data/app/views/decidim/user_report_mailer/notify.html.erb

@@ -0,0 +1,7 @@
+<p><%= t ".hello", admin: h(@admin.name) %></p>
+
+<p><%= t ".body_1", user: h(@user.name), token: h(@token.name) %></p>
+
+<p><%= t ".body_2", reason: h(@reason) %></p>
+
+<p><%= t(".greetings", organization_name: h(@organization.name), organization_url: decidim.root_url(host: @organization.host)).html_safe %></p>

data/app/views/decidim/widgets/_data_picker.html.erb

@@ -1,6 +1,6 @@
 <div id="<%= picker_options[:id] %>" class="data-picker <%= picker_options[:class] %>" data-picker-name="<%= picker_options[:name] %>">
   <div class="picker-values"><% items.each do |item, params| %>
-    <div><a href="<%= params[:url] %>" data-picker-value="<%= item.id %>"><%= params[:text] %></a></div>
+    <div><a href="<%= params[:url] %>" class="label primary" data-picker-value="<%= item.id %>"><span aria-hidden="true">×</span> <%= params[:text] %></a></div>
   <% end %></div>
   <div class="picker-prompt"><a href="<%= prompt_params[:url] %>"><%= prompt_params[:text] %></a></div>
 </div>

data/app/views/layouts/decidim/_application.html.erb

@@ -21,6 +21,7 @@
     <%= render partial: "layouts/decidim/impersonation_warning" %>
     <%= render partial: "layouts/decidim/cookie_warning" %>
     <%= render partial: "layouts/decidim/omnipresent_banner" %>
+    <%= render partial: "layouts/decidim/timeout_modal" %>
 
     <%= render "layouts/decidim/wrapper" do %>
       <%= yield %>

data/app/views/layouts/decidim/_js_configuration.html.erb

@@ -10,7 +10,7 @@ js_configs = {
 }
 character_messages = {
   "charactersAtLeast": {
-    one: t("forms.length_validator.minimum.one", count: "%count%"),
+    one: t("forms.length_validator.minimum.one", count: "%count%", default: "forms.length_validator.minimum.other"),
     other: t("forms.length_validator.minimum.other", count: "%count%")
   },
   "charactersLeft": {

data/app/views/layouts/decidim/_main_footer.html.erb

@@ -8,14 +8,16 @@
     <div class="medium-8 large-6 large-offset-3 column">
       <nav class="main__footer__nav">
         <ul class="footer-nav">
-          <% if current_organization.static_pages.any? %>
+          <% organization_pages = current_organization.static_pages_accessible_for(current_user) %>
+          <% if organization_pages.any? %>
             <% current_organization.static_page_topics.where(show_in_footer: true).each do |page_topic| %>
-              <% if page_topic.pages.any? %>
-                <li><%= link_to translated_attribute(page_topic.title), decidim.page_path(page_topic.pages.first) %></li>
+              <% topic_pages = page_topic.accessible_pages_for(current_user) %>
+              <% if topic_pages.any? %>
+                <li><%= link_to translated_attribute(page_topic.title), decidim.page_path(topic_pages.first) %></li>
               <% end %>
             <% end %>
 
-            <% current_organization.static_pages.where(show_in_footer: true).each do |page| %>
+            <% organization_pages.where(show_in_footer: true).each do |page| %>
               <li><%= link_to translated_attribute(page.title), decidim.page_path(page) %></li>
             <% end %>
           <% end %>

data/app/views/layouts/decidim/_timeout_modal.html.erb

@@ -0,0 +1,21 @@
+<% if current_user %>
+  <% timeout_time_seconds = Devise.timeout_in.to_i %>
+  <div class="reveal" id="timeoutModal" data-close-on-click="false" data-close-on-esc="false"
+    data-seconds-until-timeout-path="<%= decidim.seconds_until_timeout_path %>"
+    data-session-timeout="<%= timeout_time_seconds %>"
+    data-session-timeouter-interval="<%= Decidim.config.session_timeouter_interval %>" data-reveal>
+    <h2><%= t(".title") %></h2>
+    <p><%= t(".body", minutes: (timeout_time_seconds / 60) - 2) %></p>
+
+    <div class="reveal__buttons">
+      <%= link_to t(".sign_out"), decidim.destroy_user_session_path, method: :delete, class: "button warning" %>
+      <%= link_to "", decidim.destroy_user_session_path(translation_suffix: :timed_out), method: :delete, id: "reveal-hidden-sign-out", class: "hide" %>
+      <%= button_to t(".continue_session"),
+        decidim.heartbeat_path,
+        id: "continueSession",
+        class: "button primary",
+        remote: true,
+        method: :post %>
+    </div>
+  </div>
+<% end %>