decidim-core 0.23.6 → 0.24.0.rc1

data/app/controllers/decidim/report_users_controller.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+module Decidim
+  class ReportUsersController < ApplicationController
+    include FormFactory
+    include NeedsPermission
+
+    before_action :authenticate_user!
+
+    def create
+      enforce_permission_to :create, :user_report
+
+      @form = form(Decidim::ReportForm).from_params(params)
+
+      CreateUserReport.call(@form, reportable, current_user) do
+        on(:ok) do
+          flash[:notice] = I18n.t("decidim.reports.create.success")
+          redirect_back fallback_location: root_path
+        end
+
+        on(:invalid) do
+          flash[:alert] = I18n.t("decidim.reports.create.error")
+          redirect_back fallback_location: root_path
+        end
+      end
+    end
+
+    private
+
+    def reportable
+      @reportable ||= GlobalID::Locator.locate_signed params[:sgid]
+    end
+
+    def permission_class_chain
+      [Decidim::ReportUserPermissions, Decidim::Permissions]
+    end
+
+    def permission_scope
+      :public
+    end
+  end
+end

data/app/controllers/decidim/scopes_controller.rb

@@ -8,17 +8,10 @@ module Decidim
     def picker
       enforce_permission_to :pick, :scope
 
-      context = root ? { root: root.id, title: title, max_depth: max_depth } : { title: title, max_depth: max_depth }
-      required = params[:required] && params[:required] != "false"
+      context = picker_context(root, title, max_depth)
+      required = params&.[](:required) != "false"
 
-      if current
-        scopes = current.children unless scope_depth_limit?
-        parent_scopes = current.part_of_scopes(root)
-      else
-        scopes = root&.children || current_organization.scopes.top_level unless scope_depth_limit?
-
-        parent_scopes = [root].compact
-      end
+      scopes, parent_scopes = resolve_picker_scopes(root, current)
 
       render(
         :picker,
@@ -40,6 +33,22 @@ module Decidim
 
     private
 
+    def picker_context(root, title, max_depth)
+      root ? { root: root.id, title: title, max_depth: max_depth } : { title: title, max_depth: max_depth }
+    end
+
+    def resolve_picker_scopes(root, current)
+      scopes = nil
+      if current
+        scopes = current.children unless scope_depth_limit?
+        parent_scopes = current.part_of_scopes(root)
+      else
+        scopes = root&.children || current_organization.scopes.top_level unless scope_depth_limit?
+        parent_scopes = [root].compact
+      end
+      [scopes, parent_scopes]
+    end
+
     def title
       @title ||= params[:title] || t("decidim.scopes.picker.title", field: params[:field]&.downcase)
     end

data/app/controllers/decidim/timeouts_controller.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+require "active_support/concern"
+
+module Decidim
+  # Tells/Extends time before inactivity warning or automatic logout.
+  class TimeoutsController < Decidim::ApplicationController
+    prepend_before_action :skip_timeout, only: :seconds_until_timeout
+
+    def skip_timeout
+      request.env["devise.skip_timeoutable"] = true
+    end
+
+    def seconds_until_timeout
+      time_remaining = current_user ? ::Devise.timeout_in - (Time.current - Time.zone.at(user_session["last_request_at"])) : 0
+      respond_to do |format|
+        format.json { render json: { seconds_remaining: time_remaining.to_i }, status: :ok }
+      end
+    end
+
+    # If user wants to continue session after inactivity warning.
+    def heartbeat
+      respond_to do |format|
+        format.js
+      end
+    end
+  end
+end

data/app/controllers/decidim/user_activities_controller.rb

@@ -6,10 +6,15 @@ module Decidim
     include Paginable
     include UserGroups
     include FilterResource
+    include Flaggable
 
     helper Decidim::ResourceHelper
     helper_method :activities, :resource_types, :user
 
+    def index
+      raise ActionController::RoutingError, "Blocked User" if user&.blocked? && !current_user&.admin?
+    end
+
     private
 
     def user

data/app/controllers/decidim/user_timeline_controller.rb

@@ -6,6 +6,7 @@ module Decidim
     include Paginable
     include UserGroups
     include FilterResource
+    include Flaggable
 
     helper Decidim::ResourceHelper
     helper_method :activities, :resource_types, :user

data/app/events/decidim/demoted_membership_event.rb

@@ -18,11 +18,11 @@ module Decidim
     end
 
     def user_group_nickname
-      extra.dig("user_group_nickname")
+      extra["user_group_nickname"]
     end
 
     def user_group_name
-      extra.dig("user_group_name")
+      extra["user_group_name"]
     end
   end
 end

data/app/events/decidim/invited_to_group_event.rb

@@ -23,11 +23,11 @@ module Decidim
     end
 
     def user_group_nickname
-      extra.dig("user_group_nickname")
+      extra["user_group_nickname"]
     end
 
     def user_group_name
-      extra.dig("user_group_name")
+      extra["user_group_name"]
     end
   end
 end

data/app/events/decidim/join_request_accepted_event.rb

@@ -18,11 +18,11 @@ module Decidim
     end
 
     def user_group_nickname
-      extra.dig("user_group_nickname")
+      extra["user_group_nickname"]
     end
 
     def user_group_name
-      extra.dig("user_group_name")
+      extra["user_group_name"]
     end
   end
 end

data/app/events/decidim/join_request_created_event.rb

@@ -18,11 +18,11 @@ module Decidim
     end
 
     def user_group_nickname
-      extra.dig("user_group_nickname")
+      extra["user_group_nickname"]
     end
 
     def user_group_name
-      extra.dig("user_group_name")
+      extra["user_group_name"]
     end
   end
 end

data/app/events/decidim/join_request_rejected_event.rb

@@ -18,11 +18,11 @@ module Decidim
     end
 
     def user_group_nickname
-      extra.dig("user_group_nickname")
+      extra["user_group_nickname"]
     end
 
     def user_group_name
-      extra.dig("user_group_name")
+      extra["user_group_name"]
     end
   end
 end

data/app/events/decidim/promoted_to_admin_event.rb

@@ -18,11 +18,11 @@ module Decidim
     end
 
     def user_group_nickname
-      extra.dig("user_group_nickname")
+      extra["user_group_nickname"]
     end
 
     def user_group_name
-      extra.dig("user_group_name")
+      extra["user_group_name"]
     end
   end
 end

data/app/events/decidim/removed_from_group_event.rb

@@ -18,11 +18,11 @@ module Decidim
     end
 
     def user_group_nickname
-      extra.dig("user_group_nickname")
+      extra["user_group_nickname"]
     end
 
     def user_group_name
-      extra.dig("user_group_name")
+      extra["user_group_name"]
     end
   end
 end

data/app/forms/decidim/account_form.rb

@@ -20,7 +20,7 @@ module Decidim
 
     validates :name, presence: true
     validates :email, presence: true, 'valid_email_2/email': { disposable: true }
-    validates :nickname, presence: true, format: Decidim::User::REGEXP_NICKNAME
+    validates :nickname, presence: true, format: /\A[\w\-]+\z/
 
     validates :nickname, length: { maximum: Decidim::User.nickname_max_length, allow_blank: true }
     validates :password, confirmation: true
@@ -37,7 +37,7 @@ module Decidim
     def personal_url
       return if super.blank?
 
-      return "http://" + super unless super.match?(%r{\A(http|https)://}i)
+      return "http://#{super}" unless super.match?(%r{\A(http|https)://}i)
 
       super
     end

data/app/forms/decidim/invite_user_form.rb

@@ -16,7 +16,7 @@ module Decidim
     validates :email, :name, :organization, :invitation_instructions, presence: true
     validates :role, inclusion: { in: Decidim::User::Roles.all }
 
-    validates :name, format: { with: /\A(?!.*[<>?%&\^*#@\(\)\[\]\=\+\:\;\"\{\}\\\|])/ }
+    validates :name, format: { with: /\A(?!.*[<>?%&\^*#@()\[\]=+:;"{}\\|])/ }
     validate :admin_uniqueness
 
     def email
@@ -43,7 +43,7 @@ module Decidim
     private
 
     def admin_uniqueness
-      errors.add(:email, :taken) if organization.admins.where(email: email).exists?
+      errors.add(:email, :taken) if organization.admins.exists?(email: email)
     end
   end
 end

data/app/forms/decidim/messaging/conversation_form.rb

@@ -6,7 +6,7 @@ module Decidim
     class ConversationForm < Decidim::Form
       mimic :conversation
 
-      attribute :body, String
+      attribute :body, Decidim::Attributes::CleanString
       attribute :recipient_id, Integer
 
       validates :body, :recipient, presence: true

data/app/forms/decidim/messaging/message_form.rb

@@ -6,7 +6,7 @@ module Decidim
     class MessageForm < Decidim::Form
       mimic :message
 
-      attribute :body, String
+      attribute :body, Decidim::Attributes::CleanString
 
       validates :body, presence: true
     end

data/app/forms/decidim/notifications_settings_form.rb

@@ -7,6 +7,7 @@ module Decidim
     mimic :user
 
     attribute :email_on_notification, Boolean
+    attribute :email_on_moderations, Boolean
     attribute :newsletter_notifications, Boolean
     attribute :notifications_from_followed, Boolean
     attribute :notifications_from_own_activity, Boolean
@@ -40,5 +41,24 @@ module Decidim
     def direct_message_types
       allow_public_contact ? "all" : "followed-only"
     end
+
+    def user_is_moderator?(user)
+      participatory_space_types.each do |participatory_space_type|
+        participatory_space_type.constantize.all.each do |participatory_space|
+          return true if participatory_space.moderators.include?(user)
+        end
+      end
+      false
+    end
+
+    private
+
+    def participatory_space_types
+      participatory_space_types = []
+      Decidim.participatory_space_manifests.each do |manifest|
+        participatory_space_types << manifest.model_class_name.to_s
+      end
+      participatory_space_types
+    end
   end
 end

data/app/forms/url_validator.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+# A custom validator to check that the field value is a URL.
+#
+#   validates :my_url, url: true
+#
+class UrlValidator < ActiveModel::EachValidator
+  def validate_each(record, attribute, value)
+    record.errors[attribute] << (options[:message] || "must be a valid URL") unless url_valid?(value)
+  end
+
+  # a URL may be technically well-formed but may
+  # not actually be valid, so this checks for both.
+  def url_valid?(url)
+    url = URI.parse(url)
+    (url.is_a?(URI::HTTP) || url.is_a?(URI::HTTPS)) && url.host.present?
+  rescue URI::InvalidURIError
+    false
+  end
+end

data/app/helpers/decidim/action_authorization_helper.rb

@@ -50,6 +50,7 @@ module Decidim
 
     private
 
+    # rubocop: disable Metrics/PerceivedComplexity
     def authorized_to(tag, action, arguments, block)
       if block
         body = block
@@ -85,6 +86,7 @@ module Decidim
         send("#{tag}_to", body, url, html_options)
       end
     end
+    # rubocop: enable Metrics/PerceivedComplexity
 
     def modal_path(action, resource)
       resource_params = if resource

data/app/helpers/decidim/application_helper.rb

@@ -7,7 +7,6 @@ module Decidim
     include Decidim::ScopesHelper
     include Decidim::ContextualHelpHelper
     include Decidim::AmendmentsHelper
-    include Decidim::CacheHelper
 
     # Truncates a given text respecting its HTML tags.
     #
@@ -23,7 +22,7 @@ module Decidim
       options[:tail] = options.delete(:separator) || options[:tail] || "..."
       options[:count_tags] ||= false
       options[:count_tail] ||= false
-      options[:tail_before_final_tag] ||= true
+      options[:tail_before_final_tag] = true unless options.has_key?(:tail_before_final_tag)
 
       Truncato.truncate(text, options)
     end
@@ -99,7 +98,6 @@ module Decidim
     # Renders the cell contents.
     def cell(name, model, options = {}, &block)
       options = { context: { current_user: current_user } }.deep_merge(options)
-
       super(name, model, options, &block)
     end
 

data/app/helpers/decidim/cells_helper.rb

@@ -33,5 +33,11 @@ module Decidim
 
       true
     end
+
+    def user_flaggable?
+      return unless context[:controller].try(:flaggable_controller?)
+
+      true
+    end
   end
 end

data/app/helpers/decidim/filters_helper.rb

@@ -29,6 +29,15 @@ module Decidim
       end
     end
 
+    def filter_cache_hash(filter)
+      hash = []
+      hash << "decidim/proposals/filters"
+      hash << I18n.locale.to_s
+      hash << Digest::MD5.hexdigest(filter.to_json)
+
+      hash.join("/")
+    end
+
     private
 
     # Creates a unique namespace for a filter form to prevent dupliacte IDs in

data/app/helpers/decidim/messaging/conversation_helper.rb

@@ -6,7 +6,7 @@ module Decidim
       #
       # Generates a visualization of users for listing conversations threads
       #
-      def username_list(users, shorten = false)
+      def username_list(users, shorten: false)
         return users.pluck(:name).join(", ") unless shorten
         return users.pluck(:name).join(", ") unless users.count > 3
 
@@ -29,6 +29,16 @@ module Decidim
         end
       end
 
+      #
+      # Same as #link_to_current_or_new_conversation_with, but with a text body instead of an icon
+      #
+      # Links to the conversation between the current user and another user
+      #
+      def text_link_to_current_or_new_conversation_with(user, body = t("decidim.profiles.show.send_private_message"))
+        conversation_path = current_or_new_conversation_path_with(user)
+        link_to body, conversation_path, title: body if conversation_path
+      end
+
       #
       # Finds the right path to the conversation the current user and another
       # user (the interlocutor).

data/app/helpers/decidim/newsletters_helper.rb

@@ -9,17 +9,15 @@ module Decidim
     # And replace "%{name}" on the subject or content of newsletter to the user Name
     # for example transform "%{name}" to "User Name"
     def parse_interpolations(content, user = nil, id = nil)
-      if Decidim.config.track_newsletter_links
-        if id.present? && user.present?
-          host = user.organization.host.to_s
-          campaign = "newsletter_#{id}"
+      if Decidim.config.track_newsletter_links && id.present? && user.present?
+        host = user.organization.host.to_s
+        campaign = "newsletter_#{id}"
 
-          links = content.scan(/href\s*=\s*"([^"]*)"/)
+        links = content.scan(/href\s*=\s*"([^"]*)"/)
 
-          links.each do |link|
-            link_replaced = link.first + utm_codes(host, campaign)
-            content = content.gsub(/href\s*=\s*"([^"]*#{link.first})"/, %(href="#{link_replaced}"))
-          end
+        links.each do |link|
+          link_replaced = link.first + utm_codes(host, campaign)
+          content = content.gsub(/href\s*=\s*"([^"]*#{link.first})"/, %(href="#{link_replaced}"))
         end
       end
 

data/app/helpers/decidim/scopes_helper.rb

@@ -67,7 +67,7 @@ module Decidim
     # checkboxes_on_top - Show picker values on top (default) or below the picker prompt (only for multiple pickers)
     #
     # Returns nothing.
-    def scopes_picker_filter(form, name, checkboxes_on_top = true)
+    def scopes_picker_filter(form, name, checkboxes_on_top: true)
       options = {
         multiple: true,
         legend_title: I18n.t("decidim.scopes.scopes"),

data/app/jobs/decidim/block_user_job.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module Decidim
+  class BlockUserJob < ApplicationJob
+    queue_as :block_user
+
+    def perform(user, justification)
+      BlockUserMailer.notify(user, justification).deliver_now
+    end
+  end
+end

data/app/jobs/decidim/export_job.rb

@@ -4,12 +4,12 @@ module Decidim
   class ExportJob < ApplicationJob
     queue_as :default
 
-    def perform(user, component, name, format)
+    def perform(user, component, name, format, resource_id = nil)
       export_manifest = component.manifest.export_manifests.find do |manifest|
         manifest.name == name.to_sym
       end
 
-      collection = export_manifest.collection.call(component, user)
+      collection = export_manifest.collection.call(component, user, resource_id)
       serializer = export_manifest.serializer
 
       export_data = Decidim::Exporters.find_exporter(format).new(collection, serializer).export

data/app/jobs/decidim/find_and_update_descendants_job.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+module Decidim
+  # Update search indexes for each descendants of a given element
+  class FindAndUpdateDescendantsJob < ApplicationJob
+    queue_as :default
+
+    def perform(element)
+      descendants_collector = components_for(element)
+      descendants_collector << element.comments.to_a if element.respond_to?(:comments)
+
+      return if descendants_collector.blank?
+
+      descendants_collector.each do |descendants|
+        next if descendants.blank?
+
+        Decidim::UpdateSearchIndexesJob.perform_later(descendants)
+      end
+    end
+
+    private
+
+    def manifest_name_to_class(name)
+      resource_registry = Decidim.resource_registry.find(name)
+      return if resource_registry.blank?
+
+      resource_registry.model_class_name&.safe_constantize
+    end
+
+    # returns array of components
+    # If element not responds to components, returns empty array
+    def components_for(element)
+      return [] unless element.respond_to?(:components) && !element.components.empty?
+
+      ary = []
+      element.components.each do |component|
+        klass = component.manifest_name == "blogs" ? Decidim::Blogs::Post : manifest_name_to_class(component.manifest_name)
+
+        next if klass.blank?
+        next if klass.column_names.exclude? "decidim_component_id"
+
+        ary << klass.where(component: component).to_a
+      end
+
+      ary
+    end
+  end
+end

data/app/jobs/decidim/machine_translation_resource_job.rb

@@ -8,6 +8,8 @@ module Decidim
   class MachineTranslationResourceJob < ApplicationJob
     queue_as :default
 
+    # rubocop: disable Metrics/CyclomaticComplexity
+
     # Performs the job.
     #
     # resource - Any kind of `Decidim::TranslatableResource` model instance
@@ -46,6 +48,7 @@ module Decidim
         end
       end
     end
+    # rubocop: enable Metrics/CyclomaticComplexity
 
     def default_locale_changed_or_translation_removed(previous_changes, field)
       default_locale = default_locale(@resource)

data/app/jobs/decidim/machine_translation_save_job.rb

@@ -28,6 +28,35 @@ module Decidim
         resource.update_column field_name.to_sym, resource[field_name]
         # rubocop:enable Rails/SkipsModelValidations
       end
+
+      send_translated_report_notifications(resource) if reported_resource_in_organization_language?(resource, target_locale)
+    end
+
+    private
+
+    def send_translated_report_notifications(reportable)
+      reportable.moderation.reports.each do |report|
+        reportable.moderation.participatory_space.moderators.each do |moderator|
+          Decidim::ReportedMailer.report(moderator, report).deliver_later
+        end
+      end
+    end
+
+    def reported_resource_in_organization_language?(resource, target_locale)
+      return unless resource.try(:organization)
+
+      resource_reported?(resource) && target_locale == resource.organization.default_locale && resource_completely_translated?(resource, target_locale)
+    end
+
+    def resource_reported?(resource)
+      resource.class.included_modules.include?(Decidim::Reportable) && resource.reported?
+    end
+
+    def resource_completely_translated?(resource, target_locale)
+      reported_translatable_fields = resource.reported_attributes & resource.class.translatable_fields_list
+      reported_translatable_fields.all? do |field|
+        resource[field]&.dig("machine_translations", target_locale).present?
+      end
     end
   end
 end

data/app/jobs/decidim/update_search_indexes_job.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module Decidim
+  class UpdateSearchIndexesJob < ApplicationJob
+    queue_as :default
+
+    def perform(elements)
+      elements.each { |element| element.try(:try_update_index_for_search_resource) }
+    end
+  end
+end

data/app/jobs/decidim/user_report_job.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module Decidim
+  class UserReportJob < ApplicationJob
+    queue_as :user_report
+
+    def perform(admin, token, reason, user)
+      UserReportMailer.notify(admin, token, reason, user).deliver_now
+    end
+  end
+end