decidim-core 0.24.0 → 0.25.0.rc1

data/app/controllers/concerns/decidim/impersonate_users.rb

@@ -56,16 +56,24 @@ module Decidim
       # Returns the managed user impersonated by an admin if exists
       def managed_user
         return unless can_impersonate_users?
+        return if impersonation_log.blank?
 
-        impersonation_log&.user
+        @managed_user ||= begin
+          impersonation_log.ensure_not_expired!
+          impersonation_log.user
+        end
       end
 
       # Check if the active impersonation session has expired or not.
       def check_impersonation_log_expired
-        return unless can_impersonate_users? && expired_log
+        # Prevent ajax requests to follow redirect
+        return if request && request.xhr?
+        # Prevent redirect on non-HTML responses, because we want redirect AFTER impersonation.js inits a reload.
+        return if request && request.negotiate_mime([Mime[:html]]).blank?
+        return unless can_impersonate_users?
+        return unless expired_log
 
-        expired_log.ended_at = Time.current
-        expired_log.save!
+        expired_log.update!(ended_at: Time.current)
         flash[:alert] = I18n.t("managed_users.expired_session", scope: "decidim")
         redirect_to decidim_admin.impersonatable_users_path
       end

data/app/controllers/concerns/decidim/needs_permission.rb

@@ -25,6 +25,7 @@ module Decidim
       end
 
       def user_has_no_permission_referer
+        return unless user_signed_in?
         return if request.referer == request.original_url
 
         request.referer

data/app/controllers/decidim/account_controller.rb

@@ -23,7 +23,7 @@ module Decidim
                            end
 
           bypass_sign_in(current_user)
-          redirect_to account_path
+          redirect_to account_path(locale: current_user.reload.locale)
         end
 
         on(:invalid) do
@@ -59,7 +59,7 @@ module Decidim
     private
 
     def account_params
-      { avatar: current_user.avatar }.merge(params[:user].to_unsafe_h)
+      params[:user].to_unsafe_h
     end
   end
 end

data/app/controllers/decidim/application_controller.rb

@@ -11,6 +11,7 @@ module Decidim
     include NeedsPermission
     include PayloadInfo
     include ImpersonateUsers
+    include HasStoredPath
     include NeedsTosAccepted
     include HttpCachingDisabler
     include ActionAuthorization
@@ -36,10 +37,6 @@ module Decidim
                          ::Decidim::Admin::Permissions,
                          ::Decidim::Permissions)
 
-    # Saves the location before loading each page so we can return to the
-    # right page.
-    before_action :store_current_location
-
     before_action :store_machine_translations_toggle
     helper_method :machine_translations_toggled?
 
@@ -52,18 +49,6 @@ module Decidim
 
     private
 
-    # Stores the url where the user will be redirected after login.
-    #
-    # Uses the `redirect_url` param or the current url if there's no param.
-    # In Devise controllers we only store the URL if it's from the params, we don't
-    # want to overwrite the stored URL for a Devise one.
-    def store_current_location
-      return if skip_store_location?
-
-      value = redirect_url || request.url
-      store_location_for(:user, value)
-    end
-
     # This overrides Devise's method for extracting the path from the URL. We
     # want to ensure the path to be stored in the cookie is not too long in
     # order to avoid ActionDispatch::Cookies::CookieOverflow exception. If the
@@ -97,21 +82,9 @@ module Decidim
       RequestStore.store[:toggle_machine_translations]
     end
 
-    def skip_store_location?
-      # Skip if Devise already handles the redirection
-      return true if devise_controller? && redirect_url.blank?
-      # Skip for all non-HTML requests"
-      return true unless request.format.html?
-      # Skip if a signed in user requests the TOS page without having agreed to
-      # the TOS. Most of the times this is because of a redirect to the TOS
-      # page (in which case the desired location is somewhere else after the
-      # TOS is agreed).
-      return true if current_user && !current_user.tos_accepted? && request.path == tos_path
-
-      false
-    end
-
     def user_has_no_permission_path
+      return decidim.new_user_session_path unless user_signed_in?
+
       decidim.root_path
     end
 

data/app/controllers/decidim/data_portability_controller.rb

@@ -25,24 +25,12 @@ module Decidim
     def download_file
       enforce_permission_to :download, :user, current_user: current_user
 
-      if data_portability_file_exists?
-        redirect_to uploader.url
+      if current_user.data_portability_file.attached?
+        redirect_to Rails.application.routes.url_helpers.rails_blob_url(current_user.data_portability_file.blob, only_path: true)
       else
         flash[:error] = t("decidim.account.data_portability_export.file_no_exists")
         redirect_to data_portability_path
       end
     end
-
-    private
-
-    def data_portability_file_exists?
-      uploader.file.exists?
-    rescue StandardError
-      false
-    end
-
-    def uploader
-      current_user.data_portability_file(params[:filename])
-    end
   end
 end

data/app/controllers/decidim/doorkeeper/credentials_controller.rb

@@ -28,7 +28,7 @@ module Decidim
       end
 
       def avatar_url
-        avatar_url = current_resource_owner.avatar_url
+        avatar_url = current_resource_owner.attached_uploader(:avatar).url(host: current_resource_owner.organization.host)
         return unless avatar_url
 
         unless %r{^https?://}.match? avatar_url

data/app/controllers/decidim/free_resource_authorization_modals_controller.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+module Decidim
+  class FreeResourceAuthorizationModalsController < Decidim::ApplicationController
+    helper_method :authorizations, :authorize_action_path
+    layout false
+
+    def show
+      render template: "decidim/authorization_modals/show"
+    end
+
+    private
+
+    def resource
+      @resource ||= if params[:resource_name] && params[:resource_id]
+                      manifest = Decidim.find_resource_manifest(params[:resource_name])
+                      manifest&.model_class&.find_by(id: params[:resource_id])
+                    end
+    end
+
+    def authorization_action
+      @authorization_action ||= params[:authorization_action]
+    end
+
+    def authorize_action_path(handler_name)
+      authorizations.status_for(handler_name).current_path(redirect_url: URI(request.referer).path)
+    end
+
+    def authorizations
+      @authorizations ||= action_authorized_to(authorization_action, resource: nil, permissions_holder: resource)
+    end
+  end
+end

data/app/controllers/decidim/links_controller.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+module Decidim
+  class InvalidUrlError < StandardError; end
+
+  class LinksController < Decidim::ApplicationController
+    skip_before_action :store_current_location
+
+    helper Decidim::ExternalDomainHelper
+
+    before_action :parse_url
+    rescue_from Decidim::InvalidUrlError, with: :invalid_url
+
+    def new
+      headers["X-Robots-Tag"] = "noindex"
+    end
+
+    private
+
+    def invalid_url
+      flash[:alert] = I18n.t("decidim.links.invalid_url")
+      redirect_to decidim.root_path
+    end
+
+    def parse_url
+      raise Decidim::InvalidUrlError unless external_url
+
+      parts = external_url.match %r{^(([a-z]+):)?//([^/]+)(/.*)?$}
+      raise Decidim::InvalidUrlError unless parts
+
+      @url_parts = {
+        protocol: parts[1],
+        domain: parts[3],
+        path: parts[4]
+      }
+    end
+
+    def external_url
+      @external_url ||= params[:external_url]
+    end
+  end
+end

data/app/controllers/decidim/messaging/conversations_controller.rb

@@ -46,8 +46,11 @@ module Decidim
             }
           end
 
-          on(:invalid) do
-            render json: { error: I18n.t("messaging.conversations.create.error", scope: "decidim") }, status: :unprocessable_entity
+          on(:invalid) do |messages|
+            render action: :error, locals: {
+              error: I18n.t("messaging.conversations.create.error", scope: "decidim"),
+              messages: messages
+            }, status: :unprocessable_entity
           end
         end
       end

data/app/controllers/decidim/open_data_controller.rb

@@ -3,8 +3,8 @@
 module Decidim
   class OpenDataController < Decidim::ApplicationController
     def download
-      if open_data_file_exists?
-        redirect_to uploader.url
+      if uploader.attached?
+        redirect_to uploader.path
       else
         schedule_open_data_generation
         flash[:alert] = t("decidim.open_data.not_available_yet")
@@ -14,14 +14,8 @@ module Decidim
 
     private
 
-    def open_data_file_exists?
-      uploader.file.exists?
-    rescue StandardError
-      false
-    end
-
     def uploader
-      current_organization.open_data_file
+      @uploader ||= Decidim::ApplicationUploader.new(current_organization, :open_data_file)
     end
 
     def schedule_open_data_generation

data/app/controllers/decidim/profiles_controller.rb

@@ -83,13 +83,7 @@ module Decidim
     def profile_holder
       return if params[:nickname].blank?
 
-      @profile_holder ||= Decidim::User.find_by(
-        nickname: params[:nickname],
-        organization: current_organization
-      ) || Decidim::UserGroup.find_by(
-        nickname: params[:nickname],
-        organization: current_organization
-      )
+      @profile_holder ||= Decidim::UserBaseEntity.find_by(nickname: params[:nickname], organization: current_organization)
     end
   end
 end

data/app/controllers/decidim/timeouts_controller.rb

@@ -5,14 +5,13 @@ require "active_support/concern"
 module Decidim
   # Tells/Extends time before inactivity warning or automatic logout.
   class TimeoutsController < Decidim::ApplicationController
-    prepend_before_action :skip_timeout, only: :seconds_until_timeout
+    # Skip these methods because they can call Devise's store_location_for, which can save timeouts path to session.
+    skip_before_action :store_current_location
 
-    def skip_timeout
-      request.env["devise.skip_timeoutable"] = true
-    end
+    prepend_before_action :skip_timeout, only: :seconds_until_timeout
 
     def seconds_until_timeout
-      time_remaining = current_user ? ::Devise.timeout_in - (Time.current - Time.zone.at(user_session["last_request_at"])) : 0
+      time_remaining = current_user ? Decidim.config.expire_session_after - (Time.current - Time.zone.at(user_session["last_request_at"])) : 0
       respond_to do |format|
         format.json { render json: { seconds_remaining: time_remaining.to_i }, status: :ok }
       end
@@ -24,5 +23,11 @@ module Decidim
         format.js
       end
     end
+
+    private
+
+    def skip_timeout
+      request.env["devise.skip_timeoutable"] = true
+    end
   end
 end

data/app/controllers/decidim/user_activities_controller.rb

@@ -26,6 +26,7 @@ module Decidim
         ActivitySearch.new(
           organization: current_organization,
           user: user,
+          current_user: current_user,
           resource_type: "all",
           resource_name: filter.resource_type
         ).run

data/app/forms/decidim/account_form.rb

@@ -8,19 +8,20 @@ module Decidim
 
     mimic :user
 
+    attribute :locale
     attribute :name
     attribute :nickname
     attribute :email
     attribute :password
     attribute :password_confirmation
     attribute :avatar
-    attribute :remove_avatar
+    attribute :remove_avatar, Boolean, default: false
     attribute :personal_url
     attribute :about
 
     validates :name, presence: true
     validates :email, presence: true, 'valid_email_2/email': { disposable: true }
-    validates :nickname, presence: true, format: /\A[\w\-]+\z/
+    validates :nickname, presence: true, format: Decidim::User::REGEXP_NICKNAME
 
     validates :nickname, length: { maximum: Decidim::User.nickname_max_length, allow_blank: true }
     validates :password, confirmation: true

data/app/forms/decidim/messaging/conversation_form.rb

@@ -9,7 +9,7 @@ module Decidim
       attribute :body, Decidim::Attributes::CleanString
       attribute :recipient_id, Integer
 
-      validates :body, :recipient, presence: true
+      validates :body, :recipient, presence: true, length: { maximum: Decidim.config.maximum_conversation_message_length }
       validate :check_recipient
 
       def recipient

data/app/forms/decidim/notifications_settings_form.rb

@@ -43,22 +43,11 @@ module Decidim
     end
 
     def user_is_moderator?(user)
-      participatory_space_types.each do |participatory_space_type|
-        participatory_space_type.constantize.all.each do |participatory_space|
-          return true if participatory_space.moderators.include?(user)
-        end
+      Decidim.participatory_space_manifests.map do |manifest|
+        participatory_space_type = manifest.model_class_name.constantize
+        return true if participatory_space_type.moderators(user.organization).exists?(id: user.id)
       end
       false
     end
-
-    private
-
-    def participatory_space_types
-      participatory_space_types = []
-      Decidim.participatory_space_manifests.each do |manifest|
-        participatory_space_types << manifest.model_class_name.to_s
-      end
-      participatory_space_types
-    end
   end
 end

data/app/forms/url_validator.rb

@@ -12,6 +12,8 @@ class UrlValidator < ActiveModel::EachValidator
   # a URL may be technically well-formed but may
   # not actually be valid, so this checks for both.
   def url_valid?(url)
+    return true if url.blank?
+
     url = URI.parse(url)
     (url.is_a?(URI::HTTP) || url.is_a?(URI::HTTPS)) && url.host.present?
   rescue URI::InvalidURIError

data/app/helpers/concerns/decidim/flash_helper_extensions.rb

@@ -19,9 +19,12 @@ module Decidim
       #
       # Returns a HTML string.
       def alert_box(value, alert_class, closable)
-        options = { class: "flash callout #{alert_class}" }
+        options = {
+          class: "flash callout #{alert_class}",
+          role: "alert",
+          aria: { atomic: "true" }
+        }
         options[:data] = { closable: "" } if closable
-        options[:role] = "alert"
         content_tag(:div, options) do
           concat value
           concat close_link if closable

data/app/helpers/decidim/action_authorization_helper.rb

@@ -64,13 +64,14 @@ module Decidim
 
       html_options ||= {}
       resource = html_options.delete(:resource)
+      permissions_holder = html_options.delete(:permissions_holder)
 
       if !current_user
         html_options = clean_authorized_to_data_open(html_options)
 
         html_options["data-open"] = "loginModal"
         url = "#"
-      elsif action && !action_authorized_to(action, resource: resource).ok?
+      elsif action && !action_authorized_to(action, resource: resource, permissions_holder: permissions_holder).ok?
         html_options = clean_authorized_to_data_open(html_options)
 
         html_options["data-open"] = "authorizationModal"
@@ -94,7 +95,11 @@ module Decidim
                         else
                           {}
                         end
-      decidim.authorization_modal_path(authorization_action: action, component_id: current_component.id, **resource_params)
+      if current_component.present?
+        decidim.authorization_modal_path(authorization_action: action, component_id: current_component&.id, **resource_params)
+      else
+        decidim.free_resource_authorization_modal_path(authorization_action: action, **resource_params)
+      end
     end
 
     def clean_authorized_to_data_open(html_options)