decidim-core 0.24.3 → 0.25.0.rc1

data/app/cells/decidim/user_activity/show.erb

@@ -30,4 +30,3 @@
     <% end %>
   </div>
 </div>
-<%= javascript_include_tag "decidim/filters" %>

data/app/cells/decidim/user_conversation/conversation_header.erb

@@ -1,11 +1,11 @@
 <div class="conversation-header flex--cc absolutes">
   <div class="left center mr-s">
     <%= link_to decidim.profile_conversations_path(nickname: user.nickname), class: "card--list__data__icon card--list__data__icon--back" do %>
-      <%= icon "chevron-left", role: "img" %>
+      <%= icon "chevron-left", role: "img", aria_label: t("decidim.user_conversations.show.back") %>
     <% end %>
   </div>
   <%= link_to profile_path(user.nickname) do %>
-    <%= image_tag conversation_avatar, alt: t("decidim.author.avatar") %>
+    <%= image_tag conversation_avatar, alt: conversation_avatar_alt %>
   <% end %>
 
   <div class="ml-s">

data/app/cells/decidim/user_conversation/messages.erb

@@ -1,6 +1,6 @@
 <div class="conversation-chat<%= " conversation-chat--offset" if sender_is_user?(sender) %>">
   <%= link_to sender.personal_url do %>
-    <%= image_tag sender.avatar_url, alt: t("decidim.author.avatar") %>
+    <%= image_tag sender.attached_uploader(:avatar).url(host: current_organization.host), alt: t("decidim.author.avatar", name: decidim_sanitize(sender.name)) %>
   <% end %>
   <div>
     <% messages.each do |message| %>

data/app/cells/decidim/user_conversation_cell.rb

@@ -6,6 +6,7 @@ module Decidim
     include Decidim::LayoutHelper
     include Decidim::ApplicationHelper
     include Decidim::FormFactory
+    include Decidim::SanitizeHelper
     include Decidim::Core::Engine.routes.url_helpers
     include Messaging::ConversationHelper
 
@@ -38,9 +39,17 @@ module Decidim
 
     def conversation_avatar
       if interlocutors.count == 1
-        interlocutors.first.avatar_url
+        present(interlocutors.first).avatar_url
       else
-        current_user.avatar.default_multiuser_url
+        present(current_user).avatar.default_multiuser_url
+      end
+    end
+
+    def conversation_avatar_alt
+      if interlocutors.count == 1
+        t("decidim.author.avatar", name: decidim_sanitize(interlocutors.first.name))
+      else
+        t("decidim.author.avatar_multiuser")
       end
     end
 

data/app/cells/decidim/user_conversations/add_conversation_users.erb

@@ -12,7 +12,6 @@
             class="js-multiple-mentions mentions__container"
             placeholder="<%= t("decidim.user_conversations.index.add_users_placeholder") %>"
             data-noresults="<%= t("decidim.user_conversations.index.no_results") %>"
-            data-tribute="yes"
             contenteditable="true"
             data-direct-messages-disabled="<%= t("decidim.user_conversations.index.participant_with_disabled_message_reception") %>"
             aria-expanded="false">

data/app/cells/decidim/user_conversations/conversation_item.erb

@@ -3,7 +3,7 @@
     <li class="card-data__item">
       <div class="card__link text-center">
         <div class="user-header__avatar">
-          <%= image_tag conversation_avatar(conversation), alt: t("decidim.author.avatar") %>
+          <%= image_tag conversation_avatar(conversation), alt: conversation_avatar_alt(conversation) %>
         </div>
         <span class="text-medium mt-xs"><%= Date::ABBR_DAYNAMES[conversation.created_at.wday] %> <%= conversation.created_at.wday %></span>
       </div>

data/app/cells/decidim/user_conversations/show.erb

@@ -36,7 +36,6 @@
             </div>
           <% end %>
     </div>
-    <%= javascript_include_tag "decidim/start_conversation_dialog" %>
   </div>
   <div class="columns">
       <% if conversations.empty? %>

data/app/cells/decidim/user_conversations_cell.rb

@@ -4,10 +4,12 @@ module Decidim
   class UserConversationsCell < Decidim::ViewModel
     include Cell::ViewModel::Partial
     include Decidim::LayoutHelper
+    include Decidim::SanitizeHelper
     include CellsPaginateHelper
     include Decidim::Core::Engine.routes.url_helpers
     include Messaging::ConversationHelper
     include ActionView::Helpers::DateHelper
+    include Decidim::ApplicationHelper
 
     def user
       model
@@ -26,9 +28,15 @@ module Decidim
     end
 
     def conversation_avatar(conversation)
-      return user.avatar.default_multiuser_url unless conversation.interlocutors(user).count == 1
+      return present(user).avatar.default_multiuser_url unless conversation.interlocutors(user).count == 1
 
-      conversation.interlocutors(user).first.avatar_url
+      present(conversation.interlocutors(user).first).avatar_url
+    end
+
+    def conversation_avatar_alt(conversation)
+      return t("decidim.author.avatar_multiuser") unless conversation.interlocutors(user).count == 1
+
+      t("decidim.author.avatar", name: decidim_sanitize(conversation.interlocutors(user).first.name))
     end
 
     def conversation_interlocutors(conversation)

data/app/cells/decidim/user_profile/unlinked_user_data.erb

@@ -2,12 +2,12 @@
   <div class="author-data__main">
     <div class="author author--flex">
       <span class="author__avatar">
-        <%= image_tag avatar, alt: t("avatar", scope: "activemodel.attributes.group") %>
+        <%= image_tag avatar, alt: t("decidim.author.avatar", name: decidim_sanitize(name)) %>
       </span>
       <div>
         <div class="author__name--container">
-          <span class="author__name"><%= name %></span>
-          <%= icon badge, class: "author__verified" if badge.present? %>
+          <span class="author__name"><%= decidim_sanitize(name) %></span>
+          <%= icon badge, class: "author__verified", role: "img", "aria-hidden": true if badge.present? %>
         </div>
         <span class="author__nickname"><%= nickname %></span>
       </div>

data/app/cells/decidim/user_profile/user_data.erb

@@ -2,12 +2,12 @@
   <div class="author-data__main">
     <div class="author author--flex">
       <%= link_to resource_path, class: "author__avatar" do %>
-        <%= image_tag avatar, alt: t("avatar", scope: "activemodel.attributes.group") %>
+        <%= image_tag avatar, alt: t("decidim.author.avatar", name: decidim_sanitize(name)) %>
       <% end %>
       <div>
         <div class="author__name--container">
-          <%= link_to name, resource_path, class: "author__name" %>
-          <%= icon badge, class: "author__verified" if badge.present? %>
+          <%= link_to decidim_sanitize(name), resource_path, class: "author__name" %>
+          <%= icon badge, class: "author__verified", role: "img", "aria-hidden": true if badge.present? %>
         </div>
         <%= link_to nickname, resource_path, class: "author__nickname" %>
       </div>

data/app/cells/decidim/user_profile_cell.rb

@@ -23,6 +23,7 @@ module Decidim
 
     delegate :nickname, to: :presented_resource
     delegate :name, to: :presented_resource
+    delegate :organization, to: :presented_resource
     delegate :officialized?, to: :presented_resource
 
     delegate :badge, to: :presented_resource
@@ -32,7 +33,7 @@ module Decidim
     end
 
     def avatar
-      user.avatar_url(:big)
+      present(user).avatar_url(variant: :big, host: organization.host)
     end
 
     def presented_resource

data/app/cells/decidim/version_author/show.erb

@@ -1,17 +1,17 @@
 <div class="author-data__main">
   <div class="author author--inline">
-    <% if author.respond_to?(:avatar_url) %>
+    <% if author.respond_to?(:avatar) %>
       <span class="author__avatar author__avatar--small">
-        <%= image_tag author.avatar_url, alt: "author-avatar" %>
+        <%= image_tag present(author).avatar_url, alt: t("decidim.author.avatar", name: decidim_sanitize(author_name)) %>
       </span>
     <% end %>
     <span class="author__name">
       <% if author.try(:deleted?) %>
         <span class="label label--small label--basic">
-          <%= t(".deleted") %>
+          <%= t("decidim.version_author.show.deleted") %>
         </span>
       <% else %>
-        <%= author.try(:name) || author %>
+        <%= decidim_sanitize(author_name || author) %>
       <% end %>
     </span>
   </div>

data/app/cells/decidim/version_author_cell.rb

@@ -2,8 +2,19 @@
 
 module Decidim
   class VersionAuthorCell < Decidim::ViewModel
+    include Decidim::ApplicationHelper
+    include Decidim::SanitizeHelper
+
     def author
       model
     end
+
+    def author_name
+      return nil unless author
+      return author if author.is_a?(String)
+      return t("decidim.version_author.show.deleted") if author.deleted?
+
+      author.name
+    end
   end
 end

data/app/cells/decidim/versions_list_item/show.erb

@@ -14,7 +14,7 @@
   </div>
   <div class="card--list__data">
     <%= link_to version_path, class: "card--list__data__icon" do %>
-      <%= icon "chevron-right", role: "img", "aria-hidden": true %>
+      <%= icon "chevron-right", role: "img", aria_label: t("decidim.versions_list_item.back") %>
     <% end %>
   </div>
 </div>

data/app/commands/decidim/attachment_attributes_methods.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+module Decidim
+  # A module to deal with attributes associated with attachments allowing
+  # deletions with remove_attribute_name
+  module AttachmentAttributesMethods
+    private
+
+    # This method set the attributes to assign. The attribute is included if a
+    # value exists in the form or remove_[attribute_name] is true in the form
+    # (in this case the value is nil)
+    def attachment_attributes(*attrs)
+      attrs.each_with_object({}) do |attribute, attributes|
+        attributes[attribute] = form.send(attribute) if form.try("remove_#{attribute}") || form.send(attribute).present?
+      end
+    end
+  end
+end

data/app/commands/decidim/attachment_methods.rb

@@ -12,7 +12,8 @@ module Decidim
       @attachment = Attachment.new(
         title: { I18n.locale => @form.attachment.title },
         attached_to: attached_to,
-        file: @form.attachment.file # Define attached_to before this
+        file: @form.attachment.file, # Define attached_to before this
+        content_type: @form.attachment.file.content_type
       )
     end
 

data/app/commands/decidim/create_follow.rb

@@ -32,7 +32,10 @@ module Decidim
     attr_reader :follow, :form, :current_user
 
     def create_follow!
-      @follow = Follow.create!(
+      @follow = Follow.find_by(
+        followable: form.followable,
+        user: current_user
+      ) || Follow.create!(
         followable: form.followable,
         user: current_user
       )

data/app/commands/decidim/create_omniauth_registration.rb

@@ -66,7 +66,12 @@ module Decidim
         @user.email_on_notification = true
         @user.password = generated_password
         @user.password_confirmation = generated_password
-        @user.remote_avatar_url = form.avatar_url if form.avatar_url.present?
+        if form.avatar_url.present?
+          url = URI.parse(form.avatar_url)
+          filename = File.basename(url.path)
+          file = URI.open(url)
+          @user.avatar.attach(io: file, filename: filename)
+        end
         @user.skip_confirmation! if verified_email
       end
 

data/app/commands/decidim/destroy_account.rb

@@ -39,7 +39,7 @@ module Decidim
       @user.admin = false if @user.admin?
       @user.deleted_at = Time.current
       @user.skip_reconfirmation!
-      @user.remove_avatar!
+      @user.avatar.purge
       @user.save!
     end
 

data/app/commands/decidim/gallery_methods.rb

@@ -14,7 +14,8 @@ module Decidim
         @gallery << Attachment.new(
           title: { I18n.locale => photo.original_filename },
           attached_to: attached_to || gallery_attached_to,
-          file: photo # Define attached_to before this
+          file: photo, # Define attached_to before this
+          content_type: photo.content_type
         )
       end
     end

data/app/commands/decidim/messaging/start_conversation.rb

@@ -18,7 +18,7 @@ module Decidim
       #
       # Returns nothing.
       def call
-        return broadcast(:invalid) if form.invalid?
+        return broadcast(:invalid, form.errors.full_messages) if form.invalid?
 
         if conversation.save
           notify_interlocutors
@@ -26,7 +26,7 @@ module Decidim
 
           broadcast(:ok, conversation)
         else
-          broadcast(:invalid)
+          broadcast(:invalid, conversation.errors.full_messages)
         end
       end
 

data/app/commands/decidim/multiple_attachments_methods.rb

@@ -10,7 +10,8 @@ module Decidim
         @documents << Attachment.new(
           title: { I18n.locale => file.original_filename },
           attached_to: @attached_to || documents_attached_to,
-          file: file
+          file: file,
+          content_type: file.content_type
         )
       end
     end

data/app/commands/decidim/update_account.rb

@@ -32,6 +32,7 @@ module Decidim
     private
 
     def update_personal_data
+      @user.locale = @form.locale
       @user.name = @form.name
       @user.nickname = @form.nickname
       @user.email = @form.email
@@ -40,8 +41,11 @@ module Decidim
     end
 
     def update_avatar
-      @user.avatar = @form.avatar
-      @user.remove_avatar = @form.remove_avatar
+      if @form.avatar.present?
+        @user.avatar = @form.avatar
+      elsif @form.remove_avatar
+        @user.avatar = nil
+      end
     end
 
     def update_password

data/app/commands/decidim/update_user_group.rb

@@ -8,7 +8,6 @@ module Decidim
     # form - A form object with the params.
     # user_group - The user group to update
     def initialize(form, user_group)
-      form.avatar = user_group.avatar if form.avatar.blank?
       @form = form
       @user_group = user_group
     end
@@ -35,7 +34,7 @@ module Decidim
 
     def update_user_group
       user_group_attributes = attributes
-      user_group_attributes[:avatar] = form.avatar if form.avatar.present?
+      user_group_attributes.delete(:avatar) if form.avatar.blank?
       user_group.update(user_group_attributes)
     end
 

data/app/controllers/concerns/decidim/amendments_controller.rb

@@ -5,6 +5,7 @@ module Decidim
     include Decidim::ApplicationHelper
     include FormFactory
     helper Decidim::ResourceReferenceHelper
+    helper UserGroupHelper
 
     before_action :authenticate_user!
     helper_method :amendment, :amendable, :emendation, :similar_emendations

data/app/controllers/concerns/decidim/force_authentication.rb

@@ -22,7 +22,6 @@ module Decidim
       # Next stop: Let's check whether auth is ok
       unless user_signed_in?
         flash[:warning] = t("actions.login_before_access", scope: "decidim.core")
-        store_location_for(:user, request.path)
         redirect_to decidim.new_user_session_path
       end
     end

data/app/controllers/concerns/decidim/impersonate_users.rb

@@ -56,16 +56,24 @@ module Decidim
       # Returns the managed user impersonated by an admin if exists
       def managed_user
         return unless can_impersonate_users?
+        return if impersonation_log.blank?
 
-        impersonation_log&.user
+        @managed_user ||= begin
+          impersonation_log.ensure_not_expired!
+          impersonation_log.user
+        end
       end
 
       # Check if the active impersonation session has expired or not.
       def check_impersonation_log_expired
-        return unless can_impersonate_users? && expired_log
+        # Prevent ajax requests to follow redirect
+        return if request && request.xhr?
+        # Prevent redirect on non-HTML responses, because we want redirect AFTER impersonation.js inits a reload.
+        return if request && request.negotiate_mime([Mime[:html]]).blank?
+        return unless can_impersonate_users?
+        return unless expired_log
 
-        expired_log.ended_at = Time.current
-        expired_log.save!
+        expired_log.update!(ended_at: Time.current)
         flash[:alert] = I18n.t("managed_users.expired_session", scope: "decidim")
         redirect_to decidim_admin.impersonatable_users_path
       end

data/app/controllers/concerns/decidim/needs_permission.rb

@@ -25,6 +25,7 @@ module Decidim
       end
 
       def user_has_no_permission_referer
+        return unless user_signed_in?
         return if request.referer == request.original_url
 
         request.referer

data/app/controllers/decidim/account_controller.rb

@@ -23,7 +23,7 @@ module Decidim
                            end
 
           bypass_sign_in(current_user)
-          redirect_to account_path
+          redirect_to account_path(locale: current_user.reload.locale)
         end
 
         on(:invalid) do
@@ -59,7 +59,7 @@ module Decidim
     private
 
     def account_params
-      { avatar: current_user.avatar }.merge(params[:user].to_unsafe_h)
+      params[:user].to_unsafe_h
     end
   end
 end