decidim-core 0.25.0 → 0.26.0.rc2

data/config/brakeman.ignore

@@ -0,0 +1,149 @@
+{
+  "ignored_warnings": [
+    {
+      "warning_type": "Cross-Site Scripting",
+      "warning_code": 2,
+      "fingerprint": "211ff4b5e0d738e40e3c7f6d27b6905f23b1ed4e20347c179af3df40f6e5694d",
+      "check_name": "CrossSiteScripting",
+      "message": "Unescaped model attribute",
+      "file": "app/views/decidim/messaging/conversations/_conversation.html.erb",
+      "line": 20,
+      "link": "https://brakemanscanner.org/docs/warning_types/cross_site_scripting",
+      "code": "username_list((Unresolved Model).new.interlocutors(current_user), :shorten => true)",
+      "render_path": [
+        {
+          "type": "template",
+          "name": "decidim/messaging/conversations/index",
+          "line": 25,
+          "file": "app/views/decidim/messaging/conversations/index.html.erb",
+          "rendered": {
+            "name": "decidim/messaging/conversations/_conversation",
+            "file": "app/views/decidim/messaging/conversations/_conversation.html.erb"
+          }
+        }
+      ],
+      "location": {
+        "type": "template",
+        "template": "decidim/messaging/conversations/_conversation"
+      },
+      "user_input": "(Unresolved Model).new.interlocutors(current_user)",
+      "confidence": "Weak",
+      "note": ""
+    },
+    {
+      "warning_type": "Cross-Site Scripting",
+      "warning_code": 4,
+      "fingerprint": "2c7f1da812b5d4b350d2260b604e9061ef082ecae90073ae09fe2eb46c1b9a08",
+      "check_name": "LinkToHref",
+      "message": "Unsafe parameter value in `link_to` href",
+      "file": "app/views/decidim/links/_modal.html.erb",
+      "line": 16,
+      "link": "https://brakemanscanner.org/docs/warning_types/link_to_href",
+      "code": "link_to(t(\"decidim.links.warning.proceed\"), params[:external_url], :target => \"_blank\", :data => ({ :close => \"\" }), :class => \"button primary button--nomargin\")",
+      "render_path": [
+        {
+          "type": "controller",
+          "class": "Decidim::LinksController",
+          "method": "new",
+          "line": 16,
+          "file": "app/controllers/decidim/links_controller.rb",
+          "rendered": {
+            "name": "decidim/links/new",
+            "file": "app/views/decidim/links/new.js.erb"
+          }
+        },
+        {
+          "type": "template",
+          "name": "decidim/links/new",
+          "line": 3,
+          "file": "app/views/decidim/links/new.js.erb",
+          "rendered": {
+            "name": "decidim/links/_modal",
+            "file": "app/views/decidim/links/_modal.html.erb"
+          }
+        }
+      ],
+      "location": {
+        "type": "template",
+        "template": "decidim/links/_modal"
+      },
+      "user_input": "params[:external_url]",
+      "confidence": "High",
+      "note": ""
+    },
+    {
+      "warning_type": "Cross-Site Scripting",
+      "warning_code": 2,
+      "fingerprint": "2d9910c9250df37f9cf9ddd225d4541ab9c411c61e74562b9a4b7b188e44cc47",
+      "check_name": "CrossSiteScripting",
+      "message": "Unescaped parameter value",
+      "file": "app/views/decidim/searches/index.js.erb",
+      "line": 5,
+      "link": "https://brakemanscanner.org/docs/warning_types/cross_site_scripting",
+      "code": "j(cell(\"decidim/search_results\", @sections, :params => (params)).show).strip",
+      "render_path": [
+        {
+          "type": "controller",
+          "class": "Decidim::SearchesController",
+          "method": "index",
+          "line": 15,
+          "file": "app/controllers/decidim/searches_controller.rb",
+          "rendered": {
+            "name": "decidim/searches/index",
+            "file": "app/views/decidim/searches/index.js.erb"
+          }
+        }
+      ],
+      "location": {
+        "type": "template",
+        "template": "decidim/searches/index"
+      },
+      "user_input": "params",
+      "confidence": "Weak",
+      "note": ""
+    },
+    {
+      "warning_type": "Cross-Site Scripting",
+      "warning_code": 2,
+      "fingerprint": "b46eb40178db883a8a9065d3affe7fb7868369084048fd88321f887d8618eea5",
+      "check_name": "CrossSiteScripting",
+      "message": "Unescaped parameter value",
+      "file": "app/views/decidim/messaging/conversations/_show.html.erb",
+      "line": 29,
+      "link": "https://brakemanscanner.org/docs/warning_types/cross_site_scripting",
+      "code": "t(\".title\", :usernames => username_list(form(ConversationForm).from_params(params, :sender => current_user).recipient.to_a))",
+      "render_path": [
+        {
+          "type": "controller",
+          "class": "Decidim::Messaging::ConversationsController",
+          "method": "new",
+          "line": 35,
+          "file": "app/controllers/decidim/messaging/conversations_controller.rb",
+          "rendered": {
+            "name": "decidim/messaging/conversations/new",
+            "file": "app/views/decidim/messaging/conversations/new.html.erb"
+          }
+        },
+        {
+          "type": "template",
+          "name": "decidim/messaging/conversations/new",
+          "line": 1,
+          "file": "app/views/decidim/messaging/conversations/new.html.erb",
+          "rendered": {
+            "name": "decidim/messaging/conversations/_show",
+            "file": "app/views/decidim/messaging/conversations/_show.html.erb"
+          }
+        }
+      ],
+      "location": {
+        "type": "template",
+        "template": "decidim/messaging/conversations/_show"
+      },
+      "user_input": "params",
+      "confidence": "Weak",
+      "note": ""
+    }
+  ],
+  "updated": "2021-12-22 09:55:40 +0000",
+  "brakeman_version": "5.1.2"
+}

data/config/initializers/devise.rb

@@ -88,7 +88,7 @@ Devise.setup do |config|
   # It will change confirmation, password recovery and other workflows
   # to behave the same regardless if the e-mail provided was right or wrong.
   # Does not affect registerable.
-  # config.paranoid = true
+  config.paranoid = true
 
   # By default Devise will store the user in session. You can skip storage for
   # particular strategies by setting this option.

data/config/initializers/rack_attack.rb

@@ -7,31 +7,33 @@ if Rails.env.production? || Rails.env.test?
     config.middleware.use Rack::Attack
   end
 
-  Rack::Attack.blocklist("block all access to system") do |request|
-    # Requests are blocked if the return value is truthy
-    if request.path.start_with?("/system")
-      Decidim.system_accesslist_ips.any? && Decidim.system_accesslist_ips.map { |ip_address| IPAddr.new(ip_address).include?(IPAddr.new(request.ip)) }.any?
+  ActiveSupport::Reloader.to_prepare do
+    Rack::Attack.blocklist("block all access to system") do |request|
+      # Requests are blocked if the return value is truthy
+      if request.path.start_with?("/system")
+        Decidim.system_accesslist_ips.any? && Decidim.system_accesslist_ips.map { |ip_address| IPAddr.new(ip_address).include?(IPAddr.new(request.ip)) }.any?
+      end
     end
-  end
 
-  unless Rails.env.test?
-    Rack::Attack.throttle(
-      "requests by ip",
-      limit: Decidim.throttling_max_requests,
-      period: Decidim.throttling_period,
-      &:ip
-    )
+    unless Rails.env.test?
+      Rack::Attack.throttle(
+        "requests by ip",
+        limit: Decidim.throttling_max_requests,
+        period: Decidim.throttling_period,
+        &:ip
+      )
 
-    # Throttle login attempts for a given email parameter to 6 reqs/minute
-    # Return the email as a discriminator on POST /users/sign_in requests
-    Rack::Attack.throttle("limit logins per email", limit: 5, period: 60.seconds) do |request|
-      request.params["user"]["email"] if request.path == "/users/sign_in" && request.post?
-    end
+      # Throttle login attempts for a given email parameter to 6 reqs/minute
+      # Return the email as a discriminator on POST /users/sign_in requests
+      Rack::Attack.throttle("limit logins per email", limit: 5, period: 60.seconds) do |request|
+        request.params["user"]["email"] if request.path == "/users/sign_in" && request.post?
+      end
 
-    # Throttle login attempts for a given email parameter to 6 reqs/minute
-    # Return the email as a discriminator on POST /users/sign_in requests
-    Rack::Attack.throttle("limit password recovery attempts per email", limit: 5, period: 60.seconds) do |request|
-      request.params["user"]["email"] if request.path == "/users/password" && request.post?
+      # Throttle login attempts for a given email parameter to 6 reqs/minute
+      # Return the email as a discriminator on POST /users/sign_in requests
+      Rack::Attack.throttle("limit password recovery attempts per email", limit: 5, period: 60.seconds) do |request|
+        request.params["user"]["email"] if request.path == "/users/password" && request.post?
+      end
     end
   end
 end

data/config/locales/ar.yml

@@ -711,6 +711,9 @@ ar:
       index:
         last_activity: النشاط الاخير
         resource_type: نوع
+    links:
+      warning:
+        cancel: إلغاء
     log:
       base_presenter:
         create: "%{user_name} تم الإنشاء %{resource_name}"
@@ -920,6 +923,7 @@ ar:
         report_html: <p>بعد <a href="%{url}">محتوى</a> تم إخفاء تلقائيا.</p>
         subject: تم إخفاء المورد تلقائيًا
       report:
+        content_original_language: لغة المحتوى الأصلية
         hello: مرحبا %{name}،
         report_html: <p>تم الإبلاغ عن المحتوى <a href="%{url}">التالي</a> .</p>
         subject: تم الإبلاغ عن مورد
@@ -962,6 +966,8 @@ ar:
           other: "%{count} النتائج"
         view_all: عرض الكل (%{count})
     shared:
+      confirm_modal:
+        cancel: إلغاء
       embed_modal:
         close_window: أغلق النافذة
         embed: يرجى لصق هذا الرمز في صفحتك
@@ -1218,6 +1224,8 @@ ar:
         close_session: اغلق الموسم
         description_html: أنت تدير المشارك <b>%{user_name}</b>.
         expire_time_html: سوف تنتهي جلستك في <b><span class="minutes">%{minutes}</span> دقائق</b>.
+      language_chooser:
+        choose_language: اختر اللغة
       notifications_dashboard:
         mark_all_as_read: اشر عليها بانها قرات
       user_menu:

data/config/locales/ca.yml

@@ -76,6 +76,30 @@ ca:
       decidim_with_day_and_month_name: "%A %d %b %Y"
       decidim_with_month_name: "%d %B %Y"
       decidim_with_month_name_short: "%d %b"
+  datetime:
+    distance_in_words:
+      about_x_hours:
+        one: al voltant d’1 hora
+        other: al voltant de %{count} hores
+      about_x_months:
+        one: al voltant d’1 mes
+        other: al voltant de %{count} mesos
+      half_a_minute: mig minut
+      less_than_x_minutes:
+        one: menys d’un minut
+        other: menys de %{count} minuts
+      less_than_x_seconds:
+        one: ara mateix
+        other: menys de %{count} segons
+      x_days:
+        one: fa 1 dia
+        other: "fa %{count} dies"
+      x_hours:
+        one: fa 1 hora
+        other: "fa %{count} hores"
+      x_minutes:
+        one: fa 1 minut
+        other: "fa %{count} minuts"
   decidim:
     accessibility:
       external_link: Enllaç extern
@@ -504,6 +528,11 @@ ca:
           this_application_will_not_be_able_to: 'Aquesta aplicació no podrà:'
           update_profile: Actualitza el teu perfil
           wants_to_use_your_account_html: "<strong>%{application_name}</strong> vol utilitzar el teu compte"
+    editor_images:
+      create:
+        error: S'ha produït un error en pujar la imatge
+        success: La imatge s'ha pujat correctament
+      drag_and_drop_help: Afegeix imatges arrossegant-les i deixant-les anar o bé enganxant-les.
     endorsable:
       endorsements: Adhesions
       endorsements_count: Número d'adhesions
@@ -694,6 +723,7 @@ ca:
       no_followers: Encara no hi ha seguidores.
     following:
       no_followings: No segueix a cap persona ni cap activitat.
+      non_public_followings: Alguns dels recursos seguits no són públics.
     follows:
       create:
         button: Seguir
@@ -959,6 +989,7 @@ ca:
           next: Següent
           no_conversations: Encara no tens converses
           title: Converses
+          to: Per a
         reply:
           placeholder: La teva resposta...
           send: Enviar
@@ -966,6 +997,7 @@ ca:
         show:
           back: Tornar a totes les converses
           chat_with: Conversa amb
+          deleted_accounts: No podeu tenir una conversa amb un compte d'usuària eliminat.
           not_allowed: Aquesta participant no accepta missatges directes.
           title: Conversa amb %{usernames}
         start:
@@ -1033,6 +1065,12 @@ ca:
         greetings: Salutacions,<br/>%{organization_name}<br/><a href="%{organization_url}">%{organization_url}</a>
         hello: Hola,
         subject: Vols seguir rebent informació rellevant sobre %{organization_name}?
+    notification_mailer:
+      event_received:
+        no_translation_available: Ho sentim, no s'ha pogut recuperar la traducció automàtica en enviar el correu. Pots comprovar la traducció del text original a través del següent enllaç %{link}.
+        original_text: 'Text original:'
+        same_language: El contingut s'ha publicat en la teva llengua de preferència (%{language}), és per això que no es mostra cap traducció automàtica en aquest correu electrònic.
+        translated_text: 'Text de la traducció automàtica:'
     notifications:
       no_notifications: Encara no hi ha notificacions.
     notifications_settings:
@@ -1330,6 +1368,7 @@ ca:
         title_reply: Respondre
       show:
         back: Mostra totes les converses
+        deleted_accounts: No podeu tenir una conversa amb un compte d'usuària eliminat.
         not_allowed: Aquesta participant no accepta missatges directes.
         title: Conversa amb %{usernames}
       update:
@@ -1626,10 +1665,12 @@ ca:
     name: Català
     name_with_error: Anglès (error!)
   password_validator:
+    blacklisted: a la llista negra
     domain_included_in_password: és massa semblant a aquest nom de domini
     email_included_in_password: és massa similar al teu correu electrònic
     fallback: no és vàlid
     name_included_in_password: és massa semblant al teu nom
+    nickname_included_in_password: és massa semblant al teu àlies
     not_enough_unique_characters: no té prou caràcters únics
     password_not_allowed: no està permès
     password_too_common: és massa comú
@@ -1664,6 +1705,8 @@ ca:
       day_of_week: "%a"
       day_of_week_long: "%a %e"
       day_of_year: "%d/%m/%y"
+      ddmm: "%d.%m"
+      ddmmyyyy: "%d.%m.%Y"
       decidim_day_of_year: "%d %B %Y"
       decidim_short: "%d/%m/%Y %H:%M"
       default: "%a, %d %b %Y %H:%M:%S %z"

data/config/locales/cs.yml

@@ -84,6 +84,48 @@ cs:
       decidim_with_day_and_month_name: "%A %d %b %Y"
       decidim_with_month_name: "%d %B %Y"
       decidim_with_month_name_short: "%d %b"
+  datetime:
+    distance_in_words:
+      about_x_hours:
+        one: asi 1 hodina
+        few: asi %{count} hodiny
+        many: asi %{count} hodin
+        other: asi %{count} hodin
+      about_x_months:
+        one: asi 1 měsíc
+        few: asi %{count} měsíce
+        many: asi %{count} měsíců
+        other: asi %{count} měsíců
+      half_a_minute: půl minuty
+      less_than_x_minutes:
+        one: méně než minutu.
+        few: méně než %{count} minuty.
+        many: méně než %{count} minut.
+        other: méně než %{count} minut.
+      less_than_x_seconds:
+        one: právě teď
+        few: méně než %{count} vteřiny.
+        many: méně než %{count} vteřin.
+        other: méně než %{count} vteřin.
+      x_days:
+        one: před 1 dnem
+        few: "před %{count} dny"
+        many: "před %{count} ti dny"
+        other: "před %{count} ti dny"
+      x_hours:
+        one: před 1 hodinou
+        few: "před %{count} hodinami"
+        many: "před %{count} hodinami"
+        other: "před %{count} hodinami"
+      x_minutes:
+        one: před 1 minutou
+        few: "před %{count} minutami"
+        many: "před %{count} minutami"
+        other: "před %{count} minutami"
+      x_seconds:
+        one: před 1 vteřinou
+        other: "před %{count} vteřinami"
+        zero: právě teď
   decidim:
     accessibility:
       external_link: Externí odkaz
@@ -527,6 +569,11 @@ cs:
           this_application_will_not_be_able_to: 'Tato aplikace nebude moci:'
           update_profile: Aktualizujte svůj profil
           wants_to_use_your_account_html: "<strong>%{application_name}</strong> chce používat váš účet"
+    editor_images:
+      create:
+        error: Chyba při nahrávání obrázku
+        success: Obrázek byl úspěšně nahrán
+      drag_and_drop_help: Přidejte obrázky přetažením nebo vložením.
     endorsable:
       endorsements: Schválení
       endorsements_count: Počet schvalování
@@ -719,6 +766,7 @@ cs:
       no_followers: Zatím žádní sledující.
     following:
       no_followings: Nesleduje nikoho ani nic.
+      non_public_followings: Některé z uvedených zdrojů nejsou veřejné.
     follows:
       create:
         button: Sledovat
@@ -984,6 +1032,7 @@ cs:
           next: Další
           no_conversations: Nemáte zatím žádné konverzace
           title: Konverzace
+          to: Komu
         reply:
           placeholder: Vaše odpověď...
           send: Poslat
@@ -991,6 +1040,7 @@ cs:
         show:
           back: Zpět ke všem konverzacím
           chat_with: Konverzace s
+          deleted_accounts: Nemůžete mít konverzaci s odstraněnými účty.
           not_allowed: Tento uživatel nepřijímá přímé zprávy.
           title: Konverzace s číslem %{usernames}
         start:
@@ -1058,6 +1108,12 @@ cs:
         greetings: Zdravím,<br/>%{organization_name}<br/><a href="%{organization_url}">%{organization_url}</a>
         hello: Ahoj,
         subject: Chcete nadále dostávat příslušné informace o %{organization_name}?
+    notification_mailer:
+      event_received:
+        no_translation_available: Omlouváme se, po odeslání e-mailu nelze získat automatický překlad. Překlad původního textu můžete zkontrolovat na následujícím odkazu %{link}.
+        original_text: 'Původní text:'
+        same_language: Obsah byl zveřejněn ve vašem preferovaném jazyce (%{language}), proto se v tomto e-mailu nezobrazuje automatický překlad.
+        translated_text: 'Automaticky přeložený text:'
     notifications:
       no_notifications: Zatím žádné oznámení.
     notifications_settings:
@@ -1357,6 +1413,7 @@ cs:
         title_reply: Odpovědět
       show:
         back: Zobrazit všechny konverzace
+        deleted_accounts: Nemůžete mít konverzaci s odstraněnými účty.
         not_allowed: Tento uživatel již nepřijímá žádné přímé zprávy.
         title: Konverzace s %{usernames}
       update:
@@ -1660,10 +1717,12 @@ cs:
     name: Čeština
     name_with_error: Čeština
   password_validator:
+    blacklisted: je na černé listině
     domain_included_in_password: je příliš podobné tomuto názvu domény
     email_included_in_password: je příliš podobný e-mailu
     fallback: není platný
     name_included_in_password: je příliš podobné vašemu jménu
+    nickname_included_in_password: je příliš podobné vaší přezdívce
     not_enough_unique_characters: nemá dostatek jedinečných znaků
     password_not_allowed: není povoleno
     password_too_common: je příliš běžné
@@ -1698,6 +1757,8 @@ cs:
       day_of_week: "%a"
       day_of_week_long: "%a %e"
       day_of_year: "%d.%m.%y"
+      ddmm: "%d.%m"
+      ddmmyyyy: "%d.%m.%Y"
       decidim_day_of_year: "%d %B %Y"
       decidim_short: "%d/%m/%Y %H:%M"
       default: "%a, %d %b %Y %H:%M:%S %z"

data/config/locales/en.yml

@@ -77,6 +77,34 @@ en:
       decidim_with_day_and_month_name: "%A %d %b %Y"
       decidim_with_month_name: "%d %B %Y"
       decidim_with_month_name_short: "%d %b"
+  datetime:
+    distance_in_words:
+      about_x_hours:
+        one: about 1 hour
+        other: about %{count} hours
+      about_x_months:
+        one: about 1 month
+        other: about %{count} months
+      half_a_minute: half a minute
+      less_than_x_minutes:
+        one: less than a min.
+        other: less than %{count} min.
+      less_than_x_seconds:
+        one: right now
+        other: less than %{count} sec.
+      x_days:
+        one: 1 day ago
+        other: "%{count} days ago"
+      x_hours:
+        one: 1 hour ago
+        other: "%{count} hours ago"
+      x_minutes:
+        one: 1 min. ago
+        other: "%{count} min. ago"
+      x_seconds:
+        one: 1 sec. ago
+        other: "%{count} sec. ago"
+        zero: right now
   decidim:
     accessibility:
       external_link: External link
@@ -512,6 +540,11 @@ en:
           this_application_will_not_be_able_to: 'This application will not be able to:'
           update_profile: Update your profile
           wants_to_use_your_account_html: "<strong>%{application_name}</strong> wants to use your account"
+    editor_images:
+      create:
+        error: Error uploading image
+        success: Image uploaded successfully
+      drag_and_drop_help: Add images by dragging & dropping or pasting them.
     endorsable:
       endorsements: Endorsements
       endorsements_count: Endorsements count
@@ -702,6 +735,7 @@ en:
       no_followers: No followers yet.
     following:
       no_followings: Doesn't follow anyone or anything yet.
+      non_public_followings: Some of the resources followed are not public.
     follows:
       create:
         button: Follow
@@ -967,6 +1001,7 @@ en:
           next: Next
           no_conversations: You have no conversations yet
           title: Conversations
+          to: To
         reply:
           placeholder: Your reply...
           send: Send
@@ -974,6 +1009,7 @@ en:
         show:
           back: Back to all conversations
           chat_with: Conversation with
+          deleted_accounts: You can't have a conversation with deleted accounts.
           not_allowed: This participant does not accept direct messages.
           title: Conversation with %{usernames}
         start:
@@ -1041,6 +1077,12 @@ en:
         greetings: Greetings,<br/>%{organization_name}<br/><a href="%{organization_url}">%{organization_url}</a>
         hello: Hello,
         subject: Do you want to keep receiving relevant information about %{organization_name}?
+    notification_mailer:
+      event_received:
+        no_translation_available: Sorry, the automated translation could not be retrieved when the email has been sent. You can check the translation of the original text on the following link %{link}.
+        original_text: 'Original text:'
+        same_language: The content has been posted in your preferred language (%{language}), this is why no automated translation is displayed in this email.
+        translated_text: 'Automatically translated text:'
     notifications:
       no_notifications: No notifications yet.
     notifications_settings:
@@ -1338,6 +1380,7 @@ en:
         title_reply: Reply
       show:
         back: Show all conversations
+        deleted_accounts: You can't have a conversation with deleted accounts.
         not_allowed: This user does not accept any more direct messages.
         title: Conversation with %{usernames}
       update:
@@ -1635,10 +1678,12 @@ en:
     name: English
     name_with_error: English (error!)
   password_validator:
+    blacklisted: is blacklisted
     domain_included_in_password: is too similar to this domain name
     email_included_in_password: is too similar to your email
     fallback: is not valid
     name_included_in_password: is too similar to your name
+    nickname_included_in_password: is too similar to your nickname
     not_enough_unique_characters: does not have enough unique characters
     password_not_allowed: is not allowed
     password_too_common: is too common
@@ -1673,6 +1718,8 @@ en:
       day_of_week: "%a"
       day_of_week_long: "%a %e"
       day_of_year: "%d.%m.%y"
+      ddmm: "%d.%m"
+      ddmmyyyy: "%d.%m.%Y"
       decidim_day_of_year: "%d %B %Y"
       decidim_short: "%d/%m/%Y %H:%M"
       default: "%a, %d %b %Y %H:%M:%S %z"