decidim-core 0.25.2 → 0.26.0.rc1

data/app/packs/stylesheets/decidim/extras/_extras.scss

@@ -11,6 +11,5 @@
 @import "stylesheets/decidim/extras/quill";
 @import "stylesheets/decidim/extras/reference";
 @import "stylesheets/decidim/extras/results-per-page";
-@import "stylesheets/decidim/extras/social_icons_mini";
 @import "stylesheets/decidim/extras/social_share";
 @import "stylesheets/decidim/extras/status-labels";

data/app/packs/stylesheets/decidim/extras/_quill.scss

@@ -11,3 +11,10 @@
   margin-top: 0;
   margin-bottom: 0;
 }
+
+.ql-reset-decidim{
+  display: flex;
+  flex-direction: column;
+  padding: 0;
+  white-space: inherit;
+}

data/app/packs/stylesheets/decidim/modules/_buttons.scss

@@ -441,14 +441,21 @@
   text-align: center;
 }
 
-.button--social--mini .button--social__icon{
-  position: relative;
-}
-
 .button--social__text{
   margin-left: 3rem;
 }
 
+.button--social--mini{
+  padding: 0;
+  min-width: 0;
+
+  .button--social__icon{
+    border: 0;
+    padding: .85em 0;
+    margin-right: 0;
+  }
+}
+
 .button--twitter{
   background-color: var(--twitter);
 

data/app/packs/stylesheets/decidim/modules/_cards.scss

@@ -634,6 +634,10 @@ a .card__title{
     pointer-events: none;
   }
 
+  &--inline{
+    display: inline-block;
+  }
+
   svg{
     flex-basis: auto;
   }

data/app/packs/stylesheets/decidim/modules/_layout.scss

@@ -3,7 +3,7 @@
   position: relative;
 
   @include breakpoint(medium){
-    padding: 5rem 1.5rem 3rem;
+    padding: 3rem 1.5rem;
   }
 
   @include breakpoint(large){

data/app/presenters/decidim/nil_presenter.rb

@@ -12,11 +12,11 @@ module Decidim
       true
     end
 
-    def avatar_url
+    def avatar_url(_variant = nil)
       Decidim::AvatarUploader.new(Decidim::User.new, :avatar).default_url
     end
 
-    def respond_to_missing?
+    def respond_to_missing?(*)
       true
     end
 

data/app/presenters/decidim/notification_presenter.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+module Decidim
+  #
+  # Decorator for notifications.
+  #
+  class NotificationPresenter < SimpleDelegator
+    include ActionView::Helpers::DateHelper
+
+    delegate :resource_text, to: :event_class_instance
+
+    def created_at_in_words
+      if created_at.between?(1.month.ago, Time.current)
+        time_ago_in_words(created_at)
+      else
+        format = created_at.year == Time.current.year ? :ddmm : :ddmmyyyy
+        I18n.l(created_at, format: format)
+      end
+    end
+
+    def display_resource_text?
+      event_class.constantize.included_modules.include?(Decidim::Comments::CommentEvent)
+    end
+  end
+end

data/app/presenters/decidim/official_author_presenter.rb

@@ -17,7 +17,7 @@ module Decidim
       ""
     end
 
-    def avatar_url
+    def avatar_url(_variant = nil)
       ActionController::Base.helpers.asset_pack_path("media/images/default-avatar.svg")
     end
 

data/app/presenters/decidim/validation_errors_presenter.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+module Decidim
+  #
+  # Decorator to format validation errors of a form in html format
+  #
+  class ValidationErrorsPresenter < Rectify::Presenter
+    include Decidim::SanitizeHelper
+
+    attr_reader :error, :form
+
+    def initialize(error, form)
+      @error = error
+      @form = form
+    end
+
+    def message
+      "<p>#{error}</p>#{validation_errors_list}"
+    end
+
+    def validation_errors_list
+      return "" if form.valid?
+
+      content_tag(:ul, decidim_sanitize(form.errors.full_messages.map { |err| content_tag(:li, err) }.join))
+    end
+  end
+end

data/app/queries/decidim/similar_emendations.rb

@@ -29,7 +29,7 @@ module Decidim
                 .published
                 .not_hidden
                 .where(
-                  "GREATEST(#{title_similarity}, #{body_similarity}) >= ?",
+                  Arel.sql("GREATEST(#{title_similarity}, #{body_similarity}) >= ?").to_s,
                   translated_attribute(emendation.title),
                   translated_attribute(emendation.body),
                   amendable_module.similarity_threshold

data/app/resolvers/decidim/core/metric_resolver.rb

@@ -56,7 +56,7 @@ module Decidim
       def group
         @records = @records
                    .group(group_by)
-                   .order("#{group_by} DESC")
+                   .order(Arel.sql("#{group_by} DESC").to_s)
       end
 
       def sum

data/app/services/decidim/activity_search.rb

@@ -150,7 +150,7 @@ module Decidim
                 ON #{manifest.name}_private_users.privatable_to_type = '#{manifest.model_class_name}'
                 AND #{table}.id = #{manifest.name}_private_users.privatable_to_id
             SQL
-          )
+          ).to_s
         ).where(
           Arel.sql(
             <<~SQL.squish
@@ -158,7 +158,7 @@ module Decidim
               #{table}.private_space = 'f' OR
               #{manifest.name}_private_users.decidim_user_id = #{current_user_id}
             SQL
-          )
+          ).to_s
         )
       end
 

data/app/services/decidim/email_notification_generator.rb

@@ -66,6 +66,9 @@ module Decidim
       return unless recipient.email_on_notification?
       return if resource.respond_to?(:can_participate?) && !resource.can_participate?(recipient)
 
+      wait_time = 0
+      wait_time = Decidim.machine_translation_delay.to_i + 1.minute if recipient.organization.enable_machine_translations
+
       NotificationMailer
         .event_received(
           event,
@@ -75,7 +78,7 @@ module Decidim
           user_role.to_s,
           extra
         )
-        .deliver_later
+        .deliver_later(wait: wait_time)
     end
 
     def component

data/app/services/decidim/html_truncation.rb

@@ -0,0 +1,130 @@
+# frozen_string_literal: true
+
+module Decidim
+  class HtmlTruncation
+    include Decidim::SanitizeHelper
+
+    # Truncates html content
+    # text - Content to be truncated
+    # options - Hash with the options
+    #         max_length: An Integer maximum number of characters
+    #         tail: Suffix to add after truncation
+    #         count_tags: A boolean which tells if html tags should be calculated to max length, otherwise just content
+    #         count_tail: A boolean value that determines whether max_length contains the tail
+    #         tail_before_final_tag: A boolean, add tail before final tag if true, otherwise add tail where content is cut.
+    def initialize(text, options = {})
+      @options = {
+        max_length: options[:max_length] || 30,
+        tail: options[:tail] || "...",
+        count_tags: options[:count_tags] || false,
+        count_tail: options[:count_tail] || false,
+        tail_before_final_tag: options[:tail_before_final_tag] || false
+      }
+      @text = text
+    end
+
+    # Perform truncation to the html content (text) added in constructor
+    # Returns truncated String
+    def perform
+      @document = Nokogiri::HTML::DocumentFragment.parse(@text)
+      @tail_added = false
+      @remaining = initial_remaining
+      @cut = false
+      cut_children(document, options[:count_tags])
+      add_tail(document) if @remaining.negative? && !@tail_added
+      escape_html_from_content(document)
+
+      # Nokogiri's to_html escapes " to " and we do not want extra &amp so we have to unescape.
+      CGI.unescape_html(document.to_html).gsub("\n", "")
+    end
+
+    private
+
+    attr_reader :document, :options
+
+    def cut_children(node, count_html)
+      return @remaining -= node_length(node, count_html) if @remaining >= node_length(node, count_html)
+      return node.unlink if @remaining.negative?
+      return cut_with_tags(node, true) if count_html && @remaining < node_length(node, count_html)
+
+      if node.children.empty?
+        if node.content.present? && @remaining < node_length(node, count_html)
+          cut_content(node)
+          @remaining = -1
+        else
+          @remaining -= node_length(node, count_html)
+        end
+
+        return
+      end
+
+      node.children.each do |child|
+        cut_children(child, count_html)
+      end
+    end
+
+    def escape_html_from_content(node)
+      node.content = decidim_html_escape(node.content) if node.is_a? Nokogiri::XML::Text
+      return if node.children.empty?
+
+      node.children.each do |child|
+        escape_html_from_content(child)
+      end
+    end
+
+    def cut_with_tags(node, parent)
+      if parent
+        return node.children.each { |child| cut_with_tags(child, false) } if node.children.present?
+
+        return ignore_closing_tag_and_cut(node)
+      end
+      return node.unlink if @cut
+
+      if @remaining < node_length(node, true)
+        @cut = true
+        return ignore_closing_tag_and_cut(node) if @remaining > opening_tag_length(node) || node.content.present?
+      end
+      @remaining -= node_length(node, true)
+    end
+
+    def ignore_closing_tag_and_cut(node)
+      @remaining -= opening_tag_length(node)
+      cut_content(node)
+      @remaining = -1
+    end
+
+    def add_tail(document)
+      return if document.children.empty? || @tail_added
+
+      target = document.children[-1]
+      if target.is_a?(Nokogiri::XML::Text) || target.content.empty?
+        document.add_child(Nokogiri::XML::Text.new(options[:tail], document))
+      else
+        target.add_child(Nokogiri::XML::Text.new(options[:tail], document))
+      end
+      @tail_added = true
+    end
+
+    def cut_content(node)
+      tail = options[:tail_before_final_tag] ? "" : options[:tail]
+      @tail_added = true if tail.present?
+
+      node.content = "#{node.content.truncate(@remaining, omission: "")}#{tail}"
+    end
+
+    def initial_remaining
+      return options[:max_length] unless options[:count_tail]
+
+      options[:max_length] - options[:tail].length
+    end
+
+    def opening_tag_length(node)
+      closing_tag_index = node.to_html.rindex("</") || node.to_html.length
+      node.to_html.length - (node.to_html.length - closing_tag_index) - node.content.length
+    end
+
+    def node_length(node, count_html)
+      count_html ? node.to_html.length : node.content.length
+    end
+  end
+end

data/app/services/decidim/open_data_exporter.rb

@@ -33,7 +33,6 @@ module Decidim
         open_data_component_manifests.each do |manifest|
           add_file_to_output(out, format(FILE_NAME_PATTERN, { host: organization.host, entity: manifest.name }), data_for_component(manifest))
         end
-
         open_data_participatory_space_manifests.each do |manifest|
           add_file_to_output(out, format(FILE_NAME_PATTERN, { host: organization.host, entity: manifest.name }), data_for_participatory_space(manifest))
         end
@@ -42,12 +41,37 @@ module Decidim
       buffer.string
     end
 
-    def data_for_component(export_manifest)
-      collection = components.where(manifest_name: export_manifest.manifest.name).find_each.flat_map do |component|
-        export_manifest.collection.call(component)
+    def data_for_component(export_manifest, col_sep = Decidim.default_csv_col_sep)
+      headers = []
+      collection = []
+      ActiveRecord::Base.uncached do
+        components.where(manifest_name: export_manifest.manifest.name).find_each do |component|
+          export_manifest.collection.call(component).find_in_batches(batch_size: 100) do |batch|
+            exporter = Decidim::Exporters::CSV.new(batch, export_manifest.serializer)
+            headers.push(*exporter.headers)
+            exported = exporter.export
+
+            tmpfile = Tempfile.new("#{export_manifest.name}-#{component.id}-")
+            tmpfile.write(exported.read)
+            # Do not delete the file when the reference is deleted
+            ObjectSpace.undefine_finalizer(tmpfile)
+            tmpfile.close
+
+            collection.push(tmpfile.path)
+          end
+        end
       end
 
-      Decidim::Exporters::CSV.new(collection, export_manifest.serializer).export
+      headers.uniq!
+
+      data = CSV.generate_line(headers, col_sep: col_sep)
+      collection.each do |content|
+        CSV.foreach(content, headers: true, col_sep: col_sep) do |row|
+          data << CSV.generate_line(row.values_at(*headers), col_sep: col_sep)
+        end
+        File.unlink(content)
+      end
+      Decidim::Exporters::ExportData.new(data, "csv")
     end
 
     def data_for_participatory_space(export_manifest)

data/app/services/decidim/resource_search.rb

@@ -75,7 +75,7 @@ module Decidim
       conditions << "#{query.model_name.plural}.decidim_scope_id IS NULL" if clean_scope_ids.delete("global")
       conditions.concat(["? = ANY(decidim_scopes.part_of)"] * clean_scope_ids.count) if clean_scope_ids.any?
 
-      query.includes(:scope).references(:decidim_scopes).where(conditions.join(" OR "), *clean_scope_ids.map(&:to_i))
+      query.includes(:scope).references(:decidim_scopes).where(Arel.sql(conditions.join(" OR ")).to_s, *clean_scope_ids.map(&:to_i))
     end
 
     # Handle the origin filter.

data/app/uploaders/decidim/editor_image_uploader.rb

@@ -0,0 +1,6 @@
+# frozen_string_literal: true
+
+module Decidim
+  # This class deals with uploading images to WYSIWYG editor.
+  class EditorImageUploader < ImageUploader; end
+end

data/app/validators/password_validator.rb

@@ -0,0 +1,123 @@
+# frozen_string_literal: true
+
+# Class is used to verify that the user's password is strong enough
+class PasswordValidator < ActiveModel::EachValidator
+  MINIMUM_LENGTH = 10
+  MAX_LENGTH = 256
+  MIN_UNIQUE_CHARACTERS = 5
+  IGNORE_SIMILARITY_SHORTER_THAN = 4
+  VALIDATION_METHODS = [
+    :password_too_short?,
+    :password_too_long?,
+    :not_enough_unique_characters?,
+    :name_included_in_password?,
+    :nickname_included_in_password?,
+    :email_included_in_password?,
+    :domain_included_in_password?,
+    :password_too_common?,
+    :blacklisted?
+  ].freeze
+
+  # Check if user's password is strong enough
+  #
+  # record - Instance of a form (e.g. Decidim::RegistrationForm) or model
+  # attribute - "password"
+  # value - Actual password
+  # Returns true if password is strong enough
+  def validate_each(record, attribute, value)
+    return false if value.blank?
+
+    @record = record
+    @attribute = attribute
+    @value = value
+    @weak_password_reasons = []
+
+    return true if strong?
+
+    @weak_password_reasons.each do |reason|
+      record.errors[attribute] << get_message(reason)
+    end
+
+    false
+  end
+
+  private
+
+  attr_reader :record, :attribute, :value
+
+  def get_message(reason)
+    I18n.t "password_validator.#{reason}"
+  end
+
+  def strong?
+    VALIDATION_METHODS.each do |method|
+      @weak_password_reasons << method.to_s.sub(/\?$/, "").to_sym if send(method.to_s)
+    end
+
+    @weak_password_reasons.empty?
+  end
+
+  def password_too_short?
+    value.length < MINIMUM_LENGTH
+  end
+
+  def password_too_long?
+    value.length > MAX_LENGTH
+  end
+
+  def not_enough_unique_characters?
+    value.chars.uniq.length < MIN_UNIQUE_CHARACTERS
+  end
+
+  def name_included_in_password?
+    return false if !record.respond_to?(:name) || record.name.blank?
+    return true if value.include?(record.name.delete(" "))
+
+    record.name.split(" ").each do |part|
+      next if part.length < IGNORE_SIMILARITY_SHORTER_THAN
+
+      return true if value.include?(part)
+    end
+
+    false
+  end
+
+  def nickname_included_in_password?
+    return false if !record.respond_to?(:nickname) || record.nickname.blank?
+
+    value.include?(record.nickname)
+  end
+
+  def email_included_in_password?
+    return false if !record.respond_to?(:email) || record.email.blank?
+
+    name, domain, _whatever = record.email.split("@")
+    value.include?(name) || (domain && value.include?(domain.split(".").first))
+  end
+
+  def domain_included_in_password?
+    return false unless record&.current_organization&.host
+    return true if value.include?(record.current_organization.host)
+
+    record.current_organization.host.split(".").each do |part|
+      next if part.length < IGNORE_SIMILARITY_SHORTER_THAN
+
+      return true if value.include?(part)
+    end
+
+    false
+  end
+
+  def blacklisted?
+    Array(Decidim.password_blacklist).each do |expression|
+      return true if expression.is_a?(Regexp) && value.match?(expression)
+      return true if expression.to_s == value
+    end
+
+    false
+  end
+
+  def password_too_common?
+    Decidim::CommonPasswords.instance.passwords.include?(value)
+  end
+end

data/app/views/decidim/account/_password_fields.html.erb

@@ -1,2 +1,2 @@
-<%= form.password_field :password, value: form.object.password, autocomplete: "off", help_text: t("devise.passwords.edit.password_help", minimun_characters: NOBSPW.configuration.min_password_length) %>
+<%= form.password_field :password, value: form.object.password, autocomplete: "off", help_text: t("devise.passwords.edit.password_help", minimun_characters: ::PasswordValidator::MINIMUM_LENGTH) %>
 <%= form.password_field :password_confirmation, value: form.object.password_confirmation, autocomplete: "off" %>

data/app/views/decidim/devise/passwords/edit.html.erb

@@ -16,7 +16,7 @@
             <%= f.hidden_field :reset_password_token %>
 
             <div class="field">
-              <%= f.password_field :password, autocomplete: "off", help_text: t("devise.passwords.edit.password_help", minimun_characters: NOBSPW.configuration.min_password_length) %>
+              <%= f.password_field :password, autocomplete: "off", help_text: t("devise.passwords.edit.password_help", minimun_characters: ::PasswordValidator::MINIMUM_LENGTH) %>
             </div>
 
             <div class="field">

data/app/views/decidim/devise/registrations/new.html.erb

@@ -49,7 +49,7 @@
             </div>
 
             <div class="field">
-              <%= f.password_field :password, help_text: t(".password_help", minimun_characters: NOBSPW.configuration.min_password_length), autocomplete: "off" %>
+              <%= f.password_field :password, help_text: t(".password_help", minimun_characters: ::PasswordValidator::MINIMUM_LENGTH), autocomplete: "off" %>
             </div>
 
             <div class="field">

data/app/views/decidim/devise/shared/_omniauth_buttons_mini.html.erb

@@ -1,21 +1,23 @@
 <% if Devise.mappings[:user].omniauthable? && current_organization.enabled_omniauth_providers.any? %>
   <div class="row">
     <div class="columns medium-8 medium-centered">
-      <span class="register__separator">
-        <span class="register__separator__text"><%= t("or", scope: "decidim.devise.shared.omniauth_buttons") %></span>
-      </span>
       <div class="text-center">
         <%- current_organization.enabled_omniauth_providers.keys.each do |provider| %>
+        <div class="social-register">
           <%= link_to decidim.send("user_#{provider}_omniauth_authorize_path"), class: "button button--social button--#{normalize_provider_name(provider)} button--social--mini", method: :post do %>
             <span class="button--social__icon" aria-hidden="true">
               <%= oauth_icon provider %>
             </span>
-            <span class="show-for-sr">
+            <span class="button--social__text">
               <%= t("devise.shared.links.sign_in_with_provider", provider: normalize_provider_name(provider).titleize) %>
             </span>
           <% end %>
+        </div>
         <% end %>
       </div>
+      <span class="register__separator">
+        <span class="register__separator__text"><%= t("or", scope: "decidim.devise.shared.omniauth_buttons") %></span>
+      </span>
     </div>
   </div>
 <% end %>

data/app/views/decidim/messaging/conversations/_conversation.html.erb

@@ -15,9 +15,9 @@
     <li class="card-data__item card--list__item card-data__item--expand absolutes">
       <div class="mr-s">
         <% if conversation.interlocutors(current_user).count == 1 %>
-          <%= t("from", scope: "decidim.messaging.conversations.index") %>: <strong><%= conversation.interlocutors(current_user).first.name %> <span class="muted">@<%= conversation.interlocutors(current_user).first.nickname %></span></strong>
+          <%= t("from", scope: "decidim.messaging.conversations.index") %>: <%= conversation_name_for(conversation.interlocutors(current_user)) %>
         <% else %>
-          <%= t("from", scope: "decidim.messaging.conversations.index") %>: <strong><%= username_list(conversation.interlocutors(current_user), shorten: true) %></strong>
+          <%= t("from", scope: "decidim.messaging.conversations.index") %>: <strong><%= username_list(conversation.interlocutors(current_user), shorten: true).html_safe %></strong>
         <% end %>
         <br>
         <span class="muted">
@@ -45,7 +45,7 @@
           <% if conversation.interlocutors(current_user).count == 1 %>
             <%= icon "chevron-right", class: "card__link icon--big", role: "img", aria_label: t(".show", sender: conversation.interlocutors(current_user).first.name) %>
           <% else %>
-            <%= icon "chevron-right", class: "card__link icon--big", role: "img", aria_label: t(".show", sender: username_list(conversation.interlocutors(current_user))) %>
+            <%= icon "chevron-right", class: "card__link icon--big", role: "img", aria_label: t(".show", sender: strip_tags(username_list(conversation.interlocutors(current_user)))) %>
           <% end %>
         <% end %>
       </div>

data/app/views/decidim/messaging/conversations/_messages.html.erb

@@ -1,6 +1,12 @@
 <div class="conversation-chat<%= " conversation-chat--offset" if sender_is_user?(sender) %>">
-  <%= link_to profile_path(sender.nickname) do %>
-    <%= image_tag present(sender).avatar_url, alt: t("decidim.author.avatar", name: decidim_sanitize(sender.name)) %>
+  <% if sender.deleted? %>
+    <span class="label label--small label--basic">
+      <%= t("deleted", scope: "decidim.profile") %>
+    </span>
+  <% else %>
+    <%= link_to profile_path(sender.nickname) do %>
+      <%= image_tag present(sender).avatar_url, alt: t("decidim.author.avatar", name: decidim_sanitize(sender.name)) %>
+    <% end %>
   <% end %>
   <div>
     <% messages.each do |message| %>

data/app/views/decidim/messaging/conversations/_show.html.erb

@@ -1,12 +1,6 @@
-<% if participants.count == 1 %>
-  <% conversation_label = t(".chat_with") + " #{participants.first.name} (@#{participants.first.nickname})" %>
-<% else %>
-  <% conversation_label = t(".title", usernames: username_list(participants)) %>
-<% end %>
-
 <div class="wrapper">
   <div class="row">
-    <div class="columns medium-9 medium-centered tabs-panel is-active" id="conversations" role="tabpanel" aria-label="<%= conversation_label %>">
+    <div class="columns medium-9 medium-centered tabs-panel is-active" id="conversations" role="tabpanel" aria-label="<%= strip_tags(conversation_label_for(participants)) %>">
       <div class="conversation">
 
         <div class="conversation-header flex--cc absolutes">
@@ -15,20 +9,24 @@
               <%= icon "chevron-left", role: "img", aria_label: t(".back") %>
             <% end %>
           </div>
+
           <% if participants.count == 1 %>
-            <%= link_to profile_path(participants.first.nickname) do %>
-              <%= image_tag present(participants.first).avatar_url, alt: t("decidim.author.avatar", name: decidim_sanitize(participants.first.name)) %>
+            <% if participants.first.deleted? %>
+              <%= image_tag present(participants.first).avatar_url, alt: t("decidim.author.avatar", name: t("decidim.profile.deleted")) %>
+            <% else %>
+              <%= link_to profile_path(participants.first.nickname) do %>
+                <%= image_tag present(participants.first).avatar_url, alt: t("decidim.author.avatar", name: decidim_sanitize(participants.first.name)) %>
+              <% end %>
             <% end %>
           <% else %>
             <%= image_tag present(current_user).avatar.default_multiuser_url, alt: t("decidim.author.avatar_multiuser") %>
           <% end %>
-
           <div class="ml-s">
             <h1>
               <% if participants.count == 1 %>
-                <%= t(".chat_with") %> <strong><%= participants.first.name %></strong><br><span class="muted">@<%= participants.first.nickname %></span>
+                <%= t(".chat_with") %> <%= conversation_name_for(participants) %>
               <% else %>
-                <%= t(".title", usernames: username_list(participants)) %>
+                <%= t(".title", usernames: username_list(participants)).html_safe %>
               <% end %>
             </h1>
           </div>