decidim-core 0.26.1 → 0.26.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 53feb2cc6c5c494c20cf8e6ae1d35cc933ddf3a91ee2704b9b2fb6436b267c87
-  data.tar.gz: 431d81f9df34a6c1f0a88a3786f138e748e4cc9b5a706707493e7735a7cf782a
+  metadata.gz: 3cbd72f4c386bc8730dfa1d3958a691c5ed719b3cf43b15f778d2011ae5a7f0d
+  data.tar.gz: 32e72e8185fc2f28f0298ef2a9a0350cd8b436e1a39bda136fe82c9da5644433
 SHA512:
-  metadata.gz: 69ec72cc2adbd4c88933c2c21aade155b7b98dc9708c85d9f0677b32621ce205c8b247109d96c0b13d3b7e6b96214eea3ac1c03e3aedfdaae2ca0afba7de96cd
-  data.tar.gz: 92caf28a3f0ea16de36d307a4ff484478d071a5b442a6848a09741c657b1bdf86f1c53c9ccf799920901fabb8aea5284f32e661c07d3d6830e77e8299c482557
+  metadata.gz: 3d7a4d41fa9aeb76c68e21e5a486b8a3149d117a956c4d0ec17020db1abad1c8a8ce1316ba014a158bbb2fe254ebc0db4b4923a756d0f97997c06bb128c3e440
+  data.tar.gz: e282e746492e32a9e85edb4b72ede7804be3b5b7fd9567e49eac2ba6b9430f6d46da2596f044b87fa520fb4cde0e92259c40695837c87d6fb0943f2c244fa8e2

data/app/cells/decidim/card_m/show.erb

@@ -9,7 +9,7 @@
       <div class="card__text">
         <div class="card__text--paragraph">
           <%= render :badge if has_badge? %>
-          <%= description %>
+          <%= Decidim::ContentProcessor.render(description, "div") %>
         </div>
       </div>
 

data/app/cells/decidim/content_blocks/cta/show.erb

@@ -1,5 +1,5 @@
 <section class="section">
-  <div class="expanded hero" style="background-image:url(<%= background_image %>);">
+  <div class="expanded hero" style="background-image:url('<%= background_image %>');">
     <div class="hero__container">
       <div class="row">
         <div class="columns small-centered medium-6 text-center">

data/app/cells/decidim/content_blocks/hero/show.erb

@@ -1,4 +1,4 @@
-<section class="extended hero home-section" style="background-image:url(<%= background_image %>);">
+<section class="extended hero home-section" style="background-image:url('<%= background_image %>');">
   <div class="hero__container">
     <div class="row">
       <div class="columns small-centered large-10">

data/app/cells/decidim/content_blocks/highlighted_content_banner/show.erb

@@ -1,5 +1,5 @@
 <section class="extended highligted-content-banner home-section"
-          style="background-image:url(<%= current_organization.attached_uploader(:highlighted_content_banner_image).path %>);">
+          style="background-image:url('<%= current_organization.attached_uploader(:highlighted_content_banner_image).path %>');">
   <div class="highligted-content-banner__container">
     <div class="row">
       <div class="columns large-10">

data/app/cells/decidim/content_blocks/stats_cell.rb

@@ -16,6 +16,7 @@ module Decidim
       def cache_hash
         hash = []
         hash.push(I18n.locale)
+        hash.push(current_organization.cache_key)
         hash.join(Decidim.cache_key_separator)
       end
     end

data/app/cells/decidim/followers_cell.rb

@@ -12,7 +12,7 @@ module Decidim
     end
 
     def followers
-      @followers ||= model.followers.page(params[:page]).per(20)
+      @followers ||= model.followers.not_blocked.page(params[:page]).per(20)
     end
   end
 end

data/app/cells/decidim/notification/show.erb

@@ -13,7 +13,7 @@
         <span class="text-small"><%= notification.event_class.constantize.model_name.human %></span>
         <br>
         <span>
-          <%= notification.event_class_instance.notification_title %>
+          <%= notification_title %>
         </span>
         <% if notification.display_resource_text? %>
           <p>

data/app/cells/decidim/notification_cell.rb

@@ -11,6 +11,12 @@ module Decidim
       render :show
     end
 
+    def notification_title
+      notification.event_class_instance.notification_title
+    rescue StandardError
+      I18n.t("decidim.notifications.show.missing_event")
+    end
+
     private
 
     def notification

data/app/commands/decidim/update_user_interests.rb

@@ -29,7 +29,11 @@ module Decidim
     end
 
     def selected_scopes_ids
-      @form.scopes.select(&:checked).map(&:id)
+      @form.scopes.map do |scope|
+        next unless scope.checked?
+
+        scope.id.to_i
+      end.compact
     end
   end
 end

data/app/controllers/concerns/decidim/resource_versions_concern.rb

@@ -10,6 +10,10 @@ module Decidim
       helper Decidim::TraceabilityHelper
       helper_method :current_version, :versioned_resource
 
+      def show
+        raise ActionController::RoutingError, "Not found" unless current_version
+      end
+
       private
 
       # Overwrite this method in your controller to define how to find the

data/app/controllers/concerns/decidim/skip_timeoutable.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+require "active_support/concern"
+
+module Decidim
+  # We don't want to reset timeout timer on routes where we make requests automatically
+  # (e.g. asking time before timeout or fetching comments).
+  module SkipTimeoutable
+    extend ActiveSupport::Concern
+
+    private
+
+    def skip_timeout
+      request.env["devise.skip_timeoutable"] = true
+    end
+  end
+end

data/app/controllers/decidim/devise/registrations_controller.rb

@@ -37,7 +37,7 @@ module Decidim
           end
 
           on(:invalid) do
-            flash.now[:alert] = @form.errors[:base].join(", ") if @form.errors[:base].any?
+            flash.now[:alert] = @form.errors.full_messages.join(", ") if @form.errors.full_messages.any?
             render :new
           end
         end

data/app/controllers/decidim/timeouts_controller.rb

@@ -5,6 +5,8 @@ require "active_support/concern"
 module Decidim
   # Tells/Extends time before inactivity warning or automatic logout.
   class TimeoutsController < Decidim::ApplicationController
+    include Decidim::SkipTimeoutable
+
     # Skip these methods because they can call Devise's store_location_for, which can save timeouts path to session.
     skip_before_action :store_current_location
 
@@ -23,11 +25,5 @@ module Decidim
         format.js
       end
     end
-
-    private
-
-    def skip_timeout
-      request.env["devise.skip_timeoutable"] = true
-    end
   end
 end

data/app/events/decidim/resource_endorsed_event.rb

@@ -15,7 +15,8 @@ module Decidim
     end
 
     def resource_text
-      resource.body
+      return resource.body if resource.respond_to? :body
+      return resource.description if resource.respond_to? :description
     end
 
     def resource_type

data/app/forms/decidim/account_form.rb

@@ -50,7 +50,7 @@ module Decidim
     end
 
     def unique_email
-      return true if Decidim::User.where(
+      return true if Decidim::UserBaseEntity.where(
         organization: context.current_organization,
         email: email
       ).where.not(id: context.current_user.id).empty?
@@ -60,9 +60,10 @@ module Decidim
     end
 
     def unique_nickname
-      return true if Decidim::User.where(
-        organization: context.current_organization,
-        nickname: nickname
+      return true if Decidim::UserBaseEntity.where(
+        "decidim_organization_id = ? AND LOWER(nickname) = ? ",
+        context.current_organization.id,
+        nickname.downcase
       ).where.not(id: context.current_user.id).empty?
 
       errors.add :nickname, :taken

data/app/forms/decidim/registration_form.rb

@@ -35,11 +35,17 @@ module Decidim
     private
 
     def email_unique_in_organization
-      errors.add :email, :taken if User.no_active_invitation.find_by(email: email, organization: current_organization).present?
+      errors.add :email, :taken if valid_users.find_by(email: email, organization: current_organization).present?
     end
 
     def nickname_unique_in_organization
-      errors.add :nickname, :taken if User.no_active_invitation.find_by(nickname: nickname, organization: current_organization).present?
+      return false unless nickname
+
+      errors.add :nickname, :taken if valid_users.find_by("LOWER(nickname)= ? AND decidim_organization_id = ?", nickname.downcase, current_organization.id).present?
+    end
+
+    def valid_users
+      UserBaseEntity.where(invitation_token: nil)
     end
 
     def no_pending_invitations_exist

data/app/forms/decidim/user_interest_scope_form.rb

@@ -6,7 +6,7 @@ module Decidim
   class UserInterestScopeForm < Form
     mimic :scope
 
-    attribute :name, String
+    attribute :name, JsonbAttributes
     attribute :checked, Boolean
     attribute :children, Array[UserInterestScopeForm]
 

data/app/helpers/decidim/application_helper.rb

@@ -119,5 +119,9 @@ module Decidim
         [base_url, "/", process.active_step.cta_path].join("")
       end
     end
+
+    def prevent_timeout_seconds
+      0
+    end
   end
 end

data/app/helpers/decidim/filters_helper.rb

@@ -24,7 +24,11 @@ module Decidim
           remote: true,
           html: { id: nil }.merge(html_options)
         ) do |form|
-          yield form
+          # Cannot use `concat()` here because it's not available in cells
+          inner = []
+          inner << hidden_field_tag("per_page", params[:per_page], id: nil) if params[:per_page]
+          inner << capture { yield form }
+          inner.join.html_safe
         end
       end
     end

data/app/helpers/decidim/meta_tags_helper.rb

@@ -16,7 +16,30 @@ module Decidim
       add_decidim_meta_description(tags[:description])
       add_decidim_meta_url(tags[:url])
       add_decidim_meta_twitter_handler(tags[:twitter_handler])
-      add_decidim_meta_image_url(tags[:image_url])
+      add_decidim_meta_image_url(add_base_url_to(tags[:image_url]))
+    end
+
+    # Public: Add base url to path if path doesn't include host.
+    # path - A String containing path (e.g. "/proposals/1" )
+    # Returns a String of URL including base URL and path, or path if it's blank.
+    def add_base_url_to(path)
+      return path if path.blank?
+      return path if URI.parse(path).host.present?
+
+      "#{resolve_base_url}#{path}"
+    end
+
+    # Public: Resolve base url (example: https://www.decidim.org) without url params
+    # Returns a String of base URL
+    def resolve_base_url
+      return request.base_url if respond_to?(:request) && request&.base_url.present?
+
+      uri = URI.parse(decidim.root_url(host: current_organization.host))
+      if uri.port.blank? || [80, 443].include?(uri.port)
+        "#{uri.scheme}://#{uri.host}"
+      else
+        "#{uri.scheme}://#{uri.host}:#{uri.port}"
+      end
     end
 
     # Public: Accumulates the given `title` so that they can be chained. Since Rails views

data/app/helpers/decidim/sanitize_helper.rb

@@ -94,11 +94,17 @@ module Decidim
       end
     end
 
+    # This method is currently being used only for Proposal and Meeting,
+    # It aims to load the presenter class, and perform some basic sanitization on the content
+    # This method should be used along side simple_format.
+    # @param resource [Object] Resource object
+    # @param method [Symbol] Method name
+    #
+    # @return ActiveSupport::SafeBuffer
     def render_sanitized_content(resource, method)
       content = present(resource).send(method, links: true, strip_tags: !safe_content?)
-      content = simple_format(content, {}, sanitize: false)
 
-      return content unless safe_content?
+      return decidim_sanitize(content, {}) unless safe_content?
 
       decidim_sanitize_editor(content)
     end

data/app/models/decidim/action_log.rb

@@ -130,15 +130,16 @@ module Decidim
     end
 
     # Whether this activity or log is visible for a given user (can also be nil)
-    #
-    # Returns a True/False.
     def visible_for?(user)
-      return false if resource_lazy.blank?
-      return false if participatory_space_lazy.blank?
-      return false if resource_lazy.respond_to?(:hidden?) && resource_lazy.hidden?
-      return false if resource_lazy.respond_to?(:can_participate?) && !resource_lazy.can_participate?(user)
-
-      true
+      resource_lazy.present? &&
+        participatory_space_lazy.present? &&
+        !resource_lazy.try(:deleted?) &&
+        !resource_lazy.try(:hidden?) &&
+        (!resource_lazy.respond_to?(:can_participate?) || resource_lazy.try(:can_participate?, user))
+    rescue NameError => e
+      Rails.logger.warn "Failed resource for #{self.class.name}(id=#{id}): #{e.message}"
+
+      false
     end
   end
 end

data/app/models/decidim/user_base_entity.rb

@@ -30,6 +30,7 @@ module Decidim
 
     scope :blocked, -> { where(blocked: true) }
     scope :not_blocked, -> { where(blocked: false) }
+    scope :available, -> { where(deleted_at: nil, blocked: false, managed: false) }
 
     # Public: Returns a collection with all the public entities this user is following.
     #
@@ -55,6 +56,7 @@ module Decidim
       scope = scope.public_spaces if klass.try(:participatory_space?)
       scope = scope.includes(:component) if klass.try(:has_component?)
       scope = scope.filter(&:visible?) if klass.method_defined?(:visible?)
+      scope = scope.reject(&:blocked) if klass == Decidim::UserBaseEntity
       scope
     end
   end

data/app/packs/src/decidim/external_link.js

@@ -5,6 +5,9 @@ const EXCLUDE_CLASSES = [
   "footer-social__icon",
   "logo-cityhall"
 ];
+const EXCLUDE_ANCESTOR_CLASSES = [
+  "editor-container"
+]
 const EXCLUDE_REL = ["license", "decidim"];
 
 const DEFAULT_MESSAGES = {
@@ -27,6 +30,9 @@ export default class ExternalLink {
     if (EXCLUDE_CLASSES.some((cls) => this.$link.hasClass(cls))) {
       return;
     }
+    if (EXCLUDE_ANCESTOR_CLASSES.some((cls) => this.$link.parents().hasClass(cls))) {
+      return;
+    }
     if (
       EXCLUDE_REL.some((rel) => {
         const linkRels = `${this.$link.attr("rel")}`.split(" ");

data/app/packs/src/decidim/map/controller/static.js

@@ -16,6 +16,12 @@ export default class MapStaticController extends MapController {
       this.map.tap.disable();
     }
 
+    if (this.config.zoom) {
+      this.map.setZoom(this.config.zoom);
+    } else {
+      this.map.setZoom(15);
+    }
+
     if (this.config.latitude && this.config.longitude) {
       const coordinates = [this.config.latitude, this.config.longitude];
 
@@ -27,11 +33,6 @@ export default class MapStaticController extends MapController {
       }).addTo(this.map);
       marker._icon.removeAttribute("tabindex");
     }
-    if (this.config.zoom) {
-      this.map.setZoom(this.config.zoom);
-    } else {
-      this.map.setZoom(15);
-    }
 
     if (this.config.link) {
       this.map._container.addEventListener("click", (ev) => {

data/app/packs/src/decidim/map/factory.js

@@ -33,7 +33,7 @@ import MapDragMarkerController from "src/decidim/map/controller/drag_marker"
  * @param {Object} config The map configuration object.
  * @returns {MapController} The controller for the map.
  */
-export default function createMapController(mapId, config) {
+const createMapController = function(mapId, config) {
   if (config.type === "static") {
     return new MapStaticController(mapId, config);
   } else if (config.type === "drag-marker") {
@@ -42,3 +42,5 @@ export default function createMapController(mapId, config) {
 
   return new MapMarkersController(mapId, config);
 }
+
+window.Decidim.createMapController = createMapController;

data/app/packs/src/decidim/map/legacy.js

@@ -1,7 +1,7 @@
 /* eslint-disable require-jsdoc */
 
 import * as L from "leaflet";
-import createMapController from "src/decidim/map/factory"
+import "src/decidim/map/factory"
 
 /**
  * @deprecated
@@ -60,7 +60,7 @@ const loadMap = (mapId, markersData) => {
   legacyMapSupport($map);
 
   const mapData = $map.data("decidim-map");
-  const ctrl = createMapController(mapId, mapData);
+  const ctrl = window.Decidim.createMapController(mapId, mapData);
   const map = ctrl.load();
 
   L.tileLayer.here(mapData.tileLayer).addTo(map);

data/app/packs/src/decidim/map.js

@@ -1,4 +1,4 @@
-import createMapController from "src/decidim/map/factory"
+import "src/decidim/map/factory"
 
 $(() => {
   // Load the map controller factory method in the document.ready handler to
@@ -20,7 +20,7 @@ $(() => {
     }
 
     const mapConfig = $map.data("decidim-map");
-    const ctrl = createMapController(mapId, mapConfig);
+    const ctrl = window.Decidim.createMapController(mapId, mapConfig);
     const map = ctrl.load();
 
     $map.data("map", map);

data/app/packs/src/decidim/session_timeouter.js

@@ -1,5 +1,4 @@
 import moment from "moment"
-import Foundation from "foundation-sites"
 
 $(() => {
   let sessionTimeOutEnabled = true;
@@ -8,17 +7,18 @@ $(() => {
   const secondsUntilTimeoutPath = $timeoutModal.data("seconds-until-timeout-path");
   const heartbeatPath = $timeoutModal.data("heartbeat-path");
   const interval = parseInt($timeoutModal.data("session-timeout-interval"), 10);
+  const preventTimeOutSeconds = $timeoutModal.data("prevent-timeout-seconds");
   let endsAt = moment().add(timeoutInSeconds, "seconds");
   let lastAction = moment();
-  const popup = new Foundation.Reveal($timeoutModal);
   const $continueSessionButton = $("#continueSession");
   let lastActivityCheck = moment();
   // 5 * 60 seconds = 5 Minutes
   const activityCheckInterval = 5 * 60;
+  const preventTimeOutUntil = moment().add(preventTimeOutSeconds, "seconds");
 
   // Ajax request is made at timeout_modal.html.erb
   $continueSessionButton.on("click", () => {
-    $("#timeoutModal").foundation("close");
+    $timeoutModal.foundation("close");
     // In admin panel we have to hide all overlays
     $(".reveal-overlay").css("display", "none");
     lastActivityCheck = moment();
@@ -82,7 +82,12 @@ $(() => {
     }
 
     const timeRemaining = Math.round((endsAt - moment()) / 1000);
-    if (timeRemaining > 150) {
+    if (timeRemaining > 170) {
+      return;
+    }
+
+    if (moment() < preventTimeOutUntil) {
+      heartbeat();
       return;
     }
 
@@ -95,7 +100,7 @@ $(() => {
       } else if (secondsUntilSessionExpires <= 90) {
         $timeoutModal.find("#reveal-hidden-sign-out")[0].click();
       } else if (secondsUntilSessionExpires <= 150) {
-        popup.open();
+        $timeoutModal.foundation("open");
       }
     });
   }, interval);

data/app/packs/stylesheets/decidim/modules/_cards.scss

@@ -30,6 +30,8 @@ $datetime-bg: var(--primary);
   border-radius: $card-border-radius;
   // Keep visible for accessibility (active/focused card as a link)
   overflow: visible;
+  overflow-wrap: break-word;
+  hyphens: auto;
 
   @include modifiers(
     border-top-color,

data/app/packs/stylesheets/decidim/modules/_comments.scss

@@ -80,6 +80,8 @@ $comment-form-bg: $light-gray;
 
 .comment__content{
   padding: 0 $comment-padding;
+  overflow-wrap: break-word;
+  hyphens: auto;
 
   > :last-child{
     margin-bottom: 0;

data/app/packs/stylesheets/decidim/modules/_forms.scss

@@ -77,6 +77,11 @@ label > [type="radio"]{
     margin-right: 1rem;
     flex-shrink: 0;
   }
+
+  &,
+  &.tiny{
+    height: auto;
+  }
 }
 
 .switch{

data/app/permissions/decidim/permissions.rb

@@ -116,9 +116,11 @@ module Decidim
     end
 
     def apply_endorsement_permissions
-      return disallow! if !current_settings.endorsements_enabled || current_settings.endorsements_blocked
+      is_allowed = current_settings.endorsements_enabled &&
+                   !current_settings.endorsements_blocked &&
+                   authorized?(:endorse, resource: context.fetch(:resource, nil))
 
-      allow!
+      toggle_allow(is_allowed)
     end
 
     def notification_action?

data/app/presenters/decidim/user_presenter.rb

@@ -13,6 +13,8 @@ module Decidim
     # nickname presented in a twitter-like style
     #
     def nickname
+      return "" if __getobj__.blocked?
+
       "@#{__getobj__.nickname}"
     end
 
@@ -33,13 +35,14 @@ module Decidim
     end
 
     def avatar_url(variant = nil)
+      return default_avatar_url if __getobj__.blocked?
       return avatar.default_url unless avatar.attached?
 
       avatar.path(variant: variant)
     end
 
     def default_avatar_url
-      attached_uploader.default_url
+      attached_uploader(:avatar).default_url
     end
 
     def profile_path

data/app/validators/password_validator.rb

@@ -49,6 +49,15 @@ class PasswordValidator < ActiveModel::EachValidator
     I18n.t "password_validator.#{reason}"
   end
 
+  def organization
+    @organization ||= organization_from_record
+  end
+
+  def organization_from_record
+    return record.current_organization if record.respond_to?(:current_organization)
+    return record.organization if record.respond_to?(:organization)
+  end
+
   def strong?
     VALIDATION_METHODS.each do |method|
       @weak_password_reasons << method.to_s.sub(/\?$/, "").to_sym if send(method.to_s)
@@ -96,10 +105,10 @@ class PasswordValidator < ActiveModel::EachValidator
   end
 
   def domain_included_in_password?
-    return false unless record&.current_organization&.host
-    return true if value.include?(record.current_organization.host)
+    return false unless organization && organization.host
+    return true if value.include?(organization.host)
 
-    record.current_organization.host.split(".").each do |part|
+    organization.host.split(".").each do |part|
       next if part.length < IGNORE_SIMILARITY_SHORTER_THAN
 
       return true if value.include?(part)

data/app/views/decidim/data_portability/show.html.erb

@@ -1,7 +1,7 @@
 <% add_decidim_page_title(t("my_data", scope: "layouts.decidim.user_profile")) %>
 <% content_for(:subtitle) { t("my_data", scope: "layouts.decidim.user_profile") } %>
 
-<div class="row data-portability">
+<div class="data-portability">
   <strong><%= t(".download_data") %></strong>
   <p><%= t(".download_data_description", user_email: current_user.email).html_safe %></p>
   <%= button_to t(".request_data"), export_data_portability_path, class: "button", data: { disable: true } %>

data/app/views/decidim/devise/invitations/edit.html.erb

@@ -27,11 +27,11 @@
 
             <% if f.object.class.require_password_on_accepting %>
               <div class="field">
-                <p><%= f.password_field :password, required: "required", minlength: ::Devise.password_length.min, maxlength: ::Devise.password_length.max %></p>
+                <p><%= f.password_field :password, required: "required", minlength: ::PasswordValidator::MINIMUM_LENGTH, maxlength: ::PasswordValidator::MAX_LENGTH %></p>
               </div>
 
               <div class="field">
-                <p><%= f.password_field :password_confirmation, required: "required", minlength: ::Devise.password_length.min, maxlength: ::Devise.password_length.max %></p>
+                <p><%= f.password_field :password_confirmation, required: "required", minlength: ::PasswordValidator::MINIMUM_LENGTH, maxlength: ::PasswordValidator::MAX_LENGTH %></p>
               </div>
             <% end %>
           </div>