decidim-core 0.26.2 → 0.27.0.rc2

data/app/services/decidim/iframe_disabler.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+module Decidim
+  class IframeDisabler
+    def initialize(text, _options = {})
+      @text = text
+    end
+
+    def perform
+      @document = Nokogiri::HTML::DocumentFragment.parse(@text)
+      disable_iframes(@document)
+      document.to_html
+    end
+
+    private
+
+    attr_reader :document
+
+    def disable_iframes(node)
+      if node.name == "iframe"
+        orig_node = node.to_s
+        node.replace(%(<div class="disabled-iframe"><!-- #{orig_node} --></div>))
+      end
+
+      node.children.each do |child|
+        disable_iframes(child)
+      end
+    end
+  end
+end

data/app/services/decidim/notification_generator_for_recipient.rb

@@ -31,7 +31,7 @@ module Decidim
       return unless resource
       return unless recipient
 
-      notification.save!
+      notification if notification.save!
     end
 
     private

data/app/services/decidim/notifications_digest_sending_decider.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+module Decidim
+  class NotificationsDigestSendingDecider
+    class << self
+      def must_notify?(user, time: Time.now.utc)
+        return true if user.digest_sent_at.blank?
+
+        # Note that we are checking whether the notifications were sent at any
+        # time during the assumed sending day moment to prevent potential issues
+        # during the sending if the digest_sent_at is set to some other moment
+        # than the exact beginning of that day.
+        case user.notifications_sending_frequency.to_sym
+        when :none then false
+        when :daily then user.digest_sent_at <= (time - 1.day).end_of_day
+        when :weekly then user.digest_sent_at <= (time - 1.day - 1.week).end_of_day
+        else true
+        end
+      end
+    end
+  end
+end

data/app/services/decidim/notifications_subscriptions_persistor.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+module Decidim
+  # This class manages the creation and deletion of user notifications
+
+  class NotificationsSubscriptionsPersistor
+    attr_reader :user
+
+    def initialize(user)
+      @user = user
+    end
+
+    def add_subscription(params)
+      subscriptions = user.notification_settings["subscriptions"] || {}
+      filtered_params = filter_params(params)
+      new_subscription = { filtered_params[:auth] => filtered_params }
+      user.notification_settings["subscriptions"] = subscriptions.merge(new_subscription)
+      user.save
+    end
+
+    def delete_subscription(auth_key)
+      subscriptions = user.notification_settings["subscriptions"] || {}
+      user.notification_settings["subscriptions"] = subscriptions.except(auth_key)
+      user.save
+    end
+
+    private
+
+    def filter_params(params)
+      {
+        auth: params[:keys][:auth],
+        p256dh: params[:keys][:p256dh],
+        endpoint: params[:endpoint]
+      }
+    end
+  end
+end

data/app/services/decidim/open_data_exporter.rb

@@ -23,7 +23,7 @@ module Decidim
     def export
       dirname = File.dirname(path)
       FileUtils.mkdir_p(dirname) unless File.directory?(dirname)
-      File.open(path, "wb") { |file| file.write(data) }
+      File.binwrite(path, data)
     end
 
     private

data/app/services/decidim/resource_search.rb

@@ -1,177 +1,30 @@
 # frozen_string_literal: true
 
 module Decidim
-  # This is the base class to be used by other search services.
-  # Searchlight documentation: https://github.com/nathanl/searchlight
-  class ResourceSearch < Searchlight::Search
-    attr_reader :user, :organization, :component
+  # This is the base class to be used by other search services. This helps the
+  # searches to work with context attributes that are not passed from the user
+  # interface.
+  class ResourceSearch < Ransack::Search
+    attr_reader :user, :organization, :component, :search_context
 
-    # Initialize the Searchlight::Search base class with the options provided.
-    #
-    # scope   - The scope used to create the base query
-    # options - A hash of options to modify the search. These options will be
-    #          converted to methods by SearchLight so they can be used on filter
-    #          methods. (Default {})
-    def initialize(scope, options = {})
-      super(options)
-      @scope = scope
+    def initialize(object, params = {}, options = {})
       @user = options[:current_user] || options[:user]
       @component = options[:component]
       @organization = options[:organization] || component&.organization
-    end
-
-    # Public: Companion method to `search_search_text` which defines the
-    # attributes where we should search for text values in a model.
-    def self.text_search_fields(*fields)
-      @text_search_fields = fields if fields.any?
-      @text_search_fields
-    end
-
-    # Handle the search_text filter. We have to cast the JSONB columns
-    # into a `text` type so that we can search.
-    def search_search_text
-      return query unless self.class.text_search_fields.any?
-
-      fields = self.class.text_search_fields.dup
-
-      text_query = query.where(localized_search_text_in("#{query.model_name.plural}.#{fields.shift}"), text: "%#{search_text}%")
-
-      fields.each do |field|
-        text_query = text_query.or(query.where(localized_search_text_in("#{query.model_name.plural}.#{field}"), text: "%#{search_text}%"))
-      end
-      text_query
-    end
-
-    # Creates the SearchLight base query.
-    # Check if the option component was provided.
-    def base_query
-      raise "Missing component" unless component
-
-      @scope.where(component: component)
-    end
-
-    # Handle the category_id filter
-    def search_category_id
-      return query if category_ids.include?("all")
-
-      query
-        .includes(:categorization)
-        .where(decidim_categorizations: { decidim_category_id: all_category_ids })
-    end
-
-    # Handles the scope_ids filter. When we want to show only those that do not
-    # have a scope_ids set, we cannot pass an empty String or nil because Searchlight
-    # will automatically filter out these params, so the method will not be used.
-    # Instead, we need to pass a fake ID and then convert it inside. In this case,
-    # in order to select those elements that do not have a scope_ids set we use
-    # `"global"` as parameter, and in the method we do the needed changes to search
-    # properly.
-    def search_scope_id
-      return query if scope_ids.include?("all")
-
-      clean_scope_ids = scope_ids
-
-      conditions = []
-      conditions << "#{query.model_name.plural}.decidim_scope_id IS NULL" if clean_scope_ids.delete("global")
-      conditions.concat(["? = ANY(decidim_scopes.part_of)"] * clean_scope_ids.count) if clean_scope_ids.any?
-
-      query.includes(:scope).references(:decidim_scopes).where(Arel.sql(conditions.join(" OR ")).to_s, *clean_scope_ids.map(&:to_i))
-    end
-
-    # Handle the origin filter.
-    def search_origin
-      renamed_origin = Array(origin).map do |search_value|
-        "#{search_value}_origin"
-      end
-      apply_scopes(%w(official_origin citizens_origin user_group_origin meeting_origin), renamed_origin)
-    end
-
-    # We overwrite the `results` method to ensure we only return unique
-    # results. We can't use `#uniq` because it returns an Array and we're
-    # adding scopes in the controller, and `#distinct` doesn't work here
-    # because in the later scopes we're ordering by `RANDOM()` in a DB level,
-    # and `SELECT DISTINCT` doesn't work with `RANDOM()` sorting, so we need
-    # to perform two queries.
-    #
-    # The correct behaviour is backed by tests.
-    def results
-      base_query.model.where(id: super.pluck(:id))
-    end
-
-    private
-
-    # Private: To be used by classes that inherit from ResourceSearch.
-    #
-    # This method is useful when the values of the filters match the names of
-    # defined scopes in a model, it applies those scopes that are included in
-    # the search values.
-    #
-    # Example:
-    #   Consider you want to filter by state, and your model has an `open` and
-    #   a `closed` ActiveRecord scope.
-    #
-    #   def search_state
-    #     apply_scopes(%w(open closed), state)
-    #   end
-    #
-    #   In this scenario, the `state` variable has the input by the use, who
-    #   has selected which states they want to see. `states` here is an array
-    #   of strings.
-    #
-    # Returns an ActiveRecord::Relation.
-    def apply_scopes(scopes, search_values)
-      search_values = Array(search_values)
-
-      conditions = scopes.map do |scope|
-        search_values.member?(scope.to_s) ? query.try(scope) : nil
-      end.compact
-
-      return query unless conditions.any?
-
-      scoped_query = query.where(id: conditions.shift)
-
-      conditions.each do |condition|
-        scoped_query = scoped_query.or(query.where(id: condition))
-      end
-
-      scoped_query
-    end
-
-    # Private: Creates an array of category ids.
-    # It contains categories' subcategories ids as well.
-    def all_category_ids
-      cat_ids = category_ids.without("without")
-
-      component
-        .categories
-        .where(id: cat_ids)
-        .or(component.categories.where(parent_id: cat_ids))
-        .pluck(:id).tap { |ids| ids.prepend(nil) if category_ids.include?("without") }
-    end
-
-    # Private: Returns an array with checked category ids.
-    def category_ids
-      Array(category_id)
-    end
+      @search_context = options[:search_context] || :participants
+      configure(options)
 
-    # Private: Returns an array with checked scope ids.
-    def scope_ids
-      if scope_id.is_a?(Hash)
-        scope_id.values
-      else
-        Array(scope_id)
-      end
+      # The super method calls the build method in the super class, which can be
+      # overridden by the individual search implementations, so call this as the
+      # last thing at the initialize method. The params are passed to the
+      # build method as the only argument.
+      super
     end
 
-    # Internal: builds the needed query to search for a text in the organization's
-    # available locales. Note that it is intended to be used as follows:
-    #
-    # Example:
-    #   Resource.where(localized_search_text_for(:title, text: "my_query"))
-    #
-    # The Hash with the `:text` key is required or it won't work.
-    def localized_search_text_in(field)
-      organization.available_locales.map { |l| "#{field} ->> '#{l}' ILIKE :text" }.join(" OR ")
+    def configure(options)
+      # This can be overridden by the search implementations in order to set
+      # extra variables based on the options passed to the search class before
+      # calling the build method below.
     end
   end
 end

data/app/services/decidim/send_push_notification.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+require "webpush"
+
+module Decidim
+  # This class generates a notification based on the given event, for the given
+  # resource/recipient couple. It is intended to be used by the
+  # `Decidim::NotificationGenerator` class, which schedules a job for each recipient
+  # of the event, so that we can easily control which jobs fail.
+
+  class SendPushNotification
+    include ActionView::Helpers::UrlHelper
+
+    # Send the push notification. Returns `nil` if the user didn't allowed push notifications
+    # or if the subscription to push notifications doesn't exist
+    #
+    # Returns the result of the dispatch or nil if user or subscription are empty
+    def perform(notification)
+      return unless Rails.application.secrets.vapid[:enabled]
+
+      I18n.with_locale(notification.user.locale || notification.user.organization.default_locale) do
+        notification.user.notifications_subscriptions.values.map do |subscription|
+          message_params = notification_params(Decidim::PushNotificationPresenter.new(notification))
+          payload = build_payload(message_params, subscription)
+          # Capture webpush exceptions in order to avoid this call to be repeated by the background job runner
+          # Webpush::Error class is the parent class of all defined errors
+          begin
+            Webpush.payload_send(**payload)
+          rescue Webpush::Error => e
+            Rails.logger.warn("[ERROR] Push notification delivery failed due to #{e.message}")
+            nil
+          end
+        end.compact
+      end
+    end
+
+    private
+
+    def notification_params(notification)
+      {
+        title: notification.title,
+        body: notification.body,
+        icon: notification.icon,
+        data: { url: notification.url }
+      }
+    end
+
+    def build_payload(message_params, subscription)
+      {
+        message: JSON.generate(message_params),
+        endpoint: subscription["endpoint"],
+        p256dh: subscription["p256dh"],
+        auth: subscription["auth"],
+        vapid: {
+          public_key: Rails.application.secrets.vapid[:public_key],
+          private_key: Rails.application.secrets.vapid[:private_key]
+        }
+      }
+    end
+  end
+end

data/app/services/decidim/traceability.rb

@@ -64,7 +64,7 @@ module Decidim
           result = block_given? ? yield : nil
           loggable_resource = resource.is_a?(Class) ? result : resource
           log(action, author, loggable_resource, extra_log_info)
-          return result
+          result
         end
       end
     end

data/app/uploaders/decidim/application_uploader.rb

@@ -47,11 +47,7 @@ module Decidim
       return unless attached?
 
       representable = variant(key)
-      if representable.is_a? ActiveStorage::Attached
-        Rails.application.routes.url_helpers.rails_blob_url(representable.blob, **protocol_option.merge(options))
-      else
-        Rails.application.routes.url_helpers.rails_representation_url(representable, **protocol_option.merge(options))
-      end
+      AssetRouter.new(representable).url(**options)
     end
 
     def path(options = {})
@@ -68,18 +64,12 @@ module Decidim
     def remote_url=(url)
       uri = URI.parse(url)
       filename = File.basename(uri.path)
-      file = URI.open(url)
+      file = URI.parse(url).open
       model.send(mounted_as).attach(io: file, filename: filename)
     rescue URI::InvalidURIError
       model.errors.add(mounted_as, :invalid)
     end
 
-    def protocol_option
-      return {} unless Rails.application.config.force_ssl
-
-      { protocol: "https" }
-    end
-
     class << self
       # Each class inherits variants from parents and can define their own
       # variants with the set_variants class method

data/app/uploaders/decidim/cw/attachment_uploader.rb

@@ -47,7 +47,7 @@ module Decidim::Cw
       return unless image?(self)
 
       manipulate! do |image|
-        raise CarrierWave::IntegrityError, I18n.t("carrierwave.errors.image_too_big") if image.dimensions.any? { |dimension| dimension > max_image_height_or_width }
+        raise CarrierWave::IntegrityError, I18n.t("carrierwave.errors.file_resolution_too_large") if image.dimensions.any? { |dimension| dimension > max_image_height_or_width }
 
         image
       end

data/app/uploaders/decidim/cw/{data_portability_uploader.rb → download_your_data_uploader.rb}

@@ -1,11 +1,11 @@
 # frozen_string_literal: true
 
 module Decidim::Cw
-  # This class deals with saving data portability Zip Files to App
-  class DataPortabilityUploader < ApplicationUploader
+  # This class deals with saving download your data Zip Files to App
+  class DownloadYourDataUploader < ApplicationUploader
     # Override the directory where uploaded files will be stored.
     def store_dir
-      default_path = "uploads/data-portability/"
+      default_path = "uploads/download-your-data/"
 
       return File.join(Decidim.base_uploads_path, default_path) if Decidim.base_uploads_path.present?
 

data/app/uploaders/decidim/cw/image_uploader.rb

@@ -48,14 +48,14 @@ module Decidim::Cw
     # See https://hackerone.com/reports/390
     def validate_dimensions
       manipulate! do |image|
-        validation_error!(I18n.t("carrierwave.errors.image_too_big")) if image.dimensions.any? { |dimension| dimension > max_image_height_or_width }
+        validation_error!(I18n.t("carrierwave.errors.file_resolution_too_large")) if image.dimensions.any? { |dimension| dimension > max_image_height_or_width }
         image
       end
     end
 
     def validate_size
       manipulate! do |image|
-        validation_error!(I18n.t("carrierwave.errors.image_too_big")) if image.size > maximum_upload_size
+        validation_error!(I18n.t("carrierwave.errors.file_size_too_large")) if image.size > maximum_upload_size
         image
       end
     end

data/app/uploaders/decidim/organization_favicon_uploader.rb

@@ -4,8 +4,9 @@ module Decidim
   # This class deals with uploading an organization's favicon.
   class OrganizationFaviconUploader < ImageUploader
     SIZES = {
-      big: 152,
-      medium: 64,
+      huge: 512,
+      big: 192,
+      medium: 180,
       small: 32
     }.freeze
 

data/app/validators/passthru_validator.rb

@@ -18,6 +18,9 @@
 #     validates :image, passthru: { to: Person, attribute: :avatar_image }
 #   end
 class PassthruValidator < ActiveModel::EachValidator
+  # record - Form object (e.g. Decidim::UploadValidationForm)
+  # attribute - The attribute to validate (e.g. :avatar)
+  # value - Blob's signed id (e.g. "eyJfcmFpbHMi...")
   def validate_each(record, attribute, value)
     return unless target_class
 
@@ -25,12 +28,20 @@ class PassthruValidator < ActiveModel::EachValidator
 
     # Create a dummy record for which the validations are actually run on
     dummy = validation_record(record)
+    if dummy.respond_to?(dummy_attr) && !(value.class <= ActiveStorage::Attached)
+      dummy.public_send("#{dummy_attr}=", value)
+      value = dummy.public_send(dummy_attr)
+    elsif dummy.respond_to? :file
+      dummy.public_send("file=", value)
+      value = dummy.public_send(:file)
+    end
 
     target_validators(attribute).each do |validator|
       next unless validator.is_a?(ActiveModel::EachValidator)
       next unless check_validator_conditions(dummy, validator)
 
       dummy.errors.clear
+
       validator.validate_each(dummy, dummy_attr, value)
       dummy.errors[dummy_attr].each do |err|
         record.errors.add(attribute, err)
@@ -67,13 +78,12 @@ class PassthruValidator < ActiveModel::EachValidator
   end
 
   def target_instance(record)
-    instance_attributes = begin
-      if options[:with].respond_to?(:call)
-        options[:with].call(record)
-      else
-        options[:with] || {}
-      end
-    end
+    instance_attributes = if options[:with].respond_to?(:call)
+                            options[:with].call(record)
+                          else
+                            options[:with] || {}
+                          end
+
     instance_attributes.each do |key, val|
       instance_attributes[key] = val.call(record) if val.respond_to?(:call)
     end
@@ -85,24 +95,22 @@ class PassthruValidator < ActiveModel::EachValidator
 
   def check_validator_conditions(record, validator)
     if (condition = validator.options[:if])
-      if_result = begin
-        if condition.respond_to?(:call)
-          condition.call(record)
-        else
-          record.public_send(condition)
-        end
-      end
+      if_result = if condition.respond_to?(:call)
+                    condition.call(record)
+                  else
+                    record.public_send(condition)
+                  end
+
       return false unless if_result
     end
 
     if (condition = validator.options[:unless])
-      unless_result = begin
-        if condition.respond_to?(:call)
-          condition.call(record)
-        else
-          record.public_send(condition)
-        end
-      end
+      unless_result = if condition.respond_to?(:call)
+                        condition.call(record)
+                      else
+                        record.public_send(condition)
+                      end
+
       return false if unless_result
     end
 

data/app/validators/password_validator.rb

@@ -6,6 +6,8 @@ class PasswordValidator < ActiveModel::EachValidator
   MAX_LENGTH = 256
   MIN_UNIQUE_CHARACTERS = 5
   IGNORE_SIMILARITY_SHORTER_THAN = 4
+  ADMIN_MINIMUM_LENGTH = Decidim.config.admin_password_min_length
+  ADMIN_REPETITION_TIMES = Decidim.config.admin_password_repetition_times
   VALIDATION_METHODS = [
     :password_too_short?,
     :password_too_long?,
@@ -15,9 +17,16 @@ class PasswordValidator < ActiveModel::EachValidator
     :email_included_in_password?,
     :domain_included_in_password?,
     :password_too_common?,
-    :blacklisted?
+    :blacklisted?,
+    :password_repeated?
   ].freeze
 
+  def self.minimum_length_for(record)
+    return ADMIN_MINIMUM_LENGTH if record.try(:admin?) && Decidim.config.admin_password_strong
+
+    MINIMUM_LENGTH
+  end
+
   # Check if user's password is strong enough
   #
   # record - Instance of a form (e.g. Decidim::RegistrationForm) or model
@@ -35,7 +44,7 @@ class PasswordValidator < ActiveModel::EachValidator
     return true if strong?
 
     @weak_password_reasons.each do |reason|
-      record.errors[attribute] << get_message(reason)
+      record.errors.add attribute, get_message(reason)
     end
 
     false
@@ -67,7 +76,7 @@ class PasswordValidator < ActiveModel::EachValidator
   end
 
   def password_too_short?
-    value.length < MINIMUM_LENGTH
+    value.length < self.class.minimum_length_for(record)
   end
 
   def password_too_long?
@@ -82,7 +91,7 @@ class PasswordValidator < ActiveModel::EachValidator
     return false if !record.respond_to?(:name) || record.name.blank?
     return true if value.include?(record.name.delete(" "))
 
-    record.name.split(" ").each do |part|
+    record.name.split.each do |part|
       next if part.length < IGNORE_SIMILARITY_SHORTER_THAN
 
       return true if value.include?(part)
@@ -129,4 +138,16 @@ class PasswordValidator < ActiveModel::EachValidator
   def password_too_common?
     Decidim::CommonPasswords.instance.passwords.include?(value)
   end
+
+  def password_repeated?
+    return false unless Decidim.config.admin_password_strong
+    return false unless record.try(:admin?)
+    return false unless record.try(:encrypted_password_changed?)
+
+    [record.encrypted_password_was, *record.previous_passwords].compact_blank.take(ADMIN_REPETITION_TIMES).each do |encrypted_password|
+      return true if Devise::Encryptor.compare(Decidim::User, encrypted_password, value)
+    end
+
+    false
+  end
 end

data/app/validators/uploader_image_dimensions_validator.rb

@@ -28,7 +28,7 @@ class UploaderImageDimensionsValidator < ActiveModel::Validations::FileContentTy
     return unless uploader.validable_dimensions
     return if (image = extract_image(file)).blank?
 
-    record.errors.add attribute, I18n.t("carrierwave.errors.image_too_big") if image.dimensions.any? { |dimension| dimension > uploader.max_image_height_or_width }
+    record.errors.add attribute, I18n.t("carrierwave.errors.file_resolution_too_large") if image.dimensions.any? { |dimension| dimension > uploader.max_image_height_or_width }
   end
 
   def extract_image(file)

data/app/views/decidim/account/_account_notification.js.erb

@@ -0,0 +1,20 @@
+var existingNotification = document.querySelector("main > .flash.callout");
+if (existingNotification) {
+  existingNotification.classList.add("hide");
+}
+
+var accountNotification = document.querySelector(".account-notification");
+document.querySelector("main").prepend(accountNotification);
+
+if (accountNotification.querySelector(".account-message")) {
+  accountNotification.querySelector(".account-message").remove();
+}
+var messageDiv = document.createElement("div");
+messageDiv.classList.add("account-message");
+
+accountNotification.appendChild(messageDiv);
+messageDiv.innerHTML = <%== @text.to_json %>;
+
+accountNotification.classList.add("<%= @alert_class %>");
+accountNotification.classList.remove("hide");
+accountNotification.removeAttribute("style");

data/app/views/decidim/account/_password_fields.html.erb

@@ -1,2 +1,2 @@
-<%= form.password_field :password, value: form.object.password, autocomplete: "off", help_text: t("devise.passwords.edit.password_help", minimun_characters: ::PasswordValidator::MINIMUM_LENGTH) %>
-<%= form.password_field :password_confirmation, value: form.object.password_confirmation, autocomplete: "off" %>
+<%= form.password_field :password, password_field_options_for(current_user) %>
+<%= form.password_field :password_confirmation, password_field_options_for(current_user).except(:help_text) %>

data/app/views/decidim/account/cancel_email_change.js.erb

@@ -0,0 +1,6 @@
+<%= render partial: "account_notification" %>
+
+if ("<%= @alert_class %>" === "success") {
+  document.querySelector("#email-change-pending").classList.add("hide");
+  document.querySelector("#user_email").disabled = false;
+}