decidim-core 0.26.4 → 0.26.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1863adec9ae8ce9d4d528f247a2f18561de3618eacb84e50c03fae6a89fb2d6e
-  data.tar.gz: 032b9cce96757af5e5d87d687f64231a1630fdc003973b3b16cc4044f7f667bb
+  metadata.gz: 2d573b856227ec581d40d90cff9a85c1f21502a1ed6278b82aa9768a434f0e9c
+  data.tar.gz: 2ca2fff70b6e6b9314450c35ab22965b3ba60af303a2839c7716e502cb566b3a
 SHA512:
-  metadata.gz: 44579a2195e6d79ca6e5d78a1695815c4db2d2dd850b9a94e819d5219cda61cad771aa172ad99628bb9460e79a99b02fa4cd72fb377649b565b22ad010eb6924
-  data.tar.gz: 959d4d1552af3fd6b25fb1fb27292d8d107c260bedddd5a49dce829f6271772fd8a2c043d401cdc5061a615e1de71157d0b084eeab3b794e9aa3373451ad7ef8
+  metadata.gz: 1000d09afe7e9af0586fa14c917c77a150bf9f55adee9d0a243744799a9cf9c84aa364b0f014cdec6eda3855c10b4b15772732c979d9f15e381c8a62e78aad8f
+  data.tar.gz: 1a4feafaa713a4fa540aab815e0306f125cc74d45599d5defbec2e9dd2cce8bc6223acd0148424b3973a0f1d6853b96cd3ee9a6fda7ff45cc91073fd2b84ac8a

data/app/cells/decidim/announcement_cell.rb

@@ -62,7 +62,7 @@ module Decidim
     end
 
     def clean(value)
-      decidim_sanitize(translated_attribute(value))
+      decidim_sanitize_admin(translated_attribute(value))
     end
   end
 end

data/app/cells/decidim/content_blocks/cta_cell.rb

@@ -16,7 +16,7 @@ module Decidim
       end
 
       def translated_description
-        @translated_description ||= decidim_sanitize_editor(translated_attribute(model.settings.description))
+        @translated_description ||= decidim_sanitize_editor_admin(translated_attribute(model.settings.description))
       end
 
       def button_url

data/app/cells/decidim/content_blocks/hero/show.erb

@@ -6,7 +6,7 @@
           <% if translated_welcome_text.blank? %>
             <%= t("decidim.pages.home.hero.welcome", organization: current_organization.name) %>
           <% else %>
-            <%= decidim_sanitize translated_welcome_text %>
+            <%= decidim_sanitize_admin translated_welcome_text %>
           <% end %>
         </h1>
       </div>

data/app/cells/decidim/content_blocks/highlighted_content_banner/show.erb

@@ -7,7 +7,7 @@
           <%= translated_attribute current_organization.highlighted_content_banner_title %>
         </h1>
         <span class="text-highlight">
-          <%= decidim_sanitize_editor translated_attribute current_organization.highlighted_content_banner_short_description %>
+          <%= decidim_sanitize_editor_admin translated_attribute current_organization.highlighted_content_banner_short_description %>
         </span>
       </div>
       <div class="columns large-2">

data/app/cells/decidim/content_blocks/sub_hero_cell.rb

@@ -15,7 +15,7 @@ module Decidim
       private
 
       def organization_description
-        desc = decidim_sanitize(translated_attribute(current_organization.description))
+        desc = decidim_sanitize_admin(translated_attribute(current_organization.description))
 
         # Strip the surrounding paragraph tag because it is not allowed within
         # a <hN> element.

data/app/cells/decidim/newsletter_templates/base_cell.rb

@@ -25,6 +25,14 @@ module Decidim
       def recipient_user
         options[:recipient_user]
       end
+
+      def custom_url_for_mail_root
+        options[:custom_url_for_mail_root]
+      end
+
+      def decidim
+        @decidim ||= EngineRouter.new("decidim", {})
+      end
     end
   end
 end

data/app/cells/decidim/newsletter_templates/basic_only_text/show.erb

@@ -16,7 +16,7 @@
               <tr>
                 <th>
                   <center>
-                    <%= render partial: "layouts/decidim/mailer_logo.html", locals: { organization: organization } %>
+                    <%= render partial: "layouts/decidim/mailer_logo.html", locals: { organization: organization, custom_url_for_mail_root: custom_url_for_mail_root } %>
                   </center>
                 </th>
               </tr>
@@ -27,7 +27,7 @@
               <tr>
                 <th>
                   <% if organization.official_img_header.attached? %>
-                    <%= link_to organization.official_url do %>
+                    <%= link_to newsletter.organization_official_url do %>
                       <%= image_tag organization.attached_uploader(:official_img_header).path, alt: "", style: "max-height: 50px", class: "float-right" %>
                     <% end %>
                   <% end %>
@@ -72,8 +72,8 @@
           <th class="expander"></th>
           <th class="small-12 first columns cityhall-bar">
             <div class="decidim-logo" style="float: right; text-align: right; padding-right: 16px">
-              <% if @custom_url_for_mail_root.present? %>
-                <%= link_to organization.name.html_safe, @custom_url_for_mail_root %>
+              <% if custom_url_for_mail_root.present? %>
+                <%= link_to organization.name.html_safe, custom_url_for_mail_root %>
               <% else %>
                 <%= link_to organization.name.html_safe, decidim.root_url(host: organization.host) %>
               <% end %>

data/app/cells/decidim/newsletter_templates/image_text_cta/show.erb

@@ -24,7 +24,7 @@ table.button table td {
               <tr>
                 <th>
                   <center>
-                    <%= render partial: "layouts/decidim/mailer_logo.html", locals: { organization: organization } %>
+                    <%= render partial: "layouts/decidim/mailer_logo.html", locals: { organization: organization, custom_url_for_mail_root: custom_url_for_mail_root } %>
                   </center>
                 </th>
               </tr>
@@ -35,7 +35,7 @@ table.button table td {
               <tr>
                 <th>
                   <% if organization.official_img_header.attached? %>
-                    <%= link_to organization.official_url do %>
+                    <%= link_to newsletter.organization_official_url do %>
                       <%= image_tag organization.attached_uploader(:official_img_header).url(host: organization.host), alt: "", style: "max-height: 50px", class: "float-right" %>
                     <% end %>
                   <% end %>
@@ -111,8 +111,8 @@ table.button table td {
           <th class="expander"></th>
           <th class="small-12 first columns cityhall-bar">
             <div class="decidim-logo" style="float: right; text-align: right; padding-right: 16px">
-              <% if @custom_url_for_mail_root.present? %>
-                <%= link_to organization.name.html_safe, @custom_url_for_mail_root %>
+              <% if custom_url_for_mail_root.present? %>
+                <%= link_to organization.name.html_safe, custom_url_for_mail_root %>
               <% else %>
                 <%= link_to organization.name.html_safe, decidim.root_url(host: organization.host) %>
               <% end %>

data/app/commands/decidim/unendorse_resource.rb

@@ -31,7 +31,7 @@ module Decidim
       query = if @current_group.present?
                 @resource.endorsements.where(decidim_user_group_id: @current_group&.id)
               else
-                @resource.endorsements.where(author: @current_user)
+                @resource.endorsements.where(author: @current_user, decidim_user_group_id: nil)
               end
       query.destroy_all
     end

data/app/controllers/decidim/groups_controller.rb

@@ -7,6 +7,7 @@ module Decidim
     include UserGroups
 
     before_action :enforce_user_groups_enabled
+    before_action :ensure_user_group_not_blocked
 
     def new
       enforce_permission_to :create, :user_group, current_user: current_user
@@ -73,6 +74,10 @@ module Decidim
 
     private
 
+    def ensure_user_group_not_blocked
+      raise ActionController::RoutingError, "Blocked User Group" if user_group&.blocked?
+    end
+
     def accepted_user_group
       @accepted_user_group ||= Decidim::UserGroups::AcceptedUserGroups.for(current_user).find_by(nickname: params[:id])
     end

data/app/controllers/decidim/links_controller.rb

@@ -7,9 +7,11 @@ module Decidim
     skip_before_action :store_current_location
 
     helper Decidim::ExternalDomainHelper
+    helper_method :external_url
 
     before_action :parse_url
     rescue_from Decidim::InvalidUrlError, with: :invalid_url
+    rescue_from URI::InvalidURIError, with: :invalid_url
 
     def new
       headers["X-Robots-Tag"] = "noindex"
@@ -19,24 +21,21 @@ module Decidim
 
     def invalid_url
       flash[:alert] = I18n.t("decidim.links.invalid_url")
-      redirect_to decidim.root_path
+      if request.xhr?
+        render "invalid_url"
+      else
+        redirect_to decidim.root_path
+      end
     end
 
     def parse_url
+      raise Decidim::InvalidUrlError if params[:external_url].blank?
       raise Decidim::InvalidUrlError unless external_url
-
-      parts = external_url.match %r{^(([a-z]+):)?//([^/]+)(/.*)?$}
-      raise Decidim::InvalidUrlError unless parts
-
-      @url_parts = {
-        protocol: parts[1],
-        domain: parts[3],
-        path: parts[4]
-      }
+      raise Decidim::InvalidUrlError unless %w(http https).include?(external_url.scheme)
     end
 
     def external_url
-      @external_url ||= params[:external_url]
+      @external_url ||= URI.parse(params[:external_url])
     end
   end
 end

data/app/controllers/decidim/profiles_controller.rb

@@ -13,7 +13,7 @@ module Decidim
     before_action :ensure_profile_holder
     before_action :ensure_profile_holder_is_a_group, only: [:members]
     before_action :ensure_profile_holder_is_a_user, only: [:groups, :following]
-    before_action :ensure_user_not_blocked, only: [:following, :followers, :badges]
+    before_action :ensure_user_not_blocked
 
     def show
       return redirect_to profile_timeline_path(nickname: params[:nickname]) if profile_holder == current_user

data/app/helpers/decidim/cells_helper.rb

@@ -35,6 +35,7 @@ module Decidim
     end
 
     def user_flaggable?
+      return if (try(:profile_holder) || try(:profile_user) || try(:model)).try(:blocked)
       return unless context[:controller].try(:flaggable_controller?)
 
       true

data/app/helpers/decidim/external_domain_helper.rb

@@ -3,10 +3,21 @@
 module Decidim
   module ExternalDomainHelper
     def highlight_domain
+      highlighted_domain = [
+        external_url.host,
+        (external_url.port && [80, 443].include?(external_url.port) ? "" : ":#{external_url.port}")
+      ].join
+
+      path = [
+        external_url.path,
+        (external_url.query ? "?#{external_url.query}" : ""),
+        (external_url.fragment ? "##{external_url.fragment}" : "")
+      ].join
+
       tag.div do
-        content_tag(:span, "#{@url_parts[:protocol]}//") +
-          content_tag(:span, @url_parts[:domain], class: "alert") +
-          content_tag(:span, @url_parts[:path])
+        content_tag(:span, "#{external_url.scheme}://") +
+          content_tag(:span, highlighted_domain, class: "text-alert") +
+          content_tag(:span, path)
       end
     end
   end

data/app/helpers/decidim/icon_helper.rb

@@ -24,7 +24,7 @@ module Decidim
     #
     # Returns an HTML tag with the icon.
     def manifest_icon(manifest, options = {})
-      if manifest.icon
+      if manifest.respond_to?(:icon) && manifest.icon.present?
         external_icon manifest.icon, options
       else
         icon "question-mark", options
@@ -42,9 +42,9 @@ module Decidim
     def resource_icon(resource, options = {})
       if resource.class.name == "Decidim::Comments::Comment"
         icon "comment-square", options
-      elsif resource.respond_to?(:component)
+      elsif resource.respond_to?(:component) && resource.component.present?
         component_icon(resource.component, options)
-      elsif resource.respond_to?(:manifest)
+      elsif resource.respond_to?(:manifest) && resource.manifest.present?
         manifest_icon(resource.manifest, options)
       elsif resource.is_a?(Decidim::User)
         icon "person", options

data/app/helpers/decidim/newsletters_helper.rb

@@ -31,6 +31,7 @@ module Decidim
     # this method is used to generate the root link on mail with the utm_codes
     # If the newsletter_id is nil, it returns the root_url
     def custom_url_for_mail_root(organization, newsletter_id = nil)
+      decidim = EngineRouter.new("decidim", {})
       if newsletter_id.present?
         decidim.root_url(host: organization.host) + utm_codes(organization.host, newsletter_id.to_s)
       else

data/app/helpers/decidim/sanitize_helper.rb

@@ -16,13 +16,18 @@ module Decidim
     #
     # Returns an HTML-safe String.
     def decidim_sanitize(html, options = {})
+      scrubber = options[:scrubber] || Decidim::UserInputScrubber.new
       if options[:strip_tags]
-        strip_tags sanitize(html, scrubber: Decidim::UserInputScrubber.new)
+        strip_tags sanitize(html, scrubber: scrubber)
       else
-        sanitize(html, scrubber: Decidim::UserInputScrubber.new)
+        sanitize(html, scrubber: scrubber)
       end
     end
 
+    def decidim_sanitize_admin(html, options = {})
+      decidim_sanitize(html, { scrubber: Decidim::AdminInputScrubber.new }.merge(options))
+    end
+
     def decidim_sanitize_newsletter(html, options = {})
       if options[:strip_tags]
         strip_tags sanitize(html, scrubber: Decidim::NewsletterScrubber.new)
@@ -32,7 +37,11 @@ module Decidim
     end
 
     def decidim_sanitize_editor(html, options = {})
-      content_tag(:div, decidim_sanitize(html, options), class: %w(ql-editor ql-reset-decidim))
+      content_tag(:div, decidim_sanitize(html, options), class: %w(ql-editor-display))
+    end
+
+    def decidim_sanitize_editor_admin(html, options = {})
+      decidim_sanitize_editor(html, { scrubber: Decidim::AdminInputScrubber.new }.merge(options))
     end
 
     def decidim_html_escape(text)
@@ -102,9 +111,10 @@ module Decidim
     #
     # @return ActiveSupport::SafeBuffer
     def render_sanitized_content(resource, method)
-      content = present(resource).send(method, links: true, strip_tags: !safe_content?)
+      content = present(resource).send(method, links: true, strip_tags: !try(:safe_content?))
 
-      return decidim_sanitize(content, {}) unless safe_content?
+      return decidim_sanitize(content, {}) unless try(:safe_content?)
+      return decidim_sanitize_editor_admin(content, {}) if try(:safe_content_admin?)
 
       decidim_sanitize_editor(content)
     end

data/app/mailers/decidim/newsletter_mailer.rb

@@ -11,14 +11,20 @@ module Decidim
 
     helper_method :cell
 
-    def newsletter(user, newsletter)
+    def newsletter(user, newsletter, preview: false)
       return if user.email.blank?
 
       @organization = user.organization
       @newsletter = newsletter
       @user = user
-
-      @custom_url_for_mail_root = custom_url_for_mail_root(@organization, @newsletter.id) if Decidim.config.track_newsletter_links
+      @preview = preview
+
+      @custom_url_for_mail_root =
+        if @preview
+          "#"
+        elsif Decidim.config.track_newsletter_links
+          custom_url_for_mail_root(@organization, @newsletter.id)
+        end
       @encrypted_token = Decidim::NewsletterEncryptor.sent_at_encrypted(@user.id, @newsletter.sent_at)
 
       with_user(user) do
@@ -40,6 +46,7 @@ module Decidim
         organization: @organization,
         newsletter: @newsletter,
         recipient_user: @user,
+        custom_url_for_mail_root: @custom_url_for_mail_root,
         context: {
           controller: self
         }

data/app/models/decidim/newsletter.rb

@@ -56,6 +56,24 @@ module Decidim
                     .find_by(scoped_resource_id: id)
     end
 
+    def url(**kwargs)
+      proxy_url(:newsletter_url, id: id, **kwargs)
+    end
+
+    def notifications_settings_url(**kwargs)
+      proxy_url(__method__, **kwargs)
+    end
+
+    def unsubscribe_newsletters_url(**kwargs)
+      proxy_url(__method__, **kwargs)
+    end
+
+    def organization_official_url
+      return "#" unless sent?
+
+      organization.official_url || proxy_url(:root_url)
+    end
+
     private
 
     def author_belongs_to_organization
@@ -63,5 +81,15 @@ module Decidim
 
       errors.add(:author, :invalid) unless author.organization == organization
     end
+
+    def proxy_url(method, **kwargs)
+      return "#" unless sent?
+
+      router.public_send(method, host: organization.host, **kwargs)
+    end
+
+    def router
+      @router ||= EngineRouter.new("decidim", {})
+    end
   end
 end

data/app/models/decidim/scope_type.rb

@@ -15,5 +15,33 @@ module Decidim
     has_many :scopes, class_name: "Decidim::Scope", inverse_of: :scope_type, dependent: :nullify
 
     validates :name, presence: true
+
+    before_destroy :detach_dynamic_associations
+
+    def self.log_presenter_class_for(_log)
+      Decidim::AdminLog::ScopeTypePresenter
+    end
+
+    private
+
+    # This method detaches all records that may have association with the scope
+    # type. This cannot be done directly using the `dependent` option in the
+    # `has_many` relation in order to avoid tight coupling between the modules.
+    #
+    # This logic does not have to be applied to any classes that have been
+    # defined as `has_many` associations within this model already as they are
+    # already handled by the `dependent` option.
+    def detach_dynamic_associations
+      ActiveRecord::Base.descendants.each do |cls|
+        next if cls.abstract_class? || !cls.name&.match?(/^Decidim::/)
+        next if [self.class, Decidim::Scope].include?(cls)
+
+        cls.reflect_on_all_associations(:belongs_to).each do |ref|
+          next unless ref.options[:class_name] == self.class.name
+
+          cls.where(ref.options[:foreign_key] => id).update_all(ref.options[:foreign_key] => nil) # rubocop:disable Rails/SkipsModelValidations
+        end
+      end
+    end
   end
 end

data/app/models/decidim/user.rb

@@ -35,8 +35,6 @@ module Decidim
     has_many :access_grants, class_name: "Doorkeeper::AccessGrant", foreign_key: :resource_owner_id, dependent: :destroy
     has_many :access_tokens, class_name: "Doorkeeper::AccessToken", foreign_key: :resource_owner_id, dependent: :destroy
 
-    has_one :blocking, class_name: "Decidim::UserBlock", foreign_key: :id, primary_key: :block_id, dependent: :destroy
-
     validates :name, presence: true, unless: -> { deleted? }
     validates :nickname,
               presence: true,

data/app/models/decidim/user_base_entity.rb

@@ -17,6 +17,8 @@ module Decidim
     has_many :notifications, foreign_key: "decidim_user_id", class_name: "Decidim::Notification", dependent: :destroy
     has_many :following_follows, foreign_key: "decidim_user_id", class_name: "Decidim::Follow", dependent: :destroy
 
+    has_one :blocking, class_name: "Decidim::UserBlock", foreign_key: :id, primary_key: :block_id, dependent: :destroy
+
     # Regex for name & nickname format validations
     REGEXP_NAME = /\A(?!.*[<>?%&\^*#@()\[\]=+:;"{}\\|])/.freeze
 

data/app/models/decidim/user_block.rb

@@ -4,7 +4,7 @@ module Decidim
   class UserBlock < ApplicationRecord
     MINIMUM_JUSTIFICATION_LENGTH = 15
 
-    belongs_to :user, class_name: "Decidim::User", foreign_key: :decidim_user_id
-    belongs_to :blocking_user, class_name: "Decidim::User"
+    belongs_to :user, class_name: "Decidim::UserBaseEntity", foreign_key: :decidim_user_id
+    belongs_to :blocking_user, class_name: "Decidim::UserBaseEntity"
   end
 end

data/app/models/decidim/user_group.rb

@@ -21,7 +21,7 @@ module Decidim
              foreign_key: :decidim_user_id,
              source: :user
 
-    validates :name, presence: true, uniqueness: { scope: :decidim_organization_id }
+    validates :name, presence: true, uniqueness: { scope: :decidim_organization_id }, unless: -> { blocked? }
 
     validate :correct_state
     validate :unique_document_number, if: :has_document_number?

data/app/packs/src/decidim/editor/clipboard_override.js

@@ -70,7 +70,9 @@ export default class ClipboardOverride extends Clipboard {
     const text = ev.clipboardData.getData("text/plain");
     const files = Array.from(ev.clipboardData.files || []);
     if (!html && files.length > 0) {
-      this.quill.uploader.upload(range, files);
+      if (typeof this.quill.uploader !== "undefined") {
+        this.quill.uploader.upload(range, files);
+      }
       return;
     }
     if (html && files.length > 0) {
@@ -79,7 +81,9 @@ export default class ClipboardOverride extends Clipboard {
         doc.body.childElementCount === 1 &&
         doc.body.firstElementChild.tagName === "IMG"
       ) {
-        this.quill.uploader.upload(range, files);
+        if (typeof this.quill.uploader !== "undefined") {
+          this.quill.uploader.upload(range, files);
+        }
         return;
       }
     }