decidim-core 0.26.4 → 0.26.7

data/app/packs/stylesheets/decidim/vizzs/_rowchart.scss

@@ -27,8 +27,8 @@
   @mixin loop-colors-types($color, $max: 12){
     @for $i from 0 through ($max - 1){
       $interval: ($i % 4) * 24 + 1;
-      $tints: tint($color, $interval);
-      $shades: shade($color, $interval);
+      $tints: tint($color, $interval * 1%);
+      $shades: shade($color, $interval * 1%);
       $adjusts: adjust-color($color, $lightness: $interval * 1%, $hue: -$interval);
 
       .type-#{$i}{

data/app/presenters/decidim/admin_log/user_group_presenter.rb

@@ -20,7 +20,7 @@ module Decidim
 
       def action_string
         case action
-        when "verify", "verify_via_csv", "reject"
+        when "verify", "verify_via_csv", "reject", "block", "unblock"
           "decidim.admin_log.user_group.#{action}"
         else
           super

data/app/presenters/decidim/admin_log/user_moderation_presenter.rb

@@ -52,7 +52,7 @@ module Decidim
       end
 
       def unreported_user
-        @unreported_user ||= Decidim::User.find_by(id: action_log.extra.dig("extra", "user_id"))
+        @unreported_user ||= Decidim::UserBaseEntity.find_by(id: action_log.extra.dig("extra", "user_id"))
       end
 
       def has_diff?

data/app/presenters/decidim/notification_presenter.rb

@@ -11,7 +11,7 @@ module Decidim
 
     def created_at_in_words
       if created_at.between?(1.month.ago, Time.current)
-        time_ago_in_words(created_at)
+        I18n.t("decidim.user_conversations.index.time_ago", time: time_ago_in_words(created_at))
       else
         format = created_at.year == Time.current.year ? :ddmm : :ddmmyyyy
         I18n.l(created_at, format: format)

data/app/presenters/decidim/user_group_presenter.rb

@@ -16,7 +16,7 @@ module Decidim
     end
 
     def can_be_contacted?
-      true
+      true unless blocked?
     end
 
     def officialization_text

data/app/presenters/decidim/user_presenter.rb

@@ -61,7 +61,7 @@ module Decidim
     end
 
     def can_be_contacted?
-      true
+      true unless blocked?
     end
 
     def officialization_text

data/app/scrubbers/decidim/admin_input_scrubber.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+module Decidim
+  # Use this class as a scrubber to sanitize admin user input. The default
+  # scrubbed provided by Rails does not allow `iframe`s, and we are using
+  # them to embed videos, so we need to provide a whole new scrubber.
+  #
+  # Example:
+  #
+  #    sanitize(@page.body, scrubber: Decidim::AdminInputScrubber.new)
+  #
+  # Lists of default tags and attributes are extracted from
+  # https://stackoverflow.com/a/35073814/2110884.
+  class AdminInputScrubber < UserInputScrubber
+    private
+
+    DECIDIM_ALLOWED_TAGS = %w(img video audio source comment iframe).freeze
+
+    def custom_allowed_attributes
+      super + %w(frameborder allowfullscreen) - %w(onerror)
+    end
+
+    def custom_allowed_tags
+      super + DECIDIM_ALLOWED_TAGS
+    end
+  end
+end

data/app/scrubbers/decidim/user_input_scrubber.rb

@@ -1,9 +1,7 @@
 # frozen_string_literal: true
 
 module Decidim
-  # Use this class as a scrubber to sanitize user input. The default
-  # scrubbed provided by Rails does not allow `iframe`s, and we're using
-  # them to embed videos, so we need to provide a whole new scrubber.
+  # Use this class as a scrubber to sanitize participant user input.
   #
   # Example:
   #
@@ -20,12 +18,41 @@ module Decidim
 
     private
 
+    RESTRICTED_TAGS = %w(
+      area
+      article
+      aside
+      audio
+      button
+      canvas
+      fieldset
+      figcaption
+      figure
+      font
+      footer
+      form
+      header
+      img
+      input
+      label
+      legend
+      main
+      map
+      menu
+      optgroup
+      option
+      output
+      select
+      textarea
+      video
+    ).freeze
+
     def custom_allowed_attributes
-      Loofah::HTML5::SafeList::ALLOWED_ATTRIBUTES + %w(frameborder allowfullscreen) - %w(onerror)
+      Loofah::HTML5::SafeList::ALLOWED_ATTRIBUTES
     end
 
     def custom_allowed_tags
-      Loofah::HTML5::SafeList::ALLOWED_ELEMENTS_WITH_LIBXML2 + %w(iframe)
+      Loofah::HTML5::SafeList::ACCEPTABLE_ELEMENTS - RESTRICTED_TAGS
     end
   end
 end

data/app/services/decidim/traceability.rb

@@ -117,6 +117,7 @@ module Decidim
       return unless user.is_a?(Decidim::User)
       # If the record is not valid, it may not yet have an ID causing an
       # exception when trying to save the log record.
+      return if resource.nil?
       return unless resource.valid?
 
       Decidim::ActionLogger.log(

data/app/views/decidim/links/_invalid_url_modal.html.erb

@@ -0,0 +1,17 @@
+<%= decidim_modal id: "external-domain-warning" do %>
+  <div data-dialog-container>
+    <%= icon "external-link-line" %>
+    <h2 id="dialog-title-external-domain-warning" tabindex="-1" data-dialog-title><%= t("decidim.links.warning.title") %></h2>
+    <div>
+
+      <code class="mt-5 block break-all text-alert">
+        <%= flash[:alert] %>
+      </code>
+    </div>
+  </div>
+  <div data-dialog-actions>
+    <button class="button button__lg button__transparent-secondary" data-dialog-close="external-domain-warning">
+      <%= t("decidim.links.warning.cancel") %>
+    </button>
+  </div>
+<% end %>

data/app/views/decidim/links/_modal.html.erb

@@ -13,7 +13,7 @@
       </div>
     </div>
     <div class="row buttons">
-      <%= link_to t("decidim.links.warning.proceed"), params[:external_url], target: "_blank", data: { close: "" }, class: "button primary button--nomargin" %>
+      <%= link_to t("decidim.links.warning.proceed"), external_url.to_s, target: "_blank", data: { close: "" }, class: "button primary button--nomargin" %>
       <button class="button clear" data-close>
         <%= t("decidim.links.warning.cancel") %>
       </button>

data/app/views/decidim/links/invalid_url.js.erb

@@ -0,0 +1,24 @@
+(function() {
+  const create = (selector) => {
+    const element = document.createElement("div")
+    element.id = selector
+    document.body.append(element)
+    return element
+  }
+
+  const selector = "external-domain-warning"
+  const selectorContainer = `${selector}-container`
+
+  // if the container does not exist in the DOM, it creates a new one, otherwise, replace the content
+  const externalDomainWarning = document.getElementById(selectorContainer) || create(selectorContainer)
+
+  externalDomainWarning.innerHTML = ''
+  externalDomainWarning.innerHTML = '<%= j(render partial: "invalid_url_modal").strip.html_safe %>'
+
+  new window.Decidim.Dialogs(`#${selector}`, {
+    closingSelector: `[data-dialog-close="${selector}"]`,
+    backdropSelector: `[data-dialog="${selector}"]`,
+    labelledby: `dialog-title-${selector}`,
+    describedby: `dialog-desc-${selector}`
+  }).open()
+})()

data/app/views/decidim/links/new.html.erb

@@ -12,7 +12,7 @@
           </div>
           <div class="row">
             <div class="columns large-12 text-center">
-              <%= link_to t("decidim.links.warning.proceed"), params[:external_url], class: "button expanded primary" %>
+              <%= link_to t("decidim.links.warning.proceed"), external_url.to_s, class: "button expanded primary" %>
             </div>
           </div>
         </div>

data/app/views/decidim/messaging/conversations/_conversation.html.erb

@@ -33,11 +33,7 @@
         <span class="text-small">
           <%= t("last_message", scope: "decidim.messaging.conversations.index") %>:
           <strong>
-            <% if I18n.locale != :en %>
-              <%= t("ago", scope: "decidim.messaging.conversations.index") %> <%= time_ago_in_words(Time.parse(conversation.last_message.created_at.to_s)) %>
-            <% else %>
-              <%= time_ago_in_words(Time.parse(conversation.last_message.created_at.to_s)) %> <%= t("ago", scope: "decidim.messaging.conversations.index") %>
-            <% end %>
+            <%= t("decidim.user_conversations.index.time_ago", time: time_ago_in_words(Time.zone.parse(conversation.last_message.created_at.to_s))) %>
           </strong>
         </span>
       </div>

data/app/views/decidim/newsletter_mailer/newsletter.html.erb

@@ -1,16 +1,16 @@
 <%= decidim_sanitize_newsletter cell.to_s %>
 
 <% content_for :note do %>
-  <%== t ".note", organization_name: h(@organization.name), link: decidim.notifications_settings_url(host: @organization.host) %>
+  <%== t ".note", organization_name: h(@organization.name), link: @newsletter.notifications_settings_url %>
 <% end %>
 
 <% content_for :unsubscribe do %>
-  <%== t ".unsubscribe", link: decidim.unsubscribe_newsletters_url(host: @organization.host, u: @encrypted_token ) %>
+  <%== t ".unsubscribe", link: @newsletter.unsubscribe_newsletters_url(u: @encrypted_token) %>
 <% end %>
 
 <% content_for :see_on_website do %>
   <center style="display: none">
     <%== CGI.unescapeHTML truncate(cell.body, max_length: 50) %>
   </center>
-  <%== t ".see_on_website", link: decidim.newsletter_url(host: @organization.host, id: @newsletter) %>
+  <%== t ".see_on_website", link: @newsletter.url %>
 <% end %>

data/app/views/decidim/newsletters/show.html.erb

@@ -5,7 +5,7 @@
   newsletter: newsletter,
   recipient_user: @user
 ) %>
-<%= decidim_sanitize_editor @cell.to_s %>
+<%= decidim_sanitize_newsletter @cell.to_s %>
 
 <% content_for :note do %>
   <%== t "note", scope: "decidim.newsletter_mailer.newsletter", organization_name: h(@organization.name), link: decidim.notifications_settings_url(host: @organization.host) %>

data/app/views/decidim/pages/_standalone.html.erb

@@ -10,7 +10,7 @@
 
     <div class="columns small-12">
       <div class="card">
-        <div class="card__content"><%= decidim_sanitize translated_attribute page.content %></div>
+        <div class="card__content"><%= decidim_sanitize_editor_admin translated_attribute page.content %></div>
       </div>
     </div>
 

data/app/views/decidim/pages/_tabbed.html.erb

@@ -32,7 +32,7 @@
                 <h2>
                   <%= translated_attribute page.title %>
                 </h2>
-                <%= decidim_sanitize_editor translated_attribute page.content %>
+                <%= decidim_sanitize_editor_admin translated_attribute page.content %>
               </div>
             </div>
           </div>

data/app/views/layouts/decidim/_mailer_logo.html.erb

@@ -1,6 +1,6 @@
 <% if organization %>
-  <% if @custom_url_for_mail_root.present? %>
-    <% url = @custom_url_for_mail_root %>
+  <% if defined?(custom_url_for_mail_root) && custom_url_for_mail_root.present? %>
+    <% url = custom_url_for_mail_root %>
   <% else %>
     <% url = decidim.root_url(host: organization.host) %>
   <% end %>

data/app/views/layouts/decidim/newsletter_base.html.erb

@@ -6,7 +6,7 @@
     <%= stylesheet_pack_tag "decidim_email" %>
   </head>
 
-  <body>
+  <%= content_tag :body, class: @preview ? "preview" : nil do %>
     <!-- <style> -->
     <table class="body">
       <% if content_for?(:see_on_website) %>
@@ -42,5 +42,5 @@
         </td>
       </tr>
     </table>
-  </body>
+  <% end %>
 </html>