decidim-core 0.26.5 → 0.26.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8937550934aed6ed69fa84837edbbc2902c5fd6779654a5180a63abbfe25d700
-  data.tar.gz: ba86b8da585b54db8845cf1d5e476086db70d03920f99ddf3a32cbe023521992
+  metadata.gz: 7ddc4e551d59fc9b95f5121333870c4e91a77eb2f53d03f659d63e16bea7ca7f
+  data.tar.gz: dd766575d88dfe729ce7f8ea151967642b40e875c0596443962d0a6d8d5cd101
 SHA512:
-  metadata.gz: de40caba191fb9ff0b88bbf9055fbb4592fcc12352c6e35d21d812e87399b1772254d669438ade3ada960ca994247ab87b3eb4743e80df9121cb3bb07c6a9f18
-  data.tar.gz: c115b3d2e531d0b0d8e43f7b41a863dc51eb2c076bc8c4f2c8731e642fb191115b2fdf6aebe6a3cf28c48fb746c3e9cec85ea9a5be630d382ee695cff238278f
+  metadata.gz: dcbcc2625fe80e646c9f5e05c0e187485004542bcb73c33978bd8f2b1f78f31c2e0a4f4dba6904ba0b660e5b4408977a21d13e0c02fe2d46cba8bdb13c399321
+  data.tar.gz: a1abc1c25bfe4c99875d00822beeefeadb20bd214672772b1491d07e515ce3990b6b24c96d5400e4bc71d1accb8c8484d7e57c6ed006f63fd19e23f8378234ce

data/app/cells/decidim/announcement_cell.rb

@@ -62,7 +62,7 @@ module Decidim
     end
 
     def clean(value)
-      decidim_sanitize(translated_attribute(value))
+      decidim_sanitize_admin(translated_attribute(value))
     end
   end
 end

data/app/cells/decidim/collapsible_list/show.erb

@@ -16,7 +16,7 @@
     </span>
   </div>
 <% else %>
-  <div class="collapsible-list <%= list_class %>">
+  <div class="<%= list_class %>">
     <% list.each do |element| %>
       <% if cell_name %>
         <%= cell cell_name, element, cell_options %>

data/app/cells/decidim/content_blocks/cta_cell.rb

@@ -16,7 +16,7 @@ module Decidim
       end
 
       def translated_description
-        @translated_description ||= decidim_sanitize_editor(translated_attribute(model.settings.description))
+        @translated_description ||= decidim_sanitize_editor_admin(translated_attribute(model.settings.description))
       end
 
       def button_url

data/app/cells/decidim/content_blocks/hero/show.erb

@@ -6,7 +6,7 @@
           <% if translated_welcome_text.blank? %>
             <%= t("decidim.pages.home.hero.welcome", organization: current_organization.name) %>
           <% else %>
-            <%= decidim_sanitize translated_welcome_text %>
+            <%= decidim_sanitize_admin translated_welcome_text %>
           <% end %>
         </h1>
       </div>

data/app/cells/decidim/content_blocks/highlighted_content_banner/show.erb

@@ -7,7 +7,7 @@
           <%= translated_attribute current_organization.highlighted_content_banner_title %>
         </h1>
         <span class="text-highlight">
-          <%= decidim_sanitize_editor translated_attribute current_organization.highlighted_content_banner_short_description %>
+          <%= decidim_sanitize_editor_admin translated_attribute current_organization.highlighted_content_banner_short_description %>
         </span>
       </div>
       <div class="columns large-2">

data/app/cells/decidim/content_blocks/sub_hero_cell.rb

@@ -15,7 +15,7 @@ module Decidim
       private
 
       def organization_description
-        desc = decidim_sanitize(translated_attribute(current_organization.description))
+        desc = decidim_sanitize_admin(translated_attribute(current_organization.description))
 
         # Strip the surrounding paragraph tag because it is not allowed within
         # a <hN> element.

data/app/controllers/decidim/authorization_modals_controller.rb

@@ -17,7 +17,7 @@ module Decidim
     end
 
     def current_component
-      @current_component ||= Decidim::Component.find(params[:component_id])
+      @current_component ||= Decidim::Component.where(participatory_space: current_organization.participatory_spaces).find(params[:component_id])
     end
 
     def authorization_action

data/app/controllers/decidim/links_controller.rb

@@ -21,24 +21,21 @@ module Decidim
 
     def invalid_url
       flash[:alert] = I18n.t("decidim.links.invalid_url")
-      redirect_to decidim.root_path
+      if request.xhr?
+        render "invalid_url"
+      else
+        redirect_to decidim.root_path
+      end
     end
 
     def parse_url
+      raise Decidim::InvalidUrlError if params[:external_url].blank?
       raise Decidim::InvalidUrlError unless external_url
-
-      parts = external_url.match %r{\A(([a-z]+):)?//([^/]+)(/.*)?\z}
-      raise Decidim::InvalidUrlError unless parts
-
-      @url_parts = {
-        protocol: parts[1],
-        domain: parts[3],
-        path: parts[4]
-      }
+      raise Decidim::InvalidUrlError unless %w(http https).include?(external_url.scheme)
     end
 
     def external_url
-      @external_url ||= URI.parse(params[:external_url]).to_s
+      @external_url ||= URI.parse(params[:external_url])
     end
   end
 end

data/app/forms/url_validator.rb

@@ -6,7 +6,7 @@
 #
 class UrlValidator < ActiveModel::EachValidator
   def validate_each(record, attribute, value)
-    record.errors[attribute] << (options[:message] || "must be a valid URL") unless url_valid?(value)
+    record.errors.add attribute, :url_format, **options unless url_valid?(value)
   end
 
   # a URL may be technically well-formed but may

data/app/helpers/decidim/cells_helper.rb

@@ -35,6 +35,7 @@ module Decidim
     end
 
     def user_flaggable?
+      return if (try(:profile_holder) || try(:profile_user) || try(:model)).try(:blocked)
       return unless context[:controller].try(:flaggable_controller?)
 
       true

data/app/helpers/decidim/external_domain_helper.rb

@@ -3,10 +3,21 @@
 module Decidim
   module ExternalDomainHelper
     def highlight_domain
+      highlighted_domain = [
+        external_url.host,
+        (external_url.port && [80, 443].include?(external_url.port) ? "" : ":#{external_url.port}")
+      ].join
+
+      path = [
+        external_url.path,
+        (external_url.query ? "?#{external_url.query}" : ""),
+        (external_url.fragment ? "##{external_url.fragment}" : "")
+      ].join
+
       tag.div do
-        content_tag(:span, "#{@url_parts[:protocol]}//") +
-          content_tag(:span, @url_parts[:domain], class: "alert") +
-          content_tag(:span, @url_parts[:path])
+        content_tag(:span, "#{external_url.scheme}://") +
+          content_tag(:span, highlighted_domain, class: "text-alert") +
+          content_tag(:span, path)
       end
     end
   end

data/app/helpers/decidim/layout_helper.rb

@@ -74,8 +74,11 @@ module Decidim
       classes = _icon_classes(options) + ["external-icon"]
 
       if path.split(".").last == "svg"
+        icon_path = application_path(path)
+        return unless icon_path
+
         attributes = { class: classes.join(" ") }.merge(options)
-        asset = File.read(application_path(path))
+        asset = File.read(icon_path)
         asset.gsub("<svg ", "<svg#{tag_builder.tag_options(attributes)} ").html_safe
       else
         image_pack_tag(path, class: classes.join(" "), style: "display: none")
@@ -83,9 +86,17 @@ module Decidim
     end
 
     def application_path(path)
-      img_path = asset_pack_path(path)
-      img_path = URI(img_path).path if Decidim.cors_enabled
-      Rails.root.join("public/#{img_path}")
+      # Force the path to be returned without the protocol and host even when a
+      # custom asset host has been defined. The host parameter needs to be a
+      # non-nil because otherwise it will be set to the asset host at
+      # ActionView::Helpers::AssetUrlHelper#compute_asset_host.
+      img_path = asset_pack_path(path, host: "", protocol: :relative)
+      path = Rails.public_path.join(img_path.sub(%r{^/}, ""))
+      return unless File.exist?(path)
+
+      path
+    rescue ::Webpacker::Manifest::MissingEntryError
+      nil
     end
 
     # Allows to create role attribute according to accessibility rules

data/app/helpers/decidim/layout_helper.rb.orig

@@ -0,0 +1,225 @@
+# frozen_string_literal: true
+
+module Decidim
+  # View helpers related to the layout.
+  module LayoutHelper
+    include Decidim::ModalHelper
+    include Decidim::TooltipHelper
+
+    # Public: Generates a set of meta tags that generate the different favicon
+    # versions for an organization.
+    #
+    # Returns a safe String with the versions.
+    def favicon
+      return if current_organization.favicon.blank?
+
+      safe_join(Decidim::OrganizationFaviconUploader::SIZES.map do |version, size|
+        favicon_link_tag(current_organization.attached_uploader(:favicon).variant_url(version, host: current_organization.host), sizes: "#{size}x#{size}")
+      end)
+    end
+
+    def apple_favicon
+      icon_image = current_organization.attached_uploader(:favicon).variant_url(:medium, host: current_organization.host)
+      return unless icon_image
+
+      favicon_link_tag(icon_image, rel: "apple-touch-icon", type: "image/png")
+    end
+
+    def legacy_favicon
+      variant = :favicon if current_organization.favicon.content_type != "image/vnd.microsoft.icon"
+      icon_image = current_organization.attached_uploader(:favicon).variant_url(variant, host: current_organization.host)
+      return unless icon_image
+
+      favicon_link_tag(icon_image, rel: "icon", sizes: "any", type: nil)
+    end
+
+    # Outputs an SVG-based icon.
+    #
+    # name    - The String with the icon name.
+    # options - The Hash options used to customize the icon (default {}):
+    #             :width  - The Number of width in pixels (optional).
+    #             :height - The Number of height in pixels (optional).
+    #             :title - The title for the SVG element (optional, similar to alt for img)
+    #             :aria_label - The String to set as aria label (optional).
+    #             :aria_hidden - The Truthy value to enable aria_hidden (optional).
+    #             :role - The String to set as the role (optional).
+    #             :class - The String to add as a CSS class (optional).
+    #
+    # Returns a String.
+    def redesigned_icon(name, options = {})
+      default_html_properties = {
+        "width" => "1em",
+        "height" => "1em",
+        "role" => "img",
+        "aria-hidden" => "true"
+      }
+
+      html_properties = options.with_indifferent_access.transform_keys(&:dasherize).slice("width", "height", "aria-label", "role", "aria-hidden", "class", "style")
+      html_properties = default_html_properties.merge(html_properties)
+
+      href = Decidim.cors_enabled ? "" : asset_pack_path("media/images/remixicon.symbol.svg")
+
+      content_tag :svg, html_properties do
+        content_tag :use, nil, "href" => "#{href}#ri-#{name}", tabindex: -1
+      end
+    end
+
+    def legacy_icon(name, options = {})
+      options = options.with_indifferent_access
+      html_properties = {}
+
+      html_properties["width"] = options[:width]
+      html_properties["height"] = options[:height]
+      html_properties["aria-label"] = options[:aria_label] || options[:"aria-label"]
+      html_properties["role"] = options[:role] || "img"
+      html_properties["aria-hidden"] = options[:aria_hidden] || options[:"aria-hidden"]
+
+      html_properties["class"] = (["icon--#{name}"] + _icon_classes(options)).join(" ")
+
+      title = options["title"] || html_properties["aria-label"]
+      if title.blank? && html_properties["role"] == "img"
+        # This will make the accessibility audit tools happy as with the "img"
+        # role, the alternative text (aria-label) and title are required for the
+        # element. This will also force the SVG to be hidden because otherwise
+        # the screen reader would announce the icon name which can be in
+        # different language (English) than the page language which is not
+        # allowed.
+        title = name
+        html_properties["aria-label"] = title
+        html_properties["aria-hidden"] = true
+      end
+
+      href = Decidim.cors_enabled ? "" : asset_pack_path("media/images/icons.svg")
+
+      content_tag :svg, html_properties do
+        inner = content_tag :title, title
+        inner += content_tag :use, nil, "href" => "#{href}#icon-#{name}"
+
+        inner
+      end
+    end
+
+    def icon(*args)
+      redesign_enabled? ? redesigned_icon(*args) : legacy_icon(*args)
+    end
+
+    # Outputs a SVG icon from an external file. It apparently renders an image
+    # tag, but then a JS script kicks in and replaces it with an inlined SVG
+    # version.
+    #
+    # path    - The asset's path
+    #
+    # Returns an <img /> tag with the SVG icon.
+    def external_icon(path, options = {})
+      classes = _icon_classes(options) + ["external-icon"]
+
+      if path.split(".").last == "svg"
+        icon_path = application_path(path)
+        return unless icon_path
+
+        attributes = { class: classes.join(" ") }.merge(options)
+        asset = File.read(icon_path)
+        asset.gsub("<svg ", "<svg#{tag_builder.tag_options(attributes)} ").html_safe
+      else
+        image_pack_tag(path, class: classes.join(" "), style: "display: none")
+      end
+    end
+
+    def application_path(path)
+      # Force the path to be returned without the protocol and host even when a
+      # custom asset host has been defined. The host parameter needs to be a
+      # non-nil because otherwise it will be set to the asset host at
+      # ActionView::Helpers::AssetUrlHelper#compute_asset_host.
+      img_path = asset_pack_path(path, host: "", protocol: :relative)
+      path = Rails.public_path.join(img_path.sub(%r{^/}, ""))
+      return unless File.exist?(path)
+
+      path
+    rescue ::Webpacker::Manifest::MissingEntryError
+      nil
+    end
+
+    # Allows to create role attribute according to accessibility rules
+    #
+    # Returns role attribute string if role option is specified
+    def role(options = {})
+      "role=\"#{options[:role]}\" " if options[:role]
+    end
+
+    def _icon_classes(options = {})
+      classes = options[:remove_icon_class] ? [] : ["icon"]
+      classes += [options[:class]]
+      classes.compact
+    end
+
+    def extended_navigation_bar(items, max_items: 5)
+      return unless items.any?
+
+      extra_items = items.slice((max_items + 1)..-1) || []
+      active_item = items.find { |item| item[:active] }
+
+      controller.view_context.render partial: "decidim/shared/extended_navigation_bar", locals: {
+        items:,
+        extra_items:,
+        active_item:,
+        max_items:
+      }
+    end
+
+    # Renders a view with the customizable CSS variables in two flavours:
+    # 1. as a hexadecimal valid CSS color (ie: #ff0000)
+    # 2. as a disassembled RGB components (ie: 255 0 0)
+    #
+    # Example:
+    #
+    # --primary: #ff0000;
+    # --primary-rgb: 255,0,0
+    #
+    # Hexadecimal variables can be used as a normal CSS color:
+    #
+    # color: var(--primary)
+    #
+    # While the disassembled variant can be used where you need to manipulate
+    # the color somehow (ie: adding a background transparency):
+    #
+    # background-color: rgba(var(--primary-rgb), 0.5)
+    def organization_colors
+      css = current_organization.colors.each.map { |k, v| "--#{k}: #{v};--#{k}-rgb: #{v[1..2].hex} #{v[3..4].hex} #{v[5..6].hex};" }.join
+      render partial: "layouts/decidim/organization_colors", locals: { css: }
+    end
+
+<<<<<<< HEAD
+    def current_user_unread_data
+      return {} if current_user.blank?
+
+      {}.tap do |d|
+        d.merge!(unread_notifications: true) if current_user.notifications.any?
+        d.merge!(unread_conversations: true) if current_user.unread_conversations.any?
+        d.merge!(unread_items: d.present?)
+      end
+    end
+
+||||||| parent of 53b6893e5c (Use local emojibase data instead of CDN)
+=======
+    # Public: Gets the name of the webpacker entrypoint that will be used
+    # for the locale of the Emojibase NPM package, used with @picmo/popup-picker
+    #
+    # Returns a string with the entrypoint name
+    def emojibase_entrypoint_locale
+      entrypoint = Decidim::Webpacker.configuration.entrypoints.keys.select do |entry|
+        entry == "decidim_emojibase_#{I18n.locale}"
+      end
+
+      return "decidim_emojibase_en" if entrypoint.empty?
+
+      entrypoint.first
+    end
+
+>>>>>>> 53b6893e5c (Use local emojibase data instead of CDN)
+    private
+
+    def tag_builder
+      @tag_builder ||= ActionView::Helpers::TagHelper::TagBuilder.new(self)
+    end
+  end
+end

data/app/helpers/decidim/sanitize_helper.rb

@@ -16,13 +16,18 @@ module Decidim
     #
     # Returns an HTML-safe String.
     def decidim_sanitize(html, options = {})
+      scrubber = options[:scrubber] || Decidim::UserInputScrubber.new
       if options[:strip_tags]
-        strip_tags sanitize(html, scrubber: Decidim::UserInputScrubber.new)
+        strip_tags sanitize(html, scrubber: scrubber)
       else
-        sanitize(html, scrubber: Decidim::UserInputScrubber.new)
+        sanitize(html, scrubber: scrubber)
       end
     end
 
+    def decidim_sanitize_admin(html, options = {})
+      decidim_sanitize(html, { scrubber: Decidim::AdminInputScrubber.new }.merge(options))
+    end
+
     def decidim_sanitize_newsletter(html, options = {})
       if options[:strip_tags]
         strip_tags sanitize(html, scrubber: Decidim::NewsletterScrubber.new)
@@ -32,7 +37,11 @@ module Decidim
     end
 
     def decidim_sanitize_editor(html, options = {})
-      content_tag(:div, decidim_sanitize(html, options), class: %w(ql-editor ql-reset-decidim))
+      content_tag(:div, decidim_sanitize(html, options), class: %w(ql-editor-display))
+    end
+
+    def decidim_sanitize_editor_admin(html, options = {})
+      decidim_sanitize_editor(html, { scrubber: Decidim::AdminInputScrubber.new }.merge(options))
     end
 
     def decidim_html_escape(text)
@@ -102,9 +111,10 @@ module Decidim
     #
     # @return ActiveSupport::SafeBuffer
     def render_sanitized_content(resource, method)
-      content = present(resource).send(method, links: true, strip_tags: !safe_content?)
+      content = present(resource).send(method, links: true, strip_tags: !try(:safe_content?))
 
-      return decidim_sanitize(content, {}) unless safe_content?
+      return decidim_sanitize(content, {}) unless try(:safe_content?)
+      return decidim_sanitize_editor_admin(content, {}) if try(:safe_content_admin?)
 
       decidim_sanitize_editor(content)
     end

data/app/models/decidim/organization.rb

@@ -87,6 +87,12 @@ module Decidim
       @top_scopes ||= scopes.top_level
     end
 
+    def participatory_spaces
+      @participatory_spaces ||= Decidim.participatory_space_manifests.flat_map do |manifest|
+        manifest.participatory_spaces.call(self)
+      end
+    end
+
     def public_participatory_spaces
       @public_participatory_spaces ||= Decidim.participatory_space_manifests.flat_map do |manifest|
         manifest.participatory_spaces.call(self).public_spaces

data/app/models/decidim/scope_type.rb

@@ -15,5 +15,33 @@ module Decidim
     has_many :scopes, class_name: "Decidim::Scope", inverse_of: :scope_type, dependent: :nullify
 
     validates :name, presence: true
+
+    before_destroy :detach_dynamic_associations
+
+    def self.log_presenter_class_for(_log)
+      Decidim::AdminLog::ScopeTypePresenter
+    end
+
+    private
+
+    # This method detaches all records that may have association with the scope
+    # type. This cannot be done directly using the `dependent` option in the
+    # `has_many` relation in order to avoid tight coupling between the modules.
+    #
+    # This logic does not have to be applied to any classes that have been
+    # defined as `has_many` associations within this model already as they are
+    # already handled by the `dependent` option.
+    def detach_dynamic_associations
+      ActiveRecord::Base.descendants.each do |cls|
+        next if cls.abstract_class? || !cls.name&.match?(/^Decidim::/)
+        next if [self.class, Decidim::Scope].include?(cls)
+
+        cls.reflect_on_all_associations(:belongs_to).each do |ref|
+          next unless ref.options[:class_name] == self.class.name
+
+          cls.where(ref.options[:foreign_key] => id).update_all(ref.options[:foreign_key] => nil) # rubocop:disable Rails/SkipsModelValidations
+        end
+      end
+    end
   end
 end

data/app/packs/src/decidim/editor/clipboard_override.js

@@ -70,7 +70,9 @@ export default class ClipboardOverride extends Clipboard {
     const text = ev.clipboardData.getData("text/plain");
     const files = Array.from(ev.clipboardData.files || []);
     if (!html && files.length > 0) {
-      this.quill.uploader.upload(range, files);
+      if (typeof this.quill.uploader !== "undefined") {
+        this.quill.uploader.upload(range, files);
+      }
       return;
     }
     if (html && files.length > 0) {
@@ -79,7 +81,9 @@ export default class ClipboardOverride extends Clipboard {
         doc.body.childElementCount === 1 &&
         doc.body.firstElementChild.tagName === "IMG"
       ) {
-        this.quill.uploader.upload(range, files);
+        if (typeof this.quill.uploader !== "undefined") {
+          this.quill.uploader.upload(range, files);
+        }
         return;
       }
     }