decidim-core 0.27.0.rc1 → 0.27.0.rc2

data/app/packs/stylesheets/decidim/modules/{_cookie-consent.scss → _data-consent.scss}

@@ -1,7 +1,7 @@
-#cc-dialog-wrapper{
+#dc-dialog-wrapper{
   z-index: 1000000;
 
-  .cc-dialog{
+  .dc-dialog{
     position: fixed;
     background-color: $white;
     bottom: 0;
@@ -11,7 +11,7 @@
       width: unset;
     }
 
-    .cc-button-wrapper{
+    .dc-button-wrapper{
       flex-direction: column;
       margin: 1rem 0;
 
@@ -36,7 +36,7 @@
   }
 }
 
-#cc-modal{
+#dc-modal{
   background-color: $white;
 
   .category-wrapper{
@@ -47,7 +47,7 @@
       position: relative;
       justify-content: space-between;
 
-      .cc-title{
+      .dc-title{
         &::before{
           border: solid #2d4156;
           border-width: 0 2px 2px 0;
@@ -68,12 +68,12 @@
         }
       }
 
-      .cc-switch{
+      .dc-switch{
         padding: .5rem 0 0;
       }
     }
 
-    .cookie-details-wrapper{
+    .dataconsent-details-wrapper{
       .detail-titles{
         border-bottom: 1px solid $medium-gray;
 
@@ -82,13 +82,13 @@
         }
       }
 
-      .cookie-detail-row{
+      .dataconsent-detail-row{
         font-size: .6rem;
       }
     }
   }
 
-  .cc-buttons-wrapper{
+  .dc-buttons-wrapper{
     justify-content: space-between;
   }
 }
@@ -108,7 +108,7 @@
   }
 }
 
-.cookie-warning{
+.dataconsent-warning{
   flex-direction: column;
   font-size: 2rem;
   font-weight: $global-weight-bold;

data/app/packs/stylesheets/decidim/modules/_forms.scss

@@ -77,6 +77,11 @@ label > [type="radio"]{
     margin-right: 1rem;
     flex-shrink: 0;
   }
+
+  &,
+  &.tiny{
+    height: auto;
+  }
 }
 
 .switch{

data/app/packs/stylesheets/decidim/modules/_modules.scss

@@ -82,7 +82,7 @@
 //Additional elements
 @import "stylesheets/decidim/modules/share";
 @import "stylesheets/decidim/modules/help";
-@import "stylesheets/decidim/modules/cookie-consent";
+@import "stylesheets/decidim/modules/data-consent";
 @import "stylesheets/decidim/modules/map";
 @import "stylesheets/decidim/modules/omnipresent_banner";
 @import "stylesheets/decidim/modules/wizard-steps";

data/app/permissions/decidim/permissions.rb

@@ -116,9 +116,11 @@ module Decidim
     end
 
     def apply_endorsement_permissions
-      return disallow! if !current_settings.endorsements_enabled || current_settings.endorsements_blocked
+      is_allowed = current_settings.endorsements_enabled &&
+                   !current_settings.endorsements_blocked &&
+                   authorized?(:endorse, resource: context.fetch(:resource, nil))
 
-      allow!
+      toggle_allow(is_allowed)
     end
 
     def notification_action?

data/app/presenters/decidim/push_notification_presenter.rb

@@ -10,7 +10,8 @@ module Decidim
     end
 
     def body
-      ActionView::Base.full_sanitizer.sanitize(event_class_instance.notification_title)
+      # Not using Rails sanitizers here because they escape HTML entities (i.e &) and we want to keep them
+      Nokogiri::HTML(event_class_instance.notification_title).text if event_class_instance.notification_title.present?
     end
 
     def icon

data/app/presenters/decidim/user_presenter.rb

@@ -13,6 +13,8 @@ module Decidim
     # nickname presented in a twitter-like style
     #
     def nickname
+      return "" if __getobj__.blocked?
+
       "@#{__getobj__.nickname}"
     end
 
@@ -33,13 +35,14 @@ module Decidim
     end
 
     def avatar_url(variant = nil)
+      return default_avatar_url if __getobj__.blocked?
       return avatar.default_url unless avatar.attached?
 
       avatar.path(variant: variant)
     end
 
     def default_avatar_url
-      attached_uploader.default_url
+      attached_uploader(:avatar).default_url
     end
 
     def profile_path

data/app/scrubbers/decidim/admin_input_scrubber.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+module Decidim
+  # Use this class as a scrubber to sanitize admin user input. The default
+  # scrubbed provided by Rails does not allow `iframe`s, and we're using
+  # them to embed videos, so we need to provide a whole new scrubber.
+  #
+  # Example:
+  #
+  #    sanitize(@page.body, scrubber: Decidim::AdminInputScrubber.new)
+  #
+  # Lists of default tags and attributes are extracted from
+  # https://stackoverflow.com/a/35073814/2110884.
+  class AdminInputScrubber < UserInputScrubber
+    private
+
+    def custom_allowed_attributes
+      super + %w(frameborder allowfullscreen) - %w(onerror)
+    end
+
+    def custom_allowed_tags
+      super + %w(comment iframe)
+    end
+  end
+end

data/app/scrubbers/decidim/user_input_scrubber.rb

@@ -1,9 +1,7 @@
 # frozen_string_literal: true
 
 module Decidim
-  # Use this class as a scrubber to sanitize user input. The default
-  # scrubbed provided by Rails does not allow `iframe`s, and we're using
-  # them to embed videos, so we need to provide a whole new scrubber.
+  # Use this class as a scrubber to sanitize participant user input.
   #
   # Example:
   #
@@ -21,11 +19,11 @@ module Decidim
     private
 
     def custom_allowed_attributes
-      Loofah::HTML5::SafeList::ALLOWED_ATTRIBUTES + %w(frameborder allowfullscreen) - %w(onerror)
+      Loofah::HTML5::SafeList::ALLOWED_ATTRIBUTES
     end
 
     def custom_allowed_tags
-      Loofah::HTML5::SafeList::ALLOWED_ELEMENTS_WITH_LIBXML2 + %w(iframe)
+      Loofah::HTML5::SafeList::ALLOWED_ELEMENTS_WITH_LIBXML2
     end
   end
 end

data/app/services/decidim/iframe_disabler.rb

@@ -18,9 +18,8 @@ module Decidim
 
     def disable_iframes(node)
       if node.name == "iframe"
-        node.name = "div"
-        old_classes = node.attributes["class"].value
-        node.attributes["class"].value = old_classes.present? ? "#{old_classes} disabled-iframe" : "disabled-iframe"
+        orig_node = node.to_s
+        node.replace(%(<div class="disabled-iframe"><!-- #{orig_node} --></div>))
       end
 
       node.children.each do |child|

data/app/services/decidim/notifications_digest_sending_decider.rb

@@ -6,10 +6,14 @@ module Decidim
       def must_notify?(user, time: Time.now.utc)
         return true if user.digest_sent_at.blank?
 
+        # Note that we are checking whether the notifications were sent at any
+        # time during the assumed sending day moment to prevent potential issues
+        # during the sending if the digest_sent_at is set to some other moment
+        # than the exact beginning of that day.
         case user.notifications_sending_frequency.to_sym
         when :none then false
-        when :daily then user.digest_sent_at < time - 1.day
-        when :weekly then user.digest_sent_at < time - 1.week
+        when :daily then user.digest_sent_at <= (time - 1.day).end_of_day
+        when :weekly then user.digest_sent_at <= (time - 1.day - 1.week).end_of_day
         else true
         end
       end

data/app/services/decidim/send_push_notification.rb

@@ -18,18 +18,20 @@ module Decidim
     def perform(notification)
       return unless Rails.application.secrets.vapid[:enabled]
 
-      notification.user.notifications_subscriptions.values.map do |subscription|
-        message_params = notification_params(Decidim::PushNotificationPresenter.new(notification))
-        payload = build_payload(message_params, subscription)
-        # Capture webpush exceptions in order to avoid this call to be repeated by the background job runner
-        # Webpush::Error class is the parent class of all defined errors
-        begin
-          Webpush.payload_send(**payload)
-        rescue Webpush::Error => e
-          Rails.logger.warn("[ERROR] Push notification delivery failed due to #{e.message}")
-          nil
-        end
-      end.compact
+      I18n.with_locale(notification.user.locale || notification.user.organization.default_locale) do
+        notification.user.notifications_subscriptions.values.map do |subscription|
+          message_params = notification_params(Decidim::PushNotificationPresenter.new(notification))
+          payload = build_payload(message_params, subscription)
+          # Capture webpush exceptions in order to avoid this call to be repeated by the background job runner
+          # Webpush::Error class is the parent class of all defined errors
+          begin
+            Webpush.payload_send(**payload)
+          rescue Webpush::Error => e
+            Rails.logger.warn("[ERROR] Push notification delivery failed due to #{e.message}")
+            nil
+          end
+        end.compact
+      end
     end
 
     private

data/app/views/decidim/account/_password_fields.html.erb

@@ -1,2 +1,2 @@
-<%= form.password_field :password, password_field_options_for(current_user).merge(value: form.object.password) %>
-<%= form.password_field :password_confirmation, password_field_options_for(current_user).except(:help_text).merge(value: form.object.password_confirmation) %>
+<%= form.password_field :password, password_field_options_for(current_user) %>
+<%= form.password_field :password_confirmation, password_field_options_for(current_user).except(:help_text) %>

data/app/views/decidim/download_your_data/show.html.erb

@@ -1,7 +1,7 @@
 <% add_decidim_page_title(t("my_data", scope: "layouts.decidim.user_profile")) %>
 <% content_for(:subtitle) { t("my_data", scope: "layouts.decidim.user_profile") } %>
 
-<div class="row download-your-data">
+<div class="download-your-data">
   <strong><%= t(".download_data") %></strong>
   <p><%= t(".download_data_description", user_email: current_user.email).html_safe %></p>
   <%= button_to t(".request_data"), export_download_your_data_path, class: "button", data: { disable: true } %>

data/app/views/decidim/notifications_settings/show.html.erb

@@ -1,87 +1,85 @@
 <% add_decidim_page_title(t("notifications_settings", scope: "layouts.decidim.user_profile")) %>
 <% content_for(:subtitle) { t("notifications_settings", scope: "layouts.decidim.user_profile") } %>
 
-<div class="row mb-m">
-  <%= form_for(@notifications_settings, url: notifications_settings_path, method: :put, class: "user-form") do |f| %>
-    <p><strong><%= t(".receive_notifications_about") %></strong></p>
-    <div class="switch tiny switch-with-label notifications_from_own_activity">
-      <%= f.label :notifications_from_own_activity do %>
-        <%= f.check_box :notifications_from_own_activity, label: false, class: "switch-input" %>
-        <span class="switch-paddle"></span>
-        <span class="switch-label"><%= t(".own_activity") %></span>
-      <% end %>
-    </div>
-    <div class="switch tiny switch-with-label notifications_from_followed">
-      <%= f.label :notifications_from_followed do %>
-        <%= f.check_box :notifications_from_followed, label: false, class: "switch-input" %>
-        <span class="switch-paddle"></span>
-        <span class="switch-label"><%= t(".everything_followed") %></span>
-      <% end %>
-    </div>
+<%= form_for(@notifications_settings, url: notifications_settings_path, method: :put, class: "user-form") do |f| %>
+  <p><strong><%= t(".receive_notifications_about") %></strong></p>
+  <div class="switch tiny switch-with-label notifications_from_own_activity">
+    <%= f.label :notifications_from_own_activity do %>
+      <%= f.check_box :notifications_from_own_activity, label: false, class: "switch-input" %>
+      <span class="switch-paddle"></span>
+      <span class="switch-label"><%= t(".own_activity") %></span>
+    <% end %>
+  </div>
+  <div class="switch tiny switch-with-label notifications_from_followed">
+    <%= f.label :notifications_from_followed do %>
+      <%= f.check_box :notifications_from_followed, label: false, class: "switch-input" %>
+      <span class="switch-paddle"></span>
+      <span class="switch-label"><%= t(".everything_followed") %></span>
+    <% end %>
+  </div>
 
-    <p><strong><%= t(".notifications_sending_frequency") %></strong></p>
-    <%= f.collection_radio_buttons :notifications_sending_frequency, frequencies_collection, :first, :last, { checked: @notifications_settings.notifications_sending_frequency || "daily" } %>
+  <p><strong><%= t(".notifications_sending_frequency") %></strong></p>
+  <%= f.collection_radio_buttons :notifications_sending_frequency, frequencies_collection, :first, :last, { checked: @notifications_settings.notifications_sending_frequency || "daily" } %>
 
-    <p><strong><%= t(".newsletters") %></strong></p>
-    <div class="switch tiny switch-with-label newsletter_notifications">
-      <label>
-        <%= f.check_box :newsletter_notifications, label: false, class: "switch-input" %>
-        <span class="switch-paddle"></span>
-        <span class="switch-label"><%= t(".newsletter_notifications") %></span>
-      </label>
-    </div>
+  <p><strong><%= t(".newsletters") %></strong></p>
+  <div class="switch tiny switch-with-label newsletter_notifications">
+    <label>
+      <%= f.check_box :newsletter_notifications, label: false, class: "switch-input" %>
+      <span class="switch-paddle"></span>
+      <span class="switch-label"><%= t(".newsletter_notifications") %></span>
+    </label>
+  </div>
+
+  <p><strong><%= t(".direct_messages") %></strong></p>
+  <div class="switch tiny switch-with-label allow_public_contact">
+    <label>
+      <%= f.check_box :allow_public_contact, label: false, class: "switch-input" %>
+      <span class="switch-paddle"></span>
+      <span class="switch-label"><%= t(".allow_public_contact") %></span>
+    </label>
+  </div>
 
-    <p><strong><%= t(".direct_messages") %></strong></p>
-    <div class="switch tiny switch-with-label allow_public_contact">
+  <% if @notifications_settings.user_is_moderator?(current_user) %>
+    <p><strong><%= t(".administrators") %></strong></p>
+    <div class="switch tiny switch-with-label email_on_moderations">
       <label>
-        <%= f.check_box :allow_public_contact, label: false, class: "switch-input" %>
+        <%= f.check_box :email_on_moderations, label: false, class: "switch-input" %>
         <span class="switch-paddle"></span>
-        <span class="switch-label"><%= t(".allow_public_contact") %></span>
+        <span class="switch-label"><%= t(".email_on_moderations") %></span>
       </label>
     </div>
 
-    <% if @notifications_settings.user_is_moderator?(current_user) %>
-      <p><strong><%= t(".administrators") %></strong></p>
-      <div class="switch tiny switch-with-label email_on_moderations">
+    <% Decidim.notification_settings_registry.manifests.filter{ |a| a.settings_area == :administrators }.each do |manifest| %>
+      <div class="switch tiny switch-with-label notification_settings">
         <label>
-          <%= f.check_box :email_on_moderations, label: false, class: "switch-input" %>
+          <%= f.check_box "notification_settings[#{manifest.name}]",
+                          checked: ["1", true].include?(current_user.notification_settings.fetch(manifest.name.to_s, manifest.default_value)),
+                          label: false,
+                          class: "switch-input" %>
           <span class="switch-paddle"></span>
-          <span class="switch-label"><%= t(".email_on_moderations") %></span>
+          <span class="switch-label"><%= t(".notification_settings.#{manifest.name}") %></span>
         </label>
       </div>
-
-      <% Decidim.notification_settings_registry.manifests.filter{ |a| a.settings_area == :administrators }.each do |manifest| %>
-        <div class="switch tiny switch-with-label notification_settings">
-          <label>
-            <%= f.check_box "notification_settings[#{manifest.name}]",
-                            checked: ["1", true].include?(current_user.notification_settings.fetch(manifest.name.to_s, manifest.default_value)),
-                            label: false,
-                            class: "switch-input" %>
-            <span class="switch-paddle"></span>
-            <span class="switch-label"><%= t(".notification_settings.#{manifest.name}") %></span>
-          </label>
-        </div>
-      <% end %>
-
     <% end %>
 
-    <% if @notifications_settings.meet_push_notifications_requirements? %>
-      <div class="push-notifications js-sw-mandatory">
-        <p><strong><%= t(".push_notifications") %></strong></p>
-        <p id="push-notifications-reminder" class="push-notifications__reminder"><i><%= t(".push_notifications_reminder") %></i></p>
-        <div class="switch tiny switch-with-label allow_push_notifications">
-          <label>
-            <%= check_box_tag :allow_push_notifications, 0, false, class: "switch-input" %>
-            <span class="switch-paddle"></span>
-            <span class="switch-label"><%= t(".allow_push_notifications") %></span>
-          </label>
-        </div>
-      </div>
+  <% end %>
 
-      <input id="vapidPublicKey" name="vapid_public_key" type="hidden" value="<%= Base64.urlsafe_decode64(Rails.application.secrets.vapid[:public_key]).bytes %>">
-      <input id="subKeys" name="sub_key" type="hidden" value="<%= current_user.notifications_subscriptions.keys %>">
-    <% end %>
+  <% if @notifications_settings.meet_push_notifications_requirements? %>
+    <div class="push-notifications js-sw-mandatory">
+      <p><strong><%= t(".push_notifications") %></strong></p>
+      <p id="push-notifications-reminder" class="push-notifications__reminder"><i><%= t(".push_notifications_reminder") %></i></p>
+      <div class="switch tiny switch-with-label allow_push_notifications">
+        <label>
+          <%= check_box_tag :allow_push_notifications, 0, false, class: "switch-input" %>
+          <span class="switch-paddle"></span>
+          <span class="switch-label"><%= t(".allow_push_notifications") %></span>
+        </label>
+      </div>
+    </div>
 
-    <%= f.submit t(".update_notifications_settings") %>
+    <input id="vapidPublicKey" name="vapid_public_key" type="hidden" value="<%= Base64.urlsafe_decode64(Rails.application.secrets.vapid[:public_key]).bytes %>">
+    <input id="subKeys" name="sub_key" type="hidden" value="<%= current_user.notifications_subscriptions.keys %>">
   <% end %>
-</div>
+
+  <%= f.submit t(".update_notifications_settings") %>
+<% end %>

data/app/views/decidim/pages/_standalone.html.erb

@@ -10,7 +10,7 @@
 
     <div class="columns small-12">
       <div class="card">
-        <div class="card__content"><%= decidim_sanitize_editor translated_attribute page.content %></div>
+        <div class="card__content"><%= decidim_sanitize_editor_admin translated_attribute page.content %></div>
       </div>
     </div>
 

data/app/views/decidim/pages/_tabbed.html.erb

@@ -32,7 +32,7 @@
                 <h2>
                   <%= translated_attribute page.title %>
                 </h2>
-                <%= decidim_sanitize_editor translated_attribute page.content %>
+                <%= decidim_sanitize_editor_admin translated_attribute page.content %>
               </div>
             </div>
           </div>

data/app/views/decidim/user_interests/show.html.erb

@@ -1,17 +1,15 @@
 <% add_decidim_page_title(t("my_interests", scope: "layouts.decidim.user_profile")) %>
 <% content_for(:subtitle) { t("my_interests", scope: "layouts.decidim.user_profile") } %>
 
-<div class="row">
-  <p><%= t(".select_your_interests") %></p>
-  <%= form_for(@user_interests, url: user_interests_path, method: :put, class: "user-form") do |f| %>
-    <p><strong><%= t(".my_interests") %></strong></p>
-    <% if @user_interests.scopes.any? %>
-      <div class="clearfix m-bottom">
-        <%= render partial: "scopes", locals: { scopes: @user_interests.scopes, f: f } %>
-      </div>
-      <%= f.submit t(".update_my_interests") %>
-    <% else %>
-      <p><%= t(".no_scopes") %></p>
-    <% end %>
+<p><%= t(".select_your_interests") %></p>
+<%= form_for(@user_interests, url: user_interests_path, method: :put, class: "user-form") do |f| %>
+  <p><strong><%= t(".my_interests") %></strong></p>
+  <% if @user_interests.scopes.any? %>
+    <div class="clearfix m-bottom">
+      <%= render partial: "scopes", locals: { scopes: @user_interests.scopes, f: f } %>
+    </div>
+    <%= f.submit t(".update_my_interests") %>
+  <% else %>
+    <p><%= t(".no_scopes") %></p>
   <% end %>
-</div>
+<% end %>

data/app/views/layouts/decidim/_application.html.erb

@@ -23,6 +23,6 @@
     <%= render partial: "decidim/shared/login_modal" unless current_user %>
     <%= render partial: "decidim/shared/authorization_modal" %>
     <%= render partial: "layouts/decidim/decidim_javascript" %>
-    <%= render partial: "layouts/decidim/cookie_warning" %>
+    <%= render partial: "layouts/decidim/data_consent_warning" %>
   </body>
 </html>

data/app/views/layouts/decidim/_data_consent_warning.html.erb

@@ -0,0 +1,8 @@
+<div class="dataconsent-warning flex-center padding-1 hide">
+  <p>
+  <%= t("layouts.decidim.data_consent.warning.consent_required", categories: t("layouts.decidim.data_consent.warning.all_categories")) %>
+  </p>
+  <a href="#" class="button margin-vertical-2" data-open="dc-modal">
+    <%= t("change_settings", scope: "layouts.decidim.data_consent.warning") %>
+  </a>
+</div>

data/app/views/layouts/decidim/_main_footer.html.erb

@@ -22,7 +22,7 @@
             <% end %>
           <% end %>
           <li><%= link_to t("layouts.decidim.footer.download_open_data"), decidim.open_data_download_path %></li>
-          <li><a href="#" data-open="cc-modal"><%= t("layouts.decidim.footer.cookie_settings") %></a></li>
+          <li><a href="#" data-open="dc-modal"><%= t("layouts.decidim.footer.data_consent_settings") %></a></li>
         </ul>
       </nav>
     </div>

data/config/locales/am-ET.yml

@@ -1,2 +1 @@
----
 am:

data/config/locales/ar.yml

@@ -1216,15 +1216,6 @@ ar:
       updated_not_active: كلمة السر الخاصة بك تم تغييرها بنجاح.
     registrations:
       destroyed: تم إلغاء حسابك بنجاح. نحن نأمل ان نراك قريبا مره اخرى.
-      edit:
-        are_you_sure: هل أنت واثق؟
-        cancel_my_account: الغاء حسابي
-        currently_waiting_confirmation_for_email: 'حاليا في انتظار تأكيد ل: %{email}'
-        leave_blank_if_you_don_t_want_to_change_it: اتركه فارغا إذا كنت لا تريد تغييره
-        title: تحرير %{resource}
-        unhappy: تعيس؟
-        update: تحديث
-        we_need_your_current_password_to_confirm_your_changes: نحتاج كلمة المرور الحالية لتأكيد تغييراتك
       new:
         sign_up: انشئ حسابًا
       signed_up: أهلا بك! لقد اشتركت بنجاح

data/config/locales/bg.yml

@@ -1280,15 +1280,6 @@ bg:
       updated_not_active: Паролата Ви беше променена успешно.
     registrations:
       destroyed: Вашият акаунт беше успешно отказан. Надяваме се скоро да се видим отново.
-      edit:
-        are_you_sure: Сигурни ли сте?
-        cancel_my_account: Откажи профила ми
-        currently_waiting_confirmation_for_email: 'В момента се чака потвърждение за: %{email}'
-        leave_blank_if_you_don_t_want_to_change_it: оставете празно, ако не желаете промяна
-        title: Редактирай %{resource}
-        unhappy: Недоволни?
-        update: Обновяване
-        we_need_your_current_password_to_confirm_your_changes: имаме нужда от текущата Ви парола, за да потвърдим Вашите промени
       new:
         sign_up: Регистрация
       signed_up: Добре дошли! Регистрирахте се успешно.