decidim-core 0.27.0 → 0.27.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4d066aea0f8b2cede42dcd7ac23f6a22d8685f45e776cd5f7e2a8a39a8498ee9
-  data.tar.gz: a5536659a0c2c25cedde842b9c3f747e428a9b9b667d69bbf04c64bb9ef98125
+  metadata.gz: d9cfa315481be2ecd36504616728a76d1c445b99a233f36e50db71a7351ac04b
+  data.tar.gz: d67d9216824b975d528f0e64a8f605eacc4849fb042836d63e5c2fe5bc4da218
 SHA512:
-  metadata.gz: a818266bb8122ab36bedb0aac0991a98ac0eb460482b4d1c4188eab66136fadda00ffe7d8452735598a2ee8a2198670d25d57afe6a2b4c7a3761bd21cac41655
-  data.tar.gz: e5c1b93af9f057e33a773e443a3badc07c20af25be4f874ad1ed6219cbf92ed82bd0e91d9aeb48534ef90952087f0be26a718b872afe71254085ca9629e8dd25
+  metadata.gz: 776eba5812d48f147afa41d5b0a2eab52d2c46ce2db9616bd784c2f784be2851eaa1e341439ba1ac13f9b8152e1a3fb09acdbe08e93a9e2e6721e7c9afb09982
+  data.tar.gz: eb00d8fe971338da9056eb5e6268934614f5803d1d102d643a14c7602e8323266195948a282220c1013c1f0e39511f8c5adc95aa9e843244be01904589eae57e

data/app/cells/decidim/amendable/announcement_cell.rb

@@ -36,7 +36,7 @@ module Decidim::Amendable
     end
 
     def proposal_link(resource = model.amendable, text = nil)
-      text ||= %(<strong>#{present(model.amendable).title}</strong>)
+      text ||= %(<strong>#{decidim_sanitize(present(model.amendable).title, strip_tags: true)}</strong>)
       link_to resource_locator(resource).path do
         text
       end

data/app/cells/decidim/card_m_cell.rb

@@ -57,7 +57,7 @@ module Decidim
     end
 
     def title
-      translated_attribute model.title
+      decidim_html_escape(translated_attribute(model.title))
     end
 
     def description

data/app/controllers/decidim/devise/invitations_controller.rb

@@ -21,7 +21,7 @@ module Decidim
       # invitation. Using the param `invite_redirect` we can redirect the user
       # to a custom path after it has accepted the invitation.
       def after_accept_path_for(resource)
-        params[:invite_redirect] || after_sign_in_path_for(resource)
+        invite_redirect_path || after_sign_in_path_for(resource)
       end
 
       # When a managed user accepts the invitation is promoted to non-managed user.
@@ -32,7 +32,6 @@ module Decidim
           resource.update!(newsletter_notifications_at: Time.current) if update_resource_params[:newsletter_notifications]
           resource.update!(managed: false) if resource.managed?
           resource.update!(accepted_tos_version: resource.organization.tos_version)
-          Decidim::Gamification.increment_score(resource.invited_by, :invitations) if resource.invited_by
         end
 
         resource
@@ -40,6 +39,14 @@ module Decidim
 
       protected
 
+      def invite_redirect_path
+        path = params[:invite_redirect]
+        return unless path
+        return unless path.starts_with?(%r{^/[a-z0-9]+})
+
+        path
+      end
+
       def configure_permitted_parameters
         devise_parameter_sanitizer.permit(:accept_invitation, keys: [:nickname, :tos_agreement, :newsletter_notifications])
       end

data/app/controllers/decidim/last_activities_controller.rb

@@ -33,8 +33,11 @@ module Decidim
 
     def search_collection
       ActionLog
-        .where(visibility: %w(public-only all))
-        .where(organization: current_organization)
+        .where(
+          organization: current_organization,
+          visibility: %w(public-only all)
+        )
+        .with_new_resource_type("all")
         .order(created_at: :desc)
     end
 

data/app/forms/decidim/account_form.rb

@@ -19,9 +19,9 @@ module Decidim
     attribute :personal_url
     attribute :about
 
-    validates :name, presence: true
+    validates :name, presence: true, format: { with: Decidim::User::REGEXP_NAME }
     validates :email, presence: true, "valid_email_2/email": { disposable: true }
-    validates :nickname, presence: true, format: Decidim::User::REGEXP_NICKNAME
+    validates :nickname, presence: true, format: { with: Decidim::User::REGEXP_NICKNAME }
 
     validates :nickname, length: { maximum: Decidim::User.nickname_max_length, allow_blank: true }
     validates :password, confirmation: true

data/app/forms/decidim/amendable/form.rb

@@ -66,7 +66,8 @@ module Decidim
           errors = amendable_form_errors.details[key] - @original_form.errors.details[key]
 
           errors.map do |hash|
-            @amendable_form.errors.add(key, hash[:error]) unless @amendable_form.errors.details[key].include? error: hash[:error]
+            error = hash.delete(:error)
+            @amendable_form.errors.add(key, error, **hash) unless @amendable_form.errors.details[key].include?(error: error)
           end
         end
       end

data/app/forms/decidim/registration_form.rb

@@ -14,8 +14,8 @@ module Decidim
     attribute :tos_agreement, Boolean
     attribute :current_locale, String
 
-    validates :name, presence: true
-    validates :nickname, presence: true, format: Decidim::User::REGEXP_NICKNAME, length: { maximum: Decidim::User.nickname_max_length }
+    validates :name, presence: true, format: { with: Decidim::User::REGEXP_NAME }
+    validates :nickname, presence: true, format: { with: Decidim::User::REGEXP_NICKNAME }, length: { maximum: Decidim::User.nickname_max_length }
     validates :email, presence: true, "valid_email_2/email": { disposable: true }
     validates :password, confirmation: true
     validates :password, password: { name: :name, email: :email, username: :nickname }

data/app/forms/decidim/upload_validation_form.rb

@@ -7,8 +7,8 @@ module Decidim
     include Decidim::HasUploadValidations
 
     attribute :resource_class, String
-    # Property is named as attribute in upload modal and passthru validator, but it
-    # cannot be named as attribute here.
+    # Property is named as attribute in upload modal and passthru validator, but
+    # it cannot be named as attribute here.
     attribute :property, String
     attribute :blob, String
     attribute :form_class, String
@@ -16,9 +16,22 @@ module Decidim
     validates :resource_class, presence: true
     validates :property, presence: true
     validates :blob, presence: true
-    validate :file, if: ->(form) { form.resource_class.present? && form.property.present? && form.blob.present? }
+    validate :file_validators, if: ->(form) { form.resource_class.present? && form.property.present? && form.blob.present? }
 
-    def file
+    alias organization current_organization
+
+    # This is a "trick" to provide the attachment context (i.e. admin or
+    # participant) to the attachment records being validated. This is to show
+    # the invalid content type / file extension errors with the correct file
+    # extensions that may be shown in the help text next to the upload
+    # drag'n'drop field.
+    def attached_to
+      @attached_to ||= AttachmentContextProxy.new(organization, attachment_context)
+    end
+
+    private
+
+    def file_validators
       org = organization
       PassthruValidator.new(
         attributes: [property],
@@ -31,8 +44,6 @@ module Decidim
       ).validate_each(self, property.to_sym, blob)
     end
 
-    private
-
     def validate_with
       if form_object_class && form_object_class._validators[property.to_sym].is_a?(Array) && form_object_class._validators[property.to_sym].size.positive?
         passthru = form_object_class._validators[property.to_sym].find { |v| v.is_a?(PassthruValidator) }
@@ -49,6 +60,39 @@ module Decidim
       end
     end
 
-    alias organization current_organization
+    # The attachment context (i.e. admin or participant) is determined using the
+    # form class name and checking if it contains the `Admin` namespace in it.
+    # And example use case is the attachment forms in the admin panel.
+    def attachment_context
+      return :participant unless form_object_class
+      return :admin if form_object_class.name.include? "::Admin::"
+
+      :participant
+    end
+
+    # This class provides ability to interpret the attachment context based on
+    # the details available within the context of this class. Normally the
+    # attachment context would be defined by the record to which the attachment
+    # are added to, e.g. proposals (participant contenxt) or participatory
+    # processes (admin context). Unfortunately this information is not available
+    # when the parameters are passed to the upload validation.
+    class AttachmentContextProxy
+      attr_reader :organization, :attachment_context
+
+      delegate :id, :_read_attribute, to: :organization
+
+      def initialize(organization, attachment_context)
+        @organization = organization
+        @attachment_context = attachment_context
+      end
+
+      def self.primary_key
+        :id
+      end
+
+      def self.polymorphic_name
+        "Decidim::Organization"
+      end
+    end
   end
 end

data/app/helpers/decidim/layout_helper.rb

@@ -88,8 +88,11 @@ module Decidim
       classes = _icon_classes(options) + ["external-icon"]
 
       if path.split(".").last == "svg"
+        icon_path = application_path(path)
+        return unless icon_path
+
         attributes = { class: classes.join(" ") }.merge(options)
-        asset = File.read(application_path(path))
+        asset = File.read(icon_path)
         asset.gsub("<svg ", "<svg#{tag_builder.tag_options(attributes)} ").html_safe
       else
         image_pack_tag(path, class: classes.join(" "), style: "display: none")
@@ -97,9 +100,14 @@ module Decidim
     end
 
     def application_path(path)
-      img_path = asset_pack_path(path)
-      img_path = URI(img_path).path if Decidim.cors_enabled
-      Rails.root.join("public/#{img_path}")
+      # Force the path to be returned without the protocol and host even when a
+      # custom asset host has been defined. The host parameter needs to be a
+      # non-nil because otherwise it will be set to the asset host at
+      # ActionView::Helpers::AssetUrlHelper#compute_asset_host.
+      img_path = asset_pack_path(path, host: "", protocol: :relative)
+      Rails.public_path.join(img_path.sub(%r{^/}, ""))
+    rescue ::Webpacker::Manifest::MissingEntryError
+      nil
     end
 
     # Allows to create role attribute according to accessibility rules

data/app/helpers/decidim/sanitize_helper.rb

@@ -37,7 +37,7 @@ module Decidim
     end
 
     def decidim_sanitize_editor(html, options = {})
-      content_tag(:div, decidim_sanitize(html, options), class: %w(ql-editor ql-reset-decidim))
+      content_tag(:div, decidim_sanitize(html, options), class: %w(ql-editor-display))
     end
 
     def decidim_sanitize_editor_admin(html, options = {})

data/app/mailers/decidim/notification_mailer.rb

@@ -5,6 +5,7 @@ module Decidim
   # a events are received.
   class NotificationMailer < Decidim::ApplicationMailer
     helper Decidim::ResourceHelper
+    helper Decidim::SanitizeHelper
 
     def event_received(event, event_class_name, resource, user, user_role, extra) # rubocop:disable Metrics/ParameterLists
       with_user(user) do

data/app/mailers/decidim/notifications_digest_mailer.rb

@@ -5,6 +5,7 @@ module Decidim
   # a events are received.
   class NotificationsDigestMailer < Decidim::ApplicationMailer
     helper Decidim::ResourceHelper
+    helper Decidim::SanitizeHelper
     SIZE_LIMIT = 10
 
     def digest_mail(user, notification_ids)

data/app/packs/src/decidim/editor/clipboard_override.js

@@ -0,0 +1,143 @@
+/* eslint max-lines: ["error", 350] */
+
+/**
+ * Quill clipboard utilities
+ *
+ * Copyright (c) 2017, Slab
+ * Copyright (c) 2014, Jason Chen
+ * Copyright (c) 2013, salesforce.com
+ * BSD 3-Clause "New" or "Revised" License
+ *
+ * Extends the original version from https://github.com/quilljs/quill
+ * Relevant parts converted from TypeScript to JavaScript
+ */
+
+import CodeBlock from "quill/formats/code";
+import { matchNewline, matchBreak, deltaEndsWith, traverse } from "src/decidim/editor/clipboard_utilities";
+
+const Delta = Quill.import("delta");
+const Clipboard = Quill.import("modules/clipboard");
+
+/**
+ * Pasting bold text is broken in Quill as described at:
+ * https://github.com/quilljs/quill/issues/306
+ *
+ * The reason is that the `<strong>` nodes are not recognized as bold types.
+ * This override fixes the issue by introducing parts of the newer Quill code
+ * at GitHub and defining the `<strong>` tags as bold tags.
+ */
+export default class ClipboardOverride extends Clipboard {
+  constructor(quill, options) {
+    super(quill, options);
+    this.overrideMatcher("b", "b, strong");
+    this.overrideMatcher("br", "br", matchBreak);
+
+    // Change the matchNewLine matchers to the newer version
+    this.matchers[1][1] = matchNewline;
+    this.matchers[3][1] = matchNewline;
+
+    // Remove `matchSpacing` as that is also removed in the newer versions.
+    this.removeMatcher(Node.ELEMENT_NODE, "matchSpacing");
+  }
+
+  overrideMatcher(originalSelector, newSelector, newMatcher = null) {
+    const idx = this.matchers.findIndex((item) => item[0] === originalSelector);
+    if (idx >= 0) {
+      this.matchers[idx][0] = newSelector;
+      if (newMatcher) {
+        this.matchers[idx][1] = newMatcher;
+      }
+    }
+  }
+
+  removeMatcher(selector, matcherName) {
+    const idx = this.matchers.findIndex((item) => item[0] === selector && item[1].name === matcherName);
+    if (idx >= 0) {
+      this.matchers.splice(idx, 1);
+    }
+  }
+
+  onPaste(ev) {
+    if (ev.defaultPrevented || !this.quill.isEnabled()) {
+      return;
+    }
+    ev.preventDefault();
+    const range = this.quill.getSelection(true);
+    if (range === null) {
+      return;
+    }
+    const html = ev.clipboardData.getData("text/html");
+    const text = ev.clipboardData.getData("text/plain");
+    const files = Array.from(ev.clipboardData.files || []);
+    if (!html && files.length > 0) {
+      this.quill.uploader.upload(range, files);
+      return;
+    }
+    if (html && files.length > 0) {
+      const doc = new DOMParser().parseFromString(html, "text/html");
+      if (
+        doc.body.childElementCount === 1 &&
+        doc.body.firstElementChild.tagName === "IMG"
+      ) {
+        this.quill.uploader.upload(range, files);
+        return;
+      }
+    }
+    this.onPasteRange(range, { html, text });
+  }
+
+  onPasteRange(range, { text, html }) {
+    const formats = this.quill.getFormat(range.index);
+    const pastedDelta = this.convertPaste({ text, html }, formats);
+    // debug.log('onPaste", pastedDelta, { text, html });
+    const delta = new Delta().retain(range.index).delete(range.length).concat(pastedDelta);
+    this.quill.updateContents(delta, Quill.sources.USER);
+    // range.length contributes to delta.length()
+    this.quill.setSelection(
+      delta.length() - range.length,
+      Quill.sources.SILENT,
+    );
+    this.quill.scrollIntoView();
+  }
+
+  convertPaste({ html, text }, formats = {}) {
+    if (formats[CodeBlock.blotName]) {
+      return new Delta().insert(text, {
+        [CodeBlock.blotName]: formats[CodeBlock.blotName]
+      });
+    }
+    if (!html) {
+      return new Delta().insert(text || "");
+    }
+    const delta = this.convertPasteHTML(html);
+    // Remove trailing newline
+    if (
+      deltaEndsWith(delta, "\n") &&
+      (delta.ops[delta.ops.length - 1].attributes === null || formats.table)
+    ) {
+      return delta.compose(new Delta().retain(delta.length() - 1).delete(1));
+    }
+    return delta;
+  }
+
+  convertPasteHTML(html) {
+    const doc = new DOMParser().parseFromString(html, "text/html");
+    const container = doc.body;
+    const nodeMatches = new WeakMap();
+    const [elementMatchers, textMatchers] = this.prepareMatching(
+      container,
+      nodeMatches
+    );
+    return traverse(
+      this.quill.scroll,
+      container,
+      elementMatchers,
+      textMatchers,
+      nodeMatches
+    );
+  }
+}
+
+// Disable warning messages from overwritting modules
+Quill.debug("error");
+Quill.register({"modules/clipboard": ClipboardOverride}, true);

data/app/packs/src/decidim/editor/clipboard_utilities.js

@@ -0,0 +1,119 @@
+import { BlockEmbed } from "quill/blots/block";
+
+const Delta = Quill.import("delta");
+const Parchment = Quill.import("parchment");
+
+// Newer version used only for the pasting, not compatible with the version of
+// Quill in use.
+const traverse = (scroll, node, elementMatchers, textMatchers, nodeMatches) => { // eslint-disable-line max-params
+  // Post-order
+  if (node.nodeType === node.TEXT_NODE) {
+    return textMatchers.reduce((delta, matcher) => {
+      return matcher(node, delta, scroll);
+    }, new Delta());
+  }
+  if (node.nodeType === node.ELEMENT_NODE) {
+    return Array.from(node.childNodes || []).reduce((delta, childNode) => {
+      let childrenDelta = traverse(
+        scroll,
+        childNode,
+        elementMatchers,
+        textMatchers,
+        nodeMatches,
+      );
+      if (childNode.nodeType === node.ELEMENT_NODE) {
+        childrenDelta = elementMatchers.reduce((reducedDelta, matcher) => {
+          return matcher(childNode, reducedDelta, scroll);
+        }, childrenDelta);
+        childrenDelta = (nodeMatches.get(childNode) || []).reduce(
+          (reducedDelta, matcher) => {
+            return matcher(childNode, reducedDelta, scroll);
+          },
+          childrenDelta,
+        );
+      }
+      return delta.concat(childrenDelta);
+    }, new Delta());
+  }
+  return new Delta();
+}
+
+const deltaEndsWith = (delta, text) => {
+  let endText = "";
+  for (let idx = delta.ops.length - 1; idx >= 0 && endText.length < text.length; idx -= 1) {
+    const op = delta.ops[idx];
+    if (typeof op.insert !== "string") {
+      break;
+    }
+    endText = op.insert + endText;
+  }
+  return endText.slice(-1 * text.length) === text;
+}
+
+const isLine = (node) => {
+  if (node.childNodes.length === 0) {
+    // Exclude embed blocks
+    return false;
+  }
+  return [
+    "address", "article", "blockquote", "canvas", "dd", "div", "dl", "dt",
+    "fieldset", "figcaption", "figure", "footer", "form", "h1", "h2", "h3",
+    "h4", "h5", "h6", "header", "iframe", "li", "main", "nav", "ol", "output",
+    "p", "pre", "section", "table", "td", "tr", "ul", "video"
+  ].includes(node.tagName.toLowerCase());
+}
+
+const matchNewLineScroll = (nextSibling, delta, scroll) => {
+  if (!scroll) {
+    return null;
+  }
+
+  const match = Parchment.query(nextSibling)
+  if (match && match.prototype instanceof BlockEmbed) {
+    return delta.insert("\n");
+  }
+  return null;
+}
+
+const matchNewline = (node, delta, scroll) => {
+  if (!deltaEndsWith(delta, "\n")) {
+    // When scroll is defined, it was initiated from the paste event. Otherwise
+    // it is a normal Quill initiated traversal which handles adding the line
+    // breaks already.
+    if (scroll && node.nodeType === node.ELEMENT_NODE && node.tagName === "BR") {
+      return delta.insert({"break": ""});
+    }
+    if (isLine(node)) {
+      return delta.insert("\n");
+    }
+    if (delta.length() > 0 && node.nextSibling) {
+      let { nextSibling } = node;
+      while (nextSibling !== null) {
+        if (isLine(nextSibling)) {
+          return delta.insert("\n");
+        }
+        const scrollMatch = matchNewLineScroll(nextSibling, delta, scroll);
+        if (scrollMatch) {
+          return scrollMatch;
+        }
+        nextSibling = nextSibling.firstChild;
+      }
+    }
+  }
+  return delta;
+}
+
+const matchBreak = (node, delta) => {
+  if (!deltaEndsWith(delta, "\n")) {
+    delta.insert({"break": ""});
+  }
+  return delta;
+}
+
+export {
+  traverse,
+  deltaEndsWith,
+  isLine,
+  matchNewline,
+  matchBreak
+}

data/app/packs/src/decidim/editor/linebreak_module.js

@@ -129,7 +129,6 @@ class ScrollOvderride extends Scroll {
 Quill.register("blots/scroll", ScrollOvderride, true);
 Parchment.register(ScrollOvderride);
 
-
 export default function lineBreakButtonHandler(quill) {
   let range = quill.selection.getRange()[0];
   let currentLeaf = quill.getLeaf(range.index)[0];
@@ -167,13 +166,6 @@ Quill.register("modules/linebreak", (quill) => {
     }
   });
 
-  quill.clipboard.addMatcher("BR", (node) => {
-    if (node?.parentNode?.tagName === "A") {
-      return new Delta().insert("\n");
-    }
-    return new Delta().insert({"break": ""});
-  });
-
   addEnterBindings(quill);
   backspaceBindingsRangeAny(quill);
   backspaceBindings(quill);

data/app/packs/src/decidim/editor.js

@@ -1,6 +1,7 @@
 /* eslint-disable require-jsdoc */
 
 import lineBreakButtonHandler from "src/decidim/editor/linebreak_module"
+import "src/decidim/editor/clipboard_override"
 import "src/decidim/vendor/image-resize.min"
 import "src/decidim/vendor/image-upload.min"
 
@@ -10,6 +11,7 @@ export default function createQuillEditor(container) {
   const toolbar = $(container).data("toolbar");
   const disabled = $(container).data("disabled");
 
+  const allowedEmptyContentSelector = "iframe";
   let quillToolbar = [
     ["bold", "italic", "underline", "linebreak"],
     [{ list: "ordered" }, { list: "bullet" }],
@@ -93,10 +95,15 @@ export default function createQuillEditor(container) {
     });
     container.dispatchEvent(event);
 
-    if (text === "\n" || text === "\n\n") {
+    if ((text === "\n" || text === "\n\n") && quill.root.querySelectorAll(allowedEmptyContentSelector).length === 0) {
       $input.val("");
     } else {
-      $input.val(quill.root.innerHTML);
+      const emptyParagraph = "<p><br></p>";
+      const cleanHTML = quill.root.innerHTML.replace(
+        new RegExp(`^${emptyParagraph}|${emptyParagraph}$`, "g"),
+        ""
+      );
+      $input.val(cleanHTML);
     }
   });
   // After editor is ready, linebreak_module deletes two extraneous new lines