decidim-core 0.27.2 → 0.27.3

data/app/scrubbers/decidim/user_input_scrubber.rb

@@ -18,12 +18,41 @@ module Decidim
 
     private
 
+    RESTRICTED_TAGS = %w(
+      area
+      article
+      aside
+      audio
+      button
+      canvas
+      fieldset
+      figcaption
+      figure
+      font
+      footer
+      form
+      header
+      img
+      input
+      label
+      legend
+      main
+      map
+      menu
+      optgroup
+      option
+      output
+      select
+      textarea
+      video
+    ).freeze
+
     def custom_allowed_attributes
       Loofah::HTML5::SafeList::ALLOWED_ATTRIBUTES
     end
 
     def custom_allowed_tags
-      Loofah::HTML5::SafeList::ALLOWED_ELEMENTS_WITH_LIBXML2
+      Loofah::HTML5::SafeList::ACCEPTABLE_ELEMENTS - RESTRICTED_TAGS
     end
   end
 end

data/app/services/decidim/traceability.rb

@@ -117,6 +117,7 @@ module Decidim
       return unless user.is_a?(Decidim::User)
       # If the record is not valid, it may not yet have an ID causing an
       # exception when trying to save the log record.
+      return if resource.nil?
       return unless resource.valid?
 
       Decidim::ActionLogger.log(

data/app/validators/uploader_image_dimensions_validator.rb

@@ -29,21 +29,41 @@ class UploaderImageDimensionsValidator < ActiveModel::Validations::FileContentTy
     return if (image = extract_image(file)).blank?
 
     record.errors.add attribute, I18n.t("carrierwave.errors.file_resolution_too_large") if image.dimensions.any? { |dimension| dimension > uploader.max_image_height_or_width }
+  rescue MiniMagick::Error, MiniMagick::Invalid
+    # The error may happen because of many reasons but most commonly the image
+    # exceeds the default maximum dimensions set for ImageMagick when the
+    # `identify` command fails to identify the image.
+    #
+    # To relax ImageMagick default limits, please refer to:
+    # https://imagemagick.org/script/security-policy.php
+    #
+    # Note that the error can also happen because of other reasons than only
+    # the image dimensions being too large. But as we do not really know the
+    # reason every time, we default to that error.
+    record.errors.add attribute, I18n.t("carrierwave.errors.file_cannot_be_processed")
   end
 
   def extract_image(file)
     return unless file.try(:content_type).to_s.start_with?("image")
 
-    if file.is_a?(ActionDispatch::Http::UploadedFile)
+    if uploaded_file?(file)
       MiniMagick::Image.new(file.path)
     elsif file.is_a?(ActiveStorage::Attached) && file.blob.persisted?
       MiniMagick::Image.read(file.blob.download)
     end
-  rescue ActiveStorage::FileNotFoundError
+  rescue ActiveStorage::FileNotFoundError, MiniMagick::Invalid
     # Although the blob is persisted, the file is not available to download and analyze
     # after committing the record
     nil
   end
 
   def check_validity!; end
+
+  private
+
+  def uploaded_file?(file)
+    return true if defined?(Rack::Test::UploadedFile) && file.is_a?(Rack::Test::UploadedFile)
+
+    file.is_a?(ActionDispatch::Http::UploadedFile)
+  end
 end

data/app/views/decidim/links/_invalid_url_modal.html.erb

@@ -0,0 +1,17 @@
+<%= decidim_modal id: "external-domain-warning" do %>
+  <div data-dialog-container>
+    <%= icon "external-link-line" %>
+    <h2 id="dialog-title-external-domain-warning" tabindex="-1" data-dialog-title><%= t("decidim.links.warning.title") %></h2>
+    <div>
+
+      <code class="mt-5 block break-all text-alert">
+        <%= flash[:alert] %>
+      </code>
+    </div>
+  </div>
+  <div data-dialog-actions>
+    <button class="button button__lg button__transparent-secondary" data-dialog-close="external-domain-warning">
+      <%= t("decidim.links.warning.cancel") %>
+    </button>
+  </div>
+<% end %>

data/app/views/decidim/links/_modal.html.erb

@@ -13,7 +13,7 @@
       </div>
     </div>
     <div class="row buttons">
-      <%= link_to t("decidim.links.warning.proceed"), params[:external_url], target: "_blank", data: { close: "" }, class: "button primary button--nomargin" %>
+      <%= link_to t("decidim.links.warning.proceed"), external_url.to_s, target: "_blank", data: { close: "" }, class: "button primary button--nomargin" %>
       <button class="button clear" data-close>
         <%= t("decidim.links.warning.cancel") %>
       </button>

data/app/views/decidim/links/invalid_url.js.erb

@@ -0,0 +1,24 @@
+(function() {
+  const create = (selector) => {
+    const element = document.createElement("div")
+    element.id = selector
+    document.body.append(element)
+    return element
+  }
+
+  const selector = "external-domain-warning"
+  const selectorContainer = `${selector}-container`
+
+  // if the container does not exist in the DOM, it creates a new one, otherwise, replace the content
+  const externalDomainWarning = document.getElementById(selectorContainer) || create(selectorContainer)
+
+  externalDomainWarning.innerHTML = ''
+  externalDomainWarning.innerHTML = '<%= j(render partial: "invalid_url_modal").strip.html_safe %>'
+
+  new window.Decidim.Dialogs(`#${selector}`, {
+    closingSelector: `[data-dialog-close="${selector}"]`,
+    backdropSelector: `[data-dialog="${selector}"]`,
+    labelledby: `dialog-title-${selector}`,
+    describedby: `dialog-desc-${selector}`
+  }).open()
+})()

data/app/views/decidim/links/new.html.erb

@@ -12,7 +12,7 @@
           </div>
           <div class="row">
             <div class="columns large-12 text-center">
-              <%= link_to t("decidim.links.warning.proceed"), params[:external_url], class: "button expanded primary" %>
+              <%= link_to t("decidim.links.warning.proceed"), external_url.to_s, class: "button expanded primary" %>
             </div>
           </div>
         </div>

data/app/views/decidim/messaging/conversations/_conversation.html.erb

@@ -33,11 +33,7 @@
         <span class="text-small">
           <%= t("last_message", scope: "decidim.messaging.conversations.index") %>:
           <strong>
-            <% if I18n.locale != :en %>
-              <%= t("ago", scope: "decidim.messaging.conversations.index") %> <%= time_ago_in_words(Time.parse(conversation.last_message.created_at.to_s)) %>
-            <% else %>
-              <%= time_ago_in_words(Time.parse(conversation.last_message.created_at.to_s)) %> <%= t("ago", scope: "decidim.messaging.conversations.index") %>
-            <% end %>
+            <%= t("decidim.user_conversations.index.time_ago", time: time_ago_in_words(Time.zone.parse(conversation.last_message.created_at.to_s))) %>
           </strong>
         </span>
       </div>