decidim-core 0.27.3 → 0.27.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d6577740d87b562e24f541c4723480ec774239f69a389d4434536ab72be3b116
-  data.tar.gz: 8366df277375b9fadc5c96b4a9e647a0300057d7148eafcb672f3a57d3abd55f
+  metadata.gz: c9b09dc6caf48cd1318acfd39efaef6e9aa95ed3527ff40c3974a56f409eeff7
+  data.tar.gz: bb6ca8ea6d9b57a37d6793757cd8a12bbcffdf63afd27924216f67af1d8acb14
 SHA512:
-  metadata.gz: f6f4e9e7bcf14ccc5943ec41d4468338d1cf62aec7d37b296d0fa37a3c1c7bc97711b06579d10b32167ce291b8d664989f90eecfcba9a94f228ff60e7e8698e0
-  data.tar.gz: 4fcd0dacd12572c3a4b404709ec632dcc6c5cc964dfd9dc29d92a4dd03da2b10ddc3e5df57a6ed91cb3f90e0dac70c4668ba89040f8cf5788e34d1f8e857d3b8
+  metadata.gz: 4003252d8eeae3f86cb4056380f4fb7aefe8a8e97f3935e97a970513ccdd05e9d6b9ca8658b56147b7bff0e306608472e656db871eae5bbb50ab9cfc1e629d4b
+  data.tar.gz: ce5aec4bd84ee34b87b5b7cc3f1afb08a1e6bcc3c34ff5cf1afa87d3ded13fe012f29a6a882fead250413f64db4a9b643770ca2c0e643e186ea51bb57a2e6c87

data/app/cells/decidim/activities_cell.rb

@@ -27,13 +27,7 @@ module Decidim
     end
 
     def activities
-      @activities ||= last_activities.select do |activity|
-        activity.visible_for?(current_user)
-      end
-    end
-
-    def last_activities
-      @last_activities ||= model.map do |activity|
+      @activities ||= model.map do |activity|
         activity.organization_lazy
         activity.resource_lazy
         activity.participatory_space_lazy

data/app/cells/decidim/collapsible_list/show.erb

@@ -16,7 +16,7 @@
     </span>
   </div>
 <% else %>
-  <div class="collapsible-list <%= list_class %>">
+  <div class="<%= list_class %>">
     <% list.each do |element| %>
       <% if cell_name %>
         <%= cell cell_name, element, cell_options %>

data/app/cells/decidim/content_blocks/last_activity_cell.rb

@@ -56,10 +56,7 @@ module Decidim
       end
 
       def activities
-        @activities ||= ActionLog.where(
-          organization: current_organization,
-          visibility: %w(public-only all)
-        ).with_new_resource_type("all").order(created_at: :desc).limit(activities_to_show * 6)
+        @activities ||= Decidim::LastActivity.new(current_organization, current_user: current_user).query.limit(activities_to_show * 6)
       end
 
       def activities_to_show

data/app/cells/decidim/tags_cell.rb

@@ -55,7 +55,7 @@ module Decidim
     end
 
     def category_path
-      resource_locator(model).index(filter: { category_id: [model.category.id.to_s] })
+      resource_locator(model).index(filter: { filter_param(:category) => [model.category.id.to_s] })
     end
 
     def scope?
@@ -86,7 +86,18 @@ module Decidim
     end
 
     def scope_path
-      resource_locator(model).index(filter: { scope_id: [model.scope.id] })
+      resource_locator(model).index(filter: { filter_param(:scope) => [model.scope.id] })
+    end
+
+    def filter_param(name)
+      candidates = ["with_any_#{name}".to_sym, "with_#{name}".to_sym]
+      return candidates.first unless controller.respond_to?(:default_filter_params, true)
+
+      available_params = controller.send(:default_filter_params)
+      candidates.each do |candidate|
+        return candidate if available_params.has_key?(candidate)
+      end
+      candidates.first
     end
   end
 end

data/app/cells/decidim/upload_modal/modal.erb

@@ -35,7 +35,10 @@
         label: false,
         multiple: true,
         direct_upload: true,
-        data: { direct_upload_url: direct_upload_url } %>
+        data: {
+          direct_upload_url: direct_upload_url,
+          upload_validations_url: upload_validations_url
+        } %>
       <span><%= t("decidim.forms.upload_help.dropzone") %></span>
     </label>
   </div>

data/app/cells/decidim/upload_modal_cell.rb

@@ -156,15 +156,15 @@ module Decidim
     end
 
     def truncated_file_name_for(attachment, max_length = 31)
-      filename = file_name_for(attachment)
-      return filename if filename.length <= max_length
+      filename = determine_filename(attachment)
+      return decidim_html_escape(filename).html_safe if filename.length <= max_length
 
       name = File.basename(filename, File.extname(filename))
-      name.truncate(max_length, omission: "...#{name.last((max_length / 2) - 3)}#{File.extname(filename)}")
+      decidim_html_escape(name.truncate(max_length, omission: "...#{name.last((max_length / 2) - 3)}#{File.extname(filename)}")).html_safe
     end
 
     def file_name_for(attachment)
-      determine_filename(attachment)
+      decidim_html_escape(determine_filename(attachment)).html_safe
     end
 
     def determine_filename(attachment)
@@ -205,6 +205,10 @@ module Decidim
       Rails.application.class.routes.url_helpers.rails_direct_uploads_path
     end
 
+    def upload_validations_url
+      Decidim::Core::Engine.routes.url_helpers.upload_validations_path
+    end
+
     def form_object_class
       form.object.class.to_s
     end

data/app/cells/decidim/version_cell.rb

@@ -66,7 +66,7 @@ module Decidim
     end
 
     def resource_path
-      resource_locator(versioned_resource).path
+      Decidim::ResourceLocatorPresenter.new(versioned_resource).path
     end
   end
 end

data/app/cells/decidim/versions_list_cell.rb

@@ -13,7 +13,7 @@ module Decidim
     end
 
     def resource_path
-      resource_locator(versioned_resource).path
+      Decidim::ResourceLocatorPresenter.new(versioned_resource).path
     end
 
     def i18n_changes_title

data/app/commands/decidim/create_omniauth_registration.rb

@@ -46,8 +46,6 @@ module Decidim
     attr_reader :form, :verified_email
 
     def create_or_find_user
-      generated_password = SecureRandom.hex
-
       @user = User.find_or_initialize_by(
         email: verified_email,
         organization: organization
@@ -59,6 +57,8 @@ module Decidim
         # to be marked confirmed.
         @user.skip_confirmation! if !@user.confirmed? && @user.email == verified_email
       else
+        generated_password = SecureRandom.hex
+
         @user.email = (verified_email || form.email)
         @user.name = form.name
         @user.nickname = form.normalized_nickname

data/app/commands/decidim/endorse_resource.rb

@@ -31,6 +31,8 @@ module Decidim
       else
         broadcast(:invalid)
       end
+    rescue ActiveRecord::RecordNotUnique
+      broadcast(:invalid)
     end
 
     private

data/app/commands/decidim/search.rb

@@ -3,7 +3,7 @@
 module Decidim
   # A command that will act as a search service, with all the business logic for performing searches.
   class Search < Decidim::Command
-    ACCEPTED_FILTERS = [:decidim_scope_id_eq].freeze
+    ACCEPTED_FILTERS = [:decidim_scope_id_in].freeze
     HIGHLIGHTED_RESULTS_COUNT = 4
 
     # Public: Initializes the command.

data/app/commands/decidim/unendorse_resource.rb

@@ -31,7 +31,7 @@ module Decidim
       query = if @current_group.present?
                 @resource.endorsements.where(decidim_user_group_id: @current_group&.id)
               else
-                @resource.endorsements.where(author: @current_user, decidim_user_group_id: nil)
+                @resource.endorsements.where(author: @current_user, decidim_user_group_id: 0)
               end
       query.destroy_all
     end

data/app/controllers/concerns/decidim/force_authentication.rb

@@ -35,11 +35,15 @@ module Decidim
     end
 
     def unauthorized_paths
-      # /locale is for changing the locale
-      %w(/locale) + Decidim::StaticPage.where(
+      default_unauthorized_paths + Decidim::StaticPage.where(
         organization: current_organization,
         allow_public_access: true
       ).pluck(Arel.sql("CONCAT('/pages/', slug)"))
     end
+
+    def default_unauthorized_paths
+      # /locale is for changing the locale and /manifest.webmanifest to request PWA manifest
+      %w(/locale /manifest.webmanifest)
+    end
   end
 end

data/app/controllers/decidim/authorization_modals_controller.rb

@@ -17,7 +17,7 @@ module Decidim
     end
 
     def current_component
-      @current_component ||= Decidim::Component.find(params[:component_id])
+      @current_component ||= Decidim::Component.where(participatory_space: current_organization.participatory_spaces).find(params[:component_id])
     end
 
     def authorization_action

data/app/controllers/decidim/devise/registrations_controller.rb

@@ -39,7 +39,7 @@ module Decidim
           end
 
           on(:invalid) do
-            flash.now[:alert] = @form.errors.full_messages.join(", ") if @form.errors.full_messages.any?
+            flash.now[:alert] = t("error", scope: "decidim.devise.registrations.create")
             render :new
           end
         end

data/app/controllers/decidim/last_activities_controller.rb

@@ -32,13 +32,7 @@ module Decidim
     end
 
     def search_collection
-      ActionLog
-        .where(
-          organization: current_organization,
-          visibility: %w(public-only all)
-        )
-        .with_new_resource_type("all")
-        .order(created_at: :desc)
+      LastActivity.new(current_organization, current_user: current_user).query
     end
 
     def default_filter_params

data/app/controllers/decidim/links_controller.rb

@@ -35,7 +35,7 @@ module Decidim
     end
 
     def external_url
-      @external_url ||= URI.parse(params[:external_url])
+      @external_url ||= URI.parse(URI::Parser.new.escape(params[:external_url]))
     end
   end
 end

data/app/controllers/decidim/searches_controller.rb

@@ -26,7 +26,7 @@ module Decidim
         term: params[:term],
         with_resource_type: nil,
         with_space_state: nil,
-        decidim_scope_id_eq: nil
+        decidim_scope_id_in: nil
       }
     end
 

data/app/controllers/decidim/short_links_controller.rb

@@ -29,7 +29,7 @@ module Decidim
     #
     # @return [Decidim::ShortLink] The short link matching the identifier
     def link
-      @link ||= Decidim::ShortLink.find_by(identifier: params[:id])
+      @link ||= Decidim::ShortLink.find_by(identifier: params[:id], organization: current_organization)
     end
   end
 end

data/app/controllers/decidim/user_timeline_controller.rb

@@ -12,7 +12,7 @@ module Decidim
     helper_method :activities, :resource_types, :user
 
     def index
-      raise ActionController::RoutingError, "Not Found" if current_user != user
+      raise ActionController::RoutingError, "Not Found" unless user && current_user == user
     end
 
     private

data/app/forms/decidim/account_form.rb

@@ -24,7 +24,7 @@ module Decidim
     validates :nickname, presence: true, format: { with: Decidim::User::REGEXP_NICKNAME }
 
     validates :nickname, length: { maximum: Decidim::User.nickname_max_length, allow_blank: true }
-    validates :password, confirmation: true
+    validates :password, confirmation: { message: I18n.t("errors.messages.password_confirmation_message") }
     validates :password, password: { name: :name, email: :email, username: :nickname }, if: -> { password.present? }
     validates :password_confirmation, presence: true, if: :password_present
     validates :avatar, passthru: { to: Decidim::User }

data/app/forms/decidim/notifications_settings_form.rb

@@ -44,16 +44,8 @@ module Decidim
       allow_public_contact ? "all" : "followed-only"
     end
 
-    def user_is_moderator?(user)
-      Decidim.participatory_space_manifests.map do |manifest|
-        participatory_space_type = manifest.model_class_name.constantize
-        return true if participatory_space_type.moderators(user.organization).exists?(id: user.id)
-      end
-      false
-    end
-
     def meet_push_notifications_requirements?
-      Rails.application.secrets.vapid[:enabled]
+      Rails.application.secrets.dig(:vapid, :enabled) || false
     end
   end
 end

data/app/forms/decidim/registration_form.rb

@@ -17,7 +17,7 @@ module Decidim
     validates :name, presence: true, format: { with: Decidim::User::REGEXP_NAME }
     validates :nickname, presence: true, format: { with: Decidim::User::REGEXP_NICKNAME }, length: { maximum: Decidim::User.nickname_max_length }
     validates :email, presence: true, "valid_email_2/email": { disposable: true }
-    validates :password, confirmation: true
+    validates :password, confirmation: { message: I18n.t("errors.messages.password_confirmation_message") }
     validates :password, password: { name: :name, email: :email, username: :nickname }
     validates :password_confirmation, presence: true
     validates :tos_agreement, allow_nil: false, acceptance: true

data/app/forms/url_validator.rb

@@ -6,7 +6,7 @@
 #
 class UrlValidator < ActiveModel::EachValidator
   def validate_each(record, attribute, value)
-    record.errors.add attribute, (options[:message] || "must be a valid URL") unless url_valid?(value)
+    record.errors.add attribute, :url_format, **options unless url_valid?(value)
   end
 
   # a URL may be technically well-formed but may

data/app/helpers/decidim/decidim_form_helper.rb

@@ -84,6 +84,7 @@ module Decidim
 
       template = ""
       template += render("decidim/scopes/scopes_picker_input",
+                         values_options: { delete_button: false },
                          picker_options: picker_options,
                          prompt_params: prompt_params,
                          scopes: scopes,

data/app/helpers/decidim/layout_helper.rb

@@ -105,7 +105,10 @@ module Decidim
       # non-nil because otherwise it will be set to the asset host at
       # ActionView::Helpers::AssetUrlHelper#compute_asset_host.
       img_path = asset_pack_path(path, host: "", protocol: :relative)
-      Rails.public_path.join(img_path.sub(%r{^/}, ""))
+      path = Rails.public_path.join(img_path.sub(%r{^/}, ""))
+      return unless File.exist?(path)
+
+      path
     rescue ::Webpacker::Manifest::MissingEntryError
       nil
     end

data/app/helpers/decidim/omniauth_helper.rb

@@ -6,6 +6,8 @@ module Decidim
     # Public: normalize providers names to they can be used for buttons
     # and icons.
     def normalize_provider_name(provider)
+      return "x" if provider == :twitter
+
       provider.to_s.split("_").first
     end
 

data/app/helpers/decidim/resource_helper.rb

@@ -67,6 +67,8 @@ module Decidim
 
     # Returns an instance of ResourceLocatorPresenter with the given resource
     def resource_locator(resource)
+      return resource.resource_locator if resource.respond_to?(:resource_locator)
+
       ::Decidim::ResourceLocatorPresenter.new(resource)
     end
 

data/app/helpers/decidim/short_link_helper.rb

@@ -21,7 +21,7 @@ module Decidim
       target ||= respond_to?(:current_organization) && current_organization
       target ||= Rails.application
 
-      mounted_engine = EngineResolver.new(_routes).mounted_name
+      mounted_engine = target.try(:mounted_engine) || EngineResolver.new(_routes).mounted_name
       ShortLink.to(target, mounted_engine, **kwargs).short_url
     end
   end

data/app/jobs/decidim/download_your_data_export_job.rb

@@ -11,7 +11,8 @@ module Decidim
 
       generate_zip_file(user, path, password, export_format)
       save_or_upload_file(user, path)
-
+      # Deletes temporary file
+      File.delete(path)
       ExportMailer.download_your_data_export(user, filename, password).deliver_later
     end
 

data/app/jobs/decidim/open_data_job.rb

@@ -11,6 +11,8 @@ module Decidim
       raise "Couldn't generate Open Data export" unless exporter.export.positive?
 
       organization.open_data_file.attach(io: File.open(path, "rb"), filename: organization.open_data_file_path)
+      # Deletes the temporary file file
+      File.delete(path)
     end
   end
 end

data/app/models/decidim/organization.rb

@@ -87,6 +87,12 @@ module Decidim
       @top_scopes ||= scopes.top_level
     end
 
+    def participatory_spaces
+      @participatory_spaces ||= Decidim.participatory_space_manifests.flat_map do |manifest|
+        manifest.participatory_spaces.call(self)
+      end
+    end
+
     def public_participatory_spaces
       @public_participatory_spaces ||= Decidim.participatory_space_manifests.flat_map do |manifest|
         manifest.participatory_spaces.call(self).public_spaces

data/app/models/decidim/user.rb

@@ -205,7 +205,7 @@ module Decidim
     end
 
     def admin_terms_accepted?
-      return true if admin_terms_accepted_at
+      admin_terms_accepted_at.present?
     end
 
     # Whether this user can be verified against some authorization or not.
@@ -261,13 +261,22 @@ module Decidim
     end
 
     def needs_password_update?
+      return false if organization.users_registration_mode == "disabled"
       return false unless admin?
       return false unless Decidim.config.admin_password_strong
-      return true if password_updated_at.blank?
+      return identities.none? if password_updated_at.blank?
 
       password_updated_at < Decidim.config.admin_password_expiration_days.days.ago
     end
 
+    def moderator?
+      Decidim.participatory_space_manifests.map do |manifest|
+        participatory_space_type = manifest.model_class_name.constantize
+        return true if participatory_space_type.moderators(organization).exists?(id: id)
+      end
+      false
+    end
+
     protected
 
     # Overrides devise email required validation.
@@ -293,7 +302,8 @@ module Decidim
         event: "decidim.events.core.welcome_notification",
         event_class: WelcomeNotificationEvent,
         resource: self,
-        affected_users: [self]
+        affected_users: [self],
+        extra: { force_email: true }
       )
     end