decidim-core 0.27.5 → 0.27.7

data/lib/decidim/core/test/shared_examples/simple_event.rb

@@ -28,10 +28,10 @@ shared_context "when a simple event" do
   let(:extra) { {} }
   let(:resource_path) { resource_locator(resource).path }
   let(:resource_url) { resource_locator(resource).url }
-  let(:resource_title) { resource.title["en"] }
+  let(:resource_title) { decidim_sanitize_translated(resource.title) }
   # to be used when resource is a component resource, not a participatory space, in which case should be overriden
   let(:participatory_space) { resource.participatory_space }
-  let(:participatory_space_title) { participatory_space.title["en"] }
+  let(:participatory_space_title) { decidim_sanitize_translated(participatory_space.title) }
   let(:participatory_space_path) { Decidim::ResourceLocatorPresenter.new(participatory_space).path }
   let(:participatory_space_url) { Decidim::ResourceLocatorPresenter.new(participatory_space).url }
   let(:author) do
@@ -65,6 +65,7 @@ shared_examples_for "a simple event" do |skip_space_checks|
     it "is generated correctly" do
       expect(subject.email_subject).to be_kind_of(String)
       expect(subject.email_subject).not_to include("translation missing")
+      expect(subject.email_subject).not_to include("script")
     end
   end
 
@@ -100,6 +101,7 @@ shared_examples_for "a simple event" do |skip_space_checks|
     it "is generated correctly" do
       expect(subject.notification_title).to be_kind_of(String)
       expect(subject.notification_title).not_to include("translation missing")
+      expect(subject.notification_title).not_to include("script")
     end
   end
 
@@ -129,6 +131,12 @@ shared_examples_for "a simple event" do |skip_space_checks|
         expect(subject.participatory_space_url).to start_with("http")
       end
     end
+
+    describe "participatory_space_title" do
+      it "is generated correctly" do
+        expect(translated(participatory_space.title)).to include("script")
+      end
+    end
   end
 
   describe "i18n_options" do
@@ -152,3 +160,43 @@ shared_examples_for "a simple event" do |skip_space_checks|
     end
   end
 end
+
+shared_examples_for "a simple event email" do
+  describe "email_subject" do
+    it "is generated correctly" do
+      expect(subject.email_subject).to eq(email_subject)
+    end
+
+    # it "is html safe" do
+    #   #   pending "Enable after #12547 is merged"
+    #   expect(subject.email_subject).not_to include("script")
+    # end
+  end
+
+  describe "email_intro" do
+    it "is generated correctly" do
+      expect(subject.email_intro).to eq(email_intro)
+    end
+  end
+
+  describe "email_outro" do
+    it "is generated correctly" do
+      expect(subject.email_outro).to eq(email_outro)
+    end
+  end
+end
+
+shared_examples_for "a simple event notification" do
+  describe "notification_title" do
+    it "is generated correctly" do
+      expect(subject.notification_title)
+        .to eq(notification_title)
+    end
+    #
+    # it "is html safe" do
+    #   pp subject.notification_title
+    #   pending "Enable after #12547 is merged"
+    #   expect(subject.notification_title).not_to include("script")
+    # end
+  end
+end

data/lib/decidim/core/test.rb

@@ -76,3 +76,4 @@ require "decidim/core/test/shared_examples/resource_endorsed_event_examples"
 require "decidim/core/test/shared_examples/versions_controller_examples"
 require "decidim/core/test/shared_examples/mcell_examples"
 require "decidim/core/test/shared_examples/digest_mail_examples"
+require "decidim/core/test/shared_examples/resource_locator_presenter_examples"

data/lib/decidim/core/version.rb

@@ -4,7 +4,7 @@ module Decidim
   # This holds the decidim-core version.
   module Core
     def self.version
-      "0.27.5"
+      "0.27.7"
     end
   end
 end

data/lib/decidim/core.rb

@@ -114,6 +114,7 @@ module Decidim
   autoload :ControllerHelpers, "decidim/controller_helpers"
   autoload :ProcessesFileLocally, "decidim/processes_file_locally"
   autoload :DependencyResolver, "decidim/dependency_resolver"
+  autoload :HasConversations, "decidim/has_conversations"
 
   include ActiveSupport::Configurable
   # Loads seeds from all engines.

data/lib/decidim/engine_router.rb

@@ -16,7 +16,7 @@ module Decidim
     #
     # @return [EngineRouter] The new engine router
     def self.main_proxy(target)
-      new(target.mounted_engine, target.mounted_params)
+      new(target.mounted_engine, target.mounted_params, target)
     end
 
     # Instantiates a router to the backend engine for an object.
@@ -25,12 +25,13 @@ module Decidim
     #
     # @return [EngineRouter] The new engine router
     def self.admin_proxy(target)
-      new(target.mounted_admin_engine, target.mounted_params)
+      new(target.mounted_admin_engine, target.mounted_params, target)
     end
 
-    def initialize(engine, default_url_options)
+    def initialize(engine, default_url_options, target = nil)
       @engine = engine
       @default_url_options = default_url_options
+      @target = target
     end
 
     def default_url_options
@@ -44,11 +45,23 @@ module Decidim
     def method_missing(method_name, *args)
       return super unless route_helper?(method_name)
 
-      send(@engine).send(method_name, *args)
+      filter_slug_params!(method_name)
+
+      send(engine).send(method_name, *args)
     end
 
     private
 
+    attr_reader :engine, :target
+
+    def filter_slug_params!(method_name)
+      return if target.nil?
+      return unless target.respond_to?(:mounted_params)
+
+      skip_space_slug = target.respond_to?(:slug_param_name) && target.respond_to?(:skip_space_slug?) && target.skip_space_slug?(method_name)
+      @default_url_options.except!(target.slug_param_name) if skip_space_slug == true
+    end
+
     def route_helper?(method_name)
       method_name.to_s.match?(/_(url|path)$/)
     end

data/lib/decidim/events/base_event.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative "../../../app/helpers/decidim/sanitize_helper"
+
 module Decidim
   module Events
     # This class serves as a base for all event classes. Event classes are intended to
@@ -8,6 +10,7 @@ module Decidim
     class BaseEvent
       extend ActiveModel::Translation
       include Decidim::TranslatableAttributes
+      include Decidim::SanitizeHelper
 
       class_attribute :types
       self.types = []
@@ -103,14 +106,18 @@ module Decidim
         return unless resource
 
         title = if resource.respond_to?(:title)
-                  translated_attribute(resource.title)
+                  decidim_sanitize_translated(resource.title)
                 elsif resource.respond_to?(:name)
-                  translated_attribute(resource.name)
+                  decidim_sanitize_translated(resource.name)
                 end
 
         Decidim::ContentProcessor.render_without_format(title, links: false).html_safe
       end
 
+      def hidden_resource?
+        resource.respond_to?(:hidden?) && resource.hidden?
+      end
+
       private
 
       def component

data/lib/decidim/events/simple_event.rb

@@ -11,7 +11,6 @@ module Decidim
       include Decidim::Events::EmailEvent
       include Decidim::Events::NotificationEvent
       include Decidim::ComponentPathHelper
-      include Decidim::SanitizeHelper
 
       delegate :created_at, to: :resource
 
@@ -34,14 +33,7 @@ module Decidim
       end
 
       def email_subject
-        I18n.t("email_subject", **email_subject_i18n_options).html_safe
-      end
-
-      def email_subject_i18n_options
-        sanitized_values = { resource_title: decidim_sanitize(resource_title) }
-        sanitized_values[:mentioned_proposal_title] = decidim_sanitize(mentioned_proposal_title) if i18n_options.has_key?(:mentioned_proposal_title)
-        sanitized_values[:participatory_space_title] = decidim_sanitize(participatory_space_title) if i18n_options.has_key?(:participatory_space_title)
-        i18n_options.merge(sanitized_values)
+        I18n.t("email_subject", **i18n_options).html_safe
       end
 
       def email_intro
@@ -77,13 +69,7 @@ module Decidim
 
       # Public: The Hash of options to pass to the I18.t method.
       def i18n_options
-        default_i18n_options.merge(event_interpolations).transform_values do |value|
-          if value.is_a?(String)
-            decidim_html_escape(value)
-          else
-            value
-          end
-        end
+        default_i18n_options.merge(event_interpolations)
       end
 
       # Caches the path for the given resource when it's a Decidim::Component.
@@ -136,7 +122,7 @@ module Decidim
       end
 
       def participatory_space_title
-        translated_attribute(participatory_space.try(:title))
+        decidim_sanitize_translated(participatory_space.try(:title))
       end
     end
   end

data/lib/decidim/form_builder.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "foundation_rails_helper/form_builder"
+require_relative "../../app/helpers/decidim/sanitize_helper"
 
 module Decidim
   # This custom FormBuilder adds fields needed to deal with translatable fields,
@@ -9,6 +10,7 @@ module Decidim
     include ActionView::Context
     include Decidim::TranslatableAttributes
     include Decidim::Map::Autocomplete::FormBuilder
+    include Decidim::SanitizeHelper
 
     # Public: generates a check boxes input from a collection and adds help
     # text and errors.
@@ -192,11 +194,12 @@ module Decidim
       options.delete(:required)
       hashtaggable = options.delete(:hashtaggable)
       hidden_options = extract_validations(name, options).merge(options)
+      sanitized_value = sanitize_editor_value(object.send(name))
 
       content_tag(:div, class: "editor #{"hashtags__container" if hashtaggable}") do
         template = ""
         template += label(name, label_text + required_for_attribute(name)) if options.fetch(:label, true)
-        template += hidden_field(name, hidden_options)
+        template += hidden_field(name, hidden_options.merge(value: sanitized_value))
         template += content_tag(:div, nil, class: "editor-container #{"js-hashtags" if hashtaggable}", data: {
                                   toolbar: toolbar,
                                   disabled: options[:disabled],
@@ -941,5 +944,14 @@ module Decidim
 
       object.class
     end
+
+    # Private: Sanitize editor values to prevent malformed values being display in the
+    # WYSIWYG editor
+    #
+    def sanitize_editor_value(value)
+      sanitized_value = decidim_sanitize_editor_admin(value)
+
+      sanitized_value == %(<div class="ql-editor-display"></div>) ? "" : sanitized_value
+    end
   end
 end

data/lib/decidim/has_category.rb

@@ -8,7 +8,7 @@ module Decidim
     extend ActiveSupport::Concern
 
     included do
-      has_one :categorization, as: :categorizable
+      has_one :categorization, as: :categorizable, class_name: "Decidim::Categorization", dependent: :destroy
       has_one :category, through: :categorization
 
       scope :with_category, lambda { |category|

data/lib/decidim/has_conversations.rb

@@ -0,0 +1,91 @@
+# frozen_string_literal: true
+
+require "active_support/concern"
+
+module Decidim
+  module HasConversations
+    extend ActiveSupport::Concern
+
+    included do
+      def new_conversation(originator, user, conversation)
+        send_notification(
+          from: originator,
+          to: user,
+          conversation: conversation,
+          message: conversation.messages.first.body,
+          action: "new_conversation"
+        )
+      end
+
+      def new_group_conversation(originator, manager, conversation, group)
+        send_notification(
+          from: originator,
+          to: manager,
+          conversation: conversation,
+          message: conversation.messages.first.body,
+          action: "new_group_conversation",
+          third_party: group
+        )
+      end
+
+      def comanagers_new_conversation(group, user, conversation, manager)
+        send_notification(
+          from: group,
+          to: user,
+          conversation: conversation,
+          message: conversation.messages.first.body,
+          action: "comanagers_new_conversation",
+          third_party: manager
+        )
+      end
+
+      def new_message(sender, user, conversation, message)
+        send_notification(
+          from: sender,
+          to: user,
+          conversation: conversation,
+          message: message.body,
+          action: "new_message"
+        )
+      end
+
+      def new_group_message(sender, user, conversation, message, group)
+        send_notification(
+          from: sender,
+          to: user,
+          conversation: conversation,
+          message: message.body,
+          action: "new_group_message",
+          third_party: group
+        )
+      end
+
+      def comanagers_new_message(sender, user, conversation, message, manager)
+        send_notification(
+          from: sender,
+          to: user,
+          conversation: conversation,
+          message: message.body,
+          action: "comanagers_new_message",
+          third_party: manager
+        )
+      end
+
+      private
+
+      def get_subject(action:, sender:, third_party:)
+        I18n.t(
+          "conversation_mailer.#{action}.subject",
+          scope: "decidim.messaging",
+          sender: sender.name,
+          manager: third_party&.name,
+          group: third_party&.name
+        )
+      end
+
+      def send_notification
+        raise NotImplementedError, "You must define a send_notification method"
+      end
+    end
+  end
+end

data/lib/decidim/organization_settings.rb

@@ -130,12 +130,20 @@ module Decidim
               )
             },
             "maximum_file_size" => {
-              "default" => 10.0,
-              "avatar" => 5.0
+              "default" => default_maximum_attachment_size,
+              "avatar" => default_maximum_avatar_size
             }
           }
         }
       end
+
+      def default_maximum_attachment_size
+        (Rails.application.secrets.decidim[:maximum_attachment_size].presence || 10).to_f
+      end
+
+      def default_maximum_avatar_size
+        (Rails.application.secrets.decidim[:maximum_avatar_size].presence || 5).to_f
+      end
     end
 
     def initialize(organization)

data/lib/decidim/participable.rb

@@ -12,6 +12,23 @@ module Decidim
                :mounted_engine, :mounted_admin_engine, :admin_extension_module, :admins_query,
                to: :class
 
+      def skip_space_slug?(method_name)
+        [
+          "edit_#{underscored_name}_path".to_sym,
+          "edit_#{underscored_name}_url".to_sym,
+          "new_#{underscored_name}_path".to_sym,
+          "new_#{underscored_name}_url".to_sym,
+          "#{underscored_name}_path".to_sym,
+          "#{underscored_name}_url".to_sym,
+          "#{underscored_name.pluralize}_path".to_sym,
+          "#{underscored_name.pluralize}_url".to_sym
+        ].include?(method_name)
+      end
+
+      def slug_param_name
+        "#{underscored_name}_slug".to_sym
+      end
+
       def mounted_params
         {
           host: organization.host,

data/lib/decidim/view_model.rb

@@ -16,6 +16,7 @@ module Decidim
     include Cell::Caching::Notifications
     include Decidim::MarkupHelper
     include ::Webpacker::Helper
+    include Decidim::SanitizeHelper
 
     delegate :current_organization, to: :controller
 

data/lib/decidim/webpacker/webpack/.modernizrrc

@@ -0,0 +1,9 @@
+{
+  "minify": true,
+    "options": [
+      "setClasses"
+    ],
+    "feature-detects": [
+      "css/transitions"
+    ]
+}

data/lib/premailer/adapter/decidim.rb

@@ -16,15 +16,16 @@ class Premailer
       # @return [String] a plain text.
       def to_plain_text
         html_src = begin
+          @doc.css("style").remove
           @doc.at("body").inner_html
         rescue StandardError
           ""
         end
 
-        html_src = @doc.to_html unless html_src && html_src.present?
-
-        # remove style tags and content
-        html_src.gsub!(%r{<style.*?/style>}m, "")
+        unless html_src && html_src.present?
+          @doc.css("style").remove
+          html_src = @doc.to_html
+        end
 
         convert_to_text(html_src, @options[:line_length], @html_encoding)
       end

data/lib/tasks/decidim_reminders_tasks.rake

@@ -2,6 +2,7 @@
 
 namespace :decidim do
   namespace :reminders do
+    desc "Sends all the email reminders defined in the manifests"
     task :all, [] => :environment do
       Decidim.reminders_registry.all.each do |reminder_manifest|
         call_reminder_job(reminder_manifest)

data/lib/tasks/upgrade/decidim_fix_categorization.rake

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+namespace :decidim do
+  namespace :upgrade do
+    desc "Remove orphan categorizations"
+    task fix_orphan_categorizations: :environment do
+      logger = Logger.new($stdout)
+      logger.info("Removing orphan categorizations...")
+
+      Decidim::Categorization.find_each do |categorization|
+        categorization.destroy if categorization.categorizable.nil?
+      end
+    end
+  end
+end