decidim-core 0.28.1 → 0.28.3

data/app/models/decidim/user.rb

@@ -278,6 +278,18 @@ module Decidim
       false
     end
 
+    def after_confirmation
+      return unless organization.send_welcome_notification?
+
+      Decidim::EventsManager.publish(
+        event: "decidim.events.core.welcome_notification",
+        event_class: WelcomeNotificationEvent,
+        resource: self,
+        affected_users: [self],
+        extra: { force_email: true }
+      )
+    end
+
     protected
 
     # Overrides devise email required validation.
@@ -296,18 +308,6 @@ module Decidim
       super
     end
 
-    def after_confirmation
-      return unless organization.send_welcome_notification?
-
-      Decidim::EventsManager.publish(
-        event: "decidim.events.core.welcome_notification",
-        event_class: WelcomeNotificationEvent,
-        resource: self,
-        affected_users: [self],
-        extra: { force_email: true }
-      )
-    end
-
     private
 
     # Changes default Devise behaviour to use ActiveJob to send async emails.

data/app/packs/src/decidim/a11y.js

@@ -104,6 +104,20 @@ const createDropdown = (component) => {
     });
   }
 
+  // Disable focus on children elements so we can pass the AXE accessibility tests
+  const dropdownMenu = document.getElementById(dropdownOptions.dropdown);
+  if (dropdownMenu.getAttribute("aria-hidden") === "true") {
+    dropdownMenu.
+      querySelectorAll("a, input, button").
+      forEach((element) => { element.tabIndex = -1 })
+  }
+
+  component.addEventListener("click", () => {
+    dropdownMenu.
+      querySelectorAll("a, input, button").
+      forEach((element) => { element.tabIndex = 0 })
+  })
+
   Dropdowns.render(component.id, dropdownOptions);
 }
 

data/app/packs/src/decidim/abide_form_validator_fixer.js

@@ -0,0 +1,44 @@
+/**
+ * This script modifies the behavior of Abide form validation to address the issue of form validation errors
+ * appearing prematurely in input fields.
+ *
+ * The primary goal is to hide error messages until the input field loses focus.
+ */
+
+class AbideFormValidatorFixer {
+  initialize() {
+    const forms = document.querySelectorAll("main [data-live-validate='true']");
+
+    forms.forEach((form) => {
+      if (this.isElementVisible(form)) {
+        this.setupForm(form);
+      }
+    });
+  }
+
+  isElementVisible(element) {
+    return element.offsetParent !== null && getComputedStyle(element).display !== "none";
+  }
+
+  setupForm(form) {
+    const inputs = form.querySelectorAll("input");
+
+    inputs.forEach((input) => {
+      const errorElement = input.closest("label")?.querySelector(".form-error") || input.parentElement.querySelector(".form-error");
+      if (!errorElement) {
+        return;
+      }
+      form.removeAttribute("data-live-validate");
+      input.addEventListener("input", this.hideErrorElement.bind(this, errorElement));
+    });
+  }
+
+  hideErrorElement(errorElement) {
+    errorElement.classList.remove("is-visible");
+  }
+}
+
+document.addEventListener("DOMContentLoaded", () => {
+  const validatorFixer = new AbideFormValidatorFixer();
+  validatorFixer.initialize();
+});

data/app/packs/src/decidim/direct_uploads/upload_modal.js

@@ -154,20 +154,16 @@ export default class UploadModal {
     // Disabled save button when any children have data-state="error"
     this.saveButton.disabled = Array.from(files).filter(({ dataset: { state } }) => state === STATUS.ERROR).length > 0;
 
-    const dataSelectFileButton = this.emptyItems.querySelector("[data-select-file-button]");
-
     // Only allow to continue the upload when the multiple option is true (default: false)
     const continueUpload = !files.length || this.options.multiple
     this.input.disabled = !continueUpload
     if (continueUpload) {
       this.emptyItems.classList.remove("is-disabled");
-      dataSelectFileButton.removeAttribute("disabled");
+      this.emptyItems.querySelector("label").removeAttribute("disabled");
     } else {
       this.emptyItems.classList.add("is-disabled");
-      dataSelectFileButton.disabled = true;
+      this.emptyItems.querySelector("label").disabled = true;
     }
-
-    dataSelectFileButton.addEventListener("click", () => this.input.click());
   }
 
   createUploadItem(file, errors, opts = {}) {

data/app/packs/src/decidim/index.js

@@ -50,6 +50,7 @@ import "src/decidim/impersonation"
 import "src/decidim/gallery"
 import "src/decidim/direct_uploads/upload_field"
 import "src/decidim/data_consent"
+import "src/decidim/abide_form_validator_fixer"
 import "src/decidim/sw"
 
 // local deps that require initialization
@@ -90,6 +91,33 @@ window.Decidim = window.Decidim || {
 
 window.morphdom = morphdom
 
+// REDESIGN_PENDING: deprecated
+window.initFoundation = (element) => {
+  $(element).foundation();
+
+  // Fix compatibility issue with the `a11y-accordion-component` package that
+  // uses the `data-open` attribute to indicate the open state for the accordion
+  // trigger.
+  //
+  // In Foundation, these listeners are initiated on the document node always,
+  // regardless of the element for which foundation is initiated. Therefore, we
+  // need the document node here instead of the `element` passed to this
+  // function.
+  const $document = $(document);
+
+  $document.off("click.zf.trigger", window.Foundation.Triggers.Listeners.Basic.openListener);
+  $document.on("click.zf.trigger", "[data-open]", (ev, ...restArgs) => {
+    // Do not apply for the accordion triggers.
+    const accordion = ev.currentTarget?.closest("[data-component='accordion']");
+    if (accordion) {
+      return;
+    }
+
+    // Otherwise call the original implementation
+    Reflect.apply(window.Foundation.Triggers.Listeners.Basic.openListener, ev.currentTarget, [ev, ...restArgs]);
+  });
+};
+
 Rails.start()
 
 /**
@@ -104,7 +132,7 @@ const initializer = (element = document) => {
   window.focusGuard = window.focusGuard || new FocusGuard(document.body);
 
   // REDESIGN_PENDING: deprecated
-  $(element).foundation();
+  window.initFoundation(element);
 
   svg4everybody();
 

data/app/packs/src/decidim/input_character_counter.js

@@ -74,7 +74,7 @@ export default class InputCharacterCounter {
 
       // If input is a hidden for WYSIWYG editor add it at the end
       if (this.$input.parent().is(".editor")) {
-        this.$input.parent().after(this.$target);
+        this.$input.parent().append(container);
       } else {
         const wrapper = document.createElement("span")
         wrapper.className = "input-character-counter"

data/app/packs/stylesheets/decidim/_accordion.scss

@@ -4,10 +4,10 @@
 
 [data-component="accordion"]
   [id*="comment"][class="comment-reply"][aria-hidden="true"] {
-  display: block;
+  display: none;
 }
 
 [data-component="accordion"]
   [id*="comment"][class="comment-reply"][aria-hidden="false"] {
-  display: none;
+  display: block;
 }

data/app/packs/stylesheets/decidim/_cards.scss

@@ -134,7 +134,7 @@
     &-month,
     &-day,
     &-year {
-      @apply inline-flex items-center justify-evenly empty:[&>span]:hidden;
+      @apply inline-flex items-center justify-evenly empty:[&>div]:hidden;
     }
   }
 
@@ -143,7 +143,7 @@
   &__list-metadata {
     @apply mt-auto inline-flex flex-wrap gap-x-4 md:gap-0;
 
-    & > span {
+    & > div {
       @apply inline-flex items-center gap-1 px-0 md:px-6 border-gray-3 border-0 md:border-r first:pl-0 last:pr-0 last:border-r-0 text-sm text-gray-2;
 
       & > svg {

data/app/packs/stylesheets/decidim/_dropdown.scss

@@ -36,6 +36,15 @@
 .dropdown {
   @apply absolute border-2 border-gray-3 rounded min-w-max p-4 drop-shadow-md text-left z-10;
 
+  /*
+    NOTE: the calculated value is the sum of the arrow offset position plus the half of the arrow size:
+    - offset position: 20%
+    - arrow size: 1.5rem
+  */
+  --arrow-offset: 20%;
+  --arrow-size: 1.5rem;
+  --arrow-visible-size: var(--arrow-size) * 0.5;
+
   & > * {
     @apply relative z-10 p-3.5 first:pt-1.5 last:pb-1.5;
   }
@@ -54,15 +63,6 @@
     }
   }
 
-  /*
-    NOTE: the calculated value is the sum of the arrow offset position plus the half of the arrow size:
-    - offset position: 20%
-    - arrow size: 1.5rem
-  */
-  --arrow-offset: 20%;
-  --arrow-size: 1.5rem;
-  --arrow-visible-size: var(--arrow-size) * 0.5;
-
   &__bottom {
     @apply top-full right-0 mt-3 translate-x-[calc(var(--arrow-offset)-var(--arrow-visible-size))] before:content-[''] before:absolute before:right-[var(--arrow-offset)] before:-top-2 before:w-[var(--arrow-size)] before:h-[var(--arrow-size)] before:rotate-45 before:bg-white before:rounded before:border-2 before:border-gray-3 after:content-[''] after:absolute after:left-0 after:top-0 after:w-full after:h-full after:bg-white;
   }

data/app/packs/stylesheets/decidim/_forms.scss

@@ -45,16 +45,16 @@
   }
 
   select {
-    &:not(.reset-defaults) {
-      @apply pr-8;
-    }
-
     @apply appearance-none;
 
     background-image: url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' fill='none' viewBox='0 0 12 8'%3e%3cpath fill='%233E4C5C' d='M5.99962 4.97656L10.1246 0.851562L11.303 2.0299L5.99962 7.33323L0.696289 2.0299L1.87462 0.851562L5.99962 4.97656Z'/%3e%3c/svg%3e");
     background-position: right 1rem center;
     background-repeat: no-repeat;
     background-size: 0.75rem;
+
+    &:not(.reset-defaults) {
+      @apply pr-8;
+    }
   }
 }
 

data/app/packs/stylesheets/decidim/_layout.scss

@@ -6,7 +6,7 @@
   }
 
   [data-content] {
-    @apply min-h-[60vh] relative flex flex-col;
+    @apply relative flex flex-col;
   }
 }
 
@@ -31,14 +31,14 @@
 }
 
 .layout-2col {
-  @apply md:grid grid-cols-12 container grow min-h-[60vh];
+  @apply md:grid grid-cols-12 container grow auto-rows-max;
 
   &__aside {
     @apply col-span-4 lg:col-span-3 md:pr-16 py-6 md:py-12 gap-6 md:gap-12 flex flex-col justify-between items-start md:justify-start before:content-[''] before:absolute before:top-0 before:left-0 before:h-full before:w-1/2 before:-z-10 md:before:bg-background;
   }
 
   &__main {
-    @apply col-span-8 lg:col-span-9 bg-white md:pl-16 py-6 md:py-12;
+    @apply col-span-8 lg:col-span-9 bg-white md:pl-16 py-6 md:py-12 min-h-[60vh];
   }
 
   &__reverse &__aside {

data/app/packs/stylesheets/decidim/_modal_update.scss

@@ -28,9 +28,7 @@
           @apply w-24 flex-none flex justify-center;
         }
 
-        img:not([src^="data:image"]):not(
-            [src^="data:application/octet-stream"]
-          ) {
+        img[src="data:,"] {
           @apply hidden;
         }
 

data/app/packs/stylesheets/decidim/_tooltip.scss

@@ -1,6 +1,16 @@
 [role="tooltip"] {
   @apply absolute bg-black z-10 px-4 py-2 w-max max-w-xs rounded text-left text-white;
 
+  /*
+    NOTE: the calculated value is the sum of the arrow offset position plus the half of the arrow size:
+    - offset position: 20%
+    - arrow size: 16px
+  */
+  --arrow-offset: 20%;
+  --arrow-size: 16px;
+  --arrow-visible-size: var(--arrow-size) * 0.5;
+  --arrow-margin: var(--arrow-visible-size) * 1.4142135623730951; // due to the rotation, the margin is SQRT2 times the visible size
+
   & > * {
     @apply relative z-20;
   }
@@ -41,16 +51,6 @@
     }
   }
 
-  /*
-    NOTE: the calculated value is the sum of the arrow offset position plus the half of the arrow size:
-    - offset position: 20%
-    - arrow size: 16px
-  */
-  --arrow-offset: 20%;
-  --arrow-size: 16px;
-  --arrow-visible-size: var(--arrow-size) * 0.5;
-  --arrow-margin: var(--arrow-visible-size) * 1.4142135623730951; // due to the rotation, the margin is SQRT2 times the visible size
-
   &.top {
     @apply -translate-x-[calc(100%-var(--arrow-offset))] -translate-y-[calc(100%+var(--arrow-margin))] before:content-[''] before:absolute before:-z-10 before:right-[calc(var(--arrow-offset)-var(--arrow-visible-size))] before:-bottom-[var(--arrow-visible-size)] before:w-[var(--arrow-size)] before:h-[var(--arrow-size)] before:rotate-45 before:bg-black before:rounded-br;
   }

data/app/packs/stylesheets/decidim/editor.scss

@@ -21,7 +21,7 @@
 }
 
 .editor-container {
-  @apply editor-props editor-suggestions-props flex flex-col mb-6 border editor-border;
+  @apply editor-props editor-suggestions-props flex flex-col mt-4 border editor-border;
 
   &.editor-disabled {
     .editor-input .ProseMirror {

data/app/presenters/decidim/admin_log/organization_presenter.rb

@@ -26,7 +26,7 @@ module Decidim
 
       def settings_attributes_mapping
         {
-          name: :string,
+          name: :i18n,
           default_locale: :locale,
           reference_prefix: :string,
           twitter_handler: :string,

data/app/presenters/decidim/log/resource_presenter.rb

@@ -10,6 +10,8 @@ module Decidim
     # overwrite `BasePresenter#resource_presenter` to return your custom resource presenter.
     # The only requirement for custom renderers is that they should respond to `present`.
     class ResourcePresenter
+      include Decidim::SanitizeHelper
+
       # Public: Initializes the presenter.
       #
       # resource - An instance of a model that can be located by
@@ -65,7 +67,11 @@ module Decidim
       #
       # Returns an HTML-safe String.
       def present_resource_name
-        h.translated_attribute extra["title"]
+        if resource.present? && resource.respond_to?(:presenter) && resource.presenter.respond_to?(:title)
+          resource.presenter.title(html_escape: true)
+        else
+          decidim_escape_translated(extra["title"]).html_safe
+        end
       end
     end
   end

data/app/services/decidim/download_your_data_exporter.rb

@@ -1,8 +1,6 @@
 # frozen_string_literal: true
 
-require "seven_zip_ruby"
-require "zip"
-require_relative "zip_stream/writer"
+require "decidim/seven_zip_wrapper"
 
 module Decidim
   # Public: Generates a 7z(seven zip) file with data files ready to be persisted
@@ -10,8 +8,6 @@ module Decidim
   #
   # In fact, the 7z file wraps a ZIP file which finally contains the data files.
   class DownloadYourDataExporter
-    include ::Decidim::ZipStream::Writer
-
     DEFAULT_EXPORT_FORMAT = "CSV"
     ZIP_FILE_NAME = "download-your-data.zip"
 
@@ -29,36 +25,25 @@ module Decidim
     end
 
     def export
-      dirname = File.dirname(@path)
-      FileUtils.mkdir_p(dirname) unless File.directory?(dirname)
-      File.open(@path, "wb") do |file|
-        SevenZipRuby::Writer.open(file, password: @password) do |szw|
-          szw.header_encryption = true
-          szw.add_data(data, ZIP_FILE_NAME)
-        end
-      end
+      tmpdir = Dir.mktmpdir("temporary-download-your-data-dir")
+      user_data, user_attachments = data_and_attachments_for_user
+      save_user_data(tmpdir, user_data)
+      save_user_attachments(tmpdir, user_attachments)
+
+      SevenZipWrapper.compress_and_encrypt(filename: @path, password: @password, input_directory: tmpdir)
     end
 
     private
 
-    def data
-      buffer = Zip::OutputStream.write_buffer do |out|
-        user_data, attachments = data_for(@user, @export_format)
+    attr_reader :user, :export_format
 
-        add_user_data_to_zip_stream(out, user_data)
-        add_attachments_to_zip_stream(out, attachments)
-      end
-
-      buffer.string
-    end
-
-    def data_for(user, format)
+    def data_and_attachments_for_user
       export_data = []
       export_attachments = []
 
       download_your_data_entities.each do |object|
         klass = Object.const_get(object)
-        export_data << [klass.model_name.name.parameterize.pluralize, Exporters.find_exporter(format).new(klass.user_collection(user), klass.export_serializer).export]
+        export_data << [klass.model_name.name.parameterize.pluralize, Exporters.find_exporter(export_format).new(klass.user_collection(user), klass.export_serializer).export]
         attachments = klass.download_your_data_images(user)
         export_attachments << [klass.model_name.name.parameterize.pluralize, attachments.flatten] unless attachments.nil?
       end
@@ -69,5 +54,31 @@ module Decidim
     def download_your_data_entities
       @download_your_data_entities ||= DownloadYourDataSerializers.data_entities
     end
+
+    def save_user_data(tmpdir, user_data)
+      user_data.each do |entity, exporter_data|
+        next if exporter_data.read == "\n"
+
+        file_name = File.join(tmpdir, "#{entity}-#{exporter_data.filename}")
+        File.write(file_name, exporter_data.read)
+      end
+    end
+
+    def save_user_attachments(tmpdir, user_attachments)
+      user_attachments.each do |entity, attachment_block|
+        attachment_block.each do |attachment|
+          next unless attachment.attached?
+
+          blobs = attachment.is_a?(ActiveStorage::Attached::One) ? [attachment.blob] : attachment.blobs
+          blobs.each do |blob|
+            Dir.mkdir(File.join(tmpdir, entity.parameterize))
+            file_name = File.join(tmpdir, entity.parameterize, blob.filename.to_s)
+            blob.open do |blob_file|
+              File.write(file_name, blob_file.read.force_encoding("UTF-8"))
+            end
+          end
+        end
+      end
+    end
   end
 end

data/app/services/decidim/log/diff_changeset_calculator.rb

@@ -86,7 +86,7 @@ module Decidim
         locales.flat_map do |locale|
           previous_value = values.first.try(:[], locale)
           new_value = values.last.try(:[], locale)
-          if previous_value == new_value
+          if previous_value == new_value || (previous_value.nil? && new_value.blank?)
             nil
           else
             label = generate_label(attribute, locale)

data/app/services/decidim/open_data_exporter.rb

@@ -51,13 +51,14 @@ module Decidim
             headers.push(*exporter.headers)
             exported = exporter.export
 
-            tmpfile = Tempfile.new("#{export_manifest.name}-#{component.id}-")
-            tmpfile.write(exported.read)
-            # Do not delete the file when the reference is deleted
-            ObjectSpace.undefine_finalizer(tmpfile)
-            tmpfile.close
-
-            collection.push(tmpfile.path)
+            tmpdir = Dir::Tmpname.create(export_manifest.name.to_s) do
+              # just get an empty file name
+            end
+            filename = File.join(tmpdir, "#{component.id}.csv")
+            Dir.mkdir(tmpdir)
+            File.write(filename, exported.read)
+
+            collection.push(filename)
           end
         end
       end

data/app/views/decidim/account/show.html.erb

@@ -5,7 +5,7 @@
   <% if current_user.unconfirmed_email.present? %>
     <%# NOTE: announcement cell clean_body method will purge the button %>
     <div id="email-change-pending" class="flash secondary" data-announcement>
-      <span class="flash__message flex-none block leading-relaxed">
+      <div class="flash__message flex-none block leading-relaxed">
         <p>
           <strong><%= t("decidim.account.email_change.title") %></strong>
         </p>
@@ -18,7 +18,7 @@
             resend_link: link_to(t("decidim.account.email_change.send_again"), resend_confirmation_instructions_account_path, role: :button, method: :post, remote: true),
             cancel_link: link_to(t("decidim.account.email_change.cancel"), cancel_email_change_account_path, role: :button, method: :post, remote: true)) %>
         </p>
-      </span>
+      </div>
     </div>
   <% end %>
 

data/app/views/decidim/application/_document.html.erb

@@ -7,8 +7,8 @@
       <div class="card__list-text"><%= decidim_escape_translated(document.description) %></div>
     <% end %>
     <div class="card__list-metadata">
-      <span><%= icon "file-text-line" %><%= document.file_type %></span>
-      <span><%= icon "scales-2-line" %><%= number_to_human_size(document.file_size) %></span>
+      <div><%= icon "file-text-line" %><%= document.file_type %></div>
+      <div><%= icon "scales-2-line" %><%= number_to_human_size(document.file_size) %></div>
     </div>
   </div>
   <%= link_to document.url,

data/app/views/decidim/endorsements/update_buttons_and_counters.js.erb

@@ -1,5 +1,4 @@
 updateEndorsementBlock();
-
 function updateEndorsementBlock() {
   var $endorsementBlock = $('#resource-<%= resource.id %>-endorsement-block');
   var $endorsementListTrigger = $('#resource-<%= resource.id %>-endorsement-block #dropdown-trigger');
@@ -24,4 +23,6 @@ function updateEndorsementBlock() {
   } else {
     $endorsementIdentitiesButton[0].innerHTML = '<%= j(cell("decidim/endorsement_buttons", resource).button_content).strip.html_safe %>';
   }
+  document.dispatchEvent(new CustomEvent("ajax:loaded", { detail: $endorsementBlock[0] }));
+  document.dispatchEvent(new CustomEvent("ajax:loaded", { detail: $endorsementListGrid[0] }));
 }

data/app/views/decidim/gamification/badges/index.html.erb

@@ -1,40 +1,41 @@
-<div class="wrapper">
-  <div class="row column mb-m">
-    <h1><%= t ".title" %></h1>
-    <p>
-      <%= t ".page_description" %>
+<% add_decidim_meta_tags(
+  title: t(".title"),
+  description: t(".page_description")
+) %>
+
+<main class="layout-1col cols-10">
+
+  <header class="text-center py-10">
+    <h1 class="title-decorator inline-block text-left mb-12">
+      <%= t ".title" %>
+    </h1>
+    <p class="text-lg text-gray-2">
+    <%= t ".page_description" %>
     </p>
-  </div>
+  </header>
+
   <% @badges.each do |badge| %>
-    <div class="row column mb-m">
-      <div class="column medium-2">
-        <div class="card card--badge absolutes">
-          <div class="card__content">
-            <div class="card__header">
-              <div class="badge-container">
-                <%= image_tag badge.image %>
-              </div>
-            </div>
-            <div class="card__text text-center">
-              <strong><%= badge.translated_name %></strong>
-            </div>
+    <div class="mb-12">
+      <h2 class="h4 mb-4"><%= t ".badge_title", name: badge.translated_name %></h2>
+      <div class="grid grid-cols-10 text-gray-2 leading-relaxed">
+        <div class="col-span-2">
+          <div class="flex justify-center items-center">
+            <%= image_tag badge.image, class: "w-32", alt: badge.translated_name %>
+          </div>
+          <div class="text-center mt-4">
+            <strong><%= badge.translated_name %></strong>
           </div>
         </div>
-      </div>
-      <div class="column medium-10">
-        <h6>
-          <strong><%= t ".badge_title", name: badge.translated_name %></strong>
-        </h6>
-        <p><%= badge.description(current_organization.name) %></p>
-        <h6>
-          <strong><%= t ".how" %></strong>
-        </h6>
-        <ol>
-          <% badge.conditions.each do |condition| %>
-            <li><%= condition %></li>
-          <% end %>
-        </ol>
+        <div class="col-span-7 ml-2">
+          <p><%= badge.description(current_organization.name) %></p>
+          <p class="mt-4"><strong><%= t ".how" %></strong></p>
+          <ol class="list-decimal">
+            <% badge.conditions.each do |condition| %>
+              <li><%= condition %></li>
+            <% end %>
+          </ol>
+        </div>
       </div>
     </div>
   <% end %>
-</div>
+</main>

data/app/views/decidim/links/_modal.html.erb

@@ -16,6 +16,6 @@
     <button class="button button__lg button__transparent-secondary" data-dialog-close="external-domain-warning">
       <%= t("decidim.links.warning.cancel") %>
     </button>
-    <%= link_to t("decidim.links.warning.proceed"), external_url.to_s , target: "_blank", class: "button button__lg button__secondary" %>
+    <%= link_to t("decidim.links.warning.proceed"), external_url.to_s , target: "_blank", class: "button button__lg button__secondary", rel: "nofollow noopener noreferrer" %>
   </div>
 <% end %>