decidim-core 0.28.5 → 0.28.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 30504edbc5451f226b04213804ae8b02392132d8f66f9d5ebe9ea58ad264031e
-  data.tar.gz: 0ff217364122ef3812f7aa950e4908364126ceca46f135d0d5dc049b1ee19537
+  metadata.gz: 88c7b06f4bb2ad092e2e306434bd645d1f27f8e467bc34ab341093f1213ef70b
+  data.tar.gz: 45be0ca0bc0b4f11581b1e12c931cbc1c9a80a321ed9c7e1822bc79ff7d9d59f
 SHA512:
-  metadata.gz: 897aec8c06d1dd2110a5bd880e07061cab5e12495b707ed175afa81468c5ac162cf3d7a6643879eab83a82a9ca76232ff82dcb0d9b29ccf277d328fec6539a35
-  data.tar.gz: 88e9607861160a270e3604733a323fc2b1d359779c335ff8ccce97c9e587062c9c916d07682ad0ddda2b50abe2f718d3ce4baeb5bf77cbf3aab77ea231160014
+  metadata.gz: 79b66628f6569dd4f570d3388bf185583b5d9fe1edee9545da9948cb8371e9b7722edd651db0805a73aeeb272e8b8c2df4c55b07b9237da062761992e43e8c13
+  data.tar.gz: 969da677904a158b3b7744f58a834162dbc10c6b8d94a609aac305744a6c061b439117793d52d964edcbbfe656476239651ac0d6dc34d32c22fc3da79f0b32b6

data/app/cells/decidim/participatory_space_dropdown_metadata/show.erb

@@ -3,7 +3,9 @@
     <%= render :metadata %>
     <%= cell "decidim/content_blocks/menu_breadcrumb_last_activity", model, hide_participatory_space: true %>
   </div>
-  <ul class="menu-bar__secondary-dropdown__menu">
-    <%= render :links %>
-  </ul>
+  <nav role="navigation" aria-label="<%= t("decidim.accessibility.secondary_menu") %>">
+    <ul class="menu-bar__secondary-dropdown__menu">
+      <%= render :links %>
+    </ul>
+  </nav>
 </div>

data/app/cells/decidim/resource_types_filter/show.erb

@@ -11,7 +11,7 @@
   <ul id="dropdown-menu-resource">
     <% resource_types.each do |resource_type| %>
       <li role="menuitem">
-        <%= link_to decidim.last_activities_path(filter: { with_resource_type: resource_type[0] } ), class: "filter#{" is-active" if filter_param == resource_type[0]}" do %>
+        <%= link_to filter_url(resource_type[0]), class: "filter#{" is-active" if filter_param == resource_type[0]}" do %>
           <span class="sr-only"><%= resource_type[1] %></span>
           <%= text_with_resource_icon(*resource_type) %>
         <% end %>

data/app/cells/decidim/resource_types_filter_cell.rb

@@ -29,8 +29,12 @@ module Decidim
       options[:id] || "filters"
     end
 
-    def form_path
-      options[:form_path]
+    def filter_url(resource_type)
+      if options[:source] == :last_activities
+        last_activities_path(filter: { with_resource_type: resource_type })
+      else
+        profile_activity_path(nickname: params[:nickname], filter: { resource_type: })
+      end
     end
 
     def filter_param_key
@@ -41,10 +45,6 @@ module Decidim
       @filter_param ||= params.dig(:filter, filter_param_key) || all_types_key
     end
 
-    def filter
-      options[:filter]
-    end
-
     def all_resource_types_option
       [all_types_key, I18n.t("all", scope: "decidim.last_activities")]
     end

data/app/cells/decidim/user_activity/show.erb

@@ -1,5 +1,5 @@
 <div class="profile__activity">
-  <%= cell "decidim/resource_types_filter", resource_types, form_path: url_for, filter: %>
+  <%= cell "decidim/resource_types_filter", resource_types, source: :profile_activity %>
   <div class="profile__activity__container" id="activities-container">
     <% if activities.length == 0 %>
       <%= cell "decidim/announcement", t("decidim.user_activity.index.no_activities_warning") %>

data/app/commands/decidim/create_omniauth_registration.rb

@@ -45,6 +45,8 @@ module Decidim
 
     attr_reader :form, :verified_email
 
+    REGEXP_SANITIZER = /[<>?%&\^*#@()\[\]=+:;"{}\\|]/
+
     def create_or_find_user
       @user = User.find_or_initialize_by(
         email: verified_email,
@@ -63,16 +65,11 @@ module Decidim
         @user.save!
       else
         @user.email = (verified_email || form.email)
-        @user.name = form.name
+        @user.name = form.name.gsub(REGEXP_SANITIZER, "")
         @user.nickname = form.normalized_nickname
         @user.newsletter_notifications_at = nil
         @user.password = SecureRandom.hex
-        if form.avatar_url.present?
-          url = URI.parse(form.avatar_url)
-          filename = File.basename(url.path)
-          file = url.open
-          @user.avatar.attach(io: file, filename:)
-        end
+        attach_avatar(form.avatar_url) if form.avatar_url.present?
         @user.skip_confirmation! if verified_email
         @user.tos_agreement = "1"
         @user.save!
@@ -81,6 +78,15 @@ module Decidim
       end
     end
 
+    def attach_avatar(avatar_url)
+      url = URI.parse(avatar_url)
+      filename = File.basename(url.path)
+      file = url.open
+      @user.avatar.attach(io: file, filename:)
+    rescue OpenURI::HTTPError, Errno::ECONNREFUSED
+      # Do not attach the avatar, as it fails to fetch it.
+    end
+
     def create_identity
       @user.identities.create!(
         provider: form.provider,
@@ -126,7 +132,7 @@ module Decidim
         provider: form.provider,
         uid: form.uid,
         email: form.email,
-        name: form.name,
+        name: form.name.gsub(REGEXP_SANITIZER, ""),
         nickname: form.normalized_nickname,
         avatar_url: form.avatar_url,
         raw_data: form.raw_data

data/app/commands/decidim/search.rb

@@ -37,6 +37,12 @@ module Decidim
                     klass.order_by_id_list(result_ids.take(HIGHLIGHTED_RESULTS_COUNT))
                   end
 
+        uncommentable_resources = uncommentable_resources(results) if results.present?
+        if uncommentable_resources.present?
+          results -= uncommentable_resources
+          results_count -= uncommentable_resources.count
+        end
+
         results_by_type.update(class_name => {
                                  count: results_count,
                                  results:
@@ -89,5 +95,13 @@ module Decidim
       query = query.global_search(I18n.transliterate(term)) if term.present?
       query
     end
+
+    def uncommentable_resources(results)
+      results.where(id: results.select { |obj| related_uncommentable_resources?(obj) }.map(&:id))
+    end
+
+    def related_uncommentable_resources?(object)
+      object.respond_to?(:commentable) && !object.commentable.commentable?
+    end
   end
 end

data/app/controllers/decidim/profiles_controller.rb

@@ -24,7 +24,7 @@ module Decidim
     def show
       return redirect_to profile_members_path if profile_holder.is_a?(Decidim::UserGroup)
 
-      redirect_to profile_activity_path(nickname: params[:nickname])
+      redirect_to profile_activity_path(nickname: params[:nickname].downcase)
     end
 
     def tooltip
@@ -116,7 +116,7 @@ module Decidim
     def profile_holder
       return if params[:nickname].blank?
 
-      @profile_holder ||= Decidim::UserBaseEntity.find_by("LOWER(nickname) = ? AND decidim_organization_id = ?", params[:nickname].downcase, current_organization.id)
+      @profile_holder ||= Decidim::UserBaseEntity.find_by("nickname = ? AND decidim_organization_id = ?", params[:nickname].downcase, current_organization.id)
     end
   end
 end

data/app/controllers/decidim/reports_controller.rb

@@ -16,7 +16,7 @@ module Decidim
       CreateReport.call(@form, reportable, current_user) do
         on(:ok) do
           flash[:notice] = I18n.t("decidim.reports.create.success")
-          redirect_back fallback_location: root_path
+          redirect_to reportable.reload.reported_content_url
         end
 
         on(:invalid) do

data/app/controllers/decidim/user_activities_controller.rb

@@ -22,7 +22,7 @@ module Decidim
     def user
       return unless params[:nickname]
 
-      @user ||= current_organization.users.find_by("LOWER(nickname) = ?", params[:nickname].downcase)
+      @user ||= current_organization.users.find_by("nickname = ?", params[:nickname].downcase)
     end
 
     def activities

data/app/forms/decidim/account_form.rb

@@ -21,7 +21,10 @@ module Decidim
 
     validates :name, presence: true, format: { with: Decidim::User::REGEXP_NAME }
     validates :email, presence: true, "valid_email_2/email": { disposable: true }
-    validates :nickname, presence: true, format: { with: Decidim::User::REGEXP_NICKNAME }
+    validates :nickname,
+              presence: true,
+              format: { with: Decidim::User::REGEXP_NICKNAME, message: :format },
+              length: { maximum: Decidim::User.nickname_max_length }
 
     validates :nickname, length: { maximum: Decidim::User.nickname_max_length, allow_blank: true }
     validates :password, password: { name: :name, email: :email, username: :nickname }, if: -> { password.present? }
@@ -66,7 +69,7 @@ module Decidim
 
     def unique_nickname
       return true if Decidim::UserBaseEntity.where(
-        "decidim_organization_id = ? AND LOWER(nickname) = ? ",
+        "decidim_organization_id = ? AND nickname = ? ",
         context.current_organization.id,
         nickname.downcase
       ).where.not(id: context.current_user.id).empty?

data/app/helpers/decidim/orders_helper.rb

@@ -13,7 +13,8 @@ module Decidim
     def order_selector(orders, options = {})
       render partial: "decidim/shared/orders", locals: {
         orders:,
-        i18n_scope: options[:i18n_scope]
+        i18n_scope: options[:i18n_scope],
+        css_class: options[:css_class]
       }
     end
 

data/app/helpers/decidim/participatory_space_helpers.rb

@@ -28,7 +28,7 @@ module Decidim
     end
 
     def participatory_space_floating_help
-      return if help_section.blank?
+      return if help_section.blank? || strip_tags(translated_attribute(help_section).html_safe).blank?
 
       floating_help(help_id) { translated_attribute(help_section).html_safe }
     end

data/app/models/decidim/user.rb

@@ -13,8 +13,6 @@ module Decidim
     include Decidim::UserReportable
     include Decidim::Traceable
 
-    REGEXP_NICKNAME = /\A[\w-]+\z/
-
     class Roles
       def self.all
         Decidim.config.user_roles
@@ -51,8 +49,6 @@ module Decidim
 
     has_one_attached :download_your_data_file
 
-    scope :not_deleted, -> { where(deleted_at: nil) }
-
     scope :managed, -> { where(managed: true) }
     scope :not_managed, -> { where(managed: false) }
 

data/app/models/decidim/user_base_entity.rb

@@ -21,11 +21,13 @@ module Decidim
 
     # Regex for name & nickname format validations
     REGEXP_NAME = /\A(?!.*[<>?%&\^*#@()\[\]=+:;"{}\\|])/
+    REGEXP_NICKNAME = /\A[a-z0-9_-]+\z/
 
     has_one_attached :avatar
     validates_avatar :avatar, uploader: Decidim::AvatarUploader
 
     validates :name, format: { with: REGEXP_NAME }
+    validates :nickname, format: { with: REGEXP_NICKNAME }, unless: -> { deleted? || managed? }
 
     scope :confirmed, -> { where.not(confirmed_at: nil) }
     scope :not_confirmed, -> { where(confirmed_at: nil) }
@@ -34,6 +36,8 @@ module Decidim
     scope :not_blocked, -> { where(blocked: false) }
     scope :available, -> { where(deleted_at: nil, blocked: false, managed: false) }
 
+    scope :not_deleted, -> { where(deleted_at: nil) }
+
     # Public: Returns a collection with all the public entities this user is following.
     #
     # This cannot be done as with a `has_many :following, through: :following_follows`

data/app/packs/src/decidim/index.js

@@ -68,7 +68,8 @@ import markAsReadNotifications from "src/decidim/notifications"
 import RemoteModal from "src/decidim/remote_modal"
 import selectActiveIdentity from "src/decidim/identity_selector_dialog"
 import createTooltip from "src/decidim/tooltips"
-import fetchRemoteTooltip from "src/decidim/remote_tooltips"
+// Temporary disabling this feature because we have a poor performance. See https://github.com/decidim/decidim/issues/14431
+// import fetchRemoteTooltip from "src/decidim/remote_tooltips"
 import createToggle from "src/decidim/toggle"
 import {
   createAccordion,
@@ -190,7 +191,8 @@ const initializer = (element = document) => {
   // Initialize data-toggles
   element.querySelectorAll("[data-toggle]").forEach((elem) => createToggle(elem))
 
-  element.querySelectorAll("[data-remote-tooltip]").forEach((elem) => fetchRemoteTooltip(elem))
+  // Temporary disabling this feature because we have a poor performance. See https://github.com/decidim/decidim/issues/14431
+  // element.querySelectorAll("[data-remote-tooltip]").forEach((elem) => fetchRemoteTooltip(elem))
 
   element.querySelectorAll(".new_report").forEach((elem) => changeReportFormBehavior(elem))
 }

data/app/packs/src/decidim/map/provider/here.js

@@ -1,5 +1,5 @@
 import "leaflet"
-import "src/decidim/vendor/leaflet-tilelayer-here"
+import "leaflet-tilelayer-here"
 
 /**
  * NOTE:

data/app/packs/stylesheets/decidim/_hashtags.scss

@@ -0,0 +1,5 @@
+.hashtags {
+  > label {
+    @apply ml-4;
+  }
+}

data/app/packs/stylesheets/decidim/_header.scss

@@ -81,7 +81,7 @@ header {
       @apply fixed bottom-0 left-0 z-40 bg-white w-full px-4 py-3 flex justify-between text-secondary shadow-[0_-4px_6px_rgba(198,198,198,0.25)];
 
       &__trigger {
-        @apply flex flex-col items-center text-secondary cursor-pointer p-2;
+        @apply flex flex-col items-center text-secondary cursor-pointer md:pl-4 md:border-l border-gray-3;
 
         svg {
           @apply w-5 h-5 fill-current;
@@ -140,6 +140,20 @@ header {
         }
       }
 
+      &__login {
+        @apply w-auto h-full flex flex-row items-center relative text-secondary gap-1 pl-2 pr-2;
+
+        svg {
+          @apply w-8 h-8 fill-current;
+        }
+
+        svg + span {
+          @apply text-sm first-letter:uppercase w-auto;
+
+          flex-shrink: 0;
+        }
+      }
+
       &__item {
         @apply w-1/4 flex flex-col items-center relative;
 
@@ -412,8 +426,12 @@ header {
         @apply h4 md:h3;
       }
 
+      nav {
+        @apply w-full md:w-1/4;
+      }
+
       &__menu {
-        @apply w-full md:w-1/4 bg-primary px-4 md:px-8 pt-0 pb-3 md:py-3 divide-y divide-gray-3 text-white;
+        @apply w-full bg-primary px-4 md:px-8 pt-0 pb-3 md:py-3 divide-y divide-gray-3 text-white;
 
         > * {
           @apply py-3 md:py-3.5;

data/app/packs/stylesheets/decidim/application.scss

@@ -57,6 +57,7 @@
   @import "stylesheets/decidim/_toggle_switch.scss";
   @import "stylesheets/decidim/_hero.scss";
   @import "stylesheets/decidim/_actions.scss";
+  @import "stylesheets/decidim/_hashtags.scss";
 }
 
 // On the other hand, the following styles match with specific routes

data/app/presenters/decidim/log/user_presenter.rb

@@ -46,6 +46,7 @@ module Decidim
       # Returns an HTML-safe String.
       def present_user
         return h.content_tag(:span, present_user_name, class: "logs__log__author") if user.blank?
+        return I18n.t("decidim.profile.deleted") if user.respond_to?(:deleted?) && user.deleted?
 
         h.link_to(
           present_user_name,

data/app/services/decidim/base_diff_renderer.rb

@@ -41,6 +41,8 @@ module Decidim
     end
 
     def parse_i18n_changeset(attribute, values, type, diff)
+      return diff unless values.last.is_a?(Hash)
+
       (values.last.keys - ["machine_translations"]).each do |locale, _value|
         first_value = values.first.try(:[], locale)
         last_value = values.last.try(:[], locale)

data/app/services/decidim/static_map_generator.rb

@@ -15,7 +15,7 @@ module Decidim
     def data
       return if @resource.blank? || map_utility.nil?
 
-      Rails.cache.fetch(@resource.cache_key) do
+      Rails.cache.fetch(@resource.cache_key_with_version) do
         map_utility.image_data(
           latitude: @resource.latitude,
           longitude: @resource.longitude,

data/app/views/decidim/last_activities/index.html.erb

@@ -5,7 +5,7 @@
   <h1 class="title-decorator my-12"><%= t("last_activity", scope: "decidim.last_activities.index") %></h1>
 
   <div class="profile__activity pb-16">
-    <%= cell "decidim/resource_types_filter", resource_types, form_path: last_activities_path, filter_param_key: :with_resource_type, filter: %>
+    <%= cell "decidim/resource_types_filter", resource_types, source: :last_activities, filter_param_key: :with_resource_type %>
     <div id="activities">
       <%= render partial: "activities" %>
     </div>

data/app/views/decidim/reported_mailer/hide.html.erb

@@ -1,7 +1,7 @@
 <p class="email-greeting"><%= t(".hello", name: @user.name) %></p>
 
 <p class="email-instructions">
-  <%= t(".report_html", url: reported_content_url ) %>
+  <%= t(".report_html", url: report_url ) %>
 </p>
 
 <p class="email-button email-button__cta">

data/app/views/decidim/reported_mailer/report.html.erb

@@ -1,7 +1,7 @@
 <p class="email-greeting"><%= t(".hello", name: @user.name) %></p>
 
 <p class="email-instructions">
-  <%= t(".report_html", url: reported_content_url) %>
+  <%= t(".report_html", url: report_url) %>
 </p>
 
 <br>

data/app/views/decidim/searches/_count.html.erb

@@ -15,6 +15,6 @@
   <% end %>
 </div>
 
-<h1 class="h3 decorator mb-10 md:my-10">
+<h1 id="search-results-title" class="h3 decorator mb-10 md:my-10">
   <%= t("decidim.search.results_found_for_term", count: @results_count, term:) %>
 </h1>

data/app/views/decidim/searches/_filters.html.erb

@@ -1,44 +1,46 @@
-<div class="filter-container search__filter">
-  <button id="dropdown-trigger-search" data-component="dropdown" data-target="dropdown-menu-search" data-auto-close="true">
-    <%= content_tag :span, t("decidim.searches.filters_small_view.filter_by"), class: "#{"is-active" if params.dig(:filter, :with_resource_type) == nil}" %>
-    <% @blocks.each do |elements| %>
-      <% elements.each do |type, results| %>
-        <%= content_tag :span, class: "#{"is-active" if params.dig(:filter, :with_resource_type) == type}" do %>
-          <span><%= searchable_resource_human_name(type) %></span>
+<nav role="navigation" aria-labelledby="search-results-title">
+  <div class="filter-container search__filter">
+    <button id="dropdown-trigger-search" data-component="dropdown" data-target="dropdown-menu-search" data-auto-close="true">
+      <%= content_tag :span, t("decidim.searches.filters_small_view.filter_by"), class: "#{"is-active" if params.dig(:filter, :with_resource_type) == nil}" %>
+      <% @blocks.each do |elements| %>
+        <% elements.each do |type, results| %>
+          <%= content_tag :span, class: "#{"is-active" if params.dig(:filter, :with_resource_type) == type}" do %>
+            <span><%= searchable_resource_human_name(type) %></span>
+          <% end %>
         <% end %>
       <% end %>
-    <% end %>
-    <%= icon "arrow-down-s-line", class: "w-8 h-8 flex-none text-secondary fill-current" %>
-    <%= icon "arrow-up-s-line", class: "w-8 h-8 flex-none text-secondary fill-current" %>
-  </button>
-  <div id="dropdown-menu-search" aria-hidden="true">
-    <div>
-      <%= link_to main_search_path, class: "filter#{" is-active" if params.dig(:filter, :with_resource_type) == nil}" do %>
-        <%= resource_type_icon("all") %>
-        <span><%= t("all", scope: "decidim.searches.filters.state") %></span>
-        <span class="label ml-auto"><%= @results_count %></span>
-      <% end %>
-    </div>
-    <% @blocks.each do |elements| %>
+      <%= icon "arrow-down-s-line", class: "w-8 h-8 flex-none text-secondary fill-current" %>
+      <%= icon "arrow-up-s-line", class: "w-8 h-8 flex-none text-secondary fill-current" %>
+    </button>
+    <div id="dropdown-menu-search" aria-hidden="true">
       <div>
-        <% elements.each do |type, results| %>
-          <div>
-            <% if results[:count].positive? %>
-              <%= link_to search_path_by_resource_type(type), class: "filter#{" is-active" if params.dig(:filter, :with_resource_type) == type}" do %>
-                <%= resource_type_icon(type) %>
-                <span><%= searchable_resource_human_name(type) %></span>
-                <span class="label ml-auto"><%= results[:count] %></span>
-              <% end %>
-            <% else %>
-              <%= content_tag :div, class: "filter#{" is-empty" if results[:count].zero?}" do %>
-                <%= resource_type_icon(type) %>
-                <span><%= searchable_resource_human_name(type) %></span>
-                <span class="label ml-auto"><%= results[:count] %></span>
-              <% end %>
-            <% end %>
-          </div>
+        <%= link_to main_search_path, class: "filter#{" is-active" if params.dig(:filter, :with_resource_type) == nil}" do %>
+          <%= resource_type_icon("all") %>
+          <span><%= t("all", scope: "decidim.searches.filters.state") %></span>
+          <span class="label ml-auto"><%= @results_count %></span>
         <% end %>
       </div>
-    <% end %>
+      <% @blocks.each do |elements| %>
+        <div>
+          <% elements.each do |type, results| %>
+            <div>
+              <% if results[:count].positive? %>
+                <%= link_to search_path_by_resource_type(type), class: "filter#{" is-active" if params.dig(:filter, :with_resource_type) == type}" do %>
+                  <%= resource_type_icon(type) %>
+                  <span><%= searchable_resource_human_name(type) %></span>
+                  <span class="label ml-auto"><%= results[:count] %></span>
+                <% end %>
+              <% else %>
+                <%= content_tag :div, class: "filter#{" is-empty" if results[:count].zero?}" do %>
+                  <%= resource_type_icon(type) %>
+                  <span><%= searchable_resource_human_name(type) %></span>
+                  <span class="label ml-auto"><%= results[:count] %></span>
+                <% end %>
+              <% end %>
+            </div>
+          <% end %>
+        </div>
+      <% end %>
+    </div>
   </div>
-</div>
+</nav>

data/app/views/decidim/shared/_orders.html.erb

@@ -1,9 +1,9 @@
-<button class="order-by__button" id="dropdown-trigger-order" data-component="dropdown" data-target="dropdown-menu-order" data-open-md="true">
+<button class="order-by__button <%= b_css_class if defined?(b_css_class) %>" id="dropdown-trigger-order" data-component="dropdown" data-target="dropdown-menu-order" data-open-md="true">
   <%= icon "arrow-down-s-line" %>
   <%= icon "arrow-up-s-line" %>
   <span><%= t("#{i18n_scope}.label") %></span>
 </button>
-<div id="dropdown-menu-order" class="order-by">
+<div id="dropdown-menu-order" class="order-by <%= css_class if defined?(css_class) %>">
   <% orders.each do |order_name| %>
     <%= order_link order_name,
                    i18n_scope:,