decidim-core 0.30.6 → 0.30.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1d2d2e573802976d0b68a5ec56528a5ba499416c443101bba31fee2d2f1af9e6
-  data.tar.gz: f172339288312c74d88a376805b12eed9aea1ea97c7e049978c3d94a4ab99f38
+  metadata.gz: b31c19b0f1263634559541d974f68dba477328f79a493ab4188eb3d8cb42a0eb
+  data.tar.gz: a9d06e9ea81dfe61b62c9f99961a4284af380a5343a12ce5c7ca7b055f4041b8
 SHA512:
-  metadata.gz: eb126980873b650eaa4c89d208bbd0d266df4da01196f60621211e896501e615329f1e35e34251c66f8e7f67b71d4df6cfaefe38eb4343f69d7d65437b62f51e
-  data.tar.gz: 3204e02c1097ee49b967bfd558fd51b32f3faa6d3ee9352590e6c98c0020c86590c383756b0b5694c97fe3e4b6689fcbecb422e15b2bae929656533a5908af9b
+  metadata.gz: 4c821103cefa1cfc8c3688fe69dce51bd2e6c94a448bee4fdc05ef5abd08e522cc4785e0827217b464b9b4a601cb52daa8539b21b0bf98f39e69fdff1b5824a5
+  data.tar.gz: 9c27f4b8ce372ac3295e719a3985b7276ec91d90303b4e627545d4571012936d3d4f1694c6e81e4df95fac154bbb2aaa3889130b9ffcfc609a1b2a40a699a99f

data/app/cells/decidim/content_blocks/highlighted_elements_with_cell_for_list_cell.rb

@@ -19,10 +19,14 @@ module Decidim
         @list_cell ||= cell(
           list_cell_path,
           published_components.one? ? published_components.first : published_components,
-          **model.settings.to_h, see_all_path:
+          **model.settings.to_h, **extra_list_cell_options, see_all_path:
         )
       end
 
+      def extra_list_cell_options
+        {}
+      end
+
       def see_all_path; end
     end
   end

data/app/cells/decidim/content_blocks/participatory_space_metadata/content.erb

@@ -2,9 +2,9 @@
   <% metadata_valued_items.each do |item| %>
     <div class="participatory-space__metadata-item">
       <div class="participatory-space__metadata-item-title">
-        <span><%= item[:title] %></span>
+        <p><%= item[:title] %></p>
       </div>
-      <span><%= item[:value] %></span>
+      <p><%= item[:value] %></p>
     </div>
   <% end %>
 </div>

data/app/cells/decidim/report_button/already_reported_modal.erb

@@ -1,7 +1,7 @@
 <%= decidim_modal id: modal_id, class: "flag-modal" do %>
   <div data-dialog-container>
     <%= icon "flag-line" %>
-    <h2 tabindex="-1" data-dialog-title><%= t("decidim.shared.flag_modal.title") %></h2>
+    <h2 id="dialog-title-<%= modal_id %>" tabindex="-1" data-dialog-title><%= t("decidim.shared.flag_modal.title") %></h2>
     <div>
       <div class="form__wrapper flag-modal__form">
         <p class="flag-modal__form-description"><%= t("decidim.shared.flag_modal.already_reported") %></p>

data/app/cells/decidim/report_button/flag_modal.erb

@@ -2,7 +2,7 @@
   <%= form_for report_form, builder:, url: report_path, method: :post, html: { id: nil } do |f| %>
     <div data-dialog-container>
       <%= icon "flag-line" %>
-      <h2 tabindex="-1" data-dialog-title><%= t("decidim.shared.flag_modal.title") %></h2>
+      <h2 id="dialog-title-<%= modal_id %>" tabindex="-1" data-dialog-title><%= t("decidim.shared.flag_modal.title") %></h2>
       <div>
         <div class="form__wrapper flag-modal__form">
           <p id="dialog-desc-<%= modal_id %>" class="flag-modal__form-description"><%= t("decidim.shared.flag_modal.description") %></p>

data/app/cells/decidim/report_user_button/already_reported_modal.erb

@@ -1,7 +1,7 @@
 <%= decidim_modal id: modal_id, class: "flag-user-modal" do %>
   <div data-dialog-container>
     <%= icon "flag-line" %>
-    <h2 tabindex="-1" data-dialog-title><%= t("decidim.shared.flag_user_modal.title") %></h2>
+    <h2 id="dialog-title-<%= modal_id %>" tabindex="-1" data-dialog-title><%= t("decidim.shared.flag_user_modal.title") %></h2>
     <div>
       <div class="form__wrapper flag-modal__form">
         <p class="flag-modal__form-description"><%= t("decidim.shared.flag_user_modal.already_reported") %></p>

data/app/cells/decidim/report_user_button/flag_modal.erb

@@ -2,7 +2,7 @@
   <%= form_for report_form, builder:, url: report_path, method: :post, html: { id: nil } do |f| %>
     <div data-dialog-container>
       <%= icon "flag-line" %>
-      <h2 tabindex="-1" data-dialog-title><%= t("decidim.shared.flag_user_modal.title") %></h2>
+      <h2 id="dialog-title-<%= modal_id %>" tabindex="-1" data-dialog-title><%= t("decidim.shared.flag_user_modal.title") %></h2>
       <div>
         <div class="form__wrapper flag-modal__form">
           <p class="flag-modal__form-description"><%= t("decidim.shared.flag_user_modal.description") %></p>

data/app/cells/decidim/statistic/show.erb

@@ -1,8 +1,8 @@
 <div class="statistic <%= stat_dom_class %>" data-statistic>
-  <span class="statistic__title" title="<%= stat_title %>">
+  <p class="statistic__title" title="<%= stat_title %>">
     <%= stat_title %>
-  </span>
-  <span class="statistic__number">
+  </p>
+  <p class="statistic__number">
     <%= stat_number %>
-  </span>
+  </p>
 </div>

data/app/cells/decidim/upload_modal/files.erb

@@ -1,9 +1,9 @@
 <div class="upload-modal__files-container upload-container-for-<%= attribute %> <%= with_title %>">
   <div>
-    <%= label %>
+    <%= options[:paragraph] == true ? paragraph : label %>
 
     <% if options[:help_text].present? %>
-      <span class="help-text"><%= options[:help_text] %></span>
+      <p class="help-text"><%= options[:help_text] %></p>
     <% end %>
 
     <%# NOTE: this block is about wrapping a default image for the avatar with the new styles,
@@ -33,16 +33,20 @@
           <% end %>
 
           <% if has_title? %>
-            <span><%= title_for(attachment) %></span>
+            <p><%= title_for(attachment) %></p>
           <% else %>
             <% if attachment_blob&.image? %>
-              <span><%= title_for(attachment) %></span>
+              <p><%= title_for(attachment) %></p>
             <% else %>
               <%= link_to title_for(attachment), file_attachment_path(attachment), class: "w-full break-all mb-2" %>
             <% end %>
           <% end %>
           <% if attachment_blob.present? %>
-            <%= form.hidden_field attribute, value: attachment_blob.signed_id, id: "hidden_#{attribute}_#{attachment_blob.id}" %>
+            <% if is_persisted_attachment %>
+              <%= form.hidden_field attribute, value: attachment.id, id: "hidden_#{attribute}_#{attachment.id}" %>
+            <% else %>
+              <%= form.hidden_field attribute, value: attachment_blob.signed_id, id: "hidden_#{attribute}_#{attachment_blob.id}" %>
+            <% end %>
           <% end %>
         </div>
       <% end %>

data/app/cells/decidim/upload_modal_cell.rb

@@ -30,6 +30,10 @@ module Decidim
       form.send(:custom_label, attribute, options[:label], { required: required?, for: nil })
     end
 
+    def paragraph
+      form.send(:custom_paragraph, attribute, options[:label], { required: required? })
+    end
+
     def button_label
       return button_edit_label if attachments.count.positive?
 
@@ -124,7 +128,16 @@ module Decidim
       @attachments = begin
         attachments = options[:attachments] || form.object.send(attribute)
         attachments = Array(attachments).compact_blank
-        attachments.map { |attachment| attachment.is_a?(String) ? ActiveStorage::Blob.find_signed(attachment) : attachment }
+        attachments.map do |attachment|
+          case attachment
+          when String
+            ActiveStorage::Blob.find_signed(attachment)
+          when Integer
+            Decidim::Attachment.find_by(id: attachment)
+          else
+            attachment
+          end
+        end.compact
       end
     end
 

data/app/commands/decidim/multiple_attachments_methods.rb

@@ -41,8 +41,9 @@ module Decidim
 
     def create_attachments(first_weight: 0)
       weight = first_weight
-      # Add the weights first to the old document
-      @form.documents.each do |document|
+      # Add the weights first to the old documents
+      document_ids = keep_ids
+      Decidim::Attachment.where(id: document_ids).each do |document|
         document.update!(weight:)
         weight += 1
       end
@@ -59,7 +60,7 @@ module Decidim
       documents = include_all_attachments ? documents_attached_to.attachments.with_attached_file : documents_attached_to.documents
 
       documents.each do |document|
-        document.destroy! if @form.documents.map(&:id).exclude? document.id
+        document.destroy! unless keep_ids.include?(document.id)
       end
 
       documents_attached_to.reload
@@ -98,5 +99,21 @@ module Decidim
     def blob(signed_id)
       ActiveStorage::Blob.find_signed(signed_id)
     end
+
+    def keep_ids
+      documents_array = Array(@form.documents)
+      documents_array.map do |doc|
+        case doc
+        when Decidim::Attachment
+          doc.id
+        when Integer
+          doc
+        when String
+          doc.match?(/\A\d+\z/) ? doc.to_i : nil
+        when Hash
+          (doc[:id] || doc["id"]).to_i
+        end
+      end.compact
+    end
   end
 end

data/app/helpers/decidim/mailer_helper.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+module Decidim
+  # Helper that provides methods to render order selector and links
+  module MailerHelper
+    # Transforms relative image URLs in HTML content to absolute URLs using the provided host.
+    # This is used in emails (newsletters and notifications) to ensure images display correctly
+    # in email clients.
+    #
+    # @param content [String] - HTML content with img tags
+    # @param host [String] - the Decidim::Organization host to use for the root URL
+    #
+    # @return [String] - the content with transformed image URLs
+    def decidim_transform_image_urls(content, host)
+      return content if host.blank? || content.blank?
+
+      root_url = if Rails.application.secrets.dig(:storage, :cdn_host).present?
+                   Rails.application.secrets.dig(:storage, :cdn_host).chomp("/")
+                 else
+                   Decidim::EngineRouter.new("decidim", {}).root_url(host:).chomp("/")
+                 end
+
+      content.gsub(/src\s*=\s*(['"])([^'"]*)\1/) do
+        quote = Regexp.last_match(1)
+        src_value = Regexp.last_match(2)
+
+        if src_value.blank? || src_value.start_with?("http://", "https://", "data:", "//", "cid:")
+          %(src=#{quote}#{src_value}#{quote})
+        else
+          normalized_src = src_value.start_with?("/") ? src_value : "/#{src_value}"
+          %(src=#{quote}#{root_url}#{normalized_src}#{quote})
+        end
+      end
+    end
+  end
+end

data/app/helpers/decidim/menu_helper.rb

@@ -57,7 +57,8 @@ module Decidim
         self,
         element_class: "font-semibold underline",
         active_class: "is-active",
-        container_options: { class: "space-y-4 break-inside-avoid", role: :menu },
+        role: false,
+        container_options: { class: "space-y-4 break-inside-avoid" },
         label: t("layouts.decidim.footer.decidim_title")
       )
     end

data/app/helpers/decidim/newsletters_helper.rb

@@ -3,6 +3,9 @@
 module Decidim
   # Helper that provides methods to render links with utm codes, and replaced name
   module NewslettersHelper
+    include Decidim::SanitizeHelper
+    include Decidim::MailerHelper
+
     # If the newsletter body there are some links and the Decidim.track_newsletter_links = true
     # it will be replaced with the utm_codes method described below.
     # for example transform "https://es.lipsum.com/" to "https://es.lipsum.com/?utm_source=localhost&utm_campaign=newsletter_11"
@@ -19,7 +22,7 @@ module Decidim
 
       content = interpret_name(content, user)
       content = track_newsletter_links(content, id, host)
-      transform_image_urls(content, host)
+      decidim_transform_image_urls(content, host)
     end
 
     # this method is used to generate the root link on mail with the utm_codes
@@ -67,27 +70,6 @@ module Decidim
       content.gsub("%{name}", user.name)
     end
 
-    # Find each img HTML tag with relative path in src attribute
-    # For each URL, prepends the decidim.root_url
-    #   If host is not defined it returns full content
-    #
-    # @param content [String] - the string to convert
-    # @param host [String] - the Decidim::Organization host to replace
-    #
-    # @return [String] - the content converted
-    #
-    def transform_image_urls(content, host)
-      return content if host.blank?
-
-      content.scan(/src\s*=\s*"([^"]*)"/).each do |src|
-        root_url = decidim.root_url(host:)[0..-2]
-        src_replaced = "#{root_url}#{src.first}"
-        content = content.gsub(/src\s*=\s*"([^"]*#{src.first})"/, %(src="#{src_replaced}"))
-      end
-
-      content
-    end
-
     # Add tracking query params to each links
     #
     # @param content [String] - the string to convert

data/app/jobs/decidim/find_and_update_descendants_job.rb

@@ -4,8 +4,14 @@ module Decidim
   # Update search indexes for each descendants of a given element
   class FindAndUpdateDescendantsJob < ApplicationJob
     queue_as :default
+    MAX_DEPTH = 5
+
+    def perform(element, current_depth = 0)
+      if current_depth >= MAX_DEPTH
+        Rails.logger.warn "Max depth of #{MAX_DEPTH} reached for element #{element.class.name} with id #{element.id}. Stopping recursion."
+        return
+      end
 
-    def perform(element)
       descendants_collector = components_for(element)
       descendants_collector << element.comments.to_a if element.respond_to?(:comments)
 
@@ -14,7 +20,7 @@ module Decidim
       descendants_collector.each do |descendants|
         next if descendants.blank?
 
-        Decidim::UpdateSearchIndexesJob.perform_later(descendants)
+        Decidim::UpdateSearchIndexesJob.perform_later(descendants, current_depth + 1)
       end
     end
 

data/app/jobs/decidim/update_search_indexes_job.rb

@@ -4,8 +4,8 @@ module Decidim
   class UpdateSearchIndexesJob < ApplicationJob
     queue_as :default
 
-    def perform(elements)
-      elements.each { |element| element.try(:try_update_index_for_search_resource) }
+    def perform(elements, current_depth = 0)
+      elements.each { |element| element.try(:try_update_index_for_search_resource, current_depth) }
     end
   end
 end

data/app/mailers/decidim/application_mailer.rb

@@ -7,9 +7,13 @@ module Decidim
     include LocalisedMailer
     include MultitenantAssetHost
     include Decidim::SanitizeHelper
+    include Decidim::MailerHelper
     include Decidim::OrganizationHelper
     helper_method :organization_name, :decidim_escape_translated, :decidim_sanitize_translated, :translated_attribute, :decidim_sanitize, :decidim_sanitize_newsletter
 
+    helper Decidim::SanitizeHelper
+    helper Decidim::MailerHelper
+
     after_action :set_smtp
     after_action :set_from
 

data/app/packs/src/decidim/a11y.js

@@ -124,6 +124,13 @@ const createDropdown = (component) => {
  * @return {void}
  */
 const createDialog = (component) => {
+  const getFocusableElements = (container) => {
+    const selectors = "a[href],button:not([disabled]),input:not([disabled]),select:not([disabled]),textarea:not([disabled]),[tabindex]:not([tabindex='-1'])";
+    return Array.from(container.querySelectorAll(selectors)).filter(
+      (el) => el.offsetParent !== null
+    );
+  };
+
   const {
     dataset: { dialog, ...attrs }
   } = component;
@@ -145,11 +152,33 @@ const createDialog = (component) => {
     backdropSelector: `[data-dialog="${dialog}"]`,
     enableAutoFocus: false,
     onOpen: (params, trigger) => {
+      const keyHandler = (event) => {
+        if (event.key !== "Tab") {
+          return;
+        }
+        const focusable = getFocusableElements(params);
+        if (focusable.length === 0) {
+          return;
+        }
+        if (event.shiftKey && document.activeElement === focusable[0]) {
+          event.preventDefault();
+          focusable[focusable.length - 1].focus({ preventScroll: true });
+        } else if (!event.shiftKey && document.activeElement === focusable[focusable.length - 1]) {
+          event.preventDefault();
+          focusable[0].focus({ preventScroll: true });
+        }
+      };
+      params._focusTrapHandler = keyHandler;
+      params.addEventListener("keydown", keyHandler);
       setFocusOnTitle(params);
       window.focusGuard.trap(params, trigger);
       params.dispatchEvent(new CustomEvent("open.dialog"));
     },
     onClose: (params) => {
+      if (params._focusTrapHandler) {
+        params.removeEventListener("keydown", params._focusTrapHandler);
+        Reflect.deleteProperty(params, "_focusTrapHandler");
+      }
       window.focusGuard.disable();
       params.dispatchEvent(new CustomEvent("close.dialog"));
     },

data/app/packs/src/decidim/a11y.test.js

@@ -0,0 +1,81 @@
+/* global jest */
+
+import { createDialog } from "src/decidim/a11y"
+
+describe("a11y dialog focus trap", () => {
+  const dialogHtml = `
+    <button id="open-btn" data-dialog-open="testDialog">Open</button>
+    <div id="test-dialog" data-dialog="testDialog">
+      <div data-dialog-container>
+        <h2 id="dialog-title-testDialog" tabindex="-1" data-dialog-title>Test Dialog</h2>
+        <a href="#">Link 1</a>
+        <button>Button 1</button>
+        <input type="text" />
+        <button>Button 2</button>
+        <a href="#">Link 2</a>
+      </div>
+      <div data-dialog-actions>
+        <button data-dialog-close="testDialog">Close</button>
+      </div>
+    </div>
+  `;
+
+  beforeEach(() => {
+    document.body.innerHTML = dialogHtml;
+    window.Decidim = {
+      currentDialogs: {}
+    };
+    window.focusGuard = {
+      trap: jest.fn(),
+      disable: jest.fn()
+    };
+  });
+
+  describe("keydown handler", () => {
+    let dialogEl = null;
+
+    beforeEach(() => {
+      const component = document.querySelector("[data-dialog]");
+      createDialog(component);
+      dialogEl = document.querySelector("[data-dialog='testDialog']");
+      // Get the dialog from Decidim.currentDialogs and open it
+      const dialog = window.Decidim.currentDialogs.testDialog;
+      dialog.open();
+    });
+
+    it("adds keydown handler on open", () => {
+      expect(dialogEl._focusTrapHandler).toBeDefined();
+    });
+
+    it("handles Tab key", () => {
+      const selectors = "a[href],button:not([disabled]),input:not([disabled]),select:not([disabled]),textarea:not([disabled]),[tabindex]:not([tabindex='-1'])";
+      const tabbableElements = Array.from(dialogEl.querySelectorAll(selectors)).filter(
+        (el) => el.offsetParent || el.offsetParent === null
+      );
+      tabbableElements[tabbableElements.length - 1].focus();
+
+      const event = new KeyboardEvent("keydown", { key: "Tab", bubbles: true });
+      const preventDefault = jest.fn();
+      event.preventDefault = preventDefault;
+
+      dialogEl.dispatchEvent(event);
+
+      expect(preventDefault).toHaveBeenCalled();
+    });
+  });
+
+  describe("onClose cleanup", () => {
+    it("removes the keydown handler on close", () => {
+      const component = document.querySelector("[data-dialog]");
+      createDialog(component);
+      const dialogEl = document.querySelector("[data-dialog='testDialog']");
+
+      const dialog = window.Decidim.currentDialogs.testDialog;
+      dialog.open();
+      expect(dialogEl._focusTrapHandler).toBeDefined();
+
+      dialog.close();
+      expect(dialogEl._focusTrapHandler).toBeUndefined();
+    });
+  });
+});

data/app/packs/src/decidim/confirm.js

@@ -162,7 +162,9 @@ export const initializeConfirm = () => {
     return handleDocumentEvent(ev, [
       Rails.linkClickSelector,
       Rails.buttonClickSelector,
-      Rails.formInputClickSelector
+      Rails.formInputClickSelector,
+      'button[data-confirm][type="button"]',
+      "form button[data-confirm]"
     ]);
   });
   document.addEventListener("change", (ev) => {
@@ -180,6 +182,11 @@ export const initializeConfirm = () => {
     $(Rails.formInputClickSelector).on("click.confirm", (ev) => {
       handleConfirm(ev, getMatchingEventTarget(ev, Rails.formInputClickSelector));
     });
+
+    // Handle button[type="button"] with data-confirm inside forms
+    $('button[data-confirm][type="button"]').on("click.confirm", (ev) => {
+      handleConfirm(ev, ev.currentTarget);
+    });
   });
 };