decidim-core 0.31.2 → 0.32.1

data/app/packs/stylesheets/decidim/editor.scss

@@ -1,3 +1,5 @@
+@use "stylesheets/decidim/editor_suggestions";
+
 .editor-props {
   --editor-active-color: #487bda;
   --editor-disabled-color: #eee;
@@ -5,12 +7,6 @@
   --editor-bubble-shadow-color: #333;
 }
 
-.editor-suggestions-props {
-  --editor-suggestions-border-color: #000;
-  --editor-suggestions-background-color: #eee;
-  --editor-suggestions-selected-highlight-color: #ccc;
-}
-
 .editor-active {
   @apply outline outline-4 outline-[var(--editor-active-color)];
 }
@@ -130,6 +126,16 @@
         [data-image-resizer-wrapper] {
           @apply relative inline-block;
 
+          [data-image-resizer-control],
+          [data-image-resizer-dimensions] {
+            z-index: 1;
+          }
+
+          > a {
+            position: relative;
+            z-index: 0;
+          }
+
           [data-image-resizer-control] {
             @apply absolute hidden w-2.5 h-2.5 rounded-none border border-solid border-[#000] bg-[#fff] opacity-80;
           }
@@ -176,30 +182,3 @@
     }
   }
 }
-
-.editor-suggestions {
-  @apply editor-suggestions-props border-0 bg-[var(--editor-suggestions-background-color)] max-w-sm drop-shadow-md rounded-md;
-
-  &:hover {
-    .editor-suggestions-item[data-selected]:not(:hover) {
-      @apply bg-transparent;
-    }
-  }
-
-  .editor-suggestions-item {
-    @apply block w-full text-left py-[0.375rem] px-1.5 border-0 rounded-none truncate text-sm;
-
-    &:first-child {
-      @apply rounded-t-md;
-    }
-
-    &:last-child {
-      @apply rounded-b-md;
-    }
-
-    &:hover,
-    &[data-selected] {
-      @apply bg-[var(--editor-suggestions-selected-highlight-color)];
-    }
-  }
-}

data/app/packs/stylesheets/decidim/geocoding_addons.scss

@@ -1,5 +1,13 @@
-.geocoding-container {
-  .user-device-location button {
+.geocoding {
+  &__locate .geocoding__button {
     @apply mt-4;
+
+    &--locating {
+      @apply opacity-70 cursor-wait;
+    }
+
+    .geocoding__spinner {
+      @apply inline-block w-4 h-4 rounded-full animate-spin border-2 border-l-transparent border-y-transparent border-r-secondary align-middle;
+    }
   }
 }

data/app/presenters/decidim/admin_log/participatory_space/member_presenter.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+module Decidim
+  module AdminLog
+    module ParticipatorySpace
+      # This class holds the logic to present a `Decidim::ParticipatorySpace::MemberPresenter`
+      # for the `AdminLog` log.
+      #
+      # Usage should be automatic and you should not need to call this class
+      # directly, but here is an example:
+      #
+      #    action_log = Decidim::ActionLog.last
+      #    view_helpers # => this comes from the views
+      #    MemberPresenter.new(action_log, view_helpers).present
+      class MemberPresenter < Decidim::Log::BasePresenter
+        private
+
+        def diff_fields_mapping
+          {
+            name: :string,
+            email: :string
+          }
+        end
+
+        def action_string
+          case action
+          when "create", "create_via_csv", "delete"
+            "decidim.admin_log.member.#{action}"
+          else
+            super
+          end
+        end
+
+        def i18n_labels_scope
+          "activemodel.attributes.member"
+        end
+      end
+    end
+  end
+end

data/app/presenters/decidim/admin_log/static_page_resource_presenter.rb

@@ -11,7 +11,7 @@ module Decidim
       #
       # Returns an HTML-safe String.
       def resource_path
-        @resource_path ||= h.decidim.page_path(resource)
+        @resource_path ||= h.decidim.page_path(resource, locale: I18n.locale)
       end
     end
   end

data/app/presenters/decidim/authorization_transfer_presenter.rb

@@ -20,7 +20,7 @@ module Decidim
     #      "Decidim::Bar" => "Bars: 456"
     #   }
     #
-    # @return [Hash<String => String>] The translated resource counts with the
+    # @return [Hash{String => String}] The translated resource counts with the
     #   resource type as its keys and the translated text with the record count
     #   as its values.
     def translated_record_counts

data/app/presenters/decidim/breadcrumb_root_menu_item_presenter.rb

@@ -9,16 +9,16 @@ module Decidim
 
     def render
       content_tag :li, class: link_wrapper_classes do
-        output = [arrow_link(label, url, link_options)]
+        output = [root_link(label, url, link_options)]
         output.push(@view.send(:simple_menu, **@menu_item.submenu).render) if @menu_item.submenu
 
         safe_join(output)
       end
     end
 
-    def arrow_link(text, url, args = {})
+    def root_link(text, url, args = {})
       link_to url, class: args.with_indifferent_access[:class] do
-        "<span>#{text}</span> #{icon("arrow-right-line")}".html_safe
+        "<span>#{text}</span>".html_safe
       end
     end
   end

data/app/presenters/decidim/footer_menu_presenter.rb

@@ -3,10 +3,8 @@
 module Decidim
   # A presenter to render footer menu
   class FooterMenuPresenter < MenuPresenter
-    def render
-      content_tag(:nav, :role => "navigation", "aria-label" => @options[:label]) do
-        safe_join([content_tag(:h2, @options[:label], class: "h5 mb-4"), render_menu])
-      end
+    def render_menu_items
+      render_menu
     end
   end
 end

data/app/presenters/decidim/log/user_presenter.rb

@@ -11,6 +11,7 @@ module Decidim
     # The only requirement for custom renderers is that they should respond to `present`.
     class UserPresenter
       include Decidim::SanitizeHelper
+
       # Public: Initializes the presenter.
       #
       # user - An instance of Decidim::User

data/app/presenters/decidim/log/value_types/access_mode_presenter.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+module Decidim
+  module Log
+    module ValueTypes
+      # This class presents the given value as an access mode. Check
+      # the `DefaultPresenter` for more info on how value
+      # presenters work.
+      class AccessModePresenter < DefaultPresenter
+        # Public: Presents the value as an access mode. If the access mode can
+        # be found, it shows its translated label. Otherwise it shows a fallback message.
+        #
+        # Returns an HTML-safe String.
+        def present
+          return unless value
+          return translated_access_mode if valid_access_mode?
+
+          I18n.t("not_found", id: value, scope: "decidim.log.value_types.access_mode_presenter")
+        end
+
+        private
+
+        def valid_access_mode?
+          access_modes.has_value?(value.to_i)
+        end
+
+        def translated_access_mode
+          I18n.t(access_mode_key, scope: "decidim.log.value_types.access_mode_presenter.access_modes")
+        end
+
+        def access_mode_key
+          access_modes.key(value.to_i)
+        end
+
+        def access_modes
+          # Access modes are consistent across participatory spaces (assemblies, processes, etc.)
+          # open: 0 - fully visible and accessible
+          # transparent: 1 - visible but content restricted
+          # restricted: 2 - not visible, requires permission
+          { open: 0, transparent: 1, restricted: 2 }
+        end
+      end
+    end
+  end
+end

data/app/presenters/decidim/menu_item_presenter.rb

@@ -29,9 +29,9 @@ module Decidim
     delegate :content_tag, :safe_join, :link_to, :active_link_to_class, :is_active_link?, :icon, to: :@view
 
     def render
-      content_tag :li, role: :menuitem, class: link_wrapper_classes do
+      content_tag :li, role: wrapper_role, class: link_wrapper_classes do
         output = if url == "#"
-                   [content_tag(:span, composed_label, class: "sidebar-menu__item-disabled")]
+                   [content_tag(:span, composed_label, class: "sidebar-menu__item-disabled", role: menuitem_role)]
                  else
                    [link_to(composed_label, url, link_options)]
                  end
@@ -52,7 +52,7 @@ module Decidim
         { aria: { current: "page" } }
       else
         {}
-      end.merge({ class: link_classes })
+      end.merge({ class: link_classes, role: menuitem_role })
     end
 
     def composed_label
@@ -69,6 +69,18 @@ module Decidim
       [@options.element_wrapper_class, active_class].compact.join(" ")
     end
 
+    def menuitem_role
+      return if @options.role == false
+
+      @options.role || :menuitem
+    end
+
+    def wrapper_role
+      return if menuitem_role.blank?
+
+      :presentation
+    end
+
     def active_class
       active_link_to_class(
         url,

data/app/presenters/decidim/participatory_space/member_presenter.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+module Decidim
+  module ParticipatorySpace
+    #
+    # Decorator for participatory space members
+    #
+    class MemberPresenter < SimpleDelegator
+      delegate :profile_url, to: :user, allow_nil: true
+
+      def name
+        user ? user.name : full_name
+      end
+
+      def nickname
+        user.nickname if user
+      end
+
+      def avatar_url(variant = nil)
+        return user.avatar_url(variant) if user.present?
+
+        non_user_avatar_path(variant)
+      end
+
+      def non_user_avatar_path(variant = nil)
+        return non_user_avatar.default_url(variant) unless non_user_avatar.attached?
+
+        non_user_avatar.path(variant:)
+      end
+
+      def non_user_avatar
+        attached_uploader(:non_user_avatar)
+      end
+
+      def deleted?
+        false
+      end
+
+      private
+
+      def user
+        @user ||= if (user = __getobj__.user.presence)
+                    Decidim::UserPresenter.new(user)
+                  end
+      end
+    end
+  end
+end

data/app/presenters/decidim/resource_locator_presenter.rb

@@ -55,8 +55,9 @@ module Decidim
     # Returns a String.
     def show(options = {})
       options.merge!(options_for_polymorphic)
+      locale = options.delete(:locale) || I18n.locale
 
-      admin_route_proxy.send("#{member_route_name}_path", target, options)
+      normalize_locale_route(admin_route_proxy.send("#{member_route_name}_path", target, options), locale)
     end
 
     # Builds the admin edit path to the resource.
@@ -66,8 +67,9 @@ module Decidim
     # Returns a String.
     def edit(options = {})
       options.merge!(options_for_polymorphic)
+      locale = options.delete(:locale) || I18n.locale
 
-      admin_route_proxy.send("edit_#{member_route_name}_path", target, options)
+      normalize_locale_route(admin_route_proxy.send("edit_#{member_route_name}_path", target, options), locale)
     end
 
     private
@@ -112,8 +114,9 @@ module Decidim
 
     def admin_collection_route(route_type, options)
       options.merge!(options_for_polymorphic)
+      locale = options.delete(:locale) || I18n.locale
 
-      admin_route_proxy.send("#{collection_route_name}_#{route_type}", options)
+      normalize_locale_route(admin_route_proxy.send("#{collection_route_name}_#{route_type}", options), locale)
     end
 
     def manifest_for(record)
@@ -172,5 +175,21 @@ module Decidim
     def admin_route_proxy
       @admin_route_proxy ||= EngineRouter.admin_proxy(component || target)
     end
+
+    def normalize_locale_route(path, locale)
+      path = path.sub(/([?&])locale=[^&]*(?=&|\z)/, "\\1")
+      path = path.delete_suffix("?")
+      path = path.delete_suffix("&")
+      path = path.sub("?&", "?")
+
+      path = "/#{path}" unless path.start_with?("/")
+
+      locale_candidates = Regexp.union(I18n.available_locales.map(&:to_s).sort_by(&:length).reverse)
+      path = path.sub(%r{\A/#{locale_candidates}(?=/|\z)}, "")
+
+      path = "/" if path.empty?
+
+      "/#{locale}#{path}"
+    end
   end
 end

data/app/presenters/decidim/stats_presenter.rb

@@ -15,7 +15,7 @@ module Decidim
             hash[name][:data][idx] += value
           end
         else
-          hash[name] = stat
+          hash[name] = stat.merge(data: stat[:data].dup)
         end
       end.values
     end

data/app/queries/decidim/last_activity.rb

@@ -79,7 +79,7 @@ module Decidim
       Decidim.participatory_space_manifests.map do |manifest|
         klass = manifest.model_class_name.constantize
 
-        condition = if klass.include?(Decidim::HasPrivateUsers)
+        condition = if klass.include?(Decidim::ParticipatorySpace::HasMembers)
                       Arel.sql(
                         <<~SQL.squish
                           (

data/app/resolvers/decidim/meta_image_url_resolver.rb

@@ -79,6 +79,9 @@ module Decidim
         image_url = image_element["src"]
         next if image_url.blank?
 
+        blob = find_blob_by_id(image_url.split("/").last)
+        return blob if blob.present?
+
         blob = find_blob_by_key(image_url.split("/").second_to_last)
         return blob if blob.present?
       end
@@ -120,6 +123,10 @@ module Decidim
       ActiveStorage::Blob.find_signed(blob_key) if blob_key.present?
     end
 
+    def find_blob_by_id(blob_id)
+      ActiveStorage::Blob.find_by(id: blob_id) if blob_id.present?
+    end
+
     def blob_from_attached_file(file)
       return unless file.respond_to?(:attached?) && file.attached?
 

data/app/serializers/decidim/exporters/participatory_space_serializer.rb

@@ -27,7 +27,8 @@ module Decidim
           follows_count: resource.follows_count,
           short_description: resource.short_description,
           description: resource.description,
-          promoted: resource.promoted
+          promoted: resource.promoted,
+          component_settings:
         }
       end
 
@@ -98,6 +99,19 @@ module Decidim
         serializer = Decidim::Exporters::ParticipatorySpaceComponentsSerializer.new(resource)
         serializer.run
       end
+
+      def component_settings
+        return unless resource.respond_to?(:components)
+
+        resource.components.map do |component|
+          {
+            id: component.id,
+            name: component.name,
+            manifest_name: component.manifest_name,
+            settings: component.settings.respond_to?(:as_json) ? component.settings.as_json : component.settings
+          }
+        end
+      end
     end
   end
 end

data/app/services/decidim/email_notification_generator.rb

@@ -44,6 +44,7 @@ module Decidim
 
     def send_to_affected_users
       affected_users.each do |recipient|
+        next unless recipient.is_a?(Decidim::User)
         next unless ["all", "own-only"].include?(recipient.notification_types)
         next if recipient.deleted? || recipient.blocked?
 
@@ -53,6 +54,7 @@ module Decidim
 
     def send_to_followers
       followers.each do |recipient|
+        next unless recipient.is_a?(Decidim::User)
         next unless ["all", "followed-only"].include?(recipient.notification_types)
         next if recipient.deleted? || recipient.blocked?
 

data/app/services/decidim/notification_generator.rb

@@ -37,10 +37,14 @@ module Decidim
       return unless event_class.types.include?(:notification)
 
       followers.each do |recipient|
+        next unless recipient.is_a?(Decidim::User)
+
         generate_notification_for(recipient, user_role: :follower) if ["all", "followed-only"].include?(recipient.notification_types)
       end
 
       affected_users.each do |recipient|
+        next unless recipient.is_a?(Decidim::User)
+
         generate_notification_for(recipient, user_role: :affected_user) if ["all", "own-only"].include?(recipient.notification_types)
       end
     end

data/app/services/decidim/notifications_subscriptions_persistor.rb

@@ -4,6 +4,10 @@ module Decidim
   # This class manages the creation and deletion of user notifications
 
   class NotificationsSubscriptionsPersistor
+    include PushSubscriptionEndpointValidator
+
+    class UnsupportedPushSubscriptionEndpointError < StandardError; end
+
     attr_reader :user
 
     def initialize(user)
@@ -11,6 +15,8 @@ module Decidim
     end
 
     def add_subscription(params)
+      raise UnsupportedPushSubscriptionEndpointError unless supported_push_subscription_endpoint?(params[:endpoint])
+
       subscriptions = user.notification_settings["subscriptions"] || {}
       filtered_params = filter_params(params)
       new_subscription = { filtered_params[:auth] => filtered_params }

data/app/services/decidim/push_subscription_endpoint_validator.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+module Decidim
+  # Shared validation for browser push subscription endpoints.
+  module PushSubscriptionEndpointValidator
+    private
+
+    def supported_push_subscription_endpoint?(endpoint)
+      return false if endpoint.blank?
+
+      uri = URI.parse(endpoint)
+      return false unless uri.is_a?(URI::HTTPS)
+
+      host = uri.host&.downcase
+      return false if host.blank?
+
+      allowed_push_subscription_endpoint_patterns.any? { |pattern| pattern.match?(host) }
+    rescue URI::InvalidURIError
+      false
+    end
+
+    # Override this method to customize the browser push endpoint allowlist.
+    def allowed_push_subscription_endpoint_patterns
+      [
+        /\A(?:.*\.)?push\.services\.mozilla\.com\z/,
+        /\A(?:.*\.)?fcm\.googleapis\.com\z/,
+        /\A(?:.*\.)?android\.googleapis\.com\z/,
+        /\A(?:.*\.)?push\.apple\.com\z/,
+        /\A(?:.*\.)?opera\.com\z/,
+        /\A(?:.*\.)?notify\.windows\.com\z/
+      ]
+    end
+  end
+end

data/app/services/decidim/send_push_notification.rb

@@ -10,6 +10,7 @@ module Decidim
 
   class SendPushNotification
     include ActionView::Helpers::UrlHelper
+    include PushSubscriptionEndpointValidator
 
     # Send the push notification. Returns `nil` if the user did not allowed push notifications
     # or if the subscription to push notifications does not exist
@@ -24,9 +25,12 @@ module Decidim
       raise ArgumentError, "Need to provide a title if the notification is a PushNotificationMessage" if notification.is_a?(Decidim::PushNotificationMessage) && title.nil?
 
       user = notification.user
+      subscriptions = user.notifications_subscriptions.values.select do |subscription|
+        supported_push_subscription_endpoint?(subscription["endpoint"])
+      end
 
       I18n.with_locale(user.locale || user.organization.default_locale) do
-        user.notifications_subscriptions.values.map do |subscription|
+        subscriptions.map do |subscription|
           payload = build_payload(message_params(notification, title), subscription)
           # Capture webpush exceptions in order to avoid this call to be repeated by the background job runner
           # Webpush::Error class is the parent class of all defined errors

data/app/uploaders/decidim/image_uploader.rb

@@ -8,7 +8,7 @@ module Decidim
     end
 
     def content_type_allowlist
-      extension_allowlist.map { |ext| MiniMime.lookup_by_extension(ext).content_type }.uniq
+      extension_allowlist.filter_map { |ext| MiniMime.lookup_by_extension(ext)&.content_type }.uniq
     end
 
     # Fetches info about different variants, their processors and dimensions

data/app/uploaders/decidim/organization_favicon_uploader.rb

@@ -7,7 +7,8 @@ module Decidim
       huge: 512,
       big: 192,
       medium: 180,
-      small: 32
+      small: 32,
+      favicon: 256
     }.freeze
 
     set_variants do
@@ -16,17 +17,11 @@ module Decidim
           resize_and_pad: [value, value],
           format: :png
         }
-      end.merge(
-        favicon: {
-          resize_and_pad: [256, 256],
-          define: "icon:auto-resize=16,24,32,48,64,72,96,128,256",
-          format: :ico
-        }
-      )
+      end
     end
 
     def extension_allowlist
-      %w(png jpg jpeg webp ico)
+      %w(png jpg jpeg webp)
     end
   end
 end

data/app/validators/uploader_image_dimensions_validator.rb

@@ -3,7 +3,7 @@
 # This validator checks when the files to be uploaded are images and the attached uploader's
 # has enabled dimensions validation that the image dimensions are below the
 # limit defined by the uploader
-require "mini_magick"
+require "vips"
 
 class UploaderImageDimensionsValidator < ActiveModel::Validations::FileContentTypeValidator
   def validate_each(record, attribute, value)
@@ -28,14 +28,16 @@ class UploaderImageDimensionsValidator < ActiveModel::Validations::FileContentTy
     return unless uploader.validable_dimensions
     return if (image = extract_image(file)).blank?
 
-    record.errors.add attribute, I18n.t("decidim.errors.files.file_resolution_too_large") if image.dimensions.any? { |dimension| dimension > uploader.max_image_height_or_width }
-  rescue MiniMagick::Error
-    # The error may happen because of many reasons but most commonly the image
-    # exceeds the default maximum dimensions set for ImageMagick when the
-    # `identify` command fails to identify the image.
+    # A simple check to avoid DoS with maliciously crafted images, or just to
+    # avoid reckless users that upload images with too many pixels.
     #
-    # To relax ImageMagick default limits, please refer to:
-    # https://imagemagick.org/script/security-policy.php
+    # See https://hackerone.com/reports/390
+    max_dimension = [image.width, image.height].max
+    record.errors.add attribute, I18n.t("decidim.errors.files.file_resolution_too_large") if max_dimension > uploader.max_image_height_or_width
+  rescue Vips::Error
+    # The error may happen because of many reasons but most commonly the image
+    # exceeds the default maximum dimensions set for libvips when the image
+    # fails to load.
     #
     # Note that the error can also happen because of other reasons than only
     # the image dimensions being too large. But as we do not really know the
@@ -47,11 +49,11 @@ class UploaderImageDimensionsValidator < ActiveModel::Validations::FileContentTy
     return unless file.try(:content_type).to_s.start_with?("image")
 
     if uploaded_file?(file)
-      MiniMagick::Image.new(file.path, File.extname(file.original_filename))
+      Vips::Image.new_from_file(file.path)
     elsif file.is_a?(ActiveStorage::Attached) && file.blob.persisted?
-      MiniMagick::Image.read(file.blob.download, File.extname(file.blob.filename.to_s))
+      Vips::Image.new_from_buffer(file.blob.download, "")
     end
-  rescue ActiveStorage::FileNotFoundError, MiniMagick::Invalid
+  rescue ActiveStorage::FileNotFoundError, Vips::Error
     # Although the blob is persisted, the file is not available to download and analyze
     # after committing the record
     nil

data/app/views/decidim/delete_user_mailer/delete.html.erb

@@ -0,0 +1,6 @@
+<p class="email-greeting"><%= t(".hello", username: @user_name) %></p>
+
+<p class="email-instructions"><%= t ".body_1" %></p>
+<p class="email-instructions"><%= t ".body_2" %></p>
+
+<p class="email-closing"><%= t(".greetings_html", organization_name: organization_name(@organization), organization_url: decidim.root_url(host: @organization.host)) %></p>