decidim-core 0.31.3 → 0.31.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c44cbb210028e54b7a2bcc3a10fc79e041e355eac55e81b9a4b934f5fb5b42db
-  data.tar.gz: 0d87937801924b8d92ef31e2b136019090118d89b46ddbe5f2ce4052eef207b0
+  metadata.gz: 62bd053e6fd5eba91bd7b08d3c502accbe3a13d9045cab68091035b0c95b2964
+  data.tar.gz: 1376e77830f2ec0e1f96c1503caa458f4c834d956f3e189e5d1176ad3403f430
 SHA512:
-  metadata.gz: 508ad856daf2345e66f3c6b0b01c1a0c851d225eca8d0e4e739d79f5584dacb6de8c0155b8a3f28ac80961f6346c31ef3d6fdc14f80299fd80184ea64697b4ef
-  data.tar.gz: 931b27cfcafe94a6f922d26c2c419dbf89386f64147234d5cf129641b52e2651e877cbfff63ec13f9844c5e6f91c12730df30f0fea2a5dffe2f6c61551bee522
+  metadata.gz: 4beb29f27737221e77294185ea9b1d1fde88cb3296cd21691cc91ad2477117669b20b3f8369a80d7e9443594d516701462134ef77936433b4d372571ddaf414a
+  data.tar.gz: 51aafb46408f1a5cb3067e73b9559661b10c8573a46d5fb3036b576e94a998d9f98952da18cb0330d67d1379c7d7e568b4e9f9c9c22a2c9e30a4a998e5484991

data/app/cells/decidim/content_blocks/html_cell.rb

@@ -8,7 +8,7 @@ module Decidim
       end
 
       def html_content
-        translated_attribute(model.settings.html_content).html_safe
+        decidim_sanitize_editor_admin(translated_attribute(model.settings.html_content))
       end
     end
   end

data/app/cells/decidim/content_blocks/static_page/section_cell.rb

@@ -5,7 +5,7 @@ module Decidim
     module StaticPage
       class SectionCell < Decidim::ViewModel
         def content
-          translated_attribute(model.settings.content).html_safe
+          decidim_sanitize_editor_admin(translated_attribute(model.settings.content))
         end
       end
     end

data/app/cells/decidim/content_blocks/static_page/summary_cell.rb

@@ -5,7 +5,7 @@ module Decidim
     module StaticPage
       class SummaryCell < Decidim::ViewModel
         def content
-          translated_attribute(model.settings.summary).html_safe
+          decidim_sanitize_editor_admin(translated_attribute(model.settings.summary))
         end
       end
     end

data/app/cells/decidim/content_blocks/static_page/two_pane_section_cell.rb

@@ -5,11 +5,11 @@ module Decidim
     module StaticPage
       class TwoPaneSectionCell < Decidim::ViewModel
         def left_column
-          translated_attribute(model.settings.left_column).html_safe
+          decidim_sanitize_editor_admin(translated_attribute(model.settings.left_column))
         end
 
         def right_column
-          translated_attribute(model.settings.right_column).html_safe
+          decidim_sanitize_editor_admin(translated_attribute(model.settings.right_column))
         end
       end
     end

data/app/cells/decidim/data_consent/category.erb

@@ -13,12 +13,12 @@
       <%= icon "close-line", class: "cookies__category-toggle-icon" %>
     </label>
 
-    <div id="accordion-trigger-<%= category[:slug] %>" data-controls="accordion-panel-<%= category[:slug] %>" aria-labelledby="accordion-title-<%= category[:slug] %>">
-      <h3 id="accordion-title-<%= category[:slug] %>" class="cookies__category-trigger-title">
-        <%= category[:title] %>
-      </h3>
+    <h3 id="accordion-title-<%= category[:slug] %>" class="cookies__category-trigger-title">
+      <%= category[:title] %>
+    </h3>
 
-      <span>
+    <div id="accordion-trigger-<%= category[:slug] %>" role="group" data-controls="accordion-panel-<%= category[:slug] %>" aria-labelledby="accordion-title-<%= category[:slug] %>">
+      <span aria-hidden="true">
         <%= icon "arrow-down-s-line", class: "cookies__category-trigger-arrow" %>
         <%= icon "arrow-up-s-line", class: "cookies__category-trigger-arrow" %>
       </span>

data/app/cells/decidim/nav_links/show.erb

@@ -1,12 +1,12 @@
 <div class="participatory-space__nav-container">
-  <button id="dropdown-trigger-participatory-space" data-controller="dropdown" data-target="dropdown-menu-participatory-space" data-auto-close="true" data-scroll-to-menu="true">
+  <button id="dropdown-trigger-participatory-space" data-controller="dropdown" data-target="dropdown-menu-participatory-space" data-auto-close="true" data-scroll-to-menu="true" data-add-aria-roles="false" data-open-md="true">
     <span><%= t("decidim.searches.filters.jump_to") %></span>
     <%= icon "arrow-down-s-line" %>
     <%= icon "arrow-up-s-line" %>
   </button>
-  <ul id="dropdown-menu-participatory-space" class="participatory-space__nav" aria-hidden="true">
+  <ul id="dropdown-menu-participatory-space" class="participatory-space__nav">
     <% model.each do |item| %>
-      <li role="menuitem">
+      <li>
         <%= link_to item[:url], class: "participatory-space__nav-item" do %>
           <%= decidim_escape_translated(item[:name]) %>
           <%= icon "arrow-right-line" %>

data/app/cells/decidim/participatory_space_private_user/show.erb

@@ -1,13 +1,13 @@
-<div class="profile__user">
+<%= link_to profile_url, class: "profile__user" do %>
   <div class="profile__user-avatar-container">
-    <div class="<%= has_profile? ? "profile__user-avatar" : "profile__user-avatar !border-0" %>">
-      <%= image_tag(has_profile? ? model.avatar_url(:big) : model.non_user_avatar_path, alt: "member-avatar") %>
+    <div class="profile__user-avatar">
+      <%= image_tag(model.avatar_url(:big), alt: "member-avatar") %>
     </div>
   </div>
   <div>
-    <div class="<%= has_profile? ? "profile__user-name" : "profile__user-name !no-underline" %>">
+    <span class="profile__user-name">
       <%= name %>
-    </div>
+    </span>
     <% if nickname.present? %>
       <span class="profile__user-nick block">
         <%= nickname %>
@@ -20,4 +20,4 @@
       </span>
     </div>
   </div>
-</div>
+<% end %>

data/app/cells/decidim/participatory_space_private_user_cell.rb

@@ -10,10 +10,6 @@ module Decidim
 
     private
 
-    def has_profile?
-      model.profile_url.present?
-    end
-
     def role_translated
       decidim_html_escape(decidim_sanitize(translated_attribute(role)))
     end

data/app/cells/decidim/upload_modal_cell.rb

@@ -177,6 +177,11 @@ module Decidim
 
     def file_attachment_path(attachment)
       return unless attachment
+
+      if attachment.respond_to?(:record) && attachment.record.is_a?(Decidim::Authorization) && attachment.name.to_s == "verification_attachment"
+        return decidim.private_download_path(Decidim::PrivateDownload.for(attachment.record, attachment_name: attachment.name).token)
+      end
+
       return Rails.application.routes.url_helpers.rails_blob_url(attachment, only_path: true) if attachment.is_a? ActiveStorage::Blob
 
       if attachment.try(:attached?)

data/app/controllers/decidim/download_your_data_controller.rb

@@ -50,7 +50,7 @@ module Decidim
         flash[:error] = t("decidim.account.download_your_data_export.export_expired")
         redirect_to download_your_data_path
       elsif private_export.file.attached?
-        redirect_to Rails.application.routes.url_helpers.rails_blob_url(private_export.file.blob, only_path: true)
+        redirect_to private_download_path(Decidim::PrivateDownload.for(private_export, attachment_name: :file).token)
       else
         flash[:error] = t("decidim.account.download_your_data_export.file_no_exists")
         redirect_to download_your_data_path

data/app/controllers/decidim/notifications_subscriptions_controller.rb

@@ -3,6 +3,8 @@
 module Decidim
   # The controller to handle the subscriptions to push notifications
   class NotificationsSubscriptionsController < Decidim::ApplicationController
+    rescue_from Decidim::NotificationsSubscriptionsPersistor::UnsupportedPushSubscriptionEndpointError, with: :unsupported_browser
+
     def create
       Decidim::NotificationsSubscriptionsPersistor.new(current_user).add_subscription(params)
       head :ok
@@ -12,5 +14,11 @@ module Decidim
       Decidim::NotificationsSubscriptionsPersistor.new(current_user).delete_subscription(params[:auth])
       head :ok
     end
+
+    private
+
+    def unsupported_browser
+      render json: { error: I18n.t("notifications_settings.show.push_notifications_unsupported_browser", scope: "decidim") }, status: :unprocessable_entity
+    end
   end
 end

data/app/controllers/decidim/private_downloads_controller.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+module Decidim
+  class PrivateDownloadsController < Decidim::ApplicationController
+    before_action :authenticate_user!
+
+    def show
+      return head :not_found unless private_download.attached?
+      return head :not_found unless private_download.authorized_for?(current_user)
+
+      disposition = private_download.attachment.content_type.start_with?("image/") ? :inline : :attachment
+
+      send_data(
+        private_download.attachment.download,
+        filename: private_download.attachment.filename.to_s,
+        type: private_download.attachment.content_type,
+        disposition:
+      )
+    rescue Decidim::PrivateDownload::InvalidTokenError
+      head :not_found
+    end
+
+    private
+
+    def private_download
+      @private_download ||= Decidim::PrivateDownload.from_token(params[:id])
+    end
+  end
+end

data/app/helpers/decidim/mailer_helper.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+module Decidim
+  # Helper that provides methods to render order selector and links
+  module MailerHelper
+    # Transforms relative image URLs in HTML content to absolute URLs using the provided host.
+    # This is used in emails (newsletters and notifications) to ensure images display correctly
+    # in email clients.
+    #
+    # @param content [String] - HTML content with img tags
+    # @param host [String] - the Decidim::Organization host to use for the root URL
+    #
+    # @return [String] - the content with transformed image URLs
+    def decidim_transform_image_urls(content, host)
+      return content if host.blank? || content.blank?
+
+      root_url = if Decidim.storage_cdn_host.present?
+                   Decidim.storage_cdn_host.chomp("/")
+                 else
+                   Decidim::EngineRouter.new("decidim", {}).root_url(host:).chomp("/")
+                 end
+
+      content.gsub(/src\s*=\s*(['"])([^'"]*)\1/) do
+        quote = Regexp.last_match(1)
+        src_value = Regexp.last_match(2)
+
+        if src_value.blank? || src_value.start_with?("http://", "https://", "data:", "//", "cid:")
+          %(src=#{quote}#{src_value}#{quote})
+        else
+          normalized_src = src_value.start_with?("/") ? src_value : "/#{src_value}"
+          %(src=#{quote}#{root_url}#{normalized_src}#{quote})
+        end
+      end
+    end
+  end
+end

data/app/helpers/decidim/menu_helper.rb

@@ -57,7 +57,8 @@ module Decidim
         self,
         element_class: "font-semibold underline",
         active_class: "is-active",
-        container_options: { class: "space-y-4 break-inside-avoid", role: :menu },
+        role: false,
+        container_options: { class: "space-y-4 break-inside-avoid" },
         label: t("layouts.decidim.footer.decidim_title")
       )
     end

data/app/helpers/decidim/newsletters_helper.rb

@@ -3,6 +3,9 @@
 module Decidim
   # Helper that provides methods to render links with utm codes, and replaced name
   module NewslettersHelper
+    include Decidim::SanitizeHelper
+    include Decidim::MailerHelper
+
     # If the newsletter body there are some links and the Decidim.track_newsletter_links = true
     # it will be replaced with the utm_codes method described below.
     # for example transform "https://es.lipsum.com/" to "https://es.lipsum.com/?utm_source=localhost&utm_campaign=newsletter_11"
@@ -19,7 +22,7 @@ module Decidim
 
       content = interpret_name(content, user)
       content = track_newsletter_links(content, id, host)
-      transform_image_urls(content, host)
+      decidim_transform_image_urls(content, host)
     end
 
     # this method is used to generate the root link on mail with the utm_codes
@@ -67,27 +70,6 @@ module Decidim
       content.gsub("%{name}", user.name)
     end
 
-    # Find each img HTML tag with relative path in src attribute
-    # For each URL, prepends the decidim.root_url
-    #   If host is not defined it returns full content
-    #
-    # @param content [String] - the string to convert
-    # @param host [String] - the Decidim::Organization host to replace
-    #
-    # @return [String] - the content converted
-    #
-    def transform_image_urls(content, host)
-      return content if host.blank?
-
-      content.scan(/src\s*=\s*"([^"]*)"/).each do |src|
-        root_url = decidim.root_url(host:)[0..-2]
-        src_replaced = "#{root_url}#{src.first}"
-        content = content.gsub(/src\s*=\s*"([^"]*#{src.first})"/, %(src="#{src_replaced}"))
-      end
-
-      content
-    end
-
     # Add tracking query params to each links
     #
     # @param content [String] - the string to convert

data/app/mailers/decidim/application_mailer.rb

@@ -7,9 +7,13 @@ module Decidim
     include LocalisedMailer
     include MultitenantAssetHost
     include Decidim::SanitizeHelper
+    include Decidim::MailerHelper
     include Decidim::OrganizationHelper
     helper_method :organization_name, :decidim_escape_translated, :decidim_sanitize_translated, :translated_attribute, :decidim_sanitize, :decidim_sanitize_newsletter
 
+    helper Decidim::SanitizeHelper
+    helper Decidim::MailerHelper
+
     after_action :set_smtp
     after_action :set_from
 

data/app/models/decidim/attachment.rb

@@ -88,7 +88,7 @@ module Decidim
     # Returns String.
     def file_type
       if file?
-        url&.split(".")&.last&.split("&")&.first&.downcase
+        file.filename.extension&.downcase
       elsif link?
         "link"
       end
@@ -100,7 +100,13 @@ module Decidim
     def url
       @url ||=
         if file?
-          attached_uploader(:file).url
+          if private_download_required?
+            Decidim::Core::Engine.routes.url_helpers.private_download_path(
+              Decidim::PrivateDownload.for(self, attachment_name: :file).token
+            )
+          else
+            attached_uploader(:file).url
+          end
         elsif link?
           link
         end
@@ -144,5 +150,17 @@ module Decidim
 
       attached_to.can_participate?(user)
     end
+
+    def private_download_authorized?(user, requested_attachment_name)
+      return false unless requested_attachment_name.to_s == "file"
+
+      can_participate?(user)
+    end
+
+    def private_download_required?
+      return attached_to.private_space? if attached_to.respond_to?(:private_space?)
+
+      attached_to.respond_to?(:component) && attached_to.component&.private_non_transparent_space?
+    end
   end
 end

data/app/models/decidim/authorization.rb

@@ -91,6 +91,13 @@ module Decidim
       Decidim::AuthorizationTransfer.perform!(self, handler)
     end
 
+    def private_download_authorized?(user, requested_attachment_name)
+      return false unless requested_attachment_name.to_s == "verification_attachment"
+      return true if user&.admin? && user.organization == organization
+
+      user == self.user
+    end
+
     private
 
     def active_handler?

data/app/models/decidim/private_download.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+module Decidim
+  class PrivateDownload
+    class InvalidTokenError < StandardError; end
+
+    VERIFIER_PURPOSE = :private_download
+
+    def self.for(record, attachment_name:)
+      new(record:, attachment_name:)
+    end
+
+    def self.from_token(token)
+      payload = verifier.verify(token, purpose: VERIFIER_PURPOSE).with_indifferent_access
+      record = GlobalID::Locator.locate(payload[:gid])
+
+      raise InvalidTokenError if record.blank?
+
+      new(record:, attachment_name: payload[:attachment_name])
+    rescue ActiveSupport::MessageVerifier::InvalidSignature, TypeError
+      raise InvalidTokenError
+    end
+
+    def self.verifier
+      @verifier ||= ActiveSupport::MessageVerifier.new(Rails.application.secret_key_base, serializer: JSON)
+    end
+
+    def initialize(record:, attachment_name:)
+      @record = record
+      @attachment_name = attachment_name.to_s
+    end
+
+    def token
+      self.class.verifier.generate(
+        {
+          gid: record.to_global_id.to_s,
+          attachment_name:
+        },
+        purpose: VERIFIER_PURPOSE
+      )
+    end
+
+    def attachment
+      record.public_send(attachment_name)
+    end
+
+    def attached?
+      attachment.respond_to?(:attached?) && attachment.attached?
+    end
+
+    def authorized_for?(user)
+      return false unless record.respond_to?(:private_download_authorized?)
+
+      record.private_download_authorized?(user, attachment_name)
+    end
+
+    private
+
+    attr_reader :record, :attachment_name
+  end
+end

data/app/models/decidim/private_export.rb

@@ -24,5 +24,11 @@ module Decidim
       self.content_type = file.content_type
       self.file_size = file.byte_size
     end
+
+    def private_download_authorized?(user, requested_attachment_name)
+      return false unless requested_attachment_name.to_s == "file"
+
+      attached_to == user
+    end
   end
 end

data/app/packs/src/decidim/controllers/accordion/accordion.test.js

@@ -0,0 +1,118 @@
+/* global jest */
+
+import AccordionController from "src/decidim/controllers/accordion/controller";
+
+jest.mock("a11y-accordion-component", () => ({
+  render: jest.fn(),
+  destroy: jest.fn()
+}));
+
+describe("AccordionController", () => {
+  let controller = null;
+  let accordionElement = null;
+  let panel1 = null;
+  let panel2 = null;
+
+  const createController = (controllerElement) => {
+    const ControllerClass = AccordionController;
+    const instance = Object.create(ControllerClass.prototype);
+    Reflect.defineProperty(instance, "element", {
+      get: () => controllerElement,
+      configurable: true
+    });
+    return instance;
+  };
+
+  beforeEach(() => {
+    window.matchMedia = jest.fn().mockImplementation((query) => ({
+      matches: false,
+      media: query,
+      addListener: jest.fn(),
+      removeListener: jest.fn()
+    }));
+
+    document.body.innerHTML = `
+      <div id="test-accordion" data-controller="accordion">
+        <button id="trigger-1" data-controls="panel-1">Trigger 1</button>
+        <div id="panel-1">Panel 1 Content</div>
+        <button id="trigger-2" data-controls="panel-2">Trigger 2</button>
+        <div id="panel-2">Panel 2 Content</div>
+      </div>
+    `;
+
+    accordionElement = document.getElementById("test-accordion");
+    panel1 = document.getElementById("panel-1");
+    panel2 = document.getElementById("panel-2");
+
+    controller = createController(accordionElement);
+  });
+
+  afterEach(() => {
+    document.body.innerHTML = "";
+    Reflect.deleteProperty(window, "matchMedia");
+  });
+
+  describe("fixPanelRole", () => {
+    it("changes role from region to group when data-panel-role is group", () => {
+      panel1.setAttribute("role", "region");
+      panel2.setAttribute("role", "region");
+
+      accordionElement.dataset.panelRole = "group";
+      controller.fixPanelRole();
+
+      expect(panel1.getAttribute("role")).toBe("group");
+      expect(panel2.getAttribute("role")).toBe("group");
+    });
+
+    it("removes role attribute when data-panel-role is none", () => {
+      panel1.setAttribute("role", "region");
+      panel2.setAttribute("role", "region");
+
+      accordionElement.dataset.panelRole = "none";
+      controller.fixPanelRole();
+
+      expect(panel1.getAttribute("role")).toBeNull();
+      expect(panel2.getAttribute("role")).toBeNull();
+    });
+
+    it("does nothing when data-panel-role is not set", () => {
+      panel1.setAttribute("role", "region");
+      panel2.setAttribute("role", "region");
+
+      Reflect.deleteProperty(accordionElement.dataset, "panelRole");
+      controller.fixPanelRole();
+
+      expect(panel1.getAttribute("role")).toBe("region");
+      expect(panel2.getAttribute("role")).toBe("region");
+    });
+
+    it("does nothing when data-panel-role is empty", () => {
+      panel1.setAttribute("role", "region");
+
+      accordionElement.dataset.panelRole = "";
+      controller.fixPanelRole();
+
+      expect(panel1.getAttribute("role")).toBe("region");
+    });
+
+    it("sets custom role value when data-panel-role is set", () => {
+      panel1.setAttribute("role", "region");
+
+      accordionElement.dataset.panelRole = "navigation";
+      controller.fixPanelRole();
+
+      expect(panel1.getAttribute("role")).toBe("navigation");
+    });
+
+    it("handles nonexistent panels gracefully", () => {
+      accordionElement.dataset.panelRole = "group";
+
+      const nonExistentTrigger = document.createElement("button");
+      nonExistentTrigger.dataset.controls = "nonexistent-panel";
+      accordionElement.appendChild(nonExistentTrigger);
+
+      expect(() => controller.fixPanelRole()).not.toThrow();
+    });
+  });
+});
+

data/app/packs/src/decidim/controllers/accordion/controller.js

@@ -39,6 +39,8 @@ export default class extends Controller {
 
     Accordions.render(this.element.id, accordionOptions);
 
+    this.fixPanelRole();
+
     this.expandIfNeeded();
 
     this.boundReconnect = this.reconnect.bind(this);
@@ -88,6 +90,28 @@ export default class extends Controller {
     this.previouslyExpanded = this.toggleButton.getAttribute("aria-expanded");
   }
 
+  fixPanelRole() {
+    const panelRole = this.element.dataset.panelRole;
+    if (!panelRole) {
+      return;
+    }
+
+    const panels = this.element.querySelectorAll("[data-controls]");
+    panels.forEach((trigger) => {
+      const panelId = trigger.dataset.controls;
+      const panel = document.getElementById(panelId);
+      if (!panel) {
+        return;
+      }
+
+      if (panelRole === "none") {
+        panel.removeAttribute("role");
+      } else {
+        panel.setAttribute("role", panelRole);
+      }
+    });
+  }
+
   /**
    * Checks if a key is in the current viewport
    *

data/app/packs/src/decidim/controllers/dropdown/controller.js

@@ -76,6 +76,32 @@ export default class extends Controller {
     }
 
     Dropdowns.render(this.element.id, dropdownOptions);
+
+    const addAriaRoles = this.element.dataset.addAriaRoles !== "false";
+    if (!addAriaRoles) {
+      this.removeAriaRoles();
+    }
+  }
+
+  removeAriaRoles() {
+    const target = this.element.dataset.target;
+    const dropdownMenu = document.getElementById(target);
+    if (!dropdownMenu) {
+      return;
+    }
+
+    dropdownMenu.removeAttribute("role");
+    dropdownMenu.removeAttribute("aria-labelledby");
+    dropdownMenu.removeAttribute("tabindex");
+
+    dropdownMenu.querySelectorAll("li").forEach((li) => {
+      li.removeAttribute("role");
+    });
+
+    dropdownMenu.querySelectorAll("a").forEach((anchor) => {
+      anchor.removeAttribute("role");
+      anchor.removeAttribute("tabindex");
+    });
   }
 
   /**