decidim-core 0.31.4 → 0.31.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 513dc9560cc17e12439bcef89efbb034edc6300b791810f2037bbb64191805a6
-  data.tar.gz: 99d7f076a772765592d34f5164659c5f4d0826edb4d146d5917fff28e02dc922
+  metadata.gz: 1625dd1f860a4431caaae18f96ec93ee1751d8d135bde4da819eddbf4976e0d3
+  data.tar.gz: ff6293ab292f7c3a18d663a524a099754d63c59dbc4d15e81ca7664f6fc74bff
 SHA512:
-  metadata.gz: d8928571dc994667af951c63981ce2472ce1be5db0c477beb27cadfc2ac43b6cfa87f1a8ab6854483cd00ce46fb1856adacf593ad4e159e7e1a46dc3ae099b87
-  data.tar.gz: e03706f2aadaac2165c6a513a5b1284011bda181ab5a29683fe5983e616c880fd9c7a6ff15cbf1619fb6d6f658eb30df40e4d151cb81f12b0bdbd16c7848b224
+  metadata.gz: 4403452ffb2df3d9ef2c5c1dd911321cffcfcfaa89ab1d4bf1b32542acc6a2a3e15ad6410a23538bd98cb33ec57496d58de2015022f3a1ce52f77a901d776d99
+  data.tar.gz: c385ae7331b4c38b6a2b3a0679340e4739ee9da30535daea878690279776b68e1b5652951bc2151b06959935343a56dd0cbd0d7e066ccc97329dcf4712694862

data/app/cells/decidim/amendable/amend_button_card/show.erb

@@ -1,5 +1,5 @@
-<li role="menuitem" class="dropdown__item">
-  <%= action_authorized_link_to :amend, new_amend_path, resource: model, data: { "redirect_url" => new_amend_path }, id: "amend-button", class: "dropdown__button" do %>
+<li role="presentation" class="dropdown__item">
+  <%= action_authorized_link_to :amend, new_amend_path, resource: model, data: { "redirect_url" => new_amend_path }, id: "amend-button", class: "dropdown__button", role: "menuitem" do %>
     <span><%= t("button", scope: "decidim.amendments.amendable", model_name: nil) %></span>
     <%= icon "pencil-line" %>
   <% end %>

data/app/cells/decidim/author_cell.rb

@@ -31,10 +31,6 @@ module Decidim
       render unless current_user == model
     end
 
-    def perform_caching?
-      true
-    end
-
     def raw_model
       model.try(:__getobj__) || model
     end

data/app/cells/decidim/content_blocks/cta_settings_form/show.erb

@@ -4,6 +4,6 @@
   <%= settings_fields.translated :text_field, :description, label: t("decidim.content_blocks.cta_settings_form.description") %>
 <% end %>
 
-<% form.fields_for :images, form.object.images do |images_fields| %>
+<% form.fields_for :images, content_block.images_container do |images_fields| %>
   <%= images_fields.upload :background_image, label: t("decidim.content_blocks.cta_settings_form.background_image") %>
 <% end %>

data/app/cells/decidim/content_blocks/hero_settings_form/show.erb

@@ -5,7 +5,7 @@
 
   <div class="row column" data-controller="slug">
     <%= settings_fields.translated :text_field, :cta_button_path, label: t(".cta_button_path") %>
-    <p class="help-text"><%= t(".cta_button_path_help", url: decidim_form_slug_url("", translated_attribute(form.object.settings.cta_button_path))) %></p>
+    <p class="help-text"><%= t(".cta_button_path_help", url: decidim_form_slug_url("", translated_attribute(form.object.settings["cta_button_path"]))) %></p>
   </div>
 
   <div class="row column">
@@ -14,7 +14,7 @@
   </div>
 <% end %>
 
-<% form.fields_for :images, form.object.images do |images_fields| %>
+<% form.fields_for :images, content_block.images_container do |images_fields| %>
   <div class="row column">
     <%= images_fields.upload :background_image, label: t(".background_image"), button_class: "button button__sm button__transparent-secondary" %>
   </div>

data/app/cells/decidim/content_blocks/highlighted_content_banner_cell.rb

@@ -32,7 +32,7 @@ module Decidim
       private
 
       def render?
-        required_keys = [:title, :short_description, :action_button_title, :action_button_subtitle, :action_button_url]
+        required_keys = [:title, :action_button_title, :action_button_subtitle, :action_button_url]
         required_keys.all? { |key| model.settings.public_send(key).present? }
       end
     end

data/app/cells/decidim/content_blocks/highlighted_content_banner_settings_form/show.erb

@@ -20,7 +20,7 @@
   </div>
 <% end %>
 
-<% form.fields_for :images, form.object.images do |images_fields| %>
+<% form.fields_for :images, content_block.images_container do |images_fields| %>
   <div class="row column">
     <%= images_fields.upload :background_image, label: t(".background_image"), button_class: "button button__sm button__transparent-secondary" %>
   </div>

data/app/cells/decidim/content_blocks/highlighted_participatory_spaces_cell.rb

@@ -28,7 +28,7 @@ module Decidim
       private
 
       def cache_hash
-        [I18n.locale, highlighted_spaces.map(&:cache_key_with_version)].join(Decidim.cache_key_separator)
+        [I18n.locale, model.cache_key_with_version, highlighted_spaces.map(&:cache_key_with_version)].join(Decidim.cache_key_separator)
       end
 
       def section_class

data/app/cells/decidim/content_blocks/html_cell.rb

@@ -8,7 +8,7 @@ module Decidim
       end
 
       def html_content
-        translated_attribute(model.settings.html_content).html_safe
+        decidim_sanitize_editor_admin(translated_attribute(model.settings.html_content))
       end
     end
   end

data/app/cells/decidim/content_blocks/participatory_space_hero_settings_form/show.erb

@@ -8,7 +8,7 @@
   </div>
 <% end %>
 
-<% form.fields_for :images, form.object.images do |images_fields| %>
+<% form.fields_for :images, content_block.images_container do |images_fields| %>
   <div class="row column">
     <%= images_fields.upload :background_image, label: t("decidim.content_blocks.cta_settings_form.background_image"), button_class: "button button__sm button__transparent-secondary" %>
   </div>

data/app/cells/decidim/content_blocks/static_page/section_cell.rb

@@ -5,7 +5,7 @@ module Decidim
     module StaticPage
       class SectionCell < Decidim::ViewModel
         def content
-          translated_attribute(model.settings.content).html_safe
+          decidim_sanitize_editor_admin(translated_attribute(model.settings.content))
         end
       end
     end

data/app/cells/decidim/content_blocks/static_page/section_settings_form/show.erb

@@ -1,3 +1,5 @@
 <% form.fields_for :settings, form.object.settings do |settings_fields| %>
-  <%= settings_fields.translated :editor, :content, label: %>
+  <div class="row column">
+    <%= settings_fields.translated :editor, :content, label: %>
+  </div>
 <% end %>

data/app/cells/decidim/content_blocks/static_page/summary_cell.rb

@@ -5,7 +5,7 @@ module Decidim
     module StaticPage
       class SummaryCell < Decidim::ViewModel
         def content
-          translated_attribute(model.settings.summary).html_safe
+          decidim_sanitize_editor_admin(translated_attribute(model.settings.summary))
         end
       end
     end

data/app/cells/decidim/content_blocks/static_page/summary_settings_form/show.erb

@@ -1,3 +1,5 @@
 <% form.fields_for :settings, form.object.settings do |settings_fields| %>
-  <%= settings_fields.translated :editor, :summary, label: %>
+  <div class="row column">
+    <%= settings_fields.translated :editor, :summary, label: %>
+  </div>
 <% end %>

data/app/cells/decidim/content_blocks/static_page/two_pane_section_cell.rb

@@ -5,11 +5,11 @@ module Decidim
     module StaticPage
       class TwoPaneSectionCell < Decidim::ViewModel
         def left_column
-          translated_attribute(model.settings.left_column).html_safe
+          decidim_sanitize_editor_admin(translated_attribute(model.settings.left_column))
         end
 
         def right_column
-          translated_attribute(model.settings.right_column).html_safe
+          decidim_sanitize_editor_admin(translated_attribute(model.settings.right_column))
         end
       end
     end

data/app/cells/decidim/content_blocks/static_page/two_pane_section_settings_form/show.erb

@@ -1,4 +1,6 @@
 <% form.fields_for :settings, form.object.settings do |settings_fields| %>
-  <%= settings_fields.translated :editor, :left_column, label: label_left_column %>
-  <%= settings_fields.translated :editor, :right_column, label: label_right_column %>
+  <div class="row column">
+    <%= settings_fields.translated :editor, :left_column, label: label_left_column %>
+    <%= settings_fields.translated :editor, :right_column, label: label_right_column %>
+  </div>
 <% end %>

data/app/cells/decidim/data_consent/category.erb

@@ -13,12 +13,12 @@
       <%= icon "close-line", class: "cookies__category-toggle-icon" %>
     </label>
 
-    <div id="accordion-trigger-<%= category[:slug] %>" data-controls="accordion-panel-<%= category[:slug] %>" aria-labelledby="accordion-title-<%= category[:slug] %>">
-      <h3 id="accordion-title-<%= category[:slug] %>" class="cookies__category-trigger-title">
-        <%= category[:title] %>
-      </h3>
+    <h3 id="accordion-title-<%= category[:slug] %>" class="cookies__category-trigger-title">
+      <%= category[:title] %>
+    </h3>
 
-      <span>
+    <div id="accordion-trigger-<%= category[:slug] %>" role="group" data-controls="accordion-panel-<%= category[:slug] %>" aria-labelledby="accordion-title-<%= category[:slug] %>">
+      <span aria-hidden="true">
         <%= icon "arrow-down-s-line", class: "cookies__category-trigger-arrow" %>
         <%= icon "arrow-up-s-line", class: "cookies__category-trigger-arrow" %>
       </span>

data/app/cells/decidim/resource_types_filter/show.erb

@@ -10,8 +10,8 @@
   </button>
   <ul id="dropdown-menu-resource">
     <% resource_types.each do |resource_type| %>
-      <li role="menuitem">
-        <%= link_to filter_url(resource_type[0]), class: "filter#{" is-active" if filter_param == resource_type[0]}" do %>
+      <li role="presentation">
+        <%= link_to filter_url(resource_type[0]), class: "filter#{" is-active" if filter_param == resource_type[0]}", role: "menuitem" do %>
           <span class="sr-only"><%= resource_type[1] %></span>
           <%= text_with_resource_icon(*resource_type) %>
         <% end %>

data/app/cells/decidim/upload_modal_cell.rb

@@ -177,6 +177,11 @@ module Decidim
 
     def file_attachment_path(attachment)
       return unless attachment
+
+      if attachment.respond_to?(:record) && attachment.record.is_a?(Decidim::Authorization) && attachment.name.to_s == "verification_attachment"
+        return decidim.private_download_path(Decidim::PrivateDownload.for(attachment.record, attachment_name: attachment.name).token)
+      end
+
       return Rails.application.routes.url_helpers.rails_blob_url(attachment, only_path: true) if attachment.is_a? ActiveStorage::Blob
 
       if attachment.try(:attached?)

data/app/commands/decidim/destroy_account.rb

@@ -15,7 +15,7 @@ module Decidim
     def call
       return broadcast(:invalid) unless @form.valid?
 
-      Decidim::User.transaction do
+      with_events(with_transaction: true) do
         destroy_user_account!
         destroy_user_identities
         destroy_follows
@@ -110,5 +110,16 @@ module Decidim
         space_manifest.invoke_on_destroy_account(current_user)
       end
     end
+
+    # We use memoization in this particular email, as we want to have the data available before the actual anonymization
+    def event_arguments
+      @event_arguments ||= {
+        user_id: current_user.id,
+        user_email: current_user.email,
+        user_name: current_user.name,
+        locale: current_user.locale,
+        organization: current_user.organization
+      }
+    end
   end
 end

data/app/commands/decidim/multiple_attachments_methods.rb

@@ -5,16 +5,16 @@ module Decidim
     private
 
     def build_attachments
-      @documents = []
-      @form.add_documents.compact_blank.each do |attachment|
+      @attachments = []
+      @form.add_attachments.compact_blank.each do |attachment|
         if attachment.is_a?(Hash) && attachment.has_key?(:id)
           update_attachment_title_for(attachment)
           next
         end
 
-        @documents << Attachment.new(
+        @attachments << Attachment.new(
           title: title_for(attachment),
-          attached_to: @attached_to || documents_attached_to,
+          attached_to: @attached_to || attachments_attached_to,
           file: signed_id_for(attachment),
           content_type: content_type_for(attachment)
         )
@@ -26,11 +26,11 @@ module Decidim
     end
 
     def attachments_invalid?
-      @documents.each do |document|
-        next if document.valid? || !document.errors.has_key?(:file)
+      @attachments.each do |attachment|
+        next if attachment.valid? || !attachment.errors.has_key?(:file)
 
-        document.errors[:file].each do |error|
-          @form.errors.add(:add_documents, error)
+        attachment.errors[:file].each do |error|
+          @form.errors.add(:add_attachments, error)
         end
 
         return true
@@ -41,37 +41,38 @@ module Decidim
 
     def create_attachments(first_weight: 0)
       weight = first_weight
-      # Add the weights first to the old documents
-      document_ids = keep_ids
-      Decidim::Attachment.where(id: document_ids).each do |document|
-        document.update!(weight:)
+      # Add the weights first to the old attachments
+      attachment_ids = keep_ids
+      Decidim::Attachment.where(id: attachment_ids).each do |attachment|
+        attachment.update!(weight:)
         weight += 1
       end
-      @documents.map! do |document|
-        document.weight = weight
-        document.attached_to = documents_attached_to
-        document.save!
+      @attachments.map! do |attachment|
+        attachment.weight = weight
+        attachment.attached_to = attachments_attached_to
+        attachment.save!
         weight += 1
-        @form.documents << document
+        @form.attachments << attachment
       end
     end
 
-    def document_cleanup!(include_all_attachments: false)
-      documents = include_all_attachments ? documents_attached_to.attachments.with_attached_file : documents_attached_to.documents
+    def attachment_cleanup!(include_all_attachments: false)
+      attachments = include_all_attachments ? attachments_attached_to.attachments.with_attached_file : attachments_attached_to.attachments
 
-      documents.each do |document|
-        document.destroy! unless keep_ids.include?(document.id)
+      attachments.each do |attachment|
+        attachment.destroy! unless keep_ids.include?(attachment.id)
       end
 
-      documents_attached_to.reload
-      documents_attached_to.instance_variable_set(:@documents, nil)
+      attachments_attached_to.reload
+      attachments_attached_to.instance_variable_set(:@attachments, nil)
+      attachments_attached_to.instance_variable_set(:@photos, nil)
     end
 
     def process_attachments?
-      @form.add_documents.any?
+      @form.add_attachments.any?
     end
 
-    def documents_attached_to
+    def attachments_attached_to
       return @attached_to if @attached_to.present?
       return form.current_organization if form.respond_to?(:current_organization)
 
@@ -101,8 +102,8 @@ module Decidim
     end
 
     def keep_ids
-      documents_array = Array(@form.documents)
-      documents_array.map do |doc|
+      attachments_array = Array(@form.attachments)
+      attachments_array.map do |doc|
         case doc
         when Decidim::Attachment
           doc.id

data/app/controllers/concerns/decidim/devise_controllers.rb

@@ -41,6 +41,10 @@ module Decidim
 
       layout "layouts/decidim/application"
 
+      # Ensure locale is set before Devise's own prepended callbacks and reset
+      # after the request finishes.
+      prepend_around_action :set_current_locale
+
       # Saves the location before loading each page so we can return to the
       # right page.
       before_action :store_current_location
@@ -58,6 +62,12 @@ module Decidim
 
         store_location_for(:user, redirect_url)
       end
+
+      def set_current_locale(&)
+        locale = detect_locale
+        locale = default_locale unless available_locales.include?(locale)
+        I18n.with_locale(locale, &)
+      end
     end
   end
 end

data/app/controllers/decidim/download_your_data_controller.rb

@@ -50,7 +50,7 @@ module Decidim
         flash[:error] = t("decidim.account.download_your_data_export.export_expired")
         redirect_to download_your_data_path
       elsif private_export.file.attached?
-        redirect_to Rails.application.routes.url_helpers.rails_blob_url(private_export.file.blob, only_path: true)
+        redirect_to private_download_path(Decidim::PrivateDownload.for(private_export, attachment_name: :file).token)
       else
         flash[:error] = t("decidim.account.download_your_data_export.file_no_exists")
         redirect_to download_your_data_path

data/app/controllers/decidim/notifications_subscriptions_controller.rb

@@ -3,6 +3,8 @@
 module Decidim
   # The controller to handle the subscriptions to push notifications
   class NotificationsSubscriptionsController < Decidim::ApplicationController
+    rescue_from Decidim::NotificationsSubscriptionsPersistor::UnsupportedPushSubscriptionEndpointError, with: :unsupported_browser
+
     def create
       Decidim::NotificationsSubscriptionsPersistor.new(current_user).add_subscription(params)
       head :ok
@@ -12,5 +14,11 @@ module Decidim
       Decidim::NotificationsSubscriptionsPersistor.new(current_user).delete_subscription(params[:auth])
       head :ok
     end
+
+    private
+
+    def unsupported_browser
+      render json: { error: I18n.t("notifications_settings.show.push_notifications_unsupported_browser", scope: "decidim") }, status: :unprocessable_entity
+    end
   end
 end

data/app/controllers/decidim/private_downloads_controller.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+module Decidim
+  class PrivateDownloadsController < Decidim::ApplicationController
+    before_action :authenticate_user!
+
+    def show
+      return head :not_found unless private_download.attached?
+      return head :not_found unless private_download.authorized_for?(current_user)
+
+      disposition = private_download.attachment.content_type.start_with?("image/") ? :inline : :attachment
+
+      send_data(
+        private_download.attachment.download,
+        filename: private_download.attachment.filename.to_s,
+        type: private_download.attachment.content_type,
+        disposition:
+      )
+    rescue Decidim::PrivateDownload::InvalidTokenError
+      head :not_found
+    end
+
+    private
+
+    def private_download
+      @private_download ||= Decidim::PrivateDownload.from_token(params[:id])
+    end
+  end
+end

data/app/jobs/decidim/process_inactive_participant_job.rb

@@ -31,13 +31,6 @@ module Decidim
     end
 
     def process_remove_user(user)
-      email = user.email
-      name = user.name
-      locale = user.locale
-      organization = user.organization
-
-      ParticipantsAccountMailer.removal_notification(email, name, locale, organization).deliver_later
-
       Decidim::DestroyAccount.call(
         Decidim::DeleteAccountForm.from_params(
           delete_reason: I18n.t("decidim.account.destroy.inactive_account_removal_reason", inactivity_period: Decidim.delete_inactive_users_after_days)

data/app/mailers/decidim/delete_user_mailer.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+module Decidim
+  class DeleteUserMailer < ApplicationMailer
+    # This email is being sent when a user deletes his own account, or when the user was inactive for too long.
+    def delete(user_email:, user_name:, locale:, organization:)
+      I18n.with_locale(locale) do
+        @user_name = user_name
+        @organization = organization
+        mail(to: user_email, subject: I18n.t("decidim.delete_user_mailer.subject"))
+      end
+    end
+  end
+end

data/app/mailers/decidim/participants_account_mailer.rb

@@ -18,21 +18,5 @@ module Decidim
         mail(to: user.email, subject:)
       end
     end
-
-    # Notify user about account removal due to inactivity
-    def removal_notification(email, name, locale, organization)
-      @email = email
-      @user_name = name
-      @organization = organization
-
-      I18n.with_locale(locale) do
-        subject = I18n.t(
-          "decidim.participants_account_mailer.removal_notification.subject",
-          organization_name: organization_name(@organization)
-        )
-
-        mail(to: email, subject:)
-      end
-    end
   end
 end

data/app/models/decidim/attachment.rb

@@ -88,7 +88,7 @@ module Decidim
     # Returns String.
     def file_type
       if file?
-        url&.split(".")&.last&.split("&")&.first&.downcase
+        file.filename.extension&.downcase
       elsif link?
         "link"
       end
@@ -100,7 +100,13 @@ module Decidim
     def url
       @url ||=
         if file?
-          attached_uploader(:file).url
+          if private_download_required?
+            Decidim::Core::Engine.routes.url_helpers.private_download_path(
+              Decidim::PrivateDownload.for(self, attachment_name: :file).token
+            )
+          else
+            attached_uploader(:file).url
+          end
         elsif link?
           link
         end
@@ -144,5 +150,17 @@ module Decidim
 
       attached_to.can_participate?(user)
     end
+
+    def private_download_authorized?(user, requested_attachment_name)
+      return false unless requested_attachment_name.to_s == "file"
+
+      can_participate?(user)
+    end
+
+    def private_download_required?
+      return attached_to.private_space? if attached_to.respond_to?(:private_space?)
+
+      attached_to.respond_to?(:component) && attached_to.component&.private_non_transparent_space?
+    end
   end
 end

data/app/models/decidim/authorization.rb

@@ -91,6 +91,13 @@ module Decidim
       Decidim::AuthorizationTransfer.perform!(self, handler)
     end
 
+    def private_download_authorized?(user, requested_attachment_name)
+      return false unless requested_attachment_name.to_s == "verification_attachment"
+      return true if user&.admin? && user.organization == organization
+
+      user == self.user
+    end
+
     private
 
     def active_handler?

data/app/models/decidim/moderation.rb

@@ -32,7 +32,7 @@ module Decidim
     end
 
     def self.ransackable_attributes(_auth_object = nil)
-      %w(reported_id_string reported_content created_at)
+      %w(reported_id_string reported_content created_at report_count)
     end
 
     def self.ransackable_associations(_auth_object = nil)

data/app/models/decidim/participatory_space_private_user.rb

@@ -39,7 +39,7 @@ module Decidim
     def self.ransackable_attributes(auth_object = nil)
       return [] unless auth_object&.admin?
 
-      %w(name nickname email invitation_accepted_at last_sign_in_at invitation_sent_at role)
+      %w(name nickname email invitation_accepted_at last_sign_in_at invitation_sent_at role published)
     end
 
     def self.ransackable_associations(_auth_object = nil)

data/app/models/decidim/private_download.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+module Decidim
+  class PrivateDownload
+    class InvalidTokenError < StandardError; end
+
+    VERIFIER_PURPOSE = :private_download
+
+    def self.for(record, attachment_name:)
+      new(record:, attachment_name:)
+    end
+
+    def self.from_token(token)
+      payload = verifier.verify(token, purpose: VERIFIER_PURPOSE).with_indifferent_access
+      record = GlobalID::Locator.locate(payload[:gid])
+
+      raise InvalidTokenError if record.blank?
+
+      new(record:, attachment_name: payload[:attachment_name])
+    rescue ActiveSupport::MessageVerifier::InvalidSignature, TypeError
+      raise InvalidTokenError
+    end
+
+    def self.verifier
+      @verifier ||= ActiveSupport::MessageVerifier.new(Rails.application.secret_key_base, serializer: JSON)
+    end
+
+    def initialize(record:, attachment_name:)
+      @record = record
+      @attachment_name = attachment_name.to_s
+    end
+
+    def token
+      self.class.verifier.generate(
+        {
+          gid: record.to_global_id.to_s,
+          attachment_name:
+        },
+        purpose: VERIFIER_PURPOSE
+      )
+    end
+
+    def attachment
+      record.public_send(attachment_name)
+    end
+
+    def attached?
+      attachment.respond_to?(:attached?) && attachment.attached?
+    end
+
+    def authorized_for?(user)
+      return false unless record.respond_to?(:private_download_authorized?)
+
+      record.private_download_authorized?(user, attachment_name)
+    end
+
+    private
+
+    attr_reader :record, :attachment_name
+  end
+end

data/app/models/decidim/private_export.rb

@@ -24,5 +24,11 @@ module Decidim
       self.content_type = file.content_type
       self.file_size = file.byte_size
     end
+
+    def private_download_authorized?(user, requested_attachment_name)
+      return false unless requested_attachment_name.to_s == "file"
+
+      attached_to == user
+    end
   end
 end