decidim-core 0.31.6 → 0.31.8

data/app/validators/uploader_image_content_validator.rb

@@ -0,0 +1,278 @@
+# frozen_string_literal: true
+
+# This validator ensures that files declared as images actually contain valid
+# image data of the declared format. It does so by checking the leading bytes
+# (magic bytes / file signature) of the file against the known signatures of
+# the supported image formats, and by comparing the detected format with the
+# content type declared by the file.
+#
+# This prevents non-image files (e.g. HTML, MATLAB, or arbitrary binary data)
+# from being uploaded with an image extension and a spoofed image content type.
+# Such files would later cause image processing to fail (e.g. in ImageMagick or
+# in libvips when generating a variant) and could lead to a denial of service.
+#
+# Comparing the detected format with the declared content type also prevents
+# files whose contents do not match their declaration (e.g. a JPEG file
+# declared as image/png), so that the stored MIME type is consistent with the
+# file contents.
+#
+# SVG documents are XML-based and can contain scripts and other active content,
+# which is executed when the document is rendered by the browser. Because of
+# that, the contents of files detected as SVG are additionally validated by
+# Decidim::SvgContentValidator, so that documents which could execute scripts
+# or read external resources are rejected instead of being stored as they are.
+class UploaderImageContentValidator < ActiveModel::Validations::FileContentTypeValidator
+  # The number of leading bytes to read from the file to detect its signature.
+  SIGNATURE_LENGTH = 128
+
+  # The known signatures of the supported binary image formats. Each entry
+  # associates a format with a list of [offset, bytes] pairs that must all
+  # match at their respective offsets for the file to be considered of that
+  # format.
+  BINARY_IMAGE_SIGNATURES = [
+    [:png, [[0, "\x89PNG\r\n\x1A\n".b]]],
+    [:jpeg, [[0, "\xFF\xD8\xFF".b]]],
+    [:gif, [[0, "GIF87a".b]]],
+    [:gif, [[0, "GIF89a".b]]],
+    [:bmp, [[0, "BM".b]]],
+    [:tiff, [[0, "II*\x00".b]]],
+    [:tiff, [[0, "MM\x00*".b]]],
+    [:webp, [[0, "RIFF".b], [8, "WEBP".b]]],
+    [:ico, [[0, "\x00\x00\x01\x00".b]]]
+  ].freeze
+
+  # The major brands of the ISOBMFF "ftyp" box that identify HEIF and AVIF
+  # images. These formats share the same leading layout as other "ftyp" files
+  # (e.g. MP4 video), so the brand at offset 8 is used to tell images apart.
+  # The brands are grouped per format family, because HEIF files may use any
+  # of the HEIF brands regardless of their extension (e.g. a ".heic" file
+  # with the "mif1" major brand).
+  FTYPE_IMAGE_BRANDS = {
+    heif: %w(heic heix hevc hevx mif1 msf1).map(&:b).freeze,
+    avif: %w(avif avis).map(&:b).freeze
+  }.freeze
+
+  # The leading markup of an SVG document, which is XML-based and therefore has
+  # no fixed binary signature.
+  SVG_SIGNATURES = ["<svg".b, "<?xml".b, "<!DOCTYPE svg".b].freeze
+
+  # The content types accepted for each image format detected from the file
+  # signature. The content type declared by the file must be one of these, so
+  # that the stored MIME type is consistent with the file contents. The lists
+  # include the aliases commonly used in the wild for the same format.
+  FORMAT_CONTENT_TYPES = {
+    png: %w(image/png),
+    jpeg: %w(image/jpeg image/jpg image/pjpeg),
+    gif: %w(image/gif),
+    bmp: %w(image/bmp image/x-ms-bmp image/windows-bmp),
+    tiff: %w(image/tiff image/x-tiff),
+    webp: %w(image/webp),
+    ico: %w(image/vnd.microsoft.icon image/x-icon image/ico image/icon),
+    heif: %w(image/heic image/heif image/heic-sequence image/heif-sequence),
+    avif: %w(image/avif image/avis),
+    svg: %w(image/svg+xml)
+  }.freeze
+
+  def validate_each(record, attribute, value)
+    begin
+      values = parse_values(value)
+    rescue JSON::ParserError
+      record.errors.add attribute, :invalid
+      return
+    end
+
+    return if values.empty?
+
+    values.each do |val|
+      validate_image_content(record, attribute, val)
+    end
+  end
+
+  def check_validity!; end
+
+  private
+
+  def validate_image_content(record, attribute, file)
+    content_type = normalize_content_type(declared_content_type(file))
+    return unless content_type.start_with?("image/")
+
+    signature = file_signature(file)
+    return if signature.nil?
+
+    detected = image_format(signature)
+    return add_invalid_image(record, attribute) unless valid_image_format?(detected, content_type)
+
+    validate_svg_content(record, attribute, file) if detected == :svg
+  end
+
+  # The content type declared by the file, either through the blob of an
+  # attached file or through the upload itself.
+  def declared_content_type(file)
+    if file.is_a?(ActiveStorage::Attached)
+      file.blob&.content_type
+    else
+      file.try(:content_type)
+    end
+  end
+
+  # Strips the content type parameters (e.g. "image/png;charset=binary") and
+  # normalizes the casing, as content types are case insensitive.
+  def normalize_content_type(content_type)
+    content_type.to_s.split(";", 2).first.to_s.strip.downcase
+  end
+
+  # Whether the format detected from the file signature is one of the
+  # supported image formats and is consistent with the content type declared
+  # by the file.
+  def valid_image_format?(detected, content_type)
+    return false if detected.nil?
+
+    FORMAT_CONTENT_TYPES.fetch(detected).include?(content_type)
+  end
+
+  # Validates the contents of a file detected as SVG, which can contain active
+  # content. The validation is delegated to Decidim::SvgContentValidator, so
+  # that the SVG specific logic is kept out of this validator. Documents which
+  # are not well formed SVG documents are rejected as invalid images, and the
+  # ones which could execute scripts or read external resources when they are
+  # rendered are rejected as unsafe files.
+  def validate_svg_content(record, attribute, file)
+    case Decidim::SvgContentValidator.validate(file_content(file))
+    when :invalid
+      add_invalid_image(record, attribute)
+    when :unsafe
+      add_unsafe_svg(record, attribute)
+    end
+  end
+
+  def add_invalid_image(record, attribute)
+    record.errors.add attribute, I18n.t("decidim.errors.files.file_is_not_a_valid_image")
+  end
+
+  def add_unsafe_svg(record, attribute)
+    record.errors.add attribute, I18n.t("decidim.errors.files.file_contains_unsafe_content")
+  end
+
+  # Reads the leading bytes (signature) of the file. Returns nil when the file
+  # cannot be read, in which case the validation is skipped. Empty files yield
+  # an empty signature, which is rejected.
+  def file_signature(file)
+    read_file(file, SIGNATURE_LENGTH)
+  end
+
+  # Reads the whole contents of the file. Returns nil when the file cannot be
+  # read.
+  def file_content(file)
+    read_file(file)
+  end
+
+  # Reads the contents of the file, or only its leading bytes when a maximum
+  # length is given.
+  def read_file(file, max_length = nil)
+    if uploaded_file?(file)
+      File.open(file.path, "rb") { |io| read_io(io, max_length) }
+    elsif file.is_a?(ActiveStorage::Attached)
+      read_attached(file, max_length)
+    end
+  rescue ActiveStorage::Error, Errno::ENOENT, IOError
+    nil
+  end
+
+  # Reads the contents of an IO, or only its leading bytes when a maximum
+  # length is given. IO#read returns nil at the end of the file, so an empty
+  # file would otherwise be indistinguishable from an unreadable one and skip
+  # the validation. Normalizing it to an empty content keeps empty files
+  # rejected, while nil is kept for files which cannot be read at all.
+  def read_io(io, max_length = nil)
+    (max_length ? io.read(max_length) : io.read) || ""
+  end
+
+  # Reads the contents of an attached file. Blobs are only uploaded once the
+  # record is saved, so for still unpersisted blobs (e.g. an image assigned to
+  # a new record) the bytes are read from the pending attachable. Otherwise a
+  # spoofed image could be saved without being checked.
+  def read_attached(attached, max_length = nil)
+    blob = attached.blob
+    return read_blob(blob, max_length) if blob&.persisted?
+
+    read_pending_attachable(attached, max_length)
+  end
+
+  # ActiveStorage keeps the attachable of a pending attachment in the record's
+  # attachment changes until the blob is uploaded when the record is saved, so
+  # its contents can already be read during the validation.
+  def read_pending_attachable(attached, max_length = nil)
+    attachable = pending_attachable(attached)
+    if uploaded_file?(attachable) || attachable.is_a?(File)
+      File.open(attachable.path, "rb") { |io| read_io(io, max_length) }
+    elsif attachable.is_a?(Pathname)
+      File.open(attachable.to_path, "rb") { |io| read_io(io, max_length) }
+    elsif attachable.is_a?(Hash)
+      read_io_without_consuming(attachable[:io], max_length)
+    end
+  end
+
+  def pending_attachable(attached)
+    change = attached.record.try(:attachment_changes)&.[](attached.name.to_s)
+    change.try(:attachable)
+  end
+
+  # Reads the contents without consuming the IO, so ActiveStorage can still
+  # upload it after the validation.
+  def read_io_without_consuming(io, max_length = nil)
+    return unless io.respond_to?(:read) && io.respond_to?(:rewind)
+
+    io.rewind
+    content = read_io(io, max_length)
+    io.rewind
+    content
+  end
+
+  # Reads the whole contents of the blob, or only its leading bytes when a
+  # maximum length is given to keep the operation cheap for large files. The
+  # services return nil when the blob is empty, which is normalized to an
+  # empty content so that empty blobs are rejected. Falls back to opening the
+  # whole blob when the service does not support ranged downloads.
+  def read_blob(blob, max_length = nil)
+    return blob.download if max_length.nil?
+
+    blob.download_chunk(0...max_length) || ""
+  rescue NotImplementedError
+    blob.open { |io| read_io(io, max_length) }
+  end
+
+  # The image format detected from the file signature, or nil when the
+  # signature does not match any of the supported image formats.
+  def image_format(signature)
+    return nil if signature.blank?
+
+    binary_image_format(signature) || ftyp_image_format(signature) || svg_format(signature)
+  end
+
+  def binary_image_format(signature)
+    BINARY_IMAGE_SIGNATURES.find do |_format, pairs|
+      pairs.all? { |offset, bytes| signature[offset, bytes.bytesize] == bytes }
+    end&.first
+  end
+
+  # The format of an ISOBMFF-based image (HEIF or AVIF). These files start with
+  # a "ftyp" box at offset 4 followed by a major brand at offset 8.
+  def ftyp_image_format(signature)
+    return nil unless signature[4, 4] == "ftyp".b
+
+    FTYPE_IMAGE_BRANDS.find { |_format, brands| brands.include?(signature[8, 4]) }&.first
+  end
+
+  def svg_format(signature)
+    content = signature.sub(/\A\xEF\xBB\xBF/n, "").lstrip
+    return nil unless SVG_SIGNATURES.any? { |svg_signature| content.start_with?(svg_signature) }
+
+    :svg
+  end
+
+  def uploaded_file?(file)
+    return true if defined?(Rack::Test::UploadedFile) && file.is_a?(Rack::Test::UploadedFile)
+
+    file.is_a?(ActionDispatch::Http::UploadedFile)
+  end
+end

data/app/views/decidim/application/_radio_accordion.html.erb

@@ -12,7 +12,7 @@
   </label>
 
   <div data-controller="accordion" class="radio-accordion-section content-block__description editor-content">
-    <div id="panel-title--<%= panel_id %>" aria-hidden="true">
+    <div id="panel-title--<%= panel_id %>" aria-hidden="true" inert>
       <%= yield %>
     </div>
 
@@ -21,10 +21,6 @@
         <%= show_more_text %>
       </span>
       <%= icon "arrow-down-s-line" %>
-      <span>
-        <%= show_less_text %>
-      </span>
-      <%= icon "arrow-up-s-line" %>
     </button>
   </div>
 </div>

data/app/views/decidim/messaging/conversations/create.js.erb

@@ -1,3 +1 @@
-$("#messages").append("<%= j(render "messages", sender: conversation.messages.first.sender, messages: [conversation.messages.first]).html_safe %>");
-$("div[data-add-message]").replaceWith("<%= j(render "reply", form:, conversation:).html_safe %>");
-window.initFoundation($("#new_message_"));
+window.location.href = "<%= conversation_path(conversation) %>";

data/app/views/decidim/searches/_filters.html.erb

@@ -16,7 +16,7 @@
         </button>
       <% end %>
     </div>
-    <button id="dropdown-trigger-search" data-controller="dropdown" data-target="dropdown-menu-search" data-auto-close="true" aria-expanded="true">
+    <button id="dropdown-trigger-search" data-controller="dropdown" data-target="dropdown-menu-search" data-auto-close="true">
       <%= content_tag :span, t("decidim.searches.filters_small_view.filter_by"), class: "#{"is-active" if params.dig(:filter, :with_resource_type) == nil}" %>
       <% @blocks.each do |elements| %>
         <% elements.each do |type, results| %>

data/app/views/decidim/shared/_login_modal.html.erb

@@ -9,11 +9,9 @@
   %>
 
   <%= decidim_form_for(Decidim::User.new, namespace: "login", as: :user, url: path, html: { class: nil }) do |f| %>
-    <div>
-      <div class="flex flex-row">
-        <%= icon "user-line", class: "w-6 h-6 text-gray fill-current" %>
-        <h3 id="dialog-title-loginModal" class="h3 ml-1"><%= t(".please_log_in") %></h3>
-      </div>
+    <div data-dialog-container>
+      <%= icon "user-line" %>
+      <h3 id="dialog-title-loginModal" tabindex="-1" data-dialog-title><%= t(".please_log_in") %></h3>
 
       <div>
         <% if current_organization.sign_in_enabled? %>
@@ -44,16 +42,16 @@
             <%= render partial: "decidim/devise/shared/omniauth_buttons", locals: { is_horizontal: true } %>
           <% end %>
         <% end %>
-        <% if current_organization.sign_in_enabled? %>
-          <div data-dialog-actions>
-            <div class="form__wrapper-block w-full mb-4">
-              <button type="submit" class="button button__lg button__secondary">
-                <%= t("devise.sessions.new.log_in") %>
-              </button>
-            </div>
-          </div>
-        <% end %>
       </div>
     </div>
+    <% if current_organization.sign_in_enabled? %>
+      <div data-dialog-actions>
+        <div class="form__wrapper-block w-full mb-4">
+          <button type="submit" class="button button__lg button__secondary">
+            <%= t("devise.sessions.new.log_in") %>
+          </button>
+        </div>
+      </div>
+    <% end %>
   <% end %>
 <% end %>

data/app/views/layouts/decidim/_mailer_logo.html.erb

@@ -8,7 +8,7 @@
     <% if organization.logo.attached? %>
       <%= image_tag(
             organization.attached_uploader(:logo).variant_url(:medium, host: organization.host),
-            style: "max-height: 50px",
+            style: "max-height: 50px; display: inline-block",
             alt: organization_name(organization)
           ) %>
     <% else %>

data/app/views/layouts/decidim/footer/_main.html.erb

@@ -3,7 +3,7 @@
     <div class="lg:w-1/3">
       <%= render partial: "layouts/decidim/footer/main_intro" %>
     </div>
-    <div class="lg:w-2/3 grid grid-cols-1 gap-x-4 gap-y-10 lg:grid-cols-4 text-md text-white">
+    <div class="lg:w-2/3 grid grid-cols-1 gap-x-4 lg:grid-cols-4 text-md text-white">
       <%= render partial: "layouts/decidim/footer/main_links" %>
     </div>
   </div>

data/app/views/layouts/decidim/footer/_main_links.html.erb

@@ -1,31 +1,59 @@
-<%= footer_menu.render %>
+<div data-controller="accordion" data-multiselectable="true" class="contents">
+  <nav class="footer__nav" role="navigation" aria-label="<%= t("layouts.decidim.footer.decidim_title") %>">
+    <button type="button" id="panel-footer-menu-trigger" data-controls="panel-footer-menu" data-open-lg="true">
+      <span class="h4"><%= t("layouts.decidim.footer.decidim_title") %></span>
+      <%= icon "arrow-down-s-line" %>
+    </button>
+    <div id="panel-footer-menu" aria-hidden="true">
+      <%= footer_menu.render_menu_items %>
+    </div>
+  </nav>
 
-<nav role="navigation" aria-label="<%= t("layouts.decidim.user_menu.profile") %>">
-  <h2 class="h4 mb-4"><%= t("layouts.decidim.user_menu.profile") %></h2>
-  <ul class="space-y-4 break-inside-avoid">
-    <% if current_user %>
-      <li class="font-semibold underline"><%= link_to t("layouts.decidim.user_menu.configuration"), decidim.account_path %></li>
-      <li class="font-semibold underline"><%= link_to t("layouts.decidim.user_menu.public_profile"), decidim.profile_path(current_user.nickname) %></li>
-      <li class="font-semibold underline"><%= link_to t("layouts.decidim.user_menu.notifications"), decidim.notifications_path %></li>
-      <li class="font-semibold underline"><%= link_to t("layouts.decidim.user_menu.conversations"), decidim.conversations_path %></li>
-    <% else %>
-      <% if current_organization.sign_up_enabled? %>
-        <li class="font-semibold underline"><%= link_to t("layouts.decidim.footer.sign_up"), decidim.new_user_registration_path %></li>
-      <% end %>
-      <li class="font-semibold underline"><%= link_to t("layouts.decidim.footer.log_in"), decidim.new_user_session_path %></li>
-    <% end %>
-  </ul>
-</nav>
+  <nav class="footer__nav" role="navigation" aria-label="<%= t("layouts.decidim.user_menu.profile") %>">
+    <button type="button" id="panel-profile-trigger" data-controls="panel-profile" data-open-lg="true">
+      <span class="h4"><%= t("layouts.decidim.user_menu.profile") %></span>
+      <%= icon "arrow-down-s-line" %>
+    </button>
+    <div id="panel-profile" aria-hidden="true">
+      <ul>
+        <% if current_user %>
+          <li><%= link_to t("layouts.decidim.user_menu.configuration"), decidim.account_path %></li>
+          <li><%= link_to t("layouts.decidim.user_menu.public_profile"), decidim.profile_path(current_user.nickname) %></li>
+          <li><%= link_to t("layouts.decidim.user_menu.notifications"), decidim.notifications_path %></li>
+          <li><%= link_to t("layouts.decidim.user_menu.conversations"), decidim.conversations_path %></li>
+        <% else %>
+          <% if current_organization.sign_up_enabled? %>
+            <li><%= link_to t("layouts.decidim.footer.sign_up"), decidim.new_user_registration_path %></li>
+          <% end %>
+          <li><%= link_to t("layouts.decidim.footer.log_in"), decidim.new_user_session_path %></li>
+        <% end %>
+      </ul>
+    </div>
+  </nav>
 
-<nav role="navigation" aria-label="<%= t("layouts.decidim.footer.resources") %>">
-  <h2 class="h4 mb-4"><%= t("layouts.decidim.footer.resources") %></h2>
-  <ul class="space-y-4 break-inside-avoid">
-    <li class="font-semibold underline"><%= link_to t("decidim.profiles.show.activity"), decidim.last_activities_path %></li>
-    <% if Decidim.module_installed?(:meetings) %>
-      <li class="font-semibold underline"><%= link_to t("decidim.pages.home.extended.meetings"), Decidim::Meetings::DirectoryEngine.routes.url_helpers.root_path %></li>
-    <% end %>
-    <li class="font-semibold underline"><%= link_to t("layouts.decidim.footer.open_data"), decidim.open_data_path %></li>
-  </ul>
-</nav>
+  <nav class="footer__nav" role="navigation" aria-label="<%= t("layouts.decidim.footer.resources") %>">
+    <button type="button" id="panel-resources-trigger" data-controls="panel-resources" data-open-lg="true">
+      <span class="h4"><%= t("layouts.decidim.footer.resources") %></span>
+      <%= icon "arrow-down-s-line" %>
+    </button>
+    <div id="panel-resources" aria-hidden="true">
+      <ul>
+        <li><%= link_to t("decidim.profiles.show.activity"), decidim.last_activities_path %></li>
+        <% if Decidim.module_installed?(:meetings) %>
+          <li><%= link_to t("decidim.pages.home.extended.meetings"), Decidim::Meetings::DirectoryEngine.routes.url_helpers.root_path %></li>
+        <% end %>
+        <li><%= link_to t("layouts.decidim.footer.open_data"), decidim.open_data_path %></li>
+      </ul>
+    </div>
+  </nav>
 
-<%= cell("decidim/footer_topics", nil) %>
+  <nav class="footer__nav" role="navigation" aria-label="<%= t("layouts.decidim.footer.help") %>">
+    <button type="button" id="panel-help-trigger" data-controls="panel-help" data-open-lg="true">
+      <span class="h4"><%= t("layouts.decidim.footer.help") %></span>
+      <%= icon "arrow-down-s-line" %>
+    </button>
+    <div id="panel-help" aria-hidden="true">
+      <%= cell("decidim/footer_topics", nil) %>
+    </div>
+  </nav>
+</div>

data/config/initializers/rack_attack.rb

@@ -34,6 +34,16 @@ if Rails.env.production? || Rails.env.test?
       Rack::Attack.throttle("limit password recovery attempts per email", limit: 5, period: 60.seconds) do |request|
         request.params["user"]["email"] if request.path == "/users/password" && request.post?
       end
+
+      # Throttle SMS verification confirmation attempts per IP to 10 reqs/minute
+      Rack::Attack.throttle("limit sms verification attempts per ip", limit: 10, period: 60.seconds) do |request|
+        request.ip if request.path.match?(%r{^/[^/]+/sms/authorizations(?:\.[^/]+)?$}) && request.put?
+      end
+
+      # Throttle postal letter verification confirmation attempts per IP to 10 reqs/minute
+      Rack::Attack.throttle("limit postal letter verification attempts per ip", limit: 10, period: 60.seconds) do |request|
+        request.ip if request.path.match?(%r{^/[^/]+/postal_letter/authorizations(?:\.[^/]+)?$}) && request.put?
+      end
     end
   end
 end

data/config/locales/ar.yml

@@ -544,13 +544,9 @@ ar:
           affected_user:
             email_intro: 'تم قبول التعديل لمدة %{amendable_title}. يمكنك أن ترى ذلك من هذه الصفحة:'
             email_outro: لقد تلقيت هذا الإشعار لأنك مؤلف برقم %{amendable_title}.
-            email_subject: تم قبول التعديل من %{amendable_title} من %{emendation_author_nickname}
-            notification_title: تم قبول التعديل <a href="%{emendation_path}"></a> تم إنشاؤه بواسطة <a href="%{emendation_author_path}">%{emendation_author_nickname}</a> لمدة <a href="%{amendable_path}">%{amendable_title}</a>.
           follower:
             email_intro: 'تم قبول التعديل لمدة %{amendable_title}. يمكنك أن ترى ذلك من هذه الصفحة:'
             email_outro: لقد تلقيت هذا الإشعار لأنك تتابع %{amendable_title}. يمكنك إيقاف تلقي الإخطارات باتباع الرابط السابق.
-            email_subject: تم قبول التعديل من %{amendable_title} من %{emendation_author_nickname}
-            notification_title: تم قبول التعديل <a href="%{emendation_path}"></a> تم إنشاؤه بواسطة <a href="%{emendation_author_path}">%{emendation_author_nickname}</a> لمدة <a href="%{amendable_path}">%{amendable_title}</a>.
         amendment_created:
           affected_user:
             email_intro: 'تم إنشاء تعديل جديد لـ %{amendable_title}. يمكنك أن ترى ذلك من هذه الصفحة:'
@@ -566,29 +562,20 @@ ar:
           affected_user:
             email_intro: 'تم نشر تعديل مرفوض لـ %{amendable_title} باعتباره %{amendable_type}جديد. يمكنك أن ترى ذلك من هذه الصفحة:'
             email_outro: لقد تلقيت هذا الإشعار لأنك مؤلف برقم %{amendable_title}.
-            email_subject: تم نشر تعديل من %{emendation_author_nickname} كـ %{amendable_type}جديد
-            notification_title: A <a href="%{emendation_path}">رفض التعديل</a> لل <a href="%{amendable_path}">%{amendable_title}</a> تم نشره باعتباره الجديدة %{amendable_type} من <a href="%{emendation_author_path}">%{emendation_author_nickname}</a>.
           follower:
             email_intro: 'تم نشر تعديل مرفوض لـ %{amendable_title} باعتباره %{amendable_type}جديد. يمكنك أن ترى ذلك من هذه الصفحة:'
             email_outro: لقد تلقيت هذا الإشعار لأنك تتابع %{amendable_title}. يمكنك إيقاف تلقي الإخطارات باتباع الرابط السابق.
-            email_subject: تم نشر تعديل من %{emendation_author_nickname} كـ %{amendable_type}جديد
-            notification_title: A <a href="%{emendation_path}">رفض التعديل</a> لل <a href="%{amendable_path}">%{amendable_title}</a> تم نشره باعتباره الجديدة %{amendable_type} من <a href="%{emendation_author_path}">%{emendation_author_nickname}</a>.
         amendment_rejected:
           affected_user:
             email_intro: 'تم رفض التعديل لمدة %{amendable_title}. يمكنك أن ترى ذلك من هذه الصفحة:'
             email_outro: لقد تلقيت هذا الإشعار لأنك مؤلف برقم %{amendable_title}.
-            email_subject: تم رفض التعديل لـ %{amendable_title} من %{emendation_author_nickname}
-            notification_title: تم رفض التعديل <a href="%{emendation_path}"></a> تم إنشاؤه بواسطة <a href="%{emendation_author_path}">%{emendation_author_nickname}</a> لـ <a href="%{amendable_path}">%{amendable_title}</a>.
           follower:
             email_intro: 'تم رفض التعديل لمدة %{amendable_title}. يمكنك أن ترى ذلك من هذه الصفحة:'
             email_outro: لقد تلقيت هذا الإشعار لأنك تتابع %{amendable_title}. يمكنك إيقاف تلقي الإخطارات باتباع الرابط السابق.
-            email_subject: تم رفض التعديل لـ %{amendable_title} من %{emendation_author_nickname}
-            notification_title: تم رفض التعديل <a href="%{emendation_path}"></a> تم إنشاؤه بواسطة <a href="%{emendation_author_path}">%{emendation_author_nickname}</a> لـ <a href="%{amendable_path}">%{amendable_title}</a>.
         emendation_promoted:
           follower:
             email_intro: 'تم نشر تعديل لـ %{amendable_title}. يمكنك رؤيته من هذه الصفحة:'
             email_outro: لقد تلقيت هذا الإشعار لأنك مؤلف %{amendable_title}.
-            email_subject: تم نشر تعديل من قبل %{emendation_author_nickname} كـ %{amendable_type} جديد
       attachments:
         attachment_created:
           email_intro: 'تمت إضافة مستند جديد إلى %{resource_title}. يمكنك أن ترى ذلك من هذه الصفحة:'
@@ -619,16 +606,9 @@ ar:
           notification_title: |-
             قام مسؤول بإزالة %{resource_type} لأنه تم الإبلاغ عنه كـ %{report_reasons}.</br><i>%{resource_content}</i>
       users:
-        profile_updated:
-          email_intro: و <a href="%{resource_url}">صفحة الملف الشخصي</a> من %{name} (%{nickname})، الذي كنت التالية، وقد تم تحديثها.
-          email_outro: لقد تلقيت هذا الإشعار لأنك تتابع %{nickname}. يمكنك إيقاف تلقي الإخطارات باتباع الرابط السابق.
-          email_subject: "%{nickname} تحديث ملفهم الشخصي"
-          notification_title: و <a href="%{resource_path}">صفحة الملف الشخصي</a> من %{name} (%{nickname})، الذي كنت التالية، وقد تم تحديثها.
         user_officialized:
-          email_intro: تم إضفاء الطابع الرسمي على المشارك %{name} (%{nickname}).
           email_outro: تلقيت هذا الإشعار لأنك مدير في هذه المنظمة.
           email_subject: "تم إضفاء الطابع الرسمي على %{name}"
-          notification_title: تم إضفاء الطابع الرسمي على المشارك %{name} (%{nickname}).
     export_mailer:
       download_your_data_export:
         download: تحميل

data/config/locales/bg.yml

@@ -643,13 +643,9 @@ bg:
           affected_user:
             email_intro: 'Приета е поправка в %{amendable_title}. Можете да я видите на тази страница:'
             email_outro: Получавате това известие, защото сте автор на %{amendable_title}.
-            email_subject: Приета е поправка в %{amendable_title} от %{emendation_author_nickname}
-            notification_title: <a href="%{emendation_path}">Поправката</a> направена от <a href="%{emendation_author_path}">%{emendation_author_nickname}</a> е приета за <a href="%{amendable_path}">%{amendable_title}</a>.
           follower:
             email_intro: 'Приета е поправка в %{amendable_title}. Можете да я видите на тази страница:'
             email_outro: Получавате това известие, защото следвате %{amendable_title}. Може да прекратите известията чрез предната връзка.
-            email_subject: Приета е поправка в %{amendable_title} от %{emendation_author_nickname}
-            notification_title: <a href="%{emendation_path}">Поправката</a> направена от <a href="%{emendation_author_path}">%{emendation_author_nickname}</a> е приета за <a href="%{amendable_path}">%{amendable_title}</a>.
         amendment_created:
           affected_user:
             email_intro: 'Нова поправка е създадена в %{amendable_title}. Можете да я видите на тази страница:'
@@ -665,24 +661,16 @@ bg:
           affected_user:
             email_intro: 'Отхвърлена поправка в %{amendable_title} е публикувана като нов %{amendable_type}. Можете да видите на тази страница:'
             email_outro: Получавате това известие, защото сте автор на %{amendable_title}.
-            email_subject: Поправка на %{emendation_author_nickname} е публикувана като нов %{amendable_type}
-            notification_title: Отхвърлената <a href="%{emendation_path}">поправка</a> в <a href="%{amendable_path}">%{amendable_title}</a> беше публикувана като нов %{amendable_type} от <a href="%{emendation_author_path}">%{emendation_author_nickname}</a>.
           follower:
             email_intro: 'Отхвърлена поправка в %{amendable_title} е публикувана като нов %{amendable_type}. Можете да видите на тази страница:'
             email_outro: Получавате това известие, защото следвате %{amendable_title}. Може да прекратите известията чрез предната връзка.
-            email_subject: Поправка на %{emendation_author_nickname} е публикувана като нов %{amendable_type}
-            notification_title: Отхвърлената <a href="%{emendation_path}">поправка</a> в <a href="%{amendable_path}">%{amendable_title}</a> беше публикувана като нов %{amendable_type} от <a href="%{emendation_author_path}">%{emendation_author_nickname}</a>.
         amendment_rejected:
           affected_user:
             email_intro: 'Поправка е отхвърлена в %{amendable_title}. Можете да я видите на тази страница:'
             email_outro: Получавате това известие, защото сте автор на %{amendable_title}.
-            email_subject: Отхвърлена е поправка в %{amendable_title} от %{emendation_author_nickname}
-            notification_title: <a href="%{emendation_path}">Поправката</a> направена от <a href="%{emendation_author_path}">%{emendation_author_nickname}</a> е отхвърлена за <a href="%{amendable_path}">%{amendable_title}</a>.
           follower:
             email_intro: 'Поправка е отхвърлена в %{amendable_title}. Можете да я видите на тази страница:'
             email_outro: Получавате това известие, защото следвате %{amendable_title}. Може да прекратите известията чрез предната връзка.
-            email_subject: Отхвърлена е поправка в %{amendable_title} от %{emendation_author_nickname}
-            notification_title: <a href="%{emendation_path}">Поправката</a> направена от <a href="%{emendation_author_path}">%{emendation_author_nickname}</a> е отхвърлена за <a href="%{amendable_path}">%{amendable_title}</a>.
       attachments:
         attachment_created:
           email_intro: 'Нов документ е създаден в %{resource_title}. Можете да го видите на тази страница:'
@@ -724,16 +712,9 @@ bg:
             Администратор премахна вашия %{resource_type}, защото е докладван като %{report_reasons}.</br>
             <i>%{resource_content}</i>
       users:
-        profile_updated:
-          email_intro: Профилната <a href="%{resource_url}">страница</a> на %{name} (%{nickname}), който следвате е обновена.
-          email_outro: Получавате това известие, защото следвате %{nickname}. Може да прекратите известията чрез предната връзка.
-          email_subject: "%{nickname} обнови своя профил"
-          notification_title: Профилната <a href="%{resource_path}">страница</a> на %{name} (%{nickname}), който следвате е обновена.
         user_officialized:
-          email_intro: Участник %{name} (%{nickname}) е официален.
           email_outro: Получихте това известие, защото сте администратор на организацията.
           email_subject: "%{name} е официализиран"
-          notification_title: Участник %{name} (%{nickname}) е официализиран.
     export_mailer:
       download_your_data_export:
         download: Сваляне
@@ -1527,7 +1508,6 @@ bg:
   layouts:
     decidim:
       announcements:
-        view_less: Покажи по-малко
         view_more: Още информация
       data_consent:
         details: