decidim-core 0.31.7 → 0.31.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cdd2ee47aebc30f3404fc92bd9b5954c1dfae6cdadbbd19d28d495f7939ce3d8
-  data.tar.gz: 150625ae419f2acc7f6c8068ef743c7249cee604a36a14965917e940ec5b393a
+  metadata.gz: da2944b3eea9b97a316575553e82c7e4a14c3b2e98da84253af02ef05d4a01cc
+  data.tar.gz: 3e68f90d8259e679f17a9e13811dce598970c90592d9b40fbf281ea89419783c
 SHA512:
-  metadata.gz: c8eb46226c485aa8e26c65b6a35213d73ba3928a47f4e8262816b30be044252cbc4ecc8be8bf70377e0787e5f50eb2d848fde571c26ddb0f33ee62068a3e9d0d
-  data.tar.gz: 012df3885eb89cc74df00a64f599cae1918d4ab9d40675b1444958dbf6ba07694a3770cdc236af3628856c9e97dfc5b809fbed1ecb475fbbb93952a4067d72ee
+  metadata.gz: bcf39a24518f3d8e7ee79b5fa148bd884e58a7b209b87cafdc0ca447a7d9b22a207a33d535e42507fdac7cf0a8b18dc9d171a042272cf6c273939f292f4723f8
+  data.tar.gz: 68c57967364106483e793c7e89030bc661124ac5ce42437e47b5084c12713f26b237556559e1c71fd65c53871a282ed2c72383ffad4d2db7501249506031b8c8

data/app/cells/decidim/content_blocks/participatory_space_main_data/title.erb

@@ -23,15 +23,11 @@
         <% end %>
       </div>
 
-      <button class="button button__sm button__text-secondary mt-2" data-controls="panel-view-more-<%= seed %>" aria-expanded="false" onclick="document.querySelector('div[id^=panel-view-more]').toggleAttribute('inert')">
+      <button class="button button__sm button__text-secondary mt-2" data-controls="panel-view-more-<%= seed %>" aria-expanded="false">
         <span>
           <%= t("view_more", scope: "layouts.decidim.announcements") %>
         </span>
         <%= icon "arrow-down-s-line" %>
-        <span>
-          <%= t("view_less", scope: "layouts.decidim.announcements") %>
-        </span>
-        <%= icon "arrow-up-s-line" %>
       </button>
     <% else %>
       <% if rich_text_processors? %>
@@ -42,12 +38,3 @@
     <% end %>
   </div>
 <% end %>
-<script>
-  const button = document.querySelector('button[data-controls^="panel-view-more"]')
-  button.addEventListener('keydown', function(e){
-    // press space or enter
-    if (e.keyCode === 32 || e.keyCode === 13){
-      document.querySelector('div[id^=panel-view-more]').toggleAttribute('inert')
-    }
-  })
-</script>

data/app/cells/decidim/following_cell.rb

@@ -11,7 +11,7 @@ module Decidim
     end
 
     def public_followings
-      @public_followings ||= Kaminari.paginate_array(model.public_users_followings).page(params[:page]).per(20)
+      @public_followings ||= model.public_users_followings.page(params[:page]).per(20)
     end
 
     def non_public_followings?

data/app/cells/decidim/nav_links/show.erb

@@ -8,7 +8,9 @@
     <% model.each do |item| %>
       <li>
         <%= link_to item[:url], class: "participatory-space__nav-item" do %>
-          <%= decidim_escape_translated(item[:name]) %>
+          <span class="participatory-space__nav-label">
+            <%= decidim_escape_translated(item[:name]) %>
+          </span>
           <%= icon "arrow-right-line" %>
         <% end %>
       </li>

data/app/cells/decidim/participatory_space_private_user/show.erb

@@ -15,7 +15,7 @@
     <% end %>
 
     <div class="mt-3">
-      <span class="text-gray-2 capitalize font-semibold">
+      <span class="text-gray-2 font-semibold">
         <%= role_translated %>
       </span>
     </div>

data/app/cells/decidim/share_text_widget/modal.erb

@@ -1,5 +1,6 @@
 <%= decidim_modal id: "socialShare", class: "share-modal" do %>
   <div data-dialog-container>
+    <%= icon "share-line" %>
     <h2 id="dialog-title-socialShare" tabindex="-1" data-dialog-title><%= t("share", scope: "decidim.shared.share_modal") %></h2>
 
     <div>

data/app/cells/decidim/share_widget/modal.erb

@@ -1,5 +1,6 @@
 <%= decidim_modal id: "socialShare", class: "share-modal" do %>
   <div data-dialog-container>
+    <%= icon "share-line" %>
     <h2 id="dialog-title-social-share-modal" tabindex="-1" data-dialog-title><%= t("share", scope: "decidim.shared.share_modal") %></h2>
 
     <div>

data/app/cells/decidim/share_widget/qr_code_modal.erb

@@ -1,9 +1,7 @@
 <%= decidim_modal id: "QRCodeDialog", class: "qr-modal" do %>
   <div data-dialog-container>
-    <div data-dialog-title>
-      <%= icon "qr-code-line" %>
-      <h2 id="dialog-title-qr-code-dialog" tabindex="-1"><%= t("decidim.share_widget.qr_code") %></h2>
-    </div>
+    <%= icon "qr-code-line" %>
+    <h2 id="dialog-title-qr-code-dialog" tabindex="-1" data-dialog-title><%= t("decidim.share_widget.qr_code") %></h2>
     <div class="content">
       <div>
         <% if current_organization.logo.attached? %>

data/app/commands/decidim/create_omniauth_registration.rb

@@ -30,9 +30,9 @@ module Decidim
         end
         return broadcast(:invalid) if form.invalid?
 
+        initialize_user
         transaction do
-          create_or_find_user
-          @identity = create_identity
+          @identity = existing_identity || create_identity
         end
         trigger_omniauth_event
 
@@ -50,6 +50,21 @@ module Decidim
 
     REGEXP_SANITIZER = /[<>?%&\^*#@()\[\]=+:;"{}\\|]/
 
+    def initialize_user
+      create_or_find_user
+    rescue ActiveRecord::RecordNotUnique
+      @create_retries ||= 0
+
+      # This may happen if the callback endpoint is called several times in a
+      # row which some Omniauth providers may allow (e.g. through a double
+      # click). This should ensure that the user will not get an error even if
+      # the authentication service sent the callback request several times.
+      raise if @create_retries >= 2
+
+      @create_retries += 1
+      retry
+    end
+
     def create_or_find_user
       @user = User.find_or_initialize_by(
         email: verified_email,

data/app/controllers/concerns/decidim/devise_authentication_methods.rb

@@ -9,6 +9,8 @@ module Decidim
     include Decidim::OnboardingActionMethods
 
     included do
+      protected
+
       def after_sign_in_path_for(user)
         if user.present? && user.blocked?
           check_user_block_status(user)
@@ -21,6 +23,8 @@ module Decidim
         end
       end
 
+      private
+
       # Calling the `stored_location_for` method removes the key, so in order
       # to check if there is any pending redirect after login I need to call
       # this method and use the value to set a pending redirect. This is the

data/app/controllers/concerns/decidim/devise_controllers.rb

@@ -49,6 +49,8 @@ module Decidim
       # right page.
       before_action :store_current_location
 
+      protected
+
       def permission_class_chain
         PermissionsRegistry.chain_for(DeviseControllers)
       end

data/app/controllers/concerns/decidim/disable_redirection_to_external_host.rb

@@ -7,6 +7,8 @@ module Decidim
     extend ActiveSupport::Concern
 
     included do
+      private
+
       def redirect_back(fallback_location:, allow_other_host: true, **args) # rubocop:disable Lint/UnusedMethodArgument
         super(fallback_location:, allow_other_host: Decidim.allow_open_redirects, **args)
       end

data/app/controllers/concerns/decidim/filter_resource.rb

@@ -11,6 +11,8 @@ module Decidim
     # this way we can use Rails' form helpers and have automatically checked checkboxes and
     # radio buttons in the view, for example.
     class Filter
+      private
+
       def initialize(filter)
         @filter = filter
       end

data/app/controllers/concerns/decidim/impersonate_users.rb

@@ -26,6 +26,8 @@ module Decidim
         @current_user ||= managed_user || real_user
       end
 
+      private
+
       # Clear the `@real_user` instance variable because otherwise that would be
       # the return value for any `current_user` calls after the user has already
       # signed out.
@@ -47,8 +49,6 @@ module Decidim
         ((impersonation_session_ends_at - Time.current) / 60).round
       end
 
-      private
-
       def current_user_impersonated?
         current_user && impersonation_log.present?
       end

data/app/controllers/concerns/decidim/locale_switcher.rb

@@ -9,7 +9,7 @@ module Decidim
 
     included do
       around_action :switch_locale
-      helper_method :current_locale, :available_locales, :default_locale
+      helper_method :current_locale, :available_locales, :default_locale, :canonical_url
 
       # Sets the locale for the current session.
       # Saves current locale in a session variable in case some links are locale-orphaned
@@ -24,16 +24,6 @@ module Decidim
         I18n.with_locale(locale, &)
       end
 
-      # Adds the current locale to all the URLs generated by url_for so users
-      # experience a consistent behaviour if they copy or share links.
-      #
-      # Returns a Hash.
-      def default_url_options
-        return {} if current_locale == default_locale.to_s
-
-        { locale: current_locale }
-      end
-
       # The current locale for the user. Available as a helper for the views.
       #
       # Returns a String.
@@ -99,6 +89,67 @@ module Decidim
         end
         lang == "*" ? nil : lang
       end
+
+      def canonical_url(desired_url, target_locale = default_locale)
+        uri = URI(desired_url)
+        desired_locale = available_locales.include?(target_locale) ? target_locale : default_locale
+
+        path_segments = uri.path.split("/").compact_blank
+        locale_segment = path_segments.first
+
+        query = uri.query.to_s.gsub(/locale=[a-zA-Z-]{2,5}/, "")
+
+        if available_locales.include?(locale_segment)
+          path_segments[0] = desired_locale
+
+          uri.path = "/#{path_segments.join("/")}"
+
+          if query.present?
+            params = URI.decode_www_form(query)
+            uri.query = URI.encode_www_form(params)
+          else
+            uri.query = nil
+          end
+        elsif uri.host.blank? || uri.host == request.host
+          uri.path = if uri.path == "/"
+                       "/#{desired_locale}"
+                     else
+                       "/#{desired_locale}#{uri.path}"
+                     end
+
+          if query.present?
+            params = URI.decode_www_form(query)
+            uri.query = URI.encode_www_form(params)
+          else
+            uri.query = nil
+          end
+        else
+          params = URI.decode_www_form(query) << ["locale", desired_locale]
+          uri.query = URI.encode_www_form(params)
+        end
+
+        uri.to_s
+      end
+
+      private
+
+      # Adds the current locale to all the URLs generated by url_for so users
+      # experience a consistent behaviour if they copy or share links.
+      #
+      # Returns a Hash.
+      def default_url_options
+        return {} if current_locale == default_locale.to_s
+
+        { locale: current_locale }
+      end
+
+      def locale_in_script_name?
+        script_name = request&.script_name.to_s
+        return false if script_name.blank?
+
+        locale_segment = script_name.split("/").compact_blank.first
+        available_locales.include?(locale_segment)
+      end
       # rubocop: enable Metrics/CyclomaticComplexity
       # rubocop: enable Metrics/PerceivedComplexity
     end

data/app/controllers/concerns/decidim/needs_permission.rb

@@ -41,19 +41,11 @@ module Decidim
           component_settings: try(:component_settings),
           current_organization: try(:current_organization),
           current_component: try(:current_component),
-          share_token: try(:store_share_token)
+          share_token: store_share_token
         }
       end
 
-      def enforce_permission_to(action, subject, extra_context = {})
-        if Rails.env.development?
-          Rails.logger.debug "==========="
-          Rails.logger.debug [permission_scope, action, subject, permission_class_chain].map(&:inspect).join("\n")
-          Rails.logger.debug "==========="
-        end
-
-        raise Decidim::ActionForbidden unless allowed_to?(action, subject, extra_context)
-      end
+      public
 
       # rubocop:disable Metrics/ParameterLists
       def allowed_to?(action, subject, extra_context = {}, chain = permission_class_chain, user = current_user, scope = nil)
@@ -76,6 +68,18 @@ module Decidim
         allowed_to?(action, subject, extra_context, chain, user, :admin)
       end
 
+      protected
+
+      def enforce_permission_to(action, subject, extra_context = {})
+        if Rails.env.development?
+          Rails.logger.debug "==========="
+          Rails.logger.debug [permission_scope, action, subject, permission_class_chain].map(&:inspect).join("\n")
+          Rails.logger.debug "==========="
+        end
+
+        raise Decidim::ActionForbidden unless allowed_to?(action, subject, extra_context)
+      end
+
       def permission_class_chain
         raise "Please, make this method return an array of permission classes"
       end
@@ -83,6 +87,14 @@ module Decidim
       def permission_scope
         raise "Please, make this method return a symbol"
       end
+
+      private
+
+      def store_share_token
+        session[:share_token] = params[:share_token] if params.has_key?(:share_token)
+
+        session[:share_token].presence
+      end
     end
   end
 end

data/app/controllers/concerns/decidim/onboarding_action_methods.rb

@@ -21,6 +21,8 @@ module Decidim
         OnboardingManager.new(user).pending_action?
       end
 
+      private
+
       def store_onboarding_cookie_data!(user)
         data = onboarding_cookie_data
         return if data.nil?

data/app/controllers/concerns/decidim/paginable.rb

@@ -13,9 +13,7 @@ module Decidim
       helper_method :per_page, :page_offset
       helper Decidim::PaginateHelper
 
-      def paginate(resources)
-        resources.page(params[:page]).per(per_page)
-      end
+      protected
 
       def per_page
         if OPTIONS.include?(params[:per_page])
@@ -31,6 +29,12 @@ module Decidim
       def page_offset
         [params[:page].to_i - 1, 0].max * per_page
       end
+
+      private
+
+      def paginate(resources)
+        resources.page(params[:page]).per(per_page)
+      end
     end
   end
 end

data/app/controllers/concerns/decidim/payload_info.rb

@@ -8,6 +8,8 @@ module Decidim
     include Decidim::TranslatableAttributes
 
     included do
+      private
+
       def append_info_to_payload(payload)
         super
         payload[:user_id] = try(:current_user).try(:id)

data/app/controllers/concerns/decidim/resource_versions_concern.rb

@@ -11,11 +11,25 @@ module Decidim
       helper_method :current_version, :versioned_resource
 
       def show
+        enforce_permission_to(*versioned_resource_permission)
+
         raise ActionController::RoutingError, "Not found" unless current_version
       end
 
       private
 
+      # The versions must honour the same `:read` permission as their resource,
+      # so a resource that is hidden, private, deleted or unpublished (and
+      # therefore cannot be read on its own) cannot be reached through its
+      # versions either.
+      def versioned_resource_permission
+        resource = versioned_resource
+        raise ActionController::RoutingError, "Not found" unless resource
+
+        subject = resource.model_name.element.to_sym
+        [:read, subject, { subject => resource }]
+      end
+
       # Overwrite this method in your controller to define how to find the
       # versioned resource.
       def versioned_resource

data/app/controllers/decidim/application_controller.rb

@@ -59,12 +59,6 @@ module Decidim
 
     skip_before_action :disable_http_caching, unless: :user_signed_in?
 
-    def store_share_token
-      session[:share_token] = params[:share_token] if params.has_key?(:share_token)
-
-      session[:share_token].presence
-    end
-
     private
 
     def allow_browser(**); end

data/app/controllers/decidim/authorization_modals_controller.rb

@@ -6,6 +6,8 @@ module Decidim
     layout false
 
     def show
+      enforce_permission_to :read, :authorization
+
       store_onboarding_cookie_data!(current_user)
     end
 

data/app/controllers/decidim/components/base_controller.rb

@@ -66,6 +66,8 @@ module Decidim
         raise ActionController::RoutingError, "Not Found" unless current_user_can_visit_space?
       end
 
+      protected
+
       def set_component_breadcrumb_item
         context_breadcrumb_items << {
           label: current_component.name,

data/app/controllers/decidim/devise/passwords_controller.rb

@@ -14,6 +14,8 @@ module Decidim
       before_action :check_sign_in_enabled
 
       def change_password
+        enforce_permission_to(:update, :user, current_user:)
+
         self.resource = current_user
         @send_path = apply_password_path
 
@@ -22,6 +24,8 @@ module Decidim
       end
 
       def apply_password
+        enforce_permission_to(:update, :user, current_user:)
+
         self.resource = current_user
         @send_path = apply_password_path
 
@@ -43,6 +47,10 @@ module Decidim
 
       private
 
+      def user_has_no_permission_path
+        new_user_session_path
+      end
+
       def check_sign_in_enabled
         redirect_to new_user_session_path unless current_organization.sign_in_enabled?
       end

data/app/controllers/decidim/favicon_controller.rb

@@ -12,6 +12,7 @@ module Decidim
   class FaviconController < ::DecidimController
     include ActionController::DataStreaming # For Rails 7, check out `ActiveStorage::Streaming`.
     include NeedsOrganization
+    include NeedsPermission
 
     skip_before_action :verify_authenticity_token, :verify_organization
     skip_after_action :verify_same_origin_request
@@ -52,5 +53,13 @@ module Decidim
 
       @favicon_blob ||= current_organization.favicon_ico&.blob
     end
+
+    def permission_class_chain
+      [Decidim::Permissions]
+    end
+
+    def permission_scope
+      :public
+    end
   end
 end

data/app/controllers/decidim/free_resource_authorization_modals_controller.rb

@@ -6,6 +6,8 @@ module Decidim
     layout false
 
     def show
+      enforce_permission_to :read, :authorization
+
       render template: "decidim/authorization_modals/show"
     end
 

data/app/controllers/decidim/gamification/badges_controller.rb

@@ -6,6 +6,8 @@ module Decidim
       include HasSpecificBreadcrumb
 
       def index
+        enforce_permission_to :read, :badges
+
         @badges = Decidim::Gamification.badges.sort_by(&:name)
       end
 

data/app/controllers/decidim/homepage_controller.rb

@@ -3,6 +3,9 @@
 module Decidim
   class HomepageController < Decidim::ApplicationController
     skip_before_action :store_current_location
-    def show; end
+
+    def show
+      enforce_permission_to :read, :homepage
+    end
   end
 end

data/app/controllers/decidim/likes_controller.rb

@@ -8,7 +8,7 @@ module Decidim
     helper_method :like_button
     # we need to declare with +helper+ to be able to call :render_like_identity from the views
     helper Decidim::LikeableHelper
-    helper_method :resource
+    helper_method :resource, :current_component
 
     before_action :authenticate_user!
 

data/app/controllers/decidim/links_controller.rb

@@ -15,6 +15,8 @@ module Decidim
     rescue_from URI::InvalidURIError, with: :modal
 
     def new
+      enforce_permission_to :read, :link
+
       headers["X-Robots-Tag"] = "none"
       headers["Link"] = %(<#{url_for}>; rel="canonical")
     end

data/app/controllers/decidim/manifests_controller.rb

@@ -4,6 +4,8 @@ module Decidim
   # A controller to serve the manifest file for PWA
   class ManifestsController < Decidim::ApplicationController
     def show
+      enforce_permission_to :read, :manifest
+
       organization_presenter = OrganizationPresenter.new(current_organization)
       render layout: false, locals: { organization_params: organization_presenter }, content_type: "application/manifest+json"
     end

data/app/controllers/decidim/messaging/conversations_controller.rb

@@ -43,10 +43,7 @@ module Decidim
 
         StartConversation.call(@form) do
           on(:ok) do |conversation|
-            render action: :create, locals: {
-              conversation:,
-              form: MessageForm.new
-            }
+            render action: :create, locals: { conversation: }
           end
 
           on(:invalid) do |messages|
@@ -96,6 +93,15 @@ module Decidim
 
       def check_multiple
         @form = form(ConversationForm).from_params(params, sender: current_user)
+
+        conversation = conversation_between_multiple(@form.recipient.to_a.prepend(current_user))
+
+        if conversation
+          enforce_permission_to :read, :conversation, conversation:
+        else
+          enforce_permission_to :create, :conversation, conversation: new_conversation(@form.recipient)
+        end
+
         redirect_link = current_or_new_conversation_path_with_multiple(@form.recipient, nickname: params[:nickname])
         redirect_to redirect_link
       end

data/app/controllers/decidim/newsletters_controller.rb

@@ -11,6 +11,8 @@ module Decidim
     helper_method :newsletter
 
     def show
+      enforce_permission_to :read, :newsletter
+
       @user = current_user
       @organization = current_organization
 
@@ -20,6 +22,8 @@ module Decidim
     end
 
     def unsubscribe
+      enforce_permission_to :unsubscribe, :newsletter
+
       encryptor = Decidim::NewsletterEncryptor
 
       decrypted_string = encryptor.sent_at_decrypted(params[:u])

data/app/controllers/decidim/notifications_subscriptions_controller.rb

@@ -6,11 +6,15 @@ module Decidim
     rescue_from Decidim::NotificationsSubscriptionsPersistor::UnsupportedPushSubscriptionEndpointError, with: :unsupported_browser
 
     def create
+      enforce_permission_to(:update, :user, current_user:)
+
       Decidim::NotificationsSubscriptionsPersistor.new(current_user).add_subscription(params)
       head :ok
     end
 
     def destroy
+      enforce_permission_to(:update, :user, current_user:)
+
       Decidim::NotificationsSubscriptionsPersistor.new(current_user).delete_subscription(params[:auth])
       head :ok
     end

data/app/controllers/decidim/offline_controller.rb

@@ -4,7 +4,11 @@ module Decidim
   class OfflineController < Decidim::ApplicationController
     include HasSpecificBreadcrumb
 
-    def show; end
+    def show
+      enforce_permission_to :read, :offline
+    end
+
+    private
 
     def breadcrumb_item
       {