decidim-core 0.31.8 → 0.32.0.rc1

data/app/cells/decidim/versions_list/show.erb

@@ -1,3 +1,28 @@
 <% reverse_ordered_versions.each_with_index do |version, index| %>
   <%= cell("decidim/versions_list_item", version, index:, versioned_resource:, version_path:, i18n_scope:, total:) %>
 <% end %>
+
+<% if versioned_resource.class.include?(Decidim::Fingerprintable) %>
+  <% fingerprint_id = dom_id(versioned_resource, :fingerprint_dialog) %>
+  <section class="mt-4 ml-2">
+    <%= content_tag :button, t("decidim.fingerprint.check"), class: "button button__lg button__text-secondary font-normal text-sm underline", data: { dialog_open: fingerprint_id } %>
+  </section>
+  <%= decidim_modal id: fingerprint_id, class: "fingerprint-modal" do %>
+    <div data-dialog-container>
+      <%= icon "fingerprint-line" %>
+      <h2 id="dialog-title-<%= fingerprint_id %>" tabindex="-1" data-dialog-title><%= t "decidim.fingerprint.title" %></h2>
+      <div class="fingerprint-modal__container">
+        <p id="dialog-desc-<%= fingerprint_id %>"><%= t "decidim.fingerprint.explanation" %></p>
+        <div>
+          <span class="fingerprint-modal__span"><%= t "decidim.fingerprint.value" %>:</span>
+          <code class="fingerprint-modal__code"><%= decidim_html_escape versioned_resource.fingerprint.value %></code>
+        </div>
+        <div>
+          <span class="fingerprint-modal__span"><%= t "decidim.fingerprint.source" %>:</span>
+          <code class="fingerprint-modal__code"><%= decidim_html_escape versioned_resource.fingerprint.source %></code>
+        </div>
+        <p><%= t("decidim.fingerprint.replicate_help", online_calculator_link: link_to(t("decidim.fingerprint.online_calculator_name"), "https://www.md5calc.com/sha256", target: "_blank", rel: "noopener")).html_safe %></p>
+      </div>
+    </div>
+  <% end %>
+<% end %>

data/app/commands/decidim/create_follow.rb

@@ -20,6 +20,7 @@ module Decidim
     # Returns nothing.
     def call
       return broadcast(:invalid) if form.invalid?
+      return broadcast(:invalid) unless current_user.is_a?(Decidim::User)
 
       create_follow!
       increment_score
@@ -32,13 +33,10 @@ module Decidim
     attr_reader :follow, :form
 
     def create_follow!
-      @follow = Follow.find_by(
+      @follow = Follow.where(
         followable: form.followable,
         user: current_user
-      ) || Follow.create!(
-        followable: form.followable,
-        user: current_user
-      )
+      ).first_or_create!
     end
 
     def increment_score

data/app/commands/decidim/create_omniauth_registration.rb

@@ -30,9 +30,9 @@ module Decidim
         end
         return broadcast(:invalid) if form.invalid?
 
-        initialize_user
         transaction do
-          @identity = existing_identity || create_identity
+          create_or_find_user
+          @identity = create_identity
         end
         trigger_omniauth_event
 
@@ -50,21 +50,6 @@ module Decidim
 
     REGEXP_SANITIZER = /[<>?%&\^*#@()\[\]=+:;"{}\\|]/
 
-    def initialize_user
-      create_or_find_user
-    rescue ActiveRecord::RecordNotUnique
-      @create_retries ||= 0
-
-      # This may happen if the callback endpoint is called several times in a
-      # row which some Omniauth providers may allow (e.g. through a double
-      # click). This should ensure that the user will not get an error even if
-      # the authentication service sent the callback request several times.
-      raise if @create_retries >= 2
-
-      @create_retries += 1
-      retry
-    end
-
     def create_or_find_user
       @user = User.find_or_initialize_by(
         email: verified_email,

data/app/commands/decidim/create_user_report.rb

@@ -58,7 +58,7 @@ module Decidim
       current_user.organization.admins.each do |admin|
         next unless admin.email_on_moderations
 
-        Decidim::UserReportJob.perform_later(admin, report)
+        UserReportMailer.notify(admin, report).deliver_later
       end
     end
 

data/app/commands/decidim/destroy_account.rb

@@ -15,7 +15,7 @@ module Decidim
     def call
       return broadcast(:invalid) unless @form.valid?
 
-      with_events(with_transaction: true) do
+      Decidim::User.transaction do
         destroy_user_account!
         destroy_user_identities
         destroy_follows
@@ -28,7 +28,7 @@ module Decidim
         destroy_user_badges
         destroy_user_likes
         destroy_user_reports
-        destroy_participatory_space_private_user
+        destroy_member
         delegate_destroy_to_participatory_spaces
       end
 
@@ -101,8 +101,8 @@ module Decidim
       Decidim::Follow.where(user: current_user).find_each(&:destroy)
     end
 
-    def destroy_participatory_space_private_user
-      Decidim::ParticipatorySpacePrivateUser.where(user: current_user).find_each(&:destroy)
+    def destroy_member
+      Decidim::ParticipatorySpace::Member.where(user: current_user).find_each(&:destroy)
     end
 
     def delegate_destroy_to_participatory_spaces
@@ -110,16 +110,5 @@ module Decidim
         space_manifest.invoke_on_destroy_account(current_user)
       end
     end
-
-    # We use memoization in this particular email, as we want to have the data available before the actual anonymization
-    def event_arguments
-      @event_arguments ||= {
-        user_id: current_user.id,
-        user_email: current_user.email,
-        user_name: current_user.name,
-        locale: current_user.locale,
-        organization: current_user.organization
-      }
-    end
   end
 end

data/app/commands/decidim/gallery_methods.rb

@@ -0,0 +1,107 @@
+# frozen_string_literal: true
+
+module Decidim
+  # A module with all the gallery common methods
+  # Allows to create several image attachments at once
+  module GalleryMethods
+    private
+
+    def build_gallery(attached_to = nil)
+      @gallery = []
+      @form.add_photos.compact_blank.each do |photo|
+        if photo.is_a?(Hash) && photo.has_key?(:id)
+          update_attachment_title_for(photo)
+          next
+        end
+
+        @gallery << Attachment.new(
+          title: photos_title(photo),
+          attached_to: attached_to || gallery_attached_to,
+          file: photos_signed_id(photo), # Define attached_to before this
+          content_type: photos_content_type(photo)
+        )
+      end
+    end
+
+    def update_attachment_title_for(photo)
+      Decidim::Attachment.find(photo[:id]).update(title: photos_title(photo))
+    end
+
+    def image?(signed_id)
+      blob(signed_id).content_type.start_with? "image"
+    end
+
+    def gallery_invalid?
+      @gallery.each do |photo|
+        if photo.invalid? && photo.errors.has_key?(:file)
+          @form.errors.add(:add_photos, photo.errors[:file])
+          return true
+        end
+      end
+      false
+    end
+
+    def create_gallery(first_weight: 0)
+      weight = first_weight
+      # Add the weights first to the old photos
+      @form.photos.each do |photo|
+        photo.update!(weight:)
+        weight += 1
+      end
+      @gallery.map! do |photo|
+        photo.weight = weight
+        photo.attached_to = gallery_attached_to
+        photo.save!
+        weight += 1
+        @form.photos << photo
+      end
+    end
+
+    def photo_cleanup!
+      gallery_attached_to.photos.each do |photo|
+        next unless @form.photos.map(&:id).exclude?(photo.id)
+
+        photo.destroy! if (@form.respond_to?(:documents) && @form.documents.map(&:id).exclude?(photo.id)) || !@form.respond_to?(:documents)
+      end
+      # manually reset cached photos
+      gallery_attached_to.reload
+      gallery_attached_to.instance_variable_set(:@photos, nil)
+    end
+
+    # maybe a custom settings options would be nice
+    def gallery_allowed?
+      true
+    end
+
+    def process_gallery?
+      gallery_allowed? && @form.add_photos.any?
+    end
+
+    def gallery_attached_to
+      return @attached_to if @attached_to.present?
+      return form.current_organization if form.respond_to?(:current_organization)
+
+      form.current_component.organization if form.respond_to?(:current_component)
+    end
+
+    def photos_signed_id(photo)
+      return photo[:file] if photo.is_a?(Hash)
+
+      photo
+    end
+
+    def photos_title(photo)
+      return { I18n.locale => photo[:title] } if photo.is_a?(Hash) && photo.has_key?(:title)
+
+      { I18n.locale => "" }
+    end
+
+    def photos_content_type(photo)
+      blob(photos_signed_id(photo)).content_type
+    end
+
+    def blob(signed_id)
+      ActiveStorage::Blob.find_signed(signed_id)
+    end
+  end
+end

data/app/commands/decidim/multiple_attachments_methods.rb

@@ -5,16 +5,16 @@ module Decidim
     private
 
     def build_attachments
-      @attachments = []
-      @form.add_attachments.compact_blank.each do |attachment|
+      @documents = []
+      @form.add_documents.compact_blank.each do |attachment|
         if attachment.is_a?(Hash) && attachment.has_key?(:id)
           update_attachment_title_for(attachment)
           next
         end
 
-        @attachments << Attachment.new(
+        @documents << Attachment.new(
           title: title_for(attachment),
-          attached_to: @attached_to || attachments_attached_to,
+          attached_to: @attached_to || documents_attached_to,
           file: signed_id_for(attachment),
           content_type: content_type_for(attachment)
         )
@@ -26,11 +26,11 @@ module Decidim
     end
 
     def attachments_invalid?
-      @attachments.each do |attachment|
-        next if attachment.valid? || !attachment.errors.has_key?(:file)
+      @documents.each do |document|
+        next if document.valid? || !document.errors.has_key?(:file)
 
-        attachment.errors[:file].each do |error|
-          @form.errors.add(:add_attachments, error)
+        document.errors[:file].each do |error|
+          @form.errors.add(:add_documents, error)
         end
 
         return true
@@ -41,38 +41,37 @@ module Decidim
 
     def create_attachments(first_weight: 0)
       weight = first_weight
-      # Add the weights first to the old attachments
-      attachment_ids = keep_ids
-      Decidim::Attachment.where(id: attachment_ids).each do |attachment|
-        attachment.update!(weight:)
+      # Add the weights first to the old documents
+      document_ids = keep_ids
+      Decidim::Attachment.where(id: document_ids).each do |document|
+        document.update!(weight:)
         weight += 1
       end
-      @attachments.map! do |attachment|
-        attachment.weight = weight
-        attachment.attached_to = attachments_attached_to
-        attachment.save!
+      @documents.map! do |document|
+        document.weight = weight
+        document.attached_to = documents_attached_to
+        document.save!
         weight += 1
-        @form.attachments << attachment
+        @form.documents << document
       end
     end
 
-    def attachment_cleanup!(include_all_attachments: false)
-      attachments = include_all_attachments ? attachments_attached_to.attachments.with_attached_file : attachments_attached_to.attachments
+    def document_cleanup!(include_all_attachments: false)
+      documents = include_all_attachments ? documents_attached_to.attachments.with_attached_file : documents_attached_to.documents
 
-      attachments.each do |attachment|
-        attachment.destroy! unless keep_ids.include?(attachment.id)
+      documents.each do |document|
+        document.destroy! unless keep_ids.include?(document.id)
       end
 
-      attachments_attached_to.reload
-      attachments_attached_to.instance_variable_set(:@attachments, nil)
-      attachments_attached_to.instance_variable_set(:@photos, nil)
+      documents_attached_to.reload
+      documents_attached_to.instance_variable_set(:@documents, nil)
     end
 
     def process_attachments?
-      @form.add_attachments.any?
+      @form.add_documents.any?
     end
 
-    def attachments_attached_to
+    def documents_attached_to
       return @attached_to if @attached_to.present?
       return form.current_organization if form.respond_to?(:current_organization)
 
@@ -102,8 +101,8 @@ module Decidim
     end
 
     def keep_ids
-      attachments_array = Array(@form.attachments)
-      attachments_array.map do |doc|
+      documents_array = Array(@form.documents)
+      documents_array.map do |doc|
         case doc
         when Decidim::Attachment
           doc.id

data/app/commands/decidim/search.rb

@@ -7,10 +7,10 @@ module Decidim
 
     # Public: Initializes the command.
     #
-    # @param term: The term to search for.
-    # @param organization: The Organization to which the results are constrained.
-    # @param filters: (optional) A Hash of SearchableResource attributes to filter for.
-    # @param page_params: (optional) A Hash with `page` and `per_page` options to paginate.
+    # @param term [String] -  The term to search for.
+    # @param organization [Decidim::Organization] - The Organization to which the results are constrained.
+    # @param filters [Hash] - (optional) A Hash of SearchableResource attributes to filter for.
+    # @param page_params [Hash] - (optional) A Hash with `page` and `per_page` options to paginate.
     def initialize(term, organization, filters = {}, page_params = {})
       @term = term
       @organization = organization
@@ -91,7 +91,7 @@ module Decidim
         query = query.where(decidim_participatory_space: spaces)
       end
 
-      query = query.order("datetime DESC")
+      query = query.order(datetime: :desc)
       query = query.global_search(I18n.transliterate(term)) if term.present?
       query
     end

data/app/controllers/concerns/decidim/ajax_permission_handler.rb

@@ -15,7 +15,7 @@ module Decidim
     def ajax_user_has_no_permission
       return user_has_no_permission unless request.xhr?
 
-      render json: { message: I18n.t("actions.unauthorized", scope: "decidim.core") }, status: :unprocessable_entity
+      render json: { message: I18n.t("actions.unauthorized", scope: "decidim.core") }, status: :unprocessable_content
     end
   end
 end

data/app/controllers/concerns/decidim/devise_authentication_methods.rb

@@ -9,8 +9,6 @@ module Decidim
     include Decidim::OnboardingActionMethods
 
     included do
-      protected
-
       def after_sign_in_path_for(user)
         if user.present? && user.blocked?
           check_user_block_status(user)
@@ -23,8 +21,6 @@ module Decidim
         end
       end
 
-      private
-
       # Calling the `stored_location_for` method removes the key, so in order
       # to check if there is any pending redirect after login I need to call
       # this method and use the value to set a pending redirect. This is the

data/app/controllers/concerns/decidim/devise_controllers.rb

@@ -41,16 +41,10 @@ module Decidim
 
       layout "layouts/decidim/application"
 
-      # Ensure locale is set before Devise's own prepended callbacks and reset
-      # after the request finishes.
-      prepend_around_action :set_current_locale
-
       # Saves the location before loading each page so we can return to the
       # right page.
       before_action :store_current_location
 
-      protected
-
       def permission_class_chain
         PermissionsRegistry.chain_for(DeviseControllers)
       end
@@ -64,12 +58,6 @@ module Decidim
 
         store_location_for(:user, redirect_url)
       end
-
-      def set_current_locale(&)
-        locale = detect_locale
-        locale = default_locale unless available_locales.include?(locale)
-        I18n.with_locale(locale, &)
-      end
     end
   end
 end

data/app/controllers/concerns/decidim/direct_upload.rb

@@ -6,6 +6,7 @@ module Decidim
 
     included do
       include Decidim::NeedsOrganization
+
       skip_before_action :verify_organization
 
       before_action :check_organization!,
@@ -18,14 +19,14 @@ module Decidim
       # We skip the validation if we are in system panel. `current_admin` refers to the main system admin user.
       return if current_admin.present?
 
-      head :unprocessable_entity unless [
+      head :unprocessable_content unless [
         maximum_allowed_size.try(:to_i) >= blob_args[:byte_size].try(:to_i),
         content_types.any? { |pattern| pattern.match?(blob_args[:content_type]) },
         content_types.any? { |pattern| pattern.match?(MiniMime.lookup_by_extension(extension)&.content_type) },
         allowed_extensions.any? { |pattern| pattern.match?(extension) }
       ].all?
     rescue NoMethodError
-      head :unprocessable_entity
+      head :unprocessable_content
     end
 
     def extension

data/app/controllers/concerns/decidim/disable_redirection_to_external_host.rb

@@ -7,8 +7,6 @@ module Decidim
     extend ActiveSupport::Concern
 
     included do
-      private
-
       def redirect_back(fallback_location:, allow_other_host: true, **args) # rubocop:disable Lint/UnusedMethodArgument
         super(fallback_location:, allow_other_host: Decidim.allow_open_redirects, **args)
       end

data/app/controllers/concerns/decidim/ephemeral_session_checker.rb

@@ -78,7 +78,7 @@ module Decidim
                    end
       paths_list.prepend(
         pending_authorizations_path,
-        decidim.page_path(terms_of_service_page)
+        decidim.page_path(terms_of_service_page, locale: current_locale)
       )
 
       paths_list.find { |el| /\A#{URI.parse(el).path}/.match?(request.path) }

data/app/controllers/concerns/decidim/filter_resource.rb

@@ -11,8 +11,6 @@ module Decidim
     # this way we can use Rails' form helpers and have automatically checked checkboxes and
     # radio buttons in the view, for example.
     class Filter
-      private
-
       def initialize(filter)
         @filter = filter
       end

data/app/controllers/concerns/decidim/force_authentication.rb

@@ -38,12 +38,21 @@ module Decidim
       default_unauthorized_paths + Decidim::StaticPage.where(
         organization: current_organization,
         allow_public_access: true
-      ).pluck(Arel.sql("CONCAT('/pages/', slug)"))
+      ).pluck(
+        Arel::Nodes::Concat.new(
+          Arel::Nodes.build_quoted("/#{current_locale}/pages/"),
+          Arel::Table.new(Decidim::StaticPage.table_name)[:slug]
+        )
+      )
     end
 
     def default_unauthorized_paths
       # /locale is for changing the locale and /manifest.webmanifest to request PWA manifest
       %w(/locale /manifest.webmanifest)
     end
+
+    def current_locale
+      @current_locale ||= I18n.locale.to_s
+    end
   end
 end

data/app/controllers/concerns/decidim/impersonate_users.rb

@@ -26,8 +26,6 @@ module Decidim
         @current_user ||= managed_user || real_user
       end
 
-      private
-
       # Clear the `@real_user` instance variable because otherwise that would be
       # the return value for any `current_user` calls after the user has already
       # signed out.
@@ -49,6 +47,8 @@ module Decidim
         ((impersonation_session_ends_at - Time.current) / 60).round
       end
 
+      private
+
       def current_user_impersonated?
         current_user && impersonation_log.present?
       end
@@ -71,6 +71,10 @@ module Decidim
         # Prevent redirect on non-HTML responses, because we want redirect AFTER impersonation.js inits a reload.
         return if request && request.negotiate_mime([Mime[:html]]).blank?
         return unless can_impersonate_users?
+
+        # Keep the expiration check in sync with the active impersonation log so
+        # the redirect happens in the same request when the session just expired.
+        impersonation_log&.ensure_not_expired!
         return unless expired_log
 
         expired_log.update!(ended_at: Time.current)

data/app/controllers/concerns/decidim/locale_switcher.rb

@@ -21,9 +21,20 @@ module Decidim
         else
           locale = default_locale
         end
+
         I18n.with_locale(locale, &)
       end
 
+      # Adds the current locale to all the URLs generated by url_for so users
+      # experience a consistent behaviour if they copy or share links.
+      #
+      # Returns a Hash.
+      def default_url_options
+        return {} if locale_in_script_name?
+
+        { locale: current_locale }
+      end
+
       # The current locale for the user. Available as a helper for the views.
       #
       # Returns a String.
@@ -131,18 +142,6 @@ module Decidim
         uri.to_s
       end
 
-      private
-
-      # Adds the current locale to all the URLs generated by url_for so users
-      # experience a consistent behaviour if they copy or share links.
-      #
-      # Returns a Hash.
-      def default_url_options
-        return {} if current_locale == default_locale.to_s
-
-        { locale: current_locale }
-      end
-
       def locale_in_script_name?
         script_name = request&.script_name.to_s
         return false if script_name.blank?

data/app/controllers/concerns/decidim/needs_permission.rb

@@ -41,11 +41,19 @@ module Decidim
           component_settings: try(:component_settings),
           current_organization: try(:current_organization),
           current_component: try(:current_component),
-          share_token: store_share_token
+          share_token: try(:store_share_token)
         }
       end
 
-      public
+      def enforce_permission_to(action, subject, extra_context = {})
+        if Rails.env.development?
+          Rails.logger.debug "==========="
+          Rails.logger.debug [permission_scope, action, subject, permission_class_chain].map(&:inspect).join("\n")
+          Rails.logger.debug "==========="
+        end
+
+        raise Decidim::ActionForbidden unless allowed_to?(action, subject, extra_context)
+      end
 
       # rubocop:disable Metrics/ParameterLists
       def allowed_to?(action, subject, extra_context = {}, chain = permission_class_chain, user = current_user, scope = nil)
@@ -68,18 +76,6 @@ module Decidim
         allowed_to?(action, subject, extra_context, chain, user, :admin)
       end
 
-      protected
-
-      def enforce_permission_to(action, subject, extra_context = {})
-        if Rails.env.development?
-          Rails.logger.debug "==========="
-          Rails.logger.debug [permission_scope, action, subject, permission_class_chain].map(&:inspect).join("\n")
-          Rails.logger.debug "==========="
-        end
-
-        raise Decidim::ActionForbidden unless allowed_to?(action, subject, extra_context)
-      end
-
       def permission_class_chain
         raise "Please, make this method return an array of permission classes"
       end
@@ -87,14 +83,6 @@ module Decidim
       def permission_scope
         raise "Please, make this method return a symbol"
       end
-
-      private
-
-      def store_share_token
-        session[:share_token] = params[:share_token] if params.has_key?(:share_token)
-
-        session[:share_token].presence
-      end
     end
   end
 end

data/app/controllers/concerns/decidim/needs_tos_accepted.rb

@@ -43,7 +43,7 @@ module Decidim
     end
 
     def tos_path
-      decidim.page_path terms_of_service_page
+      decidim.page_path terms_of_service_page, locale: current_locale
     end
 
     def redirect_to_tos

data/app/controllers/concerns/decidim/onboarding_action_methods.rb

@@ -21,8 +21,6 @@ module Decidim
         OnboardingManager.new(user).pending_action?
       end
 
-      private
-
       def store_onboarding_cookie_data!(user)
         data = onboarding_cookie_data
         return if data.nil?