decidim-core 0.32.0.rc1 → 0.32.0.rc3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: caaaf7bbddd64f7bb5d4341c6ebeab59b35dd0f69326b136d11958165e513801
-  data.tar.gz: e18600f3eec00c3fbf76b58e90a34bf4888a114f7dc5a9d35896540d30a7a20f
+  metadata.gz: 5c8c0eaf7af52859f34c0b152525144104d544b91f8a5ba49173b2f25530709c
+  data.tar.gz: c1d8019a4006489b276e3d2ca8c5c6f194890035369ab69a7c7e358376f16fae
 SHA512:
-  metadata.gz: 847ec9bd0ae30f358fd5330e3bf61cd34adedca669986b5082e391473e3f66df4e7eab20bac8ad4478827fd66b2d3e94e46559ef4138cf289d5a71caf60e904b
-  data.tar.gz: b832cfbd8827d809a1792ff0f7a6688f2282e3f2bfc8975bf821175465333ade87ef0e2fd92bf9ac3512f54e40d31872d2f35a28424b8549de717e2f645141b3
+  metadata.gz: 88f9cdca14f469d2fe61ca88c3ba56f8e44586a951be4de8a3faa3f9de1d75b982f8b0db9023052470118f8f47c4d327eecf4687a568f636a18a6c85cfacd874
+  data.tar.gz: de42f147191cad92bd9b25c908a4526aaa317313e44603828b59ec0f40e9360f1a9cc8e046b64ed226b9c1585cdca4b213f271380e003d43936b813ebef6160f

data/app/cells/decidim/amendable/amend_button_card/show.erb

@@ -1,5 +1,5 @@
-<li role="menuitem" class="dropdown__item">
-  <%= action_authorized_link_to :amend, new_amend_path, resource: model, data: { "redirect_url" => new_amend_path }, id: "amend-button", class: "dropdown__button" do %>
+<li role="presentation" class="dropdown__item">
+  <%= action_authorized_link_to :amend, new_amend_path, resource: model, data: { "redirect_url" => new_amend_path }, id: "amend-button", class: "dropdown__button", role: "menuitem" do %>
     <span><%= t("button", scope: "decidim.amendments.amendable", model_name: nil) %></span>
     <%= icon "pencil-line" %>
   <% end %>

data/app/cells/decidim/card_metadata_cell.rb

@@ -29,7 +29,7 @@ module Decidim
       return unless show_space?
 
       {
-        text: decidim_escape_translated(participatory_space.title),
+        text: translated_attribute(participatory_space.title),
         icon: resource_type_icon_key(participatory_space.class),
         url: Decidim::ResourceLocatorPresenter.new(participatory_space).path
       }

data/app/cells/decidim/content_blocks/cta_settings_form/show.erb

@@ -4,6 +4,6 @@
   <%= settings_fields.translated :text_field, :description, label: t("decidim.content_blocks.cta_settings_form.description") %>
 <% end %>
 
-<% form.fields_for :images, form.object.images do |images_fields| %>
+<% form.fields_for :images, content_block.images_container do |images_fields| %>
   <%= images_fields.upload :background_image, label: t("decidim.content_blocks.cta_settings_form.background_image") %>
 <% end %>

data/app/cells/decidim/content_blocks/hero_settings_form/show.erb

@@ -14,7 +14,7 @@
   </div>
 <% end %>
 
-<% form.fields_for :images, form.object.images do |images_fields| %>
+<% form.fields_for :images, content_block.images_container do |images_fields| %>
   <div class="row column">
     <%= images_fields.upload :background_image, label: t(".background_image"), button_class: "button button__sm button__transparent-secondary" %>
   </div>

data/app/cells/decidim/content_blocks/highlighted_content_banner_settings_form/show.erb

@@ -20,7 +20,7 @@
   </div>
 <% end %>
 
-<% form.fields_for :images, form.object.images do |images_fields| %>
+<% form.fields_for :images, content_block.images_container do |images_fields| %>
   <div class="row column">
     <%= images_fields.upload :background_image, label: t(".background_image"), button_class: "button button__sm button__transparent-secondary" %>
   </div>

data/app/cells/decidim/content_blocks/html_cell.rb

@@ -8,7 +8,7 @@ module Decidim
       end
 
       def html_content
-        translated_attribute(model.settings.html_content).html_safe
+        decidim_sanitize_editor_admin(translated_attribute(model.settings.html_content))
       end
     end
   end

data/app/cells/decidim/content_blocks/participatory_space_hero_settings_form/show.erb

@@ -8,7 +8,7 @@
   </div>
 <% end %>
 
-<% form.fields_for :images, form.object.images do |images_fields| %>
+<% form.fields_for :images, content_block.images_container do |images_fields| %>
   <div class="row column">
     <%= images_fields.upload :background_image, label: t("decidim.content_blocks.cta_settings_form.background_image"), button_class: "button button__sm button__transparent-secondary" %>
   </div>

data/app/cells/decidim/content_blocks/static_page/section_cell.rb

@@ -5,7 +5,7 @@ module Decidim
     module StaticPage
       class SectionCell < Decidim::ViewModel
         def content
-          translated_attribute(model.settings.content).html_safe
+          decidim_sanitize_editor_admin(translated_attribute(model.settings.content))
         end
       end
     end

data/app/cells/decidim/content_blocks/static_page/section_settings_form/show.erb

@@ -1,3 +1,5 @@
 <% form.fields_for :settings, form.object.settings do |settings_fields| %>
-  <%= settings_fields.translated :editor, :content, label: %>
+  <div class="row column">
+    <%= settings_fields.translated :editor, :content, label: %>
+  </div>
 <% end %>

data/app/cells/decidim/content_blocks/static_page/summary_cell.rb

@@ -5,7 +5,7 @@ module Decidim
     module StaticPage
       class SummaryCell < Decidim::ViewModel
         def content
-          translated_attribute(model.settings.summary).html_safe
+          decidim_sanitize_editor_admin(translated_attribute(model.settings.summary))
         end
       end
     end

data/app/cells/decidim/content_blocks/static_page/summary_settings_form/show.erb

@@ -1,3 +1,5 @@
 <% form.fields_for :settings, form.object.settings do |settings_fields| %>
-  <%= settings_fields.translated :editor, :summary, label: %>
+  <div class="row column">
+    <%= settings_fields.translated :editor, :summary, label: %>
+  </div>
 <% end %>

data/app/cells/decidim/content_blocks/static_page/two_pane_section_cell.rb

@@ -5,11 +5,11 @@ module Decidim
     module StaticPage
       class TwoPaneSectionCell < Decidim::ViewModel
         def left_column
-          translated_attribute(model.settings.left_column).html_safe
+          decidim_sanitize_editor_admin(translated_attribute(model.settings.left_column))
         end
 
         def right_column
-          translated_attribute(model.settings.right_column).html_safe
+          decidim_sanitize_editor_admin(translated_attribute(model.settings.right_column))
         end
       end
     end

data/app/cells/decidim/content_blocks/static_page/two_pane_section_settings_form/show.erb

@@ -1,4 +1,6 @@
 <% form.fields_for :settings, form.object.settings do |settings_fields| %>
-  <%= settings_fields.translated :editor, :left_column, label: label_left_column %>
-  <%= settings_fields.translated :editor, :right_column, label: label_right_column %>
+  <div class="row column">
+    <%= settings_fields.translated :editor, :left_column, label: label_left_column %>
+    <%= settings_fields.translated :editor, :right_column, label: label_right_column %>
+  </div>
 <% end %>

data/app/cells/decidim/data_consent/category.erb

@@ -13,12 +13,12 @@
       <%= icon "close-line", class: "cookies__category-toggle-icon" %>
     </label>
 
-    <div id="accordion-trigger-<%= category[:slug] %>" role="group" data-controls="accordion-panel-<%= category[:slug] %>" aria-labelledby="accordion-title-<%= category[:slug] %>">
-      <h3 id="accordion-title-<%= category[:slug] %>" class="cookies__category-trigger-title">
-        <%= category[:title] %>
-      </h3>
+    <h3 id="accordion-title-<%= category[:slug] %>" class="cookies__category-trigger-title">
+      <%= category[:title] %>
+    </h3>
 
-      <span>
+    <div id="accordion-trigger-<%= category[:slug] %>" role="group" data-controls="accordion-panel-<%= category[:slug] %>" aria-labelledby="accordion-title-<%= category[:slug] %>">
+      <span aria-hidden="true">
         <%= icon "arrow-down-s-line", class: "cookies__category-trigger-arrow" %>
         <%= icon "arrow-up-s-line", class: "cookies__category-trigger-arrow" %>
       </span>

data/app/cells/decidim/resource_types_filter/show.erb

@@ -10,8 +10,8 @@
   </button>
   <ul id="dropdown-menu-resource">
     <% resource_types.each do |resource_type| %>
-      <li role="menuitem">
-        <%= link_to filter_url(resource_type[0]), class: "filter#{" is-active" if filter_param == resource_type[0]}" do %>
+      <li role="presentation">
+        <%= link_to filter_url(resource_type[0]), class: "filter#{" is-active" if filter_param == resource_type[0]}", role: "menuitem" do %>
           <span class="sr-only"><%= resource_type[1] %></span>
           <%= text_with_resource_icon(*resource_type) %>
         <% end %>

data/app/cells/decidim/upload_modal_cell.rb

@@ -177,6 +177,11 @@ module Decidim
 
     def file_attachment_path(attachment)
       return unless attachment
+
+      if attachment.respond_to?(:record) && attachment.record.is_a?(Decidim::Authorization) && attachment.name.to_s == "verification_attachment"
+        return decidim.private_download_path(Decidim::PrivateDownload.for(attachment.record, attachment_name: attachment.name).token)
+      end
+
       return Rails.application.routes.url_helpers.rails_blob_url(attachment, only_path: true) if attachment.is_a? ActiveStorage::Blob
 
       if attachment.try(:attached?)

data/app/controllers/concerns/decidim/devise_controllers.rb

@@ -41,6 +41,10 @@ module Decidim
 
       layout "layouts/decidim/application"
 
+      # Ensure locale is set before Devise's own prepended callbacks and reset
+      # after the request finishes.
+      prepend_around_action :set_current_locale
+
       # Saves the location before loading each page so we can return to the
       # right page.
       before_action :store_current_location
@@ -58,6 +62,11 @@ module Decidim
 
         store_location_for(:user, redirect_url)
       end
+
+      def set_current_locale(&)
+        locale = Decidim::LocaleRouterDetector.new(request, params).locale
+        I18n.with_locale(locale, &)
+      end
     end
   end
 end

data/app/controllers/decidim/download_your_data_controller.rb

@@ -50,7 +50,7 @@ module Decidim
         flash[:error] = t("decidim.account.download_your_data_export.export_expired")
         redirect_to download_your_data_path
       elsif private_export.file.attached?
-        redirect_to Rails.application.routes.url_helpers.rails_blob_url(private_export.file.blob, only_path: true)
+        redirect_to private_download_path(Decidim::PrivateDownload.for(private_export, attachment_name: :file).token)
       else
         flash[:error] = t("decidim.account.download_your_data_export.file_no_exists")
         redirect_to download_your_data_path

data/app/controllers/decidim/notifications_subscriptions_controller.rb

@@ -3,6 +3,8 @@
 module Decidim
   # The controller to handle the subscriptions to push notifications
   class NotificationsSubscriptionsController < Decidim::ApplicationController
+    rescue_from Decidim::NotificationsSubscriptionsPersistor::UnsupportedPushSubscriptionEndpointError, with: :unsupported_browser
+
     def create
       Decidim::NotificationsSubscriptionsPersistor.new(current_user).add_subscription(params)
       head :ok
@@ -12,5 +14,11 @@ module Decidim
       Decidim::NotificationsSubscriptionsPersistor.new(current_user).delete_subscription(params[:auth])
       head :ok
     end
+
+    private
+
+    def unsupported_browser
+      render json: { error: I18n.t("notifications_settings.show.push_notifications_unsupported_browser", scope: "decidim") }, status: :unprocessable_content
+    end
   end
 end

data/app/controllers/decidim/private_downloads_controller.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+module Decidim
+  class PrivateDownloadsController < Decidim::ApplicationController
+    before_action :authenticate_user!
+
+    def show
+      return head :not_found unless private_download.attached?
+      return head :not_found unless private_download.authorized_for?(current_user)
+
+      disposition = private_download.attachment.content_type.start_with?("image/") ? :inline : :attachment
+
+      send_data(
+        private_download.attachment.download,
+        filename: private_download.attachment.filename.to_s,
+        type: private_download.attachment.content_type,
+        disposition:
+      )
+    rescue Decidim::PrivateDownload::InvalidTokenError
+      head :not_found
+    end
+
+    private
+
+    def private_download
+      @private_download ||= Decidim::PrivateDownload.from_token(params[:id])
+    end
+  end
+end

data/app/events/decidim/amendable/amendment_base_event.rb

@@ -3,7 +3,7 @@
 module Decidim::Amendable
   class AmendmentBaseEvent < Decidim::Events::SimpleEvent
     i18n_attributes :amendable_path, :amendable_type, :amendable_title,
-                    :emendation_path, :emendation_author_nickname, :emendation_author_path
+                    :emendation_path, :emendation_author_nickname, :emendation_author_name, :emendation_author_path
 
     def amendable_title
       @amendable_title ||= translated_attribute(amendable_resource.title)
@@ -33,6 +33,12 @@ module Decidim::Amendable
       @emendation_author_nickname ||= emendation_author.nickname
     end
 
+    def emendation_author_name
+      return unless emendation_resource
+
+      @emendation_author_name ||= emendation_author.name
+    end
+
     def emendation_author_path
       return unless emendation_resource
 

data/app/models/decidim/attachment.rb

@@ -88,7 +88,7 @@ module Decidim
     # Returns String.
     def file_type
       if file?
-        url&.split(".")&.last&.split("&")&.first&.downcase
+        file.filename.extension&.downcase
       elsif link?
         "link"
       end
@@ -100,7 +100,13 @@ module Decidim
     def url
       @url ||=
         if file?
-          attached_uploader(:file).url
+          if private_download_required?
+            Decidim::Core::Engine.routes.url_helpers.private_download_path(
+              Decidim::PrivateDownload.for(self, attachment_name: :file).token
+            )
+          else
+            attached_uploader(:file).url
+          end
         elsif link?
           link
         end
@@ -144,5 +150,17 @@ module Decidim
 
       attached_to.can_participate?(user)
     end
+
+    def private_download_authorized?(user, requested_attachment_name)
+      return false unless requested_attachment_name.to_s == "file"
+
+      can_participate?(user)
+    end
+
+    def private_download_required?
+      return attached_to.restricted? if attached_to.respond_to?(:restricted?)
+
+      attached_to.respond_to?(:component) && attached_to.component&.restricted_space?
+    end
   end
 end

data/app/models/decidim/authorization.rb

@@ -91,6 +91,13 @@ module Decidim
       Decidim::AuthorizationTransfer.perform!(self, handler)
     end
 
+    def private_download_authorized?(user, requested_attachment_name)
+      return false unless requested_attachment_name.to_s == "verification_attachment"
+      return true if user&.admin? && user.organization == organization
+
+      user == self.user
+    end
+
     private
 
     def active_handler?

data/app/models/decidim/moderation.rb

@@ -32,7 +32,7 @@ module Decidim
     end
 
     def self.ransackable_attributes(_auth_object = nil)
-      %w(reported_id_string reported_content created_at)
+      %w(reported_id_string reported_content created_at report_count)
     end
 
     def self.ransackable_associations(_auth_object = nil)

data/app/models/decidim/participatory_space/member.rb

@@ -42,7 +42,7 @@ module Decidim
       def self.ransackable_attributes(auth_object = nil)
         return [] unless auth_object&.admin?
 
-        %w(name nickname email invitation_accepted_at last_sign_in_at invitation_sent_at role)
+        %w(name nickname email invitation_accepted_at last_sign_in_at invitation_sent_at role published)
       end
 
       def self.ransackable_associations(_auth_object = nil)

data/app/models/decidim/private_download.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+module Decidim
+  class PrivateDownload
+    class InvalidTokenError < StandardError; end
+
+    VERIFIER_PURPOSE = :private_download
+
+    def self.for(record, attachment_name:)
+      new(record:, attachment_name:)
+    end
+
+    def self.from_token(token)
+      payload = verifier.verify(token, purpose: VERIFIER_PURPOSE).with_indifferent_access
+      record = GlobalID::Locator.locate(payload[:gid])
+
+      raise InvalidTokenError if record.blank?
+
+      new(record:, attachment_name: payload[:attachment_name])
+    rescue ActiveSupport::MessageVerifier::InvalidSignature, TypeError
+      raise InvalidTokenError
+    end
+
+    def self.verifier
+      @verifier ||= ActiveSupport::MessageVerifier.new(Rails.application.secret_key_base, serializer: JSON)
+    end
+
+    def initialize(record:, attachment_name:)
+      @record = record
+      @attachment_name = attachment_name.to_s
+    end
+
+    def token
+      self.class.verifier.generate(
+        {
+          gid: record.to_global_id.to_s,
+          attachment_name:
+        },
+        purpose: VERIFIER_PURPOSE
+      )
+    end
+
+    def attachment
+      record.public_send(attachment_name)
+    end
+
+    def attached?
+      attachment.respond_to?(:attached?) && attachment.attached?
+    end
+
+    def authorized_for?(user)
+      return false unless record.respond_to?(:private_download_authorized?)
+
+      record.private_download_authorized?(user, attachment_name)
+    end
+
+    private
+
+    attr_reader :record, :attachment_name
+  end
+end

data/app/models/decidim/private_export.rb

@@ -24,5 +24,11 @@ module Decidim
       self.content_type = file.content_type
       self.file_size = file.byte_size
     end
+
+    def private_download_authorized?(user, requested_attachment_name)
+      return false unless requested_attachment_name.to_s == "file"
+
+      attached_to == user
+    end
   end
 end

data/app/models/decidim/user_base_entity.rb

@@ -69,12 +69,27 @@ module Decidim
       Decidim::UserBaseEntity.joins(:follows).where(decidim_follows: { user: self }).blocked.exists?
     end
 
+    ransacker :role do
+      Arel.sql(%{CASE WHEN "decidim_users"."admin" = true THEN 'admin' ELSE cast("decidim_users"."roles" as text) END})
+    end
+
+    ransacker :user_moderation_report_count do
+      query = <<~SQL.squish
+        (
+            SELECT COALESCE(MAX(decidim_user_moderations.report_count), 0)
+            FROM decidim_user_moderations
+            WHERE decidim_user_moderations.decidim_user_id = decidim_users.id
+        )
+      SQL
+      Arel.sql(query)
+    end
+
     def self.ransackable_attributes(auth_object = nil)
-      base = %w(name email nickname last_sign_in_at)
+      base = %w(name email nickname last_sign_in_at created_at)
 
       return base unless auth_object&.admin?
 
-      base + %w(invitation_sent_at invitation_accepted_at officialized_at)
+      base + %w(invitation_sent_at invitation_accepted_at officialized_at role user_moderation_report_count)
     end
 
     def self.ransackable_associations(_auth_object = nil)

data/app/models/decidim/user_moderation.rb

@@ -19,7 +19,7 @@ module Decidim
     end
 
     def self.ransackable_attributes(_auth_object = nil)
-      []
+      %w(created_at report_count)
     end
 
     def self.ransackable_associations(_auth_object = nil)