decidim-core 0.32.0 → 0.32.2

data/app/validators/uploader_image_content_validator.rb

@@ -0,0 +1,276 @@
+# frozen_string_literal: true
+
+# This validator ensures that files declared as images actually contain valid
+# image data of the declared format. It does so by checking the leading bytes
+# (magic bytes / file signature) of the file against the known signatures of
+# the supported image formats, and by comparing the detected format with the
+# content type declared by the file.
+#
+# This prevents non-image files (e.g. HTML, MATLAB, or arbitrary binary data)
+# from being uploaded with an image extension and a spoofed image content type.
+# Such files would later cause image processing to fail (e.g. in ImageMagick or
+# in libvips when generating a variant) and could lead to a denial of service.
+#
+# Comparing the detected format with the declared content type also prevents
+# files whose contents do not match their declaration (e.g. a JPEG file
+# declared as image/png), so that the stored MIME type is consistent with the
+# file contents.
+#
+# SVG documents are XML-based and can contain scripts and other active content,
+# which is executed when the document is rendered by the browser. Because of
+# that, the contents of files detected as SVG are additionally validated by
+# Decidim::SvgContentValidator, so that documents which could execute scripts
+# or read external resources are rejected instead of being stored as they are.
+class UploaderImageContentValidator < ActiveModel::Validations::FileContentTypeValidator
+  # The number of leading bytes to read from the file to detect its signature.
+  SIGNATURE_LENGTH = 128
+
+  # The known signatures of the supported binary image formats. Each entry
+  # associates a format with a list of [offset, bytes] pairs that must all
+  # match at their respective offsets for the file to be considered of that
+  # format.
+  BINARY_IMAGE_SIGNATURES = [
+    [:png, [[0, "\x89PNG\r\n\x1A\n".b]]],
+    [:jpeg, [[0, "\xFF\xD8\xFF".b]]],
+    [:gif, [[0, "GIF87a".b]]],
+    [:gif, [[0, "GIF89a".b]]],
+    [:bmp, [[0, "BM".b]]],
+    [:tiff, [[0, "II*\x00".b]]],
+    [:tiff, [[0, "MM\x00*".b]]],
+    [:webp, [[0, "RIFF".b], [8, "WEBP".b]]]
+  ].freeze
+
+  # The major brands of the ISOBMFF "ftyp" box that identify HEIF and AVIF
+  # images. These formats share the same leading layout as other "ftyp" files
+  # (e.g. MP4 video), so the brand at offset 8 is used to tell images apart.
+  # The brands are grouped per format family, because HEIF files may use any
+  # of the HEIF brands regardless of their extension (e.g. a ".heic" file
+  # with the "mif1" major brand).
+  FTYPE_IMAGE_BRANDS = {
+    heif: %w(heic heix hevc hevx mif1 msf1).map(&:b).freeze,
+    avif: %w(avif avis).map(&:b).freeze
+  }.freeze
+
+  # The leading markup of an SVG document, which is XML-based and therefore has
+  # no fixed binary signature.
+  SVG_SIGNATURES = ["<svg".b, "<?xml".b, "<!DOCTYPE svg".b].freeze
+
+  # The content types accepted for each image format detected from the file
+  # signature. The content type declared by the file must be one of these, so
+  # that the stored MIME type is consistent with the file contents. The lists
+  # include the aliases commonly used in the wild for the same format.
+  FORMAT_CONTENT_TYPES = {
+    png: %w(image/png),
+    jpeg: %w(image/jpeg image/jpg image/pjpeg),
+    gif: %w(image/gif),
+    bmp: %w(image/bmp image/x-ms-bmp image/windows-bmp),
+    tiff: %w(image/tiff image/x-tiff),
+    webp: %w(image/webp),
+    heif: %w(image/heic image/heif image/heic-sequence image/heif-sequence),
+    avif: %w(image/avif image/avis),
+    svg: %w(image/svg+xml)
+  }.freeze
+
+  def validate_each(record, attribute, value)
+    begin
+      values = parse_values(value)
+    rescue JSON::ParserError
+      record.errors.add attribute, :invalid
+      return
+    end
+
+    return if values.empty?
+
+    values.each do |val|
+      validate_image_content(record, attribute, val)
+    end
+  end
+
+  def check_validity!; end
+
+  private
+
+  def validate_image_content(record, attribute, file)
+    content_type = normalize_content_type(declared_content_type(file))
+    return unless content_type.start_with?("image/")
+
+    signature = file_signature(file)
+    return if signature.nil?
+
+    detected = image_format(signature)
+    return add_invalid_image(record, attribute) unless valid_image_format?(detected, content_type)
+
+    validate_svg_content(record, attribute, file) if detected == :svg
+  end
+
+  # The content type declared by the file, either through the blob of an
+  # attached file or through the upload itself.
+  def declared_content_type(file)
+    if file.is_a?(ActiveStorage::Attached)
+      file.blob&.content_type
+    else
+      file.try(:content_type)
+    end
+  end
+
+  # Strips the content type parameters (e.g. "image/png;charset=binary") and
+  # normalizes the casing, as content types are case insensitive.
+  def normalize_content_type(content_type)
+    content_type.to_s.split(";", 2).first.to_s.strip.downcase
+  end
+
+  # Whether the format detected from the file signature is one of the
+  # supported image formats and is consistent with the content type declared
+  # by the file.
+  def valid_image_format?(detected, content_type)
+    return false if detected.nil?
+
+    FORMAT_CONTENT_TYPES.fetch(detected).include?(content_type)
+  end
+
+  # Validates the contents of a file detected as SVG, which can contain active
+  # content. The validation is delegated to Decidim::SvgContentValidator, so
+  # that the SVG specific logic is kept out of this validator. Documents which
+  # are not well formed SVG documents are rejected as invalid images, and the
+  # ones which could execute scripts or read external resources when they are
+  # rendered are rejected as unsafe files.
+  def validate_svg_content(record, attribute, file)
+    case Decidim::SvgContentValidator.validate(file_content(file))
+    when :invalid
+      add_invalid_image(record, attribute)
+    when :unsafe
+      add_unsafe_svg(record, attribute)
+    end
+  end
+
+  def add_invalid_image(record, attribute)
+    record.errors.add attribute, I18n.t("decidim.errors.files.file_is_not_a_valid_image")
+  end
+
+  def add_unsafe_svg(record, attribute)
+    record.errors.add attribute, I18n.t("decidim.errors.files.file_contains_unsafe_content")
+  end
+
+  # Reads the leading bytes (signature) of the file. Returns nil when the file
+  # cannot be read, in which case the validation is skipped. Empty files yield
+  # an empty signature, which is rejected.
+  def file_signature(file)
+    read_file(file, SIGNATURE_LENGTH)
+  end
+
+  # Reads the whole contents of the file. Returns nil when the file cannot be
+  # read.
+  def file_content(file)
+    read_file(file)
+  end
+
+  # Reads the contents of the file, or only its leading bytes when a maximum
+  # length is given.
+  def read_file(file, max_length = nil)
+    if uploaded_file?(file)
+      File.open(file.path, "rb") { |io| read_io(io, max_length) }
+    elsif file.is_a?(ActiveStorage::Attached)
+      read_attached(file, max_length)
+    end
+  rescue ActiveStorage::Error, Errno::ENOENT, IOError
+    nil
+  end
+
+  # Reads the contents of an IO, or only its leading bytes when a maximum
+  # length is given. IO#read returns nil at the end of the file, so an empty
+  # file would otherwise be indistinguishable from an unreadable one and skip
+  # the validation. Normalizing it to an empty content keeps empty files
+  # rejected, while nil is kept for files which cannot be read at all.
+  def read_io(io, max_length = nil)
+    (max_length ? io.read(max_length) : io.read) || ""
+  end
+
+  # Reads the contents of an attached file. Blobs are only uploaded once the
+  # record is saved, so for still unpersisted blobs (e.g. an image assigned to
+  # a new record) the bytes are read from the pending attachable. Otherwise a
+  # spoofed image could be saved without being checked.
+  def read_attached(attached, max_length = nil)
+    blob = attached.blob
+    return read_blob(blob, max_length) if blob&.persisted?
+
+    read_pending_attachable(attached, max_length)
+  end
+
+  # ActiveStorage keeps the attachable of a pending attachment in the record's
+  # attachment changes until the blob is uploaded when the record is saved, so
+  # its contents can already be read during the validation.
+  def read_pending_attachable(attached, max_length = nil)
+    attachable = pending_attachable(attached)
+    if uploaded_file?(attachable) || attachable.is_a?(File)
+      File.open(attachable.path, "rb") { |io| read_io(io, max_length) }
+    elsif attachable.is_a?(Pathname)
+      File.open(attachable.to_path, "rb") { |io| read_io(io, max_length) }
+    elsif attachable.is_a?(Hash)
+      read_io_without_consuming(attachable[:io], max_length)
+    end
+  end
+
+  def pending_attachable(attached)
+    change = attached.record.try(:attachment_changes)&.[](attached.name.to_s)
+    change.try(:attachable)
+  end
+
+  # Reads the contents without consuming the IO, so ActiveStorage can still
+  # upload it after the validation.
+  def read_io_without_consuming(io, max_length = nil)
+    return unless io.respond_to?(:read) && io.respond_to?(:rewind)
+
+    io.rewind
+    content = read_io(io, max_length)
+    io.rewind
+    content
+  end
+
+  # Reads the whole contents of the blob, or only its leading bytes when a
+  # maximum length is given to keep the operation cheap for large files. The
+  # services return nil when the blob is empty, which is normalized to an
+  # empty content so that empty blobs are rejected. Falls back to opening the
+  # whole blob when the service does not support ranged downloads.
+  def read_blob(blob, max_length = nil)
+    return blob.download if max_length.nil?
+
+    blob.download_chunk(0...max_length) || ""
+  rescue NotImplementedError
+    blob.open { |io| read_io(io, max_length) }
+  end
+
+  # The image format detected from the file signature, or nil when the
+  # signature does not match any of the supported image formats.
+  def image_format(signature)
+    return nil if signature.blank?
+
+    binary_image_format(signature) || ftyp_image_format(signature) || svg_format(signature)
+  end
+
+  def binary_image_format(signature)
+    BINARY_IMAGE_SIGNATURES.find do |_format, pairs|
+      pairs.all? { |offset, bytes| signature[offset, bytes.bytesize] == bytes }
+    end&.first
+  end
+
+  # The format of an ISOBMFF-based image (HEIF or AVIF). These files start with
+  # a "ftyp" box at offset 4 followed by a major brand at offset 8.
+  def ftyp_image_format(signature)
+    return nil unless signature[4, 4] == "ftyp".b
+
+    FTYPE_IMAGE_BRANDS.find { |_format, brands| brands.include?(signature[8, 4]) }&.first
+  end
+
+  def svg_format(signature)
+    content = signature.sub(/\A\xEF\xBB\xBF/n, "").lstrip
+    return nil unless SVG_SIGNATURES.any? { |svg_signature| content.start_with?(svg_signature) }
+
+    :svg
+  end
+
+  def uploaded_file?(file)
+    return true if defined?(Rack::Test::UploadedFile) && file.is_a?(Rack::Test::UploadedFile)
+
+    file.is_a?(ActionDispatch::Http::UploadedFile)
+  end
+end

data/app/views/decidim/application/_radio_accordion.html.erb

@@ -12,7 +12,7 @@
   </label>
 
   <div data-controller="accordion" class="radio-accordion-section content-block__description editor-content">
-    <div id="panel-title--<%= panel_id %>" aria-hidden="true">
+    <div id="panel-title--<%= panel_id %>" aria-hidden="true" inert>
       <%= yield %>
     </div>
 
@@ -21,10 +21,6 @@
         <%= show_more_text %>
       </span>
       <%= icon "arrow-down-s-line" %>
-      <span>
-        <%= show_less_text %>
-      </span>
-      <%= icon "arrow-up-s-line" %>
     </button>
   </div>
 </div>

data/app/views/decidim/messaging/conversations/_add_conversation_users.html.erb

@@ -11,7 +11,7 @@
           spellcheck="false"
           autocomplete="off"
           placeholder="<%= t("add_users_placeholder", scope: "decidim.messaging.conversations.add_conversation_users") %>"
-          data-noresults="<%= t("no_results", scope: "decidim.messaging.conversations.add_conversation_users") %>"
+          data-no_results="<%= t("no_results", scope: "decidim.messaging.conversations.add_conversation_users") %>"
           data-selected="conversation__modal-results"
           contenteditable="true"
           data-direct-messages-disabled="<%= t("participant_with_disabled_message_reception", scope: "decidim.messaging.conversations.add_conversation_users") %>">

data/app/views/decidim/messaging/conversations/create.js.erb

@@ -1,3 +1 @@
-$("#messages").append("<%= j(render "messages", sender: conversation.messages.first.sender, messages: [conversation.messages.first]).html_safe %>");
-$("div[data-add-message]").replaceWith("<%= j(render "reply", form:, conversation:).html_safe %>");
-window.initFoundation($("#new_message_"));
+window.location.href = "<%= conversation_path(conversation) %>";

data/app/views/decidim/searches/_filters.html.erb

@@ -16,7 +16,7 @@
         </button>
       <% end %>
     </div>
-    <button id="dropdown-trigger-search" data-controller="dropdown" data-target="dropdown-menu-search" data-auto-close="true" aria-expanded="true">
+    <button id="dropdown-trigger-search" data-controller="dropdown" data-target="dropdown-menu-search" data-auto-close="true">
       <%= content_tag :span, t("decidim.searches.filters_small_view.filter_by"), class: "#{"is-active" if params.dig(:filter, :with_resource_type) == nil}" %>
       <% @blocks.each do |elements| %>
         <% elements.each do |type, results| %>

data/app/views/decidim/shared/_login_modal.html.erb

@@ -9,11 +9,9 @@
   %>
 
   <%= decidim_form_for(Decidim::User.new, namespace: "login", as: :user, url: path, html: { class: nil }) do |f| %>
-    <div>
-      <div class="flex flex-row">
-        <%= icon "user-line", class: "w-6 h-6 text-gray fill-current" %>
-        <h3 id="dialog-title-loginModal" class="h3 ml-1"><%= t(".please_log_in") %></h3>
-      </div>
+    <div data-dialog-container>
+      <%= icon "user-line" %>
+      <h3 id="dialog-title-loginModal" tabindex="-1" data-dialog-title><%= t(".please_log_in") %></h3>
 
       <div>
         <% if current_organization.sign_in_enabled? %>
@@ -44,16 +42,16 @@
             <%= render partial: "decidim/devise/shared/omniauth_buttons", locals: { is_horizontal: true } %>
           <% end %>
         <% end %>
-        <% if current_organization.sign_in_enabled? %>
-          <div data-dialog-actions>
-            <div class="form__wrapper-block w-full mb-4">
-              <button type="submit" class="button button__lg button__secondary">
-                <%= t("devise.sessions.new.log_in") %>
-              </button>
-            </div>
-          </div>
-        <% end %>
       </div>
     </div>
+    <% if current_organization.sign_in_enabled? %>
+      <div data-dialog-actions>
+        <div class="form__wrapper-block w-full mb-4">
+          <button type="submit" class="button button__lg button__secondary">
+            <%= t("devise.sessions.new.log_in") %>
+          </button>
+        </div>
+      </div>
+    <% end %>
   <% end %>
 <% end %>

data/app/views/layouts/decidim/_mailer_logo.html.erb

@@ -8,7 +8,7 @@
     <% if organization.logo.attached? %>
       <%= image_tag(
             organization.attached_uploader(:logo).variant_url(:medium, host: organization.host),
-            style: "max-height: 50px",
+            style: "max-height: 50px; display: inline-block",
             alt: organization_name(organization)
           ) %>
     <% else %>

data/app/views/layouts/decidim/footer/_main.html.erb

@@ -3,7 +3,7 @@
     <div class="lg:w-1/3">
       <%= render partial: "layouts/decidim/footer/main_intro" %>
     </div>
-    <div class="lg:w-2/3 grid grid-cols-1 gap-x-4 gap-y-10 lg:grid-cols-4 text-md text-white">
+    <div class="lg:w-2/3 grid grid-cols-1 gap-x-4 lg:grid-cols-4 text-md text-white">
       <%= render partial: "layouts/decidim/footer/main_links" %>
     </div>
   </div>

data/app/views/layouts/decidim/footer/_main_links.html.erb

@@ -1,31 +1,59 @@
-<%= footer_menu.render %>
+<div data-controller="accordion" data-multiselectable="true" class="contents">
+  <nav class="footer__nav" role="navigation" aria-label="<%= t("layouts.decidim.footer.decidim_title") %>">
+    <button type="button" id="panel-footer-menu-trigger" data-controls="panel-footer-menu" data-open-lg="true">
+      <span class="h4"><%= t("layouts.decidim.footer.decidim_title") %></span>
+      <%= icon "arrow-down-s-line" %>
+    </button>
+    <div id="panel-footer-menu" aria-hidden="true">
+      <%= footer_menu.render_menu_items %>
+    </div>
+  </nav>
 
-<nav role="navigation" aria-label="<%= t("layouts.decidim.user_menu.profile") %>">
-  <h2 class="h4 mb-4"><%= t("layouts.decidim.user_menu.profile") %></h2>
-  <ul class="space-y-4 break-inside-avoid">
-    <% if current_user %>
-      <li class="font-semibold underline"><%= link_to t("layouts.decidim.user_menu.configuration"), decidim.account_path %></li>
-      <li class="font-semibold underline"><%= link_to t("layouts.decidim.user_menu.public_profile"), decidim.profile_path(current_user.nickname) %></li>
-      <li class="font-semibold underline"><%= link_to t("layouts.decidim.user_menu.notifications"), decidim.notifications_path %></li>
-      <li class="font-semibold underline"><%= link_to t("layouts.decidim.user_menu.conversations"), decidim.conversations_path %></li>
-    <% else %>
-      <% if current_organization.sign_up_enabled? %>
-        <li class="font-semibold underline"><%= link_to t("layouts.decidim.footer.sign_up"), decidim.new_user_registration_path %></li>
-      <% end %>
-      <li class="font-semibold underline"><%= link_to t("layouts.decidim.footer.log_in"), decidim.new_user_session_path %></li>
-    <% end %>
-  </ul>
-</nav>
+  <nav class="footer__nav" role="navigation" aria-label="<%= t("layouts.decidim.user_menu.profile") %>">
+    <button type="button" id="panel-profile-trigger" data-controls="panel-profile" data-open-lg="true">
+      <span class="h4"><%= t("layouts.decidim.user_menu.profile") %></span>
+      <%= icon "arrow-down-s-line" %>
+    </button>
+    <div id="panel-profile" aria-hidden="true">
+      <ul>
+        <% if current_user %>
+          <li><%= link_to t("layouts.decidim.user_menu.configuration"), decidim.account_path %></li>
+          <li><%= link_to t("layouts.decidim.user_menu.public_profile"), decidim.profile_path(current_user.nickname) %></li>
+          <li><%= link_to t("layouts.decidim.user_menu.notifications"), decidim.notifications_path %></li>
+          <li><%= link_to t("layouts.decidim.user_menu.conversations"), decidim.conversations_path %></li>
+        <% else %>
+          <% if current_organization.sign_up_enabled? %>
+            <li><%= link_to t("layouts.decidim.footer.sign_up"), decidim.new_user_registration_path %></li>
+          <% end %>
+          <li><%= link_to t("layouts.decidim.footer.log_in"), decidim.new_user_session_path %></li>
+        <% end %>
+      </ul>
+    </div>
+  </nav>
 
-<nav role="navigation" aria-label="<%= t("layouts.decidim.footer.resources") %>">
-  <h2 class="h4 mb-4"><%= t("layouts.decidim.footer.resources") %></h2>
-  <ul class="space-y-4 break-inside-avoid">
-    <li class="font-semibold underline"><%= link_to t("decidim.profiles.show.activity"), decidim.last_activities_path %></li>
-    <% if Decidim.module_installed?(:meetings) %>
-      <li class="font-semibold underline"><%= link_to t("decidim.pages.home.extended.meetings"), Decidim::Meetings::DirectoryEngine.routes.url_helpers.root_path %></li>
-    <% end %>
-    <li class="font-semibold underline"><%= link_to t("layouts.decidim.footer.open_data"), decidim.open_data_path %></li>
-  </ul>
-</nav>
+  <nav class="footer__nav" role="navigation" aria-label="<%= t("layouts.decidim.footer.resources") %>">
+    <button type="button" id="panel-resources-trigger" data-controls="panel-resources" data-open-lg="true">
+      <span class="h4"><%= t("layouts.decidim.footer.resources") %></span>
+      <%= icon "arrow-down-s-line" %>
+    </button>
+    <div id="panel-resources" aria-hidden="true">
+      <ul>
+        <li><%= link_to t("decidim.profiles.show.activity"), decidim.last_activities_path %></li>
+        <% if Decidim.module_installed?(:meetings) %>
+          <li><%= link_to t("decidim.pages.home.extended.meetings"), Decidim::Meetings::DirectoryEngine.routes.url_helpers.root_path %></li>
+        <% end %>
+        <li><%= link_to t("layouts.decidim.footer.open_data"), decidim.open_data_path %></li>
+      </ul>
+    </div>
+  </nav>
 
-<%= cell("decidim/footer_topics", nil) %>
+  <nav class="footer__nav" role="navigation" aria-label="<%= t("layouts.decidim.footer.help") %>">
+    <button type="button" id="panel-help-trigger" data-controls="panel-help" data-open-lg="true">
+      <span class="h4"><%= t("layouts.decidim.footer.help") %></span>
+      <%= icon "arrow-down-s-line" %>
+    </button>
+    <div id="panel-help" aria-hidden="true">
+      <%= cell("decidim/footer_topics", nil) %>
+    </div>
+  </nav>
+</div>

data/app/views/layouts/decidim/header/_menu_breadcrumb_desktop.html.erb

@@ -2,6 +2,7 @@
   <span><%= t("decidim.menu.home") %></span>
 <% end %>
 <% truncatable_items = breadcrumb_items.compact_blank.drop(1) %>
+<% current_page_item = breadcrumb_items.compact_blank.select { |breadcrumb_item| breadcrumb_item[:active] }.last %>
 <% breadcrumb_items.each do |item| %>
   <% next if item.blank? %>
 
@@ -16,7 +17,7 @@
   <% end %>
   <span aria-hidden="true"><%= icon "arrow-right-s-line", class: "fill-white" %></span>
   <% if item[:url].present? && !is_active_link?(item[:url], :exclusive) %>
-    <%= link_to item[:url], class: trigger_classes.join(" "), data: (truncatable ? { breadcrumb_truncate_target: "item" } : {}), "aria-current": (item[:active] ? "page" : nil) do %>
+    <%= link_to item[:url], class: trigger_classes.join(" "), data: (truncatable ? { breadcrumb_truncate_target: "item" } : {}), "aria-current": (item == current_page_item ? "page" : nil) do %>
       <% if truncatable %>
         <span class="menu-bar__breadcrumb-desktop__label--truncatable">
           <span class="menu-bar__breadcrumb-text" data-breadcrumb-truncate-target="text"><%= item_label %></span>
@@ -27,7 +28,7 @@
     <% end %>
   <% else %>
     <%# This block is executed if the condition is false %>
-    <%= content_tag :span, class: [*trigger_classes, "no-interactive"].join(" "), data: (truncatable ? { breadcrumb_truncate_target: "item" } : {}), "aria-current": (item[:active] ? "page" : nil) do %>
+    <%= content_tag :span, class: [*trigger_classes, "no-interactive"].join(" "), data: (truncatable ? { breadcrumb_truncate_target: "item" } : {}), "aria-current": (item == current_page_item ? "page" : nil) do %>
       <% if truncatable %>
         <span class="menu-bar__breadcrumb-desktop__label--truncatable">
           <span class="menu-bar__breadcrumb-text" data-breadcrumb-truncate-target="text"><%= item_label %></span>

data/config/initializers/rack_attack.rb

@@ -34,6 +34,16 @@ if Rails.env.production? || Rails.env.test?
       Rack::Attack.throttle("limit password recovery attempts per email", limit: 5, period: 60.seconds) do |request|
         request.params["user"]["email"] if request.path == "/users/password" && request.post?
       end
+
+      # Throttle SMS verification confirmation attempts per IP to 10 reqs/minute
+      Rack::Attack.throttle("limit sms verification attempts per ip", limit: 10, period: 60.seconds) do |request|
+        request.ip if request.path.match?(%r{^/[^/]+/sms/authorizations(?:\.[^/]+)?$}) && request.put?
+      end
+
+      # Throttle postal letter verification confirmation attempts per IP to 10 reqs/minute
+      Rack::Attack.throttle("limit postal letter verification attempts per ip", limit: 10, period: 60.seconds) do |request|
+        request.ip if request.path.match?(%r{^/[^/]+/postal_letter/authorizations(?:\.[^/]+)?$}) && request.put?
+      end
     end
   end
 end

data/config/locales/bg.yml

@@ -1502,7 +1502,6 @@ bg:
   layouts:
     decidim:
       announcements:
-        view_less: Покажи по-малко
         view_more: Още информация
       data_consent:
         details:

data/config/locales/ca-IT.yml

@@ -252,6 +252,7 @@ ca-IT:
         create: "%{user_name} ha afegit el component %{resource_name} a l'espai %{space_name}"
         delete: "%{user_name} ha eliminat el component %{resource_name} de l'espai %{space_name}"
         export_component: "%{user_name} ha exportat %{resource_name}%{component_name} de %{space_name} com %{format_name}"
+        menu_hidden: "%{user_name} ha amagat el component %{resource_name} del menú de l'espai de participació: %{space_name}"
         publish: "%{user_name} ha publicat el component %{resource_name} a l'espai %{space_name}"
         restore: "%{user_name} ha restaurat el component %{resource_name} a l'espai %{space_name}"
         soft_delete: "%{user_name} ha mogut el component %{resource_name} a l'espai %{space_name} a la paperera"
@@ -1205,6 +1206,8 @@ ca-IT:
       dynamic:
         screen_reader_explanation: El següent element és un mapa que presenta els components d'aquesta pàgina com a punts al mapa. L'element es pot fer servir amb un lector de pantalla però pot ser difícil d'entendre.
         skip_button: Saltar el mapa
+        zoom_in: Ampliar
+        zoom_out: Allunyar
       static:
         latlng_text: 'latitud: %{latitude}, longitud: %{longitude}'
         map_service_brand: OpenStreetMap
@@ -1546,6 +1549,10 @@ ca-IT:
         never_logged_in: mai ha iniciat sessió
         subject: Avís de compte inactiu
     participatory_space:
+      labels:
+        reference: Referència de l'espai de participació
+        restricted: Espai de participació restringit
+        transparent: Espai de participació transparent
       pages:
         user_profile:
           member_of:
@@ -1704,6 +1711,8 @@ ca-IT:
       login_modal:
         please_log_in: Si us plau, inicia la sessió
         sign_up: Crea un compte
+      mentions:
+        search_prompt: Escriu aquí per cercar entre les participants
       mentions_modal:
         remove_recipient: Eliminar destinatària %{name}
       progress: Progrés
@@ -2086,7 +2095,6 @@ ca-IT:
   layouts:
     decidim:
       announcements:
-        view_less: Mostra menys
         view_more: Més informació
       data_consent:
         details: