decidim-core 0.32.1 → 0.32.2

data/app/controllers/decidim/private_downloads_controller.rb

@@ -5,6 +5,8 @@ module Decidim
     before_action :authenticate_user!
 
     def show
+      enforce_permission_to :read, :private_download
+
       return head :not_found unless private_download.attached?
       return head :not_found unless private_download.authorized_for?(current_user)
 

data/app/controllers/decidim/profiles_controller.rb

@@ -15,30 +15,41 @@ module Decidim
     before_action :ensure_profile_holder
     before_action :ensure_profile_holder_is_a_user, only: :following
     before_action :ensure_user_not_blocked
+    before_action :ensure_user_not_deleted
 
     def show
-      redirect_to profile_activity_path(nickname: params[:nickname].downcase)
+      enforce_permission_to :read, :profile
+
+      redirect_to profile_activity_path(nickname: params.expect(:nickname).downcase)
     end
 
     def following
+      enforce_permission_to :read, :profile
+
       @content_cell = "decidim/following"
       @title_key = "following"
       render :show
     end
 
     def followers
+      enforce_permission_to :read, :profile
+
       @content_cell = "decidim/followers"
       @title_key = "followers"
       render :show
     end
 
     def badges
+      enforce_permission_to :read, :profile
+
       @content_cell = "decidim/badges"
       @title_key = "badges"
       render :show
     end
 
     def activity
+      enforce_permission_to :read, :profile
+
       @content_cell = "decidim/user_activity"
       @title_key = "activity"
       render :show
@@ -46,6 +57,13 @@ module Decidim
 
     private
 
+    # Deleted users should not normally have a nickname, so in normal situation
+    # this should not be possible, but in some edge cases there may be accounts
+    # left behind with the username field still available.
+    def ensure_user_not_deleted
+      raise ActionController::RoutingError, "Deleted User" if profile_holder&.deleted?
+    end
+
     def ensure_user_not_blocked
       raise ActionController::RoutingError, "Blocked User" if profile_holder&.blocked? && !current_user&.admin?
     end

data/app/controllers/decidim/qr_controller.rb

@@ -7,7 +7,7 @@ module Decidim
     include Decidim::OrganizationHelper
     include Decidim::QrCodeHelper
 
-    helper_method :resource, :qr_code, :qr_code_image
+    helper_method :resource, :qr_code, :qr_code_image, :current_component, :current_participatory_space
     before_action :validate_resource
     before_action :validate_component
     before_action :validate_participatory_space
@@ -15,6 +15,8 @@ module Decidim
     layout false
 
     def show
+      enforce_permission_to :read, :qr_code
+
       respond_to do |format|
         format.html
         format.png { send_data(qr_code.as_png(size: 500), filename: "qr-#{organization_name}-#{parametrized_title}.png") }

data/app/controllers/decidim/resource_autocomplete_controller.rb

@@ -3,6 +3,8 @@
 module Decidim
   class ResourceAutocompleteController < Decidim::ApplicationController
     def index
+      enforce_permission_to :read, :search
+
       respond_to do |format|
         format.json do
           if term.blank?

data/app/controllers/decidim/searches_controller.rb

@@ -12,6 +12,8 @@ module Decidim
     helper_method :term
 
     def index
+      enforce_permission_to :read, :search
+
       Search.call(term, current_organization, filters, page_params) do
         on(:ok) do |results|
           results_count = results.sum { |results_by_type| results_by_type.last[:count] }

data/app/controllers/decidim/short_links_controller.rb

@@ -8,6 +8,8 @@ module Decidim
     # The index action redirects the user to the application root in case
     # someone tries to request the short link URL without an identifier.
     def index
+      enforce_permission_to :read, :short_link
+
       redirect_to decidim.root_path, status: :moved_permanently
     end
 
@@ -18,6 +20,8 @@ module Decidim
     # @raise [ActionController::RoutingError] if a short link does not exist
     #   with the given identifier
     def show
+      enforce_permission_to :read, :short_link
+
       raise ActionController::RoutingError, "Not Found" unless link
 
       redirect_to link.target_url, status: :moved_permanently

data/app/controllers/decidim/static_map_controller.rb

@@ -5,6 +5,8 @@ module Decidim
     skip_before_action :store_current_location
 
     def show
+      enforce_permission_to :read, :static_map
+
       send_data StaticMapGenerator.new(resource).data, type: "image/jpeg", disposition: "inline"
     end
 

data/app/controllers/decidim/timeouts_controller.rb

@@ -13,6 +13,8 @@ module Decidim
     prepend_before_action :skip_timeout, only: :seconds_until_timeout
 
     def seconds_until_timeout
+      enforce_permission_to :read, :timeout
+
       time_remaining = current_user ? Decidim.config.expire_session_after - (Time.current - Time.zone.at(user_session["last_request_at"])) : 0
       respond_to do |format|
         format.json { render json: { seconds_remaining: time_remaining.to_i }, status: :ok }
@@ -21,6 +23,8 @@ module Decidim
 
     # If user wants to continue session after inactivity warning.
     def heartbeat
+      enforce_permission_to :read, :timeout
+
       respond_to do |format|
         format.js
       end

data/app/controllers/decidim/tos_controller.rb

@@ -7,6 +7,8 @@ module Decidim
     skip_before_action :store_current_location
 
     def accept_tos
+      enforce_permission_to(:update, :user, current_user:)
+
       current_user.accepted_tos_version = Time.current
       if current_user.save!
         flash[:notice] = t("accept.success", scope: "decidim.pages.terms_of_service")

data/app/controllers/decidim/upload_validations_controller.rb

@@ -10,6 +10,8 @@ module Decidim
     before_action :underscore_params!
 
     def create
+      enforce_permission_to :create, :upload_validation
+
       @form = form(Decidim::UploadValidationForm).from_params(params)
 
       ValidateUpload.call(@form) do
@@ -23,14 +25,14 @@ module Decidim
       end
     end
 
+    private
+
     def organization_time_zone
       return Rails.application.config.time_zone unless current_organization
 
       super
     end
 
-    private
-
     def ensure_authenticated!
       return true unless current_organization
 

data/app/controllers/decidim/user_activities_controller.rb

@@ -12,8 +12,11 @@ module Decidim
     helper_method :activities, :resource_types, :user
 
     def index
+      enforce_permission_to :read, :profile
+
       raise ActionController::RoutingError, "Missing user: #{params[:nickname]}" unless user
       raise ActionController::RoutingError, "Blocked User" if user.blocked? && !current_user&.admin?
+      raise ActionController::RoutingError, "Deleted User" if user.deleted?
     end
 
     private

data/app/forms/decidim/upload_validation_form.rb

@@ -32,16 +32,22 @@ module Decidim
     private
 
     def file_validators
-      org = organization
-      PassthruValidator.new(
-        attributes: [property],
-        to: resource_class.constantize,
-        with: lambda { |record|
-          validate_with.tap do |hash|
-            hash.merge!(organization: record.try(:organization) || org) if !hash[:organization] && record.respond_to?(:organization=)
-          end
-        }
-      ).validate_each(self, property.to_sym, blob)
+      if resource_class.constantize == Decidim::ContentBlockAttachment && resource_class.constantize.validators_on(property.to_sym).none?
+        extension = blob.filename.to_s.split(".").last&.downcase
+        allowed = Decidim::RecordImageUploader.new(nil, :file).extension_allowlist
+        errors.add(property.to_sym, I18n.t("errors.messages.allowed_file_content_types", types: allowed.join(", "))) if extension.present? && allowed.exclude?(extension)
+      else
+        org = organization
+        PassthruValidator.new(
+          attributes: [property],
+          to: resource_class.constantize,
+          with: lambda { |record|
+            validate_with.tap do |hash|
+              hash.merge!(organization: record.try(:organization) || org) if !hash[:organization] && record.respond_to?(:organization=)
+            end
+          }
+        ).validate_each(self, property.to_sym, blob)
+      end
     end
 
     def validate_with

data/app/helpers/concerns/decidim/user_role_checker.rb

@@ -10,35 +10,60 @@ module Decidim
     def user_has_any_role?(user, participatory_space = nil, broad_check: false)
       return false unless user
 
-      [
-        user.admin,
-        user.roles.any?,
-        participatory_process_user_role?(user, participatory_space, broad_check:),
-        assembly_user_role?(user, participatory_space, broad_check:),
-        conference_user_role?(user, participatory_space, broad_check:)
-      ].any?
+      @user_has_any_role_cache ||= {}
+      cache_key = [user.id, participatory_space&.class&.name, participatory_space&.id, broad_check]
+      return @user_has_any_role_cache[cache_key] if @user_has_any_role_cache.has_key?(cache_key)
+
+      @user_has_any_role_cache[cache_key] = global_user_role?(user) || space_user_role?(user, participatory_space, broad_check:)
+    end
+
+    def global_user_role?(user)
+      user.admin || user.roles.any?
+    end
+
+    def space_user_role?(user, participatory_space, broad_check: false)
+      return participatory_process_user_role?(user, participatory_space, broad_check:) if participatory_process_space?(participatory_space)
+      return assembly_user_role?(user, participatory_space, broad_check:) if assembly_space?(participatory_space)
+      return conference_user_role?(user, participatory_space, broad_check:) if conference_space?(participatory_space)
+      return false unless broad_check
+
+      participatory_process_user_role?(user, nil, broad_check: true) ||
+        assembly_user_role?(user, nil, broad_check: true) ||
+        conference_user_role?(user, nil, broad_check: true)
+    end
+
+    def participatory_process_space?(participatory_space)
+      Decidim.module_installed?(:participatory_processes) && participatory_space.is_a?(Decidim::ParticipatoryProcess)
+    end
+
+    def assembly_space?(participatory_space)
+      Decidim.module_installed?(:assemblies) && participatory_space.is_a?(Decidim::Assembly)
+    end
+
+    def conference_space?(participatory_space)
+      Decidim.module_installed?(:conferences) && participatory_space.is_a?(Decidim::Conference)
     end
 
     def participatory_process_user_role?(user, participatory_process = nil, broad_check: false)
       return false unless Decidim.module_installed?(:participatory_processes)
+      return false unless participatory_process.nil? || participatory_process.is_a?(Decidim::ParticipatoryProcess)
       return Decidim::ParticipatoryProcessUserRole.exists?(user:) if broad_check
-      return false unless participatory_process.is_a?(Decidim::ParticipatoryProcess)
 
       Decidim::ParticipatoryProcessUserRole.exists?(user:, participatory_process:)
     end
 
     def assembly_user_role?(user, assembly = nil, broad_check: false)
       return false unless Decidim.module_installed?(:assemblies)
+      return false unless assembly.nil? || assembly.is_a?(Decidim::Assembly)
       return Decidim::AssemblyUserRole.exists?(user:) if broad_check
-      return false unless assembly.is_a?(Decidim::Assembly)
 
       Decidim::AssemblyUserRole.exists?(user:, assembly:)
     end
 
     def conference_user_role?(user, conference = nil, broad_check: false)
       return false unless Decidim.module_installed?(:conferences)
+      return false unless conference.nil? || conference.is_a?(Decidim::Conference)
       return Decidim::ConferenceUserRole.exists?(user:) if broad_check
-      return false unless conference.is_a?(Decidim::Conference)
 
       Decidim::ConferenceUserRole.exists?(user:, conference:)
     end

data/app/helpers/decidim/decidim_form_helper.rb

@@ -194,7 +194,7 @@ module Decidim
       options[:data] ||= {}
       options[:data].update(live_validate: true, validate_on_blur: true)
       options[:data].update(controller: "") unless options[:data].has_key?(:controller)
-      options[:data][:controller] += " form-validator"
+      options[:data][:controller] += " form-validator autofocus"
       options[:data][:controller].strip!
 
       options[:html] ||= {}

data/app/helpers/decidim/sanitize_helper.rb

@@ -55,8 +55,18 @@ module Decidim
       )
     end
 
+    # Public: Escapes the HTML special characters of a user-inputted string.
+    #
+    # The result is marked as HTML-safe, so that when the views output it with
+    # `<%= %>` (or pass it to a tag helper) Rails does not escape it a second
+    # time. Otherwise, a text such as `O'Neil` would end up as `O&amp;#39;Neil` in
+    # the HTML and the browser would display the `&#39;` entity literally.
+    #
+    # text - A String (or an object responding to `to_str`).
+    #
+    # Returns an HTML-safe String.
     def decidim_html_escape(text)
-      ERB::Util.unwrapped_html_escape(text.to_str)
+      ERB::Util.html_escape(text.to_str)
     end
 
     def decidim_url_escape(text)

data/app/jobs/decidim/application_job.rb

@@ -2,6 +2,10 @@
 
 module Decidim
   class ApplicationJob < ActiveJob::Base
+    # Wait until the commits on the transaction are actually on the database
+    # before running the jobs, preventing possible race conditions.
+    self.enqueue_after_transaction_commit = true
+
     # Automatically retry jobs that encountered a deadlock
     retry_on ActiveRecord::Deadlocked
 

data/app/models/decidim/authorization.rb

@@ -98,6 +98,30 @@ module Decidim
       user == self.user
     end
 
+    def record_failed_attempt!
+      with_lock do
+        increment!(:failed_attempts) # rubocop:disable Rails/SkipsModelValidations
+        return unless failed_attempts >= Decidim.verification_max_failed_attempts
+
+        update!(locked_at: Time.current)
+      end
+    end
+
+    def reset_failed_attempts!
+      update!(failed_attempts: 0, locked_at: nil)
+    end
+
+    def locked_for_confirmation?
+      locked_at.present? && locked_at + Decidim.verification_unlock_in > Time.current
+    end
+
+    def clear_expired_lock!
+      return if locked_at.blank?
+      return if locked_for_confirmation?
+
+      update!(locked_at: nil, failed_attempts: 0)
+    end
+
     private
 
     def active_handler?

data/app/models/decidim/oauth_application.rb

@@ -18,6 +18,7 @@ module Decidim
       :organization_logo,
       file_size: { less_than_or_equal_to: ->(record) { record.maximum_upload_size } },
       uploader_content_type: true,
+      uploader_image_content: true,
       uploader_image_dimensions: true
     )
     attached_config[:organization_logo] = OpenStruct.new(uploader: OAuthApplicationLogoUploader)

data/app/models/decidim/user.rb

@@ -32,6 +32,7 @@ module Decidim
     has_many :access_tokens, class_name: "Doorkeeper::AccessToken", foreign_key: :resource_owner_id, dependent: :destroy
     has_many :reminders, foreign_key: "decidim_user_id", class_name: "Decidim::Reminder", dependent: :destroy
     has_many :private_exports, class_name: "Decidim::PrivateExport", dependent: :destroy, inverse_of: :attached_to, as: :attached_to
+    has_many :impersonation_logs, foreign_key: "decidim_user_id", class_name: "Decidim::ImpersonationLog", dependent: :destroy
 
     validates :name, presence: true, unless: -> { deleted? }
     validates :nickname,

data/app/models/decidim/user_base_entity.rb

@@ -62,7 +62,7 @@ module Decidim
     end
 
     def users_followings
-      @users_followings ||= Decidim::UserBaseEntity.joins(:follows).where(decidim_follows: { user: self })
+      @users_followings ||= Decidim::UserBaseEntity.joins(:follows).where(decidim_follows: { user: self }).order(decidim_follows: { created_at: :asc, id: :asc })
     end
 
     def followings_blocked?

data/app/packs/src/decidim/callout.js

@@ -19,3 +19,13 @@ document.addEventListener("turbo:load", () => {
     callout.innerHTML += " ";
   }, 500);
 });
+
+document.addEventListener("click", (event) => {
+  const closeButton = event.target.closest("[data-alert-box] [data-close]");
+
+  if (!closeButton) {
+    return;
+  }
+
+  closeButton.closest("[data-alert-box]").remove();
+});

data/app/packs/src/decidim/callout.test.js

@@ -0,0 +1,32 @@
+import "src/decidim/callout"
+
+describe("callout close button", () => {
+  beforeEach(() => {
+    document.body.innerHTML = `
+      <div id="flash-messages-container">
+        <div class="flash success" data-alert-box role="alert" aria-atomic="true">
+          <div class="flash__message">Signed in successfully.</div>
+          <button type="button" class="close-button" data-close aria-label="Dismiss">×</button>
+        </div>
+      </div>
+    `;
+  });
+
+  it("removes the alert box when the close button is clicked", () => {
+    const closeButton = document.querySelector("[data-close]");
+
+    expect(document.querySelector("[data-alert-box]")).not.toBeNull();
+
+    closeButton.click();
+
+    expect(document.querySelector("[data-alert-box]")).toBeNull();
+  });
+
+  it("does nothing when clicking outside of the close button", () => {
+    const message = document.querySelector(".flash__message");
+
+    message.click();
+
+    expect(document.querySelector("[data-alert-box]")).not.toBeNull();
+  });
+});

data/app/packs/src/decidim/controllers/accordion/accordion.test.js

@@ -1,3 +1,4 @@
+/* eslint max-lines: ["error", 350] */
 /* global jest */
 
 import AccordionController from "src/decidim/controllers/accordion/controller";
@@ -99,6 +100,69 @@ describe("AccordionController", () => {
     });
   });
 
+  describe("_setupInertPanels", () => {
+    const nextTick = () => new Promise((resolve) => setTimeout(resolve, 0));
+
+    beforeEach(() => {
+      panel1.setAttribute("inert", "");
+      panel1.setAttribute("aria-hidden", "true");
+      panel1.setAttribute("tabindex", "-1");
+      panel2.setAttribute("aria-hidden", "true");
+    });
+
+    it("only manages panels with the inert attribute", async () => {
+      controller._setupInertPanels();
+      expect(controller._panelObservers.length).toBe(1);
+
+      panel2.setAttribute("aria-hidden", "false");
+      await nextTick();
+      expect(panel2.hasAttribute("inert")).toBe(false);
+      expect("inertManaged" in panel2.dataset).toBe(false);
+    });
+
+    it("removes inert and moves focus to the panel when it gets expanded", async () => {
+      controller._setupInertPanels();
+
+      panel1.setAttribute("aria-hidden", "false");
+      await nextTick();
+      expect(panel1.hasAttribute("inert")).toBe(false);
+      expect(document.activeElement).toBe(panel1);
+    });
+
+    it("restores inert when the panel gets collapsed again", async () => {
+      controller._setupInertPanels();
+
+      panel1.setAttribute("aria-hidden", "false");
+      await nextTick();
+      panel1.setAttribute("aria-hidden", "true");
+      await nextTick();
+      expect(panel1.hasAttribute("inert")).toBe(true);
+    });
+
+    it("keeps managing an expanded panel across teardown and setup", async () => {
+      controller._setupInertPanels();
+
+      panel1.setAttribute("aria-hidden", "false");
+      await nextTick();
+      controller._teardownInertPanels();
+
+      panel1.setAttribute("aria-hidden", "true");
+      controller._setupInertPanels();
+      expect(controller._panelObservers.length).toBe(1);
+      expect(panel1.hasAttribute("inert")).toBe(true);
+    });
+
+    it("stops syncing after teardown", async () => {
+      controller._setupInertPanels();
+      controller._teardownInertPanels();
+      expect(controller._panelObservers.length).toBe(0);
+
+      panel1.setAttribute("aria-hidden", "false");
+      await nextTick();
+      expect(panel1.hasAttribute("inert")).toBe(true);
+    });
+  });
+
   describe("_applyBreakpointOpenAttributes", () => {
     beforeEach(() => {
       controller.initialize();

data/app/packs/src/decidim/controllers/accordion/controller.js

@@ -31,6 +31,8 @@ export default class extends Controller {
 
     this.fixPanelRole();
 
+    this._setupInertPanels();
+
     this.expandIfNeeded();
 
     this.boundReconnect = this.reconnect.bind(this);
@@ -52,6 +54,8 @@ export default class extends Controller {
       this.toggleButton.removeEventListener("click", this.boundExpand);
     }
 
+    this._teardownInertPanels();
+
     this._stopListeningForBreakpointChanges();
   }
 
@@ -166,6 +170,45 @@ export default class extends Controller {
     this.previouslyExpanded = this.toggleButton.getAttribute("aria-expanded");
   }
 
+  /**
+   * Syncs the `inert` attribute of partially visible panels (those rendered
+   * inert) with their `aria-hidden` state, moving focus to the panel on expand.
+   *
+   * @returns {void}
+   */
+  _setupInertPanels() {
+    this._panelObservers = [];
+
+    this.element.querySelectorAll("[data-controls]").forEach((trigger) => {
+      const panel = document.getElementById(trigger.dataset.controls);
+      if (!panel || (!panel.hasAttribute("inert") && !("inertManaged" in panel.dataset))) {
+        return;
+      }
+
+      panel.dataset.inertManaged = "";
+      panel.toggleAttribute("inert", panel.getAttribute("aria-hidden") === "true");
+
+      const observer = new MutationObserver(() => {
+        if (panel.getAttribute("aria-hidden") === "true") {
+          panel.setAttribute("inert", "");
+        } else {
+          panel.removeAttribute("inert");
+          panel.focus();
+        }
+      });
+      observer.observe(panel, { attributes: true, attributeFilter: ["aria-hidden"] });
+
+      this._panelObservers.push(observer);
+    });
+  }
+
+  _teardownInertPanels() {
+    if (this._panelObservers) {
+      this._panelObservers.forEach((observer) => observer.disconnect());
+      this._panelObservers = [];
+    }
+  }
+
   fixPanelRole() {
     const panelRole = this.element.dataset.panelRole;
     if (!panelRole) {

data/app/packs/src/decidim/controllers/autofocus/controller.js

@@ -0,0 +1,30 @@
+import { Controller } from "@hotwired/stimulus"
+import autofocus from "src/decidim/refactor/implementation/autofocus"
+
+export default class extends Controller {
+  connect() {
+    this.handleTabsChange = this.handleTabsChange.bind(this)
+
+    // Foundation tabs (used for translated fields when locales <= 4)
+    this.tabs = Array.from(this.element.querySelectorAll("ul[data-tabs]"))
+    if (typeof $ === "function" && this.tabs.length > 0) {
+      this.tabs.forEach((tabs) => $(tabs).on("change.zf.tabs", this.handleTabsChange))
+    }
+
+    // Language selector dropdown (used for translated fields when locales > 4)
+    if (this.element.querySelector("select.language-change")) {
+      autofocus(this.element)
+    }
+  }
+
+  disconnect() {
+    if (typeof $ === "function" && this.tabs && this.tabs.length > 0) {
+      this.tabs.forEach((tabs) => $(tabs).off("change.zf.tabs", this.handleTabsChange))
+    }
+  }
+
+  handleTabsChange(event) {
+    const activePane = $(event.target).parent().next(".tabs-content").find(".tabs-panel.is-active")[0]
+    autofocus(activePane)
+  }
+}