decidim-core 0.32.1 → 0.32.2

data/app/validators/uploader_image_content_validator.rb

@@ -0,0 +1,276 @@
+# frozen_string_literal: true
+
+# This validator ensures that files declared as images actually contain valid
+# image data of the declared format. It does so by checking the leading bytes
+# (magic bytes / file signature) of the file against the known signatures of
+# the supported image formats, and by comparing the detected format with the
+# content type declared by the file.
+#
+# This prevents non-image files (e.g. HTML, MATLAB, or arbitrary binary data)
+# from being uploaded with an image extension and a spoofed image content type.
+# Such files would later cause image processing to fail (e.g. in ImageMagick or
+# in libvips when generating a variant) and could lead to a denial of service.
+#
+# Comparing the detected format with the declared content type also prevents
+# files whose contents do not match their declaration (e.g. a JPEG file
+# declared as image/png), so that the stored MIME type is consistent with the
+# file contents.
+#
+# SVG documents are XML-based and can contain scripts and other active content,
+# which is executed when the document is rendered by the browser. Because of
+# that, the contents of files detected as SVG are additionally validated by
+# Decidim::SvgContentValidator, so that documents which could execute scripts
+# or read external resources are rejected instead of being stored as they are.
+class UploaderImageContentValidator < ActiveModel::Validations::FileContentTypeValidator
+  # The number of leading bytes to read from the file to detect its signature.
+  SIGNATURE_LENGTH = 128
+
+  # The known signatures of the supported binary image formats. Each entry
+  # associates a format with a list of [offset, bytes] pairs that must all
+  # match at their respective offsets for the file to be considered of that
+  # format.
+  BINARY_IMAGE_SIGNATURES = [
+    [:png, [[0, "\x89PNG\r\n\x1A\n".b]]],
+    [:jpeg, [[0, "\xFF\xD8\xFF".b]]],
+    [:gif, [[0, "GIF87a".b]]],
+    [:gif, [[0, "GIF89a".b]]],
+    [:bmp, [[0, "BM".b]]],
+    [:tiff, [[0, "II*\x00".b]]],
+    [:tiff, [[0, "MM\x00*".b]]],
+    [:webp, [[0, "RIFF".b], [8, "WEBP".b]]]
+  ].freeze
+
+  # The major brands of the ISOBMFF "ftyp" box that identify HEIF and AVIF
+  # images. These formats share the same leading layout as other "ftyp" files
+  # (e.g. MP4 video), so the brand at offset 8 is used to tell images apart.
+  # The brands are grouped per format family, because HEIF files may use any
+  # of the HEIF brands regardless of their extension (e.g. a ".heic" file
+  # with the "mif1" major brand).
+  FTYPE_IMAGE_BRANDS = {
+    heif: %w(heic heix hevc hevx mif1 msf1).map(&:b).freeze,
+    avif: %w(avif avis).map(&:b).freeze
+  }.freeze
+
+  # The leading markup of an SVG document, which is XML-based and therefore has
+  # no fixed binary signature.
+  SVG_SIGNATURES = ["<svg".b, "<?xml".b, "<!DOCTYPE svg".b].freeze
+
+  # The content types accepted for each image format detected from the file
+  # signature. The content type declared by the file must be one of these, so
+  # that the stored MIME type is consistent with the file contents. The lists
+  # include the aliases commonly used in the wild for the same format.
+  FORMAT_CONTENT_TYPES = {
+    png: %w(image/png),
+    jpeg: %w(image/jpeg image/jpg image/pjpeg),
+    gif: %w(image/gif),
+    bmp: %w(image/bmp image/x-ms-bmp image/windows-bmp),
+    tiff: %w(image/tiff image/x-tiff),
+    webp: %w(image/webp),
+    heif: %w(image/heic image/heif image/heic-sequence image/heif-sequence),
+    avif: %w(image/avif image/avis),
+    svg: %w(image/svg+xml)
+  }.freeze
+
+  def validate_each(record, attribute, value)
+    begin
+      values = parse_values(value)
+    rescue JSON::ParserError
+      record.errors.add attribute, :invalid
+      return
+    end
+
+    return if values.empty?
+
+    values.each do |val|
+      validate_image_content(record, attribute, val)
+    end
+  end
+
+  def check_validity!; end
+
+  private
+
+  def validate_image_content(record, attribute, file)
+    content_type = normalize_content_type(declared_content_type(file))
+    return unless content_type.start_with?("image/")
+
+    signature = file_signature(file)
+    return if signature.nil?
+
+    detected = image_format(signature)
+    return add_invalid_image(record, attribute) unless valid_image_format?(detected, content_type)
+
+    validate_svg_content(record, attribute, file) if detected == :svg
+  end
+
+  # The content type declared by the file, either through the blob of an
+  # attached file or through the upload itself.
+  def declared_content_type(file)
+    if file.is_a?(ActiveStorage::Attached)
+      file.blob&.content_type
+    else
+      file.try(:content_type)
+    end
+  end
+
+  # Strips the content type parameters (e.g. "image/png;charset=binary") and
+  # normalizes the casing, as content types are case insensitive.
+  def normalize_content_type(content_type)
+    content_type.to_s.split(";", 2).first.to_s.strip.downcase
+  end
+
+  # Whether the format detected from the file signature is one of the
+  # supported image formats and is consistent with the content type declared
+  # by the file.
+  def valid_image_format?(detected, content_type)
+    return false if detected.nil?
+
+    FORMAT_CONTENT_TYPES.fetch(detected).include?(content_type)
+  end
+
+  # Validates the contents of a file detected as SVG, which can contain active
+  # content. The validation is delegated to Decidim::SvgContentValidator, so
+  # that the SVG specific logic is kept out of this validator. Documents which
+  # are not well formed SVG documents are rejected as invalid images, and the
+  # ones which could execute scripts or read external resources when they are
+  # rendered are rejected as unsafe files.
+  def validate_svg_content(record, attribute, file)
+    case Decidim::SvgContentValidator.validate(file_content(file))
+    when :invalid
+      add_invalid_image(record, attribute)
+    when :unsafe
+      add_unsafe_svg(record, attribute)
+    end
+  end
+
+  def add_invalid_image(record, attribute)
+    record.errors.add attribute, I18n.t("decidim.errors.files.file_is_not_a_valid_image")
+  end
+
+  def add_unsafe_svg(record, attribute)
+    record.errors.add attribute, I18n.t("decidim.errors.files.file_contains_unsafe_content")
+  end
+
+  # Reads the leading bytes (signature) of the file. Returns nil when the file
+  # cannot be read, in which case the validation is skipped. Empty files yield
+  # an empty signature, which is rejected.
+  def file_signature(file)
+    read_file(file, SIGNATURE_LENGTH)
+  end
+
+  # Reads the whole contents of the file. Returns nil when the file cannot be
+  # read.
+  def file_content(file)
+    read_file(file)
+  end
+
+  # Reads the contents of the file, or only its leading bytes when a maximum
+  # length is given.
+  def read_file(file, max_length = nil)
+    if uploaded_file?(file)
+      File.open(file.path, "rb") { |io| read_io(io, max_length) }
+    elsif file.is_a?(ActiveStorage::Attached)
+      read_attached(file, max_length)
+    end
+  rescue ActiveStorage::Error, Errno::ENOENT, IOError
+    nil
+  end
+
+  # Reads the contents of an IO, or only its leading bytes when a maximum
+  # length is given. IO#read returns nil at the end of the file, so an empty
+  # file would otherwise be indistinguishable from an unreadable one and skip
+  # the validation. Normalizing it to an empty content keeps empty files
+  # rejected, while nil is kept for files which cannot be read at all.
+  def read_io(io, max_length = nil)
+    (max_length ? io.read(max_length) : io.read) || ""
+  end
+
+  # Reads the contents of an attached file. Blobs are only uploaded once the
+  # record is saved, so for still unpersisted blobs (e.g. an image assigned to
+  # a new record) the bytes are read from the pending attachable. Otherwise a
+  # spoofed image could be saved without being checked.
+  def read_attached(attached, max_length = nil)
+    blob = attached.blob
+    return read_blob(blob, max_length) if blob&.persisted?
+
+    read_pending_attachable(attached, max_length)
+  end
+
+  # ActiveStorage keeps the attachable of a pending attachment in the record's
+  # attachment changes until the blob is uploaded when the record is saved, so
+  # its contents can already be read during the validation.
+  def read_pending_attachable(attached, max_length = nil)
+    attachable = pending_attachable(attached)
+    if uploaded_file?(attachable) || attachable.is_a?(File)
+      File.open(attachable.path, "rb") { |io| read_io(io, max_length) }
+    elsif attachable.is_a?(Pathname)
+      File.open(attachable.to_path, "rb") { |io| read_io(io, max_length) }
+    elsif attachable.is_a?(Hash)
+      read_io_without_consuming(attachable[:io], max_length)
+    end
+  end
+
+  def pending_attachable(attached)
+    change = attached.record.try(:attachment_changes)&.[](attached.name.to_s)
+    change.try(:attachable)
+  end
+
+  # Reads the contents without consuming the IO, so ActiveStorage can still
+  # upload it after the validation.
+  def read_io_without_consuming(io, max_length = nil)
+    return unless io.respond_to?(:read) && io.respond_to?(:rewind)
+
+    io.rewind
+    content = read_io(io, max_length)
+    io.rewind
+    content
+  end
+
+  # Reads the whole contents of the blob, or only its leading bytes when a
+  # maximum length is given to keep the operation cheap for large files. The
+  # services return nil when the blob is empty, which is normalized to an
+  # empty content so that empty blobs are rejected. Falls back to opening the
+  # whole blob when the service does not support ranged downloads.
+  def read_blob(blob, max_length = nil)
+    return blob.download if max_length.nil?
+
+    blob.download_chunk(0...max_length) || ""
+  rescue NotImplementedError
+    blob.open { |io| read_io(io, max_length) }
+  end
+
+  # The image format detected from the file signature, or nil when the
+  # signature does not match any of the supported image formats.
+  def image_format(signature)
+    return nil if signature.blank?
+
+    binary_image_format(signature) || ftyp_image_format(signature) || svg_format(signature)
+  end
+
+  def binary_image_format(signature)
+    BINARY_IMAGE_SIGNATURES.find do |_format, pairs|
+      pairs.all? { |offset, bytes| signature[offset, bytes.bytesize] == bytes }
+    end&.first
+  end
+
+  # The format of an ISOBMFF-based image (HEIF or AVIF). These files start with
+  # a "ftyp" box at offset 4 followed by a major brand at offset 8.
+  def ftyp_image_format(signature)
+    return nil unless signature[4, 4] == "ftyp".b
+
+    FTYPE_IMAGE_BRANDS.find { |_format, brands| brands.include?(signature[8, 4]) }&.first
+  end
+
+  def svg_format(signature)
+    content = signature.sub(/\A\xEF\xBB\xBF/n, "").lstrip
+    return nil unless SVG_SIGNATURES.any? { |svg_signature| content.start_with?(svg_signature) }
+
+    :svg
+  end
+
+  def uploaded_file?(file)
+    return true if defined?(Rack::Test::UploadedFile) && file.is_a?(Rack::Test::UploadedFile)
+
+    file.is_a?(ActionDispatch::Http::UploadedFile)
+  end
+end

data/app/views/decidim/application/_radio_accordion.html.erb

@@ -12,7 +12,7 @@
   </label>
 
   <div data-controller="accordion" class="radio-accordion-section content-block__description editor-content">
-    <div id="panel-title--<%= panel_id %>" aria-hidden="true">
+    <div id="panel-title--<%= panel_id %>" aria-hidden="true" inert>
       <%= yield %>
     </div>
 
@@ -21,10 +21,6 @@
         <%= show_more_text %>
       </span>
       <%= icon "arrow-down-s-line" %>
-      <span>
-        <%= show_less_text %>
-      </span>
-      <%= icon "arrow-up-s-line" %>
     </button>
   </div>
 </div>

data/app/views/decidim/messaging/conversations/_add_conversation_users.html.erb

@@ -11,7 +11,7 @@
           spellcheck="false"
           autocomplete="off"
           placeholder="<%= t("add_users_placeholder", scope: "decidim.messaging.conversations.add_conversation_users") %>"
-          data-noresults="<%= t("no_results", scope: "decidim.messaging.conversations.add_conversation_users") %>"
+          data-no_results="<%= t("no_results", scope: "decidim.messaging.conversations.add_conversation_users") %>"
           data-selected="conversation__modal-results"
           contenteditable="true"
           data-direct-messages-disabled="<%= t("participant_with_disabled_message_reception", scope: "decidim.messaging.conversations.add_conversation_users") %>">

data/app/views/decidim/messaging/conversations/create.js.erb

@@ -1,3 +1 @@
-$("#messages").append("<%= j(render "messages", sender: conversation.messages.first.sender, messages: [conversation.messages.first]).html_safe %>");
-$("div[data-add-message]").replaceWith("<%= j(render "reply", form:, conversation:).html_safe %>");
-window.initFoundation($("#new_message_"));
+window.location.href = "<%= conversation_path(conversation) %>";

data/app/views/decidim/shared/_login_modal.html.erb

@@ -9,11 +9,9 @@
   %>
 
   <%= decidim_form_for(Decidim::User.new, namespace: "login", as: :user, url: path, html: { class: nil }) do |f| %>
-    <div>
-      <div class="flex flex-row">
-        <%= icon "user-line", class: "w-6 h-6 text-gray fill-current" %>
-        <h3 id="dialog-title-loginModal" class="h3 ml-1"><%= t(".please_log_in") %></h3>
-      </div>
+    <div data-dialog-container>
+      <%= icon "user-line" %>
+      <h3 id="dialog-title-loginModal" tabindex="-1" data-dialog-title><%= t(".please_log_in") %></h3>
 
       <div>
         <% if current_organization.sign_in_enabled? %>
@@ -44,16 +42,16 @@
             <%= render partial: "decidim/devise/shared/omniauth_buttons", locals: { is_horizontal: true } %>
           <% end %>
         <% end %>
-        <% if current_organization.sign_in_enabled? %>
-          <div data-dialog-actions>
-            <div class="form__wrapper-block w-full mb-4">
-              <button type="submit" class="button button__lg button__secondary">
-                <%= t("devise.sessions.new.log_in") %>
-              </button>
-            </div>
-          </div>
-        <% end %>
       </div>
     </div>
+    <% if current_organization.sign_in_enabled? %>
+      <div data-dialog-actions>
+        <div class="form__wrapper-block w-full mb-4">
+          <button type="submit" class="button button__lg button__secondary">
+            <%= t("devise.sessions.new.log_in") %>
+          </button>
+        </div>
+      </div>
+    <% end %>
   <% end %>
 <% end %>

data/app/views/layouts/decidim/_mailer_logo.html.erb

@@ -8,7 +8,7 @@
     <% if organization.logo.attached? %>
       <%= image_tag(
             organization.attached_uploader(:logo).variant_url(:medium, host: organization.host),
-            style: "max-height: 50px",
+            style: "max-height: 50px; display: inline-block",
             alt: organization_name(organization)
           ) %>
     <% else %>

data/app/views/layouts/decidim/header/_menu_breadcrumb_desktop.html.erb

@@ -2,6 +2,7 @@
   <span><%= t("decidim.menu.home") %></span>
 <% end %>
 <% truncatable_items = breadcrumb_items.compact_blank.drop(1) %>
+<% current_page_item = breadcrumb_items.compact_blank.select { |breadcrumb_item| breadcrumb_item[:active] }.last %>
 <% breadcrumb_items.each do |item| %>
   <% next if item.blank? %>
 
@@ -16,7 +17,7 @@
   <% end %>
   <span aria-hidden="true"><%= icon "arrow-right-s-line", class: "fill-white" %></span>
   <% if item[:url].present? && !is_active_link?(item[:url], :exclusive) %>
-    <%= link_to item[:url], class: trigger_classes.join(" "), data: (truncatable ? { breadcrumb_truncate_target: "item" } : {}), "aria-current": (item[:active] ? "page" : nil) do %>
+    <%= link_to item[:url], class: trigger_classes.join(" "), data: (truncatable ? { breadcrumb_truncate_target: "item" } : {}), "aria-current": (item == current_page_item ? "page" : nil) do %>
       <% if truncatable %>
         <span class="menu-bar__breadcrumb-desktop__label--truncatable">
           <span class="menu-bar__breadcrumb-text" data-breadcrumb-truncate-target="text"><%= item_label %></span>
@@ -27,7 +28,7 @@
     <% end %>
   <% else %>
     <%# This block is executed if the condition is false %>
-    <%= content_tag :span, class: [*trigger_classes, "no-interactive"].join(" "), data: (truncatable ? { breadcrumb_truncate_target: "item" } : {}), "aria-current": (item[:active] ? "page" : nil) do %>
+    <%= content_tag :span, class: [*trigger_classes, "no-interactive"].join(" "), data: (truncatable ? { breadcrumb_truncate_target: "item" } : {}), "aria-current": (item == current_page_item ? "page" : nil) do %>
       <% if truncatable %>
         <span class="menu-bar__breadcrumb-desktop__label--truncatable">
           <span class="menu-bar__breadcrumb-text" data-breadcrumb-truncate-target="text"><%= item_label %></span>

data/config/initializers/rack_attack.rb

@@ -34,6 +34,16 @@ if Rails.env.production? || Rails.env.test?
       Rack::Attack.throttle("limit password recovery attempts per email", limit: 5, period: 60.seconds) do |request|
         request.params["user"]["email"] if request.path == "/users/password" && request.post?
       end
+
+      # Throttle SMS verification confirmation attempts per IP to 10 reqs/minute
+      Rack::Attack.throttle("limit sms verification attempts per ip", limit: 10, period: 60.seconds) do |request|
+        request.ip if request.path.match?(%r{^/[^/]+/sms/authorizations(?:\.[^/]+)?$}) && request.put?
+      end
+
+      # Throttle postal letter verification confirmation attempts per IP to 10 reqs/minute
+      Rack::Attack.throttle("limit postal letter verification attempts per ip", limit: 10, period: 60.seconds) do |request|
+        request.ip if request.path.match?(%r{^/[^/]+/postal_letter/authorizations(?:\.[^/]+)?$}) && request.put?
+      end
     end
   end
 end

data/config/locales/bg.yml

@@ -1502,7 +1502,6 @@ bg:
   layouts:
     decidim:
       announcements:
-        view_less: Покажи по-малко
         view_more: Още информация
       data_consent:
         details:

data/config/locales/ca-IT.yml

@@ -252,6 +252,7 @@ ca-IT:
         create: "%{user_name} ha afegit el component %{resource_name} a l'espai %{space_name}"
         delete: "%{user_name} ha eliminat el component %{resource_name} de l'espai %{space_name}"
         export_component: "%{user_name} ha exportat %{resource_name}%{component_name} de %{space_name} com %{format_name}"
+        menu_hidden: "%{user_name} ha amagat el component %{resource_name} del menú de l'espai de participació: %{space_name}"
         publish: "%{user_name} ha publicat el component %{resource_name} a l'espai %{space_name}"
         restore: "%{user_name} ha restaurat el component %{resource_name} a l'espai %{space_name}"
         soft_delete: "%{user_name} ha mogut el component %{resource_name} a l'espai %{space_name} a la paperera"
@@ -1710,6 +1711,8 @@ ca-IT:
       login_modal:
         please_log_in: Si us plau, inicia la sessió
         sign_up: Crea un compte
+      mentions:
+        search_prompt: Escriu aquí per cercar entre les participants
       mentions_modal:
         remove_recipient: Eliminar destinatària %{name}
       progress: Progrés
@@ -2092,7 +2095,6 @@ ca-IT:
   layouts:
     decidim:
       announcements:
-        view_less: Mostra menys
         view_more: Més informació
       data_consent:
         details:

data/config/locales/ca.yml

@@ -252,6 +252,7 @@ ca:
         create: "%{user_name} ha afegit el component %{resource_name} a l'espai %{space_name}"
         delete: "%{user_name} ha eliminat el component %{resource_name} de l'espai %{space_name}"
         export_component: "%{user_name} ha exportat %{resource_name}%{component_name} de %{space_name} com %{format_name}"
+        menu_hidden: "%{user_name} ha amagat el component %{resource_name} del menú de l'espai de participació: %{space_name}"
         publish: "%{user_name} ha publicat el component %{resource_name} a l'espai %{space_name}"
         restore: "%{user_name} ha restaurat el component %{resource_name} a l'espai %{space_name}"
         soft_delete: "%{user_name} ha mogut el component %{resource_name} a l'espai %{space_name} a la paperera"
@@ -855,6 +856,8 @@ ca:
     errors:
       files:
         file_cannot_be_processed: No s'ha pogut processar el fitxer
+        file_contains_unsafe_content: El fitxer conté contingut no segur
+        file_is_not_a_valid_image: El fitxer no és una imatge vàlida
         file_resolution_too_large: La resolució de l'arxiu és massa gran
         not_inside_organization: L'arxiu no està vinculat a cap organització.
       internal_server_error:
@@ -960,12 +963,12 @@ ca:
         member_added:
           published:
             email_intro: Se t'ha afegit com a membre a un espai de participació.
-            email_outro: Heu rebut aquesta notificació perquè una administradora us ha afegit a <a href="%{resource_url}">"%{resource_title}"</a>. El vostre perfil es mostrarà a la <a href="%{members_page}">llista de membres</a> d'aquest espai.<br> Si l'accés a aquest espai és restringit, hi podràs accedir sempre que hagis iniciat la teva sessió amb el teu compte.
+            email_outro: Has rebut aquesta notificació perquè una administradora t'ha afegit a <a href="%{resource_url}">"%{resource_title}"</a>. El teu perfil es mostrarà a la <a href="%{members_page}">llista de membres</a> d'aquest espai.<br> Si l'accés a aquest espai és restringit, hi podràs accedir sempre que hagis iniciat la teva sessió amb el teu compte.
             email_subject: Ara tens accés a "%{resource_title}".
             notification_title: Ara tens accés a <a href="%{resource_url}">"%{resource_title}"</a>.
           unpublished:
             email_intro: Se t'ha afegit com a membre a un espai de participació.
-            email_outro: Heu rebut aquesta notificació perquè una administradora us ha afegit a <a href="%{resource_url}">"%{resource_title}"</a>. Si l'accés a aquest espai és restringit, hi podràs accedir sempre que hagis iniciat la teva sessió amb el teu compte.
+            email_outro: Has rebut aquesta notificació perquè una administradora t'ha afegit a <a href="%{resource_url}">"%{resource_title}"</a>. Si l'accés a aquest espai és restringit, hi podràs accedir sempre que hagis iniciat la teva sessió amb el teu compte.
             email_subject: Ara tens accés a "%{resource_title}".
             notification_title: Ara tens accés a <a href="%{resource_url}">"%{resource_title}"</a>.
       reports:
@@ -1562,7 +1565,7 @@ ca:
     participatory_spaces:
       show:
         restricted_space: Aquest és un espai restringit. Només membres i administradores el poden veure i participar-hi.
-        transparent_space: Aquest és un espai restringit però transparent. Qualsevol pot veure'n el contingut, però només les membres i administradores hi poden participar.
+        transparent_space: Aquest és un espai transparent. Qualsevol pot veure'n el contingut, però només les membres i administradores hi poden participar.
     passwords:
       update:
         error: Hi ha hagut un problema en actualitzar la contrasenya.
@@ -1710,6 +1713,8 @@ ca:
       login_modal:
         please_log_in: Si us plau, inicia la sessió
         sign_up: Crea un compte
+      mentions:
+        search_prompt: Escriu aquí per cercar entre les participants
       mentions_modal:
         remove_recipient: Eliminar destinatària %{name}
       progress: Progrés
@@ -1880,10 +1885,10 @@ ca:
         ignore: |-
           Si no vols acceptar la invitació, si us plau, ignora aquest correu electrònic.<br /> El teu compte no es crearà fins que no accedeixis a l'enllaç anterior i estableixis el teu àlies i contrasenya.
         invited_you_as_admin: "%{invited_by} t'ha convidat com a administradora de %{application}. Pots acceptar-ho a través de l'enllaç següent."
-        invited_you_as_member: "%{invited_by} t'ha convidat com a membre de %{application}. Pots acceptar-ho a través de l'enllaç següent."
+        invited_you_as_member: "%{invited_by} t'ha convidat com a membre de %{application}. Pots acceptar-ho a través del següent enllaç."
         someone_invited_you: Algú t'ha convidat a %{application}. Pots acceptar-ho a través de l'enllaç següent.
         someone_invited_you_as_admin: Algú t'ha convidat com a administradora de %{application}, pots acceptar-lo a través de l'enllaç següent.
-        someone_invited_you_as_member: Algú t'ha convidat com a membre de %{application}, pots acceptar-ho a través de l'enllaç següent.
+        someone_invited_you_as_member: Algú t'ha convidat com a membre de %{application}, pots acceptar-ho a través del següent enllaç.
         subject: Instruccions d'invitació
       invite_admin:
         subject: T'han convidat a administrar %{organization}
@@ -2092,7 +2097,6 @@ ca:
   layouts:
     decidim:
       announcements:
-        view_less: Mostra menys
         view_more: Més informació
       data_consent:
         details:

data/config/locales/cs.yml

@@ -988,6 +988,12 @@ cs:
         member_added:
           published:
             email_intro: Byli jste přidáni jako člen do participačního prostoru.
+            email_subject: Nyní máte přístup k %{resource_title}.
+            notification_title: Nyní máte přístup k <a href="%{resource_url}">%{resource_title}</a>.
+          unpublished:
+            email_intro: Byli jste přidáni jako člen do participačního prostoru.
+            email_outro: Obdrželi jste toto oznámení, protože vás správce přidal do <a href="%{resource_url}">%{resource_title}</a>. Pokud je přístup do tohoto prostoru omezený, budete mít přístup k němu pomocí vašeho účtu.
+            email_subject: Nyní máte přístup k %{resource_title}.
       reports:
         parent_hidden:
           email_outro: Obdrželi jste toto oznámení, protože jste autorem ovlivněného %{resource_type}.
@@ -1189,6 +1195,7 @@ cs:
           access_modes:
             restricted: Omezený
             transparent: Transparentní
+          not_found: Přístupový režim %{id} nebyl nalezen
         area_presenter:
           not_found: 'Oblast nebyla nalezena v databázi (ID: %{id})'
         area_type_presenter:
@@ -1207,6 +1214,8 @@ cs:
       dynamic:
         screen_reader_explanation: Následující prvek je mapa, která prezentuje položky na této stránce jako mapové body. Prvek lze použít s čtečkou obrazovky, ale může být těžko srozumitelný.
         skip_button: Přeskočit mapu
+        zoom_in: Přiblížit
+        zoom_out: Oddálit
       static:
         latlng_text: 'zeměpisná šířka: %{latitude}, zeměpisná délka: %{longitude}'
         map_service_brand: OpenStreetMap
@@ -1543,6 +1552,10 @@ cs:
         never_logged_in: nikdy se nepřihlásil
         subject: Upozornění na neaktivní účet
     participatory_space:
+      labels:
+        reference: Odkaz na prostor
+        restricted: Omezený prostor
+        transparent: Transparentní prostor
       pages:
         user_profile:
           member_of:
@@ -1839,6 +1852,7 @@ cs:
         nickname_help: Vaše přezdívka v %{organization}. Může obsahovat pouze písmena, číslice, '-' a '_'.
         submit_button: Uložit
         subtitle: Pokud přijmete pozvánku, nastavte svou přezdívku a heslo.
+        subtitle_no_password: Pokud přijmete pozvánku, nastavte prosím svou přezdívku.
       invitation_removed: Vaše pozvánka byla odstraněna.
       invitation_token_invalid: Předložený token je neplatný!
       new:
@@ -1846,6 +1860,7 @@ cs:
         submit_button: Odeslat pozvánku
       no_invitations_remaining: Žádné zbývající pozvánky
       send_instructions: Pozvánka byla odeslána na %{email}.
+      updated: Pozvánka byla úspěšně přijata. Nyní jste přihlášeni.
       updated_not_active: Pozvánka úspěšně přijata.
     mailer:
       confirmation_instructions:
@@ -2082,7 +2097,6 @@ cs:
   layouts:
     decidim:
       announcements:
-        view_less: Zobrazit méně
         view_more: Více informací
       data_consent:
         details: