decidim-core 0.32.1 → 0.32.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2c6e0e725b51232026afe0dfeb5bdf73eeaf07f88d346202d4854ef47c093908
-  data.tar.gz: ee494f4ab056b6f6debfe4590b885178eb39351e516efb9d98f174eab52b4a1e
+  metadata.gz: 8290aaa3b5f8596b066ea39214624b798bc2fa4cbc2555ec74be6f0332b9356f
+  data.tar.gz: 1a76634eca16d14db59d3f6d61fe7e17ae5d9ca9f44497ca92ae37e09ba2b7f2
 SHA512:
-  metadata.gz: d01d66392ab3be5f859ac9791375a83f9d810abd6ee909af6b1e8cf5d833da3a20806e8eed83c05142013d7c9166a12c31fa2ec128b6b4c9a61d8a5e34e7caba
-  data.tar.gz: '09c6891b8ab26cde54ead3bb2f0876c4cd04c88d3309c1855c3afce7c11297bfb95cf3d07e8dbabafa67a390882503f7b0595f4574f01c90050847392b217d31'
+  metadata.gz: 20697b2436b43b7c2b8d239ee8d865bdc25c2b6916f741ad36398134d995dfb8139d1391cef863931a8a0be9b08a53408511f513367c5c3dec5295a428a00cbf
+  data.tar.gz: c1b155c89712ddfa2274c99f0965ee2cabc68385e93faf62ed069a39d2d10a87c3911d5b90872b99d44f03aeb0a2a0ddab202be2a330b43af317615d761d52d4

data/app/cells/decidim/content_blocks/participatory_space_main_data/title.erb

@@ -23,15 +23,11 @@
         <% end %>
       </div>
 
-      <button class="button button__sm button__text-secondary mt-2" data-controls="panel-view-more-<%= seed %>" aria-expanded="false" onclick="document.querySelector('div[id^=panel-view-more]').toggleAttribute('inert')">
+      <button class="button button__sm button__text-secondary mt-2" data-controls="panel-view-more-<%= seed %>" aria-expanded="false">
         <span>
           <%= t("view_more", scope: "layouts.decidim.announcements") %>
         </span>
         <%= icon "arrow-down-s-line" %>
-        <span>
-          <%= t("view_less", scope: "layouts.decidim.announcements") %>
-        </span>
-        <%= icon "arrow-up-s-line" %>
       </button>
     <% else %>
       <% if rich_text_processors? %>
@@ -42,12 +38,3 @@
     <% end %>
   </div>
 <% end %>
-<script>
-  const button = document.querySelector('button[data-controls^="panel-view-more"]')
-  button.addEventListener('keydown', function(e){
-    // press space or enter
-    if (e.keyCode === 32 || e.keyCode === 13){
-      document.querySelector('div[id^=panel-view-more]').toggleAttribute('inert')
-    }
-  })
-</script>

data/app/cells/decidim/following_cell.rb

@@ -11,7 +11,7 @@ module Decidim
     end
 
     def public_followings
-      @public_followings ||= Kaminari.paginate_array(model.public_users_followings).page(params[:page]).per(20)
+      @public_followings ||= model.public_users_followings.page(params[:page]).per(20)
     end
 
     def non_public_followings?

data/app/cells/decidim/member/show.erb

@@ -15,7 +15,7 @@
     <% end %>
 
     <div class="mt-3">
-      <span class="text-gray-2 capitalize font-semibold">
+      <span class="text-gray-2 font-semibold">
         <%= role_translated %>
       </span>
     </div>

data/app/cells/decidim/nav_links/show.erb

@@ -8,7 +8,9 @@
     <% model.each do |item| %>
       <li>
         <%= link_to item[:url], class: "participatory-space__nav-item" do %>
-          <%= decidim_escape_translated(item[:name]) %>
+          <span class="participatory-space__nav-label">
+            <%= decidim_escape_translated(item[:name]) %>
+          </span>
           <%= icon "arrow-right-line" %>
         <% end %>
       </li>

data/app/cells/decidim/share_text_widget/modal.erb

@@ -1,5 +1,6 @@
 <%= decidim_modal id: "socialShare", class: "share-modal" do %>
   <div data-dialog-container>
+    <%= icon "share-line" %>
     <h2 id="dialog-title-socialShare" tabindex="-1" data-dialog-title><%= t("share", scope: "decidim.shared.share_modal") %></h2>
 
     <div>

data/app/cells/decidim/share_widget/modal.erb

@@ -1,5 +1,6 @@
 <%= decidim_modal id: "socialShare", class: "share-modal" do %>
   <div data-dialog-container>
+    <%= icon "share-line" %>
     <h2 id="dialog-title-social-share-modal" tabindex="-1" data-dialog-title><%= t("share", scope: "decidim.shared.share_modal") %></h2>
 
     <div>

data/app/cells/decidim/share_widget/qr_code_modal.erb

@@ -1,9 +1,7 @@
 <%= decidim_modal id: "QRCodeDialog", class: "qr-modal" do %>
   <div data-dialog-container>
-    <div data-dialog-title>
-      <%= icon "qr-code-line" %>
-      <h2 id="dialog-title-qr-code-dialog" tabindex="-1"><%= t("decidim.share_widget.qr_code") %></h2>
-    </div>
+    <%= icon "qr-code-line" %>
+    <h2 id="dialog-title-qr-code-dialog" tabindex="-1" data-dialog-title><%= t("decidim.share_widget.qr_code") %></h2>
     <div class="content">
       <div>
         <% if current_organization.logo.attached? %>

data/app/commands/decidim/create_omniauth_registration.rb

@@ -30,9 +30,9 @@ module Decidim
         end
         return broadcast(:invalid) if form.invalid?
 
+        initialize_user
         transaction do
-          create_or_find_user
-          @identity = create_identity
+          @identity = existing_identity || create_identity
         end
         trigger_omniauth_event
 
@@ -50,6 +50,21 @@ module Decidim
 
     REGEXP_SANITIZER = /[<>?%&\^*#@()\[\]=+:;"{}\\|]/
 
+    def initialize_user
+      create_or_find_user
+    rescue ActiveRecord::RecordNotUnique
+      @create_retries ||= 0
+
+      # This may happen if the callback endpoint is called several times in a
+      # row which some Omniauth providers may allow (e.g. through a double
+      # click). This should ensure that the user will not get an error even if
+      # the authentication service sent the callback request several times.
+      raise if @create_retries >= 2
+
+      @create_retries += 1
+      retry
+    end
+
     def create_or_find_user
       @user = User.find_or_initialize_by(
         email: verified_email,

data/app/controllers/concerns/decidim/devise_authentication_methods.rb

@@ -9,6 +9,8 @@ module Decidim
     include Decidim::OnboardingActionMethods
 
     included do
+      protected
+
       def after_sign_in_path_for(user)
         if user.present? && user.blocked?
           check_user_block_status(user)
@@ -21,6 +23,8 @@ module Decidim
         end
       end
 
+      private
+
       # Calling the `stored_location_for` method removes the key, so in order
       # to check if there is any pending redirect after login I need to call
       # this method and use the value to set a pending redirect. This is the

data/app/controllers/concerns/decidim/devise_controllers.rb

@@ -49,6 +49,8 @@ module Decidim
       # right page.
       before_action :store_current_location
 
+      protected
+
       def permission_class_chain
         PermissionsRegistry.chain_for(DeviseControllers)
       end

data/app/controllers/concerns/decidim/disable_redirection_to_external_host.rb

@@ -7,6 +7,8 @@ module Decidim
     extend ActiveSupport::Concern
 
     included do
+      private
+
       def redirect_back(fallback_location:, allow_other_host: true, **args) # rubocop:disable Lint/UnusedMethodArgument
         super(fallback_location:, allow_other_host: Decidim.allow_open_redirects, **args)
       end

data/app/controllers/concerns/decidim/filter_resource.rb

@@ -11,6 +11,8 @@ module Decidim
     # this way we can use Rails' form helpers and have automatically checked checkboxes and
     # radio buttons in the view, for example.
     class Filter
+      private
+
       def initialize(filter)
         @filter = filter
       end

data/app/controllers/concerns/decidim/impersonate_users.rb

@@ -26,6 +26,8 @@ module Decidim
         @current_user ||= managed_user || real_user
       end
 
+      private
+
       # Clear the `@real_user` instance variable because otherwise that would be
       # the return value for any `current_user` calls after the user has already
       # signed out.
@@ -47,8 +49,6 @@ module Decidim
         ((impersonation_session_ends_at - Time.current) / 60).round
       end
 
-      private
-
       def current_user_impersonated?
         current_user && impersonation_log.present?
       end

data/app/controllers/concerns/decidim/locale_switcher.rb

@@ -25,16 +25,6 @@ module Decidim
         I18n.with_locale(locale, &)
       end
 
-      # Adds the current locale to all the URLs generated by url_for so users
-      # experience a consistent behaviour if they copy or share links.
-      #
-      # Returns a Hash.
-      def default_url_options
-        return {} if locale_in_script_name?
-
-        { locale: current_locale }
-      end
-
       # The current locale for the user. Available as a helper for the views.
       #
       # Returns a String.
@@ -142,6 +132,18 @@ module Decidim
         uri.to_s
       end
 
+      private
+
+      # Adds the current locale to all the URLs generated by url_for so users
+      # experience a consistent behaviour if they copy or share links.
+      #
+      # Returns a Hash.
+      def default_url_options
+        return {} if locale_in_script_name?
+
+        { locale: current_locale }
+      end
+
       def locale_in_script_name?
         script_name = request&.script_name.to_s
         return false if script_name.blank?

data/app/controllers/concerns/decidim/needs_permission.rb

@@ -41,19 +41,11 @@ module Decidim
           component_settings: try(:component_settings),
           current_organization: try(:current_organization),
           current_component: try(:current_component),
-          share_token: try(:store_share_token)
+          share_token: store_share_token
         }
       end
 
-      def enforce_permission_to(action, subject, extra_context = {})
-        if Rails.env.development?
-          Rails.logger.debug "==========="
-          Rails.logger.debug [permission_scope, action, subject, permission_class_chain].map(&:inspect).join("\n")
-          Rails.logger.debug "==========="
-        end
-
-        raise Decidim::ActionForbidden unless allowed_to?(action, subject, extra_context)
-      end
+      public
 
       # rubocop:disable Metrics/ParameterLists
       def allowed_to?(action, subject, extra_context = {}, chain = permission_class_chain, user = current_user, scope = nil)
@@ -76,6 +68,18 @@ module Decidim
         allowed_to?(action, subject, extra_context, chain, user, :admin)
       end
 
+      protected
+
+      def enforce_permission_to(action, subject, extra_context = {})
+        if Rails.env.development?
+          Rails.logger.debug "==========="
+          Rails.logger.debug [permission_scope, action, subject, permission_class_chain].map(&:inspect).join("\n")
+          Rails.logger.debug "==========="
+        end
+
+        raise Decidim::ActionForbidden unless allowed_to?(action, subject, extra_context)
+      end
+
       def permission_class_chain
         raise "Please, make this method return an array of permission classes"
       end
@@ -83,6 +87,14 @@ module Decidim
       def permission_scope
         raise "Please, make this method return a symbol"
       end
+
+      private
+
+      def store_share_token
+        session[:share_token] = params[:share_token] if params.has_key?(:share_token)
+
+        session[:share_token].presence
+      end
     end
   end
 end

data/app/controllers/concerns/decidim/onboarding_action_methods.rb

@@ -21,6 +21,8 @@ module Decidim
         OnboardingManager.new(user).pending_action?
       end
 
+      private
+
       def store_onboarding_cookie_data!(user)
         data = onboarding_cookie_data
         return if data.nil?

data/app/controllers/concerns/decidim/paginable.rb

@@ -13,9 +13,7 @@ module Decidim
       helper_method :per_page, :page_offset
       helper Decidim::PaginateHelper
 
-      def paginate(resources)
-        resources.page(params[:page]).per(per_page)
-      end
+      protected
 
       def per_page
         if OPTIONS.include?(params[:per_page])
@@ -31,6 +29,12 @@ module Decidim
       def page_offset
         [params[:page].to_i - 1, 0].max * per_page
       end
+
+      private
+
+      def paginate(resources)
+        resources.page(params[:page]).per(per_page)
+      end
     end
   end
 end

data/app/controllers/concerns/decidim/payload_info.rb

@@ -8,6 +8,8 @@ module Decidim
     include Decidim::TranslatableAttributes
 
     included do
+      private
+
       def append_info_to_payload(payload)
         super
         payload[:user_id] = try(:current_user).try(:id)

data/app/controllers/concerns/decidim/resource_versions_concern.rb

@@ -11,11 +11,25 @@ module Decidim
       helper_method :current_version, :versioned_resource
 
       def show
+        enforce_permission_to(*versioned_resource_permission)
+
         raise ActionController::RoutingError, "Not found" unless current_version
       end
 
       private
 
+      # The versions must honour the same `:read` permission as their resource,
+      # so a resource that is hidden, private, deleted or unpublished (and
+      # therefore cannot be read on its own) cannot be reached through its
+      # versions either.
+      def versioned_resource_permission
+        resource = versioned_resource
+        raise ActionController::RoutingError, "Not found" unless resource
+
+        subject = resource.model_name.element.to_sym
+        [:read, subject, { subject => resource }]
+      end
+
       # Overwrite this method in your controller to define how to find the
       # versioned resource.
       def versioned_resource

data/app/controllers/decidim/application_controller.rb

@@ -59,12 +59,6 @@ module Decidim
 
     skip_before_action :disable_http_caching, unless: :user_signed_in?
 
-    def store_share_token
-      session[:share_token] = params[:share_token] if params.has_key?(:share_token)
-
-      session[:share_token].presence
-    end
-
     private
 
     def allow_browser(**); end

data/app/controllers/decidim/authorization_modals_controller.rb

@@ -6,6 +6,8 @@ module Decidim
     layout false
 
     def show
+      enforce_permission_to :read, :authorization
+
       store_onboarding_cookie_data!(current_user)
     end
 

data/app/controllers/decidim/components/base_controller.rb

@@ -67,6 +67,8 @@ module Decidim
         raise ActionController::RoutingError, "Not Found" unless current_user_can_visit_space?
       end
 
+      protected
+
       def set_breadcrumb_items
         context_breadcrumb_items << add_current_component
         context_breadcrumb_items << add_parent_breadcrumb_item

data/app/controllers/decidim/devise/passwords_controller.rb

@@ -14,6 +14,8 @@ module Decidim
       before_action :check_sign_in_enabled
 
       def change_password
+        enforce_permission_to(:update, :user, current_user:)
+
         self.resource = current_user
         @send_path = apply_password_path
 
@@ -22,6 +24,8 @@ module Decidim
       end
 
       def apply_password
+        enforce_permission_to(:update, :user, current_user:)
+
         self.resource = current_user
         @send_path = apply_password_path
 
@@ -43,6 +47,10 @@ module Decidim
 
       private
 
+      def user_has_no_permission_path
+        new_user_session_path
+      end
+
       def check_sign_in_enabled
         redirect_to new_user_session_path unless current_organization.sign_in_enabled?
       end

data/app/controllers/decidim/favicon_controller.rb

@@ -12,6 +12,7 @@ module Decidim
   class FaviconController < ::DecidimController
     include ActionController::DataStreaming # For Rails 7, check out `ActiveStorage::Streaming`.
     include NeedsOrganization
+    include NeedsPermission
 
     skip_before_action :verify_authenticity_token, :verify_organization
     skip_after_action :verify_same_origin_request
@@ -52,5 +53,13 @@ module Decidim
 
       @favicon_blob ||= current_organization.favicon_ico&.blob
     end
+
+    def permission_class_chain
+      [Decidim::Permissions]
+    end
+
+    def permission_scope
+      :public
+    end
   end
 end

data/app/controllers/decidim/free_resource_authorization_modals_controller.rb

@@ -6,6 +6,8 @@ module Decidim
     layout false
 
     def show
+      enforce_permission_to :read, :authorization
+
       render template: "decidim/authorization_modals/show"
     end
 

data/app/controllers/decidim/gamification/badges_controller.rb

@@ -6,6 +6,8 @@ module Decidim
       include HasSpecificBreadcrumb
 
       def index
+        enforce_permission_to :read, :badges
+
         @badges = Decidim::Gamification.badges.sort_by(&:name)
       end
 

data/app/controllers/decidim/homepage_controller.rb

@@ -3,6 +3,9 @@
 module Decidim
   class HomepageController < Decidim::ApplicationController
     skip_before_action :store_current_location
-    def show; end
+
+    def show
+      enforce_permission_to :read, :homepage
+    end
   end
 end

data/app/controllers/decidim/likes_controller.rb

@@ -9,7 +9,7 @@ module Decidim
     helper_method :like_button
     # we need to declare with +helper+ to be able to call :render_like_identity from the views
     helper Decidim::LikeableHelper
-    helper_method :resource
+    helper_method :resource, :current_component
 
     before_action :authenticate_user!
 

data/app/controllers/decidim/links_controller.rb

@@ -15,6 +15,8 @@ module Decidim
     rescue_from URI::InvalidURIError, with: :modal
 
     def new
+      enforce_permission_to :read, :link
+
       headers["X-Robots-Tag"] = "none"
       headers["Link"] = %(<#{url_for}>; rel="canonical")
     end

data/app/controllers/decidim/manifests_controller.rb

@@ -4,6 +4,8 @@ module Decidim
   # A controller to serve the manifest file for PWA
   class ManifestsController < Decidim::ApplicationController
     def show
+      enforce_permission_to :read, :manifest
+
       organization_presenter = OrganizationPresenter.new(current_organization)
       render layout: false, locals: { organization_params: organization_presenter }, content_type: "application/manifest+json"
     end

data/app/controllers/decidim/messaging/conversations_controller.rb

@@ -43,10 +43,7 @@ module Decidim
 
         StartConversation.call(@form) do
           on(:ok) do |conversation|
-            render action: :create, locals: {
-              conversation:,
-              form: MessageForm.new
-            }
+            render action: :create, locals: { conversation: }
           end
 
           on(:invalid) do |messages|
@@ -96,6 +93,15 @@ module Decidim
 
       def check_multiple
         @form = form(ConversationForm).from_params(params, sender: current_user)
+
+        conversation = conversation_between_multiple(@form.recipient.to_a.prepend(current_user))
+
+        if conversation
+          enforce_permission_to :read, :conversation, conversation:
+        else
+          enforce_permission_to :create, :conversation, conversation: new_conversation(@form.recipient)
+        end
+
         redirect_link = current_or_new_conversation_path_with_multiple(@form.recipient, nickname: params[:nickname])
         redirect_to redirect_link
       end

data/app/controllers/decidim/newsletters_controller.rb

@@ -11,6 +11,8 @@ module Decidim
     helper_method :newsletter
 
     def show
+      enforce_permission_to :read, :newsletter
+
       @user = current_user
       @organization = current_organization
 
@@ -20,6 +22,8 @@ module Decidim
     end
 
     def unsubscribe
+      enforce_permission_to :unsubscribe, :newsletter
+
       encryptor = Decidim::NewsletterEncryptor
 
       decrypted_string = encryptor.sent_at_decrypted(params[:u])

data/app/controllers/decidim/notifications_subscriptions_controller.rb

@@ -6,11 +6,15 @@ module Decidim
     rescue_from Decidim::NotificationsSubscriptionsPersistor::UnsupportedPushSubscriptionEndpointError, with: :unsupported_browser
 
     def create
+      enforce_permission_to(:update, :user, current_user:)
+
       Decidim::NotificationsSubscriptionsPersistor.new(current_user).add_subscription(params)
       head :ok
     end
 
     def destroy
+      enforce_permission_to(:update, :user, current_user:)
+
       Decidim::NotificationsSubscriptionsPersistor.new(current_user).delete_subscription(params[:auth])
       head :ok
     end

data/app/controllers/decidim/offline_controller.rb

@@ -4,7 +4,11 @@ module Decidim
   class OfflineController < Decidim::ApplicationController
     include HasSpecificBreadcrumb
 
-    def show; end
+    def show
+      enforce_permission_to :read, :offline
+    end
+
+    private
 
     def breadcrumb_item
       {

data/app/controllers/decidim/open_data_controller.rb

@@ -4,9 +4,13 @@ module Decidim
   class OpenDataController < Decidim::ApplicationController
     helper_method :open_data_component_manifests, :open_data_participatory_space_manifests, :open_data_core_manifests
 
-    def index; end
+    def index
+      enforce_permission_to :read, :open_data
+    end
 
     def download
+      enforce_permission_to :read, :open_data
+
       resource = params[:resource] || nil
 
       if open_data_file_for_resource(resource)

data/app/controllers/decidim/pages_controller.rb

@@ -10,6 +10,10 @@ module Decidim
 
     before_action :legacy_redirect, :set_default_request_format
 
+    # Included after the legacy redirect so its before_action does not look the
+    # page up (and 404) before the redirect happens.
+    include HasSpecificBreadcrumb
+
     def index
       enforce_permission_to :read, :public_page
       @topics = StaticPageTopic.where(organization: current_organization)
@@ -17,14 +21,38 @@ module Decidim
     end
 
     def show
-      @page = current_organization.static_pages.find_by!(slug: params[:id])
-      enforce_permission_to :read, :public_page, page: @page
-      @topic = @page.topic
+      enforce_permission_to :read, :public_page, page:
+
+      @topic = page.topic
       @pages = @topic&.pages
     end
 
     private
 
+    def page
+      @page ||= current_organization.static_pages.find_by!(slug: params.expect(:id))
+    end
+
+    def breadcrumb_item
+      items = [
+        {
+          label: t("decidim.pages.index.title"),
+          active: action_name == "index",
+          url: pages_path
+        }
+      ]
+
+      if action_name == "show"
+        items << {
+          label: page.title,
+          active: true,
+          url: page_path(page)
+        }
+      end
+
+      items
+    end
+
     def legacy_redirect
       return redirect_to decidim.page_path("terms-of-service") if params[:id] == "terms-and-conditions"
     end