decidim-meetings 0.27.5 → 0.27.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5a610ceae614ac794a5b7ea743fcbdcf71a0f2a70e8b559f6e57961afb5648db
-  data.tar.gz: 40d10bb06adb06467f54953cae3c060e6388287b2e3191f9974cfa5dc4f9ee29
+  metadata.gz: 71a0790cb2d4d2270dc622fa73b690117680150c848a6262fddc39d9fa30437f
+  data.tar.gz: bf73625c7ea0b80d69f3313ea415eca7982e008f21e8b63060a8a8672f4e7737
 SHA512:
-  metadata.gz: a27d0127cf7915042f66df45b51d8cc8dcb76adac2956ea18eaf8ccfba26b14676746f89c2f06b1e2967fa11682398d817a3c145a7aed5061fd0cfb63f7f1647
-  data.tar.gz: 5b0601806650088310ee24494e5217d2733fe06d558fc0cf088237f3c4775d249c5ba3b01e4da3ff7e3659a4bed20b6be003d334e0382d9b4fecbbe1877632ad
+  metadata.gz: e1e5d4e38ec3c00cd02936c9fe02d3410ac3b5118a81988a8e26736a1bb2bda4a4cceb4d83a9d4fb90942a6a96078f2a2d0110b26ca536abf3dd89255bd96b33
+  data.tar.gz: 6c5039b5c1a953e2e77450f1817f1b1f942c68bd214a1d73e0fb60ae2aa9cd2abf8f280eb5182f47dfb984c8a222caefc2d7f7cb66b621b5677668865dc6c715

data/app/cells/decidim/meetings/highlighted_meetings_for_component/show.erb

@@ -1,7 +1,7 @@
 <% if upcoming_meetings.any? %>
   <div class="section row collapse upcoming_meetings">
     <h3 class="section-heading">
-      <%= translated_attribute(model.name) %> - <%= t("decidim.participatory_spaces.highlighted_meetings.upcoming_meetings") %>
+      <%= decidim_escape_translated(model.name) %> - <%= t("decidim.participatory_spaces.highlighted_meetings.upcoming_meetings") %>
       <a href="<%= main_component_path(model) %>" class="text-small"><%= t("decidim.participatory_spaces.highlighted_meetings.see_all", count: upcoming_meetings_count) %></a>
     </h3>
     <div class="card card--list">
@@ -18,7 +18,7 @@
 <% elsif past_meetings.any? %>
   <div class="section row collapse past_meetings">
     <h3 class="section-heading">
-      <%= translated_attribute(model.name) %> - <%= t("decidim.participatory_spaces.highlighted_meetings.past_meetings") %> <a href="<%= main_component_path(model) %>" class="text-small"><%= t("decidim.participatory_spaces.highlighted_meetings.see_all", count: past_meetings_count) %></a>
+      <%= decidim_escape_translated(model.name) %> - <%= t("decidim.participatory_spaces.highlighted_meetings.past_meetings") %> <a href="<%= main_component_path(model) %>" class="text-small"><%= t("decidim.participatory_spaces.highlighted_meetings.see_all", count: past_meetings_count) %></a>
     </h3>
     <div class="card card--list">
       <% past_meetings.each do |meeting| %>

data/app/cells/decidim/meetings/meeting_s_cell.rb

@@ -14,7 +14,7 @@ module Decidim
       end
 
       def participatory_space_title
-        translated_attribute model.component.participatory_space.title
+        decidim_escape_translated model.component.participatory_space.title
       end
 
       def participatory_space_path

data/app/controllers/decidim/meetings/widgets_controller.rb

@@ -6,15 +6,25 @@ module Decidim
       helper MeetingsHelper
       helper Decidim::SanitizeHelper
 
+      def show
+        enforce_permission_to :embed, :meeting, meeting: model if model
+
+        super
+      end
+
       private
 
       def model
-        @model ||= Meeting.where(component: params[:component_id]).find(params[:meeting_id])
+        @model ||= Meeting.except_withdrawn.published.not_hidden.where(component: current_component).find(params[:meeting_id])
       end
 
       def iframe_url
         @iframe_url ||= meeting_widget_url(model)
       end
+
+      def permission_class_chain
+        [Decidim::Meetings::Permissions]
+      end
     end
   end
 end

data/app/helpers/decidim/meetings/directory/application_helper.rb

@@ -92,7 +92,7 @@ module Decidim
             key_point = current_participatory_space.class.name.gsub("::", "__") + current_participatory_space.id.to_s
 
             TreeNode.new(
-              TreePoint.new(key_point, translated_attribute(current_participatory_space.title, current_organization)),
+              TreePoint.new(key_point, decidim_escape_translated(current_participatory_space.title)),
               categories_values
             )
           end

data/app/packs/src/decidim/meetings/poll.component.js

@@ -1,5 +1,8 @@
 /* eslint id-length: ["error", { "exceptions": ["$"] }] */
 
+import createOptionAttachedInputs from "src/decidim/forms/option_attached_inputs.component"
+import createMaxChoicesAlertComponent from "src/decidim/forms/max_choices_alert.component"
+
 /**
  * A plain Javascript component that handles questions from polls in meetings:
  *   - fetches them via Ajax
@@ -75,6 +78,7 @@ export default class PollComponent {
       this._updateCounter();
       this._setQuestionsState(this.$element);
       this._pollQuestions();
+      this._addValidations();
     });
   }
 
@@ -163,4 +167,27 @@ export default class PollComponent {
       this.$counter.html(`(${questionsCount})`);
     }
   }
+
+  _addValidations() {
+    $(".js-radio-button-collection, .js-check-box-collection").each((idx, el) => {
+      createOptionAttachedInputs({
+        wrapperField: $(el),
+        controllerFieldSelector: "input[type=radio], input[type=checkbox]",
+        dependentInputSelector: "input[type=text], input[type=hidden]"
+      });
+    });
+
+    $.unique($(".js-check-box-collection").parents(".answer")).each((idx, el) => {
+      const maxChoices = $(el).data("max-choices");
+      if (maxChoices) {
+        createMaxChoicesAlertComponent({
+          wrapperField: $(el),
+          controllerFieldSelector: "input[type=checkbox]",
+          controllerCollectionSelector: ".js-check-box-collection",
+          alertElement: $(el).find(".max-choices-alert"),
+          maxChoices: maxChoices
+        });
+      }
+    });
+  }
 }

data/app/permissions/decidim/meetings/permissions.rb

@@ -4,6 +4,7 @@ module Decidim
   module Meetings
     class Permissions < Decidim::DefaultPermissions
       def permissions
+        allow_embed_meeting?
         return permission_action unless user
 
         # Delegate the admin permission checks to the admin permissions class
@@ -57,6 +58,15 @@ module Decidim
         @question ||= context.fetch(:question, nil)
       end
 
+      # As this is a public action, we need to run this before other checks
+      def allow_embed_meeting?
+        return unless permission_action.action == :embed && permission_action.subject == :meeting && meeting
+        return disallow! if meeting.withdrawn?
+        return allow! if meeting.published?
+
+        disallow!
+      end
+
       def can_join_meeting?
         meeting.can_be_joined_by?(user) &&
           authorized?(:join, resource: meeting)

data/app/presenters/decidim/meetings/admin_log/meeting_presenter.rb

@@ -15,10 +15,6 @@ module Decidim
       class MeetingPresenter < Decidim::Log::BasePresenter
         private
 
-        def resource_presenter
-          @resource_presenter ||= Decidim::Meetings::Log::ResourcePresenter.new(action_log.resource, h, action_log.extra["resource"])
-        end
-
         def diff_fields_mapping
           {
             address: :string,

data/app/presenters/decidim/meetings/admin_log/value_types/meeting_title_description_presenter.rb

@@ -10,7 +10,7 @@ module Decidim
           def present
             return unless value
 
-            renderer = Decidim::ContentRenderers::HashtagRenderer.new(h.translated_attribute(value))
+            renderer = Decidim::ContentRenderers::HashtagRenderer.new(h.decidim_escape_translated(value))
             renderer.render(links: false).html_safe
           end
         end

data/app/services/decidim/meetings/close_meeting_reminder_generator.rb

@@ -38,11 +38,9 @@ module Decidim
 
       def send_reminders(component)
         intervals = Array(reminder_manifest.settings.attributes[:reminder_times].default)
-        space_admins = Decidim::ParticipatoryProcessUserRole.where(decidim_participatory_process_id: component.participatory_space_id, role: "admin").collect(&:user)
-        space_admins = (global_admins + space_admins).uniq
         intervals.each do |interval|
           finder_query(component.id, interval).find_each do |meeting|
-            authors = meeting.official? ? space_admins : [meeting.author]
+            authors = meeting.official? ? space_admins(component) : [meeting.author]
             authors.each do |author|
               send_notif = author.notification_settings.fetch("close_meeting_reminder", "1")
               next unless send_notif == "1"
@@ -60,8 +58,16 @@ module Decidim
         end
       end
 
-      def global_admins
-        @global_admins ||= Decidim::User.where(admin: true).all
+      def space_admins(component)
+        @space_admins ||= begin
+          space_admins = if component.participatory_space.respond_to?(:user_roles)
+                           component.participatory_space.user_roles(:admin).collect(&:user)
+                         else
+                           []
+                         end
+          global_admins = component.organization.admins
+          (global_admins + space_admins).uniq
+        end
       end
     end
   end

data/app/views/decidim/meetings/admin/agenda/_form.html.erb

@@ -3,7 +3,7 @@
     <h2 class="card-title">
       <div class="flex--sbc">
         <div class="grid-x align-middle">
-          <u> <%= present(@meeting).title %> </u> &nbsp;<%= icon "arrow-right" %>&nbsp;<%= title %>
+          <u> <%= present(@meeting).title(html_escape: true) %> </u> &nbsp;<%= icon "arrow-right" %>&nbsp;<%= title %>
         </div>
       </div>
     </h2>

data/app/views/decidim/meetings/layouts/live_event.html.erb

@@ -24,7 +24,7 @@
       <% end %>
 
       <div>
-        <strong class="text-secondary"><%= current_organization.name %></strong> / <strong><%= present(meeting).title(links: true) %></strong>
+        <strong class="text-secondary"><%= current_organization.name %></strong> / <strong><%= present(meeting).title(links: true, html_escape: true) %></strong>
       </div>
 
       <div class="flex--cc">

data/app/views/decidim/meetings/meetings/_meeting_agenda.html.erb

@@ -11,7 +11,7 @@
           <span class="text-small"><%= display_duration_agenda_items(agenda_item.id, index, agenda_items_times) %></span>
         </h5>
         <hr class="reset m-none mb-s">
-        <p><%= translated_attribute(agenda_item.description).html_safe %></p>
+        <p><%= decidim_sanitize_translated(agenda_item.description).html_safe %></p>
 
         <% if agenda_item.agenda_item_children.presence %>
           <% parent_start_time = agenda_items_times[index][:start_time] %>
@@ -22,7 +22,7 @@
               <strong><%= translated_attribute(agenda_item_child.title) %></strong>&nbsp;
               <span class="text-small"><%= display_duration_agenda_items(agenda_item_child.id, index_child, agenda_item_children_times) %></span>
             </h6>
-            <p><%= translated_attribute(agenda_item_child.description).html_safe %></p>
+            <p><%= decidim_sanitize_translated(agenda_item_child.description).html_safe %></p>
           <% end %>
         <% end %>
       <% end %>

data/app/views/decidim/meetings/meetings/show.html.erb

@@ -105,7 +105,9 @@ edit_link(
     <%= resource_version(meeting, versions_path: meeting_versions_path(meeting)) %>
     <%= cell "decidim/meetings/cancel_registration_meeting_button", meeting %>
     <%= render partial: "decidim/shared/share_modal" %>
-    <%= embed_modal_for meeting_widget_url(meeting, format: :js) %>
+    <% if allowed_to? :embed, :meeting, meeting: @meeting %>
+      <%= embed_modal_for meeting_widget_url(meeting, format: :js) %>
+    <% end %>
     <%= render partial: "calendar_modal", locals: { ics_url: calendar_meeting_url(meeting), google_url: google_calendar_event_url(meeting) } %>
   </div>
   <div class="columns mediumlarge-8 mediumlarge-pull-4">

data/app/views/decidim/meetings/polls/answers/_multiple_option.html.erb

@@ -1,13 +1,17 @@
-<% question.answer_options.each_with_index do |answer_option, idx| %>
-  <% choice = answer.choices.find { |choice| choice.decidim_answer_option_id == answer_option.id } if answer %>
+<div class="answer-questionnaire__single-option js-check-box-collection">
+  <% question.answer_options.each_with_index do |answer_option, idx| %>
+    <% choice = answer.choices.find { |choice| choice.decidim_answer_option_id == answer_option.id } if answer %>
 
-  <%= label_tag do %>
-    <%= check_box_tag "answer[choices][#{idx}][body]",
-                      translated_attribute(answer_option.body),
-                      choice.present?, disabled: disabled %>
+    <div class="js-collection-input">
+      <%= label_tag do %>
+        <%= check_box_tag "answer[choices][#{idx}][body]",
+                          translated_attribute(answer_option.body),
+                          choice.present?, disabled: disabled %>
 
-    <%= translated_attribute(answer_option.body) %>
+        <%= translated_attribute(answer_option.body) %>
 
-    <%= hidden_field_tag "answer[choices][#{idx}][answer_option_id]", answer_option.id, disabled: disabled %>
+        <%= hidden_field_tag "answer[choices][#{idx}][answer_option_id]", answer_option.id, disabled: disabled %>
+      <% end %>
+    </div>
   <% end %>
-<% end %>
+</div>

data/app/views/decidim/meetings/polls/answers/_single_option.html.erb

@@ -4,16 +4,16 @@
   <% choice_id = "#{field_id}_choices_#{idx}" %>
 
   <%= label_tag "#{choice_id}_body" do %>
-    <%= radio_button_tag "answer[choices][#{idx}][body]",
-                        translated_attribute(answer_option.body),
-                        answer_option.id == choice.try(:decidim_answer_option_id),
-                        id: "#{choice_id}_body", disabled: disabled %>
+    <%= radio_button_tag "answer[choices][#{question.id}][body]",
+                         translated_attribute(answer_option.body),
+                         answer_option.id == choice.try(:decidim_answer_option_id),
+                         id: "#{choice_id}_body", disabled: disabled %>
 
     <%= translated_attribute(answer_option.body) %>
 
-    <%= hidden_field_tag "answer[choices][#{idx}][answer_option_id]",
-                        answer_option.id,
-                        id: "#{choice_id}_answer_option",
-                        disabled: disabled %>
+    <%= hidden_field_tag "answer[choices][#{question.id}][answer_option_id]",
+                         answer_option.id,
+                         id: "#{choice_id}_answer_option",
+                         disabled: disabled %>
   <% end %>
 <% end %>

data/app/views/decidim/meetings/polls/questions/_published_question.html.erb

@@ -6,12 +6,12 @@
   <% @form = form || Decidim::Meetings::AnswerForm.new(question_id: question.id, current_user: current_user) %>
   <%= decidim_form_for(@form, url: meeting_polls_answers_path(meeting), method: :post, remote: true, html: { class: "form answer-questionnaire" }, data: { "safe-path" => meeting_live_event_path(meeting) }) do |form| %>
     <div class="row column answer question" data-max-choices="<%= question.max_choices %>">
+      <small class="form-error max-choices-alert"><%= t(".max_choices_alert") %></small>
+
       <%= render partial: "decidim/meetings/polls/answers/#{question.question_type}", locals: { answer: @form.answer, question: question, answer_form: form, disabled: question.answered_by?(current_user), field_id: question.id  } %>
 
       <%= form.hidden_field :question_id %>
 
-      <small class="form-error max-choices-alert"><%= t(".max_choices_alert") %></small>
-
       <% @form.errors.full_messages.each do |msg| %>
         <small class="form-error is-visible margin-top-1"><%= msg %></small>
       <% end %>

data/config/locales/ar.yml

@@ -460,7 +460,6 @@ ar:
         new_meeting_at_html: "<span>اجتماع جديد في %{link}</span>"
       layouts:
         live_event:
-          administrate: إدارة
           close: إغلاق
           questions: الأسئلة
       mailer: