decidim-proposals 0.27.1 → 0.27.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: dfcb748eb8b97dccb3b6389e62fb97e77f98feb27cf8565706896a7cde0989b0
-  data.tar.gz: 9f9f8d56788cb3d6cc04bf279ec6759c61bb92c5abfb8e3a614319f628de7b88
+  metadata.gz: 4935cb826afe1af3dccd4c4c1875441bbaa54be6b95d8c9af4f2a52af4e94865
+  data.tar.gz: 53a2e218497c07e1fc0387d161c4546cc701efd48b8e467d5d3dd570395ed311
 SHA512:
-  metadata.gz: 7eceeb9e69e7c058136b82f4b0b990afda72792c896c7c73310c59ce1a722391f2c997f538c64b73a40c6516703440a1a88bab6cdc1cd30273b4ffdaf7c9fdb1
-  data.tar.gz: c7693e8574f30f8b59fd63e0e7928b0b7696d24873039f20a47be6a1444099ad1baf260975ea9c1ba67551fc74963b4310650020318bb5d42ee6bad16c95c655
+  metadata.gz: c5ba80edc1b162bd378baea6188082d008660341b2db13b624111e70064982bb0e71a1421dcebaff7ce52be1bcb8e51564d308bce2c93440a553422a6ae18160
+  data.tar.gz: b970f890aeefd7fc75ad450ca5f6e7503c2b321699713c173ecc7f9cca0aa273dfb60f4dfdcb48fbac8094a5e25fd32d3202d4e209f4f5b19c87518b9d7739c4

data/app/cells/decidim/proposals/collaborative_draft_m_cell.rb

@@ -23,7 +23,7 @@ module Decidim
       end
 
       def description
-        decidim_sanitize_editor(present(model).body.truncate(100, separator: /\s/))
+        decidim_sanitize_editor(present(model).body.truncate(100, separator: /\s/), strip_tags: true)
       end
 
       def has_badge?

data/app/commands/decidim/proposals/admin/create_proposal.rb

@@ -40,9 +40,10 @@ module Decidim
             create_gallery if process_gallery?
             create_attachment(weight: first_attachment_weight) if process_attachments?
             link_author_meeeting if form.created_in_meeting?
-            send_notification
           end
 
+          send_notification
+
           broadcast(:ok, proposal)
         end
 
@@ -81,11 +82,13 @@ module Decidim
         end
 
         def send_notification
+          return unless proposal
+
           Decidim::EventsManager.publish(
             event: "decidim.events.proposals.proposal_published",
             event_class: Decidim::Proposals::PublishProposalEvent,
             resource: proposal,
-            followers: @proposal.participatory_space.followers,
+            followers: proposal.participatory_space.followers,
             extra: {
               participatory_space: true
             }

data/app/commands/decidim/proposals/admin/notify_proposal_answer.rb

@@ -21,6 +21,8 @@ module Decidim
         #
         # Returns nothing.
         def call
+          return broadcast(:invalid) if proposal.blank?
+
           if proposal.published_state? && state_changed?
             transaction do
               increment_score

data/app/helpers/decidim/proposals/application_helper.rb

@@ -95,7 +95,13 @@ module Decidim
       # the proposal comes from a collaborative_draft or a participatory_text.
       def safe_content?
         (rich_text_editor_in_public_views? && not_from_collaborative_draft(@proposal)) ||
-          ((@proposal.official? || @proposal.official_meeting?) && not_from_participatory_text(@proposal))
+          safe_content_admin?
+      end
+
+      # For admin entered content, the proposal body can contain certain extra
+      # tags, such as iframes.
+      def safe_content_admin?
+        (@proposal.official? || @proposal.official_meeting?) && not_from_participatory_text(@proposal)
       end
 
       # If the content is safe, HTML tags are sanitized, otherwise, they are stripped.

data/app/helpers/decidim/proposals/proposals_helper.rb

@@ -7,7 +7,7 @@ module Decidim
       def proposal_reason_callout_announcement
         {
           title: proposal_reason_callout_title,
-          body: decidim_sanitize_editor(translated_attribute(@proposal.answer))
+          body: decidim_sanitize_editor_admin(translated_attribute(@proposal.answer))
         }
       end
 

data/app/views/decidim/proposals/admin/participatory_texts/_article-preview.html.erb

@@ -1,13 +1,13 @@
 <div class="grid-x">
   <div class="cell">
     <%= form.hidden_field :position, class: "position" %>
-    <%= form.text_field :title, optional: false %>
+    <%= form.text_field :title, required: true %>
   </div>
 </div>
 <% if proposal.article? %>
 <div class="grid-x">
   <div class="cell">
-    <%= form.text_area :body, optional: false, rows: 5 %>
+    <%= form.text_area :body, required: true, rows: 5 %>
   </div>
 </div>
 <% end %>

data/app/views/decidim/proposals/admin/participatory_texts/new_import.html.erb

@@ -23,7 +23,7 @@
           <fieldset>
             <legend> <%= t(".document_legend", valid_mime_types: mime_types_with_document_examples).html_safe %> </legend>
               <div class="row column">
-                <%= form.upload :document, optional: false %>
+                <%= form.upload :document, required: true %>
               </div>
           </fieldset>
         </div>

data/app/views/decidim/proposals/collaborative_drafts/_edit_form_fields.html.erb

@@ -5,7 +5,7 @@
 </div>
 
 <div class="field hashtags__container">
-  <%= form.text_area :body, rows: 10, class: "js-hashtags", value: form_presenter.body(extras: false).strip %>
+  <%= text_editor_for_proposal_body(form) %>
 </div>
 
 <% if @form.component_automatic_hashtags.any? %>

data/app/views/decidim/proposals/collaborative_drafts/show.html.erb

@@ -33,7 +33,7 @@
     <div class="section">
       <%== cell("decidim/proposals/collaborative_draft_m", @collaborative_draft, full_badge: true).badge %>
 
-      <%= simple_format(present(@collaborative_draft).body(links: true, strip_tags: true), nil, sanitize: false) %>
+      <%= decidim_sanitize_editor present(@collaborative_draft).body(links: true) %>
 
       <% if component_settings.geocoding_enabled? %>
         <%= render partial: "decidim/shared/static_map", locals: { icon_name: "proposals", geolocalizable: @collaborative_draft } %>

data/app/views/decidim/proposals/proposals/_linked_proposals.html.erb

@@ -22,7 +22,8 @@
           <% end %>
         </div>
       </div>
-      <% if !current_settings.try(:votes_hidden?) && !proposal.component.current_settings.votes_hidden? %>
+      <% if !current_settings.try(:votes_hidden?) && !proposal.component.current_settings.votes_hidden? &&
+      proposal.component.current_settings.votes_enabled? %>
         <div class="card--list__data">
           <span class="card--list__data__number">
             <%= proposal.votes.size %>