Merge branch 'develop' of github.com:decidim/decidim into feature/mul…

…tiple-statuses-on-proposals

decidim-admin/spec/events/decidim/attachment_created_event_spec.rb

@@ -8,10 +8,10 @@
   let(:event_name) { "decidim.events.attachments.attachment_created" }
   let(:resource) { create(:attachment) }
   let(:attached_to_url) { resource_locator(attached_to).url }
-  let(:resource_title) { attached_to.title["en"] }
+  let(:resource_title) { decidim_escape_translated(attached_to.title) }
   let(:resource_path) { resource.url }
   let(:attached_to) { resource.attached_to }
-  let(:email_subject) { "An update to #{resource_title}" }
+  let(:email_subject) { "An update to #{decidim_sanitize_translated(attached_to.title)}" }
   let(:email_intro) { "A new document has been added to #{resource_title}. You can see it from this page:" }
   let(:email_outro) { "You have received this notification because you are following #{resource_title}. You can stop receiving notifications following the previous link." }
   let(:notification_title) { "A <a href=\"#{resource_path}\">new document</a> has been added to <a href=\"#{attached_to_url}\">#{resource_title}</a>" }

decidim-admin/spec/events/decidim/component_published_event_spec.rb

@@ -11,12 +11,11 @@
   let(:resource) { create(:component) }
   let(:participatory_space) { resource.participatory_space }
   let(:resource_path) { main_component_path(resource) }
-  let(:email_subject) { "An update to #{participatory_space_title}" }
-  let(:resource_title) { decidim_sanitize_translated(resource.name) }
-  let(:participatory_space_title) { decidim_sanitize_translated(participatory_space.title) }
-  let(:email_intro) { "The #{decidim_escape_translated(resource.name)} component is now active for #{participatory_space_title}. You can see it from this page:" }
+  let(:email_subject) { "An update to #{decidim_sanitize_translated(participatory_space.title)}" }
+  let(:resource_title) { decidim_escape_translated(resource.name) }
+  let(:email_intro) { "The #{resource_title} component is now active for #{participatory_space_title}. You can see it from this page:" }
   let(:email_outro) { "You have received this notification because you are following #{participatory_space_title}. You can stop receiving notifications following the previous link." }
-  let(:notification_title) { "The #{decidim_escape_translated(resource.name)} component is now active for <a href=\"#{resource_path}\">#{participatory_space_title}</a>" }
+  let(:notification_title) { "The #{resource_title} component is now active for <a href=\"#{resource_path}\">#{participatory_space_title}</a>" }
 
   it_behaves_like "a simple event"
   it_behaves_like "a simple event email"

decidim-admin/spec/system/admin_checks_logs_spec.rb

@@ -50,6 +50,8 @@
       let(:space_title) { translated(action_logs.first.participatory_space.title) }
       let(:search_term) { space_title[0..2].downcase }
       let(:autocomplete_result) { "Participatory processes - #{space_title}" }
+      # we are intentionally skipping injection here because we want to test the search.
+      let!(:action_logs) { create_list(:action_log, 3, organization:, skip_injection: true) }
 
       it "lists only logs from that participatory space" do
         within ".filters__section" do

decidim-blogs/spec/events/decidim/blogs/create_post_event_spec.rb

@@ -8,7 +8,7 @@
   let(:email_intro) { "The post \"#{resource_title}\" has been published in \"#{participatory_space_title}\" that you are following." }
   let(:email_outro) { "You have received this notification because you are following \"#{participatory_space_title}\". You can unfollow it from the previous link." }
   let(:notification_title) { "The post <a href=\"#{resource_path}\">#{resource_title}</a> has been published in #{participatory_space_title}" }
-  let(:email_subject) { "New post published in #{participatory_space_title}" }
+  let(:email_subject) { "New post published in #{decidim_sanitize_translated(participatory_space.title)}" }
 
   include_context "when a simple event"
   it_behaves_like "a simple event"

decidim-core/app/cells/decidim/content_blocks/participatory_space_hero_cell.rb

@@ -22,13 +22,13 @@ def cta_path
       end
 
       def title_text
-        translated_attribute(title)
+        decidim_escape_translated(title)
       end
 
       def subtitle_text
         return unless resource.respond_to?(:subtitle)
 
-        translated_attribute(resource.subtitle)
+        decidim_escape_translated(resource.subtitle)
       end
 
       # If it is called from the landing page content block, use the background image defined there

decidim-core/app/cells/decidim/content_blocks/participatory_space_metadata_cell.rb

@@ -11,7 +11,7 @@ def show
 
       def metadata_valued_items
         metadata_items.filter_map do |item|
-          next if (value = translated_attribute(presented_space.send(item))).blank?
+          next if (value = decidim_escape_translated(presented_space.send(item))).blank?
 
           {
             title: t(item, scope: translations_scope),

decidim-core/lib/decidim/core/test/shared_examples/has_space_in_mcell_examples.rb

@@ -8,7 +8,7 @@
     let(:show_space) { true }
 
     it "renders the space where the model belongs to" do
-      expect(cell_html).to have_content(translated(model.component.participatory_space.title, locale: :en))
+      expect(cell_html).to have_content(decidim_escape_translated(model.component.participatory_space.title))
     end
   end
 end

decidim-core/lib/decidim/core/test/shared_examples/simple_event.rb

@@ -31,7 +31,7 @@
   let(:resource_title) { resource.title["en"] }
   # to be used when resource is a component resource, not a participatory space, in which case should be overriden
   let(:participatory_space) { resource.participatory_space }
-  let(:participatory_space_title) { participatory_space.title["en"] }
+  let(:participatory_space_title) { decidim_escape_translated(participatory_space.title) }
   let(:participatory_space_path) { Decidim::ResourceLocatorPresenter.new(participatory_space).path }
   let(:participatory_space_url) { Decidim::ResourceLocatorPresenter.new(participatory_space).url }
   let(:author) do

decidim-core/spec/cells/decidim/card_metadata_cell_spec.rb

@@ -26,7 +26,7 @@
     let(:options) { { show_space: true } }
 
     it "renders the space the model belongs to" do
-      expect(cell_html).to have_content(translated(model.component.participatory_space.title, locale: :en))
+      expect(cell_html).to have_content(decidim_escape_translated(model.component.participatory_space.title))
     end
   end
 

decidim-core/spec/mailers/reported_mailer_spec.rb

@@ -28,7 +28,7 @@ module Decidim
 
       describe "email body" do
         it "includes the participatory space name" do
-          expect(email_body(mail)).to match(moderation.participatory_space.title["en"])
+          expect(email_body(mail)).to include(decidim_escape_translated(moderation.participatory_space.title))
         end
 
         it "includes the report's reason" do

decidim-core/spec/presenters/decidim/log/space_presenter_spec.rb

@@ -21,7 +21,7 @@
 
   context "when the space exists" do
     it "links to its public page" do
-      expect(subject).to have_link(title, href: space_path)
+      expect(subject).to have_link(translated(space.title), href: space_path)
     end
   end
 

decidim-debates/spec/events/decidim/debates/create_debate_event_spec.rb

@@ -36,10 +36,10 @@
   context "when the notification is for space followers" do
     let(:type) { :space }
     let(:i18n_scope) { "decidim.events.debates.create_debate_event.space_followers" }
-    let(:email_subject) { "New debate \"#{decidim_sanitize(debate_title)}\" on #{translated(space.title)}" }
-    let(:email_intro) { "Hi,\nA new debate \"#{debate_title}\" has been created on the #{translated(space.title)} participatory space, check it out and contribute:" }
-    let(:email_outro) { "You have received this notification because you are following the #{translated(space.title)} participatory space. You can stop receiving notifications following the previous link." }
-    let(:notification_title) { "The <a href=\"#{resource_path}\">#{debate_title}</a> debate was created on <a href=\"#{space_path}\">#{translated(space.title)}</a>." }
+    let(:email_subject) { "New debate \"#{resource_title}\" on #{participatory_space_title}" }
+    let(:email_intro) { "Hi,\nA new debate \"#{resource_title}\" has been created on the #{participatory_space_title} participatory space, check it out and contribute:" }
+    let(:email_outro) { "You have received this notification because you are following the #{participatory_space_title} participatory space. You can stop receiving notifications following the previous link." }
+    let(:notification_title) { "The <a href=\"#{resource_path}\">#{debate_title}</a> debate was created on <a href=\"#{space_path}\">#{participatory_space_title}</a>." }
 
     it_behaves_like "a simple event"
     it_behaves_like "a simple event email"

decidim-debates/spec/events/decidim/debates/creation_disabled_event_spec.rb

@@ -13,7 +13,7 @@ module Debates
       let(:resource) { create(:debates_component) }
       let(:participatory_space) { resource.participatory_space }
       let(:resource_path) { main_component_path(resource) }
-      let(:email_subject) { "Debate creation disabled in #{participatory_space_title}" }
+      let(:email_subject) { "Debate creation disabled in #{decidim_sanitize_translated(participatory_space.title)}" }
       let(:email_intro) { "Debate creation is no longer active in #{participatory_space_title}. You can still participate in open debates from this page:" }
       let(:email_outro) { "You have received this notification because you are following #{participatory_space_title}. You can stop receiving notifications following the previous link." }
       let(:notification_title) { "Debate creation is now disabled in <a href=\"#{participatory_space_url}\">#{participatory_space_title}</a>" }

decidim-debates/spec/events/decidim/debates/creation_enabled_event_spec.rb

@@ -13,10 +13,10 @@ module Debates
       let(:resource) { create(:debates_component) }
       let(:participatory_space) { resource.participatory_space }
       let(:resource_path) { main_component_path(resource) }
-      let(:email_subject) { "Debates now available in #{participatory_space.title["en"]}" }
+      let(:email_subject) { "Debates now available in #{decidim_sanitize_translated(participatory_space.title)}" }
       let(:email_intro) { "You can now start new debates in #{participatory_space_title}! Start participating in this page:" }
-      let(:email_outro) { "You have received this notification because you are following #{participatory_space.title["en"]}. You can stop receiving notifications following the previous link." }
-      let(:notification_title) { "You can now start <a href=\"#{resource_path}\">new debates</a> in <a href=\"#{participatory_space_url}\">#{participatory_space.title["en"]}</a>." }
+      let(:email_outro) { "You have received this notification because you are following #{participatory_space_title}. You can stop receiving notifications following the previous link." }
+      let(:notification_title) { "You can now start <a href=\"#{resource_path}\">new debates</a> in <a href=\"#{participatory_space_url}\">#{participatory_space_title}</a>." }
 
       it_behaves_like "a simple event"
       it_behaves_like "a simple event email"

decidim-elections/spec/events/decidim/elections/election_published_event_spec.rb

@@ -7,9 +7,8 @@
 
   let(:event_name) { "decidim.events.elections.election_published" }
   let(:resource) { create(:election) }
-  let(:participatory_space_title) { resource.participatory_space.title["en"] }
   let(:resource_title) { resource.title["en"] }
-  let(:email_subject) { "The #{resource_title} election is now active for #{participatory_space_title}." }
+  let(:email_subject) { "The #{resource_title} election is now active for #{decidim_sanitize_translated(participatory_space.title)}." }
   let(:email_intro) { "The #{resource_title} election is now active for #{participatory_space_title}. You can see it from this page:" }
   let(:email_outro) { "You have received this notification because you are following #{participatory_space_title}. You can stop receiving notifications following the previous link." }
   let(:notification_title) { "The <a href=\"#{resource_path}\">#{resource_title}</a> election is now active for #{participatory_space_title}." }

decidim-elections/spec/events/decidim/elections/trustees/notify_new_trustee_event_spec.rb

@@ -7,14 +7,15 @@
 
   let(:event_name) { "decidim.events.elections.trustees.new_trustee" }
   let(:resource) { create(:participatory_process) }
-  let(:participatory_space_title) { resource.title["en"] }
-  let(:resource_title) { resource.title["en"] }
+  let(:participatory_space) { resource }
+  let(:resource_title) { decidim_escape_translated(resource.title) }
+
   let(:trustee_zone_url) { "http://#{resource.organization.host}/trustee" }
-  let(:email_subject) { "You are a trustee for #{participatory_space_title}." }
+  let(:email_subject) { "You are a trustee for #{resource_title}." }
   let(:email_intro) { "An admin has added you as trustee for #{participatory_space_title}. You should create your public key <a href='#{trustee_zone_url}'>in your trustee zone</a>" }
   let(:email_outro) { "You have received this notification because you have been added as trustee for #{participatory_space_title}." }
   let(:notification_title) { <<-EOTITLE.squish }
-    You have been added to act as a trustee in #{translated(resource.title)} for some elections that will take place in this platform.<br>
+    You have been added to act as a trustee in #{resource_title} for some elections that will take place in this platform.<br>
     You will perform tasks as needed. For now, please <a href='#{trustee_zone_url}'>generate your identification keys</a>.
   EOTITLE
 

decidim-meetings/spec/presenters/decidim/meetings/admin_log/invite_presenter_spec.rb

@@ -20,7 +20,7 @@ module Decidim::Meetings::AdminLog
         it "renders the invite information" do
           user = action_log.user
           inviter = "<a class=\"logs__log__author\" title=\"@#{user.nickname}\" href=\"/profiles/#{user.nickname}\">#{user.name}</a>"
-          space = "<a class=\"logs__log__space\" href=\"/processes/#{participatory_space.slug}?participatory_process_slug=#{participatory_space.slug}\">#{translated(participatory_space.title)}</a>"
+          space = "<a class=\"logs__log__space\" href=\"/processes/#{participatory_space.slug}?participatory_process_slug=#{participatory_space.slug}\">#{decidim_escape_translated(participatory_space.title)}</a>"
           action_string = "#{inviter} invited #{invite.user.name} to join <span class=\"logs__log__resource\"></span> meeting on the #{space} space"
           expect(subject).to include action_string
         end

decidim-participatory_processes/app/cells/decidim/participatory_process_groups/content_blocks/main_data_cell.rb

@@ -16,7 +16,7 @@ def extra_classes
         end
 
         def title_text
-          translated_attribute(title)
+          decidim_escape_translated(title)
         end
 
         def description_text

decidim-participatory_processes/app/cells/decidim/participatory_processes/content_blocks/extra_data_cell.rb

@@ -49,7 +49,7 @@ def group_item
             title: t("belongs_to_group", scope: "decidim.participatory_processes.show"),
             icon: "archive-line",
             text: link_to(
-              translated_attribute(participatory_process_group.title),
+              decidim_escape_translated(participatory_process_group.title).html_safe,
               decidim_participatory_processes.participatory_process_group_path(participatory_process_group)
             )
           }

decidim-participatory_processes/app/cells/decidim/participatory_processes/process_dropdown_metadata_cell.rb

@@ -26,7 +26,7 @@ def cache_hash
       end
 
       def step_title
-        translated_attribute process.active_step&.title
+        decidim_html_escape translated_attribute(process.active_step&.title)
       end
 
       def display_steps?

decidim-participatory_processes/app/cells/decidim/participatory_processes/process_step/show.erb

@@ -15,7 +15,7 @@
                   <span>
                     <span class="participatory-space__metadata-modal__step-title">
                       <span class="participatory-space__metadata-modal__step-current"><%= t("active_step", scope: "layouts.decidim.participatory_processes.participatory_process") %></span>
-                      <%= translated_attribute(step.title) %>
+                      <%= decidim_escape_translated(step.title) %>
                     </span>
                     <span class="participatory-space__metadata-modal__step-dates"><%= step_dates(step) %></span>
                   </span>
@@ -26,7 +26,7 @@
                   <span>
                     <span class="participatory-space__metadata-modal__step-title">
                       <span class="participatory-space__metadata-modal__step-current"><%= t("active_step", scope: "layouts.decidim.participatory_processes.participatory_process") %></span>
-                      <%= translated_attribute(step.title) %>
+                      <%= decidim_escape_translated(step.title) %>
                     </span>
                     <span class="participatory-space__metadata-modal__step-dates"><%= step_dates(step) %></span>
                   </span>