diff --git a/decidim-assemblies/app/views/decidim/assemblies/assemblies/show.html.erb b/decidim-assemblies/app/views/decidim/assemblies/assemblies/show.html.erb index 5bef8f269688b..b64461ad2d923 100644 --- a/decidim-assemblies/app/views/decidim/assemblies/assemblies/show.html.erb +++ b/decidim-assemblies/app/views/decidim/assemblies/assemblies/show.html.erb @@ -37,7 +37,7 @@ edit_link(

<%= t(".title") %>

- <%= decidim_sanitize_editor translated_attribute(current_participatory_space.short_description) %> + <%= decidim_sanitize_editor_admin translated_attribute(current_participatory_space.short_description) %>
<%= decidim_sanitize_editor_admin translated_attribute(current_participatory_space.description) %> @@ -57,21 +57,21 @@ edit_link( <% if translated_attribute(current_participatory_space.purpose_of_action).present? %>

<%= t("purpose_of_action", scope: "decidim.assemblies.show") %>

- <%= decidim_sanitize_editor translated_attribute(current_participatory_space.purpose_of_action) %> + <%= decidim_sanitize_editor_admin translated_attribute(current_participatory_space.purpose_of_action) %>
<% end %> <% if translated_attribute(current_participatory_space.internal_organisation).present? %>

<%= t("internal_organisation", scope: "decidim.assemblies.show") %>

- <%= decidim_sanitize_editor translated_attribute(current_participatory_space.internal_organisation) %> + <%= decidim_sanitize_editor_admin translated_attribute(current_participatory_space.internal_organisation) %>
<% end %> <% if translated_attribute(current_participatory_space.composition).present? %>

<%= t("composition", scope: "decidim.assemblies.show") %>

- <%= decidim_sanitize_editor translated_attribute(current_participatory_space.composition) %> + <%= decidim_sanitize_editor_admin translated_attribute(current_participatory_space.composition) %>
<% end %>
diff --git a/decidim-assemblies/spec/system/assemblies_spec.rb b/decidim-assemblies/spec/system/assemblies_spec.rb index 955b7ae0a26d2..6b72d25343cb3 100644 --- a/decidim-assemblies/spec/system/assemblies_spec.rb +++ b/decidim-assemblies/spec/system/assemblies_spec.rb @@ -6,14 +6,24 @@ describe "Assemblies", type: :system do let(:organization) { create(:organization) } let(:show_statistics) { true } - let(:base_description) { { en: "Description", ca: "Descripció", es: "Descripción" } } + + let(:description) { { en: "Description", ca: "Descripció", es: "Descripción" } } + let(:short_description) { { en: "Short description", ca: "Descripció curta", es: "Descripción corta" } } + let(:purpose_of_action) { { en: "Purpose of action", ca: "Propòsit de l'acció", es: "Propósito de la acción" } } + let(:internal_organisation) { { en: "Internal organisation", ca: "Organització interna", es: "Organización interna" } } + let(:composition) { { en: "Composition", ca: "Composició", es: "Composición" } } + let(:closing_date_reason) { { en: "Closing date reason", ca: "Motiu de la data de tancament", es: "Razón de la fecha de cierre" } } let(:base_assembly) do create( :assembly, :with_type, organization: organization, - description: base_description, - short_description: { en: "Short description", ca: "Descripció curta", es: "Descripción corta" }, + description: description, + short_description: short_description, + purpose_of_action: purpose_of_action, + internal_organisation: internal_organisation, + composition: composition, + closing_date_reason: closing_date_reason, show_statistics: show_statistics ) end @@ -182,7 +192,35 @@ let(:attached_to) { assembly } end - it_behaves_like "has embedded video in description", :base_description + context "when having rich content" do + context "when short_description" do + it_behaves_like "has embedded video in description", :short_description + end + + context "when description" do + before { click_button("Read more") } + + it_behaves_like "has embedded video in description", :description + end + + context "when purpose_of_action" do + before { click_button("Read more") } + + it_behaves_like "has embedded video in description", :purpose_of_action + end + + context "when internal_organisation" do + before { click_button("Read more") } + + it_behaves_like "has embedded video in description", :internal_organisation + end + + context "when composition" do + before { click_button("Read more") } + + it_behaves_like "has embedded video in description", :composition + end + end context "when the assembly has some components" do it "shows the components" do diff --git a/decidim-blogs/spec/system/explore_posts_spec.rb b/decidim-blogs/spec/system/explore_posts_spec.rb index 6035034e431ed..2c2a15bd6ff85 100644 --- a/decidim-blogs/spec/system/explore_posts_spec.rb +++ b/decidim-blogs/spec/system/explore_posts_spec.rb @@ -55,7 +55,8 @@ describe "show" do let(:posts_count) { 1 } let(:author) { organization } - let!(:post) { create(:post, component: component, author: author) } + let(:body) { { en: "Short description", ca: "Descripció curta", es: "Descripción corta" } } + let!(:post) { create(:post, component:, author: author, body: body) } before do visit resource_locator(post).path @@ -96,6 +97,8 @@ expect(page).to have_content(post.created_at.strftime("%d/%m/%Y %H:%M ")) end + it_behaves_like "has embedded video in description", :body + it "shows the back button" do expect(page).to have_link(href: "#{main_component_path(component)}posts") end diff --git a/decidim-budgets/app/cells/decidim/budgets/budgets_header/show.erb b/decidim-budgets/app/cells/decidim/budgets/budgets_header/show.erb index 4b0d50d17e416..467c292dc4955 100644 --- a/decidim-budgets/app/cells/decidim/budgets/budgets_header/show.erb +++ b/decidim-budgets/app/cells/decidim/budgets/budgets_header/show.erb @@ -1,7 +1,7 @@
- <%= decidim_sanitize_editor(landing_page_content) %> + <%= decidim_sanitize_editor_admin(landing_page_content) %>
diff --git a/decidim-budgets/app/views/decidim/budgets/projects/show.html.erb b/decidim-budgets/app/views/decidim/budgets/projects/show.html.erb index 2abbd6e215cc8..1074803f356e0 100644 --- a/decidim-budgets/app/views/decidim/budgets/projects/show.html.erb +++ b/decidim-budgets/app/views/decidim/budgets/projects/show.html.erb @@ -59,7 +59,7 @@ edit_link( <%= render partial: "decidim/shared/static_map", locals: { icon_name: "projects", geolocalizable: project } %> <% end %> <%= cell("decidim/budgets/project_selected_status", project, as_label: true) %> - <%= decidim_sanitize_editor translated_attribute project.description %> + <%= decidim_sanitize_editor_admin translated_attribute project.description %> <%= cell "decidim/budgets/project_tags", project, context: { extra_classes: ["tags--project"] } %>
<%= attachments_for project %> diff --git a/decidim-budgets/spec/system/explore_budgets_spec.rb b/decidim-budgets/spec/system/explore_budgets_spec.rb index 6588f83494f07..1862a971dfa94 100644 --- a/decidim-budgets/spec/system/explore_budgets_spec.rb +++ b/decidim-budgets/spec/system/explore_budgets_spec.rb @@ -44,6 +44,14 @@ end describe "budget list item" do + let!(:component) do + create(:budgets_component, + :with_vote_threshold_percent, + manifest: manifest, + participatory_space: participatory_process, + settings: { landing_page_content: description }) + end + let(:description) { { en: "Short description", ca: "Descripció curta", es: "Descripción corta" } } let(:budget) { budgets.first } let(:item) { page.find(".budget-list .card--list__item:first-child", match: :first) } let!(:projects) { create_list(:project, 3, budget: budget, budget_amount: 10_000_000) } @@ -52,6 +60,8 @@ login_as user, scope: :user end + it_behaves_like "has embedded video in description", :description + it "has a clickable title" do expect(item).to have_link(translated(budget.title), href: budget_path(budget)) end diff --git a/decidim-budgets/spec/system/explore_projects_spec.rb b/decidim-budgets/spec/system/explore_projects_spec.rb index f1ca31ff0712f..2e571d81d445c 100644 --- a/decidim-budgets/spec/system/explore_projects_spec.rb +++ b/decidim-budgets/spec/system/explore_projects_spec.rb @@ -13,6 +13,18 @@ let!(:project) { projects.first } let(:categories) { create_list(:category, 3, participatory_space: component.participatory_space) } + describe "show" do + let(:description) { { en: "Short description", ca: "Descripció curta", es: "Descripción corta" } } + let(:project) { create(:project, budget: budget, description: description) } + + before do + visit_budget + click_link translated(project.title) + end + + it_behaves_like "has embedded video in description", :description + end + describe "index" do it "shows all resources for the given component" do visit_budget diff --git a/decidim-consultations/app/cells/decidim/consultations/consultation_m_cell.rb b/decidim-consultations/app/cells/decidim/consultations/consultation_m_cell.rb index 0337526d39fa1..2755fe7d0bd70 100644 --- a/decidim-consultations/app/cells/decidim/consultations/consultation_m_cell.rb +++ b/decidim-consultations/app/cells/decidim/consultations/consultation_m_cell.rb @@ -34,9 +34,7 @@ def badge_name # find the opening `

` tag and include the badge right after it. This # makes the layout look good. def description - text = super - text.sub!(/

/, "

#{render :badge}") - html_truncate(text, length: 100) + render(:badge) + truncate(strip_tags(super), length: 100) end def resource_path diff --git a/decidim-consultations/app/scrubbers/decidim/consultations/question_title_scrubber.rb b/decidim-consultations/app/scrubbers/decidim/consultations/question_title_scrubber.rb new file mode 100644 index 0000000000000..6d4f6742eb220 --- /dev/null +++ b/decidim-consultations/app/scrubbers/decidim/consultations/question_title_scrubber.rb @@ -0,0 +1,17 @@ +# frozen_string_literal: true + +module Decidim + module Consultations + class QuestionTitleScrubber < Decidim::UserInputScrubber + private + + def custom_allowed_tags + %w(strong em u b i br ul ol li p a code) + end + + def custom_allowed_attributes + %w(class href target rel) + end + end + end +end diff --git a/decidim-consultations/app/views/decidim/consultations/consultations/_consultation_details.html.erb b/decidim-consultations/app/views/decidim/consultations/consultations/_consultation_details.html.erb index ac198c7b4477b..fd08af9db5ab9 100644 --- a/decidim-consultations/app/views/decidim/consultations/consultations/_consultation_details.html.erb +++ b/decidim-consultations/app/views/decidim/consultations/consultations/_consultation_details.html.erb @@ -1,6 +1,6 @@

-

<%= decidim_sanitize_editor translated_attribute(consultation.description) %>

+

<%= decidim_sanitize_editor_admin translated_attribute(consultation.description) %>

<% if consultation.introductory_video_url.blank? %> diff --git a/decidim-consultations/app/views/decidim/consultations/consultations/_question.html.erb b/decidim-consultations/app/views/decidim/consultations/consultations/_question.html.erb index 0e62f1b04865a..3fa4aedf2f907 100644 --- a/decidim-consultations/app/views/decidim/consultations/consultations/_question.html.erb +++ b/decidim-consultations/app/views/decidim/consultations/consultations/_question.html.erb @@ -3,7 +3,7 @@
<%= link_to decidim_consultations.question_path(question), class: "card__link" do %> -

<%= decidim_sanitize translated_attribute question.title %>

+

<%= decidim_sanitize translated_attribute(question.title), strip_tags: true %>

<% end %>

<%= translated_attribute question.subtitle %>

diff --git a/decidim-consultations/app/views/decidim/consultations/questions/_vote_modal.html.erb b/decidim-consultations/app/views/decidim/consultations/questions/_vote_modal.html.erb index 21c011fdab30d..431ca1ac4c00a 100644 --- a/decidim-consultations/app/views/decidim/consultations/questions/_vote_modal.html.erb +++ b/decidim-consultations/app/views/decidim/consultations/questions/_vote_modal.html.erb @@ -10,7 +10,7 @@

<%= t "questions.vote_modal.contextual_help", scope: "decidim" %>

-

<%= translated_attribute(question.title).html_safe %>

+

<%= decidim_sanitize translated_attribute(question.title), scrubber: Decidim::Consultations::QuestionTitleScrubber.new %>

diff --git a/decidim-consultations/app/views/decidim/consultations/questions/show.html.erb b/decidim-consultations/app/views/decidim/consultations/questions/show.html.erb index fe55100f4848f..e7411ec1ee742 100644 --- a/decidim-consultations/app/views/decidim/consultations/questions/show.html.erb +++ b/decidim-consultations/app/views/decidim/consultations/questions/show.html.erb @@ -2,7 +2,7 @@
- <%= decidim_sanitize_editor translated_attribute current_question.question_context %> + <%= decidim_sanitize_editor_admin translated_attribute current_question.question_context %>
@@ -13,12 +13,12 @@

<%= t "question.what_is_decided", scope: "activemodel.attributes" %>

-

<%= decidim_sanitize_editor translated_attribute(current_question.what_is_decided), strip_tags: true %>

+

<%= decidim_sanitize_editor_admin translated_attribute(current_question.what_is_decided) %>

<%= t "question.question_context", scope: "activemodel.attributes" %>

-

<%= decidim_sanitize_editor translated_attribute(current_question.question_context), strip_tags: true %>

+

<%= decidim_sanitize_editor_admin translated_attribute(current_question.question_context) %>

diff --git a/decidim-consultations/app/views/layouts/decidim/_question_header.html.erb b/decidim-consultations/app/views/layouts/decidim/_question_header.html.erb index 6d5728c85ac7a..da8b210265a85 100644 --- a/decidim-consultations/app/views/layouts/decidim/_question_header.html.erb +++ b/decidim-consultations/app/views/layouts/decidim/_question_header.html.erb @@ -23,7 +23,7 @@ <%= yield :question_header_instructions if content_for? :question_header_instructions %>
-

<%= decidim_sanitize translated_attribute question.title %>

+

<%= decidim_sanitize translated_attribute(question.title), scrubber: Decidim::Consultations::QuestionTitleScrubber.new %>

<% unless question.hashtag.blank? %>
<%= link_to "##{question.hashtag}", twitter_hashtag_url(question.hashtag), target: "_blank" %> diff --git a/decidim-consultations/spec/scrubbers/decidim/consultations/question_title_scrubber_spec.rb b/decidim-consultations/spec/scrubbers/decidim/consultations/question_title_scrubber_spec.rb new file mode 100644 index 0000000000000..a831ee286373d --- /dev/null +++ b/decidim-consultations/spec/scrubbers/decidim/consultations/question_title_scrubber_spec.rb @@ -0,0 +1,61 @@ +# frozen_string_literal: true + +require "spec_helper" + +describe Decidim::Consultations::QuestionTitleScrubber do + subject { described_class.new } + + def scrub(html) + Loofah.scrub_fragment(html, subject).to_s + end + + RSpec::Matchers.define :be_scrubbed do + match do |actual| + expect(scrub(actual)).to eq actual + end + + failure_message do |actual| + "expected \"#{actual}\" to eq \"#{scrub(actual)}\" after scrubbing" + end + end + + RSpec::Matchers.define :be_scrubbed_as do |expected| + match do |actual| + expect(scrub(actual)).to eq expected + end + + failure_message do |actual| + "expected \"#{actual}\" to eq \"#{expected}\" after scrubbing, scrubbed as \"#{scrub(actual)}\" instead" + end + end + + it "does not allow iframes" do + html = "" + expect(html).to be_scrubbed_as("") + end + + it "does not allow comments" do + html = "

Hello,

" + expect(html).to be_scrubbed_as("

Hello,

") + end + + it "does not allow disabled iframes" do + html = %(
) + expect(html).to be_scrubbed_as("") + end + + it "allows most basic tags" do + html = "


" + expect(html).to be_scrubbed + end + + it "does not allow scripts" do + html = "" + expect(html).to be_scrubbed_as("") + end + + it "does not allow onerror attributes" do + html = "" + expect(html).to be_scrubbed_as("") + end +end diff --git a/decidim-consultations/spec/system/consultation_spec.rb b/decidim-consultations/spec/system/consultation_spec.rb index cdb952ddfa7a2..1dd56d544f227 100644 --- a/decidim-consultations/spec/system/consultation_spec.rb +++ b/decidim-consultations/spec/system/consultation_spec.rb @@ -4,8 +4,10 @@ describe "Consultation", type: :system do let!(:organization) { create(:organization) } - let!(:consultation) { create(:consultation, :published, organization: organization) } - let!(:user) { create :user, :confirmed, organization: organization } + let(:description) { { en: "Short description", ca: "Descripció curta", es: "Descripción corta" } } + let(:introductory_video_url) { "https://www.youtube.com/watch?v=1234567890" } + let!(:consultation) { create(:consultation, :published, organization: organization, description: description, introductory_video_url: introductory_video_url) } + let!(:user) { create :user, :confirmed, organization: } before do switch_to_host(organization.host) @@ -20,6 +22,10 @@ visit decidim_consultations.consultation_path(consultation) end + it_behaves_like "has embedded video in description", :description do + let(:introductory_video_url) { nil } + end + it "Shows the basic consultation data" do expect(page).to have_i18n_content(consultation.title) expect(page).to have_i18n_content(consultation.subtitle) diff --git a/decidim-consultations/spec/system/question_spec.rb b/decidim-consultations/spec/system/question_spec.rb index c9e62339575f6..b9381e39ca657 100644 --- a/decidim-consultations/spec/system/question_spec.rb +++ b/decidim-consultations/spec/system/question_spec.rb @@ -4,9 +4,11 @@ describe "Question", type: :system do let(:organization) { create(:organization) } - let(:consultation) { create(:consultation, :published, organization: organization) } + let!(:consultation) { create(:consultation, :published, organization: organization) } + let(:question_context) { Decidim::Faker::Localized.wrapped("

", "

") { generate_localized_title } } + let(:what_is_decided) { Decidim::Faker::Localized.wrapped("

", "

") { generate_localized_title } } let(:previous_question) { create :question, consultation: consultation } - let(:question) { create :question, consultation: consultation } + let(:question) { create :question, consultation: consultation, question_context: question_context, what_is_decided: what_is_decided } let(:next_question) { create :question, consultation: consultation } context "when shows question information" do @@ -15,6 +17,18 @@ visit decidim_consultations.question_path(question) end + context "when displaying question context" do + it_behaves_like "has embedded video in description", :question_context, count: 2 do + before { click_button("Read more") } + end + end + + context "when displaying what is decided" do + it_behaves_like "has embedded video in description", :what_is_decided do + before { click_button("Read more") } + end + end + it "Shows the basic question data" do expect(page).to have_i18n_content(question.promoter_group) expect(page).to have_i18n_content(question.scope.name) diff --git a/decidim-core/app/scrubbers/decidim/admin_input_scrubber.rb b/decidim-core/app/scrubbers/decidim/admin_input_scrubber.rb index 13ad3b49ef1f0..e45d930204fce 100644 --- a/decidim-core/app/scrubbers/decidim/admin_input_scrubber.rb +++ b/decidim-core/app/scrubbers/decidim/admin_input_scrubber.rb @@ -14,12 +14,14 @@ module Decidim class AdminInputScrubber < UserInputScrubber private + DECIDIM_ALLOWED_TAGS = %w(img video audio source comment iframe).freeze + def custom_allowed_attributes super + %w(frameborder allowfullscreen) - %w(onerror) end def custom_allowed_tags - super + %w(comment iframe) + super + DECIDIM_ALLOWED_TAGS end end end diff --git a/decidim-core/app/scrubbers/decidim/user_input_scrubber.rb b/decidim-core/app/scrubbers/decidim/user_input_scrubber.rb index c32321d41dce5..2626dd260969c 100644 --- a/decidim-core/app/scrubbers/decidim/user_input_scrubber.rb +++ b/decidim-core/app/scrubbers/decidim/user_input_scrubber.rb @@ -18,12 +18,41 @@ def initialize private + RESTRICTED_TAGS = %w( + area + article + aside + audio + button + canvas + fieldset + figcaption + figure + font + footer + form + header + img + input + label + legend + main + map + menu + optgroup + option + output + select + textarea + video + ).freeze + def custom_allowed_attributes Loofah::HTML5::SafeList::ALLOWED_ATTRIBUTES end def custom_allowed_tags - Loofah::HTML5::SafeList::ALLOWED_ELEMENTS_WITH_LIBXML2 + Loofah::HTML5::SafeList::ACCEPTABLE_ELEMENTS - RESTRICTED_TAGS end end end diff --git a/decidim-core/lib/decidim/core/test/shared_examples/editor_shared_examples.rb b/decidim-core/lib/decidim/core/test/shared_examples/editor_shared_examples.rb index e54c4490f3747..8bcc720b91309 100644 --- a/decidim-core/lib/decidim/core/test/shared_examples/editor_shared_examples.rb +++ b/decidim-core/lib/decidim/core/test/shared_examples/editor_shared_examples.rb @@ -1,8 +1,9 @@ # frozen_string_literal: true -shared_examples_for "has embedded video in description" do |description_attribute_name| +shared_examples_for "has embedded video in description" do |description_attribute_name, count: 1| let(description_attribute_name) { { en: %(Description ) } } let(:iframe_src) { "http://www.example.org" } + let!(:cookie_warning) { "You need to enable all cookies in order to see this content" } context "when cookies are rejected" do before do @@ -11,7 +12,7 @@ end it "disables iframe" do - expect(page).to have_content("You need to enable all cookies in order to see this content") + expect(page).to have_content(cookie_warning) expect(page).not_to have_selector("iframe") end end @@ -23,8 +24,8 @@ end it "shows iframe" do - expect(page).not_to have_content("You need to enable all cookies in order to see this content") - expect(page).to have_selector("iframe", count: 1) + expect(page).not_to have_content(cookie_warning) + expect(page).to have_selector("iframe", count: count) end end end diff --git a/decidim-core/spec/scrubbers/decidim/user_input_scrubber_spec.rb b/decidim-core/spec/scrubbers/decidim/user_input_scrubber_spec.rb index 5e0ec0371f130..8efd76ef78154 100644 --- a/decidim-core/spec/scrubbers/decidim/user_input_scrubber_spec.rb +++ b/decidim-core/spec/scrubbers/decidim/user_input_scrubber_spec.rb @@ -56,6 +56,6 @@ def scrub(html) it "does not allow onerror attributes" do html = "" - expect(html).to be_scrubbed_as("") + expect(html).to be_scrubbed_as("") end end diff --git a/decidim-debates/app/views/decidim/debates/debates/show.html.erb b/decidim-debates/app/views/decidim/debates/debates/show.html.erb index 396846ecbf5e7..cc977f70c62f8 100644 --- a/decidim-debates/app/views/decidim/debates/debates/show.html.erb +++ b/decidim-debates/app/views/decidim/debates/debates/show.html.erb @@ -108,12 +108,12 @@ edit_link( <% if translated_attribute(debate.instructions).present? %>
- <%= decidim_sanitize_editor(simple_format(translated_attribute(debate.instructions), {}, sanitize: false)) %> + <%= decidim_sanitize_editor_admin(simple_format(translated_attribute(debate.instructions), {}, sanitize: false)) %>
<% end %> <% if translated_attribute(debate.information_updates).present? %>
- <%= decidim_sanitize_editor(simple_format(translated_attribute(debate.information_updates), {}, sanitize: false)) %> + <%= decidim_sanitize_editor_admin(simple_format(translated_attribute(debate.information_updates), {}, sanitize: false)) %>
<% end %> diff --git a/decidim-debates/spec/system/show_spec.rb b/decidim-debates/spec/system/show_spec.rb index 8ef863542b4d4..2bffaeb5a3615 100644 --- a/decidim-debates/spec/system/show_spec.rb +++ b/decidim-debates/spec/system/show_spec.rb @@ -6,13 +6,55 @@ include_context "with a component" let(:manifest_name) { "debates" } - let!(:debate) { create(:debate, component: component, skip_injection: true) } + let(:description) { Decidim::Faker::Localized.wrapped("

", "

") { generate_localized_debate_title } } + let(:information_updates) { Decidim::Faker::Localized.wrapped("

", "

") { generate_localized_debate_title } } + let(:instructions) { Decidim::Faker::Localized.wrapped("

", "

") { generate_localized_debate_title } } + let!(:debate) { create(:debate, component: component, description: description, information_updates: information_updates, instructions: instructions, skip_injection: true) } before do visit_component click_link debate.title[I18n.locale.to_s], class: "card__link" end + context "when is created from the admin panel" do + let!(:debate) { create(:debate, :official, component: component, description: description, information_updates: information_updates, instructions: instructions) } + + context "when the field is decription" do + it_behaves_like "has embedded video in description", :description + end + + context "when the field is information_updates" do + it_behaves_like "has embedded video in description", :information_updates + end + + context "when the field is instructions" do + it_behaves_like "has embedded video in description", :instructions + end + end + + context "when is created by the participant" do + let!(:debate) { create(:debate, :participant_author, component: component, description: description, information_updates: information_updates, instructions: instructions) } + let(:iframe_src) { "http://www.example.org" } + + context "when the field is decription" do + let(:description) { { en: %(Description ) } } + + it { expect(page).not_to have_selector("iframe") } + end + + context "when the field is information_updates" do + let(:information_updates) { { en: %(Description ) } } + + it { expect(page).not_to have_selector("iframe") } + end + + context "when the field is instructions" do + let(:instructions) { { en: %(Description ) } } + + it { expect(page).not_to have_selector("iframe") } + end + end + context "when shows the debate component" do it "shows the debate title" do expect(page).to have_content debate.title[I18n.locale.to_s] diff --git a/decidim-elections/app/views/decidim/elections/elections/show.html.erb b/decidim-elections/app/views/decidim/elections/elections/show.html.erb index 23b93809f6ecc..03525425c509d 100644 --- a/decidim-elections/app/views/decidim/elections/elections/show.html.erb +++ b/decidim-elections/app/views/decidim/elections/elections/show.html.erb @@ -45,7 +45,7 @@ edit_link( <% end %>
-

<%= decidim_sanitize_editor(simple_format(translated_attribute(election.description)), strip_tags: true) %>

+

<%= decidim_sanitize_editor_admin(translated_attribute(election.description)) %>

<%= cell("decidim/elections/election_vote_cta", election) %> diff --git a/decidim-elections/spec/system/explore_elections_spec.rb b/decidim-elections/spec/system/explore_elections_spec.rb index bf192b54d7aac..455fe45249015 100644 --- a/decidim-elections/spec/system/explore_elections_spec.rb +++ b/decidim-elections/spec/system/explore_elections_spec.rb @@ -136,7 +136,8 @@ describe "show" do let(:elections_count) { 1 } - let(:election) { elections.first } + let(:description) { Decidim::Faker::Localized.wrapped("

", "

") { generate_localized_title } } + let(:election) { create(:election, :complete, :published, :ongoing, component: component, description: description) } let(:question) { election.questions.first } let(:image) { create(:attachment, :with_image, attached_to: election) } @@ -145,6 +146,8 @@ visit resource_locator(election).path end + it_behaves_like "has embedded video in description", :description + it "shows all election info" do expect(page).to have_i18n_content(election.title) expect(page).to have_i18n_content(election.description) diff --git a/decidim-forms/app/views/decidim/forms/questionnaires/_answer.html.erb b/decidim-forms/app/views/decidim/forms/questionnaires/_answer.html.erb index 8149b202bdbe5..b1d4042e71da3 100644 --- a/decidim-forms/app/views/decidim/forms/questionnaires/_answer.html.erb +++ b/decidim-forms/app/views/decidim/forms/questionnaires/_answer.html.erb @@ -7,7 +7,7 @@ <%= label_tag field_id, translated_attribute(answer.question.body), class: "questionnaire-title_and_description" %> <% if translated_attribute(answer.question.description).present? %>
- <%= decidim_sanitize_editor translated_attribute(answer.question.description) %> + <%= decidim_sanitize_editor_admin translated_attribute(answer.question.description) %>
<% end %> <%= render partial: "decidim/forms/questionnaires/answers/#{answer.question.question_type}", locals: { answer: answer, answer_form: answer_form, answer_idx: answer_idx, field_id: field_id, disabled: disabled } %> @@ -22,7 +22,7 @@ <% if translated_attribute(answer.question.description).present? %>
- <%= decidim_sanitize_editor translated_attribute(answer.question.description) %> + <%= decidim_sanitize_editor_admin translated_attribute(answer.question.description) %>
<% end %> diff --git a/decidim-forms/app/views/decidim/forms/questionnaires/show.html.erb b/decidim-forms/app/views/decidim/forms/questionnaires/show.html.erb index c243f1be83540..a07d800d25bd6 100644 --- a/decidim-forms/app/views/decidim/forms/questionnaires/show.html.erb +++ b/decidim-forms/app/views/decidim/forms/questionnaires/show.html.erb @@ -11,7 +11,7 @@

<%= translated_attribute questionnaire.title %>

- <%= decidim_sanitize_editor translated_attribute questionnaire.description %> + <%= decidim_sanitize_editor_admin translated_attribute questionnaire.description %>
diff --git a/decidim-meetings/app/views/decidim/meetings/meetings/_linked_meetings.html.erb b/decidim-meetings/app/views/decidim/meetings/meetings/_linked_meetings.html.erb index c4f34e62a725e..063d823c5a7d4 100644 --- a/decidim-meetings/app/views/decidim/meetings/meetings/_linked_meetings.html.erb +++ b/decidim-meetings/app/views/decidim/meetings/meetings/_linked_meetings.html.erb @@ -14,7 +14,7 @@ <%= meeting.start_time.strftime("%H:%M") %> - <%= meeting.end_time.strftime("%H:%M") %>
- <%= decidim_sanitize_editor(present(meeting).description) %> + <%= decidim_sanitize_editor present(meeting).description(strip_tags: true) %>
diff --git a/decidim-pages/spec/system/page_show_spec.rb b/decidim-pages/spec/system/page_show_spec.rb index 4439b9adbb14e..f678409b937cc 100644 --- a/decidim-pages/spec/system/page_show_spec.rb +++ b/decidim-pages/spec/system/page_show_spec.rb @@ -27,6 +27,7 @@ end it_behaves_like "accessible page" + it_behaves_like "has embedded video in description", :body it "renders the content of the page" do expect(page).to have_content("Content") diff --git a/decidim-participatory_processes/app/views/decidim/participatory_processes/participatory_processes/show.html.erb b/decidim-participatory_processes/app/views/decidim/participatory_processes/participatory_processes/show.html.erb index 2c85d80c94ded..b47035f336186 100644 --- a/decidim-participatory_processes/app/views/decidim/participatory_processes/participatory_processes/show.html.erb +++ b/decidim-participatory_processes/app/views/decidim/participatory_processes/participatory_processes/show.html.erb @@ -32,7 +32,7 @@ <%= render partial: "participatory_process_group" %> <% end %>
- <%= decidim_sanitize_editor translated_attribute(current_participatory_space.short_description) %> + <%= decidim_sanitize_editor_admin translated_attribute(current_participatory_space.short_description) %>
<%= decidim_sanitize_editor_admin translated_attribute(current_participatory_space.description) %>
diff --git a/decidim-participatory_processes/spec/system/participatory_processes_spec.rb b/decidim-participatory_processes/spec/system/participatory_processes_spec.rb index 545db7da89b45..60c5c4177f047 100644 --- a/decidim-participatory_processes/spec/system/participatory_processes_spec.rb +++ b/decidim-participatory_processes/spec/system/participatory_processes_spec.rb @@ -9,13 +9,14 @@ let(:show_statistics) { true } let(:hashtag) { true } let(:base_description) { { en: "Description", ca: "Descripció", es: "Descripción" } } + let(:short_description) { { en: "Short description", ca: "Descripció curta", es: "Descripción corta" } } let(:base_process) do create( :participatory_process, :active, organization: organization, description: base_description, - short_description: { en: "Short description", ca: "Descripció curta", es: "Descripción corta" }, + short_description:, show_metrics: show_metrics, show_statistics: show_statistics ) @@ -485,6 +486,7 @@ end it_behaves_like "has embedded video in description", :base_description + it_behaves_like "has embedded video in description", :short_description end end end diff --git a/decidim-proposals/app/helpers/decidim/proposals/proposals_helper.rb b/decidim-proposals/app/helpers/decidim/proposals/proposals_helper.rb index a97f7346a8b68..6705bdd5e9e21 100644 --- a/decidim-proposals/app/helpers/decidim/proposals/proposals_helper.rb +++ b/decidim-proposals/app/helpers/decidim/proposals/proposals_helper.rb @@ -7,7 +7,7 @@ module ProposalsHelper def proposal_reason_callout_announcement { title: proposal_reason_callout_title, - body: decidim_sanitize_editor(translated_attribute(@proposal.answer)) + body: decidim_sanitize_editor_admin(translated_attribute(@proposal.answer)) } end diff --git a/decidim-proposals/spec/system/proposals_spec.rb b/decidim-proposals/spec/system/proposals_spec.rb index bb909a2121f8c..be910b1e9adde 100644 --- a/decidim-proposals/spec/system/proposals_spec.rb +++ b/decidim-proposals/spec/system/proposals_spec.rb @@ -175,6 +175,53 @@ end end + context "when a proposal has video embeds" do + let(:cost_report) { { en: "My cost report" } } + let(:execution_period) { { en: "My execution period" } } + let(:body) { Decidim::Faker::Localized.localized { " #{Faker::Lorem.sentences(number: 3).join("\n")}" } } + let(:answer) { generate_localized_title } + + let!(:proposal) do + create( + :proposal, + :accepted, + :official, + :with_answer, + component: component, + body: body, + answer: answer, + cost: 20_000, + cost_report: cost_report, + execution_period: execution_period + ) + end + + before do + component.update!( + step_settings: { + component.participatory_space.active_step.id => { + answers_with_costs: true + } + } + ) + + visit_component + click_link proposal_title + end + + context "when is created by the admin" do + context "when the field is body" do + it_behaves_like "has embedded video in description", :body + end + end + + context "when is created by the user" do + context "when the field is answer" do + it_behaves_like "has embedded video in description", :answer + end + end + end + context "when a proposal has costs" do let!(:proposal) do create( diff --git a/decidim-sortitions/app/cells/decidim/sortitions/sortition_m_cell.rb b/decidim-sortitions/app/cells/decidim/sortitions/sortition_m_cell.rb index 04f1a4165d877..e34b1cc41324e 100644 --- a/decidim-sortitions/app/cells/decidim/sortitions/sortition_m_cell.rb +++ b/decidim-sortitions/app/cells/decidim/sortitions/sortition_m_cell.rb @@ -46,7 +46,7 @@ def proposals_count # find the opening `

` tag and include the badge right after it. This # makes the layout look good. def description - text = decidim_sanitize_editor(translated_attribute(model.additional_info)) + text = decidim_sanitize_editor(translated_attribute(model.additional_info), strip_tags: true) text.sub!(/

/, "

#{render :badge}") html_truncate(text, length: 100) end diff --git a/decidim-sortitions/app/views/decidim/sortitions/sortitions/show.html.erb b/decidim-sortitions/app/views/decidim/sortitions/sortitions/show.html.erb index b45a27eebeea1..0774dbddf1e47 100644 --- a/decidim-sortitions/app/views/decidim/sortitions/sortitions/show.html.erb +++ b/decidim-sortitions/app/views/decidim/sortitions/sortitions/show.html.erb @@ -39,7 +39,7 @@

- <%= decidim_sanitize_editor translated_attribute sortition.additional_info %> + <%= decidim_sanitize_editor_admin translated_attribute sortition.additional_info %>
diff --git a/decidim-sortitions/spec/system/decidim/sortitions/show_spec.rb b/decidim-sortitions/spec/system/decidim/sortitions/show_spec.rb index d904fdfe5817e..3abc18a9b12f0 100644 --- a/decidim-sortitions/spec/system/decidim/sortitions/show_spec.rb +++ b/decidim-sortitions/spec/system/decidim/sortitions/show_spec.rb @@ -51,13 +51,20 @@ end context "when cancelled sortition" do - let!(:sortition) { create(:sortition, :cancelled, component: component) } + let(:witnesses) { Decidim::Faker::Localized.wrapped("

", "

") { generate_localized_title } } + let(:additional_info) { Decidim::Faker::Localized.wrapped("

", "

") { generate_localized_title } } + let(:cancel_reason) { Decidim::Faker::Localized.wrapped("

", "

") { generate_localized_title } } + let!(:sortition) { create(:sortition, :cancelled, component: component, witnesses: witnesses, additional_info: additional_info, cancel_reason: cancel_reason) } before do page.visit "#{main_component_path(component)}?filter[with_any_state]=cancelled" click_link "View" end + context "when the field is additional_info" do + it_behaves_like "has embedded video in description", :additional_info + end + it "shows the cancel reasons" do expect(page).to have_content(sortition.cancel_reason[:en]) end diff --git a/decidim-surveys/spec/system/survey_spec.rb b/decidim-surveys/spec/system/survey_spec.rb index 16b97daa5ac27..66db4beeb5a86 100644 --- a/decidim-surveys/spec/system/survey_spec.rb +++ b/decidim-surveys/spec/system/survey_spec.rb @@ -19,10 +19,17 @@ "es" => "

Contenido de la encuesta

" } end + let(:question_description) do + { + "en" => "

Survey's content

", + "ca" => "

Contingut de l'enquesta

", + "es" => "

Contenido de la encuesta

" + } + end let(:user) { create(:user, :confirmed, organization: component.organization) } let!(:questionnaire) { create(:questionnaire, title: title, description: description) } let!(:survey) { create(:survey, component: component, questionnaire: questionnaire) } - let!(:question) { create(:questionnaire_question, questionnaire: questionnaire, position: 0) } + let!(:question) { create(:questionnaire_question, questionnaire: questionnaire, position: 0, description: question_description) } include_context "with a component" @@ -92,6 +99,29 @@ it_behaves_like "has questionnaire" end + + context "when displaying questionnaire rich content" do + before do + component.update!( + step_settings: { + component.participatory_space.active_step.id => { + allow_answers: true, + allow_unregistered: true + } + }, + settings: { starts_at: 1.week.ago, ends_at: 1.day.from_now } + ) + visit_component + end + + context "when displaying questionnaire description" do + it_behaves_like "has embedded video in description", :description + end + + context "when displaying question description" do + it_behaves_like "has embedded video in description", :question_description + end + end end context "when survey has action log entry" do