Merge branch 'production.panel.sutty.nl' into panel.testing.sutty.nl

Gemfile

@@ -79,6 +79,7 @@ gem 'webpacker'
 gem 'yaml_db', git: 'https://0xacab.org/sutty/yaml_db.git'
 gem 'kaminari'
 gem 'device_detector'
+gem 'htmlbeautifier'
 gem 'rubanok'
 
 gem 'after_commit_everywhere', '~> 1.0'

Gemfile.lock

@@ -270,6 +270,7 @@ GEM
     hiredis (0.6.3-x86_64-linux-musl)
     hiredis-client (0.14.1-x86_64-linux-musl)
       redis-client (= 0.14.1)
+    htmlbeautifier (1.4.2)
     http_parser.rb (0.8.0-x86_64-linux-musl)
     httparty (0.21.0)
       mini_mime (>= 1.0.0)
@@ -659,6 +660,7 @@ DEPENDENCIES
   hamlit-rails
   hiredis
   hiredis-client
+  htmlbeautifier
   httparty
   icalendar
   image_processing

app/javascript/controllers/file_preview_controller.js

@@ -0,0 +1,19 @@
+import { Controller } from 'stimulus'
+import bsCustomFileInput from "bs-custom-file-input";
+
+document.addEventListener("turbolinks:load", () => {
+  bsCustomFileInput.init();
+});
+
+export default class extends Controller {
+  static targets = ["preview", "input"];
+
+  connect() {
+  }
+
+  update(event = undefined) {
+    if (!this.hasPreviewTarget) return;
+
+    this.previewTarget.src = window.URL.createObjectURL(this.inputTarget.files[0])
+  }
+}

app/javascript/etc/image_preview.js

@@ -1,11 +0,0 @@
-document.addEventListener('turbolinks:load', () => {
-  document.querySelectorAll('input[type=file]').forEach(file => {
-    if (!file.dataset.preview) return
-
-    file.addEventListener('change', event => {
-      if (file.files.length === 0) return
-
-      document.querySelector('#' + file.dataset.preview).src = window.URL.createObjectURL(file.files[0])
-    })
-  })
-})

app/javascript/etc/index.js

@@ -1,5 +1,4 @@
 import './external_links'
-import './image_preview'
 import './input-date'
 import './input-tag'
 import './prosemirror'

app/models/metadata_content.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require 'htmlbeautifier'
+
 # Se encarga del contenido del artículo y quizás otros campos que
 # requieran texto largo.
 class MetadataContent < MetadataTemplate
@@ -91,7 +93,7 @@ class MetadataContent < MetadataTemplate
       end
     end
 
-    html.to_s.html_safe
+    HtmlBeautifier.beautify(html.to_s).html_safe
   end
 
   # Limpia estilos en base a una lista de permitidos

app/policies/site_usuarie_policy.rb

@@ -36,8 +36,7 @@ class SiteUsuariePolicy
   end
 
   def accept_invitation?
-    su = site_usuarie
-    (usuarie? || invitade?) && su.usuarie.rol_for_site(su.site).temporal
+    !!site_usuarie.usuarie.rol_for_site(site_usuarie.site)&.temporal
   end
 
   def reject_invitation?

app/views/posts/attributes/_file.haml

@@ -1,12 +1,14 @@
-.form-group
+.form-group{ data: { controller: 'file-preview' } }
   - if metadata.static_file
     - case metadata.static_file.blob.content_type
       - when %r{\Avideo/}
         = video_tag url_for(metadata.static_file),
-          controls: true, class: 'img-fluid'
+          controls: true, class: 'img-fluid',
+          data: { target: 'file-preview.preview' }
       - when %r{\Aaudio/}
         = audio_tag url_for(metadata.static_file),
-          controls: true, class: 'img-fluid'
+          controls: true, class: 'img-fluid',
+          data: { target: 'file-preview.preview' }
       - when 'application/pdf'
         %iframe{ src: url_for(metadata.static_file) }
       - else
@@ -24,7 +26,7 @@
     = file_field(*field_name_for(base, attribute, :path),
       **field_options(attribute, metadata, required: (metadata.required && !metadata.path?)),
       class: "custom-file-input #{invalid(post, attribute)}",
-      data: { preview: "#{attribute}-preview" })
+      data: { target: 'file-preview.input', action: 'file-preview#update' })
     = label_tag "#{base}_#{attribute}_path",
       post_label_t(attribute, :path, post: post), class: 'custom-file-label'
     = render 'posts/attribute_feedback',

app/views/posts/attributes/_image.haml

@@ -1,9 +1,9 @@
-.form-group
+.form-group{ data: { controller: 'file-preview' } }
   - if metadata.static_file
     = image_tag url_for(metadata.static_file),
       alt: metadata.value['description'],
       class: 'img-fluid',
-      id: "#{attribute}-preview"
+      data: { target: 'file-preview.preview' }
 
     -# Mantener el valor si no enviamos ninguna imagen
     = hidden_field_tag "#{base}[#{attribute}][path]", metadata.value['path']
@@ -16,13 +16,14 @@
     = image_tag '',
       alt: metadata.value['description'],
       class: 'img-fluid',
-      id: "#{attribute}-preview"
+      data: { target: 'file-preview.preview' }
 
   .custom-file
     = file_field(*field_name_for(base, attribute, :path),
       **field_options(attribute, metadata, required: (metadata.required && !metadata.path?)),
       class: "custom-file-input #{invalid(post, attribute)}",
-      accept: ActiveStorage.web_image_content_types.join(','), data: { preview: "#{attribute}-preview" })
+      accept: ActiveStorage.web_image_content_types.join(','),
+      data: { target: 'file-preview.input', action: 'file-preview#update' })
     = label_tag "#{base}_#{attribute}_path",
       post_label_t(attribute, :path, post: post), class: 'custom-file-label'
     = render 'posts/attribute_feedback',

app/views/sites/index.haml

@@ -24,30 +24,31 @@
                   = site.title
               %p.lead= site.description
               %br
-              = link_to t('.visit'), site.url, class: 'btn btn-secondary'
-              - if current_usuarie.rol_for_site(site).temporal?
-                = render 'components/btn_base',
-                  text: t('sites.invitations.accept'),
-                  path: site_usuaries_accept_invitation_path(site),
-                  title: t('help.sites.invitations.accept'),
-                  class: 'btn-secondary'
-                = render 'components/btn_base',
-                  text: t('sites.invitations.reject'),
-                  path: site_usuaries_reject_invitation_path(site),
-                  title: t('help.sites.invitations.reject'),
-                  class: 'btn-secondary'
-              - else
-                - if policy(site).show?
-                  = render 'layouts/btn_with_tooltip',
-                    tooltip: t('help.sites.edit_posts'),
-                    type: 'success',
-                    link: site_path(site),
-                    text: t('sites.posts')
-                = render 'sites/build', site: site
-                = render 'sites/moderation_queue', site: site
-                - if policy(SiteUsuarie.new(site, current_usuarie)).index?
-                  = render 'layouts/btn_with_tooltip',
-                    tooltip: t('usuaries.index.help.self'),
-                    text: t('usuaries.index.title'),
-                    type: 'info',
-                    link: site_usuaries_path(site)
+              .d-flex.flex-row
+                = link_to t('.visit'), site.url, class: 'btn btn-secondary'
+                - if current_usuarie.rol_for_site(site).temporal?
+                  = render 'components/btn_base',
+                    text: t('sites.invitations.accept'),
+                    path: site_usuaries_accept_invitation_path(site),
+                    title: t('help.sites.invitations.accept'),
+                    class: 'btn-secondary'
+                  = render 'components/btn_base',
+                    text: t('sites.invitations.reject'),
+                    path: site_usuaries_reject_invitation_path(site),
+                    title: t('help.sites.invitations.reject'),
+                    class: 'btn-secondary'
+                - else
+                  - if policy(site).show?
+                    = render 'layouts/btn_with_tooltip',
+                      tooltip: t('help.sites.edit_posts'),
+                      type: 'success',
+                      link: site_path(site),
+                      text: t('sites.posts')
+                  = render 'sites/build', site: site
+                  = render 'sites/moderation_queue', site: site
+                  - if policy(SiteUsuarie.new(site, current_usuarie)).index?
+                    = render 'layouts/btn_with_tooltip',
+                      tooltip: t('usuaries.index.help.self'),
+                      text: t('usuaries.index.title'),
+                      type: 'info',
+                      link: site_usuaries_path(site)

config/initializers/content_security_policy.rb

@@ -7,7 +7,7 @@
 # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
 
 Rails.application.config.content_security_policy do |policy|
-  policy.default_src :self
+  policy.default_src :self, :blob
   # XXX: Varios scripts generan estilos en línea
   policy.style_src   :self, :unsafe_inline, :https
   # Repetimos la default para poder saber cuál es la política en falta

package.json

@@ -15,6 +15,7 @@
     "@rails/webpacker": "5.4.4",
     "@suttyweb/editor": "^0.1.25",
     "babel-loader": "^8.2.2",
+    "bs-custom-file-input": "^1.3.4",
     "chart.js": "^3.5.1",
     "chartkick": "^4.0.5",
     "circular-dependency-plugin": "^5.2.2",

yarn.lock

@@ -2677,6 +2677,11 @@ browserslist@^4.22.2:
     node-releases "^2.0.14"
     update-browserslist-db "^1.0.13"
 
+bs-custom-file-input@^1.3.4:
+  version "1.3.4"
+  resolved "https://registry.yarnpkg.com/bs-custom-file-input/-/bs-custom-file-input-1.3.4.tgz#c275cb8d4f1c02ba026324292509fa9a747dbda8"
+  integrity sha512-NBsQzTnef3OW1MvdKBbMHAYHssCd613MSeJV7z2McXznWtVMnJCy7Ckyc+PwxV6Pk16cu6YBcYWh/ZE0XWNKCA==
+
 buffer-from@^1.0.0:
   version "1.1.1"
   resolved "https://registry.npmjs.org/buffer-from/-/buffer-from-1.1.1.tgz"