Merge branch 'rails' of 0xacab.org:sutty/sutty into issue-14953

.gitlab-ci.yml

@@ -22,6 +22,9 @@ assets:
   stage: "deploy"
   only:
   - "rails"
+  - "17.3.alpine.panel.sutty.nl"
+  except:
+  - "schedules"
   cache:
   - *cache-ruby
   - *cache-node
@@ -50,7 +53,6 @@ gem-audit:
   cache:
   - *cache-ruby
   before_script:
-  - "gem install bundler-audit"
   - *apk-add
   - *disable-hainish
   script:

Gemfile

@@ -117,6 +117,7 @@ end
 group :development do
   gem 'yard'
   gem 'brakeman'
+  gem 'bundler-audit'
   gem 'haml-lint', require: false
   gem 'letter_opener'
   gem 'listen'

Gemfile.lock

@@ -106,6 +106,9 @@ GEM
       sassc-rails (>= 2.0.0)
     brakeman (5.4.1)
     builder (3.2.4)
+    bundler-audit (0.9.1)
+      bundler (>= 1.2.0, < 3)
+      thor (~> 1.0)
     capybara (2.18.0)
       addressable
       mini_mime (>= 0.1.3)
@@ -536,7 +539,7 @@ GEM
     temple (0.10.1)
     terminal-table (2.0.0)
       unicode-display_width (~> 1.1, >= 1.1.1)
-    thor (1.2.2)
+    thor (1.3.0)
     tilt (2.1.0)
     timecop (0.9.6)
     timeout (0.3.2)
@@ -586,6 +589,7 @@ DEPENDENCIES
   blazer
   bootstrap (~> 4)
   brakeman
+  bundler-audit
   capybara (~> 2.13)
   chartkick
   commonmarker

app/assets/stylesheets/application.scss

@@ -29,11 +29,6 @@ $sizes: (
   "70ch": 70ch,
 );
 
-.btn {
-  background-color: var(--foreground);
-  color: var(--background);
-}
-
 @import "bootstrap";
 @import "editor";
 
@@ -195,7 +190,7 @@ fieldset {
 
       &[type=button] {
         @extend .btn;
-        @extend .btn-info;
+        @extend .btn-secondary;
         @extend .m-0;
       }
     }
@@ -209,8 +204,6 @@ svg {
 }
 
 .btn {
-  border: none;
-  border-radius: 0;
   margin-right: 0.3rem;
   margin-bottom: 0.3rem;
 
@@ -246,7 +239,7 @@ svg {
     color: $magenta;
   }
 
-  .btn {
+  .btn-secondary {
     background-color: $white;
     color: $black;
     border: none;

app/assets/stylesheets/dark.scss

@@ -7,3 +7,22 @@ $cyan: #13fefe;
   --background: #{$black};
   --color: #{$cyan};
 }
+
+.btn-secondary {
+  background-color: $white;
+  color: $black;
+  border: none;
+
+  &:hover {
+    color: $black;
+    background-color: $cyan;
+  }
+
+  &:active {
+    background-color: $cyan;
+  }
+
+  &:focus {
+    box-shadow: 0 0 0 0.2rem $cyan;
+  }
+}

app/controllers/api/v1/notices_controller.rb

@@ -9,10 +9,10 @@ module Api
       # Generar un stacktrace en segundo plano y enviarlo por correo
       # solo si la API key es verificable.  Del otro lado siempre
       # respondemos con lo mismo.
-      def create 
+      def create
         if (site&.airbrake_valid? airbrake_token) && !detected_device.bot?
           BacktraceJob.perform_later site_id: params[:site_id],
-            params: airbrake_params.to_h 
+                                     params: airbrake_params.to_h
         end
 
         render status: 201, json: { id: 1, url: '' }
@@ -23,7 +23,39 @@ module Api
       # XXX: Por alguna razón Airbrake envía los datos con Content-Type:
       # text/plain.
       def airbrake_params
-        @airbrake_params ||= params.merge!(FastJsonparser.parse(request.raw_post) || {}).permit!
+        @airbrake_params ||=
+          params.merge!(FastJsonparser.parse(request.raw_post) || {})
+                .permit(
+                  {
+                    errors: [
+                      :type,
+                      :message,
+                      { backtrace: %i[file line column function] }
+                    ]
+                  },
+                  {
+                    context: [
+                      :url,
+                      :language,
+                      :severity,
+                      :userAgent,
+                      :windowError,
+                      :rootDirectory,
+                      {
+                        history: [
+                          :date,
+                          :type,
+                          :severity,
+                          :target,
+                          :method,
+                          :duration,
+                          :statusCode,
+                          { arguments: [] }
+                        ]
+                      }
+                    ]
+                  }
+                )
       end
 
       def site

app/controllers/sites_controller.rb

@@ -110,27 +110,6 @@ class SitesController < ApplicationController
     redirect_to sites_path
   end
 
-  # Obtiene y streamea archivos estáticos desde el repositorio mismo,
-  # pero sólo los públicos (es decir los archivos subidos desde Sutty).
-  def static_file
-    authorize site
-
-    file = params.require(:file) + '.' + params.require(:format)
-
-    raise ActionController::RoutingError.new(nil, nil) unless file.start_with? 'public/'
-
-    path = site.relative_path file
-
-    raise ActionController::RoutingError.new(nil, nil) unless File.exist? path
-
-    # TODO: Hacer esto usa recursos, pero menos que generar el sitio
-    # cada vez.  Para poder usar X-Accel tendríamos que montar los
-    # repositorios en el servidor web, cosa que no queremos, o hacer
-    # links simbólicos desde todos los public, o usar un servidor web
-    # local que soporte sendfile mejor que Rails (nghttpd?)
-    send_file path
-  end
-
   private
 
   def site

app/models/deploy_local.rb

@@ -7,6 +7,15 @@ class DeployLocal < Deploy
 
   before_destroy :remove_destination!
 
+  def bundle(output: false)
+    run %(bundle config set --local clean 'true'), output: output
+    run(%(bundle config set --local deployment 'true'), output: output) if site.gemfile_lock_path?
+    run %(bundle config set --local path '#{gems_dir}'), output: output
+    run %(bundle config set --local without 'test development'), output: output
+    run %(bundle config set --local cache_all 'false'), output: output
+    run %(bundle install), output: output
+  end
+
   def git_lfs(output: false)
     run %(git lfs fetch), output: output
     run %(git lfs checkout), output: output
@@ -129,15 +138,6 @@ class DeployLocal < Deploy
     run 'yarn install --production', output: output
   end
 
-  def bundle(output: false)
-    run %(bundle config set --local clean 'true'), output: output
-    run(%(bundle config set --local deployment 'true'), output: output) if site.gemfile_lock_path?
-    run %(bundle config set --local path '#{gems_dir}'), output: output
-    run %(bundle config set --local without 'test development'), output: output
-    run %(bundle config set --local cache_all 'false'), output: output
-    run %(bundle install), output: output
-  end
-
   def jekyll_build(output: false)
     with_tempfile(site.private_key_pem) do |file|
       flags = extra_flags(private_key: file)

app/models/metadata_path.rb

@@ -6,7 +6,7 @@ class MetadataPath < MetadataTemplate
   #
   # @return [String]
   def default_value
-    File.join(site.path, "_#{lang}", "#{date}-#{slug}#{ext}")
+    File.join(site.path, "_#{lang}", "#{limited_name}#{ext}")
   end
 
   # La ruta del archivo según Jekyll
@@ -46,4 +46,12 @@ class MetadataPath < MetadataTemplate
   def date
     post.date.value.strftime('%F')
   end
+
+  # Limita el nombre de archivo a 255 bytes, de forma que siempre
+  # podemos guardarlo
+  #
+  # @return [String]
+  def limited_name
+    "#{date}-#{slug}".mb_chars.limit(255 - ext.length)
+  end
 end

app/models/post.rb

@@ -103,8 +103,10 @@ class Post
         src = element.attributes['src']
 
         next unless src&.value&.start_with? 'public/'
+        file = MetadataFile.new(site: site, post: self, document: document, layout: layout)
+        file.value['path'] = src.value
 
-        src.value = Rails.application.routes.url_helpers.site_static_file_url(site, file: src.value)
+        src.value = Rails.application.routes.url_helpers.url_for(file.static_file)
       end
 
       # Notificar a les usuaries que están viendo una previsualización

app/models/site.rb

@@ -159,19 +159,19 @@ class Site < ApplicationRecord
 
   # Traer la ruta del sitio
   def path
-    File.join(Site.site_path, name)
+    ::File.join(Site.site_path, name)
   end
 
   # La ruta anterior
   def path_was
-    File.join(Site.site_path, name_was)
+    ::File.join(Site.site_path, name_was)
   end
 
   # Limpiar la ruta y unirla con el separador de directorios del
   # sistema operativo.  Como si algún día fuera a cambiar o
   # soportáramos Windows :P
   def relative_path(suspicious_path)
-    File.join(path, *suspicious_path.gsub('..', '/').gsub('./', '').squeeze('/').split('/'))
+    ::File.join(path, *suspicious_path.gsub('..', '/').gsub('./', '').squeeze('/').split('/'))
   end
 
   # Obtiene la lista de traducciones actuales
@@ -358,7 +358,7 @@ class Site < ApplicationRecord
   end
 
   def jekyll?
-    File.directory? path
+    ::File.directory? path
   end
 
   def jekyll
@@ -376,7 +376,7 @@ class Site < ApplicationRecord
   # documentos de Jekyll hacia Sutty para que podamos leer los datos que
   # necesitamos.
   def load_jekyll
-    return unless name.present? && File.directory?(path)
+    return unless name.present? && ::File.directory?(path)
 
     reload_jekyll!
   end
@@ -404,7 +404,7 @@ class Site < ApplicationRecord
     # metadatos de Document
     @configuration =
       ::Jekyll.configuration('source' => path,
-                             'destination' => File.join(path, '_site'),
+                             'destination' => ::File.join(path, '_site'),
                              'safe' => true, 'watch' => false,
                              'quiet' => true, 'excerpt_separator' => '')
 
@@ -429,7 +429,7 @@ class Site < ApplicationRecord
 
   # El directorio donde se almacenan los sitios
   def self.site_path
-    @site_path ||= File.realpath(ENV.fetch('SITE_PATH', Rails.root.join('_sites')))
+    @site_path ||= ::File.realpath(ENV.fetch('SITE_PATH', Rails.root.join('_sites')))
   end
 
   def self.default
@@ -460,7 +460,7 @@ class Site < ApplicationRecord
   end
 
   def gemfile_lock_path?
-    File.exist? gemfile_lock_path
+    ::File.exist? gemfile_lock_path
   end
 
   private
@@ -578,7 +578,7 @@ class Site < ApplicationRecord
     if !gems_installed? || gemfile_updated? || gemfile_lock_updated?
       deploy_local.bundle
       touch
-      File.touch(gemfile_path)
+      FileUtils.touch(gemfile_path)
     end
   end
 
@@ -599,16 +599,16 @@ class Site < ApplicationRecord
 
   # Detecta si el Gemfile fue modificado
   def gemfile_updated?
-    updated_at < File.mtime(gemfile_path)
+    updated_at < ::File.mtime(gemfile_path)
   end
 
   def gemfile_path
-    @gemfile_path ||= File.join(path, 'Gemfile')
+    @gemfile_path ||= ::File.join(path, 'Gemfile')
   end
 
   # @return [String]
   def gemfile_lock_path
-    @gemfile_lock_path ||= File.join(path, 'Gemfile.lock')
+    @gemfile_lock_path ||= ::File.join(path, 'Gemfile.lock')
   end
 
   # Detecta si el Gemfile.lock fue modificado con respecto al sitio o al
@@ -616,8 +616,8 @@ class Site < ApplicationRecord
   def gemfile_lock_updated?
     return false unless gemfile_lock_path?
 
-    [updated_at, File.mtime(File.join(path, 'Gemfile'))].any? do |compare|
+    [updated_at, ::File.mtime(::File.join(path, 'Gemfile'))].any? do |compare|
-      compare < File.mtime(gemfile_lock_path)
+      compare < ::File.mtime(gemfile_lock_path)
     end
   end
 end

app/models/site/repository.rb

@@ -235,5 +235,10 @@ class Site
 
       r&.success?
     end
+
+    def lfs_cleanup
+      git_sh("git", "lfs", "prune")
+      git_sh("git", "lfs", "dedup")
+    end
   end
 end

app/models/site/social_distributed_press.rb

@@ -16,7 +16,7 @@ class Site
       #
       # @return [nil]
       def generate_private_key_pem!
-        self.private_key_pem ||= DistributedPress::V1::Social::Client.new(public_key_url: nil, key_size: 2048).private_key.export
+        self.private_key_pem ||= ::DistributedPress::V1::Social::Client.new(public_key_url: nil, key_size: 2048).private_key.export
       end
     end
   end

app/services/cleanup_service.rb

@@ -31,7 +31,7 @@ class CleanupService
       site.deploys.find_each(&:cleanup!)
 
       site.repository.gc
-      lfs_cleanup
+      site.repository.lfs_cleanup
       site.touch
     end
   end
@@ -46,14 +46,8 @@ class CleanupService
       Rails.logger.info "Limpiando repositorio git de #{site.name}"
 
       site.repository.gc
-      lfs_cleanup
+      site.repository.lfs_cleanup
       site.touch
     end
   end
-
-  private 
-  def lfs_cleanup
-    site.repository.git_sh("git", "lfs", "prune")
-    site.repository.git_sh("git", "lfs", "dedup")
-  end
 end

app/views/collaborations/collaborate.haml

@@ -25,4 +25,4 @@
             class: 'form-control'
 
       .form-group
-        = f.submit t('.submit'), class: 'btn btn-lg btn-block'
+        = f.submit t('.submit'), class: 'btn btn-secondary btn-lg btn-block'

app/views/devise/confirmations/new.haml

@@ -30,5 +30,5 @@
           placeholder: t('activerecord.attributes.usuarie.email')
       .actions
         = f.submit t('.resend_confirmation_instructions'),
-          class: 'btn btn-lg btn-block'
+          class: 'btn btn-secondary btn-lg btn-block'
     = render 'devise/shared/links'

app/views/devise/invitations/edit.haml

@@ -32,4 +32,4 @@
             placeholder: t('activerecord.attributes.usuarie.password')
       .actions
         = f.submit t('devise.invitations.edit.submit_button'),
-          class: 'btn btn-lg btn-block'
+          class: 'btn btn-secondary btn-lg btn-block'

app/views/devise/invitations/new.haml

@@ -16,4 +16,4 @@
           = f.text_field field, class: 'form-control'
       .actions
         = f.submit t('devise.invitations.new.submit_button'),
-          class: 'btn btn-lg btn-block'
+          class: 'btn btn-secondary btn-lg btn-block'

app/views/devise/passwords/edit.haml

@@ -39,6 +39,6 @@
 
       .actions
         = f.submit t('.change_my_password'),
-          class: 'btn btn-lg btn-block'
+          class: 'btn btn-secondary btn-lg btn-block'
 
     = render 'devise/shared/links'

app/views/devise/passwords/new.haml

@@ -20,5 +20,5 @@
           placeholder: t('activerecord.attributes.usuarie.email')
       .actions
         = f.submit t('.send_me_reset_password_instructions'),
-          class: 'btn btn-lg btn-block'
+          class: 'btn btn-secondary btn-lg btn-block'
     = render 'devise/shared/links'

app/views/devise/registrations/edit.haml

@@ -55,7 +55,7 @@
           = t('.we_need_your_current_password_to_confirm_your_changes')
       .actions
         = f.submit t('.update'),
-          class: 'btn btn-lg btn-block'
+          class: 'btn btn-secondary btn-lg btn-block'
     %hr/
 
     .sr-only
@@ -63,4 +63,4 @@
     = button_to t('.cancel_my_account'),
       registration_path(resource_name),
       data: { confirm: t('.are_you_sure') },
-      method: :delete, class: 'btn btn-block'
+      method: :delete, class: 'btn btn-secondary btn-block'

app/views/devise/registrations/new.haml

@@ -56,6 +56,6 @@
 
       .actions
         = f.submit t('.sign_up'),
-          class: 'btn btn-lg btn-block'
+          class: 'btn btn-secondary btn-lg btn-block'
 
     = render 'devise/shared/links'

app/views/devise/sessions/new.haml

@@ -35,5 +35,5 @@
               remember_for: distance_of_time_in_words(Usuarie.remember_for))
       .actions
         = f.submit t('.sign_in'),
-          class: 'btn btn-lg btn-block'
+          class: 'btn btn-secondary btn-lg btn-block'
     = render 'devise/shared/links'

app/views/devise/shared/_links.haml

@@ -4,12 +4,12 @@
 
 - if controller_name != 'sessions'
   = link_to t('.sign_in'), new_session_path(resource_name, params: locale),
-    class: 'btn btn-lg btn-block btn-success'
+    class: 'btn btn-lg btn-block btn-secondary'
   %br/
 
 - if devise_mapping.registerable? && controller_name != 'registrations'
   = link_to t('.sign_up'), new_registration_path(resource_name, params: locale),
-    class: 'btn btn-lg btn-block btn-success'
+    class: 'btn btn-lg btn-block btn-secondary'
   %br/
 
 - if devise_mapping.recoverable?

app/views/devise/unlocks/new.haml

@@ -20,5 +20,5 @@
           placeholder: t('activerecord.attributes.usuarie.email')
       .actions
         = f.submit t('.resend_unlock_instructions'),
-          class: 'btn btn-lg btn-block'
+          class: 'btn btn-secondary btn-lg btn-block'
     = render 'devise/shared/links'

app/views/i18n/_form.haml

@@ -11,7 +11,7 @@
           = select_tag 'to', 
             options_for_select(@options, @lang_to),
             class: 'form-control'
-          = submit_tag t('i18n.translate'), class: 'btn', name: nil
+          = submit_tag t('i18n.translate'), class: 'btn btn-secondary', name: nil
         - else
           = t('i18n.translating.from')
           = select_tag 'from', 
@@ -21,7 +21,7 @@
           = select_tag 'to', 
             options_for_select(@options, @lang_to),
             class: 'form-control'
-          = submit_tag t('i18n.change'), class: 'btn', name: nil
+          = submit_tag t('i18n.change'), class: 'btn btn-secondary', name: nil
 
     = render 'layouts/help', help: t('help.i18n.index')
 
@@ -33,16 +33,16 @@
       = hidden_field 'i18n', 'lang_to', value: @lang_to
       .form-group
         .dropdown.inline
-          %button.btn.dropdown-toggle{type: 'button',
+          %button.btn.btn-secondary.dropdown-toggle{type: 'button',
             data: { toggle: 'dropdown' },
             aria: { haspopup: 'true', expanded: 'false' }}
             = t('i18n.jump')
           .dropdown-menu{aria: { labelledby: t('i18n.jump') }}
             - @site.data.dig(@lang_from).each_pair do |section, content|
               %a.dropdown-item{href: "##{section}"}= t("help.i18n.#{section}")
-        = submit_tag t('i18n.save'), class: 'btn'
+        = submit_tag t('i18n.save'), class: 'btn btn-secondary'
 
       = render 'i18n/recursive', data: @site.data.dig(@lang_from), superkeys: []
 
       .form-group
-        = submit_tag t('i18n.save'), class: 'btn'
+        = submit_tag t('i18n.save'), class: 'btn btn-secondary'

app/views/layouts/_breadcrumb.haml

@@ -17,15 +17,15 @@
       - if @site&.tienda?
         %li.nav-item
           = link_to t('.tienda'), @site.tienda_url,
-            role: 'button', class: 'btn'
+            role: 'button', class: 'btn btn-secondary'
 
       %li.nav-item
         = link_to t('.contact_us'), t('.contact_us_href'),
-          class: 'btn', rel: 'me', target: '_blank'
+          class: 'btn btn-secondary', rel: 'me', target: '_blank'
 
       %li.nav-item
         = link_to t('.logout'), main_app.destroy_usuarie_session_path,
-          method: :delete, role: 'button', class: 'btn'
+          method: :delete, role: 'button', class: 'btn btn-secondary'
   - else
     - params.permit!
     - I18n.available_locales.each do |locale|

app/views/layouts/_btn_with_tooltip.haml

@@ -1,2 +1,2 @@
-= link_to text, link, class: 'btn',
+= link_to text, link, class: 'btn btn-secondary',
   data: { toggle: 'tooltip' }, 'aria-role': 'button', title: tooltip

app/views/posts/_submit.haml

@@ -1,7 +1,7 @@
 - invalid_help = site.config.fetch('invalid_help', t('.invalid_help'))
 - sending_help = site.config.fetch('sending_help', t('.sending_help'))
 .form-group
-  = submit_tag t('.save'), class: 'btn submit-post'
+  = submit_tag t('.save'), class: 'btn btn-secondary submit-post'
   = render 'bootstrap/alert', class: 'invalid-help d-none' do
     = invalid_help
   = render 'bootstrap/alert', class: 'sending-help d-none' do

app/views/posts/attributes/_content.haml

@@ -20,82 +20,82 @@
       TODO: Eliminar todo el espacio en blanco para minificar HTML
     .editor-toolbar{ style: 'z-index: 1' }
       .editor-primary-toolbar.scrollbar-black
-        %button.btn{ type: 'button', title: t('editor.multimedia'), data: { editor_button: 'multimedia' } }>
+        %button.btn.btn-secondary{ type: 'button', title: t('editor.multimedia'), data: { editor_button: 'multimedia' } }>
           %i.fa.fa-fw.fa-upload>
           %span.sr-only>= t('editor.multimedia')
-        %button.btn{ type: 'button', title: t('editor.bold'), data: { editor_button: 'mark-bold' } }>
+        %button.btn.btn-secondary{ type: 'button', title: t('editor.bold'), data: { editor_button: 'mark-bold' } }>
           %i.fa.fa-fw.fa-bold>
           %span.sr-only>= t('editor.bold')
-        %button.btn{ type: 'button', title: t('editor.italic'), data: { editor_button: 'mark-italic' } }>
+        %button.btn.btn-secondary{ type: 'button', title: t('editor.italic'), data: { editor_button: 'mark-italic' } }>
           %i.fa.fa-fw.fa-italic>
           %span.sr-only>= t('editor.italic')
-        %button.btn{ type: 'button', title: t('editor.mark'), data: { editor_button: 'mark-mark' } }>
+        %button.btn.btn-secondary{ type: 'button', title: t('editor.mark'), data: { editor_button: 'mark-mark' } }>
           %i.fa.fa-fw.fa-tint>
           %span.sr-only>= t('editor.mark')
-        %button.btn{ type: 'button', title: t('editor.link'), data: { editor_button: 'mark-link' } }>
+        %button.btn.btn-secondary{ type: 'button', title: t('editor.link'), data: { editor_button: 'mark-link' } }>
           %i.fa.fa-fw.fa-link>
           %span.sr-only>= t('editor.link')
-        %button.btn{ type: 'button', title: t('editor.deleted'), data: { editor_button: 'mark-deleted' } }>
+        %button.btn.btn-secondary{ type: 'button', title: t('editor.deleted'), data: { editor_button: 'mark-deleted' } }>
           %i.fa.fa-fw.fa-strikethrough>
           %span.sr-only>= t('editor.deleted')
-        %button.btn{ type: 'button', title: t('editor.underline'), data: { editor_button: 'mark-underline' } }>
+        %button.btn.btn-secondary{ type: 'button', title: t('editor.underline'), data: { editor_button: 'mark-underline' } }>
           %i.fa.fa-fw.fa-underline>
           %span.sr-only>= t('editor.underline')
-        %button.btn{ type: 'button', title: t('editor.super'), data: { editor_button: 'mark-super' } }>
+        %button.btn.btn-secondary{ type: 'button', title: t('editor.super'), data: { editor_button: 'mark-super' } }>
           %i.fa.fa-fw.fa-superscript>
           %span.sr-only>= t('editor.super')
-        %button.btn{ type: 'button', title: t('editor.sub'), data: { editor_button: 'mark-sub' } }>
+        %button.btn.btn-secondary{ type: 'button', title: t('editor.sub'), data: { editor_button: 'mark-sub' } }>
           %i.fa.fa-fw.fa-subscript>
           %span.sr-only>= t('editor.sub')
-        %button.btn{ type: 'button', title: t('editor.small'), data: { editor_button: 'mark-small' } }>
+        %button.btn.btn-secondary{ type: 'button', title: t('editor.small'), data: { editor_button: 'mark-small' } }>
           %i.fa.fa-fw.fa-subscript>
           %span.sr-only>= t('editor.small')
-        %button.btn.mr-0{ type: 'button', title: t('editor.h1'), data: { editor_button: 'block-h1' } }>
+        %button.btn.btn-secondary.mr-0{ type: 'button', title: t('editor.h1'), data: { editor_button: 'block-h1' } }>
           %i.fa.fa-fw.fa-heading>
           1
           %span.sr-only>= t('editor.h1')
         %details.d-inline>
           %summary.d-inline>
-            %span.btn.ml-0{ role: 'button', title: t('editor.more') }>
+            %span.btn.btn-secondary.ml-0{ role: 'button', title: t('editor.more') }>
               %i.fa.fa-caret-right>
               %span.sr-only= t('editor.more')
           .d-inline>
-            %button.btn{ type: 'button', title: t('editor.h2'), data: { editor_button: 'block-h2' } }>
+            %button.btn.btn-secondary{ type: 'button', title: t('editor.h2'), data: { editor_button: 'block-h2' } }>
               %i.fa.fa-fw.fa-heading>
               2
               %span.sr-only>= t('editor.h2')
-            %button.btn{ type: 'button', title: t('editor.h3'), data: { editor_button: 'block-h3' } }>
+            %button.btn.btn-secondary{ type: 'button', title: t('editor.h3'), data: { editor_button: 'block-h3' } }>
               %i.fa.fa-fw.fa-heading>
               3
               %span.sr-only>= t('editor.h3')
-            %button.btn{ type: 'button', title: t('editor.h4'), data: { editor_button: 'block-h4' } }>
+            %button.btn.btn-secondary{ type: 'button', title: t('editor.h4'), data: { editor_button: 'block-h4' } }>
               %i.fa.fa-fw.fa-heading>
               4
               %span.sr-only>= t('editor.h4')
-            %button.btn{ type: 'button', title: t('editor.h5'), data: { editor_button: 'block-h5' } }>
+            %button.btn.btn-secondary{ type: 'button', title: t('editor.h5'), data: { editor_button: 'block-h5' } }>
               %i.fa.fa-fw.fa-heading>
               5
               %span.sr-only>= t('editor.h5')
-            %button.btn{ type: 'button', title: t('editor.h6'), data: { editor_button: 'block-h6' } }>
+            %button.btn.btn-secondary{ type: 'button', title: t('editor.h6'), data: { editor_button: 'block-h6' } }>
               %i.fa.fa-fw.fa-heading>
               6
               %span.sr-only>= t('editor.h6')
-        %button.btn{ type: 'button', title: t('editor.ul'), data: { editor_button: 'block-unordered_list' } }>
+        %button.btn.btn-secondary{ type: 'button', title: t('editor.ul'), data: { editor_button: 'block-unordered_list' } }>
           %i.fa.fa-fw.fa-list-ul>
           %span.sr-only>= t('editor.ul')
-        %button.btn{ type: 'button', title: t('editor.ol'), data: { editor_button: 'block-ordered_list' } }>
+        %button.btn.btn-secondary{ type: 'button', title: t('editor.ol'), data: { editor_button: 'block-ordered_list' } }>
           %i.fa.fa-fw.fa-list-ol>
           %span.sr-only>= t('editor.ol')
-        %button.btn{ type: 'button', title: t('editor.left'), data: { editor_button: 'parentBlock-left' } }>
+        %button.btn.btn-secondary{ type: 'button', title: t('editor.left'), data: { editor_button: 'parentBlock-left' } }>
           %i.fa.fa-fw.fa-align-left>
           %span.sr-only>= t('editor.left')
-        %button.btn{ type: 'button', title: t('editor.center'), data: { editor_button: 'parentBlock-center' } }>
+        %button.btn.btn-secondary{ type: 'button', title: t('editor.center'), data: { editor_button: 'parentBlock-center' } }>
           %i.fa.fa-fw.fa-align-center>
           %span.sr-only>= t('editor.center')
-        %button.btn{ type: 'button', title: t('editor.right'), data: { editor_button: 'parentBlock-right' } }>
+        %button.btn.btn-secondary{ type: 'button', title: t('editor.right'), data: { editor_button: 'parentBlock-right' } }>
           %i.fa.fa-fw.fa-align-right>
           %span.sr-only>= t('editor.right')
-        %button.btn{ type: 'button', title: t('editor.blockquote'), data: { editor_button: 'block-blockquote' } }>
+        %button.btn.btn-secondary{ type: 'button', title: t('editor.blockquote'), data: { editor_button: 'block-blockquote' } }>
           %i.fa.fa-fw.fa-quote-left>
           %span.sr-only>= t('editor.blockquote')
 
@@ -116,8 +116,8 @@
             %label{ for: 'multimedia-alt' }= t('editor.description')
             %input.form-control{ type: 'text', id: 'multimedia-alt', name: 'multimedia-alt' }/
           .form-group
-            %button.btn{ type: 'button', id: 'multimedia-file-upload', name: 'multimedia-file-upload' }= t('editor.multimedia-upload')
+            %button.btn.btn-secondary{ type: 'button', id: 'multimedia-file-upload', name: 'multimedia-file-upload' }= t('editor.multimedia-upload')
-            %button.btn{ type: 'button', id: 'multimedia-remove', name: 'multimedia-remove' }= t('editor.multimedia-remove')
+            %button.btn.btn-secondary{ type: 'button', id: 'multimedia-remove', name: 'multimedia-remove' }= t('editor.multimedia-remove')
 
         .form-group{ data: { editor_auxiliary: 'link' } }
           %label{ for: 'link-url' }= t('editor.url')

app/views/posts/edit.haml

@@ -1,3 +1,6 @@
 .row.justify-content-center
   .col-md-8
-    = render 'posts/form', site: @site, post: @post
+    = render 'layouts/details', summary: "Post" do
+      = render 'posts/form', site: @site, post: @post
+    = render 'layouts/details', summary: t('.moderation_queue') do
+      = render 'posts/moderation_queue', site: @site, post: @post, moderation_queue: @moderation_queue

app/views/posts/index.haml

@@ -15,13 +15,13 @@
           = render 'schemas/row', site: @site, schema: schema, filter: @filter_params
 
     - if policy(@site_stat).index?
-      = link_to t('stats.index.title'), site_stats_path(@site), class: 'btn'
+      = link_to t('stats.index.title'), site_stats_path(@site), class: 'btn btn-secondary'
 
     - if policy(@site).edit?
-      = link_to t('sites.edit.btn', site: @site.title), edit_site_path(@site), class: 'btn'
+      = link_to t('sites.edit.btn', site: @site.title), edit_site_path(@site), class: 'btn btn-secondary'
 
     - if policy(@site).private?
-      = link_to t('sites.private'), '../private/' + @site.name, class: 'btn', target: '_blank', rel: 'noopener'
+      = link_to t('sites.private'), '../private/' + @site.name, class: 'btn btn-secondary', target: '_blank', rel: 'noopener'
 
     - if policy(SiteUsuarie.new(@site, current_usuarie)).index?
       = render 'layouts/btn_with_tooltip',
@@ -33,9 +33,9 @@
     - if @site.design.credits
       = render 'bootstrap/alert' do
         = sanitize_markdown @site.design.credits
-        = link_to t('sites.donations.text'), t('sites.donations.url'), class: 'btn'
+        = link_to t('sites.donations.text'), t('sites.donations.url'), class: 'btn btn-secondary'
         - if @site.design.designer_url
-          = link_to t('sites.designer_url'), @site.design.designer_url, class: 'btn'
+          = link_to t('sites.designer_url'), @site.design.designer_url, class: 'btn btn-secondary'
 
   %section.col
     .d-flex.justify-content-between.align-items-center.pl-2-plus.pr-2-plus.mb-2
@@ -75,19 +75,19 @@
               %th.border-0{ colspan: '4' }
                 .d-flex.flex-row.justify-content-between
                   %div
-                    = submit_tag t('posts.reorder.submit'), class: 'btn'
+                    = submit_tag t('posts.reorder.submit'), class: 'btn btn-secondary'
-                    %button.btn{ data: { action: 'reorder#unselect' } }
+                    %button.btn.btn-secondary{ data: { action: 'reorder#unselect' } }
                       = t('posts.reorder.unselect')
                       %span.badge{ data: { target: 'reorder.counter' } } 0
-                    %button.btn{ data: { action: 'reorder#up' } }= t('posts.reorder.up')
+                    %button.btn.btn-secondary{ data: { action: 'reorder#up' } }= t('posts.reorder.up')
-                    %button.btn{ data: { action: 'reorder#down' } }= t('posts.reorder.down')
+                    %button.btn.btn-secondary{ data: { action: 'reorder#down' } }= t('posts.reorder.down')
-                    %button.btn{ data: { action: 'reorder#top' } }= t('posts.reorder.top')
+                    %button.btn.btn-secondary{ data: { action: 'reorder#top' } }= t('posts.reorder.top')
-                    %button.btn{ data: { action: 'reorder#bottom' } }= t('posts.reorder.bottom')
+                    %button.btn.btn-secondary{ data: { action: 'reorder#bottom' } }= t('posts.reorder.bottom')
 
                   - if @site.pagination
                     %div
-                      = link_to_prev_page @posts, t('posts.prev'), class: 'btn'
+                      = link_to_prev_page @posts, t('posts.prev'), class: 'btn btn-secondary'
-                      = link_to_next_page @posts, t('posts.next'), class: 'btn'
+                      = link_to_next_page @posts, t('posts.next'), class: 'btn btn-secondary'
           %tbody
             - dir = @site.data.dig(params[:locale], 'dir')
             - size = @posts.size
@@ -126,9 +126,9 @@
                     = post.order
                   %td.text-nowrap
                     - if @usuarie || policy(post).edit?
-                      = link_to t('posts.edit'), edit_site_post_path(@site, post.path), class: 'btn btn-block'
+                      = link_to t('posts.edit'), edit_site_post_path(@site, post.path), class: 'btn btn-secondary btn-block'
                     - if @usuarie || policy(post).destroy?
-                      = link_to t('posts.destroy'), site_post_path(@site, post.path), class: 'btn btn-block', method: :delete, data: { confirm: t('posts.confirm_destroy') }
+                      = link_to t('posts.destroy'), site_post_path(@site, post.path), class: 'btn btn-secondary btn-block', method: :delete, data: { confirm: t('posts.confirm_destroy') }
 
 #footnotes{ hidden: true }
   - @filter_params.each do |param, value|

app/views/posts/show.haml

@@ -4,7 +4,7 @@
     %article.content.table-responsive-md
       = link_to t('posts.edit'),
         edit_site_post_path(@site, @post.id),
-        class: 'btn btn-block'
+        class: 'btn btn-secondary btn-block'
 
       %table.table.table-condensed
         %thead

app/views/sites/_build.haml

@@ -3,7 +3,7 @@
     method: :post,
     class: 'form-inline inline' do
     = submit_tag site.enqueued? ? t('sites.enqueued') : t('sites.enqueue'),
-      class: "btn no-border-radius #{local_assigns[:class]}",
+      class: "btn btn-secondary #{local_assigns[:class]}",
       title: site.enqueued? ? t('help.sites.enqueued') : t('help.sites.enqueue'),
       data: { disable_with: t('sites.enqueued') },
       disabled: site.enqueued?

app/views/sites/_form.haml

@@ -72,10 +72,10 @@
             .btn-group{ role: 'group', 'aria-label': t('.design.actions') }
               - if design.url
                 = link_to t('.design.url'), design.url,
-                  target: '_blank', class: 'btn'
+                  target: '_blank', class: 'btn btn-secondary'
               - if design.license
                 = link_to t('.design.license'), design.license,
-                  target: '_blank', class: 'btn'
+                  target: '_blank', class: 'btn btn-secondary'
       %hr/
 
   .form-group.licenses#license_id
@@ -99,7 +99,7 @@
                 tags: %w[p a strong em ul ol li h1 h2 h3 h4 h5 h6]
 
               - unless licencia.custom?
-                = link_to t('.licencia.url'), licencia.url, target: '_blank', class: 'btn', rel: 'noopener'
+                = link_to t('.licencia.url'), licencia.url, target: '_blank', class: 'btn btn-secondary', rel: 'noopener'
 
           %hr/
 
@@ -163,4 +163,4 @@
           deploy: deploy, site: site
 
   .form-group
-    = f.submit submit, class: 'btn btn-lg btn-block'
+    = f.submit submit, class: 'btn btn-secondary btn-lg btn-block'

app/views/sites/fetch.haml

@@ -27,4 +27,4 @@
   .row.justify-content-center
     .col-md-8
       = link_to t('.merge.request'), site_pull_path(@site),
-        method: 'post', class: 'btn btn-lg'
+        method: 'post', class: 'btn btn-secondary btn-lg'

app/views/sites/index.haml

@@ -4,7 +4,7 @@
     %p.lead= t('.help')
     - if policy(Site).new?
       = link_to t('sites.new.title'), new_site_path,
-        class: 'btn'
+        class: 'btn btn-secondary'
 
   %section.col
     - if @sites.empty?
@@ -29,18 +29,18 @@
                     = site.title
                 %p.lead= site.description
                 %br
-                = link_to t('.visit'), site.url, class: 'btn'
+                = link_to t('.visit'), site.url, class: 'btn btn-secondary'
                 - if rol.temporal
                   = button_to t('sites.invitations.accept'),
                     site_usuaries_accept_invitation_path(site),
                     method: :patch,
                     title: t('help.sites.invitations.accept'),
-                    class: 'btn'
+                    class: 'btn btn-secondary'
                   = button_to t('sites.invitations.reject'),
                     site_usuaries_reject_invitation_path(site),
                     method: :patch,
                     title: t('help.sites.invitations.reject'),
-                    class: 'btn'
+                    class: 'btn btn-secondary'
                 - else
                   - if policy(site).show?
                     = render 'layouts/btn_with_tooltip',

app/views/stats/index.haml

@@ -11,11 +11,11 @@
 
     %form.mb-5.form-inline{ method: 'get' }
       - Stat::INTERVALS.each do |interval|
-        = link_to t(".#{interval}"), site_stats_path(interval: interval, urls: params[:urls], period_start: params[:period_start].to_date.try(:"beginning_of_#{interval}").to_date, period_end: params[:period_end]), class: "mb-0 btn #{'btn-primary active' if @interval == interval}"
+        = link_to t(".#{interval}"), site_stats_path(interval: interval, urls: params[:urls], period_start: params[:period_start].to_date.try(:"beginning_of_#{interval}").to_date, period_end: params[:period_end]), class: "mb-0 btn #{@interval == interval ? 'btn-primary active' : 'btn-secondary' }"
 
       %input.form-control{ type: 'date', name: :period_start, value: params[:period_start] }
       %input.form-control{ type: 'date', name: :period_end, value: params[:period_end] }
-      %button.btn.mb-0{ type: 'submit' }= t('.filter')
+      %button.btn.btn-secondary.mb-0{ type: 'submit' }= t('.filter')
 
     .mb-5
       %h2= t('.host.title', count: @hostnames.size)
@@ -34,7 +34,7 @@
           %textarea#urls.form-control{ name: 'urls', autocomplete: 'on', required: true, rows: @normalized_urls.size + 1, aria_describedby: 'help-urls' }= @normalized_urls.join("\n")
           %small#help-urls.feedback.form-text.text-muted= t('.urls.help')
         .form-group
-          %button.btn{ type: 'submit' }= t('.urls.submit')
+          %button.btn.btn-secondary{ type: 'submit' }= t('.urls.submit')
       - if @normalized_urls.present?
         = line_chart site_stats_uris_path(urls: @normalized_urls, **@chart_params), **@chart_options
 

app/views/usuaries/index.haml

@@ -9,13 +9,13 @@
         - if @policy.invite?
           = link_to t('.invite'),
             site_usuaries_invite_path(@site, invite_as: u.to_s),
-            class: 'btn',
+            class: 'btn btn-secondary',
             data: { toggle: 'tooltip' },
             title: t('.help.invite', invite_as: u.to_s)
         - if policy(Collaboration.new(@site)).collaborate?
           = link_to t('.public_invite'),
             site_collaborate_path(@site),
-            class: 'btn',
+            class: 'btn btn-secondary',
             data: { toggle: 'tooltip' },
             title: t('.help.public_invite')
       %p.lead= t(".help.#{u}")
@@ -38,7 +38,7 @@
                   - if @policy.demote? && @site.usuarie?(cuenta)
                     = link_to t('.demote.text'),
                       site_usuarie_demote_path(@site, cuenta),
-                      class: 'btn',
+                      class: 'btn btn-secondary',
                       data: { toggle: 'tooltip',
                       confirm: t('.demote.confirm') },
                       title: t('.help.demote'),
@@ -46,7 +46,7 @@
                   - if @policy.promote? && @site.invitade?(cuenta)
                     = link_to t('.promote.text'),
                       site_usuarie_promote_path(@site, cuenta),
-                      class: 'btn',
+                      class: 'btn btn-secondary',
                       data: { toggle: 'tooltip',
                       confirm: t('.promote.confirm') },
                       title: t('.help.promote'),
@@ -54,7 +54,7 @@
                   - if @policy.destroy?
                     = link_to t('.destroy.text'),
                       site_usuarie_path(@site, cuenta),
-                      class: 'btn',
+                      class: 'btn btn-secondary',
                       data: { toggle: 'tooltip',
                       confirm: t('.destroy.confirm') },
                       title: t('.help.destroy'),

app/views/usuaries/invite.haml

@@ -13,4 +13,4 @@
             invite_as: invite_as)
         = f.text_area :invitaciones, class: 'form-control'
       .form-group
-        = f.submit t('.submit'), class: 'btn'
+        = f.submit t('.submit'), class: 'btn btn-secondary'

config/brakeman.ignore

@@ -0,0 +1,252 @@
+{
+  "ignored_warnings": [
+    {
+      "warning_type": "Redirect",
+      "warning_code": 18,
+      "fingerprint": "0ae5c3990d49dfbfd4fd61874451f7a576d5056aca913068adf58c314625f810",
+      "check_name": "Redirect",
+      "message": "Possible unprotected redirect",
+      "file": "app/controllers/api/v1/posts_controller.rb",
+      "line": 20,
+      "link": "https://brakemanscanner.org/docs/warning_types/redirect/",
+      "code": "redirect_to((params[:redirect_to] or origin.to_s))",
+      "render_path": null,
+      "location": {
+        "type": "method",
+        "class": "Api::V1::PostsController",
+        "method": "create"
+      },
+      "user_input": "params[:redirect_to]",
+      "confidence": "High",
+      "cwe_id": [
+        601
+      ],
+      "note": "https://0xacab.org/sutty/sutty/-/issues/14957"
+    },
+    {
+      "warning_type": "Denial of Service",
+      "warning_code": 76,
+      "fingerprint": "1947d1a2ae6e4bf718d0cc563e660efca96897165e9a8dd18186c1d7abe6ddf6",
+      "check_name": "RegexDoS",
+      "message": "Model attribute used in regular expression",
+      "file": "app/controllers/api/v1/base_controller.rb",
+      "line": 20,
+      "link": "https://brakemanscanner.org/docs/warning_types/denial_of_service/",
+      "code": "/\\.#{Site.domain}\\z/",
+      "render_path": null,
+      "location": {
+        "type": "method",
+        "class": "Api::V1::BaseController",
+        "method": "site_id"
+      },
+      "user_input": "Site.domain",
+      "confidence": "Medium",
+      "cwe_id": [
+        20,
+        185
+      ],
+      "note": "No es un atributo, es una variable de entorno"
+    },
+    {
+      "warning_type": "Cross-Site Scripting",
+      "warning_code": 4,
+      "fingerprint": "28d98d08a15c4b3ad94a2cfa20a12573de12d99f1a30b3ca51074ee1f1886592",
+      "check_name": "LinkToHref",
+      "message": "Potentially unsafe model attribute in `link_to` href",
+      "file": "app/views/layouts/_breadcrumb.haml",
+      "line": 19,
+      "link": "https://brakemanscanner.org/docs/warning_types/link_to_href",
+      "code": "link_to(t(\".tienda\"), Site.find(params[:site_id]).tienda_url, :role => \"button\", :class => \"btn\")",
+      "render_path": [
+        {
+          "type": "controller",
+          "class": "Api::V1::NoticesController",
+          "method": "site",
+          "line": 31,
+          "file": "app/controllers/api/v1/notices_controller.rb",
+          "rendered": {
+            "name": "layouts/application",
+            "file": "app/views/layouts/application.html.haml"
+          }
+        },
+        {
+          "type": "template",
+          "name": "layouts/application",
+          "line": 25,
+          "file": "app/views/layouts/application.html.haml",
+          "rendered": {
+            "name": "layouts/_breadcrumb",
+            "file": "app/views/layouts/_breadcrumb.haml"
+          }
+        }
+      ],
+      "location": {
+        "type": "template",
+        "template": "layouts/_breadcrumb"
+      },
+      "user_input": "Site.find(params[:site_id]).tienda_url",
+      "confidence": "Weak",
+      "cwe_id": [
+        79
+      ],
+      "note": ""
+    },
+    {
+      "warning_type": "Redirect",
+      "warning_code": 18,
+      "fingerprint": "5034e51aaa1bac06d15fdde5956edffbfd65f94f5620a409526bbea896dc7b5f",
+      "check_name": "Redirect",
+      "message": "Possible unprotected redirect",
+      "file": "app/controllers/api/v1/contact_controller.rb",
+      "line": 26,
+      "link": "https://brakemanscanner.org/docs/warning_types/redirect/",
+      "code": "redirect_to((params[:redirect] or origin.to_s))",
+      "render_path": null,
+      "location": {
+        "type": "method",
+        "class": "Api::V1::ContactController",
+        "method": "receive"
+      },
+      "user_input": "params[:redirect]",
+      "confidence": "High",
+      "cwe_id": [
+        601
+      ],
+      "note": "https://0xacab.org/sutty/sutty/-/issues/14957"
+    },
+    {
+      "warning_type": "Mass Assignment",
+      "warning_code": 70,
+      "fingerprint": "50582f39f8dfa900d3f2b5b9908b1592f8b8bd9e2d0b9d1cc05d77e5ede2d94e",
+      "check_name": "MassAssignment",
+      "message": "Specify exact keys allowed for mass assignment instead of using `permit!` which allows any keys",
+      "file": "app/views/layouts/_link_rel_alternate.haml",
+      "line": 2,
+      "link": "https://brakemanscanner.org/docs/warning_types/mass_assignment/",
+      "code": "params.permit!",
+      "render_path": [
+        {
+          "type": "controller",
+          "class": "Api::V1::BaseController",
+          "method": "site_id",
+          "line": 20,
+          "file": "app/controllers/api/v1/base_controller.rb",
+          "rendered": {
+            "name": "layouts/application",
+            "file": "app/views/layouts/application.html.haml"
+          }
+        },
+        {
+          "type": "template",
+          "name": "layouts/application",
+          "line": 21,
+          "file": "app/views/layouts/application.html.haml",
+          "rendered": {
+            "name": "layouts/_link_rel_alternate",
+            "file": "app/views/layouts/_link_rel_alternate.haml"
+          }
+        }
+      ],
+      "location": {
+        "type": "template",
+        "template": "layouts/_link_rel_alternate"
+      },
+      "user_input": null,
+      "confidence": "Medium",
+      "cwe_id": [
+        915
+      ],
+      "note": "https://0xacab.org/sutty/sutty/-/issues/14958"
+    },
+    {
+      "warning_type": "Mass Assignment",
+      "warning_code": 70,
+      "fingerprint": "b8e0aa898288bebb614ccc1340d169caa196d315c6ac2e4744081cc892c2ae97",
+      "check_name": "MassAssignment",
+      "message": "Specify exact keys allowed for mass assignment instead of using `permit!` which allows any keys",
+      "file": "app/views/layouts/_breadcrumb.haml",
+      "line": 30,
+      "link": "https://brakemanscanner.org/docs/warning_types/mass_assignment/",
+      "code": "params.permit!",
+      "render_path": [
+        {
+          "type": "controller",
+          "class": "Api::V1::BaseController",
+          "method": "site_id",
+          "line": 20,
+          "file": "app/controllers/api/v1/base_controller.rb",
+          "rendered": {
+            "name": "layouts/application",
+            "file": "app/views/layouts/application.html.haml"
+          }
+        },
+        {
+          "type": "template",
+          "name": "layouts/application",
+          "line": 25,
+          "file": "app/views/layouts/application.html.haml",
+          "rendered": {
+            "name": "layouts/_breadcrumb",
+            "file": "app/views/layouts/_breadcrumb.haml"
+          }
+        }
+      ],
+      "location": {
+        "type": "template",
+        "template": "layouts/_breadcrumb"
+      },
+      "user_input": null,
+      "confidence": "Medium",
+      "cwe_id": [
+        915
+      ],
+      "note": "https://0xacab.org/sutty/sutty/-/issues/14958"
+    },
+    {
+      "warning_type": "Cross-Site Scripting",
+      "warning_code": 4,
+      "fingerprint": "c051421c7cf4c2706b8e27bfd2f3b0661ec6a6df873da322a6b634b59e80351b",
+      "check_name": "LinkToHref",
+      "message": "Potentially unsafe model attribute in `link_to` href",
+      "file": "app/views/sites/_form.haml",
+      "line": 74,
+      "link": "https://brakemanscanner.org/docs/warning_types/link_to_href",
+      "code": "link_to(t(\".design.url\"), (Unresolved Model).new.url, :target => \"_blank\", :class => \"btn\")",
+      "render_path": [
+        {
+          "type": "controller",
+          "class": "SitesController",
+          "method": "new",
+          "line": 31,
+          "file": "app/controllers/sites_controller.rb",
+          "rendered": {
+            "name": "sites/new",
+            "file": "app/views/sites/new.haml"
+          }
+        },
+        {
+          "type": "template",
+          "name": "sites/new",
+          "line": 6,
+          "file": "app/views/sites/new.haml",
+          "rendered": {
+            "name": "sites/_form",
+            "file": "app/views/sites/_form.haml"
+          }
+        }
+      ],
+      "location": {
+        "type": "template",
+        "template": "sites/_form"
+      },
+      "user_input": "(Unresolved Model).new.url",
+      "confidence": "Weak",
+      "cwe_id": [
+        79
+      ],
+      "note": ""
+    }
+  ],
+  "updated": "2024-01-11 18:12:14 -0300",
+  "brakeman_version": "5.4.1"
+}

config/routes.rb

@@ -28,9 +28,6 @@ Rails.application.routes.draw do
   # alias en nginx sin tener que usar expresiones regulares para
   # detectar el nombre del sitio.
   get '/sites/private/:site_id(*file)', to: 'private#show', constraints: { site_id: %r{[^/]+} }
-  # Obtener archivos estáticos desde el directorio público
-  get '/sites/:site_id/static_file/(*file)', to: 'sites#static_file', as: 'site_static_file',
-                                             constraints: { site_id: %r{[^/]+} }
   get '/env.js', to: 'env#index'
 
   match '/api/v3/projects/:site_id/notices' => 'api/v1/notices#create', via: %i[post]