Commit Graph

428 Commits

Author SHA1 Message Date
Javi Martín
b2b64ca8a0 Add link to download summary in XLSX format again
It was removed in commit 128a8164 alongside everything related to the
legislation process summary.

Co-Authored-By: taitus <sebastia.roig@gmail.com>
2020-09-08 13:32:08 +02:00
Senén Rodero Rodríguez
e138bbb04e Upgrade to jQuery 3.5.1
Latest version of jquery-rails gem includes latest jQuery 3 version with
all security patches. See [1].

[1] https://github.com/rails/jquery-rails/blob/v4.4.0/CHANGELOG.md#440
2020-08-28 16:09:41 +02:00
Javier Martín
7ee2f15a2e Merge pull request #3624 from consul/add_errbit_support
Add support for Errbit self-hosted exception management
2020-08-27 16:53:27 +02:00
Javier Martín
69e17a3cf4 Merge pull request #4069 from consul/dependabot/bundler/rollbar-2.27.0
Bump rollbar from 2.18.0 to 2.27.0
2020-08-27 16:52:02 +02:00
Javi Martín
f658126780 Support exception management with Airbrake+Errbit
With Errbit, you can set up your own server and host the information
regarding your exceptions there. You can also hire Airbrake's hosting
services or easily setup Errbit on Heroku.

We're still including the rollbar gem so we don't harm CONSUL users who
are using rollbar.

Note Errbit requires an old version of Airbrake which forced users to
configure the gem. So we're adding the current environtment to
`ignore_environments` when the project id isn't defined; this way the
application won't crash in this case.
2020-08-27 16:22:01 +02:00
dependabot-preview[bot]
c1693e24c4 Bump omniauth-facebook from 4.0.0 to 7.0.0
Bumps [omniauth-facebook](https://github.com/mkdynamic/omniauth-facebook) from 4.0.0 to 7.0.0.
- [Release notes](https://github.com/mkdynamic/omniauth-facebook/releases)
- [Changelog](https://github.com/simi/omniauth-facebook/blob/master/CHANGELOG.md)
- [Commits](https://github.com/mkdynamic/omniauth-facebook/compare/v4.0.0...v7.0.0)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
2020-08-27 09:08:08 +00:00
dependabot-preview[bot]
3df4df3a61 Bump omniauth-google-oauth2 from 0.4.1 to 0.8.0
Bumps [omniauth-google-oauth2](https://github.com/zquestz/omniauth-google-oauth2) from 0.4.1 to 0.8.0.
- [Release notes](https://github.com/zquestz/omniauth-google-oauth2/releases)
- [Changelog](https://github.com/zquestz/omniauth-google-oauth2/blob/master/CHANGELOG.md)
- [Commits](https://github.com/zquestz/omniauth-google-oauth2/compare/v0.4.1...v0.8.0)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
2020-08-26 09:01:07 +00:00
dependabot-preview[bot]
536fc64a06 Bump mdl from 0.10.0 to 0.11.0
Bumps [mdl](https://github.com/mivok/markdownlint) from 0.10.0 to 0.11.0.
- [Release notes](https://github.com/mivok/markdownlint/releases)
- [Changelog](https://github.com/markdownlint/markdownlint/blob/master/CHANGELOG.md)
- [Commits](https://github.com/mivok/markdownlint/compare/v0.10.0...v0.11.0)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
2020-08-25 13:13:42 +00:00
Javier Martín
2e71ba139a Merge pull request #4090 from consul/dependabot/bundler/initialjs-rails-0.2.0.9
Bump initialjs-rails from 0.2.0.8 to 0.2.0.9
2020-08-25 11:46:38 +02:00
dependabot-preview[bot]
853119437b Bump database_cleaner from 1.7.0 to 1.8.5
Bumps [database_cleaner](https://github.com/DatabaseCleaner/database_cleaner) from 1.7.0 to 1.8.5.
- [Release notes](https://github.com/DatabaseCleaner/database_cleaner/releases)
- [Changelog](https://github.com/DatabaseCleaner/database_cleaner/blob/master/History.rdoc)
- [Commits](https://github.com/DatabaseCleaner/database_cleaner/compare/v1.7.0...v1.8.5)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
2020-08-24 13:17:00 +00:00
Javier Martín
9761558d01 Merge pull request #4092 from consul/dependabot/bundler/capistrano-rails-1.6.1
Bump capistrano-rails from 1.4.0 to 1.6.1
2020-08-22 17:05:39 +02:00
Javier Martín
6023ee5c0e Merge pull request #4088 from consul/dependabot/bundler/web-console-3.7.0
Bump web-console from 3.3.0 to 3.7.0
2020-08-22 15:54:18 +02:00
dependabot-preview[bot]
cce9d0dd55 Bump font-awesome-sass from 5.8.1 to 5.13.0
Bumps [font-awesome-sass](https://github.com/FortAwesome/font-awesome-sass) from 5.8.1 to 5.13.0.
- [Release notes](https://github.com/FortAwesome/font-awesome-sass/releases)
- [Commits](https://github.com/FortAwesome/font-awesome-sass/compare/5.8.1...5.13.0)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
2020-08-22 13:24:17 +00:00
dependabot-preview[bot]
e28fa4be3b Bump web-console from 3.3.0 to 3.7.0
Bumps [web-console](https://github.com/rails/web-console) from 3.3.0 to 3.7.0.
- [Release notes](https://github.com/rails/web-console/releases)
- [Changelog](https://github.com/rails/web-console/blob/master/CHANGELOG.markdown)
- [Commits](https://github.com/rails/web-console/compare/v3.3.0...v3.7.0)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
2020-08-22 13:08:17 +00:00
Javier Martín
affd12a046 Merge pull request #4093 from consul/dependabot/bundler/scss_lint-0.59.0
Bump scss_lint from 0.55.0 to 0.59.0
2020-08-22 15:06:33 +02:00
dependabot-preview[bot]
f7f532ab47 Bump initialjs-rails from 0.2.0.8 to 0.2.0.9
Bumps [initialjs-rails](https://github.com/dgilperez/initialjs-rails) from 0.2.0.8 to 0.2.0.9.
- [Release notes](https://github.com/dgilperez/initialjs-rails/releases)
- [Changelog](https://github.com/dgilperez/initialjs-rails/blob/master/CHANGELOG.md)
- [Commits](https://github.com/dgilperez/initialjs-rails/compare/v0.2.0.8...v0.2.0.9)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
2020-08-22 13:02:48 +00:00
Javier Martín
3178f388ea Merge pull request #4094 from consul/dependabot/bundler/i18n-tasks-0.9.31
Bump i18n-tasks from 0.9.29 to 0.9.31
2020-08-22 15:01:04 +02:00
dependabot-preview[bot]
8be7facf15 Bump i18n-tasks from 0.9.29 to 0.9.31
Bumps [i18n-tasks](https://github.com/glebm/i18n-tasks) from 0.9.29 to 0.9.31.
- [Release notes](https://github.com/glebm/i18n-tasks/releases)
- [Changelog](https://github.com/glebm/i18n-tasks/blob/master/CHANGES.md)
- [Commits](https://github.com/glebm/i18n-tasks/compare/v0.9.29...v0.9.31)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
2020-08-18 13:14:56 +00:00
dependabot-preview[bot]
1367b30934 Bump scss_lint from 0.55.0 to 0.59.0
Bumps [scss_lint](https://github.com/sds/scss-lint) from 0.55.0 to 0.59.0.
- [Release notes](https://github.com/sds/scss-lint/releases)
- [Changelog](https://github.com/sds/scss-lint/blob/master/CHANGELOG.md)
- [Commits](https://github.com/sds/scss-lint/compare/v0.55.0...v0.59.0)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
2020-08-18 13:14:12 +00:00
dependabot-preview[bot]
d8e4dac573 Bump capistrano-rails from 1.4.0 to 1.6.1
Bumps [capistrano-rails](https://github.com/capistrano/rails) from 1.4.0 to 1.6.1.
- [Release notes](https://github.com/capistrano/rails/releases)
- [Commits](https://github.com/capistrano/rails/compare/v1.4.0...v1.6.1)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
2020-08-17 13:17:20 +00:00
dependabot-preview[bot]
67f3b7dc67 Bump capybara-webmock from 0.5.3 to 0.5.5
Bumps [capybara-webmock](https://github.com/hashrocket/capybara-webmock) from 0.5.3 to 0.5.5.
- [Release notes](https://github.com/hashrocket/capybara-webmock/releases)
- [Commits](https://github.com/hashrocket/capybara-webmock/commits)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
2020-08-17 13:16:36 +00:00
Javier Martín
146ffc8b9a Merge pull request #3905 from consul/dependabot/bundler/paperclip-6.1.0
Bump paperclip from 5.2.1 to 6.1.0
2020-08-14 23:17:12 +02:00
dependabot-preview[bot]
9d9824d1f3 Bump groupdate from 3.2.0 to 5.1.0
Bumps [groupdate](https://github.com/ankane/groupdate) from 3.2.0 to 5.1.0.
- [Release notes](https://github.com/ankane/groupdate/releases)
- [Changelog](https://github.com/ankane/groupdate/blob/master/CHANGELOG.md)
- [Commits](https://github.com/ankane/groupdate/compare/v3.2.0...v5.1.0)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
2020-08-14 20:42:18 +00:00
dependabot-preview[bot]
8419d7fbd7 [Security] Bump omniauth from 1.9.0 to 1.9.1
Bumps [omniauth](https://github.com/omniauth/omniauth) from 1.9.0 to 1.9.1. **This update includes a security fix.**
- [Release notes](https://github.com/omniauth/omniauth/releases)
- [Commits](https://github.com/omniauth/omniauth/compare/v1.9.0...v1.9.1)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
2020-08-14 20:26:15 +00:00
dependabot-preview[bot]
7786e45114 Bump paperclip from 5.2.1 to 6.1.0
Bumps [paperclip](https://github.com/thoughtbot/paperclip) from 5.2.1 to 6.1.0.
- [Release notes](https://github.com/thoughtbot/paperclip/releases)
- [Changelog](https://github.com/thoughtbot/paperclip/blob/master/NEWS)
- [Commits](https://github.com/thoughtbot/paperclip/compare/v5.2.1...v6.1.0)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
2020-08-14 20:24:08 +00:00
dependabot-preview[bot]
f397d91e04 Bump daemons and capistrano3-delayed-job
Bumps [daemons](https://github.com/thuehlinger/daemons) and [capistrano3-delayed-job](https://github.com/AgileConsultingLLC/capistrano3-delayed-job). These dependencies needed to be updated together.

Updates `daemons` from 1.2.6 to 1.3.1
- [Release notes](https://github.com/thuehlinger/daemons/releases)
- [Changelog](https://github.com/thuehlinger/daemons/blob/master/Releases)
- [Commits](https://github.com/thuehlinger/daemons/compare/v1.2.6...v1.3.1)

Updates `capistrano3-delayed-job` from 1.7.5 to 1.7.6
- [Release notes](https://github.com/AgileConsultingLLC/capistrano3-delayed-job/releases)
- [Commits](https://github.com/AgileConsultingLLC/capistrano3-delayed-job/compare/v1.7.5...v1.7.6)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
2020-08-14 20:09:08 +00:00
dependabot-preview[bot]
0de2b7d56d Bump wicked_pdf from 1.1.0 to 2.1.0
Bumps [wicked_pdf](https://github.com/mileszs/wicked_pdf) from 1.1.0 to 2.1.0.
- [Release notes](https://github.com/mileszs/wicked_pdf/releases)
- [Changelog](https://github.com/mileszs/wicked_pdf/blob/master/CHANGELOG.md)
- [Commits](https://github.com/mileszs/wicked_pdf/commits)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
2020-08-14 18:46:10 +00:00
dependabot-preview[bot]
637d162b74 Bump rails-assets-markdown-it from 8.2.2 to 9.0.1
Bumps rails-assets-markdown-it from 8.2.2 to 9.0.1.

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
2020-08-14 18:07:14 +00:00
Javier Martín
545501ae0f Merge pull request #3708 from consul/dependabot/bundler/cocoon-1.2.14
Bump cocoon from 1.2.11 to 1.2.14
2020-08-14 13:11:52 +02:00
Javier Martín
2094c25eba Merge pull request #3865 from consul/dependabot/bundler/acts-as-taggable-on-6.5.0
Bump acts-as-taggable-on from 6.0.0 to 6.5.0
2020-08-14 12:56:25 +02:00
dependabot-preview[bot]
c23ece99e1 Bump cocoon from 1.2.11 to 1.2.14
Bumps [cocoon](https://github.com/nathanvda/cocoon) from 1.2.11 to 1.2.14.
- [Release notes](https://github.com/nathanvda/cocoon/releases)
- [Changelog](https://github.com/nathanvda/cocoon/blob/master/History.md)
- [Commits](https://github.com/nathanvda/cocoon/compare/v1.2.11...v1.2.14)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
2020-08-14 10:41:23 +00:00
Javier Martín
b8894eac70 Merge pull request #3699 from consul/upgrade_turbolinks
Bump turbolinks to 5.2.1
2020-08-12 14:34:19 +02:00
dependabot-preview[bot]
d036f09002 Bump rollbar from 2.18.0 to 2.27.0
Bumps [rollbar](https://github.com/rollbar/rollbar-gem) from 2.18.0 to 2.27.0.
- [Release notes](https://github.com/rollbar/rollbar-gem/releases)
- [Changelog](https://github.com/rollbar/rollbar-gem/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rollbar/rollbar-gem/compare/v2.18.0...v2.27.0)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
2020-08-11 10:54:23 +00:00
Javi Martín
44f6d43212 Bump mdl from 0.5.0 to 0.10.0
This contains a security fix since we're upgrading kramdown.
2020-08-11 12:13:17 +02:00
dependabot-preview[bot]
9c54825d3b Bump acts-as-taggable-on from 5.0.0 to 6.5.0
Bumps [acts-as-taggable-on](https://github.com/mbleigh/acts-as-taggable-on) from 5.0.0 to 6.5.0.
- [Release notes](https://github.com/mbleigh/acts-as-taggable-on/releases)
- [Changelog](https://github.com/mbleigh/acts-as-taggable-on/blob/master/CHANGELOG.md)
- [Commits](https://github.com/mbleigh/acts-as-taggable-on/compare/v5.0.0...v6.5.0)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
2020-08-10 09:53:52 +00:00
Javi Martín
7b96180a76 Upgrade Turbolinks to version 5.2.1
We didn't upgrade Turbolinks when we upgraded to Rails 5 so we didn't
upgrade too many things at the same time, and postponed it... until now
:).

Note upgrading Turbolinks fixes an issue with foundation's sticky when
using the browser's back and forward buttons. We're adding tests for
these scenarios.

Co-authored-by: Senén Rodero Rodríguez <senenrodero@gmail.com>
2020-08-05 14:10:22 +02:00
Javier Martín
c03ada579d Merge pull request #4061 from consul/ballot_race_condition
Fix race condition with ballot lines
2020-07-27 13:01:37 +02:00
Javi Martín
9318c4f1e9 Bump pg_search from 2.0.1 to 2.3.0
Using pg_search 2.0.1 with Rails 5.2 results in deprecation warnings:

DEPRECATION WARNING: Dangerous query method (method whose arguments used
as raw SQL) called with non-attribute argument(s):
"pg_search_978c2f8941354cf552831b.rank DESC, \"tags\".\"id\" ASC".
Non-attribute arguments will be disallowed in Rails 6.0. This method
should not be called with user-provided values, such as request
parameters or model attributes. Known-safe values can be passed by
wrapping them in Arel.sql().

We're not upgrading to the latest pg_search because it only supports
ActiveRecord >= 5.2.
2020-07-14 13:16:08 +02:00
Javi Martín
d2d517059d Fix race condition with ballot lines
With two concurrent requests, it's possible to create two ballot lines
when only one of them should be created.

The reason is the code validating the line is not thread safe:

```
if ballot.amount_available(investment.heading) < investment.price.to_i
  errors.add(:money, "insufficient funds")
end
```

If the second request executes this code after the first request has
executed it but before the first request has saved the record to the
database, both records will pass this validation and both will be saved
to the database.

So we need to introduce a lock. Now when the second request tries to
lock the ballot, it finds it's already locked by the first request, and
will wait for the transaction of the first request to finish before
checking whether there are sufficient funds.

Note we need to disable transactions during the test; otherwise the
second thread will wait for the first one to finish.

Also note that we need to update a couple of tests because records are
reloaded when they're locked.

In one case, reloading the ballot causes `ballot.user` to be `nil`,
since the user is hidden. So we hide the user after creating all its
associated records (which is the scenario that would take place in real
life).

In the other case, reloading the ballot causes `ballot.user` to reload
as well. So we need to reload the user object used in the test too so it
gets the updates done on `ballot.user`.

I haven't been able to reproduce this behavior in a system test. The
following test works with Rails 5.0, but it stopped working when we
moved to system tests in commit 9427f014. After that commit, for reasons
I haven't been able to debug (reintroducing truncation with
DatabaseClaner didn't seem to affect this test, and neither did
increasing the number of threads in Puma), the two AJAX requests
executed here are no longer simultaneous; the second request waits for
the first one to finish.

scenario "Race conditions with simultaneous requests", :js do
  allow_any_instance_of(Budget::Ballot::Line).to receive(:check_sufficient_funds) do |object|
    allow(object).to receive(:check_sufficient_funds).and_call_original
    object.check_sufficient_funds
    sleep 0.3
  end

  ["First", "Second"].each do |title|
    create(:budget_investment, :selected,
      heading: california,
      price:   california.price,
      title:   title
    )
  end

  login_as(user)
  visit budget_investments_path(budget, heading_id: california.id)

  within(".budget-investment", text: "First") { click_link "Vote" }
  within(".budget-investment", text: "Second") { click_link "Vote" }

  expect(page).to have_link "Remove vote"
  expect(Budget::Ballot::Line.count).to eq 1
end
2020-07-12 22:11:40 +02:00
Javi Martín
199d8ff609 Bump rubocop from 0.75.0 to 0.83.0
Recent versions introduce the `Layout/SpaceAroundMethodCallOperator`,
which we are going to use. We aren't upgrading to the latest rubocop
version because it conflicts with the version of Capybara we're using
and because it isn't supported by Hound.

Some rules have been renamed:

Layout/IndentAssignment is now Layout/AssignmentIndentation
Layout/IndentHeredoc is now Layout/HeredocIndentation
Layout/LeadingBlankLines is now Layout/LeadingEmptyLines
Layout/Tab is now Layout/IndentationStyle
Layout/TrailingBlankLines is now Layout/TrailingEmptyLines
Lint/StringConversionInInterpolation is now Lint/RedundantStringCoercion
Metrics/LineLength is now Layout/LineLength

Note after upgrading we get a new "offense" in the `StartWith` rule, so
we're changing the code in order to fix it.
2020-06-16 13:47:38 +02:00
dependabot-preview[bot]
eab36f476e [Security] Bump kaminari from 1.1.1 to 1.2.1
Bumps [kaminari](https://github.com/kaminari/kaminari) from 1.1.1 to 1.2.1. **This update includes a security fix.**
- [Release notes](https://github.com/kaminari/kaminari/releases)
- [Changelog](https://github.com/kaminari/kaminari/blob/master/CHANGELOG.md)
- [Commits](https://github.com/kaminari/kaminari/compare/v1.1.1...v1.2.1)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
2020-05-28 21:14:42 +00:00
dependabot-preview[bot]
8e36fab5ad [Security] Bump puma from 4.3.3 to 4.3.5
Bumps [puma](https://github.com/puma/puma) from 4.3.3 to 4.3.5. **This update includes security fixes.**
- [Release notes](https://github.com/puma/puma/releases)
- [Changelog](https://github.com/puma/puma/blob/master/History.md)
- [Commits](https://github.com/puma/puma/commits)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
2020-05-26 16:39:43 +00:00
Javi Martín
59b625a5f9 Simplify chromedriver installation with webdrivers
This gem will automatically install chromedriver based on the installed
version of Chrome/Chromium.
2020-05-25 15:50:35 +02:00
Javi Martín
f89bf0c52c Bump initialjs-rails from 0.2.0.5 to 0.2.0.8
Version 0.2.0.5 was causing comments to have invalid HTML because the
avatars had `<img>` tags with an empty `src` attribute.
2020-05-12 23:57:57 +02:00
Javi Martín
e316ad9c96 Bump byebug to version 11.1.1
Rails 5.1 updated the `method_source` dependency, which is incompatible
with pry 0.12.x (which some developers are using), and upgrading pry and
pry-byebug requires a more recent version of byebug.
2020-04-24 15:43:54 +02:00
Javi Martín
9427f01442 Use system specs instead of feature specs
We get rid of database cleaner, and JavaScript tests are faster because
between tests we now rollback transactions instead of truncating the
database.
2020-04-24 15:43:54 +02:00
Javi Martín
1118c732f1 Bump acts-as-taggable-on to 6.0.0
Rails 5.1 introduced certain changes in the way a record is touched when
the counter cache option is enabled in a belongs to association.

We need to upgrade acts-as-taggable-on so it keeps changing the
`updated_at` attribute when a new tag is added to a record.

Note we now need to reload the records in some cases to get the
`context_tag_list` method to return what we expect. Methods like
`context_tags` however work properly with no need to reload the record.
2020-04-23 18:49:43 +02:00
Javi Martín
31fa6b8bde Upgrade Rails to 5.1
Note we need to upgrade the bullet gem, although another option would be
to remove it completely.

Now we don't need the rubocop rules for deprecated methods, since using
them will raise an error and we'll be notified immediately.
2020-04-23 18:49:43 +02:00
dependabot-preview[bot]
781188758a Bump capybara from 2.17.0 to 3.29.0
Bumps [capybara](https://github.com/teamcapybara/capybara) from 2.17.0 to 3.29.0.
- [Release notes](https://github.com/teamcapybara/capybara/releases)
- [Changelog](https://github.com/teamcapybara/capybara/blob/master/History.md)
- [Commits](https://github.com/teamcapybara/capybara/compare/2.17.0...3.29.0)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
2020-04-06 20:11:44 +02:00
dependabot-preview[bot]
41777c93e6 [Security] Bump puma from 4.3.1 to 4.3.3
Bumps [puma](https://github.com/puma/puma) from 4.3.1 to 4.3.3. **This update includes security fixes.**
- [Release notes](https://github.com/puma/puma/releases)
- [Changelog](https://github.com/puma/puma/blob/master/History.md)
- [Commits](https://github.com/puma/puma/compare/v4.3.1...v4.3.3)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
2020-03-01 22:55:54 +00:00