From a2543843754f7b3fbcf68d44f24618593261a1d7 Mon Sep 17 00:00:00 2001 From: Arnaud Levy Date: Tue, 14 Jul 2026 09:14:56 +0200 Subject: [PATCH 1/3] Bloc formulaire --- .../communication/blocks/templates/form.jpg | Bin 0 -> 8796 bytes app/models/communication/block.rb | 2 +- .../communication/block/template/form.rb | 28 ++++++++++++++++++ .../communication/block/with_template.rb | 1 + .../blocks/templates/form/_edit.html.erb | 3 ++ .../blocks/templates/form/_show.html.erb | 7 +++++ .../blocks/templates/form/_snippet.html.erb | 1 + .../blocks/templates/form/_static.html.erb | 9 ++++++ .../initializers/content_security_policy.rb | 1 + config/locales/communication/blocks/en.yml | 14 +++++++++ config/locales/communication/blocks/fr.yml | 14 +++++++++ 11 files changed, 79 insertions(+), 1 deletion(-) create mode 100644 app/assets/images/communication/blocks/templates/form.jpg create mode 100644 app/models/communication/block/template/form.rb create mode 100644 app/views/admin/communication/blocks/templates/form/_edit.html.erb create mode 100644 app/views/admin/communication/blocks/templates/form/_show.html.erb create mode 100644 app/views/admin/communication/blocks/templates/form/_snippet.html.erb create mode 100644 app/views/admin/communication/blocks/templates/form/_static.html.erb diff --git a/app/assets/images/communication/blocks/templates/form.jpg b/app/assets/images/communication/blocks/templates/form.jpg new file mode 100644 index 0000000000000000000000000000000000000000..5263c2e590f99fba7d1d11ac427a91fdeb60b901 GIT binary patch literal 8796 zcmb7q2|QHq_x~Nk*mtsPFxDjdz6~+{+u#Xb>V}r|fICiYTI#HS0v#lFE`j z`&LN&N2SlFKHu->`}-fSm-C$GoOAEF=Q+>0@B45#ayS7{X{l?f10WCpfN(#+;X6PT zAR#0qCWMd>6A_b=l8{j{QBhJ*P_mz3pkabRdAPZtT%3HTWrXUg;jL;E(erD*vu)&6!Y}Es0f80+?xCo>Y1|Exm5-{WEY;d01e^-UMER zE-?U*u+B!_A^nv&Pm>z-Mim=hMtPwj#-T@v`e! z_{AwyI}xC5{l^#Ws2q-L$;f)ch{S(ILnvZg^x&8A&jDT((`?}kQ%=q^eke9vMHv8d z(b~SyPCK>(MMuA~{6}u_PvWnMezV&enkW8|pk7 zc7M2u!Rny1M~x4pn$nhB_v(kb3~M_7tFnLh06}=#c@UcT%rx+JTZ&fCA6jpES?%BL z{*tJyEvt-XLPL2u`h9-Pf@x{<>Y;yG{5}GUYKL>7>#K%;OdoCNHuR72fA}pbAu7|0 zDxJp_?-4;~VgD`iBQ->=o7GYC=TlN#j?#pokEZ`KQQ5lxP#mp7KJ-5ueV@g<{vXsvXJv6c@ZSj9IRXFz z-V9Q(lk)qP`*q)RzTqbRjhIdd0pGiun38}JlXNKWHuWdve{%qcM5KVWwgo{AdHx-* zxzNw?53UT1oE)%2|Em`rpJ~(JU_ub>+Eg<*Z%%>3xHo)nde8b_od9fp6?968MTu8T zF!13>Zel8-*H@dpgnxGe@JeQRKbE{C%u~>Of5m%(LCILjQLgEKIGuzZc*!>@rZ4I} z?8}PERjB%!KL5XbfDo5!irKuM5HA(YX5z$FPS&yS|F7V1P2#{ArrK4pEGL=UCU3YdW16FoDi;Z8}`08-n8B= zD@hYKyV6>kNRr(_Rd3JnWbwg)rc09KAVYv0>9>szRc`gs$m*{(AGYVND;G4G+7ywv z3cc(^6*_K}INDhQ1W_$+e8x6@?y77oN=0&VTmT@b#KF*ZUR{Kp%@}K|zg?H&FXacq zw`2*AcF;JtGCVDvbt0!EOXLvf{8mLqO!M}{hy#)V6)&Ve(%98fkXIdl{p}FJ$W%}A z=QA6grKN&}n}Y!Yu#ZtYQ~7bT(`|kFj>jUYR3d&&n6thi%5-Bw z9y`QOJT%(t&$%o;KU22VVW=>A2sl!=m)05pjLvwjWA7vPUBq(|M*I+;Jpn^&K?Mi% z8g+g~QO&njY;%$Llrqn>Ej{5wCxZk4g$El1Z=cnHFzU(uEEJswy#R?ILDcOuy9i(0 zV-U=hegcyP^_hOFB9}c&Q9A0M!%Nm3w&ZrRA+zFUUvvv+@#LatA1iPvyW}#a=;OfP z_9|U)LQvtD7ac#%rvkLXgWgi1_K~MuPv#qTvN#3Y*{u`ul9a)avO8~e9<#4MY1F$C zlLC2j*-CHVnq`$WL{{Z1CyN}y?*z2O^h0L)_AOrwsT_e}+r&%3uTbXbcQ%jbMaV_f zHOJJwcS80SM>8X0IO4F^1441iuXh`z4lroCm{FFEBu8PO` z&R%NQbG!KN8*b-YMGBSuiaT1D9t7O(JOmV4>#R>d%h3RmBkxLWDA#h7zLB&+?T#8= zE|thkXu47RR`-HsozEM31hqA4xg7^m|&a2XKbkQmWXb97gTa^4(lCK&~c&`VUSX&Ub;m7cGCN5G7Q$s%etER827rv?$A3xo@IGVYyU9U!7QR*5} zyzg}jwmx8dM>Q%7U_#gQ`S#5O&`YgOKqRd68j~6#_XQ$O7~0Ij5;;}+g-vEX9Wn~- zl-sjw*$r11BhxwS@s|9nM)io147R|FF}>13E5{HT3Eg+S8~(XwxTW>rvPk&o74Rvb z_2hp1J8I>`(}~KT;4<8svC5IcrzVZ+EtTJAE z)rKsOwfvB^>M)L0$j@*nL>hJcqz(!`?B+{0KGp|hHNzAW=|(@y7>!!78&${frLvFRjMDPOLUSL33c z$|0c0Xo{BY_07cgAWKJYkR|z@j|!NK3!Qss^oD&ouy8d(xuBICN@xOim=<|`>m7gN zGRrgPPtCRoXSDVY0gY8@a}*b0shb~5*%H9SihKS6O)8nP2C zwC@+KonSJP>L@*bjf{iZ!>zdrULdSr5MX7Im7lnv^1Qw3+)NP2#)Cx*Gz2`n%sAh( zoHG6yGv;76g${6gv|`xsg^WF?BzQ6&*Jn0ce=IhmBXazveCEo{o;Z3Ff)vxhKU<24 z!f5VSX^kN|0syoOu`V~eK|;_aeXoBMpXna5txthKB>gMlOc1wy(4e?49n-eu?qHL= z4_)*XTRj~qA+ctYls7YbW+WWhZV*Q@GFFuM>!M!oph}tI>;=bSj+^+S3vZ<#JlolM zJ0z85Ha+fRWvNF`Pmp4PmAmI+HX?wTp6L6&-@liEcn{O*8eAES>XD~dW|CcM$cEc5 zpPaYhLcV(zx8c8stu8usp9>JS3dBTTLCx*OzoQx`QvMXT+4ga)PpYbxpTfR`X(kxr zal0q&4vXn)W7pH0!|iHkrxbd(6w52jv31Qp{!&g=c_6++pvS4!E_$afEA0?iiA9UR z3uF<6@y6N-!v-Y$qaV#)ZBUOt6xUI|utS8a^ii;KIlIj0gtP%Un zs)}Fl8JCwwzha%1EtcI+RQf}wKN$fSVv(sX5w8fw6B6=`UsJIA-Vg(%CG;h`?d!f^ zo-XuJ8=*&6w7W)KLCeHjU&RM=#fy8aU6Y9SAb!_A*V2ar2x_l*qFr5G{Dqkm zfhOBT{xm(PJKG#yb}>h}#l<8{jBq*OBi_=;G%oJ5Rc+x{1$X=@jbZQEB57Ohz(raHBey*^DJIbKB! zEeoJCC8ab=D>ICN{zO-@gjr+x6>?x4hC`All-xmj&#$B!E(lqWb|(vmRnxWm7RV?j znrn?}Yp)u21{uC?g(K)s3%IC~Tvw}?WS2@bcGzqp-x&;$okRMmkKH@3)3H_&xkb=#bibWd<<%a;%Po;E_e1bKHbsaUOAA% zSq$2q=AK@b+U_}ldsPP~k{(PwC8Z)Xi+kv;SiMq}?`T~voy9bhYX>%zbCvuC;V3rk za=Z5vlrfD|nKr>Zcs*O%K*P3X^|@l)=6C6CFu|s!C^kd&HnUyQhNr`E88QKEih#dh z*|$Rf>11J~&{-pK4c86wR+8pH(abO*%JLeks#8CDsc_1R+wx0xA*@lJO%_*OC=nrc z<5*ooRyLHMT#6g-iHwp89mCJaWraCvl|(+I!4V$Y0b$N3-}7Zi7>_Ur>jv1x4B3k! z*evs45mM6rWpuC4`!t7P{9;MTjT>yN?Ju|Rl!f*-C<~LEdF=E;wlje*JzR+;FsnwB z)`heoJ7Rnr2ja{zHIS~AH~xd`xD8+m5I&~cGN%7_=21}mYyb^RaETs48!kSube(aa zw$=FuCSwr%iOFCfjAL@ybfwr4M%rx1K9HF;!L%j^^3deg&0D`Q@Ls%b+ydhcxgNGpm0u_0l0`CPhhAA^G7mlmTBt=M+NtUtvh z8tBll_z8p}wzC$c;xuU(dpcbU16qfD);d%6dKB*uUGUZ1y*X*BQk#@y6=Osl8-H1I z*V@3!o>(uTT-rU^d`Y>bnMUIRN_qJidNf!w-B4Quq`u+lVwY(z`ZjoqJQseW%!K7a zw7=Zj#}kxj)-6$=+`J`^=eW-^Tk|4J4IL9~sq#w?8-6N_3-jX2o4ea{INXKXb0ogX zg6|_`MGsPzmM~+Y%J|9FA_`Xsji`Ln!w64JUu>j3;22u4;~OB=q&06|^0%P6)bRR& zruo%f4}lTrM+gC{N=O>^n4vEhU0*d0#`C!i?(LwE$LC zU@#+0uhLv>gLh9_gS3OV^r1HU2YdNoJ(ra0pE4h2cRtmVl{xAr`hFz`y>J#J6*Ej1}2r8pp97=oktR;X;8s+Z3SH7?!2db_Vm%MSR z!4u6NJs%OrmpE88zsKl`hv=BqFY6Le$>|ZLjh`;jTVu?IL3%uBg!zdn$X}}JTo#11u z>Saa*4b-NCcA&$Uy(oN^XpBx0E>U5u$&u6XZO?61xLu~2ecU!X_v>)1+j4wQlZ1x=GEBeUPilOS`Cg~5bBfX`ZWpxq zya~pA{O$Knz87Yg9G-(Y@&d0f1Dd$W2-K(YV~%T7JmMdc;s;oAE1<-kU(D@YPS z!j^}4wTb?f8`81-WO?D9L4yxFfTy(sbzTas3`YkH8*HfU$s2hZX`OkLU6Lp@ec{N! zCs$@B;`zuAf%pinL%=dpkG@}Q^q8J_W2>8Q$TOihj{NZP#$s1p@fuq3hn*W5vr8*&Ndd|6 z;L%_O9+z~8vrM2?b_(_o$UmS>C9QZFD_OStQHloYf!+4!=6_S<&bt*~L38^lVfGUQ zOFga=)UNl*BOk~Q(G(d%hyDFX%4L$girHBf_-Yo!?FlU3yX3x}lI(p*_PM5fQ>)&^ z(Ou{oS_(9Ua4I^FiFuOH-82#=GO?-6p#8|4x#SQSQ$5JY|Ju|6)5NP#`mrDa^uX#B{IXe^n<#K zUx9s!Z`wIey`JuJJfody?4U1x5C4n`vUvXM&bMW?c5pC=Qe~{>yM6x zd?(`%5J&rm!=4e`QMBirG@rt}d&ht#(I-^0`w-A^j*4iQ)09{!jqY)hqxO9tGQ0k2 zW;-CIomn7&H_x3GVsSXSe>Jyi09rEy}mBY%UmCL2&lc#)!9y^R6zFYibt-(V$E*vcde_@ zz7*)75$l{5D8HGc4~h*}>90sDe<&;Q;01v}A>H7EOTC*Or(6x}4GqZV;AN*i1}t(c z%=20ZmVX^17J+$?RkFsIyh^o~Yi5_vg<-w-CN)!yv`u6tvIs@}K^VxI1Vme2CN5aO z(k6E=W|}yIN#0BE1-N$yl6joKBV)7&*l=HNl%5*^VO$N(&r?Mb(m3{8i(bOy*ayCK9HsWaTFXhQK0tWh<@^b zae(z8O8lkh?NZ+Ch0EQhW!FxeH=G$7n?UJ4iaE{G_tK7-FM>mZx_Gh9aM&Y#-RW9b z!>X2+-nK4tYh?N^Hpc@q1bPsHhL4dI|^5OWSfyFQACkg4{PNsdDe6Xt4ES$0iU1c|)4 zSblwP+TfO%3BM1dPi_e#*DJ2nOrcwtkt*>Sdv~|7P;Yw2{dpwrFS&sNb!`cH5p4QY zUUvfJ6mL4ypF6KOpRumwMrqPu=ALRNG0LV3zvF3QqMxcA2)jP=l4&gVJ<#r*``p=d zRack7LJvh16R2ID0-2C<+Ns7?JeIkyC10Cno<4qAT_pbioF8RWsb#6N&o}vD+tsKa zuBwx=mC%7teG}$YYGSwno*X9&JbB;`Jp@i^+^Xn_8k$@$5RWU3F&lYnqShsSR3>lJ zJjzURY2k>K#@%ryia7f~3AG)|0t{4-_o~e7%Z7bLWzG&}?}>1UyqCOpJNb1l;NP=6 zn|;MA;R>wZa>bLkNXCcNq5R+$Gxx+I*K2%AO+tN(_KM)jt))X?hZc8OPe+YApZ|@T YzMsG2fpF*VtcZWH!2N5+cZ;|G4|Y^4OaK4? literal 0 HcmV?d00001 diff --git a/app/models/communication/block.rb b/app/models/communication/block.rb index ba2f240345..572f82629b 100644 --- a/app/models/communication/block.rb +++ b/app/models/communication/block.rb @@ -38,7 +38,7 @@ class Communication::Block < ApplicationRecord basic: [:title, :chapter, :image, :video, :sound, :datatable], storytelling: [:key_figures, :features, :gallery, :call_to_action, :testimonials, :timeline], references: [:pages, :posts, :persons, :organizations, :agenda, :exhibitions, :programs, :locations, :projects, :papers, :volumes, :jobs, :categories], - utilities: [:files, :definitions, :contact, :links, :license, :embed] + utilities: [:form, :files, :definitions, :contact, :links, :license, :embed] } include AsIndirectObject diff --git a/app/models/communication/block/template/form.rb b/app/models/communication/block/template/form.rb new file mode 100644 index 0000000000..8a5edf9e44 --- /dev/null +++ b/app/models/communication/block/template/form.rb @@ -0,0 +1,28 @@ +class Communication::Block::Template::Form < Communication::Block::Template::Base + + has_component :url, :string + has_component :form_title, :string + + def iframe + @iframe ||= tally_iframe + tally_script + end + + def identifier + url.remove('https://tally.so/r/') + end + + def platform + url.include?('tally.so') ? :tally : nil + end + + protected + + # Quand on ajoutera d'autres plateformes, faire un service comme les vidéos + def tally_iframe + "\n" + end + + def tally_script + "" + end +end diff --git a/app/models/communication/block/with_template.rb b/app/models/communication/block/with_template.rb index 3d6ce3fe5d..e9563d2339 100644 --- a/app/models/communication/block/with_template.rb +++ b/app/models/communication/block/with_template.rb @@ -40,6 +40,7 @@ module Communication::Block::WithTemplate volumes: 3310, jobs: 3400, categories: 3500, + form: 4041, license: 4040, links: 4050 }, prefix: :template diff --git a/app/views/admin/communication/blocks/templates/form/_edit.html.erb b/app/views/admin/communication/blocks/templates/form/_edit.html.erb new file mode 100644 index 0000000000..87816420fb --- /dev/null +++ b/app/views/admin/communication/blocks/templates/form/_edit.html.erb @@ -0,0 +1,3 @@ +

<%= t('admin.communication.blocks.templates.form.edit.warning_html') %>

+<%= block_component_edit block, :url %> +<%= block_component_edit block, :form_title %> \ No newline at end of file diff --git a/app/views/admin/communication/blocks/templates/form/_show.html.erb b/app/views/admin/communication/blocks/templates/form/_show.html.erb new file mode 100644 index 0000000000..86eb756157 --- /dev/null +++ b/app/views/admin/communication/blocks/templates/form/_show.html.erb @@ -0,0 +1,7 @@ +
+
+
+ <%= raw block.template.iframe %> +
+
+
\ No newline at end of file diff --git a/app/views/admin/communication/blocks/templates/form/_snippet.html.erb b/app/views/admin/communication/blocks/templates/form/_snippet.html.erb new file mode 100644 index 0000000000..42aff76d2c --- /dev/null +++ b/app/views/admin/communication/blocks/templates/form/_snippet.html.erb @@ -0,0 +1 @@ +<%= raw block.template.iframe %> \ No newline at end of file diff --git a/app/views/admin/communication/blocks/templates/form/_static.html.erb b/app/views/admin/communication/blocks/templates/form/_static.html.erb new file mode 100644 index 0000000000..d9adbc0081 --- /dev/null +++ b/app/views/admin/communication/blocks/templates/form/_static.html.erb @@ -0,0 +1,9 @@ +<%= block_component_static block, :url %> +<%= block_component_static block, :form_title %> +<% if block.template.url.present? %> + form: + platform: "<%= block.template.platform %>" + identifier: "<%= block.template.identifier %>" + iframe: >- + <%= block.template.iframe %> +<% end %> diff --git a/config/initializers/content_security_policy.rb b/config/initializers/content_security_policy.rb index a059a34d2a..f893746944 100644 --- a/config/initializers/content_security_policy.rb +++ b/config/initializers/content_security_policy.rb @@ -13,6 +13,7 @@ script_urls = %w( https://example.osuny.org/js/ https://plausible.io + https://tally.so https://d2wy8f7a9ursnm.cloudfront.net/v7/ ) script_urls << "https://cdn.jsdelivr.net/npm/summernote@#{SummernoteRails::Rails::VERSION.split('.').take(3).join('.')}/dist/lang/" diff --git a/config/locales/communication/blocks/en.yml b/config/locales/communication/blocks/en.yml index 69d7fa2709..fcd88bd9ad 100644 --- a/config/locales/communication/blocks/en.yml +++ b/config/locales/communication/blocks/en.yml @@ -373,6 +373,19 @@ en: label: Title placeholder: Enter title here remove_file: Remove a file + form: + description: A form, so users can send data or ask questions. + edit: + form_title: + hint: Helps people with disabilities + label: Form title + placeholder: Type the form title + url: + hint: | + Ex: https://tally.so/r/jaY00R + label: Form URL + placeholder: Enter the form URL + warning_html: This block lets you integrate Tally forms. gallery: description: A gallery of images, with an accessible description, a text and a credit for each image. edit: @@ -916,6 +929,7 @@ en: exhibitions: Exhibitions features: Features files: Files + form: Form gallery: Gallery image: Image jobs: Job offers diff --git a/config/locales/communication/blocks/fr.yml b/config/locales/communication/blocks/fr.yml index 9506892822..4a4fa7b572 100644 --- a/config/locales/communication/blocks/fr.yml +++ b/config/locales/communication/blocks/fr.yml @@ -374,6 +374,19 @@ fr: label: Titre placeholder: Entrer le titre du fichier remove_file: Supprimer le fichier + form: + description: Un formulaire permettant aux internautes d'envoyer des informations ou de poser des questions. + edit: + form_title: + hint: Utile pour l'accessibilité aux personnes en situation de handicap + label: Titre du formulaire + placeholder: Indiquer le titre du formulaire + url: + hint: | + Ex: https://tally.so/r/jaY00R + label: URL du formulaire + placeholder: Entrer l'URL du formulaire + warning_html: Le bloc permet d'intégrer les formulaires Tally. gallery: description: Une galerie d'images, avec pour chaque image une description accessible, un texte et un crédit. edit: @@ -917,6 +930,7 @@ fr: exhibitions: Expositions features: Fonctionnalités files: Fichiers + form: Formulaire gallery: Galerie image: Image jobs: Offres d'emploi From 7b069c38826d9578e2a6e9197854ffbc32924a02 Mon Sep 17 00:00:00 2001 From: Arnaud Levy Date: Tue, 14 Jul 2026 10:06:25 +0200 Subject: [PATCH 2/3] fix --- .../communication/block/template/form.rb | 24 +++++++++++-------- .../blocks/group/_editor.html.erb | 6 ++++- .../blocks/templates/form/_show.html.erb | 1 + .../blocks/templates/form/_snippet.html.erb | 2 +- .../blocks/templates/form/_static.html.erb | 4 +++- 5 files changed, 24 insertions(+), 13 deletions(-) diff --git a/app/models/communication/block/template/form.rb b/app/models/communication/block/template/form.rb index 8a5edf9e44..e640d93cf7 100644 --- a/app/models/communication/block/template/form.rb +++ b/app/models/communication/block/template/form.rb @@ -3,26 +3,30 @@ class Communication::Block::Template::Form < Communication::Block::Template::Bas has_component :url, :string has_component :form_title, :string + # Quand on ajoutera d'autres plateformes, faire un service comme les vidéos def iframe - @iframe ||= tally_iframe + tally_script + "" + end + + def iframe_preview + "" + end + + def script + "" end def identifier - url.remove('https://tally.so/r/') + @identifier ||= url.remove('https://tally.so/r/') end def platform - url.include?('tally.so') ? :tally : nil + @platform ||= url.include?('tally.so') ? :tally : nil end protected - # Quand on ajoutera d'autres plateformes, faire un service comme les vidéos - def tally_iframe - "\n" - end - - def tally_script - "" + def embed_url + @embed_url ||= "https://tally.so/embed/#{identifier}?alignLeft=1&hideTitle=1&transparentBackground=1&dynamicHeight=1" end end diff --git a/app/views/admin/communication/blocks/group/_editor.html.erb b/app/views/admin/communication/blocks/group/_editor.html.erb index 21db90d7f9..16ab9be267 100644 --- a/app/views/admin/communication/blocks/group/_editor.html.erb +++ b/app/views/admin/communication/blocks/group/_editor.html.erb @@ -26,4 +26,8 @@ reorder_url = reorder_admin_communication_blocks_path( data-reorder-url="<%= reorder_url %>"> <%= render 'admin/communication/blocks/group/editor/paste', about: about %> -<%= render 'admin/communication/blocks/group/editor/reset', about: about %> \ No newline at end of file +<%= render 'admin/communication/blocks/group/editor/reset', about: about %> + +<% content_for :javascript do %> + +<% end %> \ No newline at end of file diff --git a/app/views/admin/communication/blocks/templates/form/_show.html.erb b/app/views/admin/communication/blocks/templates/form/_show.html.erb index 86eb756157..6b7468513b 100644 --- a/app/views/admin/communication/blocks/templates/form/_show.html.erb +++ b/app/views/admin/communication/blocks/templates/form/_show.html.erb @@ -2,6 +2,7 @@
<%= raw block.template.iframe %> + <%= raw block.template.script %>
\ No newline at end of file diff --git a/app/views/admin/communication/blocks/templates/form/_snippet.html.erb b/app/views/admin/communication/blocks/templates/form/_snippet.html.erb index 42aff76d2c..406a83158c 100644 --- a/app/views/admin/communication/blocks/templates/form/_snippet.html.erb +++ b/app/views/admin/communication/blocks/templates/form/_snippet.html.erb @@ -1 +1 @@ -<%= raw block.template.iframe %> \ No newline at end of file +<%= raw block.template.iframe_preview %> \ No newline at end of file diff --git a/app/views/admin/communication/blocks/templates/form/_static.html.erb b/app/views/admin/communication/blocks/templates/form/_static.html.erb index d9adbc0081..02c7560c1a 100644 --- a/app/views/admin/communication/blocks/templates/form/_static.html.erb +++ b/app/views/admin/communication/blocks/templates/form/_static.html.erb @@ -5,5 +5,7 @@ platform: "<%= block.template.platform %>" identifier: "<%= block.template.identifier %>" iframe: >- - <%= block.template.iframe %> + <%= raw block.template.iframe %> + script: >- + <%= raw block.template.script %> <% end %> From 6e3423ca3907198f3b80e176696e071b8fd621ae Mon Sep 17 00:00:00 2001 From: Arnaud Levy Date: Tue, 14 Jul 2026 10:32:51 +0200 Subject: [PATCH 3/3] allowed domains --- .../communication/block/template/form.rb | 6 +++++ .../website/with_realm_communication.rb | 14 ++++++++++ .../communication/website/with_security.rb | 27 +++++++++---------- 3 files changed, 32 insertions(+), 15 deletions(-) diff --git a/app/models/communication/block/template/form.rb b/app/models/communication/block/template/form.rb index e640d93cf7..75e7f2673d 100644 --- a/app/models/communication/block/template/form.rb +++ b/app/models/communication/block/template/form.rb @@ -24,6 +24,12 @@ def platform @platform ||= url.include?('tally.so') ? :tally : nil end + def csp_domains + [ + 'tally.so' + ] + end + protected def embed_url diff --git a/app/models/communication/website/with_realm_communication.rb b/app/models/communication/website/with_realm_communication.rb index 0b6a345828..c55fdb25eb 100644 --- a/app/models/communication/website/with_realm_communication.rb +++ b/app/models/communication/website/with_realm_communication.rb @@ -12,4 +12,18 @@ module Communication::Website::WithRealmCommunication alias :blocks :communication_blocks end + def all_blocks + @all_blocks ||= Communication::Block.where(id: all_blocks_ids) + end + + protected + + def all_blocks_ids + @all_blocks_ids ||= ( + blocks.pluck(:id) + + blocks_from_education.pluck(:id) + + blocks_from_research.pluck(:id) + + blocks_from_university.pluck(:id) + ).compact_blank.uniq + end end diff --git a/app/models/communication/website/with_security.rb b/app/models/communication/website/with_security.rb index 26da7008cf..69a4136db7 100644 --- a/app/models/communication/website/with_security.rb +++ b/app/models/communication/website/with_security.rb @@ -5,6 +5,7 @@ def allowed_domains list = allowed_domains_default list.concat allowed_domains_plausible list.concat allowed_domains_from_all_blocks_video + list.concat allowed_domains_from_all_blocks_form list.concat allowed_domains_from_all_blocks_embed list.uniq.compact end @@ -27,15 +28,8 @@ def allowed_domains_plausible end def allowed_domains_from_all_blocks_video - allowed_domains_from_blocks_video(blocks) + - allowed_domains_from_blocks_video(blocks_from_education) + - allowed_domains_from_blocks_video(blocks_from_research) + - allowed_domains_from_blocks_video(blocks_from_university) - end - - def allowed_domains_from_blocks_video(blocks) list = [] - blocks.template_video.each do |block| + all_blocks.template_video.each do |block| video_url = block.template.url next unless video_url.present? list.concat Video::Provider.find(video_url).csp_domains @@ -43,16 +37,17 @@ def allowed_domains_from_blocks_video(blocks) list end - def allowed_domains_from_all_blocks_embed - allowed_domains_from_blocks_embed(blocks) + - allowed_domains_from_blocks_embed(blocks_from_education) + - allowed_domains_from_blocks_embed(blocks_from_research) + - allowed_domains_from_blocks_embed(blocks_from_university) + def allowed_domains_from_all_blocks_form + list = [] + all_blocks.template_form.published.each do |block| + list += block.template.csp_domains + end + list end - def allowed_domains_from_blocks_embed(blocks) + def allowed_domains_from_all_blocks_embed list = [] - blocks.template_embed.published.each do |block| + all_blocks.template_embed.published.each do |block| code = block.template.code # https://stackoverflow.com/questions/25095176/extracting-all-urls-from-a-page-using-ruby code.scan(/[[:lower:]]+:\/\/[^\s"]+/).each do |url| @@ -63,6 +58,8 @@ def allowed_domains_from_blocks_embed(blocks) list end + # @SebouChu tu crois pas qu'on devrait mettre ça dans le template Embed ? + # Comme ça il fournit ses domaines et basta, non ? def load_allowed_domain_from_url(url) url = CGI.unescapeHTML(url) url = ActionController::Base.helpers.strip_tags(url)