From 6ad619609806f68ef2134145f0bb3cf609289ea1 Mon Sep 17 00:00:00 2001 From: Eric Leroy-Terquem Date: Mon, 22 Apr 2024 20:16:07 +0200 Subject: [PATCH 1/3] fix(gallery): allow pdf iframes in the PJ gallery --- config/initializers/content_security_policy.rb | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/config/initializers/content_security_policy.rb b/config/initializers/content_security_policy.rb index d213d1dfc..d07dbf05a 100644 --- a/config/initializers/content_security_policy.rb +++ b/config/initializers/content_security_policy.rb @@ -32,9 +32,12 @@ Rails.application.config.content_security_policy do |policy| connect_whitelist << Rails.application.secrets.matomo[:host] if Rails.application.secrets.matomo[:enabled] policy.connect_src(:self, *connect_whitelist) - # Frames: allow Matomo's iframe on the /suivi page + # Frames: allow some iframes frame_whitelist = [] + # allow Matomo's iframe on the /suivi page frame_whitelist << URI(MATOMO_IFRAME_URL).host if Rails.application.secrets.matomo[:enabled] + # allow pdf iframes in the PJ gallery + frame_whitelist << URI(DS_PROXY_URL).host if DS_PROXY_URL.present? policy.frame_src(:self, *frame_whitelist) # Everything else: allow us From 388470f1868f283857ce04a7e1f0ccc4be230654 Mon Sep 17 00:00:00 2001 From: Eric Leroy-Terquem Date: Mon, 22 Apr 2024 20:55:13 +0200 Subject: [PATCH 2/3] fix(gallery): add a feature flag on gallery demande --- .../piece_justificative/_show.html.haml | 37 +++++++++++-------- app/views/shared/dossiers/_demande.html.haml | 2 +- config/initializers/flipper.rb | 1 + 3 files changed, 23 insertions(+), 17 deletions(-) diff --git a/app/views/shared/champs/piece_justificative/_show.html.haml b/app/views/shared/champs/piece_justificative/_show.html.haml index 9098e88fb..4d36de1d5 100644 --- a/app/views/shared/champs/piece_justificative/_show.html.haml +++ b/app/views/shared/champs/piece_justificative/_show.html.haml @@ -1,19 +1,24 @@ .fr-downloads-group - - champ.piece_justificative_file.attachments.each do |attachment| + - if !feature_enabled?(:gallery_demande) %ul - %li= render Attachment::ShowComponent.new(attachment:, new_tab: true, truncate: true) - .gallery-item - - blob = attachment.blob - - if blob.content_type.in?(AUTHORIZED_PDF_TYPES) - = link_to blob.url, id: blob.id, data: { iframe: true, src: blob.url }, class: 'gallery-link', type: blob.content_type, title: "#{champ.libelle} -- #{blob.filename}" do - .thumbnail - = image_tag("pdf-placeholder.png") - .fr-btn.fr-btn--tertiary.fr-btn--icon-left.fr-icon-eye{ role: :button } - = 'Visualiser' + - champ.piece_justificative_file.attachments.each do |attachment| + %li= render Attachment::ShowComponent.new(attachment:, new_tab: true) + - else + - champ.piece_justificative_file.attachments.each do |attachment| + %ul + %li= render Attachment::ShowComponent.new(attachment:, new_tab: true, truncate: true) + .gallery-item + - blob = attachment.blob + - if blob.content_type.in?(AUTHORIZED_PDF_TYPES) + = link_to blob.url, id: blob.id, data: { iframe: true, src: blob.url }, class: 'gallery-link', type: blob.content_type, title: "#{champ.libelle} -- #{blob.filename}" do + .thumbnail + = image_tag("pdf-placeholder.png") + .fr-btn.fr-btn--tertiary.fr-btn--icon-left.fr-icon-eye{ role: :button } + = 'Visualiser' - - elsif blob.content_type.in?(AUTHORIZED_IMAGE_TYPES) - = link_to image_url(blob.url), title: "#{champ.libelle} -- #{blob.filename}", data: { src: blob.url }, class: 'gallery-link' do - .thumbnail - = image_tag(blob.url) - .fr-btn.fr-btn--tertiary.fr-btn--icon-left.fr-icon-eye{ role: :button } - = 'Visualiser' + - elsif blob.content_type.in?(AUTHORIZED_IMAGE_TYPES) + = link_to image_url(blob.url), title: "#{champ.libelle} -- #{blob.filename}", data: { src: blob.url }, class: 'gallery-link' do + .thumbnail + = image_tag(blob.url) + .fr-btn.fr-btn--tertiary.fr-btn--icon-left.fr-icon-eye{ role: :button } + = 'Visualiser' diff --git a/app/views/shared/dossiers/_demande.html.haml b/app/views/shared/dossiers/_demande.html.haml index 6c6e6d601..3cdd95d2e 100644 --- a/app/views/shared/dossiers/_demande.html.haml +++ b/app/views/shared/dossiers/_demande.html.haml @@ -2,7 +2,7 @@ - content_for(:notice_info) do = render partial: "shared/dossiers/france_connect_informations_notice", locals: { user_information: dossier.user.france_connect_informations.first } -.fr-container.counter-start-header-section.dossier-show.gallery.gallery-demande{ class: class_names("dossier-show-instructeur" => profile =="instructeur"), "data-controller": "lightbox" } +.fr-container.counter-start-header-section.dossier-show{ class: class_names('gallery': feature_enabled?(:gallery_demande), 'gallery-demande': feature_enabled?(:gallery_demande), "dossier-show-instructeur" => profile =="instructeur"), "data-controller": "lightbox" } .fr-grid-row.fr-grid-row--center .fr-col-12.fr-col-xl-8 - if profile == 'instructeur' && dossier.termine_and_accuse_lecture? diff --git a/config/initializers/flipper.rb b/config/initializers/flipper.rb index 3d3851c9e..9b22801b9 100644 --- a/config/initializers/flipper.rb +++ b/config/initializers/flipper.rb @@ -26,6 +26,7 @@ features = [ :engagement_juridique_type_de_champ, :export_order_by_revision, :expression_reguliere_type_de_champ, + :gallery_demande, :groupe_instructeur_api_hack, :hide_instructeur_email, :sva, From 5348543dbe0e381f934f14d65266ad57b404c781 Mon Sep 17 00:00:00 2001 From: Colin Darie Date: Mon, 22 Apr 2024 22:13:50 +0200 Subject: [PATCH 3/3] fix(demande): pj thumbnail with loading="lazy" --- app/views/instructeurs/dossiers/pieces_jointes.html.haml | 2 +- app/views/shared/champs/piece_justificative/_show.html.haml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/app/views/instructeurs/dossiers/pieces_jointes.html.haml b/app/views/instructeurs/dossiers/pieces_jointes.html.haml index e4ef2686a..ba4a228f5 100644 --- a/app/views/instructeurs/dossiers/pieces_jointes.html.haml +++ b/app/views/instructeurs/dossiers/pieces_jointes.html.haml @@ -25,7 +25,7 @@ - elsif blob.content_type.in?(AUTHORIZED_IMAGE_TYPES) = link_to image_url(blob.url), title: "#{champ.libelle} -- #{blob.filename}", data: { src: blob.url }, class: 'gallery-link' do .thumbnail - = image_tag(blob.url) + = image_tag(blob.url, loading: :lazy) .fr-btn.fr-btn--tertiary.fr-btn--icon-left.fr-icon-eye{ role: :button } Visualiser .champ-libelle diff --git a/app/views/shared/champs/piece_justificative/_show.html.haml b/app/views/shared/champs/piece_justificative/_show.html.haml index 4d36de1d5..3e8998f81 100644 --- a/app/views/shared/champs/piece_justificative/_show.html.haml +++ b/app/views/shared/champs/piece_justificative/_show.html.haml @@ -19,6 +19,6 @@ - elsif blob.content_type.in?(AUTHORIZED_IMAGE_TYPES) = link_to image_url(blob.url), title: "#{champ.libelle} -- #{blob.filename}", data: { src: blob.url }, class: 'gallery-link' do .thumbnail - = image_tag(blob.url) + = image_tag(blob.url, loading: :lazy) .fr-btn.fr-btn--tertiary.fr-btn--icon-left.fr-icon-eye{ role: :button } = 'Visualiser'