Merge branch 'pull/3024'

[rails.git] / app / controllers / users_controller.rb

diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb
index 4c5827558eeefbe7c35fd41b03fc48b2e310900b..7f12720a6efeb8c3110f3bbde92be78efb03f0bf 100644 (file)
--- a/app/controllers/users_controller.rb
+++ b/app/controllers/users_controller.rb
@@ -119,6 +119,10 @@ class UsersController < ApplicationController
   def account
     @tokens = current_user.oauth_tokens.authorized
 
+    append_content_security_policy_directives(
+      :form_action => %w[accounts.google.com *.facebook.com login.live.com github.com meta.wikimedia.org]
+    )
+
     if params[:user] && params[:user][:display_name] && params[:user][:description]
       if params[:user][:auth_provider].blank? ||
          (params[:user][:auth_provider] == current_user.auth_provider &&
@@ -344,7 +348,7 @@ class UsersController < ApplicationController
       flash[:error] = t "users.confirm_resend.failure", :name => params[:display_name]
     else
       UserMailer.signup_confirm(user, user.tokens.create).deliver_later
-      flash[:notice] = t("users.confirm_resend.success", :email => user.email, :sender => Settings.support_email).html_safe
+      flash[:notice] = t "users.confirm_resend.success_html", :email => user.email, :sender => Settings.support_email
     end
 
     redirect_to :action => "login"
@@ -648,7 +652,7 @@ class UsersController < ApplicationController
     if user.save
       session[:fingerprint] = user.fingerprint
 
-      set_locale(true)
+      set_locale(:reset => true)
 
       if user.new_email.blank? || user.new_email == user.email
         flash.now[:notice] = t "users.account.flash update success"