Fix options passed by allow_thirdparty_images

diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
index 32b53bad71c3f431d79234d65e354f6cafcf13c9..1ef49bf4629c209a6e14a61c3fc97656c5405420 100644 (file)
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -20,7 +20,7 @@ class ApplicationController < ActionController::Base
   helper_method :oauth_token
 
   def self.allow_thirdparty_images(**options)
   helper_method :oauth_token
 
   def self.allow_thirdparty_images(**options)

-    content_security_policy(options) do |policy|
+    content_security_policy(**options) do |policy|

       policy.img_src("*", :data)
     end
   end
       policy.img_src("*", :data)
     end
   end

diff --git a/test/controllers/users_controller_test.rb b/test/controllers/users_controller_test.rb
index ba1af9509e0fbfaff740a279668f9aa4d247976c..7b554711f6e7dc28f52e4d695817332aba618d65 100644 (file)
--- a/test/controllers/users_controller_test.rb
+++ b/test/controllers/users_controller_test.rb
@@ -57,6 +57,8 @@ class UsersControllerTest < ActionDispatch::IntegrationTest
     get user_new_path, :params => { :cookie_test => "true" }
     assert_response :success
 
     get user_new_path, :params => { :cookie_test => "true" }
     assert_response :success
 

+    assert_no_match(/img-src \* data:;/, @response.headers["Content-Security-Policy-Report-Only"])
+

     assert_select "html", :count => 1 do
       assert_select "head", :count => 1 do
         assert_select "title", :text => /Sign Up/, :count => 1
     assert_select "html", :count => 1 do
       assert_select "head", :count => 1 do
         assert_select "title", :text => /Sign Up/, :count => 1


@@ -297,6 +299,7 @@ class UsersControllerTest < ActionDispatch::IntegrationTest
 
     get user_path(user)
     assert_response :success
 
     get user_path(user)
     assert_response :success

+    assert_match(/img-src \* data:;/, @response.headers["Content-Security-Policy-Report-Only"])

     assert_select "div.content-heading" do
       assert_select "a[href^='/user/#{ERB::Util.u(user.display_name)}/history']", 1
       assert_select "a[href='/user/#{ERB::Util.u(user.display_name)}/traces']", 1
     assert_select "div.content-heading" do
       assert_select "a[href^='/user/#{ERB::Util.u(user.display_name)}/history']", 1
       assert_select "a[href='/user/#{ERB::Util.u(user.display_name)}/traces']", 1