Merge remote-tracking branch 'upstream/pull/5464'

diff --git a/app/assets/javascripts/index/changeset.js b/app/assets/javascripts/index/changeset.js
index 75a1f7b4dfa770463867cf7fafafbaf05babb1e3..caf40f6b6e7322ce5923e3f8b201a6a41ac73d42 100644 (file)
--- a/app/assets/javascripts/index/changeset.js
+++ b/app/assets/javascripts/index/changeset.js
@@ -1,30 +1,26 @@
 OSM.Changeset = function (map) {
   var page = {},
-      content = $("#sidebar_content"),
-      currentChangesetId;
+      content = $("#sidebar_content");
 
-  page.pushstate = page.popstate = function (path, id) {
+  page.pushstate = page.popstate = function (path) {
     OSM.loadSidebarContent(path, function () {
-      page.load(path, id);
+      page.load();
     });
   };
 
-  page.load = function (path, id) {
-    if (id) currentChangesetId = id;
-    initialize();
-    addChangeset(currentChangesetId, true);
-  };
+  page.load = function () {
+    const changesetData = content.find("[data-changeset]").data("changeset");
+    changesetData.type = "changeset";
 
-  function addChangeset(id, center) {
-    map.addObject({ type: "changeset", id: parseInt(id, 10) }, function (bounds) {
-      if (!window.location.hash && bounds.isValid() &&
-          (center || !map.getBounds().contains(bounds))) {
+    initialize();
+    map.addObject(changesetData, function (bounds) {
+      if (!window.location.hash && bounds.isValid()) {
         OSM.router.withoutMoveListener(function () {
           map.fitBounds(bounds);
         });
       }
     });
-  }
+  };
 
   function updateChangeset(method, url, include_data) {
     var data;

diff --git a/app/assets/javascripts/index/history.js b/app/assets/javascripts/index/history.js
index c6ba0c2edc9831853eedfec9f533531d71d5f341..ae8f027ed8727586f2b48d317f473f6fc8f1fe67 100644 (file)
--- a/app/assets/javascripts/index/history.js
+++ b/app/assets/javascripts/index/history.js
@@ -164,6 +164,7 @@ OSM.History = function (map) {
   page.unload = function () {
     map.removeLayer(group);
     map.off("moveend", update);
+    map.off("zoomend", updateBounds);
   };
 
   return page;

diff --git a/app/assets/javascripts/leaflet.map.js b/app/assets/javascripts/leaflet.map.js
index 6537b0b233568ada1988c56d6c215789864a8f30..5e6112fc057e16ec7566a83ea8a8e2e0b52a4680 100644 (file)
--- a/app/assets/javascripts/leaflet.map.js
+++ b/app/assets/javascripts/leaflet.map.js
@@ -267,7 +267,7 @@ L.OSM.Map = L.Map.extend({
 
     this.removeObject();
 
-    if (object.type === "note") {
+    if (object.type === "note" || object.type === "changeset") {
       this._objectLoader = {
         abort: function () {}
       };
@@ -275,18 +275,27 @@ L.OSM.Map = L.Map.extend({
       this._object = object;
       this._objectLayer = L.featureGroup().addTo(this);
 
-      L.circleMarker(object.latLng, haloStyle).addTo(this._objectLayer);
+      if (object.type === "note") {
+        L.circleMarker(object.latLng, haloStyle).addTo(this._objectLayer);
 
-      if (object.icon) {
-        L.marker(object.latLng, {
-          icon: object.icon,
-          opacity: 1,
-          interactive: true
-        }).addTo(this._objectLayer);
+        if (object.icon) {
+          L.marker(object.latLng, {
+            icon: object.icon,
+            opacity: 1,
+            interactive: true
+          }).addTo(this._objectLayer);
+        }
+      } else if (object.type === "changeset") {
+        if (object.bbox) {
+          L.rectangle([
+            [object.bbox.minlat, object.bbox.minlon],
+            [object.bbox.maxlat, object.bbox.maxlon]
+          ], changesetStyle).addTo(this._objectLayer);
+        }
       }
 
       if (callback) callback(this._objectLayer.getBounds());
-    } else { // element or changeset handled by L.OSM.DataLayer
+    } else { // element handled by L.OSM.DataLayer
       var map = this;
       this._objectLoader = $.ajax({
         url: OSM.apiUrl(object),

diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
index 32b53bad71c3f431d79234d65e354f6cafcf13c9..1ef49bf4629c209a6e14a61c3fc97656c5405420 100644 (file)
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -20,7 +20,7 @@ class ApplicationController < ActionController::Base
   helper_method :oauth_token
 
   def self.allow_thirdparty_images(**options)
-    content_security_policy(options) do |policy|
+    content_security_policy(**options) do |policy|
       policy.img_src("*", :data)
     end
   end

diff --git a/app/controllers/diary_comments_controller.rb b/app/controllers/diary_comments_controller.rb
index f6597cf4c0fac1f74fa69a2c12b9851fdc6ab4ad..676bc22a66a10306f1fc8c5f7628d40c5e7baee5 100644 (file)
--- a/app/controllers/diary_comments_controller.rb
+++ b/app/controllers/diary_comments_controller.rb
@@ -13,7 +13,7 @@ class DiaryCommentsController < ApplicationController
   before_action :lookup_user, :only => :index
   before_action :check_database_writable, :only => [:create, :hide, :unhide]
 
-  allow_thirdparty_images :only => :index
+  allow_thirdparty_images :only => [:index, :create]
 
   def index
     @title = t ".title", :user => @user.display_name

diff --git a/app/controllers/messages_controller.rb b/app/controllers/messages_controller.rb
index 26e8a5e09e6602d3a27508b8fb42a3d70b3acd5c..cc5f6c56d19dd4a6481534bc082eace36fa403ef 100644 (file)
--- a/app/controllers/messages_controller.rb
+++ b/app/controllers/messages_controller.rb
@@ -49,7 +49,7 @@ class MessagesController < ApplicationController
     elsif @message.save
       flash[:notice] = t ".message_sent"
       UserMailer.message_notification(@message).deliver_later if @message.notify_recipient?
-      redirect_to messages_inbox_path
+      redirect_to messages_outbox_path
     else
       @title = t "messages.new.title"
       render :action => "new"

diff --git a/app/helpers/changesets_helper.rb b/app/helpers/changesets_helper.rb
index ae953c5833c59c59e2b135d342f0d2c7aa2f21e5..4605658f65c0a3f1f0202cd70b7e3934adad9f96 100644 (file)
--- a/app/helpers/changesets_helper.rb
+++ b/app/helpers/changesets_helper.rb
@@ -41,4 +41,20 @@ module ChangesetsHelper
       t "changesets.index.title"
     end
   end
+
+  def changeset_data(changeset)
+    changeset_data = { :id => changeset.id }
+
+    if changeset.bbox_valid?
+      bbox = changeset.bbox.to_unscaled
+      changeset_data[:bbox] = {
+        :minlon => bbox.min_lon,
+        :minlat => bbox.min_lat,
+        :maxlon => bbox.max_lon,
+        :maxlat => bbox.max_lat
+      }
+    end
+
+    changeset_data
+  end
 end

diff --git a/app/views/changesets/_changeset.html.erb b/app/views/changesets/_changeset.html.erb
index 2a3f6585943012583e7cb94eb413d4610c8f97f2..e29cf01b012c23a81648ad69921d36ed22bcaa49 100644 (file)
--- a/app/views/changesets/_changeset.html.erb
+++ b/app/views/changesets/_changeset.html.erb
@@ -1,16 +1,4 @@
-<% changeset_data = { :id => changeset.id }
-
-   if changeset.bbox_valid?
-     bbox = changeset.bbox.to_unscaled
-     changeset_data[:bbox] = {
-       :minlon => bbox.min_lon,
-       :minlat => bbox.min_lat,
-       :maxlon => bbox.max_lon,
-       :maxlat => bbox.max_lat
-     }
-   end %>
-
-<%= tag.li :id => "changeset_#{changeset.id}", :data => { :changeset => changeset_data }, :class => "list-group-item list-group-item-action" do %>
+<%= tag.li :id => "changeset_#{changeset.id}", :data => { :changeset => changeset_data(changeset) }, :class => "list-group-item list-group-item-action" do %>
   <p class="fs-6 text-truncate text-wrap">
     <a class="changeset_id link-body-emphasis stretched-link" href="<%= changeset_path(changeset) %>">
       <span><%= changeset.tags["comment"].to_s.presence || t("browse.no_comment") %></span>

diff --git a/app/views/changesets/show.html.erb b/app/views/changesets/show.html.erb
index a47049e999620a70effb50d2d5edb0a30db41229..167bcb5cb807d5fc2d147a049853b2284125d25b 100644 (file)
--- a/app/views/changesets/show.html.erb
+++ b/app/views/changesets/show.html.erb
@@ -6,7 +6,9 @@
   <p class="fs-6 overflow-x-auto">
     <%= linkify(@changeset.tags["comment"].to_s.presence || t("browse.no_comment")) %>
   </p>
-  <p class="details"><%= changeset_details(@changeset) %></p>
+  <%= tag.p :class => "details", :data => { :changeset => changeset_data(@changeset) } do %>
+    <%= changeset_details(@changeset) %>
+  <% end %>
 
   <%= render :partial => "browse/tag_details", :object => @changeset.tags.except("comment") %>
 

diff --git a/test/controllers/diary_comments_controller_test.rb b/test/controllers/diary_comments_controller_test.rb
index 65a71a9b57b05d8f4eda9c53a4f535d143d270b5..3ea9bc09400d5334d3a80044d68089736591b427 100644 (file)
--- a/test/controllers/diary_comments_controller_test.rb
+++ b/test/controllers/diary_comments_controller_test.rb
@@ -104,6 +104,7 @@ class DiaryCommentsControllerTest < ActionDispatch::IntegrationTest
     end
     assert_response :success
     assert_template :new
+    assert_match(/img-src \* data:;/, @response.headers["Content-Security-Policy-Report-Only"])
 
     # Now try again with the right id
     assert_difference "ActionMailer::Base.deliveries.size", entry.subscribers.count do

diff --git a/test/controllers/messages_controller_test.rb b/test/controllers/messages_controller_test.rb
index 9249908929426d32086ee4297f41d1cacf6198e1..b2bb71b1c71e8b1484983d9956f89487b55d5d21 100644 (file)
--- a/test/controllers/messages_controller_test.rb
+++ b/test/controllers/messages_controller_test.rb
@@ -163,7 +163,7 @@ class MessagesControllerTest < ActionDispatch::IntegrationTest
         end
       end
     end
-    assert_redirected_to messages_inbox_path
+    assert_redirected_to messages_outbox_path
     assert_equal "Message sent", flash[:notice]
     e = ActionMailer::Base.deliveries.first
     assert_equal [recipient_user.email], e.to

diff --git a/test/controllers/users_controller_test.rb b/test/controllers/users_controller_test.rb
index ba1af9509e0fbfaff740a279668f9aa4d247976c..7b554711f6e7dc28f52e4d695817332aba618d65 100644 (file)
--- a/test/controllers/users_controller_test.rb
+++ b/test/controllers/users_controller_test.rb
@@ -57,6 +57,8 @@ class UsersControllerTest < ActionDispatch::IntegrationTest
     get user_new_path, :params => { :cookie_test => "true" }
     assert_response :success
 
+    assert_no_match(/img-src \* data:;/, @response.headers["Content-Security-Policy-Report-Only"])
+
     assert_select "html", :count => 1 do
       assert_select "head", :count => 1 do
         assert_select "title", :text => /Sign Up/, :count => 1
@@ -297,6 +299,7 @@ class UsersControllerTest < ActionDispatch::IntegrationTest
 
     get user_path(user)
     assert_response :success
+    assert_match(/img-src \* data:;/, @response.headers["Content-Security-Policy-Report-Only"])
     assert_select "div.content-heading" do
       assert_select "a[href^='/user/#{ERB::Util.u(user.display_name)}/history']", 1
       assert_select "a[href='/user/#{ERB::Util.u(user.display_name)}/traces']", 1