Merge remote-tracking branch 'upstream/pull/5731'

diff --combined app/assets/javascripts/leaflet.share.js
index 9f774df7d64c878c26dd10d72957a1e3161f2cbf,42e195f0af1aa46a77053c290b484dd975234992..d84f8820e3e0a37966470cc8ac43c88bf9dabd1f
--- 1/app/assets/javascripts/leaflet.share.js
--- 2/app/assets/javascripts/leaflet.share.js
+++ b/app/assets/javascripts/leaflet.share.js
@@@ -159,7 -159,6 +159,7 @@@ L.OSM.share = function (options) 
            .attr("class", "form-select w-auto")
            .append($("<option>").val("png").text("PNG").prop("selected", true))
            .append($("<option>").val("jpeg").text("JPEG"))
 +          .append($("<option>").val("webp").text("WEBP"))
            .append($("<option>").val("svg").text("SVG"))
            .append($("<option>").val("pdf").text("PDF"))));
  
@@@ -228,13 -227,11 +228,11 @@@
          .appendTo($form);
      }
  
-     const csrf_param = $("meta[name=csrf-param]").attr("content"),
-           csrf_token = $("meta[name=csrf-token]").attr("content");
+     const csrfAttrs = { type: "hidden" };
+     [[csrfAttrs.name, csrfAttrs.value]] = Object.entries(OSM.csrf);
  
      $("<input>")
-       .attr("name", csrf_param)
-       .attr("value", csrf_token)
-       .attr("type", "hidden")
+       .attr(csrfAttrs)
        .appendTo($form);
  
      const args = {