From: Anton Khorev <tony29@yandex.ru>
Date: Sun, 5 Jan 2025 06:55:48 +0000 (+0300)
Subject: Allow thirdparty images on failed diary comment saves
X-Git-Tag: live~34^2
X-Git-Url: https://git.openstreetmap.org./rails.git/commitdiff_plain/11b887c11813a2734e775c27c636d231b29ea824

Allow thirdparty images on failed diary comment saves
---

diff --git a/app/controllers/diary_comments_controller.rb b/app/controllers/diary_comments_controller.rb
index f6597cf4c..676bc22a6 100644
--- a/app/controllers/diary_comments_controller.rb
+++ b/app/controllers/diary_comments_controller.rb
@@ -13,7 +13,7 @@ class DiaryCommentsController < ApplicationController
   before_action :lookup_user, :only => :index
   before_action :check_database_writable, :only => [:create, :hide, :unhide]
 
-  allow_thirdparty_images :only => :index
+  allow_thirdparty_images :only => [:index, :create]
 
   def index
     @title = t ".title", :user => @user.display_name
diff --git a/test/controllers/diary_comments_controller_test.rb b/test/controllers/diary_comments_controller_test.rb
index 65a71a9b5..3ea9bc094 100644
--- a/test/controllers/diary_comments_controller_test.rb
+++ b/test/controllers/diary_comments_controller_test.rb
@@ -104,6 +104,7 @@ class DiaryCommentsControllerTest < ActionDispatch::IntegrationTest
     end
     assert_response :success
     assert_template :new
+    assert_match(/img-src \* data:;/, @response.headers["Content-Security-Policy-Report-Only"])
 
     # Now try again with the right id
     assert_difference "ActionMailer::Base.deliveries.size", entry.subscribers.count do