From: Tom Hughes <tom@compton.nu>
Date: Fri, 10 May 2024 16:49:05 +0000 (+0100)
Subject: Merge remote-tracking branch 'upstream/pull/4779'
X-Git-Tag: live~1029
X-Git-Url: https://git.openstreetmap.org./rails.git/commitdiff_plain/bac40c94e4327ab4f41cc9723d5af1b1e3f43ea7?hp=b4f719a8c58c5177fe3dbc330fc90b3e0ef94c4c

Merge remote-tracking branch 'upstream/pull/4779'
---

diff --git a/app/controllers/accounts_controller.rb b/app/controllers/accounts_controller.rb
index db9721010..1f1cc577a 100644
--- a/app/controllers/accounts_controller.rb
+++ b/app/controllers/accounts_controller.rb
@@ -17,7 +17,7 @@ class AccountsController < ApplicationController
     @tokens = current_user.oauth_tokens.authorized
 
     append_content_security_policy_directives(
-      :form_action => %w[accounts.google.com *.facebook.com login.live.com github.com meta.wikimedia.org]
+      :form_action => %w[accounts.google.com *.facebook.com login.live.com login.microsoftonline.com github.com meta.wikimedia.org]
     )
 
     if errors = session.delete(:user_errors)
@@ -32,7 +32,7 @@ class AccountsController < ApplicationController
     @tokens = current_user.oauth_tokens.authorized
 
     append_content_security_policy_directives(
-      :form_action => %w[accounts.google.com *.facebook.com login.live.com github.com meta.wikimedia.org]
+      :form_action => %w[accounts.google.com *.facebook.com login.live.com login.microsoftonline.com github.com meta.wikimedia.org]
     )
 
     user_params = params.require(:user).permit(:display_name, :new_email, :pass_crypt, :pass_crypt_confirmation, :auth_provider)
diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb
index 06df8f2be..417991292 100644
--- a/app/controllers/users_controller.rb
+++ b/app/controllers/users_controller.rb
@@ -63,7 +63,7 @@ class UsersController < ApplicationController
     parse_oauth_referer @referer
 
     append_content_security_policy_directives(
-      :form_action => %w[accounts.google.com *.facebook.com login.live.com github.com meta.wikimedia.org]
+      :form_action => %w[accounts.google.com *.facebook.com login.live.com login.microsoftonline.com github.com meta.wikimedia.org]
     )
 
     if current_user