From: Tom Hughes Date: Fri, 10 May 2024 16:55:11 +0000 (+0100) Subject: Really remove login.live.com from CSP allow list X-Git-Tag: live~499 X-Git-Url: https://git.openstreetmap.org./rails.git/commitdiff_plain/ebb1fba41db203fb05d2f35c62b774dd4534a021?ds=sidebyside Really remove login.live.com from CSP allow list --- diff --git a/app/controllers/accounts_controller.rb b/app/controllers/accounts_controller.rb index 1f1cc577a..6b47ca666 100644 --- a/app/controllers/accounts_controller.rb +++ b/app/controllers/accounts_controller.rb @@ -17,7 +17,7 @@ class AccountsController < ApplicationController @tokens = current_user.oauth_tokens.authorized append_content_security_policy_directives( - :form_action => %w[accounts.google.com *.facebook.com login.live.com login.microsoftonline.com github.com meta.wikimedia.org] + :form_action => %w[accounts.google.com *.facebook.com login.microsoftonline.com github.com meta.wikimedia.org] ) if errors = session.delete(:user_errors) @@ -32,7 +32,7 @@ class AccountsController < ApplicationController @tokens = current_user.oauth_tokens.authorized append_content_security_policy_directives( - :form_action => %w[accounts.google.com *.facebook.com login.live.com login.microsoftonline.com github.com meta.wikimedia.org] + :form_action => %w[accounts.google.com *.facebook.com login.microsoftonline.com github.com meta.wikimedia.org] ) user_params = params.require(:user).permit(:display_name, :new_email, :pass_crypt, :pass_crypt_confirmation, :auth_provider) diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb index 417991292..2cdec642d 100644 --- a/app/controllers/users_controller.rb +++ b/app/controllers/users_controller.rb @@ -63,7 +63,7 @@ class UsersController < ApplicationController parse_oauth_referer @referer append_content_security_policy_directives( - :form_action => %w[accounts.google.com *.facebook.com login.live.com login.microsoftonline.com github.com meta.wikimedia.org] + :form_action => %w[accounts.google.com *.facebook.com login.microsoftonline.com github.com meta.wikimedia.org] ) if current_user