From b07c75834570bc8a4189b95dd320b5b95ae97d41 Mon Sep 17 00:00:00 2001 From: Milan Cvetkovic Date: Fri, 10 May 2024 14:11:12 +0000 Subject: [PATCH] Fix CSP failures for Microsoft social sign-in Replace login.live.com with login.microsoftonline.com in CSP allow list. The URL changed with the move from using the omniauth-windowslive plugin to the omniauth-microsoft_graph plugin but wasn't noticed until now. --- app/controllers/accounts_controller.rb | 4 ++-- app/controllers/users_controller.rb | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/app/controllers/accounts_controller.rb b/app/controllers/accounts_controller.rb index db9721010..1f1cc577a 100644 --- a/app/controllers/accounts_controller.rb +++ b/app/controllers/accounts_controller.rb @@ -17,7 +17,7 @@ class AccountsController < ApplicationController @tokens = current_user.oauth_tokens.authorized append_content_security_policy_directives( - :form_action => %w[accounts.google.com *.facebook.com login.live.com github.com meta.wikimedia.org] + :form_action => %w[accounts.google.com *.facebook.com login.live.com login.microsoftonline.com github.com meta.wikimedia.org] ) if errors = session.delete(:user_errors) @@ -32,7 +32,7 @@ class AccountsController < ApplicationController @tokens = current_user.oauth_tokens.authorized append_content_security_policy_directives( - :form_action => %w[accounts.google.com *.facebook.com login.live.com github.com meta.wikimedia.org] + :form_action => %w[accounts.google.com *.facebook.com login.live.com login.microsoftonline.com github.com meta.wikimedia.org] ) user_params = params.require(:user).permit(:display_name, :new_email, :pass_crypt, :pass_crypt_confirmation, :auth_provider) diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb index 06df8f2be..417991292 100644 --- a/app/controllers/users_controller.rb +++ b/app/controllers/users_controller.rb @@ -63,7 +63,7 @@ class UsersController < ApplicationController parse_oauth_referer @referer append_content_security_policy_directives( - :form_action => %w[accounts.google.com *.facebook.com login.live.com github.com meta.wikimedia.org] + :form_action => %w[accounts.google.com *.facebook.com login.live.com login.microsoftonline.com github.com meta.wikimedia.org] ) if current_user -- 2.39.5