Allow redirects to authentication services from the settings page
authorTom Hughes <tom@compton.nu>
Thu, 29 Oct 2020 21:25:47 +0000 (21:25 +0000)
committerTom Hughes <tom@compton.nu>
Thu, 29 Oct 2020 21:29:35 +0000 (21:29 +0000)
Chrome and Safari require redirects to match the form-action rule
as well as the original submission address.

app/controllers/users_controller.rb

index cb92af8fbb217443aadb748c06b59c90158bbcab..288fb2d5ca547ce08d29de3dbe4db0739def7863 100644 (file)
@@ -119,6 +119,10 @@ class UsersController < ApplicationController
   def account
     @tokens = current_user.oauth_tokens.authorized
 
+    append_content_security_policy_directives(
+      :form_action => %w[accounts.google.com *.facebook.com login.live.com github.com meta.wikimedia.org]
+    )
+
     if params[:user] && params[:user][:display_name] && params[:user][:description]
       if params[:user][:auth_provider].blank? ||
          (params[:user][:auth_provider] == current_user.auth_provider &&