Merge remote-tracking branch 'upstream/pull/3644'

diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644 (file)
index 0000000..c1ad6e5
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,9 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+We welcome any reports of security vulnerabilities, and we will respond to you quickly to acknowledge receipt.
+
+To report a vulnerability please email [the maintainers using this link](mailto:tom@compton.nu;openstreetmap-website@gravitystorm.co.uk;security@openstreetmap.org). This will also notify the security team for the main deployment of this software.
+
+Please note that we do not offer any bug bounties and we do not participate in any bug programs. If your security report is validated by us, then we are happy to credit you publicly in our issue tracker, on request.

diff --git a/app/assets/javascripts/application.js b/app/assets/javascripts/application.js
index aea9e01a468df7646fd52ca3589175067c144d08..89f60847fb9261f2432051e5c2441b32b96744e9 100644 (file)
--- a/app/assets/javascripts/application.js
+++ b/app/assets/javascripts/application.js
@@ -59,7 +59,7 @@ window.updateLinks = function (loc, zoom, layers, object) {
   var editDisabled = zoom < 13;
   $("#edit_tab")
     .tooltip({ placement: "bottom" })
-    .attr("data-original-title", editDisabled ?
+    .attr("data-bs-original-title", editDisabled ?
       I18n.t("javascripts.site.edit_disabled_tooltip") : "")
     // Disable the button group and also the buttons to avoid
     // inconsistent behaviour when zooming

diff --git a/app/assets/javascripts/leaflet.key.js b/app/assets/javascripts/leaflet.key.js
index b9b7c9c04e0bb74c677a1e38396b6a2be4acc458..367c39c1462067ab74ed7fdad466b0814a5b75fa 100644 (file)
--- a/app/assets/javascripts/leaflet.key.js
+++ b/app/assets/javascripts/leaflet.key.js
@@ -62,7 +62,7 @@ L.OSM.key = function (options) {
       var disabled = ["mapnik", "cyclemap"].indexOf(map.getMapBaseLayerId()) === -1;
       button
         .toggleClass("disabled", disabled)
-        .attr("data-original-title",
+        .attr("data-bs-original-title",
               I18n.t(disabled ?
                 "javascripts.key.tooltip_disabled" :
                 "javascripts.key.tooltip"));

diff --git a/app/assets/javascripts/leaflet.layers.js b/app/assets/javascripts/leaflet.layers.js
index 676cd960780fe6741809ba3e21ca0573644313d1..038205ca4975d16e593b89d4b0278fef61062367 100644 (file)
--- a/app/assets/javascripts/leaflet.layers.js
+++ b/app/assets/javascripts/leaflet.layers.js
@@ -170,7 +170,7 @@ L.OSM.layers = function (options) {
           }
 
           $(item).attr("class", disabled ? "disabled" : "");
-          item.attr("data-original-title", disabled ?
+          item.attr("data-bs-original-title", disabled ?
             I18n.t("javascripts.site.map_" + name + "_zoom_in_tooltip") : "");
         });
       };

diff --git a/app/assets/javascripts/leaflet.note.js b/app/assets/javascripts/leaflet.note.js
index 86c4554996007bae71f9b3ac37bc7105c5b1e662..5f801096731793a376ca0c3cdf0f729c2c2312a5 100644 (file)
--- a/app/assets/javascripts/leaflet.note.js
+++ b/app/assets/javascripts/leaflet.note.js
@@ -17,7 +17,7 @@ L.OSM.note = function (options) {
       var disabled = OSM.STATUS === "database_offline" || map.getZoom() < 12;
       link
         .toggleClass("disabled", disabled)
-        .attr("data-original-title", I18n.t(disabled ?
+        .attr("data-bs-original-title", I18n.t(disabled ?
           "javascripts.site.createnote_disabled_tooltip" :
           "javascripts.site.createnote_tooltip"));
     }

diff --git a/app/assets/javascripts/leaflet.query.js b/app/assets/javascripts/leaflet.query.js
index 5f449c214a31c782f67655e319a497073d0a71c4..00292b74dbfbb3ef6262dd50e949ad50bbc63d32 100644 (file)
--- a/app/assets/javascripts/leaflet.query.js
+++ b/app/assets/javascripts/leaflet.query.js
@@ -20,7 +20,7 @@ L.OSM.query = function (options) {
           isDisabled = map.getZoom() < 14;
       link
         .toggleClass("disabled", isDisabled)
-        .attr("data-original-title", I18n.t(isDisabled ?
+        .attr("data-bs-original-title", I18n.t(isDisabled ?
           "javascripts.site.queryfeature_disabled_tooltip" :
           "javascripts.site.queryfeature_tooltip"));
 

diff --git a/app/assets/stylesheets/common.scss b/app/assets/stylesheets/common.scss
index 2682af00a40853cea4a3419c4bedd0329e73a3a7..fdf35d615d0e106981421e3d85e1701130337db9 100644 (file)
--- a/app/assets/stylesheets/common.scss
+++ b/app/assets/stylesheets/common.scss
@@ -283,7 +283,8 @@ body.compact-nav {
   margin-bottom: 10px;
   outline: none;
 
-  &:hover {
+  &:hover,
+  &:focus {
     background-color: black;
   }
 

diff --git a/app/views/browse/note.html.erb b/app/views/browse/note.html.erb
index af859651e327f1dd63205154f8812427406d4019..fb186e55e49130f1360939fe687c815cd890f300 100644 (file)
--- a/app/views/browse/note.html.erb
+++ b/app/views/browse/note.html.erb
@@ -28,10 +28,6 @@
     <p class='alert alert-warning'><%= t "javascripts.notes.show.anonymous_warning" %></p>
   <% end -%>
 
-  <% if current_user && current_user != @note.author %>
-    <p class="text-muted"><%= report_link(t(".report"), @note) %></p>
-  <% end %>
-
   <% if @note_comments.length > 1 %>
     <div class='note-comments'>
       <ul class="list-unstyled">
@@ -47,7 +43,7 @@
 
   <% if @note.status == "open" %>
     <% if current_user -%>
-      <form action="#">
+      <form class="mb-3" action="#">
         <div class="mb-3">
           <textarea class="form-control" name="text" cols="40" rows="5" maxlength="2000"></textarea>
         </div>
@@ -61,7 +57,7 @@
       </form>
     <% end -%>
   <% else %>
-    <form action="#">
+    <form class="mb-3" action="#">
       <input type="hidden" name="text" value="" autocomplete="off">
       <div class="btn-wrapper">
         <% if current_user and current_user.moderator? -%>
@@ -73,4 +69,8 @@
       </div>
     </form>
   <% end %>
+
+  <% if current_user && current_user != @note.author %>
+    <p><small class="text-muted"><%= t "javascripts.notes.show.report_link_html", :link => report_link(t(".report"), @note) %></small></p>
+  <% end %>
 </div>

diff --git a/config/locales/en.yml b/config/locales/en.yml
index 3c8f09a489d48a2d4717efa3e1214687e804a5cd..9db47674843e2e337e651e63e6656cf883fceeaa 100644 (file)
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -421,7 +421,7 @@ en:
       reopened_by_html: "Reactivated by %{user} <abbr title='%{exact_time}'>%{when}</abbr>"
       reopened_by_anonymous_html: "Reactivated by anonymous <abbr title='%{exact_time}'>%{when}</abbr>"
       hidden_by_html: "Hidden by %{user} <abbr title='%{exact_time}'>%{when}</abbr>"
-      report: Report this note
+      report: report this note
       coordinates_html: "%{latitude}, %{longitude}"
     query:
       title: "Query Features"
@@ -2883,6 +2883,7 @@ en:
         reactivate: Reactivate
         comment_and_resolve: Comment & Resolve
         comment: Comment
+        report_link_html: "If this note contains sensitive information that needs to be removed, you can %{link}. For all other problems with the note, please resolve it yourself with a comment."
     edit_help: Move the map and zoom in on a location you want to edit, then click here.
     directions:
       ascend: "Ascend"

diff --git a/test/system/site_test.rb b/test/system/site_test.rb
index 2ecc7f5a9955ac036b98036bfcdbe620160162ba..a08f7f344cd55672a935b85fc7b5af00e53f4f93 100644 (file)
--- a/test/system/site_test.rb
+++ b/test/system/site_test.rb
@@ -6,4 +6,66 @@ class SiteTest < ApplicationSystemTestCase
 
     assert_selector "h1", :text => "OpenStreetMap"
   end
+
+  test "tooltip shows for Layers button" do
+    visit "/"
+
+    assert_no_selector ".tooltip"
+    button = find ".control-layers .control-button"
+    button.hover
+    assert_selector ".tooltip", :text => "Layers"
+  end
+
+  test "tooltip shows for Map Key button on Standard layer" do
+    visit "/"
+
+    assert_no_selector ".tooltip"
+    button = find ".control-key .control-button"
+    button.hover
+    tooltip = find ".tooltip"
+    tooltip.assert_text "Map Key"
+    tooltip.assert_no_text "not available"
+  end
+
+  test "tooltip shows for Map Key button on a layer without a key provided" do
+    visit "/#layers=Y" # assumes that CyclOSM layer has no map key
+
+    assert_no_selector ".tooltip"
+    button = find ".control-key .control-button"
+    button.hover
+    tooltip = find ".tooltip"
+    tooltip.assert_text "Map Key"
+    tooltip.assert_text "not available"
+  end
+
+  test "tooltip shows for query button when zoomed in" do
+    visit "/#map=14/0/0"
+
+    assert_no_selector ".tooltip"
+    button = find ".control-query .control-button"
+    button.hover
+    tooltip = find ".tooltip"
+    tooltip.assert_text "Query features"
+    tooltip.assert_no_text "Zoom in"
+  end
+
+  test "tooltip shows for query button when zoomed out" do
+    visit "/#map=10/0/0"
+
+    assert_no_selector ".tooltip"
+    button = find ".control-query .control-button"
+    button.hover
+    tooltip = find ".tooltip"
+    tooltip.assert_text "Zoom in to query features"
+  end
+
+  test "tooltip shows for edit button when zoomed out" do
+    visit "/#map=11/0/0"
+
+    assert_no_selector ".tooltip"
+    button = find "#edit_tab"
+    button.hover
+    tooltip = find ".tooltip"
+    tooltip.assert_text "Zoom in to edit the map"
+  end
 end