Extend form-action policies for Chrome

It seems that unlike other browsers Chrome requires that if a form
submission redirects that the redirected URL also match the form-action
policy rather than just requiring the original URL to match.

diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
index 9d7642eab205e0b1f36b593e18c1a15862ae6ee1..db5d086ecbf088c06c7e4f850299329ee8be1068 100644 (file)
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -415,6 +415,7 @@ class ApplicationController < ActionController::Base
     append_content_security_policy_directives(
       :child_src => %w[127.0.0.1:8111 127.0.0.1:8112],
       :connect_src => %w[nominatim.openstreetmap.org overpass-api.de router.project-osrm.org valhalla.mapzen.com],
+      :form_action => %w[render.openstreetmap.org],
       :script_src => %w[graphhopper.com open.mapquestapi.com],
       :img_src => %w[developer.mapquest.com]
     )

diff --git a/app/controllers/oauth_controller.rb b/app/controllers/oauth_controller.rb
index 4bb129ba442c16bf4df6cd1758a866f4f04dcdc6..734783a35eef61f4df429abfee6b1aa2fd9facf8 100644 (file)
--- a/app/controllers/oauth_controller.rb
+++ b/app/controllers/oauth_controller.rb
@@ -38,6 +38,8 @@ class OauthController < ApplicationController
   protected
 
   def oauth1_authorize
+    append_content_security_policy_directives(:form_action => %w[*])
+
     if @token.invalidated?
       @message = t "oauth.oauthorize_failure.invalid"
       render :action => "authorize_failure"

diff --git a/app/controllers/user_controller.rb b/app/controllers/user_controller.rb
index b3a1ddda8fbf231ea987cc8a6bd27ef38fc00049..5c41a79dc84da7f336d7ed0152094571c0e0fe8a 100644 (file)
--- a/app/controllers/user_controller.rb
+++ b/app/controllers/user_controller.rb
@@ -203,6 +203,10 @@ class UserController < ApplicationController
     @title = t "user.new.title"
     @referer = params[:referer] || session[:referer]
 
+    append_content_security_policy_directives(
+      :form_action => %w[accounts.google.com *.facebook.com login.live.com github.com meta.wikimedia.org]
+    )
+
     if current_user
       # The user is logged in already, so don't show them the signup
       # page, instead send them to the home page