From: Tom Hughes <tom@compton.nu>
Date: Wed, 16 May 2018 17:57:34 +0000 (+0100)
Subject: Merge remote-tracking branch 'upstream/pull/1866'
X-Git-Tag: live~3036
X-Git-Url: https://git.openstreetmap.org/rails.git/commitdiff_plain/9c04912f1deb7b114c61e838a6e4a4b7775167d8?hp=e1c62f1bf21fa80d5873c0a75583450ae88b16d7

Merge remote-tracking branch 'upstream/pull/1866'
---

diff --git a/app/controllers/site_controller.rb b/app/controllers/site_controller.rb
index fa8ec5a1e..50508f885 100644
--- a/app/controllers/site_controller.rb
+++ b/app/controllers/site_controller.rb
@@ -120,7 +120,7 @@ class SiteController < ApplicationController
     append_content_security_policy_directives(
       :connect_src => %w[*],
       :img_src => %w[* blob:],
-      :script_src => %w[dev.virtualearth.net 'unsafe-eval']
+      :script_src => %w[dev.virtualearth.net *.wikipedia.org www.wikidata.org 'unsafe-eval']
     )
 
     render "id", :layout => false
diff --git a/config/routes.rb b/config/routes.rb
index d750d5035..b46f92877 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -266,7 +266,7 @@ OpenStreetMap::Application.routes.draw do
   match "/message/new/:display_name" => "messages#new", :via => [:get, :post], :as => "new_message"
   get "/message/read/:message_id" => "messages#show", :as => "message"
   post "/message/mark/:message_id" => "messages#mark", :as => "mark_message"
-  get "/message/reply/:message_id" => "messages#reply", :as => "reply_message"
+  match "/message/reply/:message_id" => "messages#reply", :via => [:get, :post], :as => "reply_message"
   post "/message/delete/:message_id" => "messages#destroy", :as => "destroy_message"
 
   # oauth admin pages (i.e: for setting up new clients, etc...)
diff --git a/test/controllers/messages_controller_test.rb b/test/controllers/messages_controller_test.rb
index b7bc3bad0..b5ca0dd3a 100644
--- a/test/controllers/messages_controller_test.rb
+++ b/test/controllers/messages_controller_test.rb
@@ -32,6 +32,10 @@ class MessagesControllerTest < ActionController::TestCase
       { :path => "/message/reply/1", :method => :get },
       { :controller => "messages", :action => "reply", :message_id => "1" }
     )
+    assert_routing(
+      { :path => "/message/reply/1", :method => :post },
+      { :controller => "messages", :action => "reply", :message_id => "1" }
+    )
     assert_routing(
       { :path => "/message/delete/1", :method => :post },
       { :controller => "messages", :action => "destroy", :message_id => "1" }