From 201796cced984aec11422518b1ff22ac6d94a873 Mon Sep 17 00:00:00 2001 From: Anton Khorev Date: Sat, 4 Jan 2025 18:47:51 +0300 Subject: [PATCH 1/2] Fix options passed by allow_thirdparty_images --- app/controllers/application_controller.rb | 2 +- test/controllers/users_controller_test.rb | 3 +++ 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index 32b53bad71..1ef49bf462 100644 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -20,7 +20,7 @@ class ApplicationController < ActionController::Base helper_method :oauth_token def self.allow_thirdparty_images(**options) - content_security_policy(options) do |policy| + content_security_policy(**options) do |policy| policy.img_src("*", :data) end end diff --git a/test/controllers/users_controller_test.rb b/test/controllers/users_controller_test.rb index ba1af9509e..7b554711f6 100644 --- a/test/controllers/users_controller_test.rb +++ b/test/controllers/users_controller_test.rb @@ -57,6 +57,8 @@ def test_new_view get user_new_path, :params => { :cookie_test => "true" } assert_response :success + assert_no_match(/img-src \* data:;/, @response.headers["Content-Security-Policy-Report-Only"]) + assert_select "html", :count => 1 do assert_select "head", :count => 1 do assert_select "title", :text => /Sign Up/, :count => 1 @@ -297,6 +299,7 @@ def test_show get user_path(user) assert_response :success + assert_match(/img-src \* data:;/, @response.headers["Content-Security-Policy-Report-Only"]) assert_select "div.content-heading" do assert_select "a[href^='/user/#{ERB::Util.u(user.display_name)}/history']", 1 assert_select "a[href='/user/#{ERB::Util.u(user.display_name)}/traces']", 1 From 11b887c11813a2734e775c27c636d231b29ea824 Mon Sep 17 00:00:00 2001 From: Anton Khorev Date: Sun, 5 Jan 2025 09:55:48 +0300 Subject: [PATCH 2/2] Allow thirdparty images on failed diary comment saves --- app/controllers/diary_comments_controller.rb | 2 +- test/controllers/diary_comments_controller_test.rb | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/app/controllers/diary_comments_controller.rb b/app/controllers/diary_comments_controller.rb index f6597cf4c0..676bc22a66 100644 --- a/app/controllers/diary_comments_controller.rb +++ b/app/controllers/diary_comments_controller.rb @@ -13,7 +13,7 @@ class DiaryCommentsController < ApplicationController before_action :lookup_user, :only => :index before_action :check_database_writable, :only => [:create, :hide, :unhide] - allow_thirdparty_images :only => :index + allow_thirdparty_images :only => [:index, :create] def index @title = t ".title", :user => @user.display_name diff --git a/test/controllers/diary_comments_controller_test.rb b/test/controllers/diary_comments_controller_test.rb index 65a71a9b57..3ea9bc0940 100644 --- a/test/controllers/diary_comments_controller_test.rb +++ b/test/controllers/diary_comments_controller_test.rb @@ -104,6 +104,7 @@ def test_create end assert_response :success assert_template :new + assert_match(/img-src \* data:;/, @response.headers["Content-Security-Policy-Report-Only"]) # Now try again with the right id assert_difference "ActionMailer::Base.deliveries.size", entry.subscribers.count do