cst1/openstreetmap-website
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Remove form_action restrictions for sessions#login

Browse source 
Login may redirect to ouath2_authorizations#create which may then
redirect to arbitrary schemes if the application is already authorized
so we need to allow login to redirect to any scheme.

Fixes #3424
This commit is contained in:
Tom Hughes 2022-01-17 11:01:07 +00:00
parent ff995e7ea3
commit 988d7cd90d
1 changed files with 1 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
app/controllers/sessions_controller.rb
View file

@ -12,9 +12,7 @@ class SessionsController < ApplicationController
authorize_resource :class => false authorize_resource :class => false
def new def new
append_content_security_policy_directives( override_content_security_policy_directives(:form_action => []) if Settings.csp_enforce || Settings.key?(:csp_report_url)
:form_action => %w[*]
)
session[:referer] = safe_referer(params[:referer]) if params[:referer] session[:referer] = safe_referer(params[:referer]) if params[:referer]
end end