Fix form-action CSP directive for external login (mastodon#20962)

ClearlyClaire · Nov 17, 2022 · 48e1366 · 48e1366
1 parent 4ae97a2
commit 48e1366
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/app/controllers/auth/sessions_controller.rb b/app/controllers/auth/sessions_controller.rb
@@ -14,6 +14,10 @@ class Auth::SessionsController < Devise::SessionsController
   before_action :set_instance_presenter, only: [:new]
   before_action :set_body_classes
 
+  content_security_policy only: :new do |p|
+    p.form_action(false)
+  end
+
   def check_suspicious!
     user = find_user
     @login_is_suspicious = suspicious_sign_in?(user) unless user.nil?