Merge branch 'next-minor' into develop

Changelog.md

@@ -21,6 +21,7 @@
 * Only require AWS-module for fog [#7201](https://github.com/diaspora/diaspora/pull/7201)
 * Only show community spotlight links on the contacts page if community spotlight is enabled [#7213](https://github.com/diaspora/diaspora/pull/7213)
 * Require spec\_helper in .rspec [#7223](https://github.com/diaspora/diaspora/pull/7223)
+* Make the CSRF mail a bit more friendly [#7238](https://github.com/diaspora/diaspora/pull/7238)
 
 ## Bug fixes
 * Fix fetching comments after fetching likes [#7167](https://github.com/diaspora/diaspora/pull/7167)

config/locales/diaspora/en.yml

@@ -715,12 +715,23 @@ en:
       body: |-
         Hello %{name},
 
-        We received a request with a wrong/missing CSRF token from your account. To prevent any possible damage you have been logged out.
+        diaspora* has detected an attempt to access your session which might be unauthorised. This might be completely innocent, but it could be a cross-site request forgery (CSRF). To avoid any chance of your data being compromised, you have been signed out.
+
+        A request made using a incorrect or missing CSRF token can be caused by:
+
+          - An add-on manipulating the request or making requests without the token;
+          - A tab left open from a past session;
+          - Another website making requests, with or without your permission;
+          - Various other external tools;
+          - Malicious code trying to access your data.
 
         For more information on CSRF see [%{link}](%{link}).
 
-        Sorry,
+        Don’t worry; you can safely sign in again now.
 
+        If you see this message repeatedly, please check the points above, including any browser add-ons.
+
+        Thank you,
         The diaspora* email robot!
     report_email:
         type:

spec/mailers/notifier_spec.rb

@@ -504,7 +504,9 @@ describe Notifier, type: :mailer do
     end
 
     it "has some informative text in the body" do
-      expect(email.body.encoded).to include("https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)")
+      email.body.parts.each do |part|
+        expect(part.decoded).to include("https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)")
+      end
     end
   end