RocketChat / RocketChat/Rocket.Chat

Livechat agent's avatar is not shown when unauthenticated avatar access is blocked.

Open
#17,819 5 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

triaged type: bug
Dominant language
TypeScript
Stars
46.1k
Forks
13.9k
Avg merge
3d 3h
Merged PRs (30d)
130

Description

Description

When public access to avatars is blocked (as according to the log is going to be the default soon, livechat agents have no avatars). Perhaps there could be a regular profile avatar to which access is blocked, and a secondary avatar for livechat agent activity to which public access is granted?

Steps to reproduce
  1. Go to Adminstration, Accounts, Avatar. Toggle "Block Unauthenticated Access to Avatars".
  2. If it's on, the livechat agent's avatar appears as a black square, else it is visible. Make sure to clean your browsers cache, or else the picture might still be visible after toggling on blocking.
  3. Check the log. It reads "The server detected an unauthenticated access to an user avatar. This type of request will soon be blocked by default."
Expected behavior

The following sections must not be removed, or else the BOT will close it immediately again:

Actual behavior

The following sections must not be removed, or else the BOT will close it immediately again:

Server Setup Information

The following sections must not be removed, or else the BOT will close it immediately again:

Version of Rocket.Chat Server

3.3.0

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No files or tests are named. Reproduce the issue from Administration > Accounts > Avatar with unauthenticated avatar access blocked, then trace the livechat agent avatar entry point and the access-denial log. Done means the agent avatar displays under the blocked setting without causing an unauthenticated avatar access warning.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
authentication, frontend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.