element-hq / element-hq/element-web

missing authentication for avatar in touchbar's recent chats

Open Beginner friendly
#34,992 1 comment 0 reactions 0 assignees View on GitHub
A-Electron A-Media O-Uncommon P4 S-Minor T-Defect
Dominant language
TypeScript
Stars
13.5k
Forks
2.8k
PR merge metrics
PR metrics pending

Description

### Steps to reproduce

Some avatar fetching requests are not properly authenticated.
I believe this is a similar reason that has been investigated and fixed in this PR: https://github.com/element-hq/element-web/pull/33997

This fetch call
https://github.com/element-hq/element-web/blob/a3dad01571f040df173ad4d3be4412899fcc2f42/apps/desktop/src/ipc.ts#L192-L197

Does not use the correct client it should use the `session` client.
The session client can be accessed using `global.mainWindow.webContents.session.fetch` or `event.sender.session.fetch` (where `event` is the first param of the callback).

What I don't understand: this is not happening for every single room, I have 100+ rooms and only 5 of them are having this problem this might be because they are old rooms with a newly uploaded avatar. I don't really know. I noticed that by reviewing the 40X logs on Synapse (which is behind a WAF and was blocking my client).

It's invisible to the client because this code is running recent chat on the touchbar, and I don't have a touchbar, so a better fix might be to skip this code if a touchbar is not available.

### Outcome

#### What did you expect?

Fetching the avatar should not raise a 404, the request should be authenticated

#### What happened instead?

The request ended up in 404, not loading the avatar.

### Operating system

mac os

### Application version

1.12.27

### How did you install the app?

dmg from https://element.io/en/download

### Homeserver

Synapse 1.154.0

### Will you send logs?

No

Contributor guide

Open the contributing guide

Research direction

Start in apps/desktop/src/ipc.ts at the avatar fetch around lines 192-197, and compare the authentication approach with PR 33997. Confirm the recent-chats touchbar request uses the appropriate session client, then verify avatar requests are authenticated and no longer return 404 responses.

Written by the indexing model from the issue text.

Assessment

Tech stack
electron, typescript
Domain
authentication, desktop
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
82/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.