element-hq / element-hq/element-web
missing authentication for avatar in touchbar's recent chats
- Dominant language
- TypeScript
- Stars
- 13.5k
- Forks
- 2.8k
- PR merge metrics
- PR metrics pending
Description
### Steps to reproduce
Some avatar fetching requests are not properly authenticated.
I believe this is a similar reason that has been investigated and fixed in this PR: https://github.com/element-hq/element-web/pull/33997
This fetch call
https://github.com/element-hq/element-web/blob/a3dad01571f040df173ad4d3be4412899fcc2f42/apps/desktop/src/ipc.ts#L192-L197
Does not use the correct client it should use the `session` client.
The session client can be accessed using `global.mainWindow.webContents.session.fetch` or `event.sender.session.fetch` (where `event` is the first param of the callback).
What I don't understand: this is not happening for every single room, I have 100+ rooms and only 5 of them are having this problem this might be because they are old rooms with a newly uploaded avatar. I don't really know. I noticed that by reviewing the 40X logs on Synapse (which is behind a WAF and was blocking my client).
It's invisible to the client because this code is running recent chat on the touchbar, and I don't have a touchbar, so a better fix might be to skip this code if a touchbar is not available.
### Outcome
#### What did you expect?
Fetching the avatar should not raise a 404, the request should be authenticated
#### What happened instead?
The request ended up in 404, not loading the avatar.
### Operating system
mac os
### Application version
1.12.27
### How did you install the app?
dmg from https://element.io/en/download
### Homeserver
Synapse 1.154.0
### Will you send logs?
No
Contributor guide
Research direction
Start in apps/desktop/src/ipc.ts at the avatar fetch around lines 192-197, and compare the authentication approach with PR 33997. Confirm the recent-chats touchbar request uses the appropriate session client, then verify avatar requests are authenticated and no longer return 404 responses.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- electron, typescript
- Domain
- authentication, desktop
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 82/100