nextcloud / nextcloud/calendar
[Bug]: Incoming federated calendar owner avatar is resolved through local /avatar endpoint and falls back incorrectly
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 1.2k
- Forks
- 332
- Avg merge
- 16h 13m
- Merged PRs (30d)
- 137
Description
Bug description
For incoming federated calendars, the Calendar app appears to pass a federated remote user id into the normal local avatar endpoint. The local avatar request returns 404, and the UI then shows an incorrect dark avatar/placeholder instead of a proper fallback.
Example requested URL on the receiving instance:
/avatar/YWxpY2VAY2xvdWQtYS5leGFtcGxlLm5ldC9uZXh0Y2xvdWQ=/64/dark
The decoded identifier is a federated id like:
alice@cloud-a.example.net/nextcloud
Steps to reproduce
- Set up two federated Nextcloud instances.
- Share a calendar from user
aliceon instance A to userbobon instance B. - Open the Calendar app on instance B.
- Look at the incoming shared calendar in the sidebar or calendar picker.
Expected behavior
The owner avatar for an incoming federated calendar should either:
- render a valid remote/federated avatar, or
- use a stable guest/placeholder avatar intentionally.
It should not rely on a local avatar lookup that is guaranteed to fail for a federated remote principal.
Actual behavior
The Calendar app requests a local avatar path for the federated id, and that request returns 404 on the receiving instance because the federated id is not a local user account.
On the affected instance:
/avatar/<encoded federated id>/64/darkreturns404/avatar/<encoded federated id>/64/dark?guestFallback=truereturns a valid generated PNG
This suggests the Calendar app is using NcAvatar with a federated principal/user id, but without handling the remote-user case.
Environment
- Nextcloud Server: 33.0.2.2
- Calendar app: 6.2.2
- PHP: 8.4
- OS: Debian 13
- Web server: Nginx
Additional information
The current main branch still appears to render shared calendar owner avatars through NcAvatar using the owner principal's userId in places such as:
src/components/AppNavigation/CalendarList/CalendarListItem.vuesrc/components/Shared/CalendarPickerOption.vue
Related issue with a similar failing /avatar/.../dark pattern:
- #5357
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with src/components/AppNavigation/CalendarList/CalendarListItem.vue and src/components/Shared/CalendarPickerOption.vue, then trace how the federated owner principal's userId is passed to NcAvatar. Reproduce the two avatar URL behaviors described in the issue; done means an incoming federated calendar shows a valid remote avatar or an intentional stable placeholder instead of the incorrect local lookup fallback.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- frontend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100