nextcloud / nextcloud/calendar

[Bug]: Incoming federated calendar owner avatar is resolved through local /avatar endpoint and falls back incorrectly

Open
#8,150 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

1. to develop bug
Dominant language
JavaScript
Stars
1.2k
Forks
332
Avg merge
16h 13m
Merged PRs (30d)
137

Description

Bug description

For incoming federated calendars, the Calendar app appears to pass a federated remote user id into the normal local avatar endpoint. The local avatar request returns 404, and the UI then shows an incorrect dark avatar/placeholder instead of a proper fallback.

Example requested URL on the receiving instance:

/avatar/YWxpY2VAY2xvdWQtYS5leGFtcGxlLm5ldC9uZXh0Y2xvdWQ=/64/dark

The decoded identifier is a federated id like:

alice@cloud-a.example.net/nextcloud
Steps to reproduce
  1. Set up two federated Nextcloud instances.
  2. Share a calendar from user alice on instance A to user bob on instance B.
  3. Open the Calendar app on instance B.
  4. Look at the incoming shared calendar in the sidebar or calendar picker.
Expected behavior

The owner avatar for an incoming federated calendar should either:

  • render a valid remote/federated avatar, or
  • use a stable guest/placeholder avatar intentionally.

It should not rely on a local avatar lookup that is guaranteed to fail for a federated remote principal.

Actual behavior

The Calendar app requests a local avatar path for the federated id, and that request returns 404 on the receiving instance because the federated id is not a local user account.

On the affected instance:

  • /avatar/<encoded federated id>/64/dark returns 404
  • /avatar/<encoded federated id>/64/dark?guestFallback=true returns a valid generated PNG

This suggests the Calendar app is using NcAvatar with a federated principal/user id, but without handling the remote-user case.

Environment
  • Nextcloud Server: 33.0.2.2
  • Calendar app: 6.2.2
  • PHP: 8.4
  • OS: Debian 13
  • Web server: Nginx
Additional information

The current main branch still appears to render shared calendar owner avatars through NcAvatar using the owner principal's userId in places such as:

  • src/components/AppNavigation/CalendarList/CalendarListItem.vue
  • src/components/Shared/CalendarPickerOption.vue

Related issue with a similar failing /avatar/.../dark pattern:

  • #5357

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with src/components/AppNavigation/CalendarList/CalendarListItem.vue and src/components/Shared/CalendarPickerOption.vue, then trace how the federated owner principal's userId is passed to NcAvatar. Reproduce the two avatar URL behaviors described in the issue; done means an incoming federated calendar shows a valid remote avatar or an intentional stable placeholder instead of the incorrect local lookup fallback.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
frontend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.