Skip to content
This repository was archived by the owner on Apr 26, 2024. It is now read-only.
Merged
Show file tree
Hide file tree
Changes from 2 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
File renamed without changes.
17 changes: 11 additions & 6 deletions synapse/push/mailer.py
Original file line number Diff line number Diff line change
Expand Up @@ -356,18 +356,13 @@ async def _get_room_vars(

room_name = await calculate_room_name(self.store, room_state_ids, user_id)

avatar_event = await self.store.get_event(
room_state_ids[(EventTypes.RoomAvatar, "")]
)
avatar_url = avatar_event.content.get("url")

room_vars: Dict[str, Any] = {
"title": room_name,
"hash": string_ordinal_total(room_id), # See sender avatar hash
"notifs": [],
"invite": is_invite,
"link": self._make_room_link(room_id),
"avatar_url": avatar_url,
"avatar_url": await self._get_room_avatar(room_state_ids),
}

if not is_invite:
Expand Down Expand Up @@ -399,6 +394,16 @@ async def _get_room_vars(

return room_vars

async def _get_room_avatar(
self,
room_state_ids: StateMap[str],
) -> Optional[str]:
event_id = room_state_ids.get((EventTypes.RoomAvatar, ""))
if event_id:
ev = await self.store.get_event(event_id)
return ev.content["url"]
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is untrusted, so there's no guarantee that this will have a url (or that it will be a string).

I also wonder if it makes sense to use the thumbnail_url instead?

Regardless, we'll need to convert the MXC URL to an HTTP one, I believe.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Regardless, we'll need to convert the MXC URL to an HTTP one, I believe.

I think this is already done in the jinja template room.html:

                <img alt="" src="{{ room.avatar_url|mxc_to_http(48,48) }}" />

where I'm guessing that pipe will feed the LHS into the mxc_to_http_filter defined in synapse/util/templates.py:85

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah-ha! I forgot we did this in the template!

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is untrusted, so there's no guarantee that this will have a url (or that it will be a string).

The spec says that "url" is required---but I guess we don't enforce that at present? Can do an isintance(..., str) check on the URL though.

I also wonder if it makes sense to use the thumbnail_url instead?

Spec says that this is "Only present if the thumbnail is unencrypted.". But I'm not sure if the main avatar could be encrypted too?

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is untrusted, so there's no guarantee that this will have a url (or that it will be a string).

The spec says that "url" is required---but I guess we don't enforce that at present? Can do an isintance(..., str) check on the URL though.

In general, event content can be whatever. So I don't think we can assume it is there / the right type. Even if we enforce it, an event could come over federation that has the incorrect shape. (Or it could have been redacted so all event content was removed.)

return None

async def _get_notif_vars(
self,
notif: Dict[str, Any],
Expand Down