If the widget fails to terminate in two seconds, proceed with disposing
the iframe nevertheless.
This allows e.g. Jitsi to hangup the conference when minimizing the
widget, instead of abrupt disconnect that can leave ghost users behind.
Signed-off-by: Pauli Virtanen <pav@iki.fi>
Just a minor thing that is bothersome. Renaming classes and functions is a bit more of an impact than is worth right now, so have settled for littering TODO comments all over the place.
Fixes https://github.com/vector-im/riot-web/issues/13131
Widgets can request an OpenID token to authenticate the user when the widget is missing authentication information. A common case for this is the Dimension sticker picker: sometimes the Riot is running in doesn't have the configuration to match the Dimension instance, so Riot rightly refuses to send an auth token to the widget. When this happens, it requests a token through postMessage().
There's a toggle on the permission dialog to remember the setting, which is the widget's security key. As an added measure, the security key generation ensures the widget URL matches as the 'remember this choice' toggle will silently work in the background, and it could be dangerous if the widget's URL changed and Riot secretly allows the widget to identify the user. This check was failing because the WidgetMessaging class was being set up with the rendered URL, which will not match the widget's URL at all. To fix this, we simply use the widget's URL to set up the messaging, which by proxy uses the right URL in calculating the security key.
Move the URL processing into AppTile so that the widget can have a
URL used for embedding in the page and a separate one for popping
out into a browser.
This fixes a common React warning we see. Most of these components should be using constructors instead, however componentDidMount is just as good (and doesn't require converting most of these).
Conversion to classes will be done in a later stage of React warning fixes.
For https://github.com/vector-im/riot-web/issues/12877
This doesn't have any backwards compatibility with anyone who has already clicked "Allow". We kinda want everyone to read the new prompt, so what better way to do it than effectively revoke all widget permissions?
Part of https://github.com/vector-im/riot-web/issues/11262
Part 1 of https://github.com/vector-im/riot-web/issues/11262
This is all the visual changes - the actual wiring of the UI to the right places is for another PR (though this PR still works independently).
The help icon is known to be weird here - it's a bug in the svg we have. The tooltip also goes right instead of up because making the tooltip go up is not easy work for this PR - maybe a future one if we *really* want it to go up.
Due to commit ffa49df889
the parameters for the call to open a widget in edit mode from the
widget panel in a room has broken. The `screen` parameter needs
to be prefixed with `type_` as it was before.
This corresponds to parameters supplied when creating the URL when
opening a widget in edit mode through Scalar screens.
Signed-off-by: Jason Robinson <jasonr@matrix.org>
This defers the work to request the IM token when displaying a widget until
after we know that widget will actually be shown and the user has granted
permission for this widget to be displayed.
This is useful in general to avoid making unnecessary token checks, but it's
particularly helpful with the new Terms API, so that we only show the Terms flow
when widget are actually being used (as opposed to entering the room where
widgets exist, but haven't been shown / permitted).
Part of https://github.com/vector-im/riot-web/issues/10088
When setting, delete the old one. Because delete checks if it exists first, we can safely call this.
The change in FromWidgetPostMessageApi is just something noticed while debugging.
Having the referrer allows widgets to do customisation based on what
riot instance is embedding it. It gets a referrer when we embed it
in the iframe so there's nothing gained by suppressing it here.
Fixes https://github.com/vector-im/riot-web/issues/6437
This also fixes a bug where if the room had apps open and you clicked the sticker picker's title, you'd end up closing the apps and not the picker.
Fixes a bug for some widgets where they cannot do their startup routine (capabilities negotiation, etc) when someone maximizes the widget. By reloading the widget messaging, we ensure the widget is kept in the loop.
Since Scalar (and other integration managers) are loaded as apps into
an iframe, a valid `scalar_token` must exist when loading the app.
It is possible that a scalar_token becomes invalid between the time
when the integration manager button was rendered and the user clicking
the link. Here we make a call to integration manager `/account`
before trying to render the integration manager, which ensures we
have a valid token for the integration manager to work with.
Moving the scalar token revalidation to the cases where it is actually
needed could make it possible to decrease the amount of Scalar /account
calls we do when switching rooms, which is currently 3.
Signed-off-by: Jason Robinson <jasonr@matrix.org>
This allows Webpack to insert the proper image URL after builds steps like
adding a hash and so on. The path you supply to `require` is relative to the JS
source file, just like any other would be.
Michael Telatynski