From 9d84f9153a1df46d1a294742f48553554ff2c84f Mon Sep 17 00:00:00 2001
From: Jared Vititoe <jjvititoe1@gmail.com>
Date: Fri, 18 Sep 2026 00:47:37 -0400
Subject: [PATCH] =?UTF-8?q?fix(invite):=20the=20header=20Invite=20dialog's?=
 =?UTF-8?q?=20QR=20was=20still=20fetched=20from=20api.qrserver.com=20?=
 =?UTF-8?q?=E2=80=94=20render=20it=20locally=20(#192)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

a899d7d3 moved the Room Settings share QR to qrcode.react but the
InviteUserPrompt (header ⋮ → Invite, Room Intro, space menu) kept the
third-party <img>, which leaked the room link and — since the prod CSP
img-src no longer allows that host — rendered as a broken image. Same
QRCodeSVG + white quiet zone as RoomShareInvite. Verified with
Playwright: SVG present, no remote <img>, zero external requests.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA
---
 .../invite-user-prompt/InviteUserPrompt.tsx   | 27 ++++++++++++++-----
 1 file changed, 20 insertions(+), 7 deletions(-)

diff --git a/src/app/components/invite-user-prompt/InviteUserPrompt.tsx b/src/app/components/invite-user-prompt/InviteUserPrompt.tsx
index c9bab43a0..4e96d985f 100644
--- a/src/app/components/invite-user-prompt/InviteUserPrompt.tsx
+++ b/src/app/components/invite-user-prompt/InviteUserPrompt.tsx
@@ -33,6 +33,7 @@ import {
 import { Room } from 'matrix-js-sdk';
 import { isKeyHotkey } from 'is-hotkey';
 import FocusTrap from 'focus-trap-react';
+import { QRCodeSVG } from 'qrcode.react';
 import { stopPropagation } from '../../utils/keyboard';
 import { useDirectUsers } from '../../hooks/useDirectUsers';
 import {
@@ -237,13 +238,25 @@ export function InviteUserPrompt({ room, requestClose }: InviteUserProps) {
                     borderBottom: `1px solid ${color.Surface.ContainerLine}`,
                   }}
                 >
-                  <img
-                    src={`https://api.qrserver.com/v1/create-qr-code/?size=180x180&data=${encodeURIComponent(inviteUrl)}`}
-                    alt="QR code for room invite link"
-                    width={180}
-                    height={180}
-                    style={{ display: 'block', borderRadius: config.radii.R300 }}
-                  />
+                  {/* Generated locally (qrcode.react) like RoomShareInvite — the
+                      old api.qrserver.com <img> leaked the room link to a third
+                      party and is blocked by the prod CSP img-src anyway
+                      (Gitea #192). White quiet-zone so it scans on any theme. */}
+                  <Box
+                    style={{
+                      padding: config.space.S200,
+                      background: '#ffffff',
+                      borderRadius: config.radii.R300,
+                      lineHeight: 0,
+                    }}
+                  >
+                    <QRCodeSVG
+                      value={inviteUrl}
+                      size={164}
+                      level="M"
+                      title="QR code for room invite link"
+                    />
+                  </Box>
                   <Text
                     size="T200"
                     style={{ opacity: 0.6, wordBreak: 'break-all', textAlign: 'center' }}