fix(security): forwarding encrypted media to a plaintext room re-uploads it

buildForwardContent copied content.file (AES key/iv/hashes) verbatim, so
forwarding from an E2EE room into an unencrypted one published the key.
For unencrypted destinations the attachment is now downloaded, decrypted
and re-uploaded as plaintext (url instead of file, thumbnail key
stripped); if that fails the forward is refused rather than leaking.
Encrypted destinations unchanged. Needs a manual check on a live
encrypted -> plaintext forward.

Fixes #63

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA

src/app/features/room/message/ForwardMessageDialog.tsx

@@ -42,7 +42,7 @@ import {
   recentForwardTargetsAtom,
   addRecentForwardTarget,
 } from '../../../state/recentForwardTargets';
-import { buildForwardContent } from './forwardContent';
+import { buildForwardContent, buildPlaintextAttachmentContent } from './forwardContent';
 
 type RoomRowProps = {
   room: Room;
@@ -314,12 +314,43 @@ export function ForwardMessageDialog({ mEvent, onClose }: Props) {
     setError(null);
 
     const ids = [...selectedRoomIds];
+
+    // `fwdContent.file` (present on encrypted attachments) carries the AES key/iv
+    // needed to decrypt it. Sending it as-is into a room that isn't encrypted would
+    // publish that key in plaintext (Gitea #63), so any unencrypted destination gets
+    // a decrypted-and-re-uploaded plaintext version instead. Built once (not per
+    // room) since every unencrypted destination gets the same re-upload.
+    let plaintextContent: Record<string, unknown> | undefined;
+    let plaintextContentError: string | undefined;
+    if (fwdContent.file) {
+      const needsPlaintext = ids.some((id) => !mx.getRoom(id)?.hasEncryptionStateEvent());
+      if (needsPlaintext) {
+        try {
+          plaintextContent = await buildPlaintextAttachmentContent(
+            mx,
+            fwdContent,
+            useAuthentication,
+          );
+        } catch {
+          plaintextContentError = 'Could not prepare this attachment for an unencrypted room.';
+        }
+      }
+    }
+
     const commentBody = comment.trim();
     const results = await Promise.allSettled(
       ids.map((id) => {
+        const destEncrypted = !!mx.getRoom(id)?.hasEncryptionStateEvent();
+        // Encrypted destinations keep the original (possibly encrypted-attachment)
+        // content; unencrypted ones get the plaintext version, or fail outright if
+        // that couldn't be built — never fall back to sending the encrypted `file`.
+        const contentToSend = fwdContent.file && !destEncrypted ? plaintextContent : fwdContent;
+        if (fwdContent.file && !destEncrypted && !contentToSend) {
+          return Promise.reject(new Error(plaintextContentError));
+        }
         // threadId-aware overload (P3-8): explicit null = send to the main timeline.
         // eslint-disable-next-line @typescript-eslint/no-explicit-any
-        const sendForward = () => mx.sendEvent(id, null, mEvent.getType() as any, fwdContent);
+        const sendForward = () => mx.sendEvent(id, null, mEvent.getType() as any, contentToSend);
         // Send the optional comment first so it reads as a note above the
         // forwarded content. The room counts as failed if either send rejects.
         // Track rooms whose comment already landed so a retry (after the FORWARD
@@ -370,7 +401,7 @@ export function ForwardMessageDialog({ mEvent, onClose }: Props) {
       return;
     }
     setError(`Forwarded to ${succeeded}/${total}. Failed: ${failedNames.join(', ')}.`);
-  }, [mx, mEvent, onClose, sending, selectedRoomIds, comment, setRecents]);
+  }, [mx, mEvent, onClose, sending, selectedRoomIds, comment, setRecents, useAuthentication]);
 
   return (
     <Overlay open backdrop={<OverlayBackdrop />}>