4 Commits

Include renames

Author	SHA1	Message	Date
Lotus CIandClaude Opus 5.5	14f05a3d5c	fix(security): widget consents and shared files cleared on logout; forged shares refused (#266, #267) ... #266: remembered widget approvals (lotus.widgetConsent.*) survived logout, so they applied silently to the next account on the device and listed the previous account's rooms; clearPlaintextCaches now sweeps them. Space structure, call membership and Lotus room-policy state join PROTECTED_STATE_TYPES, so no widget can be granted them. #267: any website could auto-submit a form to /share-target and land the user in the share picker with attacker-chosen text and files. The worker now refuses a share whose Origin is another site. (Sec-Fetch-Site, as the issue suggested, never reaches a service worker: checked in Chromium.) Origin null/absent, as the OS share sheet sends, stays accepted, and /share now says the content came from another app or website. Both logout paths await clearSharedPayload(); the server-forced one also clears the soundboard clip cache, as #57 intended. Fixes #266 Fixes #267 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-19 14:47:11 -04:00
Lotus CIandClaude Opus 5.5	a4a163df3d	fix(rooms): "Rename for me" names in Ctrl+K, forward/share pickers and notifications (#336) ... The personal room name (io.lotus.room_names) was only used by the sidebar, header, intro and call bar; the quick switcher couldn't find a room by it ("No match found") and showed the server name, as did the forward/share pickers, toasts, OS notifications and reminders. useRoomMeta gains useLocalRoomNames() / getLocalRoomName(); the quick switcher matches both names and shows the personal one, the forward and share pickers show and filter by it, and message/reminder notifications use it for the room title. Verified headless with general renamed to "Zebra Lounge": Ctrl+K "Zebra" and "general" both list "Zebra Lounge"; the forward picker filtered by "zebra" lists "Zebra Lounge". Not covered here (follow-up): message-search result headers, the inbox notifications page and the threads list still use the server name. Refs #336 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-12 15:40:56 -04:00
jaredandClaude Opus 5	be2c202543	feat(privacy): strip EXIF/XMP/IPTC from image uploads by default (#109) ... Metadata was only dropped as a side effect of opt-in compression, so a phone photo carried its GPS fix, camera model and timestamp into the room and the media store. utils/stripImageMetadata.ts now removes it at the container level, without touching pixels: JPEG drops APP1/APP13/COM (writing back a minimal EXIF holding only Orientation when it isn't 1, so sideways-stored photos still display upright), PNG drops eXIf and the text chunks XMP lives in, WebP drops EXIF/XMP and clears the VP8X flags. Other types pass through. Applied before encryption on every composer path (attach, paste, drop, share target) and to user/room avatar picks; GIF upload is excluded. Setting → General → Privacy "Remove Photo Metadata Before Sending", default on. The upload card says "Photo metadata removed". Unit tests on generated fixtures with a GPS IFD (JPEG orientation 6, JPEG + comment, PNG with eXIf + XMP, WebP with EXIF); verified end to end: the bytes stored by Synapse decode fine and carry only Orientation. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-20 14:22:34 -04:00
jaredandClaude Opus 5	96a97a2f86	feat(pwa): register as an Android share target (#155) ... public/manifest.json declares share_target (POST multipart to /share-target: title/text/url + image/video/audio/pdf/text files). The service worker answers that POST itself: it stashes the form in a Cache API bucket and 303s to the in-app /share page, which lists what arrived, offers a room search, and on pick writes the files into that room's upload-board atom (encrypting first for E2EE rooms via the composer's shared filesToUploadItems) and the title/text/url into its draft, then opens the room — the user still presses Send. The stash is cleared once placed; reopening /share afterwards says so. nginx/caddy examples and the prod image config gain a 303 for /share-target so a POST that reaches the origin before the worker controls the page lands on /share instead of a 405. iOS has no share target support and ignores the manifest entry. Verified headless against the built preview: SW-controlled page → POST /share-target (two PNGs + title + text) → /share lists both files and the text → pick the DM → composer shows both files on the upload board and the text in the draft → /share reports nothing pending. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-20 13:36:05 -04:00