fix(privacy): "Remove Photo Metadata" also covers emoji/sticker packs and badges (#332)

Custom emoji and sticker images, pack avatars and power-level badge
images were uploaded with their EXIF intact (GPS location, timestamp),
although they are published to every member of the room or space. Route
those three pickers through a new useStrippedFilePicker, which applies
the same stripImageMetadata as attachments and avatars.

Fixes #332

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

package-lock.json

@@ -81,7 +81,7 @@
       },
       "devDependencies": {
         "@axe-core/playwright": "4.13.0",
-        "@lotusguild/element-call-embedded": "0.25.0-lotus.22",
+        "@lotusguild/element-call-embedded": "0.25.0-lotus.23",
         "@playwright/test": "1.63.0",
         "@rollup/plugin-inject": "5.0.5",
         "@rollup/plugin-wasm": "6.2.2",
@@ -2695,9 +2695,9 @@
       "integrity": "sha512-dfLbk+PwWvFzSxwk3n5ySL0hfBog779o8h68wK/7/APo/7cgyWp5jcXockbxdk5kFRkbeXWm4Fbi9FrdN381sA=="
     },
     "node_modules/@lotusguild/element-call-embedded": {
-      "version": "0.25.0-lotus.22",
-      "resolved": "https://code.lotusguild.org/api/packages/LotusGuild/npm/%40lotusguild%2Felement-call-embedded/-/0.25.0-lotus.22/element-call-embedded-0.25.0-lotus.22.tgz",
-      "integrity": "sha512-AimDKZA4xUKEEyl2XUFUSUDl03tBKFv88T/3igKyH2VqNSPMGnqcQJC5HXIkHLTWrOmg8kLcJ//FFbqlUZiLcA==",
+      "version": "0.25.0-lotus.23",
+      "resolved": "https://code.lotusguild.org/api/packages/LotusGuild/npm/%40lotusguild%2Felement-call-embedded/-/0.25.0-lotus.23/element-call-embedded-0.25.0-lotus.23.tgz",
+      "integrity": "sha512-vRmcWeJcU0Accyl2x3mqNEzrIe8djE5BekyYbYOSCsMflC98rZgD1mO7KOe7bA1cX7gparRf6sAt1fotHoU+bA==",
       "dev": true
     },
     "node_modules/@matrix-org/matrix-sdk-crypto-wasm": {

package.json

@@ -108,7 +108,7 @@
   },
   "devDependencies": {
     "@axe-core/playwright": "4.13.0",
-    "@lotusguild/element-call-embedded": "0.25.0-lotus.22",
+    "@lotusguild/element-call-embedded": "0.25.0-lotus.23",
     "@playwright/test": "1.63.0",
     "@rollup/plugin-inject": "5.0.5",
     "@rollup/plugin-wasm": "6.2.2",

src/app/components/CallEmbedProvider.tsx

@@ -73,7 +73,7 @@ import { useReducedMotion } from '../hooks/useReducedMotion';
 import { useSetting } from '../state/hooks/settings';
 import { useCallPreferences } from '../state/hooks/callPreferences';
 import { settingsAtom } from '../state/settings';
-import { getStateEvent, getMemberName, isFromFilteredTimelineSet } from '../utils/room';
+import { getStateEvent, getMemberName } from '../utils/room';
 import { declinedRing, hasActiveCallMembership, isRingableRoom } from '../utils/callRing';
 import { StateEvent } from '../../types/matrix/room';
 import { getPowersLevelFromMatrixEvent } from '../hooks/usePowerLevels';
@@ -496,7 +496,6 @@ function IncomingCallListener({ callEmbed, joined }: IncomingCallListenerProps)
 
   const handleTimelineEvent: EventTimelineSetHandlerMap[RoomEvent.Timeline] = useCallback(
     async (event, room, toStartOfTimeline, removed, data) => {
-      if (isFromFilteredTimelineSet(data)) return; // [Gitea #259]
       // only process rtc notification reference events.
       // we do not want to wait to decrypt all events.
       if (event.getRelation()?.rel_type !== RelationType.Reference) return;
@@ -684,7 +683,6 @@ function IncomingCallListener({ callEmbed, joined }: IncomingCallListenerProps)
       data,
     ) => {
       if (eventRoom?.roomId !== room.roomId || !data.liveEvent) return;
-      if (isFromFilteredTimelineSet(data)) return; // [Gitea #259]
       if (event.getType() === EventType.RTCDecline && event.getSender() === myUserId) {
         const related = event.getRelation()?.event_id;
         if (!related || related === refEventId) dismiss(); // declined elsewhere

src/app/components/create-room/utils.ts

@@ -139,8 +139,11 @@ export const createRoom = async (mx: MatrixClient, data: CreateRoomData): Promis
       data.allowFederation,
       data.additionalCreators,
     ),
-    power_level_content_override:
-      data.type === RoomType.Call ? createVoiceRoomPowerLevelsOverride() : undefined,
+    // [Gitea #328] Every non-space room gets call.member at user level, not just
+    // voice rooms: the call button is shown in private group rooms too, and with
+    // Synapse's state_default (50) only admins could start or join a call there
+    // ("You don't have permission to join!").
+    power_level_content_override: createVoiceRoomPowerLevelsOverride(),
     initial_state: initialState,
   };
 

src/app/components/image-pack-view/ImagePackContent.tsx

@@ -16,7 +16,7 @@ import { SettingTile } from '../setting-tile';
 import { UsageSwitcher } from './UsageSwitcher';
 import { ImagePackProfile, ImagePackProfileEdit } from './PackMeta';
 import * as css from './style.css';
-import { useFilePicker } from '../../hooks/useFilePicker';
+import { useStrippedFilePicker } from '../../hooks/useStrippedFilePicker';
 import { CompactUploadCardRenderer } from '../upload-card';
 import { UploadSuccess } from '../../state/upload';
 import { getImageInfo, TUploadContent } from '../../utils/matrix';
@@ -60,7 +60,7 @@ export const ImagePackContent = as<'div', ImagePackContentProps>(
       [imagePack, savedImages, uploadedImages],
     );
 
-    const pickFiles = useFilePicker(
+    const pickFiles = useStrippedFilePicker(
       useCallback(
         (pickedFiles: File[]) => {
           const uniqueFiles = pickedFiles.map((file) => {

src/app/components/image-pack-view/PackMeta.tsx

@@ -19,7 +19,7 @@ import { nameInitials } from '../../utils/common';
 import { BreakWord } from '../../styles/Text.css';
 import { LINKIFY_OPTS } from '../../plugins/react-custom-html-parser';
 import { ContainerColor } from '../../styles/ContainerColor.css';
-import { useFilePicker } from '../../hooks/useFilePicker';
+import { useStrippedFilePicker } from '../../hooks/useStrippedFilePicker';
 import { useObjectURL } from '../../hooks/useObjectURL';
 import { createUploadAtom, UploadSuccess } from '../../state/upload';
 import { CompactUploadCardRenderer } from '../upload-card';
@@ -111,7 +111,7 @@ export function ImagePackProfileEdit({ meta, onCancel, onSave }: ImagePackProfil
     return undefined;
   }, [imageFile]);
 
-  const pickFile = useFilePicker(setImageFile, false);
+  const pickFile = useStrippedFilePicker(setImageFile, false);
 
   const handleRemoveUpload = useCallback(() => {
     setImageFile(undefined);

src/app/features/common-settings/permissions/PowersEditor.tsx

@@ -40,7 +40,7 @@ import { useImagePackRooms } from '../../../hooks/useImagePackRooms';
 import { roomToParentsAtom } from '../../../state/room/roomToParents';
 import { useMediaAuthentication } from '../../../hooks/useMediaAuthentication';
 import { useMatrixClient } from '../../../hooks/useMatrixClient';
-import { useFilePicker } from '../../../hooks/useFilePicker';
+import { useStrippedFilePicker } from '../../../hooks/useStrippedFilePicker';
 import { CompactUploadCardRenderer } from '../../../components/upload-card';
 import { createUploadAtom, UploadSuccess } from '../../../state/upload';
 import { AsyncStatus, useAsyncCallback } from '../../../hooks/useAsyncCallback';
@@ -68,7 +68,7 @@ function EditPower({ maxPower, power, tag, onSave, onClose }: EditPowerProps) {
   const imagePackRooms = useImagePackRooms(room.roomId, roomToParents);
 
   const [iconFile, setIconFile] = useState<File>();
-  const pickFile = useFilePicker(setIconFile, false);
+  const pickFile = useStrippedFilePicker(setIconFile, false);
 
   const [tagColor, setTagColor] = useState<string | undefined>(tag?.color);
   const [tagIcon, setTagIcon] = useState<MemberPowerTagIcon | undefined>(tag?.icon);

src/app/features/room/RoomTimeline.tsx

@@ -90,7 +90,6 @@ import {
   isMembershipChanged,
   reactionOrEditEvent,
   sendRoomEvent,
-  isFromFilteredTimelineSet,
 } from '../../utils/room';
 import { getLastEditDiff } from '../../utils/editDiff';
 import { tick } from '../../utils/haptics';
@@ -411,9 +410,6 @@ const useLiveEventArrive = (room: Room, onArrive: (mEvent: MatrixEvent) => void)
       data,
     ) => {
       if (eventRoom?.roomId !== room.roomId || !data.liveEvent) return;
-      // [Gitea #259] The media gallery / activity log register filtered timeline
-      // sets whose events the room re-emits as live: don't count them twice.
-      if (isFromFilteredTimelineSet(data)) return;
       onArrive(mEvent);
     };
     const handleRedaction: RoomEventHandlerMap[RoomEvent.Redaction] = (mEvent, eventRoom) => {

src/app/features/room/message/Reactions.tsx

@@ -69,8 +69,15 @@ export const Reactions = as<'div', ReactionsProps>(
     const measure = useCallback(() => {
       const container = containerRef.current;
       if (!container) return;
-      const rowWidth = container.getBoundingClientRect().width;
-      const gap = parseFloat(getComputedStyle(container).columnGap) || 8;
+      // [Gitea #305] The width the chips actually get (content box). The border
+      // box grows by 4 px while collapsed (margin -2 / padding 2), and measuring
+      // it made a row within 4 px of fitting flip collapsed↔expanded every frame.
+      const cs = getComputedStyle(container);
+      const rowWidth =
+        container.clientWidth -
+        (parseFloat(cs.paddingLeft) || 0) -
+        (parseFloat(cs.paddingRight) || 0);
+      const gap = parseFloat(cs.columnGap) || 8;
       const chips = keys ? keys.split('\u0000').map((k) => chipRefs.current.get(k)) : [];
       const widths = chips.map((el) => el?.getBoundingClientRect().width ?? 0);
       const moreWidth = moreRef.current?.getBoundingClientRect().width ?? 48;
@@ -110,8 +117,21 @@ export const Reactions = as<'div', ReactionsProps>(
         style={{
           ...props.style,
           ...(collapsed && rowHeight
-            ? // 2px breathing room so row-1 focus outlines are not clipped.
-              { maxHeight: rowHeight + 4, overflow: 'hidden', padding: 2, margin: -2 }
+            ? // 2px breathing room so row-1 focus outlines are not clipped. Longhand
+              // margins so the timeline's marginTop survives (Gitea #305: the
+              // `margin` shorthand overrode it and, once removed, cleared it).
+              {
+                maxHeight: rowHeight + 4,
+                overflow: 'hidden',
+                padding: 2,
+                marginLeft: -2,
+                marginRight: -2,
+                marginBottom: -2,
+                marginTop:
+                  props.style?.marginTop !== undefined
+                    ? `calc(${typeof props.style.marginTop === 'number' ? `${props.style.marginTop}px` : props.style.marginTop} - 2px)`
+                    : -2,
+              }
             : {}),
         }}
         ref={(el) => {

src/app/features/room/widgets/RoomWidgetView.tsx

@@ -14,7 +14,6 @@ import { GeneralWidgetDriver } from './GeneralWidgetDriver';
 import { WidgetPermissionRequest, isWidgetUrlSafe } from './widgetUtils';
 import { restrictWidgetMessages } from '../../../plugins/widgetTransport';
 import { WidgetPermissionPrompt } from './WidgetPermissionPrompt';
-import { isFromFilteredTimelineSet } from '../../../utils/room';
 
 type PendingAsk = {
   requests: WidgetPermissionRequest[];
@@ -112,7 +111,6 @@ export function RoomWidgetView({ room, widget }: RoomWidgetViewProps) {
     };
     const onTimeline: RoomEventHandlerMap[RoomEvent.Timeline] = (ev, r, toStart, removed, data) => {
       if (toStart || removed || !data?.liveEvent) return;
-      if (isFromFilteredTimelineSet(data)) return; // [Gitea #259] don't feed widgets each event twice
       if (ev.isBeingDecrypted()) ev.once(MatrixEventEvent.Decrypted, feed);
       else feed(ev);
     };

src/app/hooks/useStrippedFilePicker.ts

@@ -0,0 +1,36 @@
+import { useCallback } from 'react';
+import { useFilePicker } from './useFilePicker';
+import { useSetting } from '../state/hooks/settings';
+import { settingsAtom } from '../state/settings';
+import { stripImageMetadata } from '../utils/stripImageMetadata';
+
+/**
+ * [Gitea #332] `useFilePicker` for images that get published (emoji / sticker
+ * packs, pack avatars, power-level badges): applies "Remove Photo Metadata"
+ * like message attachments and avatars, so a phone photo's GPS location and
+ * timestamp don't go to every member of the room or space.
+ */
+export const useStrippedFilePicker = <M extends boolean | undefined = undefined>(
+  onSelect: (file: M extends true ? File[] : File) => void,
+  multiple?: M,
+) => {
+  const [strip] = useSetting(settingsAtom, 'stripImageMetadata');
+  const handle = useCallback(
+    (picked: File | File[]) => {
+      if (!strip) {
+        onSelect(picked as M extends true ? File[] : File);
+        return;
+      }
+      const clean = (f: File) => stripImageMetadata(f).then((r) => r.file);
+      if (Array.isArray(picked)) {
+        Promise.all(picked.map(clean)).then((files) =>
+          onSelect(files as M extends true ? File[] : File),
+        );
+      } else {
+        clean(picked).then((file) => onSelect(file as M extends true ? File[] : File));
+      }
+    },
+    [strip, onSelect],
+  );
+  return useFilePicker(handle as (file: M extends true ? File[] : File) => void, multiple);
+};

src/app/pages/client/ClientNonUIFeatures.tsx

@@ -49,7 +49,6 @@ import {
   getNotificationType,
   getUnreadInfo,
   isNotificationEvent,
-  isFromFilteredTimelineSet,
 } from '../../utils/room';
 import { NotificationType } from '../../../types/matrix/room';
 import { mxcUrlToHttp } from '../../utils/matrix';
@@ -685,7 +684,6 @@ function MessageNotifications() {
       data,
     ) => {
       if (mx.getSyncState() !== 'SYNCING') return;
-      if (isFromFilteredTimelineSet(data)) return; // [Gitea #259] no duplicate notifications
       if (document.hasFocus() && (selectedRoomId === room?.roomId || notificationSelected)) return;
       if (
         !room ||
@@ -1128,7 +1126,6 @@ function ClockSkewFeature() {
       data,
     ) => {
       if (!data.liveEvent) return;
-      if (isFromFilteredTimelineSet(data)) return; // [Gitea #259]
       // Only events our homeserver stamped: a federated event's
       // origin_server_ts is the other server's clock.
       const senderServer = mEvent.getSender()?.split(':').slice(1).join(':');

src/app/plugins/call/CallEmbed.ts

@@ -31,6 +31,7 @@ import { verifyDenoiseAssets } from './denoiseSmokeCheck';
 import { canDelegateCapability } from './utils';
 import { getCallPageUrl } from './callPageUrl';
 import { restrictWidgetMessages } from '../widgetTransport';
+import { isRingableRoom } from '../../utils/callRing';
 
 // Maximum time to wait for the embedded Element Call iframe to progress from
 // initial load to a ready/joined state. If it hasn't by then, we assume the
@@ -251,8 +252,18 @@ export class CallEmbed {
       verifyDenoiseAssets(denoiseModel).catch(() => undefined);
     }
 
+    // [Gitea #295] Only ask Element Call to notify where a call can ring at all
+    // (DMs, invite-only groups outside a space). In a voice channel or space
+    // room the notification carries an @room mention, so every member got a
+    // highlighted ping (and phone push) whenever a moderator hopped in, and
+    // other clients showed it as a missed call.
+    // `none` needs element-call-embedded ≥ 0.25.0-lotus.23 (older builds ignore it).
     if (CallEmbed.startingCall(intent)) {
-      params.append('sendNotificationType', CallEmbed.dmCall(intent) ? 'ring' : 'notification');
+      let notify = 'none';
+      if (isRingableRoom(room, CallEmbed.dmCall(intent))) {
+        notify = CallEmbed.dmCall(intent) ? 'ring' : 'notification';
+      }
+      params.append('sendNotificationType', notify);
     }
 
     // [Gitea #43] On its own origin when config.json sets elementCallUrl.

src/app/state/room/roomToUnread.ts

@@ -24,7 +24,6 @@ import {
   getUnreadInfo,
   getUnreadInfos,
   isNotificationEvent,
-  isFromFilteredTimelineSet,
 } from '../../utils/room';
 import { roomToParentsAtom } from './roomToParents';
 import { useStateEventCallback } from '../../hooks/useStateEventCallback';
@@ -237,7 +236,6 @@ export const useBindRoomToUnreadAtom = (mx: MatrixClient, unreadAtom: typeof roo
       data: IRoomTimelineData,
     ) => {
       if (!room || !data.liveEvent || room.isSpaceRoom() || !isNotificationEvent(mEvent)) return;
-      if (isFromFilteredTimelineSet(data)) return; // [Gitea #259]
       // Single-owner rule: thread replies drive the room badge via
       // RoomEvent.UnreadNotifications below — ignore them here so the count is
       // never double-driven / mis-attributed to the main timeline.

src/app/utils/filteredTimeline.test.ts

@@ -1,20 +0,0 @@
-import { test } from 'node:test';
-import assert from 'node:assert/strict';
-import type { IRoomTimelineData } from 'matrix-js-sdk';
-import { isFromFilteredTimelineSet } from './room';
-
-const data = (filter: unknown): IRoomTimelineData =>
-  ({
-    liveEvent: true,
-    timeline: { getTimelineSet: () => ({ getFilter: () => filter }) },
-  }) as unknown as IRoomTimelineData;
-
-test('isFromFilteredTimelineSet: gallery/activity-log sets are filtered, the main set is not (#259)', () => {
-  assert.equal(isFromFilteredTimelineSet(data({ filterId: 'media' })), true);
-  assert.equal(isFromFilteredTimelineSet(data(undefined)), false);
-  assert.equal(isFromFilteredTimelineSet(undefined), false);
-  assert.equal(
-    isFromFilteredTimelineSet({ liveEvent: true } as unknown as IRoomTimelineData),
-    false,
-  );
-});

src/app/utils/room.ts

@@ -20,7 +20,6 @@ import {
   Room,
   RoomMember,
   TimelineEvents,
-  IRoomTimelineData,
 } from 'matrix-js-sdk';
 import { CryptoBackend } from 'matrix-js-sdk/lib/common-crypto/CryptoBackend';
 import type { RoomMessageEventContent } from 'matrix-js-sdk/lib/@types/events';
@@ -848,14 +847,3 @@ export const guessPerfectParent = (
 
   return perfectParent;
 };
-
-/**
- * [Gitea #259] Whether a RoomEvent.Timeline emit came from a FILTERED timeline
- * set. The media gallery and activity log register filtered sets on the room
- * (getOrCreateFilteredTimelineSet), and the room re-emits their events with
- * liveEvent: true, so listeners that mean "a new event in the room" saw each
- * matching event twice (the timeline window drifted, notifications doubled).
- * The room's main and thread sets have no filter.
- */
-export const isFromFilteredTimelineSet = (data?: IRoomTimelineData): boolean =>
-  !!data?.timeline?.getTimelineSet()?.getFilter();