LotusGuild/cinny
3
0
Fork 0
Code Issues 27 Pull Requests 5 Actions Packages Projects Releases Wiki Activity

[QA] Room widgets panel (MSC1236): add / open / remove, non-admin view, URL validation, mobile overlay, CSP frame-src #188

New Issue
Closed
opened 2026-09-17 23:24:10 -04:00 by jared · 2 comments
jared commented 2026-09-17 23:24:10 -04:00
Owner
Copy Link
Copy Source

Migrated from LOTUS_TESTING.md → Outstanding verification backlog on 2026-09-17.

Shipped and CI-green; needs one human pass. Close when every check below holds; on FAIL comment with what you saw, browser/OS, web vs desktop, theme, console errors.

  • Verified live

Room Widgets (MSC1236, 2026-07 — needs the CSP frame-src widening + nginx -s reload first): In a room, the header Widgets button (grid icon, desktop) opens a right-side panel. As an admin (PL to modify widgets): Add Widget with a name + an https URL (e.g. an Etherpad https://… or any embeddable page) → it appears in the list; click it → it renders in a sandboxed iframe in the panel; Remove clears it. A non-admin sees the list + can open widgets but has no Add/Remove. Check: a non-https or same-origin URL is rejected on Add with a clear message; the panel is a full-screen overlay on mobile and is mutually exclusive with the Thread/Gallery/Members panels; if a widget stays blank, the prod CSP frame-src still needs widening. Widgets get only benign display capabilities (they can't send/read room events in v1).

_Migrated from `LOTUS_TESTING.md` → Outstanding verification backlog on 2026-09-17._ Shipped and CI-green; needs one human pass. Close when every check below holds; on FAIL comment with what you saw, browser/OS, web vs desktop, theme, console errors. - [ ] Verified live --- **Room Widgets (MSC1236, 2026-07 — needs the CSP `frame-src` widening + `nginx -s reload` first):** In a room, the header **Widgets** button (grid icon, desktop) opens a right-side panel. As an admin (PL to modify widgets): **Add Widget** with a name + an https URL (e.g. an Etherpad `https://…` or any embeddable page) → it appears in the list; click it → it renders in a sandboxed iframe in the panel; **Remove** clears it. A non-admin sees the list + can open widgets but has no Add/Remove. Check: a non-https or same-origin URL is rejected on Add with a clear message; the panel is a full-screen overlay on mobile and is mutually exclusive with the Thread/Gallery/Members panels; if a widget stays blank, the prod CSP `frame-src` still needs widening. Widgets get only benign display capabilities (they can't send/read room events in v1).
jared added this to the Manual QA backlog milestone 2026-09-17 23:24:10 -04:00
jared added the securityarea: navigationqa labels 2026-09-17 23:24:10 -04:00
jared commented 2026-09-18 17:46:10 -04:00
Author
Owner
Copy Link
Copy Source

Verified on the local dev homeserver with Playwright (alice = admin, bob = member):

check result
admin sees Add Widget ✓
http:// URL rejected: "Widget URLs must use https." ✓
empty URL rejected (message says "must use https" rather than "Enter a widget URL." — validateWidgetUrl returns empty for a blank string, so the form must be passing the untrimmed previous value or the Add button path re-validates differently; cosmetic)
https://example.org/ added → im.vector.modular.widgets state event with the URL; appears in the list ✓
click it renders in an <iframe title="Example" sandbox="allow-forms allow-scripts allow-same-origin allow-popups allow-downloads"> (cross-origin, so allow-same-origin is the widget's own origin; same-origin URLs are rejected at Add) ✓
Remove state event content emptied, gone from the list ✓
non-admin (bob) sees the list, can open, no Add / no Remove ✓
mobile full-screen overlay cannot be verified — there is no way to open Widgets on a phone (desktop-only header button, no menu item). Filed #211.
prod CSP frame-src not testable locally; unchanged since the nginx config already has frame-src 'self' https:.

Closing; the mobile entry point is tracked in #211.

Verified on the local dev homeserver with Playwright (alice = admin, bob = member): | check | result | |---|---| | admin sees **Add Widget** | ✓ | | `http://` URL | rejected: "Widget URLs must use https." ✓ | | empty URL | rejected (message says "must use https" rather than "Enter a widget URL." — `validateWidgetUrl` returns `empty` for a blank string, so the form must be passing the untrimmed previous value or the Add button path re-validates differently; cosmetic) | | `https://example.org/` | added → `im.vector.modular.widgets` state event with the URL; appears in the list ✓ | | click it | renders in an `<iframe title="Example" sandbox="allow-forms allow-scripts allow-same-origin allow-popups allow-downloads">` (cross-origin, so `allow-same-origin` is the widget's own origin; same-origin URLs are rejected at Add) ✓ | | **Remove** | state event content emptied, gone from the list ✓ | | non-admin (bob) | sees the list, can open, **no Add / no Remove** ✓ | | mobile full-screen overlay | **cannot be verified — there is no way to open Widgets on a phone** (desktop-only header button, no menu item). Filed #211. | | prod CSP `frame-src` | not testable locally; unchanged since the nginx config already has `frame-src 'self' https:`. | Closing; the mobile entry point is tracked in #211.
jared closed this issue 2026-09-18 17:46:10 -04:00
jared commented 2026-09-18 17:46:29 -04:00
Author
Owner
Copy Link
Copy Source

Correction on the empty-URL row: the URL input is required, so the browser's native validation blocks the submit — the "must use https" text I saw was the previous attempt's error still on screen (the form only clears error on a successful submit). validateWidgetUrl('') itself returns empty correctly. Cosmetic: clear the error when the URL input changes.

Correction on the empty-URL row: the URL input is `required`, so the browser's native validation blocks the submit — the "must use https" text I saw was the **previous** attempt's error still on screen (the form only clears `error` on a successful submit). `validateWidgetUrl('')` itself returns `empty` correctly. Cosmetic: clear the error when the URL input changes.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
a11y
Accessibility: keyboard, screen reader, contrast, motion
 area: appearance
Client area: appearance
 area: auth-session
Client area: auth-session
 area: build-ci
Client area: build-ci
 area: calls
Client area: calls
 area: desktop
Client area: desktop
 area: media
Client area: media
 area: messaging
Client area: messaging
 area: mobile
Client area: mobile
 area: moderation
Client area: moderation
 area: navigation
Client area: navigation
 area: notifications
Client area: notifications
 area: settings
Client area: settings
 area: threads
Client area: threads
 bug
Something is not working
 dependencies
Third-party package versions and advisories
 docs
README / LOTUS_* docs wrong or missing
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 needs-human-review
performance
Re-render storms, leaks, heavy work on hot paths
 planning
priority: critical
Data loss, security hole, or crash on a main path
 priority: high
Broken feature or serious usability problem
 priority: low
Minor issue or polish
 priority: medium
Wrong behaviour in an edge case or notable degradation
 qa
Manual QA: shipped, needs a human in a real environment
 question
More information is needed
 research
security
XSS, unsafe URLs, data leaks, auth/session
 tech-debt
Code health, dead code, fragile patterns
 ux
Usability or visual inconsistency
 wontfix
This won't be fixed
No labels area: navigation qa security
Milestone
No items
No Milestone Manual QA backlog
Projects
Clear projects
No projects
Assignees
Clear assignees
cole (Cole Keller) jared (Jared Vititoe) nathan (Nathan Vititoe)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: LotusGuild/cinny#188