[QA] Room widgets panel (MSC1236): add / open / remove, non-admin view, URL validation, mobile overlay, CSP frame-src #188

New Issue

2026-09-17T23:24:10-04:00

jared commented

2026-09-17 23:24:10 -04:00

Migrated from LOTUS_TESTING.md → Outstanding verification backlog on 2026-09-17.

Shipped and CI-green; needs one human pass. Close when every check below holds; on FAIL comment with what you saw, browser/OS, web vs desktop, theme, console errors.

Verified live

Room Widgets (MSC1236, 2026-07 — needs the CSP frame-src widening + nginx -s reload first): In a room, the header Widgets button (grid icon, desktop) opens a right-side panel. As an admin (PL to modify widgets): Add Widget with a name + an https URL (e.g. an Etherpad https://… or any embeddable page) → it appears in the list; click it → it renders in a sandboxed iframe in the panel; Remove clears it. A non-admin sees the list + can open widgets but has no Add/Remove. Check: a non-https or same-origin URL is rejected on Add with a clear message; the panel is a full-screen overlay on mobile and is mutually exclusive with the Thread/Gallery/Members panels; if a widget stays blank, the prod CSP frame-src still needs widening. Widgets get only benign display capabilities (they can't send/read room events in v1).

_Migrated from `LOTUS_TESTING.md` → Outstanding verification backlog on 2026-09-17._ Shipped and CI-green; needs one human pass. Close when every check below holds; on FAIL comment with what you saw, browser/OS, web vs desktop, theme, console errors. - [ ] Verified live --- **Room Widgets (MSC1236, 2026-07 — needs the CSP `frame-src` widening + `nginx -s reload` first):** In a room, the header **Widgets** button (grid icon, desktop) opens a right-side panel. As an admin (PL to modify widgets): **Add Widget** with a name + an https URL (e.g. an Etherpad `https://…` or any embeddable page) → it appears in the list; click it → it renders in a sandboxed iframe in the panel; **Remove** clears it. A non-admin sees the list + can open widgets but has no Add/Remove. Check: a non-https or same-origin URL is rejected on Add with a clear message; the panel is a full-screen overlay on mobile and is mutually exclusive with the Thread/Gallery/Members panels; if a widget stays blank, the prod CSP `frame-src` still needs widening. Widgets get only benign display capabilities (they can't send/read room events in v1).

jared added this to the Manual QA backlog milestone 2026-09-17 23:24:10 -04:00

jared added the security area: navigation qa labels 2026-09-17 23:24:10 -04:00

jared referenced this issue

2026-09-18 17:46:10 -04:00

Mobile: the Widgets panel has no entry point (header button is desktop-only, ⋮ menu has no Widgets item) #211

jared commented

2026-09-18 17:46:10 -04:00

Verified on the local dev homeserver with Playwright (alice = admin, bob = member):

check	result
admin sees Add Widget	✓
`http://` URL	rejected: "Widget URLs must use https." ✓
empty URL	rejected (message says "must use https" rather than "Enter a widget URL." — `validateWidgetUrl` returns `empty` for a blank string, so the form must be passing the untrimmed previous value or the Add button path re-validates differently; cosmetic)
`https://example.org/`	added → `im.vector.modular.widgets` state event with the URL; appears in the list ✓
click it	renders in an `<iframe title="Example" sandbox="allow-forms allow-scripts allow-same-origin allow-popups allow-downloads">` (cross-origin, so `allow-same-origin` is the widget's own origin; same-origin URLs are rejected at Add) ✓
Remove	state event content emptied, gone from the list ✓
non-admin (bob)	sees the list, can open, no Add / no Remove ✓
mobile full-screen overlay	cannot be verified — there is no way to open Widgets on a phone (desktop-only header button, no menu item). Filed #211.
prod CSP `frame-src`	not testable locally; unchanged since the nginx config already has `frame-src 'self' https:`.

Closing; the mobile entry point is tracked in #211.

Verified on the local dev homeserver with Playwright (alice = admin, bob = member): | check | result | |---|---| | admin sees **Add Widget** | ✓ | | `http://` URL | rejected: "Widget URLs must use https." ✓ | | empty URL | rejected (message says "must use https" rather than "Enter a widget URL." — `validateWidgetUrl` returns `empty` for a blank string, so the form must be passing the untrimmed previous value or the Add button path re-validates differently; cosmetic) | | `https://example.org/` | added → `im.vector.modular.widgets` state event with the URL; appears in the list ✓ | | click it | renders in an `<iframe title="Example" sandbox="allow-forms allow-scripts allow-same-origin allow-popups allow-downloads">` (cross-origin, so `allow-same-origin` is the widget's own origin; same-origin URLs are rejected at Add) ✓ | | **Remove** | state event content emptied, gone from the list ✓ | | non-admin (bob) | sees the list, can open, **no Add / no Remove** ✓ | | mobile full-screen overlay | **cannot be verified — there is no way to open Widgets on a phone** (desktop-only header button, no menu item). Filed #211. | | prod CSP `frame-src` | not testable locally; unchanged since the nginx config already has `frame-src 'self' https:`. | Closing; the mobile entry point is tracked in #211.

jared closed this issue

2026-09-18 17:46:10 -04:00

jared commented

2026-09-18 17:46:29 -04:00

Correction on the empty-URL row: the URL input is required, so the browser's native validation blocks the submit — the "must use https" text I saw was the previous attempt's error still on screen (the form only clears error on a successful submit). validateWidgetUrl('') itself returns empty correctly. Cosmetic: clear the error when the URL input changes.

Correction on the empty-URL row: the URL input is `required`, so the browser's native validation blocks the submit — the "must use https" text I saw was the **previous** attempt's error still on screen (the form only clears `error` on a successful submit). `validateWidgetUrl('')` itself returns `empty` correctly. Cosmetic: clear the error when the URL input changes.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: LotusGuild/cinny#188