Fix avatars not showing when not using HTTPS#3995
Open
jiafeimao0p wants to merge 1 commit intoconversejs:masterfrom
Open
Fix avatars not showing when not using HTTPS#3995jiafeimao0p wants to merge 1 commit intoconversejs:masterfrom
jiafeimao0p wants to merge 1 commit intoconversejs:masterfrom
Conversation
- Check for window.isSecureContext before using crypto.subtle API - Provide fallback for non-HTTPS environments to allow avatars to display - Fixed in: parsers.js, api.js, color.js Fixes conversejs#2374
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes the issue where avatars are not showing when Converse.js is opened on a non-secure context (non-HTTPS).
Problem
The rendering of avatars from vCards uses
crypto.subtle, which is only available in secure contexts (HTTPS). This causes avatars to not be displayed in non-HTTPS environments.Solution
Check for
window.isSecureContextbefore using thecrypto.subtleAPI, and provide a fallback for non-HTTPS environments.Files Changed
src/headless/plugins/vcard/parsers.js- Check secure context before SHA-1 hashsrc/headless/plugins/vcard/api.js- Check secure context when setting avatarsrc/headless/utils/color.js- Check secure context in colorize functionTesting
The fallback uses base64 substring or simple string hash as pseudo-hash when
crypto.subtleis unavailable, allowing avatars to display in non-HTTPS contexts.Fixes #2374