sorb/ThreadNet-Web
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 4 Wiki Activity
15 Commits 3 Branches 19 Tags
59f9c81ef8a17de3de46a346bc6fdb73b8552421
Commit Graph
4 Commits
Author SHA1 Message Date
Thore Cimbal 6a628533c2 feat: client-side ClamAV scanning for encrypted rooms (Issue #19)
Build Debian package / Build package (release) Canceled after 0s
build_desktop_and_deploy.yaml / Prepare (release) Canceled after 0s
Build and Deploy / prepare (release) Canceled after 0s
Deploy release / Deploy to Cloudflare Pages (release) Canceled after 0s
Build and Deploy / Trigger Pro pipeline (release) Canceled after 0s
Build and Deploy / Windows arm64 (release) Canceled after 0s
Build and Deploy / Windows x64 (release) Canceled after 0s
Build and Deploy / macOS (release) Canceled after 0s
Build and Deploy / Linux amd64 (sqlcipher static) (release) Canceled after 0s
Build and Deploy / Linux arm64 (sqlcipher static) (release) Canceled after 0s
Build and Deploy / ${{ needs.prepare.outputs.deploy == 'true' && 'Deploy' || 'Deploy (dry-run)' }} (release) Canceled after 0s
Build and Deploy / Deploy builds to ESS (release) Canceled after 0s 
Synapse's own check_media_file_for_spam module can never see E2EE
attachment content - only the client ever holds the decryption key.
Adds two hooks that call a self-hosted scan service
(https://axion1337.chat/_scan, deployed separately in the gitops repo):

- DecryptFile.ts: scans every decrypted attachment (image/audio/video/
  file all funnel through this one function via MediaEventHelper)
  before returning it as a Blob.
- ContentMessages.ts: scans plaintext before encryption/upload in
  uploadFile(), the shared function behind all attachment uploads
  (main file, thumbnails, voice messages), regardless of room
  encryption state.

New ContentScanRejectedError surfaces through the existing error-
rendering paths (MediaProcessingError, upload failure dialog) using
the same pattern as DecryptError/DownloadError/UploadFailedError.

Live-tested: EICAR blocked pre-upload in encrypted rooms and DMs;
receive-side hook also blocks EICAR sent by an unpatched client
(app.element.io), confirming it isn't just self-protection for our
own uploads. Fails open on scanner errors so an outage can't block
all uploads/downloads.
 2026-07-29 19:29:03 +02:00
Thore Cimbal 05900602c6 fix: restore executable bit on remaining desktop/CI scripts 
The earlier script-permission fix (5e3254d) only covered scripts
invoked by apps/web's own Dockerfile/CI at the time. Found 9 more
non-executable scripts (644 instead of 755) while building the
Electron desktop app via apps/desktop/dockerbuild - same root cause,
different invocation paths.
 2026-07-29 19:11:34 +02:00
Thore Cimbal 7839b56a65 fix: pin matrix-js-sdk to a working commit, use our own Element Call fork 
The floating github:matrix-org/matrix-js-sdk#develop reference was
resolved to a stale commit missing src/oidc/authorize.ts (breaking the
webpack build). Investigated moving to the current develop HEAD instead
(191908da) - turned out to be worse, not better: that commit renamed the
entire src/oidc/ module to src/oauth/ with a materially different API
(generateOidcAuthorizationUrl/completeAuthorizationCodeGrant/OidcError
don't exist under those names anymore). Rather than porting our OIDC
login code to the new API sight-unseen, pinned to d19cb751 - the last
develop commit before that rename, verified to have both the file at
the expected path and the exact exports apps/web imports.

Also switched the Element Call embedded widget dependency from
upstream's @element-hq/element-call-embedded to our own published fork
(@sorb/threadnet-call-embedded@0.19.2-threadnet.5) - a full rebuild was
otherwise silently bundling the unmodified upstream widget, discarding
every Element Call customization (Video-tab quality settings, German
translations, codec list fix).
 2026-07-28 23:36:53 +02:00
sorB 3da363517f feat: show call participants in room list (Discord-style)
Docker / Docker Buildx (push) Has been cancelled
Build Debian package / Build package (release) Has been cancelled
Build and Deploy / prepare (release) Has been cancelled
Deploy release / Deploy to Cloudflare Pages (release) Has been cancelled
Build and Deploy / Trigger Pro pipeline (release) Has been cancelled
Build and Deploy / Windows arm64 (release) Has been cancelled
Build and Deploy / Windows x64 (release) Has been cancelled
Build and Deploy / macOS (release) Has been cancelled
Build and Deploy / Linux amd64 (sqlcipher static) (release) Has been cancelled
Build and Deploy / Linux arm64 (sqlcipher static) (release) Has been cancelled
Build and Deploy / ${{ needs.prepare.outputs.deploy == 'true' && 'Deploy' || 'Deploy (dry-run)' }} (release) Has been cancelled
Build and Deploy / Deploy builds to ESS (release) Has been cancelled
2026-05-10 14:25:35 +02:00