Skip to content

fix(notifications): Require absolute links for support of desktop and mobile clients#59606

Merged
nickvergessen merged 1 commit intomasterfrom
bugfix/noid/require-absolute-links-in-notifications
Apr 13, 2026
Merged

fix(notifications): Require absolute links for support of desktop and mobile clients#59606
nickvergessen merged 1 commit intomasterfrom
bugfix/noid/require-absolute-links-in-notifications

Conversation

@nickvergessen
Copy link
Copy Markdown
Member

  • Was a warning so far
  • Completing the hardening to enforcement now

Checklist

AI (if applicable)

  • The content of this PR was partly or fully generated using AI

… mobile clients

Signed-off-by: Joas Schilling <coding@schilljs.com>
@nickvergessen nickvergessen added this to the Nextcloud 34 milestone Apr 13, 2026
@nickvergessen nickvergessen self-assigned this Apr 13, 2026
@nickvergessen nickvergessen requested a review from a team as a code owner April 13, 2026 13:51
@nickvergessen nickvergessen added bug 3. to review Waiting for reviews labels Apr 13, 2026
@nickvergessen nickvergessen requested review from ArtificialOwl and removed request for a team April 13, 2026 13:51
@nickvergessen
Copy link
Copy Markdown
Member Author

/backport to stable33

@nickvergessen
Copy link
Copy Markdown
Member Author

/backport to stable32

Copy link
Copy Markdown
Contributor

@Antreesy Antreesy left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
How the thrown error is handled? Do we see it in logs, or it goes silent?

@nickvergessen
Copy link
Copy Markdown
Member Author

How the thrown error is handled? Do we see it in logs, or it goes silent?

Like with all other cases of invalid data being provided. It should be an error in the log at the end but the notification will be hidden

@nickvergessen nickvergessen merged commit eecd708 into master Apr 13, 2026
169 of 179 checks passed
@nickvergessen nickvergessen deleted the bugfix/noid/require-absolute-links-in-notifications branch April 13, 2026 15:33
miaulalala added a commit to nextcloud/activity that referenced this pull request Apr 14, 2026
…P(S)

Ensure links and icons passed from activity events to INotification
are always absolute HTTP(S) URLs. Relative paths are resolved via
IURLGenerator::getAbsoluteURL(), and non-HTTP(S) schemes (e.g.
javascript:, nc://, data:) are rejected entirely.

This aligns with the stricter validation introduced in
nextcloud/server#59606.

AI-Assisted-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Anna Larch <anna@nextcloud.com>
miaulalala added a commit to nextcloud/activity that referenced this pull request Apr 14, 2026
… mobile clients

To align with the stricter validation introduced in nextcloud/server#59606.

AI-Assisted-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Anna Larch <anna@nextcloud.com>
miaulalala added a commit to nextcloud/activity that referenced this pull request Apr 14, 2026
… mobile clients

To align with the stricter validation introduced in nextcloud/server#59606.

AI-Assisted-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Anna Larch <anna@nextcloud.com>
miaulalala added a commit to nextcloud/activity that referenced this pull request Apr 15, 2026
… mobile clients

To align with the stricter validation introduced in nextcloud/server#59606.

AI-Assisted-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Anna Larch <anna@nextcloud.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants