v1.5.11

Prepare changelog for v1.5.11
v1.5.11
2020-03-02 17:51:01 +00:00 · 2020-03-02 17:51:00 +00:00 · 2020-03-02 17:47:58 +00:00 · 2020-03-02 17:47:53 +00:00 · 2020-03-02 17:47:32 +00:00 · 2020-03-02 13:08:04 +00:00
39 changed files with 1280 additions and 966 deletions
@@ -1,77 +0,0 @@
-steps:
-  - label: ":eslint: JS Lint"
-    command:
-      - "yarn install"
-      - "yarn lint:js"
-    plugins:
-      - docker#v3.0.1:
-          image: "node:12"
-
-# This layer doesn't have a TypeScript linter. This comment is to remind TravisR to fix that.
-#  - label: ":eslint: TS Lint"
-#    command:
-#      - "echo '--- Install js-sdk'"
-#      - "./scripts/ci/install-deps.sh"
-#      - "yarn lint:ts"
-#    plugins:
-#      - docker#v3.0.1:
-#          image: "node:12"
-
-  - label: ":eslint: Types Lint"
-    command:
-      - "yarn install"
-      - "yarn lint:types"
-    plugins:
-      - docker#v3.0.1:
-          image: "node:12"
-
-  - label: "🛠 Build"
-    command:
-      - "echo '--- Fetching Dependencies'"
-      - "./scripts/fetch-develop.deps.sh --depth 1"
-      - "yarn install"
-      - "echo '+++ Building Project'"
-      - "yarn build"
-    plugins:
-      - docker#v3.0.1:
-          image: "node:12"
-
-  - label: ":jest: Tests"
-    agents:
-      # We use a medium sized instance instead of the normal small ones because
-      # webpack loves to gorge itself on resources.
-      queue: "medium"
-    command:
-      - "echo '--- Fetching Dependencies'"
-      - "./scripts/fetch-develop.deps.sh --depth 1"
-      - "yarn install"
-      - "yarn build:genfiles"  # We have to build the app to make sure the autogenned files are present
-      - "echo '+++ Running Tests'"
-      - "yarn test"
-    plugins:
-      - docker#v3.0.1:
-          image: "node:10"
-
-  - label: ":hammer: Package"
-    command:
-      - "echo '--- Fetching Dependencies'"
-      - "./scripts/fetch-develop.deps.sh --depth 1"
-      - "yarn install"
-      - "echo '+++ Packaging'"
-      - "./scripts/ci_package.sh"
-    branches: "develop"
-    artifact_paths: "dist/riot-*.tar.gz"
-    plugins:
-      - docker#v3.0.1:
-          image: "node:10"
-
-  - label: "🌐 i18n"
-    command:
-      - "echo '--- Fetching Dependencies'"
-      - "./scripts/fetch-develop.deps.sh --depth 1"
-      - "yarn install"
-      - "echo '+++ Testing i18n output'"
-      - "yarn diff-i18n"
-    plugins:
-      - docker#v3.0.1:
-          image: "node:10"
@@ -5,12 +5,30 @@
    "setClasses"
  ],
  "feature-detects": [
+    "test/css/animations",
    "test/css/displaytable",
+    "test/css/filters",
    "test/css/flexbox",
-    "test/es5/specification",
    "test/css/objectfit",
-    "test/storage/localstorage",
-    "test/workers/webworkers",
-    "test/indexeddb"
+
+    "test/es5/date",
+    "test/es5/function",
+    "test/es5/object",
+    "test/es5/undefined",
+
+    "test/es6/array",
+    "test/es6/collections",
+    "test/es6/promises",
+    "test/es6/string",
+
+    "test/svg",
+    "test/svg/asimg",
+    "test/svg/filters",
+
+    "test/cors",
+    "test/iframe/sandbox",
+    "test/json",
+    "test/network/fetch",
+    "test/storage/localstorage"
  ]
 }
@@ -1,3 +1,119 @@
+Changes in [1.5.11](https://github.com/vector-im/riot-web/releases/tag/v1.5.11) (2020-03-02)
+============================================================================================
+[Full Changelog](https://github.com/vector-im/riot-web/compare/v1.5.11-rc.1...v1.5.11)
+
+ * Upgrade to JS SDK 5.1.0 and React SDK 2.2.0
+ * Fix SSO flows for Electron 8.0.2 by disabling will-navigate
+   [\#12585](https://github.com/vector-im/riot-web/pull/12585)
+
+Changes in [1.5.11-rc.1](https://github.com/vector-im/riot-web/releases/tag/v1.5.11-rc.1) (2020-02-26)
+======================================================================================================
+[Full Changelog](https://github.com/vector-im/riot-web/compare/v1.5.10...v1.5.11-rc.1)
+
+ * Upgrade to JS SDK 5.1.0-rc.1 and React SDK 2.2.0-rc.1
+ * Change Windows signing to warning when missing token
+   [\#12523](https://github.com/vector-im/riot-web/pull/12523)
+ * Modernizr remove t3st/es6/contains
+   [\#12524](https://github.com/vector-im/riot-web/pull/12524)
+ * Switch out any eval-using Modernizr rules
+   [\#12519](https://github.com/vector-im/riot-web/pull/12519)
+ * Update from Weblate
+   [\#12522](https://github.com/vector-im/riot-web/pull/12522)
+ * Notify electron of language changes
+   [\#12487](https://github.com/vector-im/riot-web/pull/12487)
+ * Relax macOS notarisation check to print a warning
+   [\#12503](https://github.com/vector-im/riot-web/pull/12503)
+ * Clarify supported tier means desktop OSes
+   [\#12486](https://github.com/vector-im/riot-web/pull/12486)
+ * Use noreferrer in addition to noopener for edge case browsers
+   [\#12477](https://github.com/vector-im/riot-web/pull/12477)
+ * Document start / end composer shortcuts
+   [\#12466](https://github.com/vector-im/riot-web/pull/12466)
+ * Update from Weblate
+   [\#12480](https://github.com/vector-im/riot-web/pull/12480)
+ * Remove buildkite pipeline
+   [\#12464](https://github.com/vector-im/riot-web/pull/12464)
+ * Remove exec so release script continues
+   [\#12435](https://github.com/vector-im/riot-web/pull/12435)
+ * Use Persistent Storage where possible
+   [\#12425](https://github.com/vector-im/riot-web/pull/12425)
+
+Changes in [1.5.10](https://github.com/vector-im/riot-web/releases/tag/v1.5.10) (2020-02-19)
+============================================================================================
+[Full Changelog](https://github.com/vector-im/riot-web/compare/v1.5.9...v1.5.10)
+
+ * Get rid of dependence on usercontent.riot.im
+   [\#12292](https://github.com/vector-im/riot-web/pull/12292)
+ * Add experimental support tier
+   [\#12377](https://github.com/vector-im/riot-web/pull/12377)
+
+Changes in [1.5.9](https://github.com/vector-im/riot-web/releases/tag/v1.5.9) (2020-02-17)
+==========================================================================================
+[Full Changelog](https://github.com/vector-im/riot-web/compare/v1.5.9-rc.1...v1.5.9)
+
+ * Automate SDK dep upgrades for release
+   [\#12374](https://github.com/vector-im/riot-web/pull/12374)
+
+Changes in [1.5.9-rc.1](https://github.com/vector-im/riot-web/releases/tag/v1.5.9-rc.1) (2020-02-13)
+====================================================================================================
+[Full Changelog](https://github.com/vector-im/riot-web/compare/v1.5.8...v1.5.9-rc.1)
+
+ * Upgrade JS SDK to 5.0.0-rc.1 and React SDK 2.1.0-rc.2
+ * Update from Weblate
+   [\#12354](https://github.com/vector-im/riot-web/pull/12354)
+ * Add top left menu shortcut
+   [\#12310](https://github.com/vector-im/riot-web/pull/12310)
+ * Remove modernizr rules for features on which we only soft depend
+   [\#12272](https://github.com/vector-im/riot-web/pull/12272)
+ * Embed CSP meta tag and stop using script-src unsafe-inline
+   [\#12258](https://github.com/vector-im/riot-web/pull/12258)
+ * Add contribute.json
+   [\#12251](https://github.com/vector-im/riot-web/pull/12251)
+ * Improve Browser checks
+   [\#12232](https://github.com/vector-im/riot-web/pull/12232)
+ * Document padlock flag
+   [\#12173](https://github.com/vector-im/riot-web/pull/12173)
+ * Enable cross-signing on /develop
+   [\#12126](https://github.com/vector-im/riot-web/pull/12126)
+ * Switch back to legacy decorators
+   [\#12110](https://github.com/vector-im/riot-web/pull/12110)
+ * Update babel targets
+   [\#12102](https://github.com/vector-im/riot-web/pull/12102)
+ * Install deps for linting
+   [\#12076](https://github.com/vector-im/riot-web/pull/12076)
+ * Update from Weblate
+   [\#12062](https://github.com/vector-im/riot-web/pull/12062)
+ * Change to minimal Webpack output
+   [\#12049](https://github.com/vector-im/riot-web/pull/12049)
+ * Remove docs for new invite dialog labs feature
+   [\#12015](https://github.com/vector-im/riot-web/pull/12015)
+ * ElectronPlatform: Add the indexSize method.
+   [\#11529](https://github.com/vector-im/riot-web/pull/11529)
+ * ElectronPlatform: Add the ability to load file events from the event index
+   [\#11907](https://github.com/vector-im/riot-web/pull/11907)
+ * Fix the remainder of the cookie links
+   [\#12008](https://github.com/vector-im/riot-web/pull/12008)
+ * Use bash in Docker scripts
+   [\#12001](https://github.com/vector-im/riot-web/pull/12001)
+ * Use debian to build the Docker image
+   [\#11999](https://github.com/vector-im/riot-web/pull/11999)
+ * Update cookie policy urls on /app and /develop config.json
+   [\#11998](https://github.com/vector-im/riot-web/pull/11998)
+ * BuildKite: Only deploy to /develop if everything else passed
+   [\#11996](https://github.com/vector-im/riot-web/pull/11996)
+ * Add docs for admin report content message
+   [\#11995](https://github.com/vector-im/riot-web/pull/11995)
+ * Load as little as possible in index.js for the skinner
+   [\#11959](https://github.com/vector-im/riot-web/pull/11959)
+ * Fix webpack config (by stealing Dave's config)
+   [\#11956](https://github.com/vector-im/riot-web/pull/11956)
+ * Force Jest to resolve the js-sdk and react-sdk to src directories
+   [\#11954](https://github.com/vector-im/riot-web/pull/11954)
+ * Fix build to not babel modules inside js/react sdk
+   [\#11949](https://github.com/vector-im/riot-web/pull/11949)
+ * Fix webpack to babel js-sdk & react-sdk but no other deps
+   [\#11944](https://github.com/vector-im/riot-web/pull/11944)
+
 Changes in [1.5.8](https://github.com/vector-im/riot-web/releases/tag/v1.5.8) (2020-01-27)
 ==========================================================================================
 [Full Changelog](https://github.com/vector-im/riot-web/compare/v1.5.8-rc.2...v1.5.8)
@@ -1,5 +1,5 @@
 # Builder
-FROM node:10-alpine as builder
+FROM node:10 as builder

 # Support custom branches of the react-sdk and js-sdk. This also helps us build
 # images of riot-web develop.
@@ -9,12 +9,12 @@ ARG REACT_SDK_BRANCH="master"
 ARG JS_SDK_REPO="https://github.com/matrix-org/matrix-js-sdk.git"
 ARG JS_SDK_BRANCH="master"

-RUN apk add --no-cache git dos2unix
+RUN apt-get update && apt-get install -y git dos2unix

 WORKDIR /src

 COPY . /src
-RUN dos2unix /src/scripts/docker-link-repos.sh && sh /src/scripts/docker-link-repos.sh
+RUN dos2unix /src/scripts/docker-link-repos.sh && bash /src/scripts/docker-link-repos.sh
 RUN yarn --network-timeout=100000 install
 RUN yarn build

@@ -22,7 +22,7 @@ RUN yarn build
 RUN cp /src/config.sample.json /src/webapp/config.json

 # Ensure we populate the version file
-RUN dos2unix /src/scripts/docker-write-version.sh && sh /src/scripts/docker-write-version.sh
+RUN dos2unix /src/scripts/docker-write-version.sh && bash /src/scripts/docker-write-version.sh


 # App
@@ -1,12 +1,31 @@
 Riot
 ====

-Riot (formerly known as Vector) is a Matrix web client built using the [Matrix React SDK](https://github.com/matrix-org/matrix-react-sdk).
+Riot (formerly known as Vector) is a Matrix web client built using the [Matrix
+React SDK](https://github.com/matrix-org/matrix-react-sdk).

-Riot is officially supported on the web in the last 2 major versions of Chrome, Firefox, and Safari. For Riot on Desktop (electron),
-only the officially published app is supported. Other browsers and packages may work, however official support is not provided. 
-For accessing Riot on an Android or iOS device, check out [riot-android](https://github.com/vector-im/riot-android)
-and [riot-ios](https://github.com/vector-im/riot-ios) - riot-web does not support mobile devices.
+Supported Environments
+======================
+
+Riot has several tiers of support for different environments:
+
+* Supported
+  * Definition: Issues **actively triaged**, regressions **block** the release
+  * Last 2 major versions of Chrome, Firefox, and Safari on desktop OSes
+  * Latest release of official Riot Desktop app on desktop OSes
+  * Desktop OSes means macOS, Windows, and Linux versions for desktop devices
+    that are actively supported by the OS vendor and receive security updates
+* Experimental
+  * Definition: Issues **accepted**, regressions **do not block** the release
+  * Riot as an installed PWA via current stable version of Chrome, Firefox, and Safari
+  * Mobile web for current stable version of Chrome, Firefox, and Safari on Android, iOS, and iPadOS
+* Not supported
+  * Definition: Issues only affecting unsupported environments are **closed**
+  * Everything else
+
+For accessing Riot on an Android or iOS device, we currently recommend the
+native apps [riot-android](https://github.com/vector-im/riot-android)
+and [riot-ios](https://github.com/vector-im/riot-ios).

 Getting Started
 ===============
@@ -52,15 +71,6 @@ We have put some coarse mitigations into place to try to protect against this
 situation, but it's still not good practice to do it in the first place.  See
 https://github.com/vector-im/riot-web/issues/1977 for more details.

-The same applies for end-to-end encrypted content, but since this is decrypted
-on the client, Riot needs a way to supply the decrypted content from a separate
-origin to the one Riot is hosted on. This currently done with a 'cross origin
-renderer' which is a small piece of javascript hosted on a different domain.
-To avoid all Riot installs needing one of these to be set up, riot.im hosts
-one on usercontent.riot.im which is used by default.
-https://github.com/vector-im/riot-web/issues/6173 tracks progress on replacing
-this with something better.
-
 Building From Source
 ====================

@@ -1,25 +1,23 @@
 module.exports = {
-  "sourceMaps": true,
-  "presets": [
-    ["@babel/preset-env", {
-      "targets": {
-        "browsers": [
-          "last 2 versions"
-        ]
-      }
-    }],
-    "@babel/preset-typescript",
-    "@babel/preset-flow",
-    "@babel/preset-react"
-  ],
-  "plugins": [
-    ["@babel/plugin-proposal-decorators", {"legacy": true}],
-    "@babel/plugin-proposal-export-default-from",
-    "@babel/plugin-proposal-numeric-separator",
-    "@babel/plugin-proposal-class-properties",
-    "@babel/plugin-proposal-object-rest-spread",
-    "@babel/plugin-transform-flow-comments",
-    "@babel/plugin-syntax-dynamic-import",
-    "@babel/plugin-transform-runtime"
-  ]
+    "sourceMaps": true,
+    "presets": [
+        ["@babel/preset-env", {
+            "targets": [
+                "last 2 Chrome versions", "last 2 Firefox versions", "last 2 Safari versions"
+            ],
+        }],
+        "@babel/preset-typescript",
+        "@babel/preset-flow",
+        "@babel/preset-react"
+    ],
+    "plugins": [
+        ["@babel/plugin-proposal-decorators", {legacy: true}],
+        "@babel/plugin-proposal-export-default-from",
+        "@babel/plugin-proposal-numeric-separator",
+        "@babel/plugin-proposal-class-properties",
+        "@babel/plugin-proposal-object-rest-spread",
+        "@babel/plugin-transform-flow-comments",
+        "@babel/plugin-syntax-dynamic-import",
+        "@babel/plugin-transform-runtime"
+    ]
 };
@@ -0,0 +1,17 @@
+{
+  "name": "Riot",
+    "description": "A glossy Matrix collaboration client for the web.",
+    "repository": {
+      "url": "https://github.com/vector-im/riot-web",
+      "license": "Apache License 2.0"
+    },
+    "bugs": {
+      "list": "https://github.com/vector-im/riot-web/issues",
+      "report": "https://github.com/vector-im/riot-web/issues/new/choose"
+    },
+    "keywords": [
+      "chat",
+      "riot",
+      "matrix"
+    ]
+}
@@ -37,6 +37,10 @@ For a good example, see https://riot.im/develop/config.json.
       authentication flows
    1. `authFooterLinks`: a list of links to show in the authentication page footer:
      `[{"text": "Link text", "url": "https://link.target"}, {"text": "Other link", ...}]`
+1. `reportEvent`: Configures the dialog for reporting content to the homeserver
+   admin.
+    1. `adminMessageMD`: An extra message to show on the reporting dialog to
+       mention homeserver-specific policies. Accepts Markdown.
 1. `integrations_ui_url`: URL to the web interface for the integrations server. The integrations
   server is not Riot and normally not your homeserver either. The integration server settings
   may be left blank to disable integrations.
@@ -53,11 +57,6 @@ For a good example, see https://riot.im/develop/config.json.
 1. `update_base_url` (electron app only): HTTPS URL to a web server to download
   updates from. This should be the path to the directory containing `macos`
   and `win32` (for update packages, not installer packages).
-1. `cross_origin_renderer_url`: URL to a static HTML page hosting code to help display
-   encrypted file attachments. This MUST be hosted on a completely separate domain to
-   anything else since it is used to isolate the privileges of file attachments to this
-   domain. Default: `https://usercontent.riot.im/v1.html`. This needs to contain v1.html from
-   https://github.com/matrix-org/usercontent/blob/master/v1.html
 1. `piwik`: Analytics can be disabled by setting `piwik: false` or by leaving the piwik config
   option out of your config file. If you want to enable analytics, set `piwik` to be an object
   containing the following properties:
@@ -83,7 +82,7 @@ For a good example, see https://riot.im/develop/config.json.
   default homeserver when signing up or logging in.
 1. `permalinkPrefix`: Used to change the URL that Riot generates permalinks with.
   By default, this is "https://matrix.to" to generate matrix.to (spec) permalinks.
-   Set this to your Riot instance URL if you run an unfederated server (eg: 
+   Set this to your Riot instance URL if you run an unfederated server (eg:
   "https://riot.example.org").

 Note that `index.html` also has an og:image meta tag that is set to an image
@@ -82,12 +82,6 @@ that downloads, stores, and indexes room messages for E2E encrypted rooms.
 The existing search will transparently work for encrypted rooms just like it
 does for non-encrypted.

-## New invite dialog (`feature_ftue_dms`)
-
-An improved dialog for inviting users. This replaces both the DM creation dialog 
-and the 'invite user' dialog, using your recent DMs as a suggestion for who to chat
-with.
-
 ## Bridge info tab (`feature_bridge_state`)

 Adds a "Bridge Info" tab to the Room Settings dialog, if a compatible bridge is
@@ -99,3 +93,8 @@ tab as the single source of truth just yet.

 This adds a presence indicator in the room list next to DM rooms where the other
 person is online.
+
+## Show padlocks on invite only rooms (`feature_invite_only_padlocks`)
+
+This adds padlocks to room list tiles and room header for invite only rooms.
+This feature flag (unlike most) is enabled by default.
@@ -47,7 +47,7 @@ Again from the `electron_app/` directory:

 Recompiling Seshat itself can be done like so:

-    yarn run electron-build-env -- --electron 6.1.1 -- neon build matrix-seshat --release`
+    yarn run electron-build-env -- --electron 6.1.1 -- neon build matrix-seshat --release

 Please make sure to include all the `--` as well as the `--release` command line
 switch at the end. Modify your electron version accordingly depending on the
@@ -56,6 +56,5 @@ version that is installed on your system.
 After this is done the Electron version of Riot can be run from the main folder
 as usual using:

-    yarn build
    yarn electron

@@ -10,4 +10,6 @@ The modifier is <kbd>Ctrl</kbd> on Windows & Linux and <kbd>⌘</kbd> on Mac.
 - <kbd>↑</kbd>/<kbd>↓</kbd> - next/prev room when focus in room list
 - <kbd>Alt</kbd>+<kbd>↑</kbd>/<kbd>↓</kbd> - resend previous messages when the composer is in focus
 - <kbd>PageUp</kbd>/<kbd>PageDown</kbd> - scroll timeline up/down
- <kbd>Ctrl</kbd>/<kbd>⌘</kbd>+<kbd>Home</kbd>/<kbd>End</kbd> - jump to timeline start/end
+- <kbd>Ctrl</kbd>/<kbd>⌘</kbd>+<kbd>Home</kbd>/<kbd>End</kbd> - jump to
+  start/end of the composer when focused, otherwise jump to timeline start/end
+- <kbd>Ctrl</kbd>/<kbd>⌘</kbd>+<kbd>`</kbd> - toggle the top left menu
@@ -9,6 +9,9 @@
         Latest electron-builder does, but it appears to be causing issues:
         (https://github.com/electron-userland/electron-builder/issues/4390)
    -->
+    <!-- https://github.com/electron/electron-notarize#prerequisites -->
+    <key>com.apple.security.cs.allow-jit</key>
+    <true/>
    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
    <true/>
    <!-- https://github.com/electron-userland/electron-builder/issues/3940 -->
@@ -1,14 +0,0 @@
-#!/bin/bash
-
-# Link to the binary
-ln -sf '/opt/${productFilename}/${executable}' '/usr/bin/${executable}'
-
-# SUID chrome-sandbox for Electron 5+
-# Remove this entire file (after-install.tpl) and remove the reference in
-# package.json once this change has been upstreamed so we go back to the copy
-# from upstream.
-# https://github.com/electron-userland/electron-builder/pull/4163
-chmod 4755 '/opt/${productFilename}/chrome-sandbox' || true
-
-update-mime-database /usr/share/mime || true
-update-desktop-database /usr/share/applications || true
@@ -2,7 +2,7 @@
  "name": "riot-web",
  "productName": "Riot",
  "main": "src/electron-main.js",
-  "version": "1.5.8",
+  "version": "1.5.11",
  "description": "A feature-rich client for Matrix.org",
  "author": "New Vector Ltd.",
  "dependencies": {
@@ -22,7 +22,7 @@
    "piwik": {
        "url": "https://piwik.riot.im/",
        "siteId": 1,
-        "policyUrl": "https://matrix.org/docs/guides/riot_im_cookie_policy"
+        "policyUrl": "https://matrix.org/legal/riot-im-cookie-policy"
    },
    "phasedRollOut": {
        "feature_lazyloading": {
@@ -346,6 +346,18 @@ ipcMain.on('seshat', async function(ev, payload) {
            }
            break;

+        case 'getStats':
+            if (eventIndex === null) ret = 0;
+            else {
+                try {
+                    ret = await eventIndex.getStats();
+                } catch (e) {
+                    sendError(payload.id, e);
+                    return;
+                }
+            }
+            break;
+
        case 'removeCrawlerCheckpoint':
            if (eventIndex === null) ret = false;
            else {
@@ -370,6 +382,18 @@ ipcMain.on('seshat', async function(ev, payload) {
            }
            break;

+        case 'loadFileEvents':
+            if (eventIndex === null) ret = [];
+            else {
+                try {
+                    ret = await eventIndex.loadFileEvents(args[0]);
+                } catch (e) {
+                    sendError(payload.id, e);
+                    return;
+                }
+            }
+            break;
+
        case 'loadCheckpoints':
            if (eventIndex === null) ret = [];
            else {
@@ -174,19 +174,8 @@ function onEditableContextMenu(ev, params) {

 module.exports = (webContents) => {
    webContents.on('new-window', onWindowOrNavigate);
-    // XXX: The below now does absolutely nothing because of
-    // https://github.com/electron/electron/issues/8841
-    // Whilst this isn't a security issue since without
-    // node integration and with the sandbox, it should be
-    // no worse than opening the site in Chrome, it obviously
-    // means the user has to restart Riot to make it usable
-    // again (often unintuitive because it minimises to the
-    // system tray). We therefore need to be vigilant about
-    // putting target="_blank" on links in Riot (although
-    // we should generally be doing this anyway since links
-    // navigating you away from Riot in the browser is
-    // also annoying).
-    webContents.on('will-navigate', onWindowOrNavigate);
+    // XXX: https://github.com/vector-im/riot-web/issues/8247
+    // webContents.on('will-navigate', onWindowOrNavigate);

    webContents.on('context-menu', function(ev, params) {
        if (params.linkURL || params.srcURL) {
@@ -2,7 +2,7 @@
  "name": "riot-web",
  "productName": "Riot",
  "main": "electron_app/src/electron-main.js",
-  "version": "1.5.8",
+  "version": "1.5.11",
  "description": "A feature-rich client for Matrix.org",
  "author": "New Vector Ltd.",
  "repository": {
@@ -24,7 +24,8 @@
    "LICENSE",
    "README.md",
    "AUTHORS.rst",
-    "package.json"
+    "package.json",
+    "contribute.json"
  ],
  "style": "bundle.css",
  "scripts": {
@@ -65,9 +66,8 @@
    "gemini-scrollbar": "github:matrix-org/gemini-scrollbar#91e1e566",
    "gfm.css": "^1.1.2",
    "highlight.js": "^9.13.1",
-    "matrix-js-sdk": "4.0.0",
-    "matrix-react-sdk": "2.0.0",
-    "modernizr": "^3.6.0",
+    "matrix-js-sdk": "5.1.0",
+    "matrix-react-sdk": "2.2.0",
    "olm": "https://packages.matrix.org/npm/olm/olm-3.1.4.tgz",
    "postcss-easings": "^2.0.0",
    "prop-types": "^15.7.2",
@@ -106,8 +106,8 @@
    "cpx": "^1.3.2",
    "cross-env": "^6.0.3",
    "css-loader": "^3.3.2",
-    "electron-builder": "^21.2.0",
-    "electron-builder-squirrel-windows": "^21.2.0",
+    "electron-builder": "^22.3.2",
+    "electron-builder-squirrel-windows": "^22.3.2",
    "electron-devtools-installer": "^2.2.4",
    "electron-notarize": "^0.2.0",
    "eslint": "^5.8.0",
@@ -131,6 +131,7 @@
    "mini-css-extract-plugin": "^0.8.0",
    "minimist": "^1.2.0",
    "mkdirp": "^0.5.1",
+    "modernizr": "^3.6.0",
    "optimize-css-assets-webpack-plugin": "^5.0.3",
    "postcss-extend": "^1.0.5",
    "postcss-import": "^12.0.1",
@@ -152,7 +153,7 @@
  },
  "build": {
    "appId": "im.riot.app",
-    "electronVersion": "7.1.9",
+    "electronVersion": "8.0.2",
    "files": [
      "node_modules/**",
      "src/**"
@@ -172,9 +173,6 @@
        "StartupWMClass": "riot"
      }
    },
-    "deb": {
-      "afterInstall": "electron_app/build/linux/after-install.tpl"
-    },
    "mac": {
      "category": "public.app-category.social-networking",
      "darkModeSupport": true
@@ -193,6 +191,9 @@
    "afterSign": "scripts/electron_afterSign.js"
  },
  "jest": {
+    "modulePathIgnorePatterns": [
+      "<rootDir>/electron_app"
+    ],
    "testEnvironment": "jest-environment-jsdom-fourteen",
    "testMatch": [
      "<rootDir>/test/**/*-test.js"
@@ -205,7 +206,9 @@
      "\\$webapp/i18n/languages.json": "<rootDir>/node_modules/matrix-react-sdk/__mocks__/languages.json",
      "^browser-request$": "<rootDir>/node_modules/matrix-react-sdk/__mocks__/browser-request.js",
      "^react$": "<rootDir>/node_modules/react",
-      "^react-dom$": "<rootDir>/node_modules/react-dom"
+      "^react-dom$": "<rootDir>/node_modules/react-dom",
+      "^matrix-js-sdk$": "<rootDir>/node_modules/matrix-js-sdk/src",
+      "^matrix-react-sdk$": "<rootDir>/node_modules/matrix-react-sdk/src"
    },
    "transformIgnorePatterns": [
      "/node_modules/(?!matrix-js-sdk).+$",
@@ -21,29 +21,57 @@ cd `dirname $0`
 for i in matrix-js-sdk matrix-react-sdk
 do
    depver=`cat package.json | jq -r .dependencies[\"$i\"]`
-    latestver=`yarn info -s $i version`
+    latestver=`yarn info -s $i dist-tags.next`
    if [ "$depver" != "$latestver" ]
    then
-        echo "The latest version of $i is $latestver but package.json depends on $depver"
-        echo -n "Type 'Yes' to continue anyway: "
+        echo "The latest version of $i is $latestver but package.json depends on $depver."
+        echo -n "Type 'u' to auto-upgrade, 'c' to continue anyway, or 'a' to abort:"
        read resp
-        if [ "$resp" != "Yes" ]
+        if [ "$resp" != "u" ] && [ "$resp" != "c" ]
        then
-            echo "OK, never mind."
+            echo "Aborting."
            exit 1
        fi
+        if [ "$resp" == "u" ]
+        then
+            echo "Upgrading $i to $latestver..."
+            yarn add -E $i@$latestver
+            git add -u
+            # The `-e` flag opens the editor and gives you a chance to check
+            # the upgrade for correctness.
+            git commit -m "Upgrade $i to $latestver" -e
+        fi
    fi
 done

-# bump Electron's package.json first
 release="${1#v}"
 tag="v${release}"
-echo "electron yarn version"
+prerelease=0
+# We check if this build is a prerelease by looking to
+# see if the version has a hyphen in it. Crude,
+# but semver doesn't support postreleases so anything
+# with a hyphen is a prerelease.
+echo $release | grep -q '-' && prerelease=1

+# bump Electron's package.json first
+echo "electron yarn version"
 cd electron_app
 yarn version --no-git-tag-version --new-version "$release"
 git commit package.json -m "$tag"

 cd ..

-exec ./node_modules/matrix-js-sdk/release.sh -u vector-im -z "$orig_args"
+./node_modules/matrix-js-sdk/release.sh -u vector-im -z "$orig_args"
+
+if [ $prerelease -eq 0 ]
+then
+    # For a release, reset SDK deps back to the `develop` branch.
+    for i in matrix-js-sdk matrix-react-sdk
+    do
+        echo "Resetting $i to develop branch..."
+        yarn add github:matrix-org/$i#develop
+        git add -u
+        git commit -m "Reset $i back to develop branch"
+    done
+    git push origin develop
+fi
@@ -18,7 +18,7 @@
    "piwik": {
        "url": "https://piwik.riot.im/",
        "siteId": 1,
-        "policyUrl": "https://matrix.org/docs/guides/riot_im_cookie_policy"
+        "policyUrl": "https://matrix.org/legal/riot-im-cookie-policy"
    },
    "roomDirectory": {
        "servers": [
@@ -35,7 +35,7 @@
            "text": "Privacy Policy"
        },
        {
-            "url": "https://matrix.org/docs/guides/riot_im_cookie_policy",
+            "url": "https://matrix.org/legal/riot-im-cookie-policy",
            "text": "Cookie Policy"
        }
    ]
@@ -20,9 +20,9 @@
        "feature_many_integration_managers": "labs",
        "feature_mjolnir": "labs",
        "feature_dm_verification": "labs",
-        "feature_cross_signing": "labs",
+        "feature_cross_signing": "enable",
+        "feature_invite_only_padlocks": "enable",
        "feature_event_indexing": "disable",
-        "feature_ftue_dms": "labs",
        "feature_bridge_state": "labs",
        "feature_presence_in_room_list": "labs"
    },
@@ -30,7 +30,7 @@
    "piwik": {
        "url": "https://piwik.riot.im/",
        "siteId": 1,
-        "policyUrl": "https://matrix.org/docs/guides/riot_im_cookie_policy"
+        "policyUrl": "https://matrix.org/legal/riot-im-cookie-policy"
    },
    "roomDirectory": {
        "servers": [
@@ -47,7 +47,7 @@
            "text": "Privacy Policy"
        },
        {
-            "url": "https://matrix.org/docs/guides/riot_im_cookie_policy",
+            "url": "https://matrix.org/legal/riot-im-cookie-policy",
            "text": "Cookie Policy"
        }
    ]
@@ -66,6 +66,7 @@ const COPY_LIST = [
    ["node_modules/matrix-react-sdk/res/media/**", "webapp/media"],
    ["node_modules/olm/olm_legacy.js", "webapp", { directwatch: 1 }],
    ["./config.json", "webapp", { directwatch: 1 }],
+    ["contribute.json", "webapp"],
 ];

 const parseArgs = require('minimist');
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/bin/bash

 set -ex

@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/bin/bash

 set -ex

@@ -10,7 +10,13 @@ exports.default = async function(context) {
        // from the keychain, so we need to get it from the environment.
        const userId = process.env.NOTARIZE_APPLE_ID;
        if (userId === undefined) {
-            throw new Error("User ID not found. Set NOTARIZE_APPLE_ID.");
+            console.warn(
+                "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!\n" +
+                "! Skipping macOS notarisation.              !\n" +
+                "! User ID not found, set NOTARIZE_APPLE_ID. !\n" +
+                "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!",
+            );
+            return;
        }

        console.log("Notarising macOS app. This may be some time.");
@@ -8,23 +8,31 @@ exports.default = async function(options) {
    const appOutDir = path.dirname(inPath);

    // get the token passphrase from the keychain
-    const tokenPassphrase = await new Promise((resolve, reject) => {
-        execFile(
-            'security',
-            ['find-generic-password', '-s', 'riot_signing_token', '-w'],
-            {},
-            (err, stdout) => {
-                if (err) {
-                    console.error("Couldn't find signing token in keychain", err);
-                    // electron-builder seems to print '[object Object]' on the
-                    // console whether you reject with an Error or a string...
-                    reject(err);
-                } else {
-                    resolve(stdout.trim());
-                }
-            },
+    let tokenPassphrase;
+    try {
+        tokenPassphrase = await new Promise((resolve, reject) => {
+            execFile(
+                'security',
+                ['find-generic-password', '-s', 'riot_signing_token', '-w'],
+                {},
+                (err, stdout) => {
+                    if (err) {
+                        reject(err);
+                    } else {
+                        resolve(stdout.trim());
+                    }
+                },
+            );
+        });
+    } catch (err) {
+        console.warn(
+            "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!\n" +
+            "! Skipping Windows signing.            !\n" +
+            "! Signing token not found in keychain. !\n" +
+            "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!",
        );
-    });
+        return;
+    }

    return new Promise((resolve, reject) => {
        let cmdLine = 'osslsigncode sign ';
@@ -29,7 +29,7 @@ export default class VectorEmbeddedPage extends EmbeddedPage {
    translate(s) {
        s = sanitizeHtml(_t(s));
        // ugly fix for https://github.com/vector-im/riot-web/issues/4243
-        s = s.replace(/\[matrix\]/, '<a href="https://matrix.org" target="_blank" rel="noopener"><img width="79" height="34" alt="[matrix]" style="padding-left: 1px;vertical-align: middle" src="welcome/images/matrix.svg"/></a>');
+        s = s.replace(/\[matrix\]/, '<a href="https://matrix.org" target="_blank" rel="noreferrer noopener"><img width="79" height="34" alt="[matrix]" style="padding-left: 1px;vertical-align: middle" src="welcome/images/matrix.svg"/></a>');
        return s;
    }
 }
@@ -34,7 +34,7 @@ const VectorAuthFooter = () => {
    const authFooterLinks = [];
    for (const linkEntry of links) {
        authFooterLinks.push(
-            <a href={linkEntry.url} key={linkEntry.text} target="_blank" rel="noopener">
+            <a href={linkEntry.url} key={linkEntry.text} target="_blank" rel="noreferrer noopener">
                {linkEntry.text}
            </a>,
        );
@@ -43,7 +43,7 @@ const VectorAuthFooter = () => {
    return (
        <div className="mx_AuthFooter">
            {authFooterLinks}
-            <a href="https://matrix.org" target="_blank" rel="noopener">{ _t('powered by Matrix') }</a>
+            <a href="https://matrix.org" target="_blank" rel="noreferrer noopener">{ _t('powered by Matrix') }</a>
        </div>
    );
 };
@@ -1,10 +1,10 @@
 {
    "Custom Server Options": "Egyedi szerverbeállítások",
-    "Dismiss": "Eltüntet",
+    "Dismiss": "Eltüntetés",
    "powered by Matrix": "Matrix hajtja",
    "%(appName)s via %(browserName)s on %(osName)s": "%(appName)s alkalmazás %(browserName)s böngészőn %(osName)s rendszeren",
    "Riot Desktop on %(platformName)s": "Riot Desktop itt: %(platformName)s",
-    "Unknown device": "Ismeretlen készülék",
+    "Unknown device": "Ismeretlen eszköz",
    "You need to be using HTTPS to place a screen-sharing call.": "Képernyőmegosztás indításához HTTPS-t kell használnod.",
    "Welcome to Riot.im": "Üdvözöl a Riot.im",
    "Decentralised, encrypted chat &amp; collaboration powered by [matrix]": "Decentralizált, titkosított csevegés és kollaboráció [matrix] alapokon",
@@ -14,7 +14,7 @@
    "Create Account": "Fiók készítés",
    "Need help?": "Segíthetünk?",
    "Explore rooms": "Szobák felderítése",
-    "Room Directory": "Szoba lista",
+    "Room Directory": "Szobalista",
    "Unexpected error preparing the app. See console for details.": "Váratlan hiba történt az alkalmazás előkészítésénél. A részletekért nézd meg a konzolt.",
    "Invalid configuration: can only specify one of default_server_config, default_server_name, or default_hs_url.": "Érvénytelen konfiguráció: csak egyet lehet megadni a default_server_config, default_server_name és default_hs_url közül.",
    "Invalid configuration: no default server specified.": "Érvénytelen konfiguráció: nincs megadva alapértelmezett szerver.",
@@ -0,0 +1 @@
+{}
@@ -7,14 +7,17 @@
    "You need to be using HTTPS to place a screen-sharing call.": "Du er nødt til å bruke HTTPS for å ha en samtale med skjermdeling.",
    "Dismiss": "Avvis",
    "Welcome to Riot.im": "Velkommen til Riot.im",
-    "Decentralised, encrypted chat &amp; collaboration powered by [matrix]": "Desentralisert, kryptert chat &amp; sammabeid drevet av [matrix]",
+    "Decentralised, encrypted chat &amp; collaboration powered by [matrix]": "Desentralisert, kryptert chat &amp; samarbeid drevet av [matrix]",
    "Chat with Riot Bot": "Chat med Riot Bot",
-    "You can use the custom server options to sign into other Matrix servers by specifying a different homeserver URL. This allows you to use Riot with an existing Matrix account on a different homeserver.": "Du kan bruke instillinger for «egendefinert tjener» til å logge inn på andre Matrix tjenere ved å spesifisere en annen URL. Dette lar deg bruke Riot med en eksisterende Matrix konto på en annen hjemmetjener.",
+    "You can use the custom server options to sign into other Matrix servers by specifying a different homeserver URL. This allows you to use Riot with an existing Matrix account on a different homeserver.": "Du kan bruke instillinger for «egendefinert tjener» til å logge inn på andre Matrix-tjenere ved å spesifisere en annen URL. Dette lar deg bruke Riot med en eksisterende Matrix-konto på en annen hjemmetjener.",
    "Sign In": "Logg inn",
    "Create Account": "Lag konto",
    "Need help?": "Trenger du hjelp?",
    "Room Directory": "Alle rom",
    "Explore rooms": "Se alle rom",
    "Your Riot configuration contains invalid JSON. Please correct the problem and reload the page.": "Riot-konfigurasjonen din inneholder ugyldig JSON. Vennligst fiks problemet og oppdater siden.",
-    "The message from the parser is: %(message)s": "Meldingen fra parseren er: %(message)s"
+    "The message from the parser is: %(message)s": "Meldingen fra parseren er: %(message)s",
+    "Invalid JSON": "Ugyldig JSON",
+    "Your Riot is misconfigured": "Riot er feilkonfigurert",
+    "Invalid configuration: no default server specified.": "Ugyldig konfigurasjon: ingen standardserver spesifisert."
 }
@@ -2,7 +2,7 @@
    "Riot Desktop on %(platformName)s": "Riot på Skrivebord for %(platformName)s",
    "Unknown device": "Ukjend eining",
    "%(appName)s via %(browserName)s on %(osName)s": "%(appName)s gjennom %(browserName)s på %(osName)s",
-    "You need to be using HTTPS to place a screen-sharing call.": "Du må bruka HTTPS for å ha ei samtale med skjermdeling.",
+    "You need to be using HTTPS to place a screen-sharing call.": "Du må bruka HTTPS for å ha ein samtale med skjermdeling.",
    "Dismiss": "Avvis",
    "powered by Matrix": "Matrixdriven",
    "Welcome to Riot.im": "Velkomen til Riot.im",
@@ -16,7 +16,7 @@
    "Explore rooms": "Utforsk romma",
    "Room Directory": "Romkatalog",
    "Your Riot configuration contains invalid JSON. Please correct the problem and reload the page.": "Riot-konfigurasjonen din har ugyldig JSON-kode. Korriger dette og last inn sida på nytt.",
-    "The message from the parser is: %(message)s": "Meldingen frå kodetolkaren er: %(message)s",
+    "The message from the parser is: %(message)s": "Meldinga frå kodetolkaren er: %(message)s",
    "Invalid JSON": "Ugyldig JSON",
    "Your Riot is misconfigured": "Riot-klienten din er feilkonfiguert",
    "Unexpected error preparing the app. See console for details.": "Uventa feil under lasting av programmet. Sjå konsollen for detaljar.",
@@ -0,0 +1,486 @@
+/*
+Copyright 2015, 2016 OpenMarket Ltd
+Copyright 2017 Vector Creations Ltd
+Copyright 2018, 2019 New Vector Ltd
+Copyright 2019 Michael Telatynski <7t3chguy@gmail.com>
+Copyright 2020 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import olmWasmPath from 'olm/olm.wasm';
+
+import React from 'react';
+// add React and ReactPerf to the global namespace, to make them easier to
+// access via the console
+global.React = React;
+
+import ReactDOM from 'react-dom';
+import * as sdk from 'matrix-react-sdk';
+import PlatformPeg from 'matrix-react-sdk/src/PlatformPeg';
+import * as VectorConferenceHandler from 'matrix-react-sdk/src/VectorConferenceHandler';
+import * as languageHandler from 'matrix-react-sdk/src/languageHandler';
+import {_t, _td, newTranslatableError} from 'matrix-react-sdk/src/languageHandler';
+import AutoDiscoveryUtils from 'matrix-react-sdk/src/utils/AutoDiscoveryUtils';
+import {AutoDiscovery} from "matrix-js-sdk/src/autodiscovery";
+import * as Lifecycle from "matrix-react-sdk/src/Lifecycle";
+
+import url from 'url';
+
+import {parseQs, parseQsFromFragment} from './url_utils';
+
+import ElectronPlatform from './platform/ElectronPlatform';
+import WebPlatform from './platform/WebPlatform';
+
+import {MatrixClientPeg} from 'matrix-react-sdk/src/MatrixClientPeg';
+import SettingsStore from "matrix-react-sdk/src/settings/SettingsStore";
+import SdkConfig from "matrix-react-sdk/src/SdkConfig";
+import {setTheme} from "matrix-react-sdk/src/theme";
+
+import Olm from 'olm';
+
+import CallHandler from 'matrix-react-sdk/src/CallHandler';
+
+let lastLocationHashSet = null;
+
+function checkBrowserFeatures() {
+    if (!window.Modernizr) {
+        console.error("Cannot check features - Modernizr global is missing.");
+        return false;
+    }
+
+    // custom checks atop Modernizr because it doesn't have ES2018/ES2019 checks in it for some features we depend on,
+    // Modernizr requires rules to be lowercase with no punctuation:
+    // ES2018: http://www.ecma-international.org/ecma-262/9.0/#sec-promise.prototype.finally
+    window.Modernizr.addTest("promiseprototypefinally", () =>
+        window.Promise && window.Promise.prototype && typeof window.Promise.prototype.finally === "function");
+    // ES2019: http://www.ecma-international.org/ecma-262/10.0/#sec-object.fromentries
+    window.Modernizr.addTest("objectfromentries", () =>
+        window.Object && typeof window.Object.fromEntries === "function");
+
+    const featureList = Object.keys(window.Modernizr);
+
+    let featureComplete = true;
+    for (let i = 0; i < featureList.length; i++) {
+        if (window.Modernizr[featureList[i]] === undefined) {
+            console.error(
+                "Looked for feature '%s' but Modernizr has no results for this. " +
+                "Has it been configured correctly?", featureList[i],
+            );
+            return false;
+        }
+        if (window.Modernizr[featureList[i]] === false) {
+            console.error("Browser missing feature: '%s'", featureList[i]);
+            // toggle flag rather than return early so we log all missing features rather than just the first.
+            featureComplete = false;
+        }
+    }
+    return featureComplete;
+}
+
+// Parse the given window.location and return parameters that can be used when calling
+// MatrixChat.showScreen(screen, params)
+function getScreenFromLocation(location) {
+    const fragparts = parseQsFromFragment(location);
+    return {
+        screen: fragparts.location.substring(1),
+        params: fragparts.params,
+    };
+}
+
+// Here, we do some crude URL analysis to allow
+// deep-linking.
+function routeUrl(location) {
+    if (!window.matrixChat) return;
+
+    console.log("Routing URL ", location.href);
+    const s = getScreenFromLocation(location);
+    window.matrixChat.showScreen(s.screen, s.params);
+}
+
+function onHashChange(ev) {
+    if (decodeURIComponent(window.location.hash) === lastLocationHashSet) {
+        // we just set this: no need to route it!
+        return;
+    }
+    routeUrl(window.location);
+}
+
+// This will be called whenever the SDK changes screens,
+// so a web page can update the URL bar appropriately.
+function onNewScreen(screen) {
+    console.log("newscreen "+screen);
+    const hash = '#/' + screen;
+    lastLocationHashSet = hash;
+    window.location.hash = hash;
+}
+
+// We use this to work out what URL the SDK should
+// pass through when registering to allow the user to
+// click back to the client having registered.
+// It's up to us to recognise if we're loaded with
+// this URL and tell MatrixClient to resume registration.
+//
+// If we're in electron, we should never pass through a file:// URL otherwise
+// the identity server will try to 302 the browser to it, which breaks horribly.
+// so in that instance, hardcode to use riot.im/app for now instead.
+function makeRegistrationUrl(params) {
+    let url;
+    if (window.location.protocol === "vector:") {
+        url = 'https://riot.im/app/#/register';
+    } else {
+        url = (
+            window.location.protocol + '//' +
+            window.location.host +
+            window.location.pathname +
+            '#/register'
+        );
+    }
+
+    const keys = Object.keys(params);
+    for (let i = 0; i < keys.length; ++i) {
+        if (i === 0) {
+            url += '?';
+        } else {
+            url += '&';
+        }
+        const k = keys[i];
+        url += k + '=' + encodeURIComponent(params[k]);
+    }
+    return url;
+}
+
+function onTokenLoginCompleted() {
+    // if we did a token login, we're now left with the token, hs and is
+    // url as query params in the url; a little nasty but let's redirect to
+    // clear them.
+    const parsedUrl = url.parse(window.location.href);
+    parsedUrl.search = "";
+    const formatted = url.format(parsedUrl);
+    console.log("Redirecting to " + formatted + " to drop loginToken " +
+        "from queryparams");
+    window.location.href = formatted;
+}
+
+export async function loadApp() {
+    // XXX: the way we pass the path to the worker script from webpack via html in body's dataset is a hack
+    // but alternatives seem to require changing the interface to passing Workers to js-sdk
+    const vectorIndexeddbWorkerScript = document.body.dataset.vectorIndexeddbWorkerScript;
+    if (!vectorIndexeddbWorkerScript) {
+        // If this is missing, something has probably gone wrong with
+        // the bundling. The js-sdk will just fall back to accessing
+        // indexeddb directly with no worker script, but we want to
+        // make sure the indexeddb script is present, so fail hard.
+        throw new Error("Missing indexeddb worker script!");
+    }
+    MatrixClientPeg.setIndexedDbWorkerScript(vectorIndexeddbWorkerScript);
+    CallHandler.setConferenceHandler(VectorConferenceHandler);
+
+    window.addEventListener('hashchange', onHashChange);
+
+    await loadOlm();
+
+    // set the platform for react sdk
+    if (window.ipcRenderer) {
+        console.log("Using Electron platform");
+        const plaf = new ElectronPlatform();
+        PlatformPeg.set(plaf);
+    } else {
+        console.log("Using Web platform");
+        PlatformPeg.set(new WebPlatform());
+    }
+
+    const platform = PlatformPeg.get();
+
+    let configJson;
+    let configError;
+    let configSyntaxError = false;
+    try {
+        configJson = await platform.getConfig();
+    } catch (e) {
+        configError = e;
+
+        if (e && e.err && e.err instanceof SyntaxError) {
+            console.error("SyntaxError loading config:", e);
+            configSyntaxError = true;
+            configJson = {}; // to prevent errors between here and loading CSS for the error box
+        }
+    }
+
+    // XXX: We call this twice, once here and once in MatrixChat as a prop. We call it here to ensure
+    // granular settings are loaded correctly and to avoid duplicating the override logic for the theme.
+    SdkConfig.put(configJson);
+
+    // Load language after loading config.json so that settingsDefaults.language can be applied
+    await loadLanguage();
+
+    const fragparts = parseQsFromFragment(window.location);
+    const params = parseQs(window.location);
+
+    // don't try to redirect to the native apps if we're
+    // verifying a 3pid (but after we've loaded the config)
+    // or if the user is following a deep link
+    // (https://github.com/vector-im/riot-web/issues/7378)
+    const preventRedirect = fragparts.params.client_secret || fragparts.location.length > 0;
+
+    if (!preventRedirect) {
+        const isIos = /iPad|iPhone|iPod/.test(navigator.userAgent) && !window.MSStream;
+        const isAndroid = /Android/.test(navigator.userAgent);
+        if (isIos || isAndroid) {
+            if (document.cookie.indexOf("riot_mobile_redirect_to_guide=false") === -1) {
+                window.location = "mobile_guide/";
+                return;
+            }
+        }
+    }
+
+    // as quickly as we possibly can, set a default theme...
+    await setTheme();
+
+    // Now that we've loaded the theme (CSS), display the config syntax error if needed.
+    if (configSyntaxError) {
+        const errorMessage = (
+            <div>
+                <p>
+                    {_t(
+                        "Your Riot configuration contains invalid JSON. Please correct the problem " +
+                        "and reload the page.",
+                    )}
+                </p>
+                <p>
+                    {_t(
+                        "The message from the parser is: %(message)s",
+                        {message: configError.err.message || _t("Invalid JSON")},
+                    )}
+                </p>
+            </div>
+        );
+
+        const GenericErrorPage = sdk.getComponent("structures.GenericErrorPage");
+        window.matrixChat = ReactDOM.render(
+            <GenericErrorPage message={errorMessage} title={_t("Your Riot is misconfigured")} />,
+            document.getElementById('matrixchat'),
+        );
+        return;
+    }
+
+    const validBrowser = checkBrowserFeatures();
+
+    const acceptInvalidBrowser = window.localStorage && window.localStorage.getItem('mx_accepts_unsupported_browser');
+
+    const urlWithoutQuery = window.location.protocol + '//' + window.location.host + window.location.pathname;
+    console.log("Vector starting at " + urlWithoutQuery);
+    if (configError) {
+        window.matrixChat = ReactDOM.render(<div className="error">
+            Unable to load config file: please refresh the page to try again.
+        </div>, document.getElementById('matrixchat'));
+    } else if (validBrowser || acceptInvalidBrowser) {
+        platform.startUpdater();
+
+        // Don't bother loading the app until the config is verified
+        verifyServerConfig().then((newConfig) => {
+            const MatrixChat = sdk.getComponent('structures.MatrixChat');
+            window.matrixChat = ReactDOM.render(
+                <MatrixChat
+                    onNewScreen={onNewScreen}
+                    makeRegistrationUrl={makeRegistrationUrl}
+                    ConferenceHandler={VectorConferenceHandler}
+                    config={newConfig}
+                    realQueryParams={params}
+                    startingFragmentQueryParams={fragparts.params}
+                    enableGuest={!configJson.disable_guests}
+                    onTokenLoginCompleted={onTokenLoginCompleted}
+                    initialScreenAfterLogin={getScreenFromLocation(window.location)}
+                    defaultDeviceDisplayName={platform.getDefaultDeviceDisplayName()}
+                />,
+                document.getElementById('matrixchat'),
+            );
+        }).catch(err => {
+            console.error(err);
+
+            let errorMessage = err.translatedMessage
+                || _t("Unexpected error preparing the app. See console for details.");
+            errorMessage = <span>{errorMessage}</span>;
+
+            // Like the compatibility page, AWOOOOOGA at the user
+            const GenericErrorPage = sdk.getComponent("structures.GenericErrorPage");
+            window.matrixChat = ReactDOM.render(
+                <GenericErrorPage message={errorMessage} title={_t("Your Riot is misconfigured")} />,
+                document.getElementById('matrixchat'),
+            );
+        });
+    } else {
+        console.error("Browser is missing required features.");
+        // take to a different landing page to AWOOOOOGA at the user
+        const CompatibilityPage = sdk.getComponent("structures.CompatibilityPage");
+        window.matrixChat = ReactDOM.render(
+            <CompatibilityPage onAccept={function() {
+                if (window.localStorage) window.localStorage.setItem('mx_accepts_unsupported_browser', true);
+                console.log("User accepts the compatibility risks.");
+                loadApp();
+            }} />,
+            document.getElementById('matrixchat'),
+        );
+    }
+}
+
+function loadOlm() {
+    /* Load Olm. We try the WebAssembly version first, and then the legacy,
+     * asm.js version if that fails. For this reason we need to wait for this
+     * to finish before continuing to load the rest of the app. In future
+     * we could somehow pass a promise down to react-sdk and have it wait on
+     * that so olm can be loading in parallel with the rest of the app.
+     *
+     * We also need to tell the Olm js to look for its wasm file at the same
+     * level as index.html. It really should be in the same place as the js,
+     * ie. in the bundle directory, but as far as I can tell this is
+     * completely impossible with webpack. We do, however, use a hashed
+     * filename to avoid caching issues.
+     */
+    return Olm.init({
+        locateFile: () => olmWasmPath,
+    }).then(() => {
+        console.log("Using WebAssembly Olm");
+    }).catch((e) => {
+        console.log("Failed to load Olm: trying legacy version", e);
+        return new Promise((resolve, reject) => {
+            const s = document.createElement('script');
+            s.src = 'olm_legacy.js'; // XXX: This should be cache-busted too
+            s.onload = resolve;
+            s.onerror = reject;
+            document.body.appendChild(s);
+        }).then(() => {
+            // Init window.Olm, ie. the one just loaded by the script tag,
+            // not 'Olm' which is still the failed wasm version.
+            return window.Olm.init();
+        }).then(() => {
+            console.log("Using legacy Olm");
+        }).catch((e) => {
+            console.log("Both WebAssembly and asm.js Olm failed!", e);
+        });
+    });
+}
+
+async function loadLanguage() {
+    const prefLang = SettingsStore.getValue("language", null, /*excludeDefault=*/true);
+    let langs = [];
+
+    if (!prefLang) {
+        languageHandler.getLanguagesFromBrowser().forEach((l) => {
+            langs.push(...languageHandler.getNormalizedLanguageKeys(l));
+        });
+    } else {
+        langs = [prefLang];
+    }
+    try {
+        await languageHandler.setLanguage(langs);
+        document.documentElement.setAttribute("lang", languageHandler.getCurrentLanguage());
+    } catch (e) {
+        console.error("Unable to set language", e);
+    }
+}
+
+async function verifyServerConfig() {
+    let validatedConfig;
+    try {
+        console.log("Verifying homeserver configuration");
+
+        // Note: the query string may include is_url and hs_url - we only respect these in the
+        // context of email validation. Because we don't respect them otherwise, we do not need
+        // to parse or consider them here.
+
+        // Note: Although we throw all 3 possible configuration options through a .well-known-style
+        // verification, we do not care if the servers are online at this point. We do moderately
+        // care if they are syntactically correct though, so we shove them through the .well-known
+        // validators for that purpose.
+
+        const config = SdkConfig.get();
+        let wkConfig = config['default_server_config']; // overwritten later under some conditions
+        const serverName = config['default_server_name'];
+        const hsUrl = config['default_hs_url'];
+        const isUrl = config['default_is_url'];
+
+        const incompatibleOptions = [wkConfig, serverName, hsUrl].filter(i => !!i);
+        if (incompatibleOptions.length > 1) {
+            // noinspection ExceptionCaughtLocallyJS
+            throw newTranslatableError(_td(
+                "Invalid configuration: can only specify one of default_server_config, default_server_name, " +
+                "or default_hs_url.",
+            ));
+        }
+        if (incompatibleOptions.length < 1) {
+            // noinspection ExceptionCaughtLocallyJS
+            throw newTranslatableError(_td("Invalid configuration: no default server specified."));
+        }
+
+        if (hsUrl) {
+            console.log("Config uses a default_hs_url - constructing a default_server_config using this information");
+            console.warn(
+                "DEPRECATED CONFIG OPTION: In the future, default_hs_url will not be accepted. Please use " +
+                "default_server_config instead.",
+            );
+
+            wkConfig = {
+                "m.homeserver": {
+                    "base_url": hsUrl,
+                },
+            };
+            if (isUrl) {
+                wkConfig["m.identity_server"] = {
+                    "base_url": isUrl,
+                };
+            }
+        }
+
+        let discoveryResult = null;
+        if (wkConfig) {
+            console.log("Config uses a default_server_config - validating object");
+            discoveryResult = await AutoDiscovery.fromDiscoveryConfig(wkConfig);
+        }
+
+        if (serverName) {
+            console.log("Config uses a default_server_name - doing .well-known lookup");
+            console.warn(
+                "DEPRECATED CONFIG OPTION: In the future, default_server_name will not be accepted. Please " +
+                "use default_server_config instead.",
+            );
+            discoveryResult = await AutoDiscovery.findClientConfig(serverName);
+        }
+
+        validatedConfig = AutoDiscoveryUtils.buildValidatedConfigFromDiscovery(serverName, discoveryResult, true);
+    } catch (e) {
+        const {hsUrl, isUrl, userId} = Lifecycle.getLocalStorageSessionVars();
+        if (hsUrl && userId) {
+            console.error(e);
+            console.warn("A session was found - suppressing config error and using the session's homeserver");
+
+            console.log("Using pre-existing hsUrl and isUrl: ", {hsUrl, isUrl});
+            validatedConfig = await AutoDiscoveryUtils.validateServerConfigWithStaticUrls(hsUrl, isUrl, true);
+        } else {
+            // the user is not logged in, so scream
+            throw e;
+        }
+    }
+
+
+    validatedConfig.isDefault = true;
+
+    // Just in case we ever have to debug this
+    console.log("Using homeserver config:", validatedConfig);
+
+    // Add the newly built config to the actual config for use by the app
+    console.log("Updating SdkConfig with validated discovery information");
+    SdkConfig.add({"validated_server_config": validatedConfig});
+
+    return SdkConfig.get();
+}
@@ -22,6 +22,21 @@
    <meta name="msapplication-config" content="<%= require('../../res/vector-icons/browserconfig.xml') %>">
    <meta name="theme-color" content="#ffffff">
    <meta property="og:image" content="<%= htmlWebpackPlugin.options.vars.og_image_url %>" />
+    <meta http-equiv="Content-Security-Policy" content="
+        default-src 'none';
+        style-src 'self' 'unsafe-inline';
+        script-src 'self' 'unsafe-eval' https://www.recaptcha.net https://www.gstatic.com;
+        img-src * blob: data:;
+        connect-src *;
+        font-src 'self' data:;
+        media-src * blob: data:;
+        child-src * blob: data:;
+        worker-src 'self';
+        frame-src * blob: data:;
+        form-action 'self';
+        object-src 'self';
+        manifest-src 'self';
+    ">
    <% for (var i=0; i < htmlWebpackPlugin.files.css.length; i++) {
        var file = htmlWebpackPlugin.files.css[i];
        var match = file.match(/^bundles\/.*?\/theme-(.*)\.css$/);
@@ -34,18 +49,10 @@
        <% }
    } %>
  </head>
-  <body style="height: 100%;">
+  <body style="height: 100%;" data-vector-indexeddb-worker-script="<%= htmlWebpackPlugin.files.chunks['indexeddb-worker'].entry %>">
    <section id="matrixchat" style="height: 100%; overflow: auto;"></section>
    <noscript>Sorry, Riot requires JavaScript to be enabled.</noscript> <!-- TODO: Translate this? -->
-    <script>
-        window.vector_indexeddb_worker_script = '<%= htmlWebpackPlugin.files.chunks['indexeddb-worker'].entry %>';
-    </script>
    <script src="<%= htmlWebpackPlugin.files.chunks['bundle'].entry %>"></script>
-    <script>
-      if ('serviceWorker' in navigator) {
-        navigator.serviceWorker.register('sw.js');
-      }
-    </script>
    <img src="<%= require('matrix-react-sdk/res/img/warning.svg') %>" width="24" height="23" style="visibility: hidden; position: absolute; top: 0px; left: 0px;"/>
    <img src="<%= require('matrix-react-sdk/res/img/e2e/warning.svg') %>" width="24" height="23" style="visibility: hidden; position: absolute; top: 0px; left: 0px;"/>
    <img src="<%= require('matrix-react-sdk/res/img/feather-customised/warning-triangle.svg') %>" width="24" height="23" style="visibility: hidden; position: absolute; top: 0px; left: 0px;"/>
@@ -3,6 +3,7 @@ Copyright 2015, 2016 OpenMarket Ltd
 Copyright 2017 Vector Creations Ltd
 Copyright 2018, 2019 New Vector Ltd
 Copyright 2019 Michael Telatynski <7t3chguy@gmail.com>
+Copyright 2020 The Matrix.org Foundation C.I.C.

 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -24,464 +25,24 @@ require('gemini-scrollbar/gemini-scrollbar.css');
 require('gfm.css/gfm.css');
 require('highlight.js/styles/github.css');

-import olmWasmPath from 'olm/olm.wasm';
-
+// These are things that can run before the skin loads - be careful not to reference the react-sdk though.
 import './rageshakesetup';
-
-import React from 'react';
-// add React and ReactPerf to the global namespace, to make them easier to
-// access via the console
-global.React = React;
-
 import './modernizr';
-import ReactDOM from 'react-dom';
+
+// load service worker if available on this platform
+if ('serviceWorker' in navigator) {
+    navigator.serviceWorker.register('sw.js');
+}
+
+// Ensure the skin is the very first thing to load for the react-sdk. We don't even want to reference
+// the SDK until we have to in imports.
+console.log("Loading skin...");
 import * as sdk from 'matrix-react-sdk';
-import PlatformPeg from 'matrix-react-sdk/src/PlatformPeg';
-sdk.loadSkin(require('../component-index'));
-import * as VectorConferenceHandler from 'matrix-react-sdk/src/VectorConferenceHandler';
-import * as languageHandler from 'matrix-react-sdk/src/languageHandler';
-import {_t, _td, newTranslatableError} from 'matrix-react-sdk/src/languageHandler';
-import AutoDiscoveryUtils from 'matrix-react-sdk/src/utils/AutoDiscoveryUtils';
-import {AutoDiscovery} from "matrix-js-sdk/src/autodiscovery";
-import * as Lifecycle from "matrix-react-sdk/src/Lifecycle";
+import * as skin from "../component-index";
+sdk.loadSkin(skin);
+console.log("Skin loaded!");

-import url from 'url';
-
-import {parseQs, parseQsFromFragment} from './url_utils';
-
-import ElectronPlatform from './platform/ElectronPlatform';
-import WebPlatform from './platform/WebPlatform';
-
-import {MatrixClientPeg} from 'matrix-react-sdk/src/MatrixClientPeg';
-import SettingsStore from "matrix-react-sdk/src/settings/SettingsStore";
-import SdkConfig from "matrix-react-sdk/src/SdkConfig";
-import {setTheme} from "matrix-react-sdk/src/theme";
-
-import Olm from 'olm';
-
-import CallHandler from 'matrix-react-sdk/src/CallHandler';
-
-let lastLocationHashSet = null;
-
-function checkBrowserFeatures(featureList) {
-    if (!window.Modernizr) {
-        console.error("Cannot check features - Modernizr global is missing.");
-        return false;
-    }
-    let featureComplete = true;
-    for (let i = 0; i < featureList.length; i++) {
-        if (window.Modernizr[featureList[i]] === undefined) {
-            console.error(
-                "Looked for feature '%s' but Modernizr has no results for this. " +
-                "Has it been configured correctly?", featureList[i],
-            );
-            return false;
-        }
-        if (window.Modernizr[featureList[i]] === false) {
-            console.error("Browser missing feature: '%s'", featureList[i]);
-            // toggle flag rather than return early so we log all missing features
-            // rather than just the first.
-            featureComplete = false;
-        }
-    }
-    return featureComplete;
-}
-
-// Parse the given window.location and return parameters that can be used when calling
-// MatrixChat.showScreen(screen, params)
-function getScreenFromLocation(location) {
-    const fragparts = parseQsFromFragment(location);
-    return {
-        screen: fragparts.location.substring(1),
-        params: fragparts.params,
-    };
-}
-
-// Here, we do some crude URL analysis to allow
-// deep-linking.
-function routeUrl(location) {
-    if (!window.matrixChat) return;
-
-    console.log("Routing URL ", location.href);
-    const s = getScreenFromLocation(location);
-    window.matrixChat.showScreen(s.screen, s.params);
-}
-
-function onHashChange(ev) {
-    if (decodeURIComponent(window.location.hash) === lastLocationHashSet) {
-        // we just set this: no need to route it!
-        return;
-    }
-    routeUrl(window.location);
-}
-
-// This will be called whenever the SDK changes screens,
-// so a web page can update the URL bar appropriately.
-function onNewScreen(screen) {
-    console.log("newscreen "+screen);
-    const hash = '#/' + screen;
-    lastLocationHashSet = hash;
-    window.location.hash = hash;
-}
-
-// We use this to work out what URL the SDK should
-// pass through when registering to allow the user to
-// click back to the client having registered.
-// It's up to us to recognise if we're loaded with
-// this URL and tell MatrixClient to resume registration.
-//
-// If we're in electron, we should never pass through a file:// URL otherwise
-// the identity server will try to 302 the browser to it, which breaks horribly.
-// so in that instance, hardcode to use riot.im/app for now instead.
-function makeRegistrationUrl(params) {
-    let url;
-    if (window.location.protocol === "vector:") {
-        url = 'https://riot.im/app/#/register';
-    } else {
-        url = (
-            window.location.protocol + '//' +
-            window.location.host +
-            window.location.pathname +
-            '#/register'
-        );
-    }
-
-    const keys = Object.keys(params);
-    for (let i = 0; i < keys.length; ++i) {
-        if (i === 0) {
-            url += '?';
-        } else {
-            url += '&';
-        }
-        const k = keys[i];
-        url += k + '=' + encodeURIComponent(params[k]);
-    }
-    return url;
-}
-
-function onTokenLoginCompleted() {
-    // if we did a token login, we're now left with the token, hs and is
-    // url as query params in the url; a little nasty but let's redirect to
-    // clear them.
-    const parsedUrl = url.parse(window.location.href);
-    parsedUrl.search = "";
-    const formatted = url.format(parsedUrl);
-    console.log("Redirecting to " + formatted + " to drop loginToken " +
-                "from queryparams");
-    window.location.href = formatted;
-}
-
-async function loadApp() {
-    if (window.vector_indexeddb_worker_script === undefined) {
-        // If this is missing, something has probably gone wrong with
-        // the bundling. The js-sdk will just fall back to accessing
-        // indexeddb directly with no worker script, but we want to
-        // make sure the indexeddb script is present, so fail hard.
-        throw new Error("Missing indexeddb worker script!");
-    }
-    MatrixClientPeg.setIndexedDbWorkerScript(window.vector_indexeddb_worker_script);
-    CallHandler.setConferenceHandler(VectorConferenceHandler);
-
-    window.addEventListener('hashchange', onHashChange);
-
-    await loadOlm();
-
-    // set the platform for react sdk
-    if (window.ipcRenderer) {
-        console.log("Using Electron platform");
-        const plaf = new ElectronPlatform();
-        PlatformPeg.set(plaf);
-    } else {
-        console.log("Using Web platform");
-        PlatformPeg.set(new WebPlatform());
-    }
-
-    const platform = PlatformPeg.get();
-
-    let configJson;
-    let configError;
-    let configSyntaxError = false;
-    try {
-        configJson = await platform.getConfig();
-    } catch (e) {
-        configError = e;
-
-        if (e && e.err && e.err instanceof SyntaxError) {
-            console.error("SyntaxError loading config:", e);
-            configSyntaxError = true;
-            configJson = {}; // to prevent errors between here and loading CSS for the error box
-        }
-    }
-
-    // XXX: We call this twice, once here and once in MatrixChat as a prop. We call it here to ensure
-    // granular settings are loaded correctly and to avoid duplicating the override logic for the theme.
-    SdkConfig.put(configJson);
-
-    // Load language after loading config.json so that settingsDefaults.language can be applied
-    await loadLanguage();
-
-    const fragparts = parseQsFromFragment(window.location);
-    const params = parseQs(window.location);
-
-    // don't try to redirect to the native apps if we're
-    // verifying a 3pid (but after we've loaded the config)
-    // or if the user is following a deep link
-    // (https://github.com/vector-im/riot-web/issues/7378)
-    const preventRedirect = fragparts.params.client_secret || fragparts.location.length > 0;
-
-    if (!preventRedirect) {
-        const isIos = /iPad|iPhone|iPod/.test(navigator.userAgent) && !window.MSStream;
-        const isAndroid = /Android/.test(navigator.userAgent);
-        if (isIos || isAndroid) {
-            if (document.cookie.indexOf("riot_mobile_redirect_to_guide=false") === -1) {
-                window.location = "mobile_guide/";
-                return;
-            }
-        }
-    }
-
-    // as quickly as we possibly can, set a default theme...
-    await setTheme();
-
-    // Now that we've loaded the theme (CSS), display the config syntax error if needed.
-    if (configSyntaxError) {
-        const errorMessage = (
-            <div>
-                <p>
-                    {_t(
-                        "Your Riot configuration contains invalid JSON. Please correct the problem " +
-                        "and reload the page.",
-                    )}
-                </p>
-                <p>
-                    {_t(
-                        "The message from the parser is: %(message)s",
-                        {message: configError.err.message || _t("Invalid JSON")},
-                    )}
-                </p>
-            </div>
-        );
-
-        const GenericErrorPage = sdk.getComponent("structures.GenericErrorPage");
-        window.matrixChat = ReactDOM.render(
-            <GenericErrorPage message={errorMessage} title={_t("Your Riot is misconfigured")} />,
-            document.getElementById('matrixchat'),
-        );
-        return;
-    }
-
-    const validBrowser = checkBrowserFeatures([
-        "displaytable", "flexbox", "es5object", "es5function", "localstorage",
-        "objectfit", "indexeddb", "webworkers",
-    ]);
-
-    const acceptInvalidBrowser = window.localStorage && window.localStorage.getItem('mx_accepts_unsupported_browser');
-
-    const urlWithoutQuery = window.location.protocol + '//' + window.location.host + window.location.pathname;
-    console.log("Vector starting at " + urlWithoutQuery);
-    if (configError) {
-        window.matrixChat = ReactDOM.render(<div className="error">
-            Unable to load config file: please refresh the page to try again.
-        </div>, document.getElementById('matrixchat'));
-    } else if (validBrowser || acceptInvalidBrowser) {
-        platform.startUpdater();
-
-        // Don't bother loading the app until the config is verified
-        verifyServerConfig().then((newConfig) => {
-            const MatrixChat = sdk.getComponent('structures.MatrixChat');
-            window.matrixChat = ReactDOM.render(
-                <MatrixChat
-                    onNewScreen={onNewScreen}
-                    makeRegistrationUrl={makeRegistrationUrl}
-                    ConferenceHandler={VectorConferenceHandler}
-                    config={newConfig}
-                    realQueryParams={params}
-                    startingFragmentQueryParams={fragparts.params}
-                    enableGuest={!configJson.disable_guests}
-                    onTokenLoginCompleted={onTokenLoginCompleted}
-                    initialScreenAfterLogin={getScreenFromLocation(window.location)}
-                    defaultDeviceDisplayName={platform.getDefaultDeviceDisplayName()}
-                />,
-                document.getElementById('matrixchat'),
-            );
-        }).catch(err => {
-            console.error(err);
-
-            let errorMessage = err.translatedMessage
-                || _t("Unexpected error preparing the app. See console for details.");
-            errorMessage = <span>{errorMessage}</span>;
-
-            // Like the compatibility page, AWOOOOOGA at the user
-            const GenericErrorPage = sdk.getComponent("structures.GenericErrorPage");
-            window.matrixChat = ReactDOM.render(
-                <GenericErrorPage message={errorMessage} title={_t("Your Riot is misconfigured")} />,
-                document.getElementById('matrixchat'),
-            );
-        });
-    } else {
-        console.error("Browser is missing required features.");
-        // take to a different landing page to AWOOOOOGA at the user
-        const CompatibilityPage = sdk.getComponent("structures.CompatibilityPage");
-        window.matrixChat = ReactDOM.render(
-            <CompatibilityPage onAccept={function() {
-                if (window.localStorage) window.localStorage.setItem('mx_accepts_unsupported_browser', true);
-                console.log("User accepts the compatibility risks.");
-                loadApp();
-            }} />,
-            document.getElementById('matrixchat'),
-        );
-    }
-}
-
-function loadOlm() {
-    /* Load Olm. We try the WebAssembly version first, and then the legacy,
-     * asm.js version if that fails. For this reason we need to wait for this
-     * to finish before continuing to load the rest of the app. In future
-     * we could somehow pass a promise down to react-sdk and have it wait on
-     * that so olm can be loading in parallel with the rest of the app.
-     *
-     * We also need to tell the Olm js to look for its wasm file at the same
-     * level as index.html. It really should be in the same place as the js,
-     * ie. in the bundle directory, but as far as I can tell this is
-     * completely impossible with webpack. We do, however, use a hashed
-     * filename to avoid caching issues.
-     */
-    return Olm.init({
-        locateFile: () => olmWasmPath,
-    }).then(() => {
-        console.log("Using WebAssembly Olm");
-    }).catch((e) => {
-        console.log("Failed to load Olm: trying legacy version", e);
-        return new Promise((resolve, reject) => {
-            const s = document.createElement('script');
-            s.src = 'olm_legacy.js'; // XXX: This should be cache-busted too
-            s.onload = resolve;
-            s.onerror = reject;
-            document.body.appendChild(s);
-        }).then(() => {
-            // Init window.Olm, ie. the one just loaded by the script tag,
-            // not 'Olm' which is still the failed wasm version.
-            return window.Olm.init();
-        }).then(() => {
-            console.log("Using legacy Olm");
-        }).catch((e) => {
-            console.log("Both WebAssembly and asm.js Olm failed!", e);
-        });
-    });
-}
-
-async function loadLanguage() {
-    const prefLang = SettingsStore.getValue("language", null, /*excludeDefault=*/true);
-    let langs = [];
-
-    if (!prefLang) {
-        languageHandler.getLanguagesFromBrowser().forEach((l) => {
-            langs.push(...languageHandler.getNormalizedLanguageKeys(l));
-        });
-    } else {
-        langs = [prefLang];
-    }
-    try {
-        await languageHandler.setLanguage(langs);
-        document.documentElement.setAttribute("lang", languageHandler.getCurrentLanguage());
-    } catch (e) {
-        console.error("Unable to set language", e);
-    }
-}
-
-async function verifyServerConfig() {
-    let validatedConfig;
-    try {
-        console.log("Verifying homeserver configuration");
-
-        // Note: the query string may include is_url and hs_url - we only respect these in the
-        // context of email validation. Because we don't respect them otherwise, we do not need
-        // to parse or consider them here.
-
-        // Note: Although we throw all 3 possible configuration options through a .well-known-style
-        // verification, we do not care if the servers are online at this point. We do moderately
-        // care if they are syntactically correct though, so we shove them through the .well-known
-        // validators for that purpose.
-
-        const config = SdkConfig.get();
-        let wkConfig = config['default_server_config']; // overwritten later under some conditions
-        const serverName = config['default_server_name'];
-        const hsUrl = config['default_hs_url'];
-        const isUrl = config['default_is_url'];
-
-        const incompatibleOptions = [wkConfig, serverName, hsUrl].filter(i => !!i);
-        if (incompatibleOptions.length > 1) {
-            // noinspection ExceptionCaughtLocallyJS
-            throw newTranslatableError(_td(
-                "Invalid configuration: can only specify one of default_server_config, default_server_name, " +
-                "or default_hs_url.",
-            ));
-        }
-        if (incompatibleOptions.length < 1) {
-            // noinspection ExceptionCaughtLocallyJS
-            throw newTranslatableError(_td("Invalid configuration: no default server specified."));
-        }
-
-        if (hsUrl) {
-            console.log("Config uses a default_hs_url - constructing a default_server_config using this information");
-            console.warn(
-                "DEPRECATED CONFIG OPTION: In the future, default_hs_url will not be accepted. Please use " +
-                "default_server_config instead.",
-            );
-
-            wkConfig = {
-                "m.homeserver": {
-                    "base_url": hsUrl,
-                },
-            };
-            if (isUrl) {
-                wkConfig["m.identity_server"] = {
-                    "base_url": isUrl,
-                };
-            }
-        }
-
-        let discoveryResult = null;
-        if (wkConfig) {
-            console.log("Config uses a default_server_config - validating object");
-            discoveryResult = await AutoDiscovery.fromDiscoveryConfig(wkConfig);
-        }
-
-        if (serverName) {
-            console.log("Config uses a default_server_name - doing .well-known lookup");
-            console.warn(
-                "DEPRECATED CONFIG OPTION: In the future, default_server_name will not be accepted. Please " +
-                "use default_server_config instead.",
-            );
-            discoveryResult = await AutoDiscovery.findClientConfig(serverName);
-        }
-
-        validatedConfig = AutoDiscoveryUtils.buildValidatedConfigFromDiscovery(serverName, discoveryResult, true);
-    } catch (e) {
-        const {hsUrl, isUrl, userId} = Lifecycle.getLocalStorageSessionVars();
-        if (hsUrl && userId) {
-            console.error(e);
-            console.warn("A session was found - suppressing config error and using the session's homeserver");
-
-            console.log("Using pre-existing hsUrl and isUrl: ", {hsUrl, isUrl});
-            validatedConfig = await AutoDiscoveryUtils.validateServerConfigWithStaticUrls(hsUrl, isUrl, true);
-        } else {
-            // the user is not logged in, so scream
-            throw e;
-        }
-    }
-
-
-    validatedConfig.isDefault = true;
-
-    // Just in case we ever have to debug this
-    console.log("Using homeserver config:", validatedConfig);
-
-    // Add the newly built config to the actual config for use by the app
-    console.log("Updating SdkConfig with validated discovery information");
-    SdkConfig.add({"validated_server_config": validatedConfig});
-
-    return SdkConfig.get();
-}
-
-loadApp();
+// Finally, load the app. All of the other react-sdk imports are in this file which causes the skinner to
+// run on the components. We use `require` here to make sure webpack doesn't optimize this into an async
+// import and thus running before the skin can load.
+require("./app").loadApp();
@@ -144,6 +144,10 @@ class SeshatIndexManager extends BaseEventIndexManager {
        return this._ipcCall('removeCrawlerCheckpoint', checkpoint);
    }

+    async loadFileEvents(args): Promise<[EventAndProfile]> {
+        return this._ipcCall('loadFileEvents', args);
+    }
+
    async loadCheckpoints(): Promise<[CrawlerCheckpoint]> {
        return this._ipcCall('loadCheckpoints');
    }
@@ -152,6 +156,10 @@ class SeshatIndexManager extends BaseEventIndexManager {
        return this._ipcCall('closeEventIndex');
    }

+    async getStats(): Promise<> {
+        return this._ipcCall('getStats');
+    }
+
    async deleteEventIndex(): Promise<> {
        return this._ipcCall('deleteEventIndex');
    }
@@ -192,16 +200,6 @@ export default class ElectronPlatform extends VectorBasePlatform {

        this.startUpdateCheck = this.startUpdateCheck.bind(this);
        this.stopUpdateCheck = this.stopUpdateCheck.bind(this);
-
-        this._tryPersistStorage();
-    }
-
-    async _tryPersistStorage() {
-        if (navigator.storage && navigator.storage.persist) {
-            const granted = await navigator.storage.persist();
-            const persisted = await navigator.storage.persisted();
-            console.log("Storage persist request granted: " + granted + " persisted: " + persisted);
-        }
    }

    async getConfig(): Promise<{}> {
@@ -387,4 +385,11 @@ export default class ElectronPlatform extends VectorBasePlatform {
    getEventIndexingManager(): BaseEventIndexManager | null {
        return this.eventIndexManager;
    }
+
+    setLanguage(preferredLangs: string[]) {
+        this._ipcCall('setLanguage', preferredLangs).catch(error => {
+            console.log("Failed to send setLanguage IPC to Electron");
+            console.error(error);
+        });
+    }
 }
@@ -34,6 +34,7 @@ module.exports = (env, argv) => {
            "bundle": "./src/vector/index.js",
            "indexeddb-worker": "./src/vector/indexeddb-worker.js",
            "mobileguide": "./src/vector/mobile_guide/index.js",
+            "usercontent": "./node_modules/matrix-react-sdk/src/usercontent/index.js",

            // CSS themes
            "theme-light": "./node_modules/matrix-react-sdk/res/themes/light/css/light.scss",
@@ -302,7 +303,7 @@ module.exports = (env, argv) => {
                // HtmlWebpackPlugin will screw up our formatting like the names
                // of the themes and which chunks we actually care about.
                inject: false,
-                excludeChunks: ['mobileguide'],
+                excludeChunks: ['mobileguide', 'usercontent'],
                minify: argv.mode === 'production',
                vars: {
                    og_image_url: og_image_url,
@@ -316,6 +317,14 @@ module.exports = (env, argv) => {
                minify: argv.mode === 'production',
                chunks: ['mobileguide'],
            }),
+
+            // This is the usercontent sandbox's entry point (separate for iframing)
+            new HtmlWebpackPlugin({
+                template: './node_modules/matrix-react-sdk/src/usercontent/index.html',
+                filename: 'usercontent/index.html',
+                minify: argv.mode === 'production',
+                chunks: ['usercontent'],
+            }),
        ],

        output: {
@@ -337,10 +346,9 @@ module.exports = (env, argv) => {
            // serve unwebpacked assets from webapp.
            contentBase: './webapp',

-            stats: {
-                // don't fill the console up with a mahoosive list of modules
-                chunks: false,
-            },
+            // Only output errors, warnings, or new compilations.
+            // This hides the massive list of modules.
+            stats: 'minimal',

            // hot module replacement doesn't work (I think we'd need react-hot-reload?)
            // so webpack-dev-server reloads the page on every update which is quite