v1.5.12

This reverts commit 9b9d585af0.

.buildkite/pipeline.yaml

@@ -1,82 +0,0 @@
-steps:
-  - label: ":eslint: JS Lint"
-    command:
-      - "echo '--- Fetching Dependencies'"
-      - "./scripts/fetch-develop.deps.sh --depth 1"
-      - "yarn install"
-      - "yarn lint:js"
-    plugins:
-      - docker#v3.0.1:
-          image: "node:12"
-
-# This layer doesn't have a TypeScript linter. This comment is to remind TravisR to fix that.
-#  - label: ":eslint: TS Lint"
-#    command:
-#      - "echo '--- Install js-sdk'"
-#      - "./scripts/ci/install-deps.sh"
-#      - "yarn lint:ts"
-#    plugins:
-#      - docker#v3.0.1:
-#          image: "node:12"
-
-  - label: ":eslint: Types Lint"
-    command:
-      - "yarn install"
-      - "yarn lint:types"
-    plugins:
-      - docker#v3.0.1:
-          image: "node:12"
-
-  - label: "🛠 Build"
-    command:
-      - "echo '--- Fetching Dependencies'"
-      - "./scripts/fetch-develop.deps.sh --depth 1"
-      - "yarn install"
-      - "echo '+++ Building Project'"
-      - "yarn build"
-    plugins:
-      - docker#v3.0.1:
-          image: "node:12"
-
-  - label: ":jest: Tests"
-    agents:
-      # We use a medium sized instance instead of the normal small ones because
-      # webpack loves to gorge itself on resources.
-      queue: "medium"
-    command:
-      - "echo '--- Fetching Dependencies'"
-      - "./scripts/fetch-develop.deps.sh --depth 1"
-      - "yarn install"
-      - "yarn build:genfiles"  # We have to build the app to make sure the autogenned files are present
-      - "echo '+++ Running Tests'"
-      - "yarn test"
-    plugins:
-      - docker#v3.0.1:
-          image: "node:10"
-
-  - label: "🌐 i18n"
-    command:
-      - "echo '--- Fetching Dependencies'"
-      - "./scripts/fetch-develop.deps.sh --depth 1"
-      - "yarn install"
-      - "echo '+++ Testing i18n output'"
-      - "yarn diff-i18n"
-    plugins:
-      - docker#v3.0.1:
-          image: "node:10"
-
-  - wait: ~ # this wait is to perform deploy to /develop only if all other steps passed
-    continue_on_failure: false
-
-  - label: ":hammer: Package"
-    command:
-        - "echo '--- Fetching Dependencies'"
-        - "./scripts/fetch-develop.deps.sh --depth 1"
-        - "yarn install"
-        - "echo '+++ Packaging'"
-        - "./scripts/ci_package.sh"
-    branches: "develop"
-    artifact_paths: "dist/riot-*.tar.gz"
-    plugins:
-        - docker#v3.0.1:
-              image: "node:10"

.modernizr.json

@@ -5,19 +5,30 @@
     "setClasses"
   ],
   "feature-detects": [
+    "test/css/animations",
     "test/css/displaytable",
+    "test/css/filters",
     "test/css/flexbox",
-    "test/es5/specification",
     "test/css/objectfit",
-    "test/storage/localstorage",
+
+    "test/es5/date",
+    "test/es5/function",
+    "test/es5/object",
+    "test/es5/undefined",
+
     "test/es6/array",
     "test/es6/collections",
     "test/es6/promises",
+    "test/es6/string",
+
     "test/svg",
     "test/svg/asimg",
     "test/svg/filters",
-    "test/css/animations",
-    "test/css/filters",
-    "test/network/fetch"
+
+    "test/cors",
+    "test/iframe/sandbox",
+    "test/json",
+    "test/network/fetch",
+    "test/storage/localstorage"
   ]
 }

CHANGELOG.md

@@ -1,3 +1,60 @@
+Changes in [1.5.12](https://github.com/vector-im/riot-web/releases/tag/v1.5.12) (2020-03-04)
+============================================================================================
+[Full Changelog](https://github.com/vector-im/riot-web/compare/v1.5.11...v1.5.12)
+
+ * Upgrade to React SDK 2.2.1
+ * Revert to Electron 7.1.12 to fix Arch Linux tray icon
+ * Fix image download links so they open in a new tab
+
+Changes in [1.5.11](https://github.com/vector-im/riot-web/releases/tag/v1.5.11) (2020-03-02)
+============================================================================================
+[Full Changelog](https://github.com/vector-im/riot-web/compare/v1.5.11-rc.1...v1.5.11)
+
+ * Upgrade to JS SDK 5.1.0 and React SDK 2.2.0
+ * Fix SSO flows for Electron 8.0.2 by disabling will-navigate
+   [\#12585](https://github.com/vector-im/riot-web/pull/12585)
+
+Changes in [1.5.11-rc.1](https://github.com/vector-im/riot-web/releases/tag/v1.5.11-rc.1) (2020-02-26)
+======================================================================================================
+[Full Changelog](https://github.com/vector-im/riot-web/compare/v1.5.10...v1.5.11-rc.1)
+
+ * Upgrade to JS SDK 5.1.0-rc.1 and React SDK 2.2.0-rc.1
+ * Change Windows signing to warning when missing token
+   [\#12523](https://github.com/vector-im/riot-web/pull/12523)
+ * Modernizr remove t3st/es6/contains
+   [\#12524](https://github.com/vector-im/riot-web/pull/12524)
+ * Switch out any eval-using Modernizr rules
+   [\#12519](https://github.com/vector-im/riot-web/pull/12519)
+ * Update from Weblate
+   [\#12522](https://github.com/vector-im/riot-web/pull/12522)
+ * Notify electron of language changes
+   [\#12487](https://github.com/vector-im/riot-web/pull/12487)
+ * Relax macOS notarisation check to print a warning
+   [\#12503](https://github.com/vector-im/riot-web/pull/12503)
+ * Clarify supported tier means desktop OSes
+   [\#12486](https://github.com/vector-im/riot-web/pull/12486)
+ * Use noreferrer in addition to noopener for edge case browsers
+   [\#12477](https://github.com/vector-im/riot-web/pull/12477)
+ * Document start / end composer shortcuts
+   [\#12466](https://github.com/vector-im/riot-web/pull/12466)
+ * Update from Weblate
+   [\#12480](https://github.com/vector-im/riot-web/pull/12480)
+ * Remove buildkite pipeline
+   [\#12464](https://github.com/vector-im/riot-web/pull/12464)
+ * Remove exec so release script continues
+   [\#12435](https://github.com/vector-im/riot-web/pull/12435)
+ * Use Persistent Storage where possible
+   [\#12425](https://github.com/vector-im/riot-web/pull/12425)
+
+Changes in [1.5.10](https://github.com/vector-im/riot-web/releases/tag/v1.5.10) (2020-02-19)
+============================================================================================
+[Full Changelog](https://github.com/vector-im/riot-web/compare/v1.5.9...v1.5.10)
+
+ * Get rid of dependence on usercontent.riot.im
+   [\#12292](https://github.com/vector-im/riot-web/pull/12292)
+ * Add experimental support tier
+   [\#12377](https://github.com/vector-im/riot-web/pull/12377)
+
 Changes in [1.5.9](https://github.com/vector-im/riot-web/releases/tag/v1.5.9) (2020-02-17)
 ==========================================================================================
 [Full Changelog](https://github.com/vector-im/riot-web/compare/v1.5.9-rc.1...v1.5.9)

README.md

@@ -1,12 +1,31 @@
 Riot
 ====
 
-Riot (formerly known as Vector) is a Matrix web client built using the [Matrix React SDK](https://github.com/matrix-org/matrix-react-sdk).
+Riot (formerly known as Vector) is a Matrix web client built using the [Matrix
+React SDK](https://github.com/matrix-org/matrix-react-sdk).
 
-Riot is officially supported on the web in the last 2 major versions of Chrome, Firefox, and Safari. For Riot on Desktop (electron),
-only the officially published app is supported. Other browsers and packages may work, however official support is not provided. 
-For accessing Riot on an Android or iOS device, check out [riot-android](https://github.com/vector-im/riot-android)
-and [riot-ios](https://github.com/vector-im/riot-ios) - riot-web does not support mobile devices.
+Supported Environments
+======================
+
+Riot has several tiers of support for different environments:
+
+* Supported
+  * Definition: Issues **actively triaged**, regressions **block** the release
+  * Last 2 major versions of Chrome, Firefox, and Safari on desktop OSes
+  * Latest release of official Riot Desktop app on desktop OSes
+  * Desktop OSes means macOS, Windows, and Linux versions for desktop devices
+    that are actively supported by the OS vendor and receive security updates
+* Experimental
+  * Definition: Issues **accepted**, regressions **do not block** the release
+  * Riot as an installed PWA via current stable version of Chrome, Firefox, and Safari
+  * Mobile web for current stable version of Chrome, Firefox, and Safari on Android, iOS, and iPadOS
+* Not supported
+  * Definition: Issues only affecting unsupported environments are **closed**
+  * Everything else
+
+For accessing Riot on an Android or iOS device, we currently recommend the
+native apps [riot-android](https://github.com/vector-im/riot-android)
+and [riot-ios](https://github.com/vector-im/riot-ios).
 
 Getting Started
 ===============
@@ -52,15 +71,6 @@ We have put some coarse mitigations into place to try to protect against this
 situation, but it's still not good practice to do it in the first place.  See
 https://github.com/vector-im/riot-web/issues/1977 for more details.
 
-The same applies for end-to-end encrypted content, but since this is decrypted
-on the client, Riot needs a way to supply the decrypted content from a separate
-origin to the one Riot is hosted on. This currently done with a 'cross origin
-renderer' which is a small piece of javascript hosted on a different domain.
-To avoid all Riot installs needing one of these to be set up, riot.im hosts
-one on usercontent.riot.im which is used by default.
-https://github.com/vector-im/riot-web/issues/6173 tracks progress on replacing
-this with something better.
-
 Building From Source
 ====================
 

docs/config.md

@@ -57,11 +57,6 @@ For a good example, see https://riot.im/develop/config.json.
 1. `update_base_url` (electron app only): HTTPS URL to a web server to download
    updates from. This should be the path to the directory containing `macos`
    and `win32` (for update packages, not installer packages).
-1. `cross_origin_renderer_url`: URL to a static HTML page hosting code to help display
-   encrypted file attachments. This MUST be hosted on a completely separate domain to
-   anything else since it is used to isolate the privileges of file attachments to this
-   domain. Default: `https://usercontent.riot.im/v1.html`. This needs to contain v1.html from
-   https://github.com/matrix-org/usercontent/blob/master/v1.html
 1. `piwik`: Analytics can be disabled by setting `piwik: false` or by leaving the piwik config
    option out of your config file. If you want to enable analytics, set `piwik` to be an object
    containing the following properties:
@@ -87,7 +82,7 @@ For a good example, see https://riot.im/develop/config.json.
    default homeserver when signing up or logging in.
 1. `permalinkPrefix`: Used to change the URL that Riot generates permalinks with.
    By default, this is "https://matrix.to" to generate matrix.to (spec) permalinks.
-   Set this to your Riot instance URL if you run an unfederated server (eg: 
+   Set this to your Riot instance URL if you run an unfederated server (eg:
    "https://riot.example.org").
 
 Note that `index.html` also has an og:image meta tag that is set to an image

docs/shortcuts.md

@@ -10,5 +10,6 @@ The modifier is <kbd>Ctrl</kbd> on Windows & Linux and <kbd>⌘</kbd> on Mac.
 - <kbd>↑</kbd>/<kbd>↓</kbd> - next/prev room when focus in room list
 - <kbd>Alt</kbd>+<kbd>↑</kbd>/<kbd>↓</kbd> - resend previous messages when the composer is in focus
 - <kbd>PageUp</kbd>/<kbd>PageDown</kbd> - scroll timeline up/down
-- <kbd>Ctrl</kbd>/<kbd>⌘</kbd>+<kbd>Home</kbd>/<kbd>End</kbd> - jump to timeline start/end
+- <kbd>Ctrl</kbd>/<kbd>⌘</kbd>+<kbd>Home</kbd>/<kbd>End</kbd> - jump to
+  start/end of the composer when focused, otherwise jump to timeline start/end
 - <kbd>Ctrl</kbd>/<kbd>⌘</kbd>+<kbd>`</kbd> - toggle the top left menu

electron_app/package.json

@@ -2,7 +2,7 @@
   "name": "riot-web",
   "productName": "Riot",
   "main": "src/electron-main.js",
-  "version": "1.5.9",
+  "version": "1.5.12",
   "description": "A feature-rich client for Matrix.org",
   "author": "New Vector Ltd.",
   "dependencies": {

package.json

@@ -2,7 +2,7 @@
   "name": "riot-web",
   "productName": "Riot",
   "main": "electron_app/src/electron-main.js",
-  "version": "1.5.9",
+  "version": "1.5.12",
   "description": "A feature-rich client for Matrix.org",
   "author": "New Vector Ltd.",
   "repository": {
@@ -66,8 +66,8 @@
     "gemini-scrollbar": "github:matrix-org/gemini-scrollbar#91e1e566",
     "gfm.css": "^1.1.2",
     "highlight.js": "^9.13.1",
-    "matrix-js-sdk": "5.0.0",
-    "matrix-react-sdk": "2.1.0",
+    "matrix-js-sdk": "5.1.0",
+    "matrix-react-sdk": "2.2.1",
     "olm": "https://packages.matrix.org/npm/olm/olm-3.1.4.tgz",
     "postcss-easings": "^2.0.0",
     "prop-types": "^15.7.2",

release.sh

@@ -20,6 +20,7 @@ cd `dirname $0`
 
 for i in matrix-js-sdk matrix-react-sdk
 do
+    echo "Checking version of $i..."
     depver=`cat package.json | jq -r .dependencies[\"$i\"]`
     latestver=`yarn info -s $i dist-tags.next`
     if [ "$depver" != "$latestver" ]
@@ -61,7 +62,7 @@ git commit package.json -m "$tag"
 
 cd ..
 
-exec ./node_modules/matrix-js-sdk/release.sh -u vector-im -z "$orig_args"
+./node_modules/matrix-js-sdk/release.sh -u vector-im -z "$orig_args"
 
 if [ $prerelease -eq 0 ]
 then

scripts/electron_afterSign.js

@@ -10,7 +10,13 @@ exports.default = async function(context) {
         // from the keychain, so we need to get it from the environment.
         const userId = process.env.NOTARIZE_APPLE_ID;
         if (userId === undefined) {
-            throw new Error("User ID not found. Set NOTARIZE_APPLE_ID.");
+            console.warn(
+                "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!\n" +
+                "! Skipping macOS notarisation.              !\n" +
+                "! User ID not found, set NOTARIZE_APPLE_ID. !\n" +
+                "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!",
+            );
+            return;
         }
 
         console.log("Notarising macOS app. This may be some time.");

scripts/electron_winSign.js

@@ -8,23 +8,31 @@ exports.default = async function(options) {
     const appOutDir = path.dirname(inPath);
 
     // get the token passphrase from the keychain
-    const tokenPassphrase = await new Promise((resolve, reject) => {
-        execFile(
-            'security',
-            ['find-generic-password', '-s', 'riot_signing_token', '-w'],
-            {},
-            (err, stdout) => {
-                if (err) {
-                    console.error("Couldn't find signing token in keychain", err);
-                    // electron-builder seems to print '[object Object]' on the
-                    // console whether you reject with an Error or a string...
-                    reject(err);
-                } else {
-                    resolve(stdout.trim());
-                }
-            },
+    let tokenPassphrase;
+    try {
+        tokenPassphrase = await new Promise((resolve, reject) => {
+            execFile(
+                'security',
+                ['find-generic-password', '-s', 'riot_signing_token', '-w'],
+                {},
+                (err, stdout) => {
+                    if (err) {
+                        reject(err);
+                    } else {
+                        resolve(stdout.trim());
+                    }
+                },
+            );
+        });
+    } catch (err) {
+        console.warn(
+            "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!\n" +
+            "! Skipping Windows signing.            !\n" +
+            "! Signing token not found in keychain. !\n" +
+            "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!",
         );
-    });
+        return;
+    }
 
     return new Promise((resolve, reject) => {
         let cmdLine = 'osslsigncode sign ';

src/components/structures/VectorEmbeddedPage.js

@@ -29,7 +29,7 @@ export default class VectorEmbeddedPage extends EmbeddedPage {
     translate(s) {
         s = sanitizeHtml(_t(s));
         // ugly fix for https://github.com/vector-im/riot-web/issues/4243
-        s = s.replace(/\[matrix\]/, '<a href="https://matrix.org" target="_blank" rel="noopener"><img width="79" height="34" alt="[matrix]" style="padding-left: 1px;vertical-align: middle" src="welcome/images/matrix.svg"/></a>');
+        s = s.replace(/\[matrix\]/, '<a href="https://matrix.org" target="_blank" rel="noreferrer noopener"><img width="79" height="34" alt="[matrix]" style="padding-left: 1px;vertical-align: middle" src="welcome/images/matrix.svg"/></a>');
         return s;
     }
 }

src/components/views/auth/VectorAuthFooter.js

@@ -34,7 +34,7 @@ const VectorAuthFooter = () => {
     const authFooterLinks = [];
     for (const linkEntry of links) {
         authFooterLinks.push(
-            <a href={linkEntry.url} key={linkEntry.text} target="_blank" rel="noopener">
+            <a href={linkEntry.url} key={linkEntry.text} target="_blank" rel="noreferrer noopener">
                 {linkEntry.text}
             </a>,
         );
@@ -43,7 +43,7 @@ const VectorAuthFooter = () => {
     return (
         <div className="mx_AuthFooter">
             {authFooterLinks}
-            <a href="https://matrix.org" target="_blank" rel="noopener">{ _t('powered by Matrix') }</a>
+            <a href="https://matrix.org" target="_blank" rel="noreferrer noopener">{ _t('powered by Matrix') }</a>
         </div>
     );
 };

src/i18n/strings/hu.json

@@ -1,10 +1,10 @@
 {
     "Custom Server Options": "Egyedi szerverbeállítások",
-    "Dismiss": "Eltüntet",
+    "Dismiss": "Eltüntetés",
     "powered by Matrix": "Matrix hajtja",
     "%(appName)s via %(browserName)s on %(osName)s": "%(appName)s alkalmazás %(browserName)s böngészőn %(osName)s rendszeren",
     "Riot Desktop on %(platformName)s": "Riot Desktop itt: %(platformName)s",
-    "Unknown device": "Ismeretlen készülék",
+    "Unknown device": "Ismeretlen eszköz",
     "You need to be using HTTPS to place a screen-sharing call.": "Képernyőmegosztás indításához HTTPS-t kell használnod.",
     "Welcome to Riot.im": "Üdvözöl a Riot.im",
     "Decentralised, encrypted chat & collaboration powered by [matrix]": "Decentralizált, titkosított csevegés és kollaboráció [matrix] alapokon",

src/i18n/strings/nb_NO.json

@@ -7,14 +7,17 @@
     "You need to be using HTTPS to place a screen-sharing call.": "Du er nødt til å bruke HTTPS for å ha en samtale med skjermdeling.",
     "Dismiss": "Avvis",
     "Welcome to Riot.im": "Velkommen til Riot.im",
-    "Decentralised, encrypted chat & collaboration powered by [matrix]": "Desentralisert, kryptert chat & sammabeid drevet av [matrix]",
+    "Decentralised, encrypted chat & collaboration powered by [matrix]": "Desentralisert, kryptert chat & samarbeid drevet av [matrix]",
     "Chat with Riot Bot": "Chat med Riot Bot",
-    "You can use the custom server options to sign into other Matrix servers by specifying a different homeserver URL. This allows you to use Riot with an existing Matrix account on a different homeserver.": "Du kan bruke instillinger for «egendefinert tjener» til å logge inn på andre Matrix tjenere ved å spesifisere en annen URL. Dette lar deg bruke Riot med en eksisterende Matrix konto på en annen hjemmetjener.",
+    "You can use the custom server options to sign into other Matrix servers by specifying a different homeserver URL. This allows you to use Riot with an existing Matrix account on a different homeserver.": "Du kan bruke instillinger for «egendefinert tjener» til å logge inn på andre Matrix-tjenere ved å spesifisere en annen URL. Dette lar deg bruke Riot med en eksisterende Matrix-konto på en annen hjemmetjener.",
     "Sign In": "Logg inn",
     "Create Account": "Lag konto",
     "Need help?": "Trenger du hjelp?",
     "Room Directory": "Alle rom",
     "Explore rooms": "Se alle rom",
     "Your Riot configuration contains invalid JSON. Please correct the problem and reload the page.": "Riot-konfigurasjonen din inneholder ugyldig JSON. Vennligst fiks problemet og oppdater siden.",
-    "The message from the parser is: %(message)s": "Meldingen fra parseren er: %(message)s"
+    "The message from the parser is: %(message)s": "Meldingen fra parseren er: %(message)s",
+    "Invalid JSON": "Ugyldig JSON",
+    "Your Riot is misconfigured": "Riot er feilkonfigurert",
+    "Invalid configuration: no default server specified.": "Ugyldig konfigurasjon: ingen standardserver spesifisert."
 }

src/i18n/strings/nn.json

@@ -2,7 +2,7 @@
     "Riot Desktop on %(platformName)s": "Riot på Skrivebord for %(platformName)s",
     "Unknown device": "Ukjend eining",
     "%(appName)s via %(browserName)s on %(osName)s": "%(appName)s gjennom %(browserName)s på %(osName)s",
-    "You need to be using HTTPS to place a screen-sharing call.": "Du må bruka HTTPS for å ha ei samtale med skjermdeling.",
+    "You need to be using HTTPS to place a screen-sharing call.": "Du må bruka HTTPS for å ha ein samtale med skjermdeling.",
     "Dismiss": "Avvis",
     "powered by Matrix": "Matrixdriven",
     "Welcome to Riot.im": "Velkomen til Riot.im",
@@ -16,7 +16,7 @@
     "Explore rooms": "Utforsk romma",
     "Room Directory": "Romkatalog",
     "Your Riot configuration contains invalid JSON. Please correct the problem and reload the page.": "Riot-konfigurasjonen din har ugyldig JSON-kode. Korriger dette og last inn sida på nytt.",
-    "The message from the parser is: %(message)s": "Meldingen frå kodetolkaren er: %(message)s",
+    "The message from the parser is: %(message)s": "Meldinga frå kodetolkaren er: %(message)s",
     "Invalid JSON": "Ugyldig JSON",
     "Your Riot is misconfigured": "Riot-klienten din er feilkonfiguert",
     "Unexpected error preparing the app. See console for details.": "Uventa feil under lasting av programmet. Sjå konsollen for detaljar.",

src/vector/platform/ElectronPlatform.js

@@ -200,16 +200,6 @@ export default class ElectronPlatform extends VectorBasePlatform {
 
         this.startUpdateCheck = this.startUpdateCheck.bind(this);
         this.stopUpdateCheck = this.stopUpdateCheck.bind(this);
-
-        this._tryPersistStorage();
-    }
-
-    async _tryPersistStorage() {
-        if (navigator.storage && navigator.storage.persist) {
-            const granted = await navigator.storage.persist();
-            const persisted = await navigator.storage.persisted();
-            console.log("Storage persist request granted: " + granted + " persisted: " + persisted);
-        }
     }
 
     async getConfig(): Promise<{}> {
@@ -395,4 +385,11 @@ export default class ElectronPlatform extends VectorBasePlatform {
     getEventIndexingManager(): BaseEventIndexManager | null {
         return this.eventIndexManager;
     }
+
+    setLanguage(preferredLangs: string[]) {
+        this._ipcCall('setLanguage', preferredLangs).catch(error => {
+            console.log("Failed to send setLanguage IPC to Electron");
+            console.error(error);
+        });
+    }
 }

webpack.config.js

@@ -34,6 +34,7 @@ module.exports = (env, argv) => {
             "bundle": "./src/vector/index.js",
             "indexeddb-worker": "./src/vector/indexeddb-worker.js",
             "mobileguide": "./src/vector/mobile_guide/index.js",
+            "usercontent": "./node_modules/matrix-react-sdk/src/usercontent/index.js",
 
             // CSS themes
             "theme-light": "./node_modules/matrix-react-sdk/res/themes/light/css/light.scss",
@@ -302,7 +303,7 @@ module.exports = (env, argv) => {
                 // HtmlWebpackPlugin will screw up our formatting like the names
                 // of the themes and which chunks we actually care about.
                 inject: false,
-                excludeChunks: ['mobileguide'],
+                excludeChunks: ['mobileguide', 'usercontent'],
                 minify: argv.mode === 'production',
                 vars: {
                     og_image_url: og_image_url,
@@ -316,6 +317,14 @@ module.exports = (env, argv) => {
                 minify: argv.mode === 'production',
                 chunks: ['mobileguide'],
             }),
+
+            // This is the usercontent sandbox's entry point (separate for iframing)
+            new HtmlWebpackPlugin({
+                template: './node_modules/matrix-react-sdk/src/usercontent/index.html',
+                filename: 'usercontent/index.html',
+                minify: argv.mode === 'production',
+                chunks: ['usercontent'],
+            }),
         ],
 
         output: {

yarn.lock

@@ -2479,12 +2479,30 @@ bser@2.1.1:
   dependencies:
     node-int64 "^0.4.0"
 
+buffer-alloc-unsafe@^1.1.0:
+  version "1.1.0"
+  resolved "https://registry.yarnpkg.com/buffer-alloc-unsafe/-/buffer-alloc-unsafe-1.1.0.tgz#bd7dc26ae2972d0eda253be061dba992349c19f0"
+  integrity sha512-TEM2iMIEQdJ2yjPJoSIsldnleVaAk1oW3DBVUykyOLsEsFmEc9kn+SFFPz+gl54KQNxlDnAwCXosOS9Okx2xAg==
+
+buffer-alloc@^1.2.0:
+  version "1.2.0"
+  resolved "https://registry.yarnpkg.com/buffer-alloc/-/buffer-alloc-1.2.0.tgz#890dd90d923a873e08e10e5fd51a57e5b7cce0ec"
+  integrity sha512-CFsHQgjtW1UChdXgbyJGtnm+O/uLQeZdtbDo8mfUgYXCHSM1wgrVxXm6bSyrUuErEb+4sYVGCzASBRot7zyrow==
+  dependencies:
+    buffer-alloc-unsafe "^1.1.0"
+    buffer-fill "^1.0.0"
+
 buffer-crc32@^0.2.1, buffer-crc32@^0.2.13:
   version "0.2.13"
   resolved "https://registry.yarnpkg.com/buffer-crc32/-/buffer-crc32-0.2.13.tgz#0d333e3f00eac50aa1454abd30ef8c2a5d9a7242"
   integrity sha1-DTM+PwDqxQqhRUq9MO+MKl2ackI=
 
-buffer-from@^1.0.0:
+buffer-fill@^1.0.0:
+  version "1.0.0"
+  resolved "https://registry.yarnpkg.com/buffer-fill/-/buffer-fill-1.0.0.tgz#f8f78b76789888ef39f205cd637f68e702122b2c"
+  integrity sha1-+PeLdniYiO858gXNY39o5wISKyw=
+
+buffer-from@^1.0.0, buffer-from@^1.1.1:
   version "1.1.1"
   resolved "https://registry.yarnpkg.com/buffer-from/-/buffer-from-1.1.1.tgz#32713bc028f75c02fdb710d7c7bcec1f2c6070ef"
   integrity sha512-MQcXEUbCKtEo7bhqEs6560Hyd4XaovZlO/k9V3hjVUF/zwW7KBVdSK4gIt/bzwS9MbR5qob+F5jusZsb0YQK2A==
@@ -2508,7 +2526,7 @@ buffer@^4.3.0:
     ieee754 "^1.1.4"
     isarray "^1.0.0"
 
-buffer@^5.1.0:
+buffer@^5.1.0, buffer@^5.4.3:
   version "5.4.3"
   resolved "https://registry.yarnpkg.com/buffer/-/buffer-5.4.3.tgz#3fbc9c69eb713d323e3fc1a895eee0710c072115"
   integrity sha512-zvj65TkFeIt3i6aj5bIvJDzjjQQGs4o/sNoezg1F1kYap9Nu2jcUdpwzRSJTHMMzG0H7bZkn4rNQpImhuxWX2A==
@@ -3877,6 +3895,11 @@ diffie-hellman@^5.0.0:
     miller-rabin "^4.0.0"
     randombytes "^2.0.0"
 
+dijkstrajs@^1.0.1:
+  version "1.0.1"
+  resolved "https://registry.yarnpkg.com/dijkstrajs/-/dijkstrajs-1.0.1.tgz#d3cd81221e3ea40742cfcde556d4e99e98ddc71b"
+  integrity sha1-082BIh4+pAdCz83lVtTpnpjdxxs=
+
 dir-glob@2.0.0:
   version "2.0.0"
   resolved "https://registry.yarnpkg.com/dir-glob/-/dir-glob-2.0.0.tgz#0b205d2b6aef98238ca286598a8204d29d0a0034"
@@ -6506,7 +6529,7 @@ isarray@1.0.0, isarray@^1.0.0, isarray@~1.0.0:
   resolved "https://registry.yarnpkg.com/isarray/-/isarray-1.0.0.tgz#bb935d48582cba168c06834957a54a3e07124f11"
   integrity sha1-u5NdSFgsuhaMBoNJV6VKPgcSTxE=
 
-isarray@^2.0.5:
+isarray@^2.0.1, isarray@^2.0.5:
   version "2.0.5"
   resolved "https://registry.yarnpkg.com/isarray/-/isarray-2.0.5.tgz#8af1e4c1221244cc62459faf38940d4e644a5723"
   integrity sha512-xHjhDr3cNBK0BzdUJSPXZntQUx/mwMS5Rw4A7lPJ90XGAO6ISP/ePDNuo0vhqOZU+UD5JoodwCAAoZQd3FeAKw==
@@ -7595,10 +7618,10 @@ mathml-tag-names@^2.1.1:
   resolved "https://registry.yarnpkg.com/mathml-tag-names/-/mathml-tag-names-2.1.1.tgz#6dff66c99d55ecf739ca53c492e626f1d12a33cc"
   integrity sha512-pWB896KPGSGkp1XtyzRBftpTzwSOL0Gfk0wLvxt4f2mgzjY19o0LxJ3U25vNWTzsh7da+KTbuXQoQ3lOJZ8WHw==
 
-matrix-js-sdk@5.0.0:
-  version "5.0.0"
-  resolved "https://registry.yarnpkg.com/matrix-js-sdk/-/matrix-js-sdk-5.0.0.tgz#dcbab35f1afdb35ef0364eb232e78e0fb7dc2a5b"
-  integrity sha512-A/aeE2Zn2OHq1n/9wIHCszrQZ7oXfThUHWi5Kz7illVCPUJ3JrZ31XVvx02k6vBasDcUtjAfZblHdTVN62cWLw==
+matrix-js-sdk@5.1.0:
+  version "5.1.0"
+  resolved "https://registry.yarnpkg.com/matrix-js-sdk/-/matrix-js-sdk-5.1.0.tgz#9b3b02af227ecc2d0cc35fb7312c92b8a6754293"
+  integrity sha512-IGRq5iACiKp3iIxAghwtdBPrbdgORowc0i8YuIMkZZMpRJDXnNaudt2BFwyQdukV7gvzz7F0sfxBUerySfOnKA==
   dependencies:
     "@babel/runtime" "^7.8.3"
     another-json "^0.2.0"
@@ -7618,10 +7641,10 @@ matrix-mock-request@^1.2.3:
     bluebird "^3.5.0"
     expect "^1.20.2"
 
-matrix-react-sdk@2.1.0:
-  version "2.1.0"
-  resolved "https://registry.yarnpkg.com/matrix-react-sdk/-/matrix-react-sdk-2.1.0.tgz#60c79b98acfcf5e18534d0fc3ff52ebacb045cfd"
-  integrity sha512-KloXDVtZ1Hy0H1+zVFoZ9+BQlUTYCBVNlxzz2ZQ6T6rZpYOGu7XTLV/i6vaKRvFh+OqVtnF7RS3Z3j0OUqjmzQ==
+matrix-react-sdk@2.2.1:
+  version "2.2.1"
+  resolved "https://registry.yarnpkg.com/matrix-react-sdk/-/matrix-react-sdk-2.2.1.tgz#1f443d35bdcc46c7ef3dc3066adda59f7f43b348"
+  integrity sha512-zIgf/i9z2x+KHf0caQtFVc3JEFiIFd9MH36XnqXaPYyRSuS0zWRLY/tFTR51pMblMIb3DskTYlf9q7JLDAP/+A==
   dependencies:
     "@babel/runtime" "^7.8.3"
     blueimp-canvas-to-blob "^3.5.0"
@@ -7649,11 +7672,12 @@ matrix-react-sdk@2.1.0:
     is-ip "^2.0.0"
     linkifyjs "^2.1.6"
     lodash "^4.17.14"
-    matrix-js-sdk "5.0.0"
+    matrix-js-sdk "5.1.0"
     minimist "^1.2.0"
     pako "^1.0.5"
     png-chunks-extract "^1.0.0"
     prop-types "^15.5.8"
+    qrcode "^1.4.4"
     qrcode-react "^0.1.16"
     qs "^6.6.0"
     react "^16.9.0"
@@ -8903,6 +8927,11 @@ png-chunks-extract@^1.0.0:
   dependencies:
     crc-32 "^0.3.0"
 
+pngjs@^3.3.0:
+  version "3.4.0"
+  resolved "https://registry.yarnpkg.com/pngjs/-/pngjs-3.4.0.tgz#99ca7d725965fb655814eaf65f38f12bbdbf555f"
+  integrity sha512-NCrCHhWmnQklfH4MtJMRjZ2a8c80qXeMlQMv2uVp9ISJMTt562SbGd6n2oq0PaPgKm7Z6pL9E2UlLIhC+SHL3w==
+
 portfinder@^1.0.25:
   version "1.0.25"
   resolved "https://registry.yarnpkg.com/portfinder/-/portfinder-1.0.25.tgz#254fd337ffba869f4b9d37edc298059cb4d35eca"
@@ -9872,6 +9901,19 @@ qrcode-react@^0.1.16:
   dependencies:
     qr.js "0.0.0"
 
+qrcode@^1.4.4:
+  version "1.4.4"
+  resolved "https://registry.yarnpkg.com/qrcode/-/qrcode-1.4.4.tgz#f0c43568a7e7510a55efc3b88d9602f71963ea83"
+  integrity sha512-oLzEC5+NKFou9P0bMj5+v6Z40evexeE29Z9cummZXZ9QXyMr3lphkURzxjXgPJC5azpxcshoDWV1xE46z+/c3Q==
+  dependencies:
+    buffer "^5.4.3"
+    buffer-alloc "^1.2.0"
+    buffer-from "^1.1.1"
+    dijkstrajs "^1.0.1"
+    isarray "^2.0.1"
+    pngjs "^3.3.0"
+    yargs "^13.2.4"
+
 qs@6.7.0:
   version "6.7.0"
   resolved "https://registry.yarnpkg.com/qs/-/qs-6.7.0.tgz#41dc1a015e3d581f1621776be31afb2876a9b1bc"
@@ -12804,7 +12846,7 @@ yargs@13.2.4:
     y18n "^4.0.0"
     yargs-parser "^13.1.0"
 
-yargs@^13.3.0:
+yargs@^13.2.4, yargs@^13.3.0:
   version "13.3.0"
   resolved "https://registry.yarnpkg.com/yargs/-/yargs-13.3.0.tgz#4c657a55e07e5f2cf947f8a366567c04a0dedc83"
   integrity sha512-2eehun/8ALW8TLoIl7MVaRUrg+yCnenu8B4kBlRxj3GJGDKU1Og7sMXPNm1BYyM1DOJmTZ4YeN/Nwxv+8XJsUA==