[mahibi]

• Problem 1: wrong avatar for one-to-one conversations

  • Applies to two accounts on the same server that have a one-to-one conversation with each other.
  • Cause: one-to-one avatars were loaded from …/room/{token}/avatar. For one-to-one rooms the server answers with the other participant's avatar, so the same URL returns a different image per account. Coil's memory/disk caches and OkHttp's HTTP cache are keyed by URL, so whichever account loaded first decided what both accounts saw.
  • Fix: one-to-one rooms use the other participant's user avatar /index.php/avatar/{user}/…, as the chat toolbar and conversation info already do. That URL returns the same image to everyone, so caching stays safe.
    • One-to-one rooms are never federated (server: participants can't be added, and the avatar fallback is a local user).
    • Callers that only know the room token (direct share shortcut updates on new messages, the ongoing-call notification) skip the caches for one-to-one rooms.
  • Reproduce on master:
    a. Set up accounts A and B on the same server, with a one-to-one conversation between them and different profile pictures.
    b. Add both accounts to the app, with A active, and open the conversation list.
    c. Switch to B.
    d. Expected bug: the conversation with A shows B's own avatar. The user status shown on it is still correct.

• Problem 2: wrong thumbnails in the remote file browser ("Share from ")

  • Cause: thumbnails were loaded from core/preview.png?file=. The server resolves that path in the requesting user's own files, so the same URL can mean different files for different accounts, and the URL-keyed caches mixed them up.
  • Fix: previews are requested by fileId (core/preview?fileId=…), with the fileId taken from oc:id, as the Nextcloud Files app and talk-ios do. The path-based URL helper was removed because nothing else used it.
  • Reproduce on master:
    a. Set up accounts A and B on the same server. Each has its own file at the same path with different content, e.g. /Photos/test.jpg.
    b. With A active, open a conversation → attachment button → "Share from " → Photos/. A's thumbnail is shown.
    c. Switch to B and repeat.
    d. Expected bug: B's row shows A's thumbnail next to B's own file size and date.
    e. The same browser opens from Profile → change avatar → choose from Nextcloud.

• Tests:

  • ConversationAvatarContentTest: one-to-one rooms use the user-avatar endpoint and never the room endpoint, with and without the avatar capability.
  • RemoteFileBrowserItemTest (new): parsing the fileId from oc:id.

• Side effects:

  • One-to-one avatars and file browser thumbnails load once more after the update, because their URLs changed.
  • The direct share shortcut update and the ongoing-call notification download one-to-one avatars without caching them.

Related: nextcloud/talk-ios#1794 is the same avatar bug in the iOS app, still open there.

🖼️ Screenshots for Problem 1

testuser1' real avatar image: the living room

testuser2' real avatar image: the keyboard

🏚️ Before

active account: testuser2	active account: testuser1. Bug: avatar of testuser2 is the living room

🏡 After

active account: testuser2	active account: testuser1

🏁 Checklist

• ⛑️ Tests (unit and/or integration) are included or not needed
• 🔖 Capability is checked or not needed
• 🔙 Backport requests are created or not needed: /backport to stable-xx.x
• 📅 Milestone is set
• 🌸 PR title is meaningful (if it should be in the changelog: is it meaningful to users?)

🤖 AI (if applicable)

• The content of this PR was partly or fully generated using AI

[github-actions]

📱 QA build

Download	app-qa-debug.apk
QR code	Open the QR code for this download
Commit	b1cd347
Version	6914
Available until	7 days after this build

The QA build installs alongside a released Nextcloud app, so you can keep
using your existing install while testing.

Downloading the file requires a GitHub account, so open this link on the
device you want to test on, or transfer the APK to it.

[github-actions]

Codacy

Lint

Type	master	PR
Warnings	138	138
Errors	15	15

SpotBugs

Category	Base	New
Bad practice	7	7
Correctness	8	8
Dodgy code	40	40
Internationalization	3	3
Malicious code vulnerability	3	3
Performance	8	8
Security	11	11
Total	80	80