Skip to content

Fix/error redirect meeting logouturl#22

Draft
antobinary wants to merge 28 commits into
v3.0.x-developfrom
fix/error-redirect-meeting-logouturl
Draft

Fix/error redirect meeting logouturl#22
antobinary wants to merge 28 commits into
v3.0.x-developfrom
fix/error-redirect-meeting-logouturl

Conversation

@antobinary

Copy link
Copy Markdown
Owner

What does this PR do?

Makes API error redirects (e.g. guestDeniedAccess, maxParticipantsReached, mismatchCreateTimeParam) fall back to the logoutURL stored on the meeting at /create time, instead of jumping straight to the server default (serverURL).

The redirect target precedence is now:

  1. errorRedirectUrl (join param)
  2. logoutURL (join param)
  3. logoutURL (create param, stored on the meeting) — new
  4. bigbluebutton.web.logoutURL / serverURL (server default)

Closes bigbluebutton#23380

Motivation

The docs for errorRedirectUrl state that when no errorRedirectUrl is provided, users are redirected to "the meeting's default logout URL". However respondWithRedirect() only consulted the current request's logoutURL parameter — a logoutURL passed on /create was never considered, so integrations that set it once at create time had denied users land on serverURL.

Repro (before this change):

  1. create with logoutURL=https://ddg.gg&guestPolicy=ALWAYS_DENY
  2. join as a guest viewer with redirect=true
  3. 302 Location: https://<serverURL>?errors=[...guestDeniedAccess...] instead of https://ddg.gg?errors=[...]

Implementation notes

  • invalid() / respondWithRedirect() accept a new optional meetingLogoutUrl argument; the meeting-scoped error paths in the join flow pass the effective logout URL that the join handler already computes (meeting value + join-param override + %%FIELDS%% token substitution).
  • Unlike the join-time logoutURL param, the create-time value is not URL-validated by processLogoutUrl(), so the fallback is only used if it passes ValidationService.isValidURL() — a malformed value keeps today's behavior (server default) rather than producing a broken redirect.
  • Error paths that fire before a meeting is resolved (checksum/validation errors) are unchanged.

Testing

Verified on a 3.0 dev container (v3.0.x-develop):

Scenario Before After
logoutURL on create only, guest denied serverURL?errors=... https://ddg.gg?errors=...
logoutURL on join (differs from create) join value honored join value still wins over create value
errorRedirectUrl on join honored honored (still wins over any logoutURL)
No logoutURL anywhere serverURL?errors=... serverURL?errors=... (unchanged)
Malformed logoutURL on create (notaurl) n/a falls back to serverURL?errors=..., no broken redirect

ramonlsouza and others added 28 commits July 13, 2026 17:19
…#25165)

Backport of bigbluebutton#25165 (merged on v4.0.x-develop) to v3.0.x-develop, bringing the
BlockNote shared-notes e2e coverage to the 3.0 line.

Cherry-picked a9c0cd5 with two conflicts resolved:
- core/elements.ts: added the BlockNote selectors block at the shared-notes
  export insertion point.
- sharednotes/blocknote/util.ts (add/add): merged the new 4.0 helpers
  (startSharedNotesBlockNote, getBlockNoteReadOnlyLocator) with the existing 3.0
  helpers already present from bigbluebutton#25225, keeping a single getBlockNoteEditorLocator.

3.0 adaptations in sharednotes.ts for element renames that only exist on 4.0:
- sharedNotesSidebarButton to sharedNotes
- messagesSidebarButton to chatButton
- lock flow uses manageUsers + lockViewersButton (the 3.0 lock modal has no
  participant permissions tab)
- make-presenter uses userListItem instead of usersListSidebarButton +
  moreOptionsUserItemButton

The "Pin and unpin notes onto whiteboard" scenario is marked fixme on 3.0: a
viewer whiteboard does not re-sync to the presenter presentation state after the
presenter unpins shared notes (the canvas is not restored). That sync behavior
only exists on 4.0.
…165-to-v3.0

test: add BlockNote shared notes e2e tests (backport of bigbluebutton#25165)
Bumps [axios](https://github.com/axios/axios) from 1.16.0 to 1.18.0.
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.16.0...v1.18.0)

---
updated-dependencies:
- dependency-name: axios
  dependency-version: 1.18.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
…npm_and_yarn/bbb-export-annotations/axios-1.18.0

build(deps): bump axios from 1.16.0 to 1.18.0 in /bbb-export-annotations
…igbluebutton#25465)

`bolder` is a relative keyword that is only valid on the font-weight
*property*, not the @font-face *descriptor*. Browsers discard the
invalid descriptor, so the SemiBold and SemiBoldItalic faces fell back
to weight 400/normal and collided with the Regular faces. Register them
at their correct absolute weight (600) instead.

Fixes SonarQube css:S8775 (At-rule descriptor values should be valid).

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
)

Bumps [axios](https://github.com/axios/axios) from 1.16.1 to 1.18.0.
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.16.1...v1.18.0)

---
updated-dependencies:
- dependency-name: axios
  dependency-version: 1.18.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
See docs of the package used to create random numbers (https://commons.apache.org/proper/commons-lang/apidocs/org/apache/commons/lang3/RandomStringUtils.html#randomNumeric(int)) Each pos. in the created numeric string can be any valid digit (0-9) The result can be: 00000, 00001,..., 99999
…igbluebutton#25442)

* docs: document 3.0 changes since v3.0.28 (shared-notes Markdown, plugin button styles)

Covers documentation-worthy changes landed on v3.0.x-develop since the
v3.0.28 tag that were not yet reflected in the docs:

- new-features.md: shared notes Markdown import/export (BlockNote), the
  new public.sharedNotes.importMarkdownEnabled / exportMarkdownEnabled
  client settings, the maxSharedNotesInitialContentUrlPayloadSize bbb-web
  property, the html5PluginSdkVersion bump, and 3.0.32 in recent releases.
- customize.md: "Enable Markdown import/export in shared notes" config
  section.
- plugins.md: configurable button styles (color/circle/hideLabel/size/style)
  for nav bar, actions bar, and presentation toolbar plugin buttons.

The shared-notes Markdown API/seeding path and the guest-lobby-position,
strict-override-validation, per-meeting recording-format, and sessionToken
items were already documented on develop, so they are not duplicated here.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* docs: fix inverted Markdown initial-content precedence in create.tsx

create.tsx claimed the inline `sharedNotesInitialContentMarkdown` create
parameter "takes precedence over sharedNotesInitialContentMarkdownUrl".
That is backwards. MeetingService.getSharedNotesInitialContentMarkdown()
checks the URL first and returns its content when non-empty, so the URL
wins; the inline create parameter only wins over the POST-body module.

Corrected both create.tsx rows to state the actual order
(URL > inline create parameter > POST module), matching the already-correct
description in development/api.md.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* docs: move shared-notes Markdown config into the new-features BlockNote section; add property to configs table

- new-features.md: the Markdown import/export subsection under BlockNote
  Shared Notes is now self-contained, including the bbb-html5.yml toggles
  (public.sharedNotes.importMarkdownEnabled / exportMarkdownEnabled) and how
  to enable them. Noted disabled-by-default in 3.0.
- customize.md: removed the separate "Enable Markdown import/export in shared
  notes" section (superseded by the new-features text) and added the
  maxSharedNotesInitialContentUrlPayloadSize property to the "Other meeting
  configs available" bbb-web.properties table.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* docs: pin shared-notes Markdown to 3.0.33, retitle BlockNote heading, tweak SDK line

- Reference BigBlueButton 3.0.33 (the release that ships the shared-notes
  Markdown import/export) instead of "next release after 3.0.32".
- Retitle heading to "Import and export BlockNote shared notes as Markdown".
- Add 3.0.33 to Recent releases (tag not published yet).
- Drop the from-version on the html5PluginSdkVersion line.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Update docs/docs/plugins.md

Co-authored-by: Guilherme Pereira Leme <69865537+GuiLeme@users.noreply.github.com>

* Update docs/docs/plugins.md

Co-authored-by: Guilherme Pereira Leme <69865537+GuiLeme@users.noreply.github.com>

* Update docs/docs/plugins.md

Co-authored-by: Guilherme Pereira Leme <69865537+GuiLeme@users.noreply.github.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Guilherme Pereira Leme <69865537+GuiLeme@users.noreply.github.com>
…tton#25474)

Bumps [axios](https://github.com/axios/axios) from 1.16.0 to 1.18.0.
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.16.0...v1.18.0)

---
updated-dependencies:
- dependency-name: axios
  dependency-version: 1.18.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…igbluebutton#25427)

Bumps [ch.qos.logback:logback-core](https://github.com/qos-ch/logback) from 1.5.33 to 1.5.34.
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](qos-ch/logback@v_1.5.33...v_1.5.34)

---
updated-dependencies:
- dependency-name: ch.qos.logback:logback-core
  dependency-version: 1.5.34
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…ml5 (bigbluebutton#25483)

Bumps [linkify-it](https://github.com/markdown-it/linkify-it) from 5.0.1 to 5.0.2.
- [Changelog](https://github.com/markdown-it/linkify-it/blob/master/CHANGELOG.md)
- [Commits](markdown-it/linkify-it@5.0.1...5.0.2)

---
updated-dependencies:
- dependency-name: linkify-it
  dependency-version: 5.0.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…n#25486)

Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.2 to 3.1.4.
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.2...v3.1.4)

---
updated-dependencies:
- dependency-name: fast-uri
  dependency-version: 3.1.4
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
)

Bumps [svgo](https://github.com/svg/svgo) from 3.3.3 to 3.3.4.
- [Release notes](https://github.com/svg/svgo/releases)
- [Commits](svg/svgo@v3.3.3...v3.3.4)

---
updated-dependencies:
- dependency-name: svgo
  dependency-version: 3.3.4
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…utton#25485)

Bumps [shell-quote](https://github.com/ljharb/shell-quote) from 1.8.4 to 1.10.0.
- [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md)
- [Commits](ljharb/shell-quote@v1.8.4...v1.10.0)

---
updated-dependencies:
- dependency-name: shell-quote
  dependency-version: 1.10.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…button#25484)

Bumps [body-parser](https://github.com/expressjs/body-parser) from 1.20.5 to 1.20.6.
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](expressjs/body-parser@1.20.5...1.20.6)

---
updated-dependencies:
- dependency-name: body-parser
  dependency-version: 1.20.6
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…gbluebutton#25478)

Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 5.0.6 to 5.0.7.
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v5.0.6...v5.0.7)

---
updated-dependencies:
- dependency-name: brace-expansion
  dependency-version: 5.0.7
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
fix: Presentation download: filename containing "&" is truncated and saved without its extension
…#25499)

Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.2 to 3.1.4.
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.2...v3.1.4)

---
updated-dependencies:
- dependency-name: fast-uri
  dependency-version: 3.1.4
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* docs: add missing create params

* docs: drop copyright and logoutTimer from create supported params
fix: The .csv export for LAD has the user 'Anonymous'
fix: grid-aware resize snapping in camera dock
When an API error redirects the user (guestDeniedAccess,
maxParticipantsReached, mismatchCreateTimeParam) and neither
errorRedirectUrl nor logoutURL was passed on the join request,
respondWithRedirect() jumped straight to the server default logout URL,
ignoring the logoutURL stored on the meeting at create time. Pass the
meeting's effective logout URL down so the redirect precedence becomes:
errorRedirectUrl (join) > logoutURL (join) > logoutURL (create) >
server default.

The create-time value is not URL-validated by processLogoutUrl(), so it
is only used when it passes ValidationService.isValidURL().

Closes bigbluebutton#23380

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown

🚨 Automated tests failed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Passed logoutURL not considered as a catchAll for api errors

5 participants