Clicking some links, or images in link previews, render the page inside the app instead of in a new browser tab

[jasonblais]

I confirm (by marking "x" in the [ ] below):

• This is not a troubleshooting question. Troubleshooting questions go here: http://www.mattermost.org/troubleshoot/.
• This doesn't reproduce on web browsers (such as in Chrome). If it does, issue reports go to the Mattermost Server repository.
• I have read contributing guidelines.

---

Jira ticket: https://mattermost.atlassian.net/browse/MM-14108

Summary

Clicking some links, or images in link previews, render the page inside the app instead of in a new browser tab

Steps to reproduce

SCENARIO 1

Environment:

• Windows 7 / Mattermost Server v3.4.0 / Mattermost Desktop App v3.4.1

Repro steps:

1. In a Mattermost channel, post http://www.theverge.com/2016/11/15/13635788/apple-coffee-table-book-products-images
2. Click the link

--

SCENARIO 2

Environment:

• Windows 7 and 10, Mac OS X / Mattermost Server v3.6.0 / Mattermost Desktop App v3.5.0

Repro steps:

1. Go to Account Settings > Advanced > Prevew pre-release features
2. Select Show experimental previews of link content, when available
3. Hit "Save"
4. In a Mattermost channel, post https://www.flickr.com/photos/spacex/31579784413/
5. Click the image preview

Expected behavior

A new browser window opens for the web page you clicked

Observed behavior

Page renders inside the app. There is no way to go back to the app unless you restart it.

Possible fixes

?

[yuya-oc]

I could not reproduce that in the combination: Windows 7 / Mattermost Server v3.4.0 / Mattermost Desktop App v3.4.1 and also on desktop app v3.5.0. I feel the link was unexpectedly rendered as a simple <a> tag without target attribute on webapp.

In some cases like SSO, external pages should be opened in the app. So I would not be able to restrict the behavior by using hostname.

[jasonblais]

I feel the link was unexpectedly rendered as a simple tag without target attribute on webapp.

Would there be post formatting that would lead to this, would you know?

[yuya-oc]

Unfortunately no. FYI, I tried two cases, typing URL and using markdown link.

[jasonblais]

Sounds good, we haven't reproduced it in 3.5 yet, so I'll add 'more information needed' label for now.

The original submitter mentioned it occurs randomly, so if they can't reproduce it in 3.5 I'll close the issue

[jasonblais]

@yuya-oc added new repro steps for a second scenario:

Repro steps:

1. Go to Account Settings > Advanced > Prevew pre-release features
2. Select Show experimental previews of link content, when available
3. Hit "Save"
4. In a Mattermost channel, post https://www.flickr.com/photos/spacex/31579784413/
5. Click the image preview

[jasonblais]

^I was able to consistently reproduce this in Windows 10; the report came from Windows 7

[yuya-oc]

Thanks! In the second scenario, the image has <a> tag without target="_blank" attribute in webapp. So the link is opened in the main window. Chrome also has this behavior, but it would not matter because browsers have back button.

To fix this, probably we can take two approaches.

1. the main window subscribes an event. If the target URL is outside of the server URL, open it with default web browser. (Exception: If the current URL is the login page, the link should be opened in the main window in order to use SSO. e.g. GitLab SSO)
2. webapp creates <a> tag with target="_blank", I'm not sure how webapp generates a preview though.

[jasonblais]

We actually just merged a new version for website link previews where we use OpenGraph data instead: mattermost/mattermost#4890

This changes the behaviour a little where images aren't clickable --> and hence they probably don't have the <a> tag associated with them.

From your viewpoint, I'm not sure if that might resolve the issues here?

[yuya-oc]

Yeah, the approach seems to solve this problem. In future, the approach 1.) would be the fundamental measure though.

[jasonblais]

Would we need to whitelist which login URLs we'd support?

A server running SAML might set up a custom IDP depending on which provider they want to use (hence, the login pages might be different)

[amyblais]

Jira ticket: https://mattermost.atlassian.net/browse/MM-14108

[esethna]

No longer valid