Unable to download media from the room's Files view, if the server has unauthenticated media access disabled

[Feliksas]

Steps to reproduce

1. Log in to a Synapse server that has enable_authenticated_media config option enabled (any Web browser)
2. Go to a room that has media posted
3. Click on the (i) button on the top right, go to Files view
4. Click the "Download" button for any file

Outcome

What did you expect?

The selected file is downloaded normally.

What happened instead?

A new tab is opened, taking the user to media/v3/download endpoint, server responds with a JSON like:

{
"errcode": "M_NOT_FOUND",
"error": "Not found"
}

it is basically the same issue, as described in element-hq/element-desktop#1911 (comment), occurs with any Web browser on any platform.

Operating system

Widows, Linux

Browser information

Chrome Version 131.0.6778.265, Firefox 134.0.1

URL for webapp

app.element.io

Application version

Element version: 1.11.90 Crypto version: Rust SDK 0.8.0 (21f7cc7), Vodozemac 0.8.1

Homeserver

Synapse 1.122.0

Will you send logs?

No

[bertiebaggio]

This happens on the matrix.org homeserver using both stable and dev EW (ie app.element.io and develop.element.io).

Repro steps are as @Feliksas described:

1. Log in to a Synapse server that has enable_authenticated_media config option enabled (any Web browser)
2. Go to a room that has media posted
3. Click on the (i) button on the top right, go to Files view
4. Click the "Download" button for any file

The download button has target="_blank" set: (Edit not really relevant it seems)

<div class="mx_MFileBody_download">
 <a target="_blank" rel="noreferrer noopener" 
    href="https://matrix-client.matrix.org/_matrix/media/v3/download/matrix.org/NKfmWsxINqSRMtWgLqkFahbI?allow_redirect=true"
    download="routerlimit1.png" data-size="sm" data-kind="secondary"
    tabindex="0" class="_button_vczzf_8 _has-icon_vczzf_57" role="link">
    <svg xmlns="http://www.w3.org/2000/svg" width="20" height="20" fill="currentColor" viewBox="0 0 24 24" aria-hidden="true">
     <path d="M12 15.575q-.2 0-.375-.062a.9.9 0 0 1-.325-.213l-3.6-3.6a.95.95 0 0 1-.275-.7q0-.425.275-.7.274-.275.712-.288t.713.263L11 12.15V5q0-.424.287-.713A.97.97 0 0 1 12 4q.424 0 .713.287Q13 4.576 13 5v7.15l1.875-1.875q.274-.274.713-.263.437.014.712.288a.95.95 0 0 1 .275.7.95.95 0 0 1-.275.7l-3.6 3.6q-.15.15-.325.212a1.1 1.1 0 0 1-.375.063M6 20q-.824 0-1.412-.587A1.93 1.93 0 0 1 4 18v-2q0-.424.287-.713A.97.97 0 0 1 5 15q.424 0 .713.287Q6 15.576 6 16v2h12v-2q0-.424.288-.713A.97.97 0 0 1 19 15q.424 0 .712.287.288.288.288.713v2q0 .824-.587 1.413A1.93 1.93 0 0 1 18 20z">
     </path>
    </svg>
   Download (50.24 KB)
 </a>
</div>

and takes client to an URL like the following (note I am happy for this media to be shared, it has nothing PII): https://matrix-client.matrix.org/_matrix/media/v3/download/matrix.org/NKfmWsxINqSRMtWgLqkFahbI?allow_redirect=true

with response:

{"errcode":"M_NOT_FOUND","error":"Not found"}

I normally wouldn't "me too!" an issue, but I mentioned this in #element-web:matrix.org and tulir seemed surprised that this happens, and noted that it does not happen for him:

So adding this here in case this was considered solved previously.

[bertiebaggio]

My mistake on the target attribute, given the comment about "new tab" I thought it was relevant- removing that attribute results in the same behaviour, except of course the "not found" response happens in the same browser window.