Do not load templates that use mxc_to_http unless public baseurl exists.

synapse/config/sso.py

@@ -12,7 +12,9 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
-from typing import Any, Dict
+from typing import Any, Dict, Optional
+
+import jinja2
 
 from ._base import Config
 
@@ -31,17 +33,13 @@ def read_config(self, config, **kwargs):
 
         # Read templates from disk
         (
-            self.sso_login_idp_picker_template,
-            self.sso_redirect_confirm_template,
             self.sso_auth_confirm_template,
             self.sso_error_template,
             sso_account_deactivated_template,
             sso_auth_success_template,
             self.sso_auth_bad_user_template,
         ) = self.read_templates(
             [
-                "sso_login_idp_picker.html",
-                "sso_redirect_confirm.html",
                 "sso_auth_confirm.html",
                 "sso_error.html",
                 "sso_account_deactivated.html",
@@ -51,6 +49,22 @@ def read_config(self, config, **kwargs):
             self.sso_template_dir,
         )
 
+        # The following templates require a public baseurl since they use the
+        # mxc_to_http filter.
+        #
+        # Note that any situation where these templates get used will check that
+        # public_baseurl is set already.
+        self.sso_login_idp_picker_template = None  # type: Optional[jinja2.Template]
+        self.sso_redirect_confirm_template = None  # type: Optional[jinja2.Template]
+        if self.public_baseurl:
+            (
+                self.sso_login_idp_picker_template,
+                self.sso_redirect_confirm_template,
+            ) = self.read_templates(
+                ["sso_login_idp_picker.html", "sso_redirect_confirm.html"],
+                self.sso_template_dir,
+            )
+
         # These templates have no placeholders, so render them here
         self.sso_account_deactivated_template = (
             sso_account_deactivated_template.render()

synapse/handlers/auth.py

@@ -1474,6 +1474,8 @@ def _complete_sso_login(
         # URL we redirect users to.
         redirect_url_no_params = client_redirect_url.split("?")[0]
 
+        assert self._sso_redirect_confirm_template is not None
+
         html = self._sso_redirect_confirm_template.render(
             display_url=redirect_url_no_params,
             redirect_url=redirect_url,

synapse/rest/synapse/client/pick_idp.py

@@ -74,6 +74,9 @@ async def _async_render_GET(self, request: SynapseRequest) -> None:
     async def _serve_id_picker(
         self, request: SynapseRequest, client_redirect_url: str
     ) -> None:
+        # The template should exist, but make sure.
+        assert self._sso_login_idp_picker_template is not None
+
         # otherwise, serve up the IdP picker
         providers = self._sso_handler.get_identity_providers()
         html = self._sso_login_idp_picker_template.render(