Wallpaper preview is blank for the default BOS wallpaper and any image outside ~/Pictures/Backgrounds #71

New issue

Closed

opened 2026-10-13 19:44:32 +08:00 by Breadway · 3 comments

Breadway commented

2026-10-13 19:44:32 +08:00

Owner

How it was found: clicking through the 98be903 build in a headless BOS live VM on 2026-10-13. On Appearance > Wallpaper the hero area showed only the "bread-background.png" caption on an empty grey box.

Confidence: high. The VM's ~/.config/breadpaper/current.json points at /usr/share/backgrounds/bos/bread-background.png (the file exists, 4 MB). src/tauri.conf.json has assetProtocol.scope: ["$HOME/Pictures/Backgrounds/**"], so convertFileSrc() in Breadpaper.svelte (hero background-image line ~119 and library thumbs line ~147) is refused for that path.

Bug: every fresh BOS install starts with the stock wallpaper from /usr/share/backgrounds/bos, so new users see a blank preview. Any image picked with "Choose image" from outside ~/Pictures/Backgrounds (Downloads, another folder) has the same blank preview.

Fix: add /usr/share/backgrounds/** to the asset scope and allow the chosen file at runtime (tauri asset_protocol_scope().allow_file when a wallpaper is set or read), or have the backend return a small thumbnail data URL instead of relying on the asset protocol.

**How it was found:** clicking through the 98be903 build in a headless BOS live VM on 2026-10-13. On Appearance > Wallpaper the hero area showed only the "bread-background.png" caption on an empty grey box. **Confidence:** high. The VM's ~/.config/breadpaper/current.json points at /usr/share/backgrounds/bos/bread-background.png (the file exists, 4 MB). src/tauri.conf.json has `assetProtocol.scope: ["$HOME/Pictures/Backgrounds/**"]`, so `convertFileSrc()` in Breadpaper.svelte (hero background-image line ~119 and library thumbs line ~147) is refused for that path. **Bug:** every fresh BOS install starts with the stock wallpaper from /usr/share/backgrounds/bos, so new users see a blank preview. Any image picked with "Choose image" from outside ~/Pictures/Backgrounds (Downloads, another folder) has the same blank preview. **Fix:** add /usr/share/backgrounds/** to the asset scope and allow the chosen file at runtime (tauri `asset_protocol_scope().allow_file` when a wallpaper is set or read), or have the backend return a small thumbnail data URL instead of relying on the asset protocol.

Breadway self-assigned this

2026-10-14 08:40:42 +08:00

Breadway commented

2026-10-14 12:42:01 +08:00

Author

Owner

PR: #80

PR: https://git.breadway.dev/Breadway/bos-settings/pulls/80

Breadway closed this issue

2026-10-14 14:14:30 +08:00

Breadway commented

2026-10-14 14:14:51 +08:00

Author

Owner

Review PASS on e1ca0f5e9a and merged via PR 80 as merge commit 7c7749db9e. Review: #80 (comment). Security: static scope limited to /usr/share/backgrounds/** and /usr/share/wallpapers/**; runtime allow_file only for the current wallpaper (absolute, existing, image extension) from breadpaper get or current.json, no caller-supplied path. All frontend and src checks green, CI check green. Not yet verified on an integrated build in a BOS VM, so the card stays in review.

Review PASS on e1ca0f5e9a7833e30994e64ee0ad27cc95266997 and merged via PR 80 as merge commit 7c7749db9e36fe30543df506c8f3bf4ab4f62050. Review: https://git.breadway.dev/Breadway/bos-settings/pulls/80#issuecomment-4819. Security: static scope limited to /usr/share/backgrounds/** and /usr/share/wallpapers/**; runtime allow_file only for the current wallpaper (absolute, existing, image extension) from breadpaper get or current.json, no caller-supplied path. All frontend and src checks green, CI check green. Not yet verified on an integrated build in a BOS VM, so the card stays in review.

Breadway reopened this issue

2026-10-14 14:14:58 +08:00

Breadway closed this issue

2026-10-14 18:27:53 +08:00

Breadway commented

2026-10-14 18:28:05 +08:00

Author

Owner

Verified on merge 7c7749d (PR #80): svelte-check 0/0, npm test, build, fmt, clippy -D warnings, cargo test 183; asset scope is ~/Pictures/Backgrounds, /usr/share/backgrounds, /usr/share/wallpapers. Live VM on the PR head showed the stock bread-background.png preview (blank on main). Reviewer follow-ups noted: canonicalize before allow_file, add an allow_preview unit test.

Verified on merge 7c7749d (PR #80): svelte-check 0/0, npm test, build, fmt, clippy -D warnings, cargo test 183; asset scope is ~/Pictures/Backgrounds, /usr/share/backgrounds, /usr/share/wallpapers. Live VM on the PR head showed the stock bread-background.png preview (blank on main). Reviewer follow-ups noted: canonicalize before allow_file, add an allow_preview unit test.