diff --git a/templates/components/scope.html b/templates/components/scope.html
index 96b5119cb..6ad4affd9 100644
--- a/templates/components/scope.html
+++ b/templates/components/scope.html
@@ -6,9 +6,32 @@ SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial
Please see LICENSE files in the repository root for full details.
-#}
+{# Macro to remove 'unsafe' scope from a scope list. Usage:
+
+ {% call(scopes) scope.unsafe_scopes(scopes=["openid", "urn:synapse:admin:*"]) %}
+ {{ scopes }}
+ {% endcall %}
+#}
+{% macro unsafe_scopes(scopes) -%}
+ {% set ns = namespace(unsafe_scopes=[]) %}
+ {% set safe_scope_prefixes = ["openid", "urn:matrix:client:api:", "urn:matrix:org.matrix.msc2967.client:api:", "urn:matrix:client:device:", "urn:matrix:org.matrix.msc2967.client:device:"] %}
+ {% for scope in scopes %}
+ {% set ns.is_safe = False %}
+ {% for safe_scope_prefix in safe_scope_prefixes %}
+ {% if scope.startswith(safe_scope_prefix) %}
+ {% set ns.is_safe = True %}
+ {% endif %}
+ {% endfor %}
+ {% if not ns.is_safe %}
+ {% set ns.unsafe_scopes = ns.unsafe_scopes + [scope] %}
+ {% endif %}
+ {% endfor %}
+ {{ caller(ns.unsafe_scopes) }}
+{%- endmacro %}
+
{% macro list(scopes) %}
- {% for scope in (scopes | split(" ")) %}
+ {% for scope in scopes %}
{% if scope == "openid" %}
{{ icon.user_profile() }}
{{ _("mas.scope.view_profile") }}
{% elif scope == "urn:mas:graphql:*" %}
@@ -18,9 +41,9 @@ Please see LICENSE files in the repository root for full details.
{{ icon.chat() }}
{{ _("mas.scope.view_messages") }}
{{ icon.send() }}
{{ _("mas.scope.send_messages") }}
{% elif scope == "urn:synapse:admin:*" %}
-
{{ icon.room() }}
{{ _("mas.scope.synapse_admin") }}
+
{{ icon.room() }}
{{ _("mas.scope.synapse_admin", scope=scope) }}
{% elif scope == "urn:mas:admin" %}
-
{{ icon.admin() }}
{{ _("mas.scope.mas_admin") }}
+
{{ icon.admin() }}
{{ _("mas.scope.mas_admin", scope=scope) }}
{% elif scope is startingwith("urn:matrix:client:device:") or scope is startingwith("urn:matrix:org.matrix.msc2967.client:device:") %}
{# We hide this scope #}
{% else %}
diff --git a/templates/pages/consent.html b/templates/pages/consent.html
index 0eac9dc8b..cd0ee2d59 100644
--- a/templates/pages/consent.html
+++ b/templates/pages/consent.html
@@ -12,6 +12,7 @@ Please see LICENSE files in the repository root for full details.
{% block content %}
{% set client_name = client.client_name or client.client_id %}
+
{% if client.logo_uri %}
@@ -22,33 +23,42 @@ Please see LICENSE files in the repository root for full details.
{% endif %}
-
- {{ scope.list(scopes=grant.scope) }}
-
-
-
- {{ _("mas.consent.make_sure_you_trust", client_name=client_name) }}
- {{ _("mas.consent.you_may_be_sharing") }}
- {% if client.policy_uri or client.tos_uri %}
- Find out how {{ client_name }} will handle your data by reviewing its
- {% if client.policy_uri %}
- privacy policy{% if not client.tos_uri %}.{% endif %}
- {% endif %}
- {% if client.policy_uri and client.tos_uri%}
- and
- {% endif %}
- {% if client.tos_uri %}
- terms of service.
- {% endif %}
+ {% call(scopes) scope.unsafe_scopes(scopes=grant.scope.split(" ")) %}
+ {% if scopes is not empty %}
+
+
-
- {{ scope.list(scopes=grant.scope) }}
-
-
-
- {{ _("mas.consent.make_sure_you_trust", client_name=client_name) }}
- {{ _("mas.consent.you_may_be_sharing") }}
- {% if client.policy_uri or client.tos_uri %}
- Find out how {{ client_name }} will handle your data by reviewing its
- {% if client.policy_uri %}
- privacy policy{% if not client.tos_uri %}.{% endif %}
- {% endif %}
- {% if client.policy_uri and client.tos_uri%}
- and
- {% endif %}
- {% if client.tos_uri %}
- terms of service.
- {% endif %}
+ {% call(scopes) scope.unsafe_scopes(scopes=grant.scope.split(" ")) %}
+ {% if scopes is not empty %}
+
+
{{ matrix_user.display_name or current_session.user.username }}
+
{{ matrix_user.mxid }}
+
@@ -123,18 +132,20 @@ Please see LICENSE files in the repository root for full details.
-
{% elif grant.state == "rejected" %}
diff --git a/templates/pages/sso.html b/templates/pages/sso.html
index cecd92baf..ce3321cfc 100644
--- a/templates/pages/sso.html
+++ b/templates/pages/sso.html
@@ -17,18 +17,29 @@ Please see LICENSE files in the repository root for full details.
-
Allow access to your account?
-
{{ client_name }} wants to access your account. This will allow {{ client_name }} to:
-
- {{ scope.list(scopes="openid urn:matrix:client:api:*") }}
-
+ {% set initial -%}
+ {%- if matrix_user.display_name -%}
+ {{- matrix_user.display_name[0] | upper -}}
+ {%- else -%}
+ {{- matrix_user.mxid[1] | upper -}}
+ {%- endif -%}
+ {%- endset %}
-
- Make sure that you trust {{ client_name }}.
- You may be sharing sensitive information with this site or app.
+
+
{{ initial }}
+
+
{{ matrix_user.display_name or current_session.user.username }}
+
{{ matrix_user.mxid }}
+
@@ -37,12 +48,10 @@ Please see LICENSE files in the repository root for full details.
{{ button.button(text=_("action.continue")) }}
-