“Never send encrypted messages to unverified sessions from this session” setting fails initial cross-signing

[florianjacob]

Description

Cross-Signing needs manual intervention from the receiver of a request if they have enabled the riot-web setting “Never send encrypted messages to unverified sessions from this session” and have not yet verified any device manually.

For me, this looks mainly like a side-effect of #11808, i.e. the setting should be adjusted for cross-signing.

Steps to reproduce

• Hit “Start Verification” on Riot-Web with someone who:
  • you share an unencrypted room with
  • but no DM room
  • who has not verified any of your individual sessions previous to cross-signing
  • who has enabled the “Never send encrypted messages from this session to unverified sessions” setting
• This will create a new DM room for the cross-signing verification
  • which is E2E encrypted by default
  • which has the “Never send encrypted messages to unverified sessions in this room” on by default, due to the global riot-web setting
• This results in an ** Unable to decrypt: The sender has disabled encrypting to unverified devices. ** in the DM for the reply to my cross-signing verification request
• Workaround: Turn of the room setting, or manually verify one device and resend the request

Version information

• Platform: web
• Browser: qutebrowser / Firefox
• OS: Linux
• version: riot-web 1.6.0