Redmine

h4 img.avatar {margin-block: -2px -4px; margin-inline: 0 4px;}

  .flyout-menu__avatar img.avatar {

# frozen_string_literal: true

# Redmine - project management software

# Copyright (C) 2006-  Jean-Philippe Lang

#

# This program is free software; you can redistribute it and/or

# modify it under the terms of the GNU General Public License

# as published by the Free Software Foundation; either version 2

# of the License, or (at your option) any later version.

#

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with this program; if not, write to the Free Software

# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.

class AvatarsController < ApplicationController

  before_action :find_avatar

  before_action :check_avatar_available

  def show

    # The original image is never served since it may contain metadata

    # such as the location where it was taken

    file = @avatar.thumbnail(:size => params[:size], :crop => true)

    unless file

      render_404

      return

    end

    expires_in 1.day, :public => !Setting.login_required?

    if stale?(:etag => file, :template => false)

      send_file(

        file,

        :filename => filename_for_content_disposition(@avatar.filename),

        :type => @avatar.content_type,

        :disposition => 'inline')

    end

  end

  private

  def find_avatar

    user = User.find_by(:id => params[:user_id], :avatar_id => params[:id])

    @avatar = user&.avatar

    render_404 unless @avatar&.readable?

  end

  def check_avatar_available

    render_404 unless User.avatar_available?

  end

end

  # Returns the full URL of the avatar image of +user+ for the API, or nil

  def avatar_image_url(user)

    if local_avatar?(user)

      user_avatar_url(user, user.avatar_id)

    elsif user.mail && Setting.gravatar_enabled?

      gravatar_url(user.mail, {rating: nil, size: nil, default: Setting.gravatar_default})

    end

  end

    elsif local_avatar?(user)

      local_avatar_tag(user, options)

  def local_avatar?(user)

    user.is_a?(User) && user.avatar_id && User.avatar_available?

  end

  def local_avatar_tag(user, options)

    size = (options.delete(:size) || GravatarHelper::DEFAULT_OPTIONS[:size]).to_i

    options[:title] ||= user.name

    options[:srcset] = "#{user_avatar_path(user, user.avatar_id, :size => size * 2)} 2x"

    image_tag(

      user_avatar_path(user, user.avatar_id, :size => size),

      GravatarHelper::DEFAULT_OPTIONS.slice(:alt).merge(options).merge(:width => size, :height => size))

  end

  # Pass :crop => true to get a square thumbnail cropped around the center.

      crop = !!options[:crop]

      target = thumbnail_path(crop ? "#{size}_crop" : size)

        Redmine::Thumbnail.generate(self.diskfile, target, size, is_pdf?, :crop => crop)

  belongs_to :avatar, :class_name => 'Attachment', :dependent => :destroy

  AVATAR_CONTENT_TYPES = %w(image/avif image/gif image/jpeg image/png image/webp).freeze

  # Avatars are served only as thumbnails, which require ImageMagick

  def self.avatar_available?

    Setting.avatar_enabled? && Redmine::Thumbnail.convert_available?

  end

  # Replaces the avatar with the uploaded +file+ and returns true, or returns

  # false with errors if the file cannot be used as an avatar

  def update_avatar(file)

    attachment = Attachment.new(:file => file, :author => User.current, :container => self)

    # Avatars are served only as thumbnails

    unless User.avatar_available? && AVATAR_CONTENT_TYPES.include?(Marcel::MimeType.for(file)) && attachment.thumbnailable?

      errors.add(:avatar, :invalid)

      return false

    end

    unless attachment.valid?

      attachment.errors.full_messages.each {|message| errors.add(:base, message)}

      return false

    end

    transaction do

      attachment.save!

      replace_avatar(attachment)

    end

    true

  end

  def delete_avatar

    replace_avatar(nil)

  end

  # Unlike the thumbnails, the original image of the avatar may contain

  # metadata such as the location where it was taken

  def attachments_visible?(user=User.current)

    user == self || user.admin?

  end

  # Avatars can only be changed through AvatarsController

  def attachments_editable?(user=User.current)

    false

  end

  def attachments_deletable?(user=User.current)

    false

  end

  def replace_avatar(attachment)

    old_avatar = avatar

    self.avatar = attachment

    update_column(:avatar_id, avatar_id)

    old_avatar&.destroy

  end

<p><%= setting_check_box :avatar_enabled %>

<% unless Redmine::Thumbnail.convert_available? %>

<em class="info"><span class="icon icon-warning"><%= sprite_icon('warning', l(:text_setting_avatar_enabled_imagemagick_unavailable)) %></span></em>

<% end %></p>

      avatar_url = avatar_image_url(user)

      api.avatar_url avatar_url if avatar_url

  avatar_url = avatar_image_url(@user)

  api.avatar_url avatar_url if avatar_url

  field_avatar: Avatar

  setting_avatar_enabled: Allow users to set their avatar

  text_setting_avatar_enabled_imagemagick_unavailable: ImageMagick is not available, so users cannot set their avatar.

  get 'users/:user_id/avatar/:id(/:size)', :to => 'avatars#show', :user_id => /\d+/, :id => /\d+/, :size => /\d+/, :as => 'user_avatar'

avatar_enabled:

  default: 1

class AddAvatarIdToUsers < ActiveRecord::Migration[8.1]

  def change

    add_column :users, :avatar_id, :integer

  end

end

    # If crop is true, the image is cropped to a square around its center

    def self.generate(source, target, size, _is_pdf = nil, crop: false)

        elsif crop

          cmd = "#{shell_quote CONVERT_BIN} #{shell_quote source} -auto-orient -thumbnail #{shell_quote "#{size}x#{size}^"} " \

                "-gravity center -extent #{shell_quote "#{size}x#{size}"} #{shell_quote output}"

# frozen_string_literal: true

# Redmine - project management software

# Copyright (C) 2006-  Jean-Philippe Lang

#

# This program is free software; you can redistribute it and/or

# modify it under the terms of the GNU General Public License

# as published by the Free Software Foundation; either version 2

# of the License, or (at your option) any later version.

#

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with this program; if not, write to the Free Software

# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.

require_relative '../test_helper'

class AvatarsControllerTest < Redmine::ControllerTest

  def setup

    User.current = nil

    set_fixtures_attachments_directory

    User.find(2).update_column(:avatar_id, 16)

  end

  def teardown

    set_tmp_attachments_directory

  end

  def test_show

    skip unless convert_installed?

    get :show, :params => {:user_id => 2, :id => 16, :size => 48}

    assert_response :success

    assert_equal 'image/png', response.media_type

    assert_match /\Ainline/, response.headers['Content-Disposition']

    assert_equal "max-age=#{1.day.to_i}, public", response.headers['Cache-Control']

  end

  def test_show_should_not_serve_original_image_if_thumbnail_cannot_be_generated

    Attachment.any_instance.stubs(:thumbnail).returns(nil)

    get :show, :params => {:user_id => 2, :id => 16}

    assert_response :not_found

  end

  def test_show_should_return_404_with_avatars_disabled

    Redmine::Thumbnail.stubs(:convert_available?).returns(true)

    with_settings :avatar_enabled => '0' do

      get :show, :params => {:user_id => 2, :id => 16}

    end

    assert_response :not_found

  end

  def test_show_should_return_404_for_replaced_avatar

    get :show, :params => {:user_id => 2, :id => 15}

    assert_response :not_found

  end

  def test_show_should_require_login_if_login_is_required

    with_settings :login_required => '1' do

      get :show, :params => {:user_id => 2, :id => 16}

      assert_response :redirect

    end

  end

end

  def test_avatar_with_user_having_local_avatar

    Redmine::Thumbnail.stubs(:convert_available?).returns(true)

    user = User.find(2)

    user.avatar_id = 16

    avatar_tag = avatar(user, :size => 24)

    assert_include 'src="/users/2/avatar/16/24"', avatar_tag

    assert_include 'srcset="/users/2/avatar/16/48 2x"', avatar_tag

    assert_include 'width="24" height="24"', avatar_tag

  end

  def test_avatar_should_ignore_local_avatar_without_imagemagick

    Redmine::Thumbnail.stubs(:convert_available?).returns(false)

    user = User.find(2)

    user.avatar_id = 16

    assert_include Digest::SHA256.hexdigest('jsmith@somenet.foo'), avatar(user)

  end

  test "GET /users/:id.xml should return the URL of the uploaded avatar" do

    Redmine::Thumbnail.stubs(:convert_available?).returns(true)

    User.find(2).update_column(:avatar_id, 16)

    with_settings :gravatar_enabled => '1' do

      get '/users/2.xml'

    end

    assert_response :success

    assert_select 'user avatar_url', :text => 'http://www.example.com/users/2/avatar/16'

  end

    should_route 'GET /users/44/avatar/2/48' => 'avatars#show', :user_id => '44', :id => '2', :size => '48'

  def test_thumbnail_with_crop_should_be_square

    skip unless Redmine::Thumbnail.convert_available?

    set_tmp_attachments_directory

    file = file_fixture('2010/11/101123161450_testfile_1.png')

    target = File.join(Attachment.storage_path, "#{SecureRandom.hex(8)}.thumb")

    Redmine::Thumbnail.generate(file.to_s, target, 50, :crop => true)

    # Width and height in the IHDR chunk of the PNG file

    assert_equal [50, 50], File.binread(target, 8, 16).unpack('NN')

  ensure

    FileUtils.rm_f(target) if target

  end

  def test_update_avatar_should_save_image_as_attachment_of_user

    set_tmp_attachments_directory

    assert update_avatar(@jsmith, '2010/11/101123161450_testfile_1.png')

    avatar = @jsmith.reload.avatar

    assert_equal @jsmith, avatar.container

    assert_equal 'image/png', avatar.content_type

  end

  def test_avatar_attachment_should_be_visible_only_to_user_and_administrators

    set_tmp_attachments_directory

    update_avatar(@jsmith, '2010/11/101123161450_testfile_1.png')

    avatar = @jsmith.reload.avatar

    assert avatar.visible?(@jsmith)

    assert avatar.visible?(@admin)

    assert_not avatar.visible?(@dlopper)

  end

  def test_avatar_available_should_require_setting_and_imagemagick

    Redmine::Thumbnail.stubs(:convert_available?).returns(true)

    assert User.avatar_available?

    with_settings :avatar_enabled => '0' do

      assert_not User.avatar_available?

    end

    Redmine::Thumbnail.stubs(:convert_available?).returns(false)

    assert_not User.avatar_available?

  end

  def test_update_avatar_should_reject_images_without_imagemagick

    Redmine::Thumbnail.stubs(:convert_available?).returns(false)

    assert_no_difference 'Attachment.count' do

      assert_not @jsmith.update_avatar(uploaded_test_file('2010/11/101123161450_testfile_1.png', 'image/png'))

    end

  end

  def test_update_avatar_should_reject_non_raster_images

    assert_no_difference 'Attachment.count' do

      assert_not update_avatar(@jsmith, 'testfile.svg')

    end

    assert_include :avatar, @jsmith.errors.attribute_names

  end

  def test_update_avatar_should_replace_existing_avatar

    set_tmp_attachments_directory

    update_avatar(@jsmith, '2010/11/101123161450_testfile_1.png')

    old_avatar_id = @jsmith.avatar_id

    update_avatar(@jsmith, '2010/12/101223161450_testfile_2.png')

    assert_not_equal old_avatar_id, @jsmith.reload.avatar_id

    assert_not Attachment.exists?(old_avatar_id)

  end

  def test_delete_avatar_should_destroy_avatar

    set_tmp_attachments_directory

    update_avatar(@jsmith, '2010/11/101123161450_testfile_1.png')

    avatar_id = @jsmith.avatar_id

    @jsmith.delete_avatar

    assert_nil @jsmith.reload.avatar_id

    assert_not Attachment.exists?(avatar_id)

  end

  def test_destroy_should_destroy_avatar

    set_tmp_attachments_directory

    update_avatar(@jsmith, '2010/11/101123161450_testfile_1.png')

    assert_difference 'Attachment.count', -1 do

      @jsmith.destroy

    end

  end

  private

  def update_avatar(user, name)

    Redmine::Thumbnail.stubs(:convert_available?).returns(true)

    user.update_avatar(uploaded_test_file(name, Redmine::MimeType.of(name)))

  end