Redmine

I have attached patches that allow users to upload an image as their avatar. Users without an uploaded avatar continue to be shown with their Gravatar or initials avatar. The feature can be disabled with the new "Allow users to set their avatar" setting on the Display tab, which is enabled by default.

Users change their avatar on the new page /my/avatar, which is linked from the my account page. Administrators can change the avatar of any user on /users/:user_id/avatar, which is linked from the user edit page. This allows administrators to remove an inappropriate image, and to set an image for accounts that never log in. The page shows the current avatar, explains whether it is the uploaded image, the image from the avatar server or the initials, and allows the uploaded image to be replaced, downloaded or deleted.

The image is stored as an attachment whose container is the user, and is referenced by the new users.avatar_id column. Reusing attachments keeps avatars compatible with plugins that store attachments elsewhere, such as in S3, and the column allows avatars to be rendered without additional queries.

Avatars are served only as thumbnails generated by ImageMagick and cropped to a square, so that metadata in the original image, such as the location where a photo was taken, is not exposed. The feature therefore requires ImageMagick. When ImageMagick is not available, uploaded avatars are ignored, Gravatar or initials avatars are displayed instead, and the setting shows a warning:

The original image can be downloaded only by the user and administrators. Like Gravatar and initials avatars, avatars are visible to anyone who can access Redmine, subject to the "Authentication required" setting.

The patches also make the following related changes:

• The avatar_url attribute in the Users API returns the URL of the uploaded avatar when there is one.
• CSS rules that targeted img.gravatar now target img.avatar, so that they apply to all avatar images. Themes that target img.gravatar may need to be updated.
• The avatar in the title of the my account page now links to the new page instead of the avatar server.
• doc/INSTALL mentions that ImageMagick is required for avatars.

These patches depend on #44620, which prevents partially written thumbnails from being served.

I have attached updated patches that replace the patches in #note-7. The only change is the format of the URL of avatar images, which now contains an unguessable hash instead of the attachment id.

In the previous patches, the URL of an avatar contained the user id and the attachment id, for example /users/2/avatar/16. Since both ids are sequential, anyone who can access Redmine could collect avatars by trying ids in turn, including avatars of users who never appear on any page they can see.

The hash in the new URL, for example /users/2/avatar/3f9a1c0b7e2d4a65, is an HMAC of the attachment id with a secret derived from secret_key_base, so the URL cannot be guessed from the ids. An avatar can therefore be retrieved only by those who have seen its URL on a page.

Setting the target version to 7.1.0.

I have attached an updated 0001-Allow-users-to-set-their-avatar-in-Redmine.patch that replaces the one in #note-9. The patch has been rebased onto r25270, in which the deprecated _is_pdf parameter was removed from Redmine::Thumbnail.generate (#44628). The :crop option added by the patch is now the only optional parameter of the method. There are no other changes.

Committed the patches in r25279, r25280, and r25281 for 7.1.0. Users can now upload an image to use as their avatar.

To change the avatar, open My account and click “Change avatar”. Administrators can also change the avatar of any user from the user's edit page. Users who have not set an avatar continue to see their Gravatar or initials avatar as before.

The feature is enabled by default and can be disabled with the "Allow users to set their avatar" setting in Administration > Settings > Display. It requires ImageMagick, which Redmine already uses to generate thumbnails.