Redmine

I have attached patches that allow users to upload an image as their avatar. Users without an uploaded avatar continue to be shown with their Gravatar or initials avatar. The feature can be disabled with the new "Allow users to set their avatar" setting on the Display tab, which is enabled by default.

Users change their avatar on the new page /my/avatar, which is linked from the my account page. Administrators can change the avatar of any user on /users/:user_id/avatar, which is linked from the user edit page. This allows administrators to remove an inappropriate image, and to set an image for accounts that never log in. The page shows the current avatar, explains whether it is the uploaded image, the image from the avatar server or the initials, and allows the uploaded image to be replaced, downloaded or deleted.

The image is stored as an attachment whose container is the user, and is referenced by the new users.avatar_id column. Reusing attachments keeps avatars compatible with plugins that store attachments elsewhere, such as in S3, and the column allows avatars to be rendered without additional queries.

Avatars are served only as thumbnails generated by ImageMagick and cropped to a square, so that metadata in the original image, such as the location where a photo was taken, is not exposed. The feature therefore requires ImageMagick. When ImageMagick is not available, uploaded avatars are ignored, Gravatar or initials avatars are displayed instead, and the setting shows a warning:

The original image can be downloaded only by the user and administrators. Like Gravatar and initials avatars, avatars are visible to anyone who can access Redmine, subject to the "Authentication required" setting.

The patches also make the following related changes:

• The avatar_url attribute in the Users API returns the URL of the uploaded avatar when there is one.
• CSS rules that targeted img.gravatar now target img.avatar, so that they apply to all avatar images. Themes that target img.gravatar may need to be updated.
• The avatar in the title of the my account page now links to the new page instead of the avatar server.
• doc/INSTALL mentions that ImageMagick is required for avatars.

These patches depend on #44620, which prevents partially written thumbnails from being served.