From 5007eed59cfc6fc885077cb0af21b3343d016b1d Mon Sep 17 00:00:00 2001
From: knrt10 <tripathi.kautilya@gmail.com>
Date: Sun, 24 Mar 2019 17:16:37 +0530
Subject: [PATCH 1/7] Fixes #12312

---
 app/ui-flextab/client/tabs/userEdit.html | 80 ++++++++++++++++-----
 app/ui-flextab/client/tabs/userEdit.js   | 90 +++++++++++++++++++++++-
 server/methods/resetAvatar.js            | 22 ++++--
 server/methods/setAvatarFromService.js   |  7 +-
 4 files changed, 170 insertions(+), 29 deletions(-)

diff --git a/app/ui-flextab/client/tabs/userEdit.html b/app/ui-flextab/client/tabs/userEdit.html
index 41285ff3a39e..daaa09bd69b9 100644
--- a/app/ui-flextab/client/tabs/userEdit.html
+++ b/app/ui-flextab/client/tabs/userEdit.html
@@ -3,25 +3,67 @@
 		<p class="secondary-font-color">{{_ "You_are_not_authorized_to_view_this_page"}}</p>
 	{{else}}
 	<form class="" action="index.html" method="post" autocomplete="off">
-		<div class="rc-input rc-form-group rc-form-group--small">
-			<label class="rc-input__label">
-				<div class="rc-input__title">{{_ "Name"}}</div>
-				<div class="rc-input__wrapper">
-					<input name="name" type="text" class="rc-input__element rc-input__element--small" id="name" autocomplete="off" value="{{user.name}}"/>
-				</div>
-			</label>
-		</div>
-		<div class="rc-input rc-form-group rc-form-group--small">
-			<label class="rc-input__label">
-				<div class="rc-input__title">{{_ "Username"}}</div>
-				<div class="rc-input__wrapper">
-					<div class="rc-input__icon">
-						{{> icon icon='at' }}
-					</div>
-					<input name="name" type="text" class="rc-input__element rc-input__element--small" id="username" autocomplete="off" value="{{user.username}}"/>
-				</div>
-			</label>
-		</div>
+               <div class="rc-form-group rc-form-group--small">
+                      <label class="rc-form-label">{{_ "Profile_picture"}}</label>
+                      <div class="rc-select-avatar">
+                              <div class="rc-select-avatar__preview">
+                                      {{# unless avatarPreview}}
+                                          {{> avatar username=user.username}}
+                                      {{else}}
+                                          {{> avatar url=avatarPreview.blob}}
+                                      {{/unless}}
+                              </div>
+
+                              <div class="rc-select-avatar__list">
+                                      <div class="rc-select-avatar__list-item rc-tooltip js-select-avatar-initials" aria-label="{{_ "initials_avatar" }}">
+                                              {{> avatar username=initialsUsername }}
+                                      </div>
+                                      <div class="rc-select-avatar__list-item rc-tooltip js-select-avatar-upload" aria-label="{{_ "Upload_user_avatar" }}">
+                                              <label class="rc-select-avatar__upload-label avatar" for="upload-avatar">
+                                                      {{> icon block="rc-select-avatar__upload-icon" icon="upload"}}
+                                              </label>
+                                              <input type="file" name="" value="" id="upload-avatar" style="display:none;" accept="image/x-png,image/gif,image/jpeg">
+                                      </div>
+                                      <div class="rc-select-avatar__list-item rc-tooltip js-select-avatar-url {{selectUrl}}" aria-label="{{_ "Use_url_for_avatar" }}">
+                                              <label class="rc-select-avatar__upload-label avatar">
+                                                      {{> icon block="rc-select-avatar__upload-icon" icon="permalink"}}
+                                              </label>
+                                      </div>
+
+                                      <div class="rc-input">
+                    
+                                              <label class="rc-input__label">
+                                                      <div class="rc-input__title">
+                                                              {{_ "Use_url_for_avatar"}}
+                                                      </div>
+                                                      <div class="rc-input__wrapper">
+                                                              <input name="avatar_url" class="rc-input__element js-avatar-url-input" placeholder="{{_ "Use_url_for_avatar"}}">
+                                                      </div>
+                                              </label>
+                                      </div>
+                              </div>
+                      </div>
+
+      <div class="rc-input rc-form-group rc-form-group--small">
+        <label class="rc-input__label">
+          <div class="rc-input__title">{{_ "Name"}}</div>
+          <div class="rc-input__wrapper">
+            <input name="name" type="text" class="rc-input__element rc-input__element--small" id="name" autocomplete="off" value="{{user.name}}"/>
+          </div>
+        </label>
+      </div>
+      <div class="rc-input rc-form-group rc-form-group--small">
+        <label class="rc-input__label">
+          <div class="rc-input__title">{{_ "Username"}}</div>
+          <div class="rc-input__wrapper">
+            <div class="rc-input__icon">
+              {{> icon icon='at' }}
+            </div>
+            <input name="name" type="text" class="rc-input__element rc-input__element--small" id="username" autocomplete="off" value="{{user.username}}"/>
+          </div>
+        </label>
+      </div>
+    </div>
 		<div class="rc-form-group rc-form-group--small">
 			<div class="rc-input">
 				<label class="rc-input__label">
diff --git a/app/ui-flextab/client/tabs/userEdit.js b/app/ui-flextab/client/tabs/userEdit.js
index 2e7e4afa08da..32faff9430d3 100644
--- a/app/ui-flextab/client/tabs/userEdit.js
+++ b/app/ui-flextab/client/tabs/userEdit.js
@@ -5,10 +5,22 @@ import { Template } from 'meteor/templating';
 import { TAPi18n } from 'meteor/tap:i18n';
 import { t, handleError } from '../../../utils';
 import { Roles } from '../../../models';
+import { Notifications } from '../../../notifications';
 import { hasAtLeastOnePermission } from '../../../authorization';
 import toastr from 'toastr';
+import { callbacks } from '../../../callbacks';
 import s from 'underscore.string';
 
+const setAvatar = function(event, template) {
+	const { blob, contentType, service } = this.suggestion;
+
+	template.avatar.set({
+		service,
+		contentType,
+		blob,
+	});
+};
+
 Template.userEdit.helpers({
 
 	disabled(cursor) {
@@ -18,10 +30,23 @@ Template.userEdit.helpers({
 		return (Template.instance().user && hasAtLeastOnePermission('edit-other-user-info')) || (!Template.instance().user && hasAtLeastOnePermission('create-user'));
 	},
 
+	selectUrl() {
+		return Template.instance().url.get().trim() ? '' : 'disabled';
+	},
+
 	user() {
 		return Template.instance().user;
 	},
 
+	initialsUsername() {
+		const { user } = Template.instance();
+		return `@${ user && user.username }`;
+	},
+
+	avatarPreview() {
+		return Template.instance().avatar.get();
+	},
+
 	requirePasswordChange() {
 		return !Template.instance().user || Template.instance().user.requirePasswordChange;
 	},
@@ -41,6 +66,52 @@ Template.userEdit.helpers({
 });
 
 Template.userEdit.events({
+	'click .js-select-avatar-initials'() {
+		Meteor.call('resetAvatar', Template.instance().user, function() {
+			toastr.success(t('Avatar_changed_successfully'));
+			callbacks.run('userAvatarSet', 'initials');
+		});
+	},
+	'click .js-select-avatar-url'(e, instance, ...args) {
+		const url = instance.url.get().trim();
+		if (!url) {
+			return;
+		}
+		setAvatar.apply({
+			suggestion: {
+				service: 'url',
+				blob: url,
+				contentType: '',
+			},
+		}, [e, instance, ...args]);
+	},
+	'input .js-avatar-url-input'(e, instance) {
+		const text = e.target.value;
+		instance.url.set(text);
+	},
+	'change .js-select-avatar-upload [type=file]'(event, template) {
+		const e = event.originalEvent || event;
+		let { files } = e.target;
+		if (!files || files.length === 0) {
+			files = (e.dataTransfer && e.dataTransfer.files) || [];
+		}
+		Object.keys(files).forEach((key) => {
+			const blob = files[key];
+			if (!/image\/.+/.test(blob.type)) {
+				return;
+			}
+			const reader = new FileReader();
+			reader.readAsDataURL(blob);
+			reader.onloadend = function() {
+				template.avatar.set({
+					service: 'upload',
+					contentType: blob.type,
+					blob: reader.result,
+				});
+				callbacks.run('userAvatarSet', 'upload');
+			};
+		});
+	},
 	'click .cancel'(e, t) {
 		e.stopPropagation();
 		e.preventDefault();
@@ -98,7 +169,9 @@ Template.userEdit.events({
 Template.userEdit.onCreated(function() {
 	this.user = this.data != null ? this.data.user : undefined;
 	this.roles = this.user ? new ReactiveVar(this.user.roles) : new ReactiveVar([]);
-
+	this.avatar = new ReactiveVar;
+	this.url = new ReactiveVar('');
+	Notifications.onLogged('updateAvatar', () => this.avatar.set());
 
 	const { tabBar } = Template.currentData();
 
@@ -162,7 +235,7 @@ Template.userEdit.onCreated(function() {
 			return;
 		}
 		const userData = this.getUserData();
-
+		const avatar = this.avatar.get();
 		if (this.user != null) {
 			for (const key in userData) {
 				if (key) {
@@ -176,6 +249,19 @@ Template.userEdit.onCreated(function() {
 			}
 		}
 
+		if (avatar) {
+			const params = [avatar.blob];
+
+			params.push(avatar.contentType);
+
+			params.push(avatar.service);
+			params.push(Template.instance().user);
+			Meteor.call('setAvatarFromService', ...params, function() {
+				toastr.success(t('Avatar_changed_successfully'));
+				callbacks.run('userAvatarSet', avatar.service);
+			});
+		}
+
 		Meteor.call('insertOrUpdateUser', userData, (error) => {
 			if (error) {
 				return handleError(error);
diff --git a/server/methods/resetAvatar.js b/server/methods/resetAvatar.js
index 06dc8160c442..f7954cda1913 100644
--- a/server/methods/resetAvatar.js
+++ b/server/methods/resetAvatar.js
@@ -6,7 +6,7 @@ import { settings } from '../../app/settings';
 import { Notifications } from '../../app/notifications';
 
 Meteor.methods({
-	resetAvatar() {
+	resetAvatar(args) {
 		if (!Meteor.userId()) {
 			throw new Meteor.Error('error-invalid-user', 'Invalid user', {
 				method: 'resetAvatar',
@@ -19,12 +19,20 @@ Meteor.methods({
 			});
 		}
 
-		const user = Meteor.user();
-		FileUpload.getStore('Avatars').deleteByName(user.username);
-		Users.unsetAvatarOrigin(user._id);
-		Notifications.notifyLogged('updateAvatar', {
-			username: user.username,
-		});
+		if (args) {
+			FileUpload.getStore('Avatars').deleteByName(args.username);
+			Users.unsetAvatarOrigin(args._id);
+			Notifications.notifyLogged('updateAvatar', {
+				username: args.username,
+			});
+		} else {
+			const user = Meteor.user();
+			FileUpload.getStore('Avatars').deleteByName(user.username);
+			Users.unsetAvatarOrigin(user._id);
+			Notifications.notifyLogged('updateAvatar', {
+				username: user.username,
+			});
+		}
 	},
 });
 
diff --git a/server/methods/setAvatarFromService.js b/server/methods/setAvatarFromService.js
index dc8ce21cd727..3ce94332f484 100644
--- a/server/methods/setAvatarFromService.js
+++ b/server/methods/setAvatarFromService.js
@@ -5,10 +5,11 @@ import { settings } from '../../app/settings';
 import { setUserAvatar } from '../../app/lib';
 
 Meteor.methods({
-	setAvatarFromService(dataURI, contentType, service) {
+	setAvatarFromService(dataURI, contentType, service, userData) {
 		check(dataURI, String);
 		check(contentType, Match.Optional(String));
 		check(service, Match.Optional(String));
+		check(userData, Match.Optional(Object));
 
 		if (!Meteor.userId()) {
 			throw new Meteor.Error('error-invalid-user', 'Invalid user', {
@@ -22,6 +23,10 @@ Meteor.methods({
 			});
 		}
 
+		if (userData) {
+			return setUserAvatar(userData, dataURI, contentType, service);
+		}
+
 		const user = Meteor.user();
 
 		return setUserAvatar(user, dataURI, contentType, service);

From 7375cffadfcfb08c9fe3c6fd56e4a3f582d1110a Mon Sep 17 00:00:00 2001
From: knrt10 <tripathi.kautilya@gmail.com>
Date: Sun, 24 Mar 2019 18:08:30 +0530
Subject: [PATCH 2/7] Add privilage for admin to update as much profile images
 as they want

---
 app/ui-flextab/client/tabs/userEdit.html | 119 ++++++++++++-----------
 app/ui-flextab/client/tabs/userEdit.js   |  20 ++--
 server/methods/resetAvatar.js            |  35 ++++---
 server/methods/setAvatarFromService.js   |  27 +++--
 4 files changed, 120 insertions(+), 81 deletions(-)

diff --git a/app/ui-flextab/client/tabs/userEdit.html b/app/ui-flextab/client/tabs/userEdit.html
index daaa09bd69b9..9b2b2f4e3ee5 100644
--- a/app/ui-flextab/client/tabs/userEdit.html
+++ b/app/ui-flextab/client/tabs/userEdit.html
@@ -3,67 +3,72 @@
 		<p class="secondary-font-color">{{_ "You_are_not_authorized_to_view_this_page"}}</p>
 	{{else}}
 	<form class="" action="index.html" method="post" autocomplete="off">
-               <div class="rc-form-group rc-form-group--small">
-                      <label class="rc-form-label">{{_ "Profile_picture"}}</label>
-                      <div class="rc-select-avatar">
-                              <div class="rc-select-avatar__preview">
-                                      {{# unless avatarPreview}}
-                                          {{> avatar username=user.username}}
-                                      {{else}}
-                                          {{> avatar url=avatarPreview.blob}}
-                                      {{/unless}}
-                              </div>
+          <div class="rc-form-group rc-form-group--small">
+                  <label class="rc-form-label">
+                          {{_ "Profile_picture"}}
+                  </label>
+                          <div class="rc-select-avatar">
+                                  <div class="rc-select-avatar__preview">
+                                          {{# unless avatarPreview}}
+                                                  {{> avatar username=user.username}}
+                                          {{else}}
+                                                  {{> avatar url=avatarPreview.blob}}
+                                          {{/unless}}
+                                  </div>
 
-                              <div class="rc-select-avatar__list">
-                                      <div class="rc-select-avatar__list-item rc-tooltip js-select-avatar-initials" aria-label="{{_ "initials_avatar" }}">
-                                              {{> avatar username=initialsUsername }}
-                                      </div>
-                                      <div class="rc-select-avatar__list-item rc-tooltip js-select-avatar-upload" aria-label="{{_ "Upload_user_avatar" }}">
-                                              <label class="rc-select-avatar__upload-label avatar" for="upload-avatar">
-                                                      {{> icon block="rc-select-avatar__upload-icon" icon="upload"}}
-                                              </label>
-                                              <input type="file" name="" value="" id="upload-avatar" style="display:none;" accept="image/x-png,image/gif,image/jpeg">
-                                      </div>
-                                      <div class="rc-select-avatar__list-item rc-tooltip js-select-avatar-url {{selectUrl}}" aria-label="{{_ "Use_url_for_avatar" }}">
-                                              <label class="rc-select-avatar__upload-label avatar">
-                                                      {{> icon block="rc-select-avatar__upload-icon" icon="permalink"}}
-                                              </label>
-                                      </div>
+                                  <div class="rc-select-avatar__list">
+                                          <div class="rc-select-avatar__list-item rc-tooltip js-select-avatar-initials" aria-label="{{_ "initials_avatar" }}">
+                                                  {{> avatar username=initialsUsername }}
+                                          </div>
+                                          <div class="rc-select-avatar__list-item rc-tooltip js-select-avatar-upload" aria-label="{{_ "Upload_user_avatar" }}">
+                                                  <label class="rc-select-avatar__upload-label avatar" for="upload-avatar">
+                                                          {{> icon block="rc-select-avatar__upload-icon" icon="upload"}}
+                                                  </label>
+                                                  <input type="file" name="" value="" id="upload-avatar" style="display:none;" accept="image/x-png,image/gif,image/jpeg">
+                                          </div>
+                                          <div class="rc-select-avatar__list-item rc-tooltip js-select-avatar-url {{selectUrl}}" aria-label="{{_ "Use_url_for_avatar" }}">
+                                                  <label class="rc-select-avatar__upload-label avatar">
+                                                          {{> icon block="rc-select-avatar__upload-icon" icon="permalink"}}
+                                                  </label>
+                                          </div>
 
-                                      <div class="rc-input">
-                    
-                                              <label class="rc-input__label">
-                                                      <div class="rc-input__title">
-                                                              {{_ "Use_url_for_avatar"}}
-                                                      </div>
-                                                      <div class="rc-input__wrapper">
-                                                              <input name="avatar_url" class="rc-input__element js-avatar-url-input" placeholder="{{_ "Use_url_for_avatar"}}">
-                                                      </div>
-                                              </label>
-                                      </div>
-                              </div>
-                      </div>
-
-      <div class="rc-input rc-form-group rc-form-group--small">
-        <label class="rc-input__label">
-          <div class="rc-input__title">{{_ "Name"}}</div>
-          <div class="rc-input__wrapper">
-            <input name="name" type="text" class="rc-input__element rc-input__element--small" id="name" autocomplete="off" value="{{user.name}}"/>
+                                          <div class="rc-input">
+                        
+                                                  <label class="rc-input__label">
+                                                          <div class="rc-input__title">
+                                                                  {{_ "Use_url_for_avatar"}}
+                                                          </div>
+                                                          <div class="rc-input__wrapper">
+                                                                  <input name="avatar_url" class="rc-input__element js-avatar-url-input" placeholder="{{_ "Use_url_for_avatar"}}">
+                                                          </div>
+                                                  </label>
+                                          </div>
+                                  </div>
+                          </div> 
+          </div>
+          <div class="rc-input rc-form-group rc-form-group--small">
+                  <label class="rc-input__label">
+                          <div class="rc-input__title">
+                                  {{_ "Name"}}
+                          </div>
+                          <div class="rc-input__wrapper">
+                                  <input name="name" type="text" class="rc-input__element rc-input__element--small" id="name" autocomplete="off" value="{{user.name}}"/>
+                          </div>
+                  </label>
           </div>
-        </label>
-      </div>
-      <div class="rc-input rc-form-group rc-form-group--small">
-        <label class="rc-input__label">
-          <div class="rc-input__title">{{_ "Username"}}</div>
-          <div class="rc-input__wrapper">
-            <div class="rc-input__icon">
-              {{> icon icon='at' }}
-            </div>
-            <input name="name" type="text" class="rc-input__element rc-input__element--small" id="username" autocomplete="off" value="{{user.username}}"/>
+          <div class="rc-input rc-form-group rc-form-group--small">
+                  <label class="rc-input__label">
+                          <div class="rc-input__title">
+                                  {{_ "Username"}}
+                          </div>
+                          <div class="rc-input__wrapper">
+                                  <div class="rc-input__icon">
+                                          {{> icon icon='at' }}
+                                  </div>
+                                  <input name="name" type="text" class="rc-input__element rc-input__element--small" id="username" autocomplete="off" value="{{user.username}}"/>
+                          </div>
+                  </label>
           </div>
-        </label>
-      </div>
-    </div>
 		<div class="rc-form-group rc-form-group--small">
 			<div class="rc-input">
 				<label class="rc-input__label">
diff --git a/app/ui-flextab/client/tabs/userEdit.js b/app/ui-flextab/client/tabs/userEdit.js
index 32faff9430d3..8d2104ac2c03 100644
--- a/app/ui-flextab/client/tabs/userEdit.js
+++ b/app/ui-flextab/client/tabs/userEdit.js
@@ -67,9 +67,13 @@ Template.userEdit.helpers({
 
 Template.userEdit.events({
 	'click .js-select-avatar-initials'() {
-		Meteor.call('resetAvatar', Template.instance().user, function() {
-			toastr.success(t('Avatar_changed_successfully'));
-			callbacks.run('userAvatarSet', 'initials');
+		Meteor.call('resetAvatarAdmin', Template.instance().user, function(err) {
+			if (err && err.details) {
+				toastr.error(t(err.message));
+			} else {
+				toastr.success(t('Avatar_changed_successfully'));
+				callbacks.run('userAvatarSet', 'initials');
+			}
 		});
 	},
 	'click .js-select-avatar-url'(e, instance, ...args) {
@@ -256,9 +260,13 @@ Template.userEdit.onCreated(function() {
 
 			params.push(avatar.service);
 			params.push(Template.instance().user);
-			Meteor.call('setAvatarFromService', ...params, function() {
-				toastr.success(t('Avatar_changed_successfully'));
-				callbacks.run('userAvatarSet', avatar.service);
+			Meteor.call('setAvatarFromServiceAdmin', ...params, function(err) {
+				if (err && err.details) {
+					toastr.error(t(err.message));
+				} else {
+					toastr.success(t('Avatar_changed_successfully'));
+					callbacks.run('userAvatarSet', avatar.service);
+				}
 			});
 		}
 
diff --git a/server/methods/resetAvatar.js b/server/methods/resetAvatar.js
index f7954cda1913..2adf488810f4 100644
--- a/server/methods/resetAvatar.js
+++ b/server/methods/resetAvatar.js
@@ -6,7 +6,7 @@ import { settings } from '../../app/settings';
 import { Notifications } from '../../app/notifications';
 
 Meteor.methods({
-	resetAvatar(args) {
+	resetAvatar() {
 		if (!Meteor.userId()) {
 			throw new Meteor.Error('error-invalid-user', 'Invalid user', {
 				method: 'resetAvatar',
@@ -19,20 +19,31 @@ Meteor.methods({
 			});
 		}
 
-		if (args) {
-			FileUpload.getStore('Avatars').deleteByName(args.username);
-			Users.unsetAvatarOrigin(args._id);
-			Notifications.notifyLogged('updateAvatar', {
-				username: args.username,
+		const user = Meteor.user();
+		FileUpload.getStore('Avatars').deleteByName(user.username);
+		Users.unsetAvatarOrigin(user._id);
+		Notifications.notifyLogged('updateAvatar', {
+			username: user.username,
+		});
+	},
+	resetAvatarAdmin(args) {
+		if (!args) {
+			throw new Meteor.Error('error-invalid-user', 'Invalid user', {
+				method: 'resetAvatarAdmin',
 			});
-		} else {
-			const user = Meteor.user();
-			FileUpload.getStore('Avatars').deleteByName(user.username);
-			Users.unsetAvatarOrigin(user._id);
-			Notifications.notifyLogged('updateAvatar', {
-				username: user.username,
+		}
+
+		if (!settings.get('Accounts_AllowUserAvatarChange')) {
+			throw new Meteor.Error('error-not-allowed', 'Not allowed', {
+				method: 'resetAvatarAdmin',
 			});
 		}
+
+		FileUpload.getStore('Avatars').deleteByName(args.username);
+		Users.unsetAvatarOrigin(args._id);
+		Notifications.notifyLogged('updateAvatar', {
+			username: args.username,
+		});
 	},
 });
 
diff --git a/server/methods/setAvatarFromService.js b/server/methods/setAvatarFromService.js
index 3ce94332f484..1066667fe580 100644
--- a/server/methods/setAvatarFromService.js
+++ b/server/methods/setAvatarFromService.js
@@ -5,11 +5,10 @@ import { settings } from '../../app/settings';
 import { setUserAvatar } from '../../app/lib';
 
 Meteor.methods({
-	setAvatarFromService(dataURI, contentType, service, userData) {
+	setAvatarFromService(dataURI, contentType, service) {
 		check(dataURI, String);
 		check(contentType, Match.Optional(String));
 		check(service, Match.Optional(String));
-		check(userData, Match.Optional(Object));
 
 		if (!Meteor.userId()) {
 			throw new Meteor.Error('error-invalid-user', 'Invalid user', {
@@ -23,14 +22,30 @@ Meteor.methods({
 			});
 		}
 
-		if (userData) {
-			return setUserAvatar(userData, dataURI, contentType, service);
-		}
-
 		const user = Meteor.user();
 
 		return setUserAvatar(user, dataURI, contentType, service);
 	},
+	setAvatarFromServiceAdmin(dataURI, contentType, service, userData) {
+		check(dataURI, String);
+		check(contentType, Match.Optional(String));
+		check(service, Match.Optional(String));
+		check(userData, Match.Optional(Object));
+
+		if (!userData) {
+			throw new Meteor.Error('error-invalid-user', 'Invalid user', {
+				method: 'setAvatarFromServiceAdmin',
+			});
+		}
+
+		if (!settings.get('Accounts_AllowUserAvatarChange')) {
+			throw new Meteor.Error('error-not-allowed', 'Not allowed', {
+				method: 'setAvatarFromServiceAdmin',
+			});
+		}
+
+		return setUserAvatar(userData, dataURI, contentType, service);
+	},
 });
 
 DDPRateLimiter.addRule({

From 8be878809653df128c1c195654bd66faf56f7cfc Mon Sep 17 00:00:00 2001
From: knrt10 <tripathi.kautilya@gmail.com>
Date: Mon, 25 Mar 2019 16:08:47 +0530
Subject: [PATCH 3/7] Added API fix too

---
 app/api/server/v1/users.js | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/app/api/server/v1/users.js b/app/api/server/v1/users.js
index dd0d0f72a3df..72192f6fd6e8 100644
--- a/app/api/server/v1/users.js
+++ b/app/api/server/v1/users.js
@@ -256,12 +256,6 @@ API.v1.addRoute('users.setAvatar', { authRequired: true }, {
 			username: Match.Maybe(String),
 		}));
 
-		if (!settings.get('Accounts_AllowUserAvatarChange')) {
-			throw new Meteor.Error('error-not-allowed', 'Change avatar is not allowed', {
-				method: 'users.setAvatar',
-			});
-		}
-
 		let user;
 		if (this.isUserFromParams()) {
 			user = Meteor.users.findOne(this.userId);
@@ -271,6 +265,14 @@ API.v1.addRoute('users.setAvatar', { authRequired: true }, {
 			return API.v1.unauthorized();
 		}
 
+		if (!user.roles.includes('admin')) {
+			if (!settings.get('Accounts_AllowUserAvatarChange')) {
+				throw new Meteor.Error('error-not-allowed', 'Change avatar is not allowed', {
+					method: 'users.setAvatar',
+				});
+			}
+		}
+
 		Meteor.runAsUser(user._id, () => {
 			if (this.bodyParams.avatarUrl) {
 				setUserAvatar(user, this.bodyParams.avatarUrl, '', 'url');

From 10b3e837c515f691760706ce2c35ca4ab5c6cc33 Mon Sep 17 00:00:00 2001
From: Rodrigo Nascimento <rodrigoknascimento@gmail.com>
Date: Sat, 6 Apr 2019 17:17:35 -0300
Subject: [PATCH 4/7] Check for permissions

---
 app/authorization/server/startup.js        |  1 +
 app/ui-flextab/client/tabs/userEdit.js     | 10 ++----
 packages/rocketchat-i18n/i18n/en.i18n.json |  2 ++
 server/methods/resetAvatar.js              | 41 +++++++++++-----------
 server/methods/setAvatarFromService.js     | 35 +++++++++---------
 5 files changed, 44 insertions(+), 45 deletions(-)

diff --git a/app/authorization/server/startup.js b/app/authorization/server/startup.js
index d79acd6d8706..0ec0476ec9de 100644
--- a/app/authorization/server/startup.js
+++ b/app/authorization/server/startup.js
@@ -35,6 +35,7 @@ Meteor.startup(function() {
 		{ _id: 'edit-other-user-active-status', roles : ['admin'] },
 		{ _id: 'edit-other-user-info',          roles : ['admin'] },
 		{ _id: 'edit-other-user-password',      roles : ['admin'] },
+		{ _id: 'edit-other-user-avatar',        roles : ['admin'] },
 		{ _id: 'edit-privileged-setting',       roles : ['admin'] },
 		{ _id: 'edit-room',                     roles : ['admin', 'owner', 'moderator'] },
 		{ _id: 'edit-room-retention-policy',    roles : ['admin'] },
diff --git a/app/ui-flextab/client/tabs/userEdit.js b/app/ui-flextab/client/tabs/userEdit.js
index 8d2104ac2c03..597f7599e251 100644
--- a/app/ui-flextab/client/tabs/userEdit.js
+++ b/app/ui-flextab/client/tabs/userEdit.js
@@ -67,7 +67,7 @@ Template.userEdit.helpers({
 
 Template.userEdit.events({
 	'click .js-select-avatar-initials'() {
-		Meteor.call('resetAvatarAdmin', Template.instance().user, function(err) {
+		Meteor.call('resetAvatar', Template.instance().user._id, function(err) {
 			if (err && err.details) {
 				toastr.error(t(err.message));
 			} else {
@@ -254,13 +254,7 @@ Template.userEdit.onCreated(function() {
 		}
 
 		if (avatar) {
-			const params = [avatar.blob];
-
-			params.push(avatar.contentType);
-
-			params.push(avatar.service);
-			params.push(Template.instance().user);
-			Meteor.call('setAvatarFromServiceAdmin', ...params, function(err) {
+			Meteor.call('setAvatarFromService', avatar.blob, avatar.contentType, avatar.service, Template.instance().user._id, function(err) {
 				if (err && err.details) {
 					toastr.error(t(err.message));
 				} else {
diff --git a/packages/rocketchat-i18n/i18n/en.i18n.json b/packages/rocketchat-i18n/i18n/en.i18n.json
index 6a8c2027ec50..d33628376c3f 100644
--- a/packages/rocketchat-i18n/i18n/en.i18n.json
+++ b/packages/rocketchat-i18n/i18n/en.i18n.json
@@ -1089,6 +1089,8 @@
   "edit-message_description": "Permission to edit a message within a room",
   "edit-other-user-active-status": "Edit Other User Active Status",
   "edit-other-user-active-status_description": "Permission to enable or disable other accounts",
+  "edit-other-user-avatar": "Edit Other User Avatar",
+  "edit-other-user-avatar_description": "Permission to change other user's avatar.",
   "edit-other-user-info": "Edit Other User Information",
   "edit-other-user-info_description": "Permission to change other user's name, username or email address.",
   "edit-other-user-password": "Edit Other User Password",
diff --git a/server/methods/resetAvatar.js b/server/methods/resetAvatar.js
index 2adf488810f4..b56b26f21537 100644
--- a/server/methods/resetAvatar.js
+++ b/server/methods/resetAvatar.js
@@ -1,12 +1,13 @@
 import { Meteor } from 'meteor/meteor';
 import { DDPRateLimiter } from 'meteor/ddp-rate-limiter';
 import { FileUpload } from '../../app/file-upload';
-import { Users } from '../../app/models';
+import { Users } from '../../app/models/server';
 import { settings } from '../../app/settings';
 import { Notifications } from '../../app/notifications';
+import { hasPermission } from '../../app/authorization/server';
 
 Meteor.methods({
-	resetAvatar() {
+	resetAvatar({ userId }) {
 		if (!Meteor.userId()) {
 			throw new Meteor.Error('error-invalid-user', 'Invalid user', {
 				method: 'resetAvatar',
@@ -19,30 +20,30 @@ Meteor.methods({
 			});
 		}
 
-		const user = Meteor.user();
-		FileUpload.getStore('Avatars').deleteByName(user.username);
-		Users.unsetAvatarOrigin(user._id);
-		Notifications.notifyLogged('updateAvatar', {
-			username: user.username,
-		});
-	},
-	resetAvatarAdmin(args) {
-		if (!args) {
-			throw new Meteor.Error('error-invalid-user', 'Invalid user', {
-				method: 'resetAvatarAdmin',
-			});
+		let user;
+
+		if (userId) {
+			if (!hasPermission(userId, 'edit-other-user-avatar')) {
+				throw new Meteor.Error('error-unauthorized', 'Unauthorized', {
+					method: 'resetAvatar',
+				});
+			}
+
+			user = Users.findOneById(userId, { fields: { _id: 1, username: 1 } });
+		} else {
+			user = Meteor.user();
 		}
 
-		if (!settings.get('Accounts_AllowUserAvatarChange')) {
-			throw new Meteor.Error('error-not-allowed', 'Not allowed', {
-				method: 'resetAvatarAdmin',
+		if (user == null) {
+			throw new Meteor.Error('error-invalid-desired-user', 'Invalid desired user', {
+				method: 'resetAvatar',
 			});
 		}
 
-		FileUpload.getStore('Avatars').deleteByName(args.username);
-		Users.unsetAvatarOrigin(args._id);
+		FileUpload.getStore('Avatars').deleteByName(user.username);
+		Users.unsetAvatarOrigin(user._id);
 		Notifications.notifyLogged('updateAvatar', {
-			username: args.username,
+			username: user.username,
 		});
 	},
 });
diff --git a/server/methods/setAvatarFromService.js b/server/methods/setAvatarFromService.js
index 1066667fe580..8195af6fd557 100644
--- a/server/methods/setAvatarFromService.js
+++ b/server/methods/setAvatarFromService.js
@@ -3,12 +3,15 @@ import { Match, check } from 'meteor/check';
 import { DDPRateLimiter } from 'meteor/ddp-rate-limiter';
 import { settings } from '../../app/settings';
 import { setUserAvatar } from '../../app/lib';
+import { Users } from '../../app/models/server';
+import { hasPermission } from '../../app/authorization/server';
 
 Meteor.methods({
-	setAvatarFromService(dataURI, contentType, service) {
+	setAvatarFromService(dataURI, contentType, service, userId) {
 		check(dataURI, String);
 		check(contentType, Match.Optional(String));
 		check(service, Match.Optional(String));
+		check(userId, Match.Optional(String));
 
 		if (!Meteor.userId()) {
 			throw new Meteor.Error('error-invalid-user', 'Invalid user', {
@@ -22,29 +25,27 @@ Meteor.methods({
 			});
 		}
 
-		const user = Meteor.user();
+		let user;
 
-		return setUserAvatar(user, dataURI, contentType, service);
-	},
-	setAvatarFromServiceAdmin(dataURI, contentType, service, userData) {
-		check(dataURI, String);
-		check(contentType, Match.Optional(String));
-		check(service, Match.Optional(String));
-		check(userData, Match.Optional(Object));
+		if (userId) {
+			if (!hasPermission(userId, 'edit-other-user-avatar')) {
+				throw new Meteor.Error('error-unauthorized', 'Unauthorized', {
+					method: 'setAvatarFromService',
+				});
+			}
 
-		if (!userData) {
-			throw new Meteor.Error('error-invalid-user', 'Invalid user', {
-				method: 'setAvatarFromServiceAdmin',
-			});
+			user = Users.findOneById(userId, { fields: { _id: 1, username: 1 } });
+		} else {
+			user = Meteor.user();
 		}
 
-		if (!settings.get('Accounts_AllowUserAvatarChange')) {
-			throw new Meteor.Error('error-not-allowed', 'Not allowed', {
-				method: 'setAvatarFromServiceAdmin',
+		if (user == null) {
+			throw new Meteor.Error('error-invalid-desired-user', 'Invalid desired user', {
+				method: 'setAvatarFromService',
 			});
 		}
 
-		return setUserAvatar(userData, dataURI, contentType, service);
+		return setUserAvatar(user, dataURI, contentType, service);
 	},
 });
 

From a315eaeae84e7eb2347a14eabf6218a38df75e9d Mon Sep 17 00:00:00 2001
From: Rodrigo Nascimento <rodrigoknascimento@gmail.com>
Date: Sat, 6 Apr 2019 17:22:04 -0300
Subject: [PATCH 5/7] Check permission in rest endpoint

---
 app/api/server/v1/users.js | 16 +++++++---------
 1 file changed, 7 insertions(+), 9 deletions(-)

diff --git a/app/api/server/v1/users.js b/app/api/server/v1/users.js
index 72192f6fd6e8..394bed371d67 100644
--- a/app/api/server/v1/users.js
+++ b/app/api/server/v1/users.js
@@ -256,23 +256,21 @@ API.v1.addRoute('users.setAvatar', { authRequired: true }, {
 			username: Match.Maybe(String),
 		}));
 
+		if (!settings.get('Accounts_AllowUserAvatarChange')) {
+			throw new Meteor.Error('error-not-allowed', 'Change avatar is not allowed', {
+				method: 'users.setAvatar',
+			});
+		}
+
 		let user;
 		if (this.isUserFromParams()) {
 			user = Meteor.users.findOne(this.userId);
-		} else if (hasPermission(this.userId, 'edit-other-user-info')) {
+		} else if (hasPermission(this.userId, 'edit-other-user-avatar')) {
 			user = this.getUserFromParams();
 		} else {
 			return API.v1.unauthorized();
 		}
 
-		if (!user.roles.includes('admin')) {
-			if (!settings.get('Accounts_AllowUserAvatarChange')) {
-				throw new Meteor.Error('error-not-allowed', 'Change avatar is not allowed', {
-					method: 'users.setAvatar',
-				});
-			}
-		}
-
 		Meteor.runAsUser(user._id, () => {
 			if (this.bodyParams.avatarUrl) {
 				setUserAvatar(user, this.bodyParams.avatarUrl, '', 'url');

From 6c1f2c1cb8997253565dc8c2faf2ac1d5d99328f Mon Sep 17 00:00:00 2001
From: Rodrigo Nascimento <rodrigoknascimento@gmail.com>
Date: Sat, 6 Apr 2019 17:26:10 -0300
Subject: [PATCH 6/7] Handle pass own id to avatar set methods

---
 server/methods/resetAvatar.js          | 2 +-
 server/methods/setAvatarFromService.js | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/server/methods/resetAvatar.js b/server/methods/resetAvatar.js
index b56b26f21537..85d8c6b19000 100644
--- a/server/methods/resetAvatar.js
+++ b/server/methods/resetAvatar.js
@@ -22,7 +22,7 @@ Meteor.methods({
 
 		let user;
 
-		if (userId) {
+		if (userId && userId !== Meteor.userId()) {
 			if (!hasPermission(userId, 'edit-other-user-avatar')) {
 				throw new Meteor.Error('error-unauthorized', 'Unauthorized', {
 					method: 'resetAvatar',
diff --git a/server/methods/setAvatarFromService.js b/server/methods/setAvatarFromService.js
index 8195af6fd557..66e6b4008d5a 100644
--- a/server/methods/setAvatarFromService.js
+++ b/server/methods/setAvatarFromService.js
@@ -27,7 +27,7 @@ Meteor.methods({
 
 		let user;
 
-		if (userId) {
+		if (userId && userId !== Meteor.userId()) {
 			if (!hasPermission(userId, 'edit-other-user-avatar')) {
 				throw new Meteor.Error('error-unauthorized', 'Unauthorized', {
 					method: 'setAvatarFromService',

From 867a7eaab72a824629ee6e1eaae080e94ed3c533 Mon Sep 17 00:00:00 2001
From: Rodrigo Nascimento <rodrigoknascimento@gmail.com>
Date: Sat, 6 Apr 2019 18:00:05 -0300
Subject: [PATCH 7/7] Code improvements

---
 app/ui-flextab/client/tabs/userEdit.html | 131 ++++++++++++-----------
 app/ui-flextab/client/tabs/userEdit.js   |  62 ++++++-----
 server/methods/resetAvatar.js            |   4 +-
 server/methods/setAvatarFromService.js   |   2 +-
 4 files changed, 100 insertions(+), 99 deletions(-)

diff --git a/app/ui-flextab/client/tabs/userEdit.html b/app/ui-flextab/client/tabs/userEdit.html
index 9b2b2f4e3ee5..ba9cc33496df 100644
--- a/app/ui-flextab/client/tabs/userEdit.html
+++ b/app/ui-flextab/client/tabs/userEdit.html
@@ -3,72 +3,75 @@
 		<p class="secondary-font-color">{{_ "You_are_not_authorized_to_view_this_page"}}</p>
 	{{else}}
 	<form class="" action="index.html" method="post" autocomplete="off">
-          <div class="rc-form-group rc-form-group--small">
-                  <label class="rc-form-label">
-                          {{_ "Profile_picture"}}
-                  </label>
-                          <div class="rc-select-avatar">
-                                  <div class="rc-select-avatar__preview">
-                                          {{# unless avatarPreview}}
-                                                  {{> avatar username=user.username}}
-                                          {{else}}
-                                                  {{> avatar url=avatarPreview.blob}}
-                                          {{/unless}}
-                                  </div>
+		<div class="rc-form-group rc-form-group--small">
+			<label class="rc-form-label">
+				{{_ "Profile_picture"}}
+			</label>
+			<div class="rc-select-avatar">
+				<div class="rc-select-avatar__preview">
+					{{#if avatarPreview}}
+						{{#if $eq avatarPreview.service 'initials'}}
+							{{> avatar username=avatarPreview.blob}}
+						{{else}}
+							{{> avatar url=avatarPreview.blob}}
+						{{/if}}
+					{{else}}
+						{{> avatar username=user.username}}
+					{{/if}}
+				</div>
 
-                                  <div class="rc-select-avatar__list">
-                                          <div class="rc-select-avatar__list-item rc-tooltip js-select-avatar-initials" aria-label="{{_ "initials_avatar" }}">
-                                                  {{> avatar username=initialsUsername }}
-                                          </div>
-                                          <div class="rc-select-avatar__list-item rc-tooltip js-select-avatar-upload" aria-label="{{_ "Upload_user_avatar" }}">
-                                                  <label class="rc-select-avatar__upload-label avatar" for="upload-avatar">
-                                                          {{> icon block="rc-select-avatar__upload-icon" icon="upload"}}
-                                                  </label>
-                                                  <input type="file" name="" value="" id="upload-avatar" style="display:none;" accept="image/x-png,image/gif,image/jpeg">
-                                          </div>
-                                          <div class="rc-select-avatar__list-item rc-tooltip js-select-avatar-url {{selectUrl}}" aria-label="{{_ "Use_url_for_avatar" }}">
-                                                  <label class="rc-select-avatar__upload-label avatar">
-                                                          {{> icon block="rc-select-avatar__upload-icon" icon="permalink"}}
-                                                  </label>
-                                          </div>
+				<div class="rc-select-avatar__list">
+					<div class="rc-select-avatar__list-item rc-tooltip js-select-avatar-initials" aria-label="{{_ "initials_avatar" }}">
+						{{> avatar username=initialsUsername }}
+					</div>
+					<div class="rc-select-avatar__list-item rc-tooltip js-select-avatar-upload" aria-label="{{_ "Upload_user_avatar" }}">
+						<label class="rc-select-avatar__upload-label avatar" for="upload-avatar">
+							{{> icon block="rc-select-avatar__upload-icon" icon="upload"}}
+						</label>
+						<input type="file" name="" value="" id="upload-avatar" style="display:none;" accept="image/x-png,image/gif,image/jpeg">
+					</div>
+					<div class="rc-select-avatar__list-item rc-tooltip js-select-avatar-url {{selectUrl}}" aria-label="{{_ "Use_url_for_avatar" }}">
+						<label class="rc-select-avatar__upload-label avatar">
+							{{> icon block="rc-select-avatar__upload-icon" icon="permalink"}}
+						</label>
+					</div>
 
-                                          <div class="rc-input">
-                        
-                                                  <label class="rc-input__label">
-                                                          <div class="rc-input__title">
-                                                                  {{_ "Use_url_for_avatar"}}
-                                                          </div>
-                                                          <div class="rc-input__wrapper">
-                                                                  <input name="avatar_url" class="rc-input__element js-avatar-url-input" placeholder="{{_ "Use_url_for_avatar"}}">
-                                                          </div>
-                                                  </label>
-                                          </div>
-                                  </div>
-                          </div> 
-          </div>
-          <div class="rc-input rc-form-group rc-form-group--small">
-                  <label class="rc-input__label">
-                          <div class="rc-input__title">
-                                  {{_ "Name"}}
-                          </div>
-                          <div class="rc-input__wrapper">
-                                  <input name="name" type="text" class="rc-input__element rc-input__element--small" id="name" autocomplete="off" value="{{user.name}}"/>
-                          </div>
-                  </label>
-          </div>
-          <div class="rc-input rc-form-group rc-form-group--small">
-                  <label class="rc-input__label">
-                          <div class="rc-input__title">
-                                  {{_ "Username"}}
-                          </div>
-                          <div class="rc-input__wrapper">
-                                  <div class="rc-input__icon">
-                                          {{> icon icon='at' }}
-                                  </div>
-                                  <input name="name" type="text" class="rc-input__element rc-input__element--small" id="username" autocomplete="off" value="{{user.username}}"/>
-                          </div>
-                  </label>
-          </div>
+					<div class="rc-input">
+						<label class="rc-input__label">
+							<div class="rc-input__title">
+								{{_ "Use_url_for_avatar"}}
+							</div>
+							<div class="rc-input__wrapper">
+								<input name="avatar_url" class="rc-input__element js-avatar-url-input" placeholder="{{_ "Use_url_for_avatar"}}">
+							</div>
+						</label>
+					</div>
+				</div>
+			</div>
+		</div>
+		<div class="rc-input rc-form-group rc-form-group--small">
+				<label class="rc-input__label">
+						<div class="rc-input__title">
+							{{_ "Name"}}
+						</div>
+						<div class="rc-input__wrapper">
+								<input name="name" type="text" class="rc-input__element rc-input__element--small" id="name" autocomplete="off" value="{{user.name}}"/>
+						</div>
+				</label>
+		</div>
+		<div class="rc-input rc-form-group rc-form-group--small">
+				<label class="rc-input__label">
+						<div class="rc-input__title">
+							{{_ "Username"}}
+						</div>
+						<div class="rc-input__wrapper">
+								<div class="rc-input__icon">
+									{{> icon icon='at' }}
+								</div>
+								<input name="name" type="text" class="rc-input__element rc-input__element--small" id="username" autocomplete="off" value="{{user.username}}"/>
+						</div>
+				</label>
+		</div>
 		<div class="rc-form-group rc-form-group--small">
 			<div class="rc-input">
 				<label class="rc-input__label">
diff --git a/app/ui-flextab/client/tabs/userEdit.js b/app/ui-flextab/client/tabs/userEdit.js
index 597f7599e251..8b097c3ddbcc 100644
--- a/app/ui-flextab/client/tabs/userEdit.js
+++ b/app/ui-flextab/client/tabs/userEdit.js
@@ -11,16 +11,6 @@ import toastr from 'toastr';
 import { callbacks } from '../../../callbacks';
 import s from 'underscore.string';
 
-const setAvatar = function(event, template) {
-	const { blob, contentType, service } = this.suggestion;
-
-	template.avatar.set({
-		service,
-		contentType,
-		blob,
-	});
-};
-
 Template.userEdit.helpers({
 
 	disabled(cursor) {
@@ -66,33 +56,31 @@ Template.userEdit.helpers({
 });
 
 Template.userEdit.events({
-	'click .js-select-avatar-initials'() {
-		Meteor.call('resetAvatar', Template.instance().user._id, function(err) {
-			if (err && err.details) {
-				toastr.error(t(err.message));
-			} else {
-				toastr.success(t('Avatar_changed_successfully'));
-				callbacks.run('userAvatarSet', 'initials');
-			}
+	'click .js-select-avatar-initials'(e, template) {
+		template.avatar.set({
+			service: 'initials',
+			blob: `@${ template.user.username }`,
 		});
 	},
-	'click .js-select-avatar-url'(e, instance, ...args) {
-		const url = instance.url.get().trim();
+
+	'click .js-select-avatar-url'(e, template) {
+		const url = template.url.get().trim();
 		if (!url) {
 			return;
 		}
-		setAvatar.apply({
-			suggestion: {
-				service: 'url',
-				blob: url,
-				contentType: '',
-			},
-		}, [e, instance, ...args]);
+
+		template.avatar.set({
+			service: 'url',
+			contentType: '',
+			blob: url,
+		});
 	},
-	'input .js-avatar-url-input'(e, instance) {
+
+	'input .js-avatar-url-input'(e, template) {
 		const text = e.target.value;
-		instance.url.set(text);
+		template.url.set(text);
 	},
+
 	'change .js-select-avatar-upload [type=file]'(event, template) {
 		const e = event.originalEvent || event;
 		let { files } = e.target;
@@ -112,10 +100,10 @@ Template.userEdit.events({
 					contentType: blob.type,
 					blob: reader.result,
 				});
-				callbacks.run('userAvatarSet', 'upload');
 			};
 		});
 	},
+
 	'click .cancel'(e, t) {
 		e.stopPropagation();
 		e.preventDefault();
@@ -239,7 +227,6 @@ Template.userEdit.onCreated(function() {
 			return;
 		}
 		const userData = this.getUserData();
-		const avatar = this.avatar.get();
 		if (this.user != null) {
 			for (const key in userData) {
 				if (key) {
@@ -253,8 +240,19 @@ Template.userEdit.onCreated(function() {
 			}
 		}
 
+		const avatar = this.avatar.get();
 		if (avatar) {
-			Meteor.call('setAvatarFromService', avatar.blob, avatar.contentType, avatar.service, Template.instance().user._id, function(err) {
+			let method;
+			const params = [];
+
+			if (avatar.service === 'initials') {
+				method = 'resetAvatar';
+			} else {
+				method = 'setAvatarFromService';
+				params.push(avatar.blob, avatar.contentType, avatar.service);
+			}
+
+			Meteor.call(method, ...params, Template.instance().user._id, function(err) {
 				if (err && err.details) {
 					toastr.error(t(err.message));
 				} else {
diff --git a/server/methods/resetAvatar.js b/server/methods/resetAvatar.js
index 85d8c6b19000..77bea775507a 100644
--- a/server/methods/resetAvatar.js
+++ b/server/methods/resetAvatar.js
@@ -7,7 +7,7 @@ import { Notifications } from '../../app/notifications';
 import { hasPermission } from '../../app/authorization/server';
 
 Meteor.methods({
-	resetAvatar({ userId }) {
+	resetAvatar(userId) {
 		if (!Meteor.userId()) {
 			throw new Meteor.Error('error-invalid-user', 'Invalid user', {
 				method: 'resetAvatar',
@@ -23,7 +23,7 @@ Meteor.methods({
 		let user;
 
 		if (userId && userId !== Meteor.userId()) {
-			if (!hasPermission(userId, 'edit-other-user-avatar')) {
+			if (!hasPermission(Meteor.userId(), 'edit-other-user-avatar')) {
 				throw new Meteor.Error('error-unauthorized', 'Unauthorized', {
 					method: 'resetAvatar',
 				});
diff --git a/server/methods/setAvatarFromService.js b/server/methods/setAvatarFromService.js
index 66e6b4008d5a..c93cd2c2d4a5 100644
--- a/server/methods/setAvatarFromService.js
+++ b/server/methods/setAvatarFromService.js
@@ -28,7 +28,7 @@ Meteor.methods({
 		let user;
 
 		if (userId && userId !== Meteor.userId()) {
-			if (!hasPermission(userId, 'edit-other-user-avatar')) {
+			if (!hasPermission(Meteor.userId(), 'edit-other-user-avatar')) {
 				throw new Meteor.Error('error-unauthorized', 'Unauthorized', {
 					method: 'setAvatarFromService',
 				});