Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[IMPROVE] Add permission to change other user profile avatar #13884

Merged
merged 8 commits into from
Apr 6, 2019
Merged

[IMPROVE] Add permission to change other user profile avatar #13884

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
5007eed
Fixes #12312
knrt10 Mar 24, 2019
7375cff
Add privilage for admin to update as much profile images as they want
knrt10 Mar 24, 2019
8be8788
Added API fix too
knrt10 Mar 25, 2019
49b0d98
Merge branch 'develop' into issue12312
marceloschmidt Apr 6, 2019
10b3e83
Check for permissions
rodrigok Apr 6, 2019
a315eae
Check permission in rest endpoint
rodrigok Apr 6, 2019
6c1f2c1
Handle pass own id to avatar set methods
rodrigok Apr 6, 2019
867a7ea
Code improvements
rodrigok Apr 6, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 8 additions & 6 deletions app/api/server/v1/users.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -256,12 +256,6 @@ API.v1.addRoute('users.setAvatar', { authRequired: true }, {
username: Match.Maybe(String),
}));

if (!settings.get('Accounts_AllowUserAvatarChange')) {
throw new Meteor.Error('error-not-allowed', 'Change avatar is not allowed', {
method: 'users.setAvatar',
});
}

let user;
if (this.isUserFromParams()) {
user = Meteor.users.findOne(this.userId);
Expand All @@ -271,6 +265,14 @@ API.v1.addRoute('users.setAvatar', { authRequired: true }, {
return API.v1.unauthorized();
}

if (!user.roles.includes('admin')) {
if (!settings.get('Accounts_AllowUserAvatarChange')) {
throw new Meteor.Error('error-not-allowed', 'Change avatar is not allowed', {
method: 'users.setAvatar',
});
}
}

Meteor.runAsUser(user._id, () => {
if (this.bodyParams.avatarUrl) {
setUserAvatar(user, this.bodyParams.avatarUrl, '', 'url');
Expand Down
85 changes: 66 additions & 19 deletions app/ui-flextab/client/tabs/userEdit.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,25 +3,72 @@
<p class="secondary-font-color">{{_ "You_are_not_authorized_to_view_this_page"}}</p>
{{else}}
<form class="" action="index.html" method="post" autocomplete="off">
<div class="rc-input rc-form-group rc-form-group--small">
<label class="rc-input__label">
<div class="rc-input__title">{{_ "Name"}}</div>
<div class="rc-input__wrapper">
<input name="name" type="text" class="rc-input__element rc-input__element--small" id="name" autocomplete="off" value="{{user.name}}"/>
</div>
</label>
</div>
<div class="rc-input rc-form-group rc-form-group--small">
<label class="rc-input__label">
<div class="rc-input__title">{{_ "Username"}}</div>
<div class="rc-input__wrapper">
<div class="rc-input__icon">
{{> icon icon='at' }}
</div>
<input name="name" type="text" class="rc-input__element rc-input__element--small" id="username" autocomplete="off" value="{{user.username}}"/>
</div>
</label>
</div>
<div class="rc-form-group rc-form-group--small">
<label class="rc-form-label">
{{_ "Profile_picture"}}
</label>
<div class="rc-select-avatar">
<div class="rc-select-avatar__preview">
{{# unless avatarPreview}}
{{> avatar username=user.username}}
{{else}}
{{> avatar url=avatarPreview.blob}}
{{/unless}}
</div>

<div class="rc-select-avatar__list">
<div class="rc-select-avatar__list-item rc-tooltip js-select-avatar-initials" aria-label="{{_ "initials_avatar" }}">
{{> avatar username=initialsUsername }}
</div>
<div class="rc-select-avatar__list-item rc-tooltip js-select-avatar-upload" aria-label="{{_ "Upload_user_avatar" }}">
<label class="rc-select-avatar__upload-label avatar" for="upload-avatar">
{{> icon block="rc-select-avatar__upload-icon" icon="upload"}}
</label>
<input type="file" name="" value="" id="upload-avatar" style="display:none;" accept="image/x-png,image/gif,image/jpeg">
</div>
<div class="rc-select-avatar__list-item rc-tooltip js-select-avatar-url {{selectUrl}}" aria-label="{{_ "Use_url_for_avatar" }}">
<label class="rc-select-avatar__upload-label avatar">
{{> icon block="rc-select-avatar__upload-icon" icon="permalink"}}
</label>
</div>

<div class="rc-input">

<label class="rc-input__label">
<div class="rc-input__title">
{{_ "Use_url_for_avatar"}}
</div>
<div class="rc-input__wrapper">
<input name="avatar_url" class="rc-input__element js-avatar-url-input" placeholder="{{_ "Use_url_for_avatar"}}">
</div>
</label>
</div>
</div>
</div>
</div>
<div class="rc-input rc-form-group rc-form-group--small">
<label class="rc-input__label">
<div class="rc-input__title">
{{_ "Name"}}
</div>
<div class="rc-input__wrapper">
<input name="name" type="text" class="rc-input__element rc-input__element--small" id="name" autocomplete="off" value="{{user.name}}"/>
</div>
</label>
</div>
<div class="rc-input rc-form-group rc-form-group--small">
<label class="rc-input__label">
<div class="rc-input__title">
{{_ "Username"}}
</div>
<div class="rc-input__wrapper">
<div class="rc-input__icon">
{{> icon icon='at' }}
</div>
<input name="name" type="text" class="rc-input__element rc-input__element--small" id="username" autocomplete="off" value="{{user.username}}"/>
</div>
</label>
</div>
<div class="rc-form-group rc-form-group--small">
<div class="rc-input">
<label class="rc-input__label">
Expand Down
98 changes: 96 additions & 2 deletions app/ui-flextab/client/tabs/userEdit.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,10 +5,22 @@ import { Template } from 'meteor/templating';
import { TAPi18n } from 'meteor/tap:i18n';
import { t, handleError } from '../../../utils';
import { Roles } from '../../../models';
import { Notifications } from '../../../notifications';
import { hasAtLeastOnePermission } from '../../../authorization';
import toastr from 'toastr';
import { callbacks } from '../../../callbacks';
import s from 'underscore.string';

const setAvatar = function(event, template) {
const { blob, contentType, service } = this.suggestion;

template.avatar.set({
service,
contentType,
blob,
});
};

Template.userEdit.helpers({

disabled(cursor) {
Expand All @@ -18,10 +30,23 @@ Template.userEdit.helpers({
return (Template.instance().user && hasAtLeastOnePermission('edit-other-user-info')) || (!Template.instance().user && hasAtLeastOnePermission('create-user'));
},

selectUrl() {
return Template.instance().url.get().trim() ? '' : 'disabled';
},

user() {
return Template.instance().user;
},

initialsUsername() {
const { user } = Template.instance();
return `@${ user && user.username }`;
},

avatarPreview() {
return Template.instance().avatar.get();
},

requirePasswordChange() {
return !Template.instance().user || Template.instance().user.requirePasswordChange;
},
Expand All @@ -41,6 +66,56 @@ Template.userEdit.helpers({
});

Template.userEdit.events({
'click .js-select-avatar-initials'() {
Meteor.call('resetAvatarAdmin', Template.instance().user, function(err) {
if (err && err.details) {
toastr.error(t(err.message));
} else {
toastr.success(t('Avatar_changed_successfully'));
callbacks.run('userAvatarSet', 'initials');
}
});
},
'click .js-select-avatar-url'(e, instance, ...args) {
const url = instance.url.get().trim();
if (!url) {
return;
}
setAvatar.apply({
suggestion: {
service: 'url',
blob: url,
contentType: '',
},
}, [e, instance, ...args]);
},
'input .js-avatar-url-input'(e, instance) {
const text = e.target.value;
instance.url.set(text);
},
'change .js-select-avatar-upload [type=file]'(event, template) {
const e = event.originalEvent || event;
let { files } = e.target;
if (!files || files.length === 0) {
files = (e.dataTransfer && e.dataTransfer.files) || [];
}
Object.keys(files).forEach((key) => {
const blob = files[key];
if (!/image\/.+/.test(blob.type)) {
return;
}
const reader = new FileReader();
reader.readAsDataURL(blob);
reader.onloadend = function() {
template.avatar.set({
service: 'upload',
contentType: blob.type,
blob: reader.result,
});
callbacks.run('userAvatarSet', 'upload');
};
});
},
'click .cancel'(e, t) {
e.stopPropagation();
e.preventDefault();
Expand Down Expand Up @@ -98,7 +173,9 @@ Template.userEdit.events({
Template.userEdit.onCreated(function() {
this.user = this.data != null ? this.data.user : undefined;
this.roles = this.user ? new ReactiveVar(this.user.roles) : new ReactiveVar([]);

this.avatar = new ReactiveVar;
this.url = new ReactiveVar('');
Notifications.onLogged('updateAvatar', () => this.avatar.set());

const { tabBar } = Template.currentData();

Expand Down Expand Up @@ -162,7 +239,7 @@ Template.userEdit.onCreated(function() {
return;
}
const userData = this.getUserData();

const avatar = this.avatar.get();
if (this.user != null) {
for (const key in userData) {
if (key) {
Expand All @@ -176,6 +253,23 @@ Template.userEdit.onCreated(function() {
}
}

if (avatar) {
const params = [avatar.blob];

params.push(avatar.contentType);

params.push(avatar.service);
params.push(Template.instance().user);
Meteor.call('setAvatarFromServiceAdmin', ...params, function(err) {
if (err && err.details) {
toastr.error(t(err.message));
} else {
toastr.success(t('Avatar_changed_successfully'));
callbacks.run('userAvatarSet', avatar.service);
}
});
}

Meteor.call('insertOrUpdateUser', userData, (error) => {
if (error) {
return handleError(error);
Expand Down
19 changes: 19 additions & 0 deletions server/methods/resetAvatar.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,25 @@ Meteor.methods({
username: user.username,
});
},
resetAvatarAdmin(args) {
if (!args) {
throw new Meteor.Error('error-invalid-user', 'Invalid user', {
method: 'resetAvatarAdmin',
});
}

if (!settings.get('Accounts_AllowUserAvatarChange')) {
throw new Meteor.Error('error-not-allowed', 'Not allowed', {
method: 'resetAvatarAdmin',
});
}

FileUpload.getStore('Avatars').deleteByName(args.username);
Copy link
Member

@sampaiodiego sampaiodiego Apr 6, 2019 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looks like there are no tests to ensure the caller has the right permissions to allow resetting someone else avatar.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

let me update it.

Users.unsetAvatarOrigin(args._id);
Notifications.notifyLogged('updateAvatar', {
username: args.username,
});
},
});

DDPRateLimiter.addRule({
Expand Down
20 changes: 20 additions & 0 deletions server/methods/setAvatarFromService.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,26 @@ Meteor.methods({

return setUserAvatar(user, dataURI, contentType, service);
},
setAvatarFromServiceAdmin(dataURI, contentType, service, userData) {
check(dataURI, String);
check(contentType, Match.Optional(String));
check(service, Match.Optional(String));
check(userData, Match.Optional(Object));

if (!userData) {
throw new Meteor.Error('error-invalid-user', 'Invalid user', {
method: 'setAvatarFromServiceAdmin',
});
}

if (!settings.get('Accounts_AllowUserAvatarChange')) {
throw new Meteor.Error('error-not-allowed', 'Not allowed', {
method: 'setAvatarFromServiceAdmin',
});
}

return setUserAvatar(userData, dataURI, contentType, service);
},
});

DDPRateLimiter.addRule({
Expand Down