PR feedback

Author: jlchilders11

core/validators.py

@@ -46,5 +46,8 @@ def __call__(self, value):
 # 1 MB max file size
 max_file_size_validator = MaxFileSizeValidator(max_size=1 * 1024 * 1024)
 
+# 5 MB max file size, for downscalable images
+downscale_image_file_size_validator = MaxFileSizeValidator(max_size=5 * 1024 * 1024)
+
 # 50 MB allowed for certain large files - to be used on staff-only fields
 large_file_max_size_validator = MaxFileSizeValidator(max_size=50 * 1024 * 1024)

templates/v3/user_profile_edit.html

@@ -523,8 +523,10 @@
             avatar = null;
           }
 
-          if(avatarInput.files.length > 0) formData.append('profile_image', avatarInput.files[0])
-          else if(avatarInputNew.files.length > 0) formData.append('profile_image', avatarInputNew.files[0])
+          if(!avatarDelete.checked) {
+            if(avatarInput.files.length > 0) formData.append('profile_image', avatarInput.files[0])
+            else if(avatarInputNew.files.length > 0) formData.append('profile_image', avatarInputNew.files[0])
+          }
           formData.append('delete_profile_image', avatarDelete.checked)
 
           this.saving = true;

users/forms.py

@@ -8,6 +8,7 @@
 from allauth.account.forms import ResetPasswordKeyForm, SignupForm
 
 from .models import Preferences
+from core.validators import max_file_size_validator
 from news.models import NEWS_MODELS
 from news.acl import can_approve
 
@@ -131,7 +132,11 @@ class CustomClearableFileInput(forms.ClearableFileInput):
 
 
 class UserProfilePhotoForm(forms.ModelForm):
-    profile_image = forms.FileField(widget=CustomClearableFileInput, required=False)
+    profile_image = forms.FileField(
+        widget=CustomClearableFileInput,
+        required=False,
+        validators=[max_file_size_validator],
+    )
 
     class Meta:
         model = User

users/models.py

@@ -22,7 +22,6 @@
 
 from core.validators import (
     image_validator,
-    max_file_size_validator,
     large_file_max_size_validator,
 )
 from core.templatetags.custom_static import large_static
@@ -209,7 +208,7 @@ class User(BaseUser):
         upload_to="profile-images",
         null=True,
         blank=True,
-        validators=[image_validator, max_file_size_validator],
+        validators=[image_validator],
     )
     image_thumbnail = ImageSpecField(
         source="profile_image",

users/serializers.py

@@ -1,8 +1,14 @@
 import re
+import os
+import uuid
 from urllib.parse import urlparse
 
+from django.conf import settings
 from rest_framework import serializers
 
+from core.validators import downscale_image_file_size_validator
+from news.utils import downsize_uploaded_image
+
 from .forms import SLACK_PROFILE_URL_PREFIX, V3ProfileLinkChoices
 from .models import User
 
@@ -56,6 +62,9 @@ class CurrentUserSerializer(serializers.ModelSerializer):
     """
     User serializer for the currently logged in user
     """
+    profile_image = serializers.ImageField(
+        validators=[downscale_image_file_size_validator]
+    )
 
     def validate_profile_links(self, value):
         if not isinstance(value, dict):
@@ -85,6 +94,23 @@ def validate_profile_links(self, value):
             raise serializers.ValidationError(field_errors)
         return value
 
+    def validate_profile_image(self, value):
+        file_name = value.name
+        root, ext = os.path.splitext(file_name)
+        value.name = str(uuid.uuid4()) + ext
+        if value.size > settings.DOWNSCALE_IMAGE_THRESHOLD:
+            return downsize_uploaded_image(value)
+        return value
+
+    def validate(self, data):
+        user = self.instance
+        if not user.can_update_image and "profile_image" in data:
+            raise serializers.ValidationError(
+                "You do not have permission to update your profile photo."
+            )
+
+        return super().validate(data)
+
     class Meta:
         model = User
         fields = (

users/views.py

@@ -79,7 +79,7 @@ class CurrentUserAPIView(generics.RetrieveUpdateAPIView):
     serializer_class = CurrentUserSerializer
     permission_classes = [IsAuthenticated]
 
-    def perform_update(self, serializer):
+    def perform_update(self, serializer: CurrentUserSerializer):
         instance = serializer.save()
         if self.request.POST.get("delete_profile_image", "").lower() == "true":
             instance.profile_image.delete()
@@ -549,9 +549,7 @@ def update_profile(self, form, request):
                 messages.error(request, f"{error}")
 
     def dispatch(self, request, *args, **kwargs):
-        if request.GET.get("edit", "").lower() == "true" and isinstance(
-            request.user, AnonymousUser
-        ):
+        if isinstance(request.user, AnonymousUser):
             return HttpResponseRedirect(reverse_lazy("account_login"))
         return super().dispatch(request, *args, **kwargs)