github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-01-19 11:12:46 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

SECURITY: do not delete avatars uploads when deleting accounts

Browse Source 
We rely on the clean up uploads job to do this safely
This commit is contained in:
Sam 2018-12-13 16:32:35 +11:00
parent 1b34a8b48a
commit d535e1ce6d
1 changed files with 2 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
app/models/user_avatar.rb
View File

@ -3,8 +3,8 @@ require_dependency 'upload_creator'
class UserAvatar < ActiveRecord::Base
belongs_to :user
belongs_to :gravatar_upload, class_name: 'Upload', dependent: :destroy
belongs_to :custom_upload, class_name: 'Upload', dependent: :destroy
belongs_to :gravatar_upload, class_name: 'Upload'
belongs_to :custom_upload, class_name: 'Upload'
def contains_upload?(id)
gravatar_upload_id == id || custom_upload_id == id
@ -50,7 +50,6 @@ class UserAvatar < ActiveRecord::Base
user.update!(uploaded_avatar_id: upload_id)
end
gravatar_upload&.destroy!
self.gravatar_upload = upload
save!
end