Fix setting profile image for other users (#7306)

2 files changed, 10 insertions, 1 deletions

diff --git a/api4/user.go b/api4/user.go
index f755270cf..2f1c72957 100644
--- a/api4/user.go
+++ b/api4/user.go
@@ -267,7 +267,7 @@ func setProfileImage(c *Context, w http.ResponseWriter, r *http.Request) {
 
 	imageData := imageArray[0]
 
-	if err := app.SetProfileImage(c.Session.UserId, imageData); err != nil {
+	if err := app.SetProfileImage(c.Params.UserId, imageData); err != nil {
 		c.Err = err
 		return
 	}
diff --git a/api4/user_test.go b/api4/user_test.go
index e353ad7b1..b80053f9f 100644
--- a/api4/user_test.go
+++ b/api4/user_test.go
@@ -14,6 +14,8 @@ import (
 	"github.com/mattermost/platform/app"
 	"github.com/mattermost/platform/model"
 	"github.com/mattermost/platform/utils"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestCreateUser(t *testing.T) {
@@ -2040,9 +2042,16 @@ func TestSetProfileImage(t *testing.T) {
 		t.Fatal("Should have failed either forbidden or unauthorized")
 	}
 
+	buser, err := app.GetUser(user.Id)
+	require.Nil(t, err)
+
 	_, resp = th.SystemAdminClient.SetProfileImage(user.Id, data)
 	CheckNoError(t, resp)
 
+	ruser, err := app.GetUser(user.Id)
+	require.Nil(t, err)
+	assert.True(t, buser.LastPictureUpdate < ruser.LastPictureUpdate, "Picture should have updated for user")
+
 	info := &model.FileInfo{Path: "users/" + user.Id + "/profile.png"}
 	if err := cleanupTestFile(info); err != nil {
 		t.Fatal(err)