diff options
Diffstat (limited to 'api/user.go')
| -rw-r--r-- | api/user.go | 18 |
1 files changed, 18 insertions, 0 deletions
diff --git a/api/user.go b/api/user.go index 06e5336f1..c9958767f 100644 --- a/api/user.go +++ b/api/user.go @@ -652,6 +652,12 @@ func getProfiles(c *Context, w http.ResponseWriter, r *http.Request) { for k, p := range profiles { options := utils.SanitizeOptions options["passwordupdate"] = false + + if c.HasSystemAdminPermissions("getProfiles") { + options["fullname"] = true + options["email"] = true + } + p.Sanitize(options) profiles[k] = p } @@ -855,6 +861,18 @@ func uploadProfileImage(c *Context, w http.ResponseWriter, r *http.Request) { return } + // Decode image config first to check dimensions before loading the whole thing into memory later on + config, _, err := image.DecodeConfig(file) + if err != nil { + c.Err = model.NewAppError("uploadProfileFile", "Could not decode profile image config.", err.Error()) + return + } else if config.Width*config.Height > MaxImageSize { + c.Err = model.NewAppError("uploadProfileFile", "Unable to upload profile image. File is too large.", err.Error()) + return + } + + file.Seek(0, 0) + // Decode image into Image object img, _, err := image.Decode(file) if err != nil { |