From f97a1153131f8a4a62a603849b128d2b2abe1530 Mon Sep 17 00:00:00 2001
From: Brian Dukes <bdukes@engagesoftware.com>
Date: Fri, 11 Dec 2020 10:08:49 -0600
Subject: [PATCH] Don't check user permissions unless there's a user

Fixes #4355
---
 .../Services/GeneratedImage/ImageHandlerInternal.cs       | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/DNN Platform/Library/Services/GeneratedImage/ImageHandlerInternal.cs b/DNN Platform/Library/Services/GeneratedImage/ImageHandlerInternal.cs
index a529c48b6ce..4ef45821fff 100644
--- a/DNN Platform/Library/Services/GeneratedImage/ImageHandlerInternal.cs	
+++ b/DNN Platform/Library/Services/GeneratedImage/ImageHandlerInternal.cs	
@@ -221,10 +221,10 @@ public void HandleImageRequest(HttpContextBase context, Func<NameValueCollection
 
             string cacheId = this.GetUniqueIDString(context, uniqueIdStringSeed);
 
+            var userId = -1;
             var cacheCleared = false;
-            var profilepic = context.Request.QueryString["mode"];
-            int userId = -1;
-            if ("profilepic".Equals(profilepic, StringComparison.InvariantCultureIgnoreCase))
+            var isProfilePic = "profilepic".Equals(context.Request.QueryString["mode"], StringComparison.InvariantCultureIgnoreCase);
+            if (isProfilePic)
             {
                 if (int.TryParse(context.Request.QueryString["userId"], out userId))
                 {
@@ -260,7 +260,7 @@ public void HandleImageRequest(HttpContextBase context, Func<NameValueCollection
             // Handle Server cache
             if (this.EnableServerCache)
             {
-                if (!this.IsPicVisibleToCurrentUser(userId))
+                if (isProfilePic && !this.IsPicVisibleToCurrentUser(userId))
                 {
                     string message = "Not allowed to see profile picture";