Honor avatar visibility settings

[rullzer]

Fixes #5456
Only when an avatar is set to public should we show it to the public.
For now this has an open question as to how to solve federated avatars.
But I assume a dedicated paramter or endpooint would make sense there.

Todo:

• Fix tests (most likely)
• Think about federated avatars

[rullzer]

For federated avatars we need a new endpoint anyways to verify their token etc. Lets leave that till later.

[rullzer]

To test. Set your avatar level in the personal settings.
And request the avatar. Depending how it is set you should see it or get a 404.

[skjnldsv]

Works!

[ChristophWurst]

Code looks good!

[rullzer]

@nickvergessen you first wanted to test something right?

[nickvergessen]

The Contacts level does not work. Should we just remove it? Since we don't send any referrers, we can not know if the image was requested by a remote instance in the allowed space. Or are avatars uploaded to the lookup server?

[skjnldsv]

I have no clue what that means Joas!
I'll follow you to what you think is best

[rullzer]

The Contacts level does not work. Should we just remove it? Since we don't send any referrers, we can not know if the image was requested by a remote instance in the allowed space. Or are avatars uploaded to the lookup server?

We should fix it. I'd leave it for now. And see if we can come up with and endpoint to request remote avatars where you send your share token for example.

[nickvergessen]

Okay, then lets merge

[tobiasKaminsky]

Damn, I saw this too late.
@rullzer this will break our clients as they assume that we get an image back.
Returning something else was previously also the case (then you got the userId back).

Can we adjust this to show the generic colored round avatar with first char in it?

[rullzer]

@tobiasKaminsky no it won't. As long as you send your credentials you should get back the image.

[tobiasKaminsky]

Clients also use https:///nextcloud/index.php/avatar/USER/ this to get avatars from other users (on the same instance [currently no federation]) when we do a search, or show it in file list if file was shared by an user.

[rullzer]

Clients also use https:///nextcloud/index.php/avatar/USER/ this to get avatars from other users (on the same instance [currently no federation]) when we do a search, or show it in file list if file was shared by an user.

yes I know. But read the code.

https://github.com/nextcloud/server/pull/17715/files#diff-17d17c6a954f29c12717db921f235531R134-R137

If the avatar is not public. And you do an anonymous request we return the 404.
So as long as you authenticated request your avatars all is fine.

[tobiasKaminsky]

True, stupid from me, I read only have of the code :-(
Sorry for the noise