Maintenance: Improved the avatar creation in the user controller.

app/controllers/users_controller.rb

@@ -771,19 +771,24 @@ curl http://localhost/api/v1/users/avatar -v -u #{login}:#{password} -H "Content
     begin
       file_full = StaticAssets.data_url_attributes(params[:avatar_full])
     rescue
-      render json: { error: __('Full-size image is invalid') }, status: :unprocessable_entity
+      render json: { error: __('The full-size image is invalid.') }, status: :unprocessable_entity
       return
     end
 
     if ActiveStorage::Variant::WEB_IMAGE_CONTENT_TYPES.exclude?(file_full[:mime_type])
-      render json: { error: __('MIME type is invalid') }, status: :unprocessable_entity
+      render json: { error: __('The MIME type of the full-size image is invalid.') }, status: :unprocessable_entity
       return
     end
 
     begin
       file_resize = StaticAssets.data_url_attributes(params[:avatar_resize])
     rescue
-      render json: { error: __('Resized image is invalid') }, status: :unprocessable_entity
+      render json: { error: __('The resized image is invalid.') }, status: :unprocessable_entity
+      return
+    end
+
+    if ActiveStorage::Variant::WEB_IMAGE_CONTENT_TYPES.exclude?(file_resize[:mime_type])
+      render json: { error: __('The MIME type of the resized image is invalid.') }, status: :unprocessable_entity
       return
     end
 

i18n/zammad.pot

@@ -4149,10 +4149,6 @@ msgstr ""
 msgid "Full Name"
 msgstr ""
 
-#: app/controllers/users_controller.rb
-msgid "Full-size image is invalid"
-msgstr ""
-
 #: db/seeds/settings.rb
 msgid "Fully Qualified Domain Name"
 msgstr ""
@@ -5546,10 +5542,6 @@ msgstr ""
 msgid "Lost network connection!"
 msgstr ""
 
-#: app/controllers/users_controller.rb
-msgid "MIME type is invalid"
-msgstr ""
-
 #: app/assets/javascripts/app/controllers/macro.coffee
 msgid "Macro"
 msgstr ""
@@ -7596,10 +7588,6 @@ msgstr ""
 msgid "Reseting changes…"
 msgstr ""
 
-#: app/controllers/users_controller.rb
-msgid "Resized image is invalid"
-msgstr ""
-
 #: app/assets/javascripts/app/views/widget/http_log_show.jst.eco
 msgid "Response"
 msgstr ""
@@ -8785,6 +8773,14 @@ msgstr ""
 msgid "Thanks for joining. Email sent to \"%s\"."
 msgstr ""
 
+#: app/controllers/users_controller.rb
+msgid "The MIME type of the full-size image is invalid."
+msgstr ""
+
+#: app/controllers/users_controller.rb
+msgid "The MIME type of the resized image is invalid."
+msgstr ""
+
 #: app/assets/javascripts/app/views/getting_started/base.jst.eco
 msgid "The URL to this installation of Zammad."
 msgstr ""
@@ -8845,6 +8841,10 @@ msgstr ""
 msgid "The format of the subject."
 msgstr ""
 
+#: app/controllers/users_controller.rb
+msgid "The full-size image is invalid."
+msgstr ""
+
 #: db/seeds/settings.rb
 msgid "The identifier for a ticket, e.g. Ticket#, Call#, MyTicket#. The default is Ticket#."
 msgstr ""
@@ -8873,6 +8873,10 @@ msgstr ""
 msgid "The page you were looking for does not exist."
 msgstr ""
 
+#: app/controllers/users_controller.rb
+msgid "The resized image is invalid."
+msgstr ""
+
 #: app/assets/javascripts/app/views/generic/object_import/import_try.jst.eco
 msgid "The test run was successful."
 msgstr ""

spec/requests/user_spec.rb

@@ -1505,12 +1505,12 @@ RSpec.describe 'User', type: :request do
 
     it 'returns verbose error when full image is missing' do
       make_request(avatar_full: '')
-      expect(json_response).to include('error' => match(%r{Full}).and(match(%r{is invalid})))
+      expect(json_response).to include('error' => match(%r{full}).and(match(%r{is invalid})))
     end
 
     it 'returns verbose error when resized image is missing' do
       make_request(avatar_full: base64)
-      expect(json_response).to include('error' => match(%r{Resized}).and(match(%r{is invalid})))
+      expect(json_response).to include('error' => match(%r{resized}).and(match(%r{is invalid})))
     end
 
     it 'successfully changes avatar' do
@@ -1523,7 +1523,16 @@ RSpec.describe 'User', type: :request do
 
       it 'returns verbose error for a not allowed mime-type' do
         make_request(avatar_full: base64)
-        expect(json_response).to include('error' => 'MIME type is invalid')
+        expect(json_response).to include('error' => 'The MIME type of the full-size image is invalid.')
+      end
+    end
+
+    context 'with a not allowed resized image mime-type' do
+      let(:resized_base64) { 'data:image/svg+xml;base64,iVBORw0KGgoAAAANSUhEUgAAAAUAAAAFCAYAAACNbyblAAAAHElEQVQI12P4//8/w38GIAXDIBKE0DHxgljNBAAO9TXL0Y4OHwAAAABJRU5ErkJggg==' }
+
+      it 'returns verbose error for a not allowed mime-type' do
+        make_request(avatar_full: base64, avatar_resize: resized_base64)
+        expect(json_response).to include('error' => 'The MIME type of the resized image is invalid.')
       end
     end
   end