Kirby
04-13-2007, 07:53 AM
Description
The Welcome Block shows the users avatar even if he does not have permission
Steps to reproduce
1) Setup a User that has a usergroup that allows custom avatars and make sure that Keep Custom Avatar in user manager is set to No
2) Upload an avatar for this user
3) Check the welcome module - avatar is being shown
4) Change usergroup permissiosn for this user so he does not have permission to use custom avatars
5) Check the welcome module - avatar is still being shown
Fix
Needs to check Bitfield genericpermissions & canuseavatar and userinfo[adminavatar]
To avoid queries, this should be done before calling fetch_avatar_url()
The Welcome Block shows the users avatar even if he does not have permission
Steps to reproduce
1) Setup a User that has a usergroup that allows custom avatars and make sure that Keep Custom Avatar in user manager is set to No
2) Upload an avatar for this user
3) Check the welcome module - avatar is being shown
4) Change usergroup permissiosn for this user so he does not have permission to use custom avatars
5) Check the welcome module - avatar is still being shown
Fix
Needs to check Bitfield genericpermissions & canuseavatar and userinfo[adminavatar]
To avoid queries, this should be done before calling fetch_avatar_url()