Additional avatar REST checks

[dkotter]

Description of the Change

Users with access to the user REST endpoint can use that to set their avatar. Additional checks were added in the last release but a few other areas of concern came up:

1. We allow any valid attachment ID to be set, including things like PDFs or videos. We change that here to ensure the attachment ID is associated with an image only
2. Any valid attachment ID can be used, even if that ID wasn't an image uploaded by the user. We change that here to only proceed if the attachment ID they are using is an attachment associated with their account. This means any images uploaded by another user aren't allowed to be used

Note

While these changes make things more secure, this could be seen as a breaking change if someone is used to a workflow where one user uploads images and other users then set those images as their avatar via a REST request. I can't imagine that's common (if anyone is doing that at all) but worth flagging

How to test the Change

Make authenticated requests to the user endpoint, passing in the proper data and ensuring the avatar gets set correctly and rejected correctly. For instance, try passing in an attachment ID that doesn't exit, that does exist but isn't an image, that is an image that your user uploaded, that is an image that a different user uploaded. Ping me for full details if needed.

Changelog Entry

Changed - Only allow images that were uploaded by the same user be used when setting the avatar via a REST request
Fixed - Only allow image files to be set as the avatar in REST requests

Credits

Props @dkotter, @justus12337

Checklist:

• I agree to follow this project's Code of Conduct.
• I have updated the documentation accordingly.
• I have added Critical Flows, Test Cases, and/or End-to-End Tests to cover my change.
• All new and existing tests pass.

[faisal-alvi]

Tests well ✅

Passing in an attachment ID that doesn't exists

---

That does exist but isn't an image (PDF)

---

That is an image that your user uploaded

---

That is an image that a different user uploaded