FIX: enforce 'allow_uploaded_avatars' & 'sso_overrides_avatar' server-side

app/controllers/uploads_controller.rb

@@ -12,6 +12,12 @@ class UploadsController < ApplicationController
     # HACK FOR IE9 to prevent the "download dialog"
     response.headers["Content-Type"] = "text/plain" if request.user_agent =~ /MSIE 9/
 
+    if type == "avatar"
+      if SiteSetting.sso_overrides_avatar || !SiteSetting.allow_uploaded_avatars
+        return render json: failed_json, status: 422
+      end
+    end
+
     if synchronous
       data = create_upload(type, file, url)
       render json: data.as_json

app/controllers/users_controller.rb

@@ -547,6 +547,16 @@ class UsersController < ApplicationController
     type = params[:type]
     upload_id = params[:upload_id]
 
+    if SiteSetting.sso_overrides_avatar
+      return render json: failed_json, status: 422
+    end
+
+    if !SiteSetting.allow_uploaded_avatars
+      if type == "uploaded" || type == "custom"
+        return render json: failed_json, status: 422
+      end
+    end
+
     user.uploaded_avatar_id = upload_id
 
     if AVATAR_TYPES_WITH_UPLOAD.include?(type)

spec/controllers/uploads_controller_spec.rb

@@ -106,6 +106,18 @@ describe UploadsController do
         expect(message.data["errors"]).to be
       end
 
+      it 'ensures allow_uploaded_avatars is enabled when uploading an avatar' do
+        SiteSetting.stubs(:allow_uploaded_avatars).returns(false)
+        xhr :post, :create, file: logo, type: "avatar"
+        expect(response).to_not be_success
+      end
+
+      it 'ensures sso_overrides_avatar is not enabled when uploading an avatar' do
+        SiteSetting.stubs(:sso_overrides_avatar).returns(true)
+        xhr :post, :create, file: logo, type: "avatar"
+        expect(response).to_not be_success
+      end
+
     end
 
   end

spec/controllers/users_controller_spec.rb

@@ -1363,6 +1363,18 @@ describe UsersController do
         expect(response).to be_forbidden
       end
 
+      it "raises an error when sso_overrides_avatar is disabled" do
+        SiteSetting.stubs(:sso_overrides_avatar).returns(true)
+        xhr :put, :pick_avatar, username: user.username, upload_id: upload.id, type: "custom"
+        expect(response).to_not be_success
+      end
+
+      it "raises an error when selecting the custom/uploaded avatar and allow_uploaded_avatars is disabled" do
+        SiteSetting.stubs(:allow_uploaded_avatars).returns(false)
+        xhr :put, :pick_avatar, username: user.username, upload_id: upload.id, type: "custom"
+        expect(response).to_not be_success
+      end
+
       it 'can successfully pick the system avatar' do
         xhr :put, :pick_avatar, username: user.username
         expect(response).to be_success