profile: avatar cannot be changed when profile locked

admins can now upload user avatars
2025-07-02 13:03:15 +02:00
parent aa35099a4d
commit 3bd41013c0
2 changed files with 2 additions and 2 deletions
@@ -178,7 +178,7 @@ async function initializeExpressSync() {
    router.post('/api/v1/profile/fallback_email',                  json, token, authorizeUser, routes.profile.canEditProfile, routes.users.verifyPassword, routes.profile.setFallbackEmail);
    router.post('/api/v1/profile/language',                        json, token, authorizeUser, routes.profile.setLanguage);
    router.get ('/api/v1/profile/avatar/:identifier',                                          routes.profile.getAvatarById); // this is not scoped so it can used directly in img tag
-    router.post('/api/v1/profile/avatar',                                token, authorizeUser, multipart, routes.profile.setAvatar); // avatar is not exposed in LDAP. so it's personal and not locked
+    router.post('/api/v1/profile/avatar',                                token, authorizeUser, routes.profile.canEditProfile, multipart, routes.profile.setAvatar); // avatar is not exposed in LDAP. so it's personal and not locked
    router.get ('/api/v1/profile/background_image',                      token, authorizeUser, routes.profile.getBackgroundImage);
    router.post('/api/v1/profile/background_image',                      token, authorizeUser, multipart, routes.profile.setBackgroundImage); // backgroundImage is not exposed in LDAP. so it's personal and not locked
    router.del ('/api/v1/profile/background_image',                      token, authorizeUser,            routes.profile.unsetBackgroundImage); // backgroundImage is not exposed in LDAP. so it's personal and not locked