avatar is not part of the profile lock

this is because avatar is not exposed via LDAP anyways. it's purely a personal dashboard thing.
2020-07-10 09:43:39 -07:00
parent 7cfc455cd3
commit 9ee6aa54c6
1 changed files with 1 additions and 1 deletions
@@ -144,7 +144,7 @@ function initializeExpressSync() {
    router.get ('/api/v1/profile',                                       token, routes.profile.get);
    router.post('/api/v1/profile',                                 json, token, routes.profile.authorize, routes.profile.update);
    router.get ('/api/v1/profile/avatar/:identifier',                           routes.profile.getAvatar); // this is not scoped so it can used directly in img tag
-    router.post('/api/v1/profile/avatar',                          json, token, routes.profile.authorize, multipart, routes.profile.setAvatar);
+    router.post('/api/v1/profile/avatar',                          json, token, multipart, routes.profile.setAvatar); // avatar is not exposed in LDAP. so it's personal and not locked
    router.del ('/api/v1/profile/avatar',                                token, routes.profile.clearAvatar);
    router.post('/api/v1/profile/password',                        json, token, routes.users.verifyPassword, routes.profile.changePassword);
    router.post('/api/v1/profile/twofactorauthentication',         json, token, routes.profile.setTwoFactorAuthenticationSecret);