Chatwoot/app/models/concerns/avatarable.rb
Sojan Jose 6fdd4a2996
chore: Security Improvements to the API (#2893)
- Devise auth tokens are reset on password update
- Avatar attachment file type is limited to jpeg,gif and png
- Avatar attachment file size is limited to 15 mb
- Widget Message attachments are limited to types ['image/png', 'image/jpeg', 'image/gif', 'image/bmp', 'image/tiff', 'application/pdf', 'audio/mpeg', 'video/mp4', 'audio/ogg', 'text/csv']
- Widget Message attachments are limited to 40Mb size limit.
2021-09-01 15:08:05 +05:30

31 lines
842 B
Ruby

# frozen_string_literal: true
module Avatarable
extend ActiveSupport::Concern
include Rails.application.routes.url_helpers
included do
has_one_attached :avatar
validate :acceptable_avatar
end
def avatar_url
return url_for(avatar.representation(resize: '250x250')) if avatar.attached? && avatar.representable?
if [User, Contact].include?(self.class) && email.present?
hash = Digest::MD5.hexdigest(email)
return "https://www.gravatar.com/avatar/#{hash}?d=404"
end
''
end
def acceptable_avatar
return unless avatar.attached?
errors.add(:avatar, 'is too big') if avatar.byte_size > 15.megabytes
acceptable_types = ['image/jpeg', 'image/png', 'image/gif'].freeze
errors.add(:avatar, 'filetype not supported') unless acceptable_types.include?(avatar.content_type)
end
end