search

instructure / canvas-lms

The open LMS by Instructure, Inc.
https://github.com/instructure/canvas-lms/wiki
GNU Affero General Public License v3.0
5.52k stars 2.45k forks source link

Setting avatar_state via API resets user's avatar to default avatar #2078

Open dc74089 opened 2 years ago

dc74089 commented 2 years ago

Summary:

When using the API to set a user's avatar_state to locked or approved, the user's avatar is reset to the default avatar.

Steps to reproduce:

Acting on a user with an avatar already set:

  1. As an account admin, PUT https://{domain}.instructure.com/api/v1/users/{user_id}/?user[avatar][state]=locked
  2. Observe that the user's profile picture is now missing on the Canvas website.
  3. Observe that the URL returned when accessing GET https://{domain}.instructure.com/api/v1/users/{user_id}/ is the default avatar URL, in our case https://{domain}.instructure.com/images/messages/avatar-50.png.

Expected behavior:

The current profile picture is kept in place, and the user is prevented from changing it.

Actual behavior:

The current profile picture is changed to the default profile picture, and is locked to the default profile picture.

Additional notes: