Log in as administrator (user role who may edit other user's profiles), e.g. UID 1
Then do the following:
- Edit another user's profile: upload a new picture
- Now the picture is uploaded as picture-1.png, that is, using my UID rather than the edited user's UID.

The fix is rather simple, at least this seems to work for me:
In resizer.module, function resizer_submit_user_picture, replace $user by $account.

The patched function (original lines commented out):


function resizer_submit_user_picture($edit, $account, $form, $step) {
	global $form_values;
	switch($step) {
		case 2:
//			global $user;
			
			list($width, $height) = explode('x', variable_get('user_picture_dimensions', '85x85'));
			
			$path = $_SERVER['DOCUMENT_ROOT'].base_path().file_directory_temp();
			
			$oldImage = $_POST['tmp_picture_name'];			
			list($filename,$extension) = explode('.',$oldImage);
			
			$newImage = createThumbnail($oldImage,$path,"-thumb",$extension,$_REQUEST['x1'],$_REQUEST['y1'],$width, $height,$_REQUEST['width'],$_REQUEST['height'],500);
			
			//$_POST['newImage'] = file_directory_temp().'/'.$newImage;
			$src = $_SERVER['DOCUMENT_ROOT'].base_path().file_directory_temp().'/'.$newImage;
			$pictures_dir = base_path().file_directory_path().'/'.variable_get('user_picture_path', 'pictures').'/';
//			$dest = $_SERVER['DOCUMENT_ROOT'].$pictures_dir.'picture-'.$user->uid.'.'.$extension;
			$dest = $_SERVER['DOCUMENT_ROOT'].$pictures_dir.'picture-'.$account->uid.'.'.$extension;
			file_copy($src,$dest,FILE_EXISTS_REPLACE);
//			$form_values['picture'] = file_directory_path().'/'.variable_get('user_picture_path', 'pictures').'/'.'picture-'.$user->uid.'.'.$extension;
			$form_values['picture'] = file_directory_path().'/'.variable_get('user_picture_path', 'pictures').'/'.'picture-'.$account->uid.'.'.$extension;
			break;
	}
}

Comments

squio’s picture

Status: Active » Needs review