3

I just realized that Craft puts the username into the path of the photoUrl. Since I use email addresses as usernames, I don’t think it’s a good idea to expose the email addresses of all users on the web.

Question: Is there a way to remove the username (in my case email address) from the photo path and replace it with the users ID for example?

I would like to get around adding a new asset field for every user, since the user photo would be fine.

Bonus question: is there any way to protect user photos from access at all? It looks to me like the urls to the user photos could be guessed quite easily.

Best, Mark

3

Since I use email addresses as usernames, I don’t think it’s a good idea to expose the email addresses of all users on the web.

I agree, and that's something we overlooked when we added the 'useEmailAsUsername' config setting.

Question: Is there a way to remove the username (in my case email address) from the photo path and replace it with the users ID for example?

Currently not, unfortunately. And it's hard-coded so there really isn't a chance for a plugin to override the behavior. And I don't think it's really any better to be displaying a user's ID or UID as well, since people wouldn't expect those to be publicly available by default.

Bonus question: is there any way to protect user photos from access at all? It looks to me like the urls to the user photos could be guessed quite easily.

Again, no.

I think the proper solution to both problems would be, upon uploading a user profile photo, generate a random string and save that along with the user in the database. The string would be used in the URL when retrieving the user's profile photo.

I'll add it to our list to address.

  • Thanks for the insights! Do you have any idea when this issue will be addressed? Days, weeks, month, years? :) – medoingthings Dec 2 '14 at 7:23
  • Would be interesting to know if it’s an option for me to hold back the user photo feature until this is fixed. – medoingthings Dec 2 '14 at 7:29
  • can you tell anything about a rough timeline here? Sorry for bothering you with this. – medoingthings Dec 15 '14 at 18:58
  • Sorry, no ETA, but it is still on our list. – Brad Bell Dec 15 '14 at 19:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.