The privacy settings page can be made to change your profile picture

Open Beginner friendly
#2,048 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
78/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
elixir
Domain
backend, security

Research direction

Start in VutuvWeb.SettingsController.save/6 and compare its submitted-field handling with Map.take in update_apps/2. Confirm which fields the privacy settings page owns and trace how profile-picture changes are recorded in the account activity history. Done means unrelated picture fields cannot be updated through this page and an allowed picture change appears in the member's history.

Written by the indexing model from the issue text.

Description

Security

Saving the privacy settings hands the whole submitted form straight to the function that updates a member, so a request that adds a picture field to that form stores a new profile picture through a page that has nothing to do with pictures. It should pass on only the fields that page owns, the way the connected-apps page already does. Nobody reaches this through the site, and the ordinary refusals still apply, but the change is recorded nowhere: the account activity log never learns the picture changed, so a member reading their own history sees no trace of it.

Where: VutuvWeb.SettingsController, save/6, against the Map.take in update_apps/2

An AI agent wrote this text in my name. I know that is problematic.

Dominant language
Elixir
Stars
345
Forks
43
Avg merge
3h 3m
Merged PRs (30d)
405

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from wintermeyer/vutuv

All issues in wintermeyer/vutuv

Similar issues

More Elixir issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.