gitea-admin/gh-christianlouis-docuelevate
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(profile): address code review feedback - early size check, CSRF helper, test constants

Browse Source 
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
This commit is contained in:
copilot-swe-agent[bot]
2026-03-12 13:10:46 +00:00
parent b0d6f1ab60
commit 9583d6d96f
3 changed files with 43 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frontend/templates/profile.html
+14 -18
View File
@@ -77,8 +77,8 @@
<!-- Upload controls -->
<div class="flex-1 space-y-3">
<p class="text-sm text-gray-600 dark:text-gray-400">
Upload a JPEG, PNG, GIF, or WebP image up to 2&thinsp;MB.
If no custom picture is set, your <a href="https://gravatar.com" class="underline" target="_blank" rel="noopener noreferrer">Gravatar</a> is shown.
Upload a JPEG, PNG, GIF, or WebP image up to 2 MB.
If no custom picture is set, your <a href="https://gravatar.com" class="underline" target="_blank" rel="noopener noreferrer" aria-label="Gravatar (opens in new tab)">Gravatar</a> is shown.
</p>
<label
for="avatar-input"
@@ -366,15 +366,20 @@ function profileSettings() {
}
},
// ── CSRF helper ────────────────────────────────────────────────────────
_getCSRFToken() {
return document.cookie
.split('; ')
.find(row => row.startsWith('csrf_token='))
?.split('=')[1];
},
// ── Save general settings ──────────────────────────────────────────────
async saveProfile() {
this.saving = true;
this._hideBanner();
try {
const csrfToken = document.cookie
.split('; ')
.find(row => row.startsWith('csrf_token='))
?.split('=')[1];
const csrfToken = this._getCSRFToken();
const res = await fetch('/api/profile', {
method: 'PATCH',
@@ -415,10 +420,7 @@ function profileSettings() {
const formData = new FormData();
formData.append('file', file);
const csrfToken = document.cookie
.split('; ')
.find(row => row.startsWith('csrf_token='))
?.split('=')[1];
const csrfToken = this._getCSRFToken();
try {
const res = await fetch('/api/profile/avatar', {
@@ -446,10 +448,7 @@ function profileSettings() {
// ── Remove avatar ──────────────────────────────────────────────────────
async removeAvatar() {
this._hideBanner();
const csrfToken = document.cookie
.split('; ')
.find(row => row.startsWith('csrf_token='))
?.split('=')[1];
const csrfToken = this._getCSRFToken();
try {
const res = await fetch('/api/profile/avatar', {
@@ -473,10 +472,7 @@ function profileSettings() {
async changePassword() {
this.pwSaving = true;
this._hideBanner();
const csrfToken = document.cookie
.split('; ')
.find(row => row.startsWith('csrf_token='))
?.split('=')[1];
const csrfToken = this._getCSRFToken();
try {
const res = await fetch('/api/profile/change-password', {