Merge master into prod#79
Merged
Merged
Conversation
chore: fixed typo newtwork > network
The header and Manage Account avatars rendered a one-time `photoURL` snapshot rather than resolving live. Google/SSO accounts stored the Google photo, while email/password accounts stored either a synthetic gravatar URL or the all-zeros dummy placeholder (avatar/0000…?d=mp&f=y). As a result, updates a user made on Gravatar never surfaced in the app. Add `getUserAvatarUrl(email, providerPhotoURL)`: - returns the provider photo (e.g. Google) unchanged when present - otherwise resolves Gravatar live from the current login email, so changes made on Gravatar are reflected — and the broken all-zeros snapshot is re-pointed to the real md5(email) hash Wire HeaderUser and the Manage Account profile page to it. parseGravatarImage is left intact (still used by OrgNotificationBanner). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
CodeQL flagged providerPhotoURL.includes("gravatar.com") as incomplete URL substring sanitization — "gravatar.com" could appear in an unrelated host (gravatar.com.evil.com) or a query string. Parse the URL and match on the hostname instead (host === "gravatar.com" || host.endsWith(".gravatar.com")), falling back to live Gravatar on unparseable values.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
fix(profile): resolve avatar provider-first, else live Gravatar
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes issue:
📜 Summary of changes:
🎥 Demo Video:
Video/Demo:
✅ Checklist:
🧪 Test instructions:
🔗 Other references: