fix: #8437, #8433

src/controllers/accounts/edit.js

@@ -7,6 +7,7 @@ const helpers = require('../helpers');
 const groups = require('../../groups');
 const accountHelpers = require('./helpers');
 const privileges = require('../../privileges');
+const file = require('../../file');
 
 const editController = module.exports;
 
@@ -124,3 +125,29 @@ async function getUserData(req) {
 	userData.hasPassword = await user.hasPassword(userData.uid);
 	return userData;
 }
+
+editController.uploadPicture = async function (req, res, next) {
+	const userPhoto = req.files.files[0];
+	try {
+		const updateUid = await user.getUidByUserslug(req.params.userslug);
+		const isAllowed = await privileges.users.canEdit(req.uid, updateUid);
+		if (!isAllowed) {
+			return helpers.notAllowed(req, res);
+		}
+		await user.checkMinReputation(req.uid, updateUid, 'min:rep:profile-picture');
+
+		const image = await user.uploadCroppedPictureFile({
+			uid: updateUid,
+			file: userPhoto,
+		});
+
+		res.json([{
+			name: userPhoto.name,
+			url: image.url,
+		}]);
+	} catch (err) {
+		next(err);
+	} finally {
+		await file.delete(userPhoto.path);
+	}
+};