Fixes weirdness in handling avatars

- urls weren't serialized correctly for activitypub
- the filename shouldn't have been preserved as-is

bookwyrm/models/user.py

@@ -84,7 +84,8 @@ class User(OrderedCollectionPageMixin, AbstractUser):
         if self.avatar:
             url = self.avatar.url
         else:
-            url = 'https://%s/static/images/default_avi.jpg' % DOMAIN
+            url = '/static/images/default_avi.jpg'
+        url = 'https://%s%s' % (DOMAIN, url)
         return activitypub.Image(url=url)
 
     @property

bookwyrm/view_actions.py

@@ -1,5 +1,6 @@
 ''' views for actions you can take in the application '''
 from io import BytesIO, TextIOWrapper
+from uuid import uuid4
 from PIL import Image
 
 import dateutil.parser
@@ -201,8 +202,12 @@ def edit_profile(request):
         output = BytesIO()
         cropped.save(output, format=image.format)
         ContentFile(output.getvalue())
+
+        # set the name to a hash
+        extension = form.files['avatar'].name.split('.')[-1]
+        filename = '%s.%s' % (uuid4(), extension)
         request.user.avatar.save(
-            form.files['avatar'].name,
+            filename,
             ContentFile(output.getvalue())
         )