From 2b0b88802b4971cd300c16b3edbcc3431810419c Mon Sep 17 00:00:00 2001
From: Mouse Reeve <mousereeve@riseup.net>
Date: Sun, 1 Nov 2020 12:36:56 -0800
Subject: [PATCH] Fixes weirdness in handling avatars

- urls weren't serialized correctly for activitypub
- the filename shouldn't have been preserved as-is
---
 bookwyrm/models/user.py  | 3 ++-
 bookwyrm/view_actions.py | 7 ++++++-
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/bookwyrm/models/user.py b/bookwyrm/models/user.py
index 6043faf4..21791411 100644
--- a/bookwyrm/models/user.py
+++ b/bookwyrm/models/user.py
@@ -84,7 +84,8 @@ class User(OrderedCollectionPageMixin, AbstractUser):
         if self.avatar:
             url = self.avatar.url
         else:
-            url = 'https://%s/static/images/default_avi.jpg' % DOMAIN
+            url = '/static/images/default_avi.jpg'
+        url = 'https://%s%s' % (DOMAIN, url)
         return activitypub.Image(url=url)
 
     @property
diff --git a/bookwyrm/view_actions.py b/bookwyrm/view_actions.py
index e9a1171d..d6582ebc 100644
--- a/bookwyrm/view_actions.py
+++ b/bookwyrm/view_actions.py
@@ -1,5 +1,6 @@
 ''' views for actions you can take in the application '''
 from io import BytesIO, TextIOWrapper
+from uuid import uuid4
 from PIL import Image
 
 import dateutil.parser
@@ -201,8 +202,12 @@ def edit_profile(request):
         output = BytesIO()
         cropped.save(output, format=image.format)
         ContentFile(output.getvalue())
+
+        # set the name to a hash
+        extension = form.files['avatar'].name.split('.')[-1]
+        filename = '%s.%s' % (uuid4(), extension)
         request.user.avatar.save(
-            form.files['avatar'].name,
+            filename,
             ContentFile(output.getvalue())
         )