fixed avatar eicar check

[SilentFlameCR]

setAvatar now sending original_avatar and eidted avatar for the clamav check. Scanning for viruses fixed for avatar.

[sonarcloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarCloud

[defnull]

The avatar that is actually stored and later displayed to visitors is not scanned? I can simply send a normal image as user[original_avatar] and a malicious one as user[avatar] to bypass the clamav check.

[farhatahmad]

It's still scanned in the user.rb file as a backup

greenlight/app/models/user.rb

Lines 221 to 229 in 3f64bef

	def scan_avatar_for_virus
	return if !virus_scan? || !attachment_changes['avatar']
	path = attachment_changes['avatar']&.attachable&.tempfile&.path
	return true if Clamby.safe?(path)
	errors.add(:avatar, 'MalwareDetected')
	throw :abort

[defnull]

Ah, so this is just for generating a proper error message on upload, I see. Thanks for the explanation.