Load avatar in header via PHP

[Niduroki]

Load the avatar in the header via PHP instead of JS.

I can't really test this, because I get #7707 when I try to upload an avatar and thus can't upload avatars …

@owncloud/designers @jbtbnl

[jbtbnl]

Div is not allowed to be in the body of span, I suppose you can change the span with id "expand" to a div to solve this.

[jbtbnl]

It wasn't introduced by you but better solve it now :)

[blizzz]

@Kondou-ger any update?

[Niduroki]

@blizzz I'm still wating for @LukasReschke's opinion to escaping this, and another string. But looks like he forgot me 😄

[LukasReschke]

Nah, not forgotten. Just a lot of other stuff to do ;-)

[MorrisJobke]

State of this?

[Niduroki]

#7749 (comment) is the state of this

[MorrisJobke]

@LukasReschke Pingeling.

[LukasReschke]

Change to p(), use the UID instead of the displayname and take a look at @jbtbnl's comment then I'm fine with it.

[Niduroki]

@LukasReschke since you're not answering me in IRC to do this sort-of confidential I'll just spit this out (it's pretty specific – so if anyone can actually abuse this, good job …), regarding the "other string" from #7749 (comment).

How about escaping this: https://github.com/owncloud/core/blob/master/core/js/jquery.avatar.js#L74 ? LDAP Names that have a ?, # or & may screw this one up. How should we escape this? Is there a p() equivalent in JS?

[LukasReschke]

urlencode - but this us not exploitable there since the username !== displayname

[Niduroki]

Finally worked on this.
@LukasReschke @jbtbnl please re-review.

[ghost]

🚀 Test PASSed. 🚀
Refer to this link for build results (access rights to CI server needed):
https://ci.owncloud.org//job/pull-request-analyser-ng-simple/705/
🚀 Test PASSed. 🚀

[MorrisJobke]

I squashed your commits and added the avatardiv-shown class, because this causes the display name to hide on small screens.

Works 👍

[MorrisJobke]

@wakeup @luckydonald @miicha @danbartram @oparoz Feel free to review this. Just check out this branch and set an avatar for the user in the personal settings. then check if it appears in the header and the display name hides on small screens.

[scrutinizer-notifier]

The inspection completed: 2 new issues, 1 updated code elements

[danbartram]

This works for me.

👍

[ghost]

🚀 Test PASSed. 🚀
Refer to this link for build results (access rights to CI server needed):
https://ci.owncloud.org//job/pull-request-analyser-ng-simple/1116/
🚀 Test PASSed. 🚀