github-mirrors/immich
1
0
Fork 0
mirror of https://github.com/immich-app/immich.git synced 2026-05-18 03:10:24 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(server): unify profile image errors to prevent user-existence oracle via status code

Browse Source 
GET /users/:id/profile-image returned HTTP 400 for an unknown user ID
but HTTP 404 when the user existed without a photo, letting callers
distinguish the two cases. Both now return 404 so the response is
identical regardless of whether the UUID maps to an account.
This commit is contained in:
timonrieger
2026-04-29 22:53:58 +02:00
parent 94264dfc1b
commit 87ef6bed4a
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/src/services/user.service.spec.ts
+1 -1
View File
@@ -179,7 +179,7 @@ describe(UserService.name, () => {
it('should throw an error if the user does not exist', async () => { it('should throw an error if the user does not exist', async () => {
mocks.user.get.mockResolvedValue(void 0); mocks.user.get.mockResolvedValue(void 0);
await expect(sut.getProfileImage(userStub.admin.id)).rejects.toBeInstanceOf(BadRequestException); await expect(sut.getProfileImage(userStub.admin.id)).rejects.toBeInstanceOf(NotFoundException);
expect(mocks.user.get).toHaveBeenCalledWith(userStub.admin.id, {}); expect(mocks.user.get).toHaveBeenCalledWith(userStub.admin.id, {});
}); });
server/src/services/user.service.ts
+2 -2
View File
@@ -134,8 +134,8 @@ export class UserService extends BaseService {
} }
async getProfileImage(id: string): Promise<ImmichFileResponse> { async getProfileImage(id: string): Promise<ImmichFileResponse> {
const user = await this.findOrFail(id, {}); const user = await this.userRepository.get(id, {});
if (!user.profileImagePath) { if (!user || !user.profileImagePath) {
throw new NotFoundException('Not found'); throw new NotFoundException('Not found');
} }