From e9819389afd98a18c4b9679eeec98bfadc55f1b6 Mon Sep 17 00:00:00 2001
From: Azareal <azareal@users.noreply.github.com>
Date: Fri, 31 Jul 2020 22:45:20 +1000
Subject: [PATCH] cover avatars with AvatarResBase config setting

---
 common/site.go        | 16 +++++++++++++++-
 common/user.go        |  7 ++++---
 docs/configuration.md |  2 ++
 3 files changed, 21 insertions(+), 4 deletions(-)

diff --git a/common/site.go b/common/site.go
index 28350678..e8d1adb9 100644
--- a/common/site.go
+++ b/common/site.go
@@ -124,7 +124,7 @@ type config struct {
 	ExtraCSPOrigins string
 	StaticResBase   string // /s/
 	//DynStaticResBase string
-	//AvatarResBase string
+	AvatarResBase string // /uploads/
 
 	Noavatar            string // ? - Move this into the settings table?
 	ItemsPerPage        int    // ? - Move this into the settings table?
@@ -249,6 +249,20 @@ func ProcessConfig() (err error) {
 	if Config.StaticResBase != "" {
 		StaticFiles.Prefix = Config.StaticResBase
 	}
+
+	uurl, err = url.Parse(Config.AvatarResBase)
+	if err != nil {
+		return errors.Wrap(err, "failed to parse Config.AvatarResBase: ")
+	}
+	host2 := uurl.Hostname()
+	if host != host2 && !local(host) {
+		Config.ExtraCSPOrigins += " " + host
+		Config.RefNoRef = true // Avoid leaking origin data to the CDN
+	}
+	if Config.AvatarResBase == "" {
+		Config.AvatarResBase = "/uploads/"
+	}
+	
 	if !Config.DisableDefaultNoavatar {
 		noavatarCache200 = make([]string, 5)
 		noavatarCache48 = make([]string, 5)
diff --git a/common/user.go b/common/user.go
index c57531e5..9e115a78 100644
--- a/common/user.go
+++ b/common/user.go
@@ -790,10 +790,11 @@ func buildNoavatar(uid, width int) string {
 		}
 		return StaticFiles.Prefix + "n" + strconv.Itoa(uid) + "-" + strconv.Itoa(width) + ".png?i=0"
 	}
+	// ? - Add a prefix setting to make this faster?
 	return strings.Replace(strings.Replace(Config.Noavatar, "{id}", strconv.Itoa(uid), 1), "{width}", strconv.Itoa(width), 1)
 }
 
-// ? Make this part of *User?
+// ? - Make this part of *User?
 // TODO: Write tests for this
 func BuildAvatar(uid int, avatar string) (normalAvatar, microAvatar string) {
 	if avatar == "" {
@@ -804,10 +805,10 @@ func BuildAvatar(uid int, avatar string) (normalAvatar, microAvatar string) {
 	}
 	if avatar[0] == '.' {
 		if avatar[1] == '.' {
-			normalAvatar = "/uploads/avatar_" + strconv.Itoa(uid) + "_tmp" + avatar[1:]
+			normalAvatar = Config.AvatarResBase+"avatar_" + strconv.Itoa(uid) + "_tmp" + avatar[1:]
 			return normalAvatar, normalAvatar
 		}
-		normalAvatar = "/uploads/avatar_" + strconv.Itoa(uid) + avatar
+		normalAvatar = Config.AvatarResBase+"avatar_" + strconv.Itoa(uid) + avatar
 		return normalAvatar, normalAvatar
 	}
 	return avatar, avatar
diff --git a/docs/configuration.md b/docs/configuration.md
index b3397b2d..91770ef2 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -130,6 +130,8 @@ ExtraCSPOrigins - Extra origins which may want whitelisted in the default Conten
 
 StaticResBase - The default prefix for static resource files. May be a path or an external domain like a CDN domain. Default: /s/
 
+AvatarResBase - The default prefix for avatar files. May be a path or an external domain like a CDN domain. Default: /uploads/
+
 NoAvatar - The default avatar to use for users when they don't have their own. The default for this may change in the near future to better utilise HTTP/2. Example: https://api.adorable.io/avatars/{width}/{id}.png
 
 ItemsPerPage - The number of posts, topics, etc. you want on each page.