Skip to content

Add image resizing FF based on avatar owner

What does this MR do?

We will use two separate feature gates to allow image resizing.
This MR introduces the second, which is more strict.

The first, :dynamic_image_resizing, based on the content requester. Enabling it for the user would allow that user to send resizing requests for any avatar.
It is already in master, and it is not completely safe to use it over a wide set of users, see https://gitlab.com/gitlab-org/gitlab/-/issues/241533.

The second, :dynamic_image_resizing_trusted_owner, based on the content owner.
Enabling it for the user would allow anyone to send resizing requests against the mentioned user avatar only. This flag allows us to operate on trusted data only.

Does this MR meet the acceptance criteria?

Conformity

Availability and Testing

Security

N/A

Related to #240920 (closed)

Edited by Aleksei Lipniagov

Merge request reports