From ccdcba869916cc67689fb26584b88ae0f2f71c66 Mon Sep 17 00:00:00 2001
From: Diego Najar <diego.najar@pmi.com>
Date: Mon, 29 Oct 2018 18:21:42 +0100
Subject: [PATCH] bug fix profile picture

---
 bl-kernel/admin/views/edit-user.php | 10 ++++++++--
 bl-kernel/ajax/profile-picture.php  | 15 +++++++++++++--
 2 files changed, 21 insertions(+), 4 deletions(-)

diff --git a/bl-kernel/admin/views/edit-user.php b/bl-kernel/admin/views/edit-user.php
index 8aee28d1..e6ede905 100644
--- a/bl-kernel/admin/views/edit-user.php
+++ b/bl-kernel/admin/views/edit-user.php
@@ -242,10 +242,16 @@ $(document).ready(function() {
 
 	$("#jsprofilePictureInputFile").on("change", function() {
 
+		// Data to send via AJAX
+		var username = $("#jsusername").val();
+		var formData = new FormData($("#jsprofilePictureForm")[0]);
+		formData.append('username', username);
+		formData.append('tokenCSRF', tokenCSRF);
+
 		$.ajax({
-			url: "<?php echo HTML_PATH_ADMIN_ROOT ?>ajax/profile-picture",
+			url: HTML_PATH_ADMIN_ROOT+"ajax/profile-picture",
 			type: "POST",
-			data: new FormData($("#jsprofilePictureForm")[0]),
+			data: formData,
 			cache: false,
 			contentType: false,
 			processData: false,
diff --git a/bl-kernel/ajax/profile-picture.php b/bl-kernel/ajax/profile-picture.php
index fc27f865..c831badb 100644
--- a/bl-kernel/ajax/profile-picture.php
+++ b/bl-kernel/ajax/profile-picture.php
@@ -1,6 +1,19 @@
 <?php defined('BLUDIT') or die('Bludit CMS.');
 header('Content-Type: application/json');
 
+// $_POST
+// ----------------------------------------------------------------------------
+// (string) $_POST['username']
+$username = empty($_POST['username']) ? false : $_POST['username'];
+// ----------------------------------------------------------------------------
+
+if ($username===false) {
+	exit (json_encode(array(
+		'status'=>1,
+		'message'=>'Error in username.'
+	)));
+}
+
 if (!isset($_FILES['profilePictureInputFile'])) {
 	exit (json_encode(array(
 		'status'=>1,
@@ -10,8 +23,6 @@ if (!isset($_FILES['profilePictureInputFile'])) {
 
 // File extension
 $fileExtension 	= pathinfo($_FILES['profilePictureInputFile']['name'], PATHINFO_EXTENSION);
-// Username who is uploading the image
-$username = $login->username();
 // Tmp filename
 $tmpFilename = $username.'.'.$fileExtension;
 // Final filename