Move to User model as `User::uploadAvatar` and include Extension::get, validation, Image::create, Image::upload, Image::update there. This logic should not live in the controller.