sakaiproject/Hilary — pull request #274 by simong (2012-12-04 21:21:53+00:00)
Title: Allow for uploading and cropping of profile pictures.

This PR introduces some functionality to upload and retrieve profile pictures for users and groups.
I'd like to hold off on merging so that search and tenant separation can go in and that this PR can benefit from those changes as well.

Something, I'd like feedback on though is the profile pictures visibility:
To avoid doing an access check each time a profile picture is accessed (there could be 1-20 pictures on a page at any given time), I'm using the same signing technique as will be used with content previews.
A URL will be signed when a User/Group object is retrieved and it will be sent back to the client.
That URL remains static for as long as the user his pic is set (so it's cacheable.) The URL is not sent out in the feeds when the current user does not have the sufficient access rights (if he's anonymous, or the profile is set to private.)

Pro:
* Cacheable URLs
* We don't need to go to Cassandra to verify if the user has access.
* Sort of re-useable with the existing storage mechanism

Con:
* Once Bob knows the URL for Alice her profile pic, he'll always be able to see it. Even if she changes the visibility setting.
* The URL is fairly ugly. (ie: /api/download/signed?uri=local:2012/12/05/1fsdsdf/my-profile.jpg&signature=1123ae132f87fcead)

Once this goes in the app servers will need to have imagemagick (or graphicsmagick if that's preferred) installed. I'll send a PR for puppet-hilary later.