Change how the user avatar is exchanged between client und server

app/models.py

@@ -838,6 +838,7 @@ class User(HashidMixin, UserMixin, db.Model):
         json_serializeable = {
             'id': self.hashid,
             'confirmed': self.confirmed,
+            'avatar': url_for('users.profile_avatar', user_id=self.id),
             'email': self.email,
             'last_seen': (
                 None if self.last_seen is None
@@ -857,10 +858,6 @@ class User(HashidMixin, UserMixin, db.Model):
             'show_last_seen': self.has_profile_privacy_setting(ProfilePrivacySettings.SHOW_LAST_SEEN),
             'show_member_since': self.has_profile_privacy_setting(ProfilePrivacySettings.SHOW_MEMBER_SINCE)
         }
-        json_serializeable['avatar'] = (
-            None if self.avatar is None
-            else self.avatar.to_json_serializeable(relationships=True)
-        )
         if backrefs:
             json_serializeable['role'] = \
                 self.role.to_json_serializeable(backrefs=True)

app/static/js/ResourceLists/UserList.js

@@ -72,7 +72,7 @@ class UserList extends ResourceList {
     return {
       'id': user.id,
       'member-since': user.member_since,
-      'avatar': user.avatar ? `/users/${user.id}/avatar` : '/static/images/user_avatar.png',
+      'avatar': user.avatar,
       'username': user.username,
       'full-name': user.full_name ? user.full_name : '',
       'location': user.location ? user.location : '',

app/users/routes.py

@@ -64,10 +64,10 @@ def user(user_id):
 @login_required
 def profile_avatar(user_id):
     user = User.query.get_or_404(user_id)
+    if not (user.is_public or user == current_user or current_user.is_administrator()):
+        abort(403)
     if user.avatar is None:
         return redirect(url_for('static', filename='images/user_avatar.png'))
-    if not user.is_public and not (user == current_user or current_user.is_administrator()):
-        abort(403)
     return send_from_directory(
         os.path.dirname(user.avatar.path),
         os.path.basename(user.avatar.path),