fix user pictures

Author: remicollet

front/document.send.php

@@ -65,17 +65,17 @@
       $send = false;
       if (($splitter[0] == "_dumps")
           && Session::haveRight("backup", CREATE)) {
-         $send = true;
+         $send = GLPI_DUMP_DIR . '/' . $splitter[1];
       }
 
       if ($splitter[0] == "_pictures") {
-         if (Document::isImage(GLPI_DOC_DIR."/".$_GET['file'])) {
-            $send = true;
+         if (Document::isImage(GLPI_PICTURE_DIR . '/' . $splitter[1])) {
+            $send = GLPI_PICTURE_DIR . '/' . $splitter[1];
          }
       }
 
-      if ($send && file_exists(GLPI_DOC_DIR."/".$_GET["file"])) {
-         Toolbox::sendFile(GLPI_DOC_DIR."/".$_GET["file"], $splitter[1]);
+      if ($send && file_exists($send)) {
+         Toolbox::sendFile($send, $splitter[1]);
       } else {
          Html::displayErrorAndDie(__('Unauthorized access to this file'), true);
       }

inc/user.class.php

@@ -733,7 +733,7 @@ function prepareInputForUpdate($input) {
                $extension    = Toolbox::strtolower(array_pop($tmp));
                @mkdir(GLPI_PICTURE_DIR . "/$sub");
                $picture_path = GLPI_PICTURE_DIR  . "/$sub/${filename}.$extension";
-               self::dropPictureFiles($filename.".".$extension);
+               self::dropPictureFiles("$sub/${filename}.$extension");
 
                if (Document::isImage($fullpath)
                    && Document::renameForce($fullpath, $picture_path)) {
@@ -4747,7 +4747,7 @@ static function dropPictureFiles($picture) {
       if (!empty($picture)) {
          // unlink main file
          if (file_exists(GLPI_PICTURE_DIR."/$picture")) {
-            @unlink(GLPI_DOC_DIR."/_pictures/$picture");
+            @unlink(GLPI_PICTURE_DIR."/$picture");
          }
          // unlink Thunmnail
          $tmp = explode(".", $picture);