fix: profile photo priority higher than avatar fields

[arifulhoque7]

feat(avatar): add support for wpuf_profile_photo with higher priority

close issue

Changes:

• Added a check for wpuf_profile_photo in wpuf_get_custom_avatar()
• If a valid profile photo exists, it now takes priority over user_avatar
• Used wpuf_avatar_add_image_size() to ensure consistent sizing
• Escaped returned URL with esc_url() for security

Summary by CodeRabbit

• New Features

  • Avatars now prioritize your uploaded profile photo—if set, it will be shown as your avatar; otherwise the previous avatar is used.
  • Avatars are served in a consistent, optimized size for clearer display across profiles, lists, and comments.

• Bug Fixes

  • More reliable avatar selection and validation to prevent broken or missing avatar images; seamless fallback remains.

[coderabbitai]

Walkthrough

Updates wpuf_get_custom_avatar($user_id) to prefer wpuf_profile_photo and return its attachment URL when present; otherwise falls back to existing user_avatar handling. Registers avatar image size and validates attachment sources. No public function signatures changed.

Changes

Cohort / File(s)	Summary of Changes
Avatar resolution logic wpuf-functions.php	Prioritizes wpuf_profile_photo over user_avatar in wpuf_get_custom_avatar($user_id). Registers avatar image size for both paths, retrieves attachment sources, tightens validation to require an array with a non-empty index 0, and adds an early return when a profile photo URL is available. No API/signature changes.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• Add profile photo support and improve form builder UI #1606 — Also modifies profile-photo/avatar handling in wpuf-functions.php, adding profile_photo support and related helpers; directly related to avatar precedence changes.

Poem

A nibble of code, a hop through the door,
Profile photo first, then avatars of yore.
If carrots were URLs, I'd stash them with glee,
Early return swift — back to my tea. 🥕✨

Pre-merge checks and finishing touches

✅ Passed checks (3 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title Check	✅ Passed	The pull request title "fix: profile photo priority higher than avatar fields" directly and accurately reflects the main change in the changeset. The core modification is implementing wpuf_profile_photo with higher priority than the existing user_avatar logic in the wpuf_get_custom_avatar() function, which is precisely what the title conveys. The title is concise, uses clear language with no vague terms or noise, and follows conventional commit formatting. A developer reviewing the git history would immediately understand that this fix prioritizes profile photo handling over avatar fields.

✨ Finishing touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 0

🧹 Nitpick comments (3)

wpuf-functions.php (3)

676-687: Return a sanitized URL and support non‑ID wpuf_profile_photo values.

• The PR description mentions escaping, but this branch returns a raw URL.
• Some installs may store wpuf_profile_photo as a URL (string), not an attachment ID. Handle both.

Apply this diff within this hunk:

 function wpuf_get_custom_avatar( $user_id ) {
-    // First check for profile photo (higher priority)
-    $profile_photo = get_user_meta( $user_id, 'wpuf_profile_photo', true );
+    // First check for profile photo (higher priority)
+    $profile_photo = get_user_meta( $user_id, 'wpuf_profile_photo', true );
+
+    // If stored as an absolute URL, use it directly
+    if ( is_string( $profile_photo ) && filter_var( $profile_photo, FILTER_VALIDATE_URL ) ) {
+        return esc_url_raw( $profile_photo );
+    }
 
     if ( absint( $profile_photo ) > 0 ) {
         wpuf_avatar_add_image_size();
 
         $avatar_source = wp_get_attachment_image_src( $profile_photo, 'wpuf_avatar_image_size' );
 
-        if ( $avatar_source ) {
-            return $avatar_source[0];
+        if ( $avatar_source ) {
+            return esc_url_raw( $avatar_source[0] );
         }
     }

---

692-703: Ensure consistent return type and sanitize; avoid returning a numeric ID.

If the attachment lookup fails for a numeric meta, this can return an integer (attachment ID) and later render as an invalid img src. Always return a URL (or empty string) and sanitize it.

Apply this diff:

     if ( absint( $avatar ) > 0 ) {
         wpuf_avatar_add_image_size();
 
         $avatar_source = wp_get_attachment_image_src( $avatar, 'wpuf_avatar_image_size' );
 
-        if ( $avatar_source ) {
-            $avatar = $avatar_source[0];
-        }
+        if ( $avatar_source ) {
+            return esc_url_raw( $avatar_source[0] );
+        }
     }
 
-    return $avatar;
+    return is_string( $avatar ) ? esc_url_raw( $avatar ) : '';

---

786-791: Sanitize URL when populating get_avatar_data.

Small hardening: sanitize before assigning to $args['url']. Core will escape on render, but this keeps the contract clean.

Replace the assignment at Line 790:

$args['url'] = esc_url_raw( $custom_avatar_url );

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 1d7b9b1 and 55837a9.

📒 Files selected for processing (1)

• wpuf-functions.php (1 hunks)

🧰 Additional context used

🪛 GitHub Actions: Inspections

wpuf-functions.php

[warning] 1-1: PHPCS: The method parameter $post_id is never used.

---

[error] 1-1: PHPCS: Processing form data without nonce verification.

[sapayth]

check the comment

[sapayth]

check if it is an array and $avatar_source[0] exists before returning

[arifulhoque7]

done @sapayth vai

[sapayth]

please check with empty()

[sapayth]

please check with empty()