unit tests: user photo access

canaille/account.py

@@ -625,6 +625,12 @@ def photo(uid, field):
         abort(404)
 
     user = User.get(uid)
-    photo = getattr(user, field)[0]
+    if not user:
-    stream = io.BytesIO(photo)
+        abort(404)
+
+    photos = getattr(user, field)
+    if not photos:
+        abort(404)
+
+    stream = io.BytesIO(photos[0])
     return send_file(stream, mimetype="image/jpeg")

tests/test_account.py

@@ -345,3 +345,23 @@ def test_login_placeholder(testclient):
     testclient.app.config["LDAP"]["USER_FILTER"] = "(|(uid={login})(email={login}))"
     placeholder = testclient.get("/login").form["login"].attrs["placeholder"]
     assert placeholder == "jdoe or john@doe.com"
+
+
+def test_photo(testclient, user, jpeg_photo):
+    user.jpegPhoto = [jpeg_photo]
+    user.save()
+    res = testclient.get("/profile/user/jpegPhoto")
+    assert res.body == jpeg_photo
+
+
+def test_photo_invalid_user(testclient, user):
+    res = testclient.get("/profile/invalid/jpegPhoto", status=404)
+
+
+def test_photo_absent(testclient, user):
+    assert not user.jpegPhoto
+    res = testclient.get("/profile/user/jpegPhoto", status=404)
+
+
+def test_photo_invalid_path(testclient, user):
+    testclient.get("/profile/user/invalid", status=404)