My details: show the CV photo instead of only saying that one is kept #1246

New issue

Open

opened 2026-11-13 10:29:41 +00:00 by tiagoagueda · 0 comments

tiagoagueda commented

2026-11-13 10:29:41 +00:00

Owner

What happens

On the profile page (My details), the "Your CV photo" card says only "A CV photo is kept." There is nothing to see: to know which photo a CV will print, the person must make a CV and look at it, or upload another one to be sure.

Where

src/postulo/templates/accounts/profile.html, the data-cv-photo-state paragraph ({% if profile.has_cv_photo %}A CV photo is kept.). The photo itself is stored in ProfilePicture with kind CV and reaches documents only as a data: address (avatars.cv_photo_data_uri), because the page's policy allows images from 'self' and data: only (#668).

Expected

When a CV photo is kept, the card shows it, at the size and proportions a CV prints it (it is not cropped, so show it uncropped), with an alt that says what it is ("Your CV photo") and its dimensions and size in words beside it.
When none is kept, the card says so, as now.
After choosing a file in the upload field, the card previews the chosen file before the form is saved, so a wrong photo is noticed before it replaces the kept one. Without script it still shows the kept photo.
Removing: the "Remove the CV photo" box dims the preview or says it will go when saved.

How it is served

Either inline from cv_photo_data_uri (no new route, but it adds the photo's bytes to every profile page load) or a small owner-only route that sends the image with a cache header and Content-Disposition: inline, nosniff, and no sharing. Pick the route if the photo is large; say which in the decision. The photo is private to the person: no share, no API listing, and the route answers 404 to anyone else.

Tests

The page shows the image when one is kept and the text when not; the route (if added) is owner-only and cached; the browser test checks the image loads under the page's content security policy; right-to-left and 320 px do not overflow.

## What happens On the profile page (My details), the "Your CV photo" card says only "A CV photo is kept." There is nothing to see: to know which photo a CV will print, the person must make a CV and look at it, or upload another one to be sure. ## Where `src/postulo/templates/accounts/profile.html`, the `data-cv-photo-state` paragraph (`{% if profile.has_cv_photo %}A CV photo is kept.`). The photo itself is stored in `ProfilePicture` with kind `CV` and reaches documents only as a `data:` address (`avatars.cv_photo_data_uri`), because the page's policy allows images from `'self'` and `data:` only (#668). ## Expected - When a CV photo is kept, the card **shows it**, at the size and proportions a CV prints it (it is not cropped, so show it uncropped), with an `alt` that says what it is ("Your CV photo") and its dimensions and size in words beside it. - When none is kept, the card says so, as now. - After choosing a file in the upload field, the card previews the chosen file before the form is saved, so a wrong photo is noticed before it replaces the kept one. Without script it still shows the kept photo. - Removing: the "Remove the CV photo" box dims the preview or says it will go when saved. ## How it is served Either inline from `cv_photo_data_uri` (no new route, but it adds the photo's bytes to every profile page load) or a small owner-only route that sends the image with a cache header and `Content-Disposition: inline`, `nosniff`, and no sharing. Pick the route if the photo is large; say which in the decision. The photo is private to the person: no share, no API listing, and the route answers 404 to anyone else. ## Tests The page shows the image when one is kept and the text when not; the route (if added) is owner-only and cached; the browser test checks the image loads under the page's content security policy; right-to-left and 320 px do not overflow.

tiagoagueda added this to the 0.6.0 milestone

2026-11-13 10:29:41 +00:00

tiagoagueda added the

interface

enhancement

labels

2026-11-13 10:29:41 +00:00