From 25a79c16a1d5ef504877f6519a736c7462bbdcb7 Mon Sep 17 00:00:00 2001
From: skodak <skodak>
Date: Sat, 1 Nov 2008 19:37:07 +0000
Subject: [PATCH] MDL-17065 user: profile iamges of deleted users are not
 accessible anymore; merged from MOODLE_19_STABLE

---
 user/pix.php | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/user/pix.php b/user/pix.php
index 00370135c03..d106c30981c 100644
--- a/user/pix.php
+++ b/user/pix.php
@@ -17,11 +17,14 @@
 
     if (count($args) == 2) {
         $userid   = (integer)$args[0];
-        $image    = $args[1];
-        $pathname = make_user_directory($userid, true) . "/$image";
-        if (file_exists($pathname) and !is_dir($pathname)) {
-            send_file($pathname, $image);
-        } 
+        // do not serve images of deleted users
+        if ($user = $DB->get_record('user', array('id'=>$userid, 'deleted'=>0, 'picture'=>1))) {
+            $image    = $args[1];
+            $pathname = make_user_directory($userid, true) . "/$image";
+            if (file_exists($pathname) and !is_dir($pathname)) {
+                send_file($pathname, $image);
+            }
+        }
     }
 
     // picture was deleted - use default instead