Files
MineGeo/supabase/migrations/20261015085948_avatar_upload_hardening.sql
pavel444-byte 930e00a736
All checks were successful
Deploy MineGeo to Dokploy / deploy (push) Successful in 8m53s
Secure profile photo uploads and trust configured production origin
2026-10-15 14:00:46 +05:00

14 lines
551 B
SQL

-- The application server is the only writer for public profile avatars. It
-- validates and re-encodes uploads, applies an account rate limit, and removes
-- replaced files. Client-side Storage uploads could bypass those controls.
drop policy if exists "MineGeo users upload their own avatars"
on storage.objects;
drop policy if exists "MineGeo users delete their own avatars"
on storage.objects;
update storage.buckets
set public = true,
file_size_limit = 5242880,
allowed_mime_types = array['image/webp']
where id = 'minegeo-avatars';