Add Feature: General Avatar URL feature, for url to local intra server or...

Brought to you by: wekan

#824 Add Feature: General Avatar URL feature, for url to local intra server or Gravatar, automatically pulled to profile avatar, all settings in environment variables

Status: open

Owner: nobody

Labels: Feature (138) Feature:User-accounts:Avatars (8)

Updated: 2026-06-20

Created: 2017-02-08

Creator: Anonymous

Private: No

Originally created by: jLouzado

Right now you have to manually add an avatar when added to a board, this could be simplified by just querying for a gravatar image (if available) or defaulting to the use of Initials.

Discussion

Anonymous - 2017-08-08

Originally posted by: lifehome

Hello there, is there any update on this? It seems the docker image does not contain such feature, I wonder if the master head does?

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Anonymous - 2017-08-08

Originally posted by: xet7

@lifehome

No, this does not exists yet.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Anonymous - 2017-11-23

Originally posted by: xet7

Using Gravatar is not compliant to EU GDPR regulation.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Anonymous - 2018-03-02

Originally posted by: zewa666

Any updates on the GDPR status of Gravatar @xet7 ?

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Anonymous - 2018-03-02

Ticket changed by: xet7

status: open --> closed
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Anonymous - 2018-03-02

Originally posted by: xet7

@zewa666

Yes. Using Gravatar is not compliant with GDPR. Gravatar support will not be implemented in Wekan.

Similar issue here:
https://lists.mailman3.org/archives/list/mailman-users@mailman3.org/thread/H5I7MO7Z5FN3LLEVGU4EUW6K7FNWJ2DT/

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Anonymous - 2018-03-02

Originally posted by: zewa666

thanks for the link 👍

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Anonymous - 2018-03-05

Originally posted by: lifehome

May I know why opt-in for Gravatar is not even considered? I am surely aware the GDPR but not everyone lives in the EU, nor all instances being regulated by the laws of EU.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Anonymous - 2018-03-05

Originally posted by: xet7

@lifehome

GDPR affects also all other companies that do business with EU, like companies at USA. If at some other country there is not such strong privacy protections, most likely govenment can hijack those connections to gravatar, potentially inserting something malicious. So having Gravatar support is security bug.

Gravatar does not work in private intranets where is no direct internet connection, or where is some kind of proxy. For those environments, Gravatar would not work, and even possibility of that option would make usage non-GDPR compliant. Same is with Sandstorm, Wekan is inside secure sandbox, with no access from Sandstorm sandbox to outside to Internet, if no Sandstorm-compatible way is implemented.

Wekan does not load any external resources from internet, like fonts, CSS, etc. That means Wekan is currently safe to use in company intranet use, in healthcare, etc. It's a strong guarantee, I do not want to break that.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Anonymous - 2018-03-05

Originally posted by: xet7

@lifehome

I would only accept General Avatar feature, with settings configured in environment variables,
like URL that can be at gravatar or local intranet server, like http://192.168.1.200/avatars/username.png, with username text replaced with Wekan username.

There should be no UI in Admin Panel, all should be configured in environment variables of standalone/docker/snap version.

This would be coded and submitted as pull request to Wekan devel branch by somebody that really wants this feature.

For implementing this, see Developer Documentation and Excellent example how pull requests are improved and integrated, and not needed commits removed

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Anonymous - 2018-03-05

Ticket changed by: xet7

status: closed --> open
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Anonymous - 2020-10-13

Originally posted by: xi67

There is no private data transmitted to Gravatar.
The service use a hash (MD5 of email address (not bijective so you can't retrieve email adress from the hash)) : https://fr.gravatar.com/site/implement/profiles/
So Wekan does not transmit any private data in requesting if there is an avatar for this hash.

In this logic, Wekan is not responsible for data present in Gravatar Website, it just request it.
I'm not an lawer but i don't see the problem around GDPR because the only data transmitted doas not contain any private information.

In addition, you can make it optional so admins are free to enable / disable it.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Anonymous - 2020-10-13

Originally posted by: xet7

@xi67

https://meta.stackexchange.com/questions/44717/is-gravatar-a-privacy-risk

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Log in to post a comment.