agent foundation

lib/Service/User/UserAvatarService.php

@@ -101,6 +101,7 @@ class UserAvatarService
         if (!$ext) {
             return ['ok' => false, 'error' => t('Invalid image file')];
         }
+        // SVG can contain JavaScript — reject files that don't pass the safety check.
         if ($isSvg && !self::imageIsSafeSvg($tmpPath)) {
             return ['ok' => false, 'error' => t('Invalid image file')];
         }
@@ -117,6 +118,7 @@ class UserAvatarService
         }
         @chmod($originalPath, 0644);
 
+        // Prefer WebP for variants (better compression); fall back to JPEG if GD lacks WebP support.
         $variantExt = function_exists('imagewebp') ? 'webp' : 'jpg';
         if (!$isSvg && self::imageCanResize()) {
             foreach (self::SIZES as $size) {
@@ -172,6 +174,7 @@ class UserAvatarService
 
         $this->delete($uuid);
         $originalPath = $dir . '/original.' . $ext;
+        // rename() fails across filesystem boundaries (e.g. /tmp → app storage), fall back to copy.
         if (!@rename($tmpPath, $originalPath)) {
             if (!@copy($tmpPath, $originalPath)) {
                 @unlink($tmpPath);