Simple Local Avatars

About Simple Local Avatars

This plugin allows users with media permissions to upload avatars to their profiles. The avatars are stored in the same folder as other media files and the plugin takes care of cropping and sizing. It also supports Gravatar and default avatars, and allows users to rate their avatars.

Screenshots

Frequently asked questions

What does Simple Local Avatars do?

Simple Local Avatars adds an avatar upload field to user profiles. It generates requested avatar sizes on demand, similar to Gravatar.

How do I use Simple Local Avatars?

To use Simple Local Avatars, edit a user profile and scroll down to the new "Avatar" field. The plugin handles cropping and sizing automatically.

Where are the avatars stored?

Avatars are stored in the "uploads" folder, alongside other media files.

Does Simple Local Avatars support Gravatar?

Yes, Simple Local Avatars fully supports Gravatar and default avatars if no local avatar is set. It also provides an option to disable Gravatar.

Can lower privilege users upload avatars?

The plugin allows you to decide whether lower privilege users, such as subscribers and contributors, can upload their own avatars.

Changelog

2.8.3 – 2024-11-18

Changed: Only allow images that were uploaded by the same user be used when setting the avatar via a REST request (props @dkotter, @justus12337, @faisal-alvi via #317).
Fixed: Only allow image files to be set as the avatar in REST requests (props @dkotter, @justus12337, @faisal-alvi via #317).
Security: Bump @10up/cypress-wp-utils from 0.2.0 to 0.4.0, @sentry/node from 6.19.7 to 8.38.0, @wordpress/env from 9.2.0 to 10.11.0, cypress from 13.2.0 to 13.15.2, cypress-mochawesome-reporter from 3.6.0 to 3.8.2, puppeteer-core from 23.3.0 to 23.8.0 (props @dkotter via #319).

2.8.2 – 2024-11-12

Fixed: Ensure dependencies are (actually) included properly in the release (props @dkotter via #316).

2.8.1 – 2024-11-12

Fixed: Ensure dependencies are included properly in the release (props @dkotter via #315).

2.8.0 – 2024-11-12

Note that this release bumps the minimum required version of WordPress from 6.4 to 6.5.

Added: Support for the WordPress.org plugin preview (props @faisal-alvi, @jeffpaul via #297).
Changed: Update PHP compatibility check to use 10up/wp-compat-validation-tool (props @Sidsector9, @jeffpaul, @faisal-alvi via #291).
Changed: Bump WordPress “tested up to” version 6.7 (props @sudip-md, @jeffpaul, @dkotter via #310, #312).
Changed: Bump WordPress minimum supported version to 6.5 (props @sudip-md, @jeffpaul, @dkotter via #310, #312).
Fixed: Ensure all strings are properly translated (props @pedro-mendonca, @dkotter via #295).
Fixed: Properly handle malformed simple_local_avatar user data (props @adekbadek, @dkotter, @faisal-alvi via #302).
Security: Run a user capability check before we clear the avatar cache (props @dkotter, @truonghuuphuc, @Sidsector9 via #309).
Security: Ensure REST API requests to set an avatar only allow existing attachment IDs to be used (props @dkotter, @justus12337, @faisal-alvi via GHSA-wfjh-m788-w2c5).
Security: Bump axios from 1.6.7 to 1.7.4 (props @dependabot, @faisal-alvi via #298).
Security: Bump webpack from 5.90.0 to 5.94.0 (props @dependabot, @faisal-alvi via #303).
Security: Bump ws from 7.5.10 to 8.18.0 and @wordpress/scripts from 27.1.0 to 30.4.0 (props @dependabot, @faisal-alvi via #305, #311).
Security: Bump body-parser from 1.20.2 to 1.20.3, express from 4.19.2 to 4.21.0, send from 0.18.0 to 0.19.0 and serve-static from 1.15.0 to 1.16.2 (props @dependabot, @faisal-alvi via #306).

2.7.11 – 2024-07-18

Note that this release bumps the minimum required version of WordPress from 6.3 to 6.4.

Changed: Bumped WordPress “tested up to” version 6.6 and minimum version to 6.4 (props @sudip-md, @ankitguptaindia, @jeffpaul via #289, #290).
Security: Add nonce check when saving the default avatar ID (props @faisal-alvi, @aaemnnosttv, @rafiem, @dkotter via GHSA-46pw-6m35-9m7x).
Security: Bump braces from 3.0.2 to 3.0.3, pac-resolver from 7.0.0 to 7.0.1, socks from 2.7.1 to 2.8.3 and removes ip (props @dependabot, @Sidsector9 via #286).
Security: Bump ws from 7.5.9 to 7.5.10 (props @dependabot, @faisal-alvi via #287).

2.7.10 – 2024-05-24

Fixed: Fix Default Avatar Fallback (props @amirhossein7, @faisal-alvi, @dkotter, @qasumitbagthariya via #281).
Security: Bump express from 4.18.2 to 4.19.2 (props @dependabot, @faisal-alvi via #269).
Security: Bump follow-redirects from 1.15.5 to 1.15.6 (props @dependabot, @faisal-alvi via #269).
Security: Bump ip from 1.1.8 to 1.1.9 (props @dependabot, @faisal-alvi via #269).
Security: Bump webpack-dev-middleware from 5.3.3 to 5.3.4 (props @dependabot, @faisal-alvi via #269).

2.7.9 – 2024-05-14

Fixed: Ensure default Gravatar avatars are shown correctly (props @faisal-alvi, @dkotter, @horrormoviesgr, @inpeaks, @lillylark, @rafaucau, @janrenn via #278).

2.7.8 – 2024-05-08

Note that this release bumps the minimum required version of WordPress from 5.7 to 6.3.

Added: “Testing” section in the CONTRIBUTING.md file (props @kmgalanakis, @jeffpaul via #274).
Changed: Bumped WordPress “tested up to” version 6.5 (props @sudip-md, @dkotter, @jeffpaul via #270).
Changed: Move simple_local_avatar_deleted action to avatar_delete (props @lllopo, @faisal-alvi, @dkotter via #255).
Changed: Clean up NPM dependencies and update node to v20 (props @Sidsector9, @dkotter via #257).
Changed: Update CODEOWNERS of the plugin (props @jeffpaul, @dkotter via #253).
Changed: Disabled auto sync pull requests with target branch (props @iamdharmesh, @jeffpaul via #263).
Changed: Upgrade download-artifact from v3 to v4 (props @iamdharmesh, @jeffpaul via #265).
Changed: Replaced lee-dohm/no-response with actions/stale to help with closing no-response/stale issues (props @jeffpaul, @dkotter via #266).
Fixed: Broken default avatar when Local Avatars Only is unchecked (props @faisal-alvi, @ankitguptaindia, @qasumitbagthariya via #260).
Fixed: Ensure high-quality avatar preview on profile edit screen (props @ocean90, @dkotter via #273).
Fixed: Possible PHP warning (props @BhargavBhandari90, @dkotter via #261).
Fixed: Fixed typos (props @szepeviktor, @dkotter via #268).

2.7.7 – 2023-12-13

Fixed: Revert the Host/Domain support for local avatar URL (props @faisal-alvi, @jakejackson1, @leogermani, @dkotter via #247).
Security: Bump axios from 0.25.0 to 1.6.2 and @wordpress/scripts from 23.7.2 to 26.18.0 (props @dependabot, @faisal-alvi via #250).

2.7.6 – 2023-11-30

Added: Check for minimum required PHP version before loading the plugin (props @kmgalanakis, @faisal-alvi via #226).
Added: pre_simple_local_avatar_url filter to allow an avatar image to be short-circuited before Simple Local Avatars processes it (props @johnbillion, @peterwilsoncc via #237).
Added: Repo Automator GitHub Action (props @iamdharmesh, @faisal-alvi via #228).
Added: E2E test for checking the front end of avatars (props @Firestorm980, @iamdharmesh via #219).
Changed: Bumped WordPress “tested up to” version 6.4 (props @zamanq, @ankitguptaindia, @faisal-alvi, @qasumitbagthariya via #230, #244).
Changed: Update the Dependency Review GitHub Action to leverage our org-wide config file to check for GPL-compatible licenses (props @jeffpaul, @faisal-alvi via #215).
Changed: Documentation updates (props @jeffpaul, @faisal-alvi via #242).
Fixed: Address conflicts with other plugins and loading the media API (props @EHLOVader, @dkotter via #218).
Fixed: Prevent PHP fatal error when switching from a multisite to single site installation (props @ocean90, @ravinderk, @faisal-alvi via #222).
Fixed: Local avatar urls remain old after domain/host change (props @jayedul, @ravinderk, @jeffpaul, @faisal-alvi via #216).
Security: Bump word-wrap from 1.2.3 to 1.2.4 (props @dependabot, @faisal-alvi via #223).
Security: Bump tough-cookie from 4.1.2 to 4.1.3 (props @dependabot, @faisal-alvi via #225).
Security: Bump @cypress/request from 2.88.10 to 3.0.0 (props @dependabot, @faisal-alvi via #225, #234).
Security: Bump cypress from 11.2.0 to 13.2.0 (props @dependabot, @faisal-alvi, @iamdharmesh via #234, #236).
Security: Bump postcss from 8.4.21 to 8.4.31 (props @dependabot, @faisal-alvi via #238).
Security: Bump @babel/traverse from 7.20.12 to 7.23.2 (props @dependabot, @faisal-alvi via #240).
Security: Bump @10up/cypress-wp-utils version to 0.2.0 (props @iamdharmesh, @faisal-alvi via #236).
Security: Bump @wordpress/env version from 5.2.0 to 8.7.0 (props @iamdharmesh, @faisal-alvi via #236).
Security: Bump cypress-mochawesome-reporter version from 3.0.1 to 3.6.0 (props @iamdharmesh, @faisal-alvi via #236).

View historical changelog details here.