Adding upstream version 9.0.3.

Signed-off-by: Daniel Baumann <daniel@debian.org>

13 files changed, 1429 insertions, 0 deletions

diff --git a/modules/avatar/avatar.go b/modules/avatar/avatar.go
new file mode 100644
index 0000000..106215e
--- /dev/null
+++ b/modules/avatar/avatar.go
@@ -0,0 +1,139 @@
+// Copyright 2014 The Gogs Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package avatar
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"image"
+	"image/color"
+	"image/png"
+
+	_ "image/gif"  // for processing gif images
+	_ "image/jpeg" // for processing jpeg images
+
+	"code.gitea.io/gitea/modules/avatar/identicon"
+	"code.gitea.io/gitea/modules/setting"
+
+	"golang.org/x/image/draw"
+
+	_ "golang.org/x/image/webp" // for processing webp images
+)
+
+// DefaultAvatarSize is the target CSS pixel size for avatar generation. It is
+// multiplied by setting.Avatar.RenderedSizeFactor and the resulting size is the
+// usual size of avatar image saved on server, unless the original file is smaller
+// than the size after resizing.
+const DefaultAvatarSize = 256
+
+// RandomImageSize generates and returns a random avatar image unique to input data
+// in custom size (height and width).
+func RandomImageSize(size int, data []byte) (image.Image, error) {
+	// we use white as background, and use dark colors to draw blocks
+	imgMaker, err := identicon.New(size, color.White, identicon.DarkColors...)
+	if err != nil {
+		return nil, fmt.Errorf("identicon.New: %w", err)
+	}
+	return imgMaker.Make(data), nil
+}
+
+// RandomImage generates and returns a random avatar image unique to input data
+// in default size (height and width).
+func RandomImage(data []byte) (image.Image, error) {
+	return RandomImageSize(DefaultAvatarSize*setting.Avatar.RenderedSizeFactor, data)
+}
+
+// processAvatarImage process the avatar image data, crop and resize it if necessary.
+// the returned data could be the original image if no processing is needed.
+func processAvatarImage(data []byte, maxOriginSize int64) ([]byte, error) {
+	imgCfg, imgType, err := image.DecodeConfig(bytes.NewReader(data))
+	if err != nil {
+		return nil, fmt.Errorf("image.DecodeConfig: %w", err)
+	}
+
+	// for safety, only accept known types explicitly
+	if imgType != "png" && imgType != "jpeg" && imgType != "gif" && imgType != "webp" {
+		return nil, errors.New("unsupported avatar image type")
+	}
+
+	// do not process image which is too large, it would consume too much memory
+	if imgCfg.Width > setting.Avatar.MaxWidth {
+		return nil, fmt.Errorf("image width is too large: %d > %d", imgCfg.Width, setting.Avatar.MaxWidth)
+	}
+	if imgCfg.Height > setting.Avatar.MaxHeight {
+		return nil, fmt.Errorf("image height is too large: %d > %d", imgCfg.Height, setting.Avatar.MaxHeight)
+	}
+
+	// If the origin is small enough, just use it, then APNG could be supported,
+	// otherwise, if the image is processed later, APNG loses animation.
+	// And one more thing, webp is not fully supported, for animated webp, image.DecodeConfig works but Decode fails.
+	// So for animated webp, if the uploaded file is smaller than maxOriginSize, it will be used, if it's larger, there will be an error.
+	if len(data) < int(maxOriginSize) {
+		return data, nil
+	}
+
+	img, _, err := image.Decode(bytes.NewReader(data))
+	if err != nil {
+		return nil, fmt.Errorf("image.Decode: %w", err)
+	}
+
+	// try to crop and resize the origin image if necessary
+	img = cropSquare(img)
+
+	targetSize := DefaultAvatarSize * setting.Avatar.RenderedSizeFactor
+	img = scale(img, targetSize, targetSize, draw.BiLinear)
+
+	// try to encode the cropped/resized image to png
+	bs := bytes.Buffer{}
+	if err = png.Encode(&bs, img); err != nil {
+		return nil, err
+	}
+	resized := bs.Bytes()
+
+	// usually the png compression is not good enough, use the original image (no cropping/resizing) if the origin is smaller
+	if len(data) <= len(resized) {
+		return data, nil
+	}
+
+	return resized, nil
+}
+
+// ProcessAvatarImage process the avatar image data, crop and resize it if necessary.
+// the returned data could be the original image if no processing is needed.
+func ProcessAvatarImage(data []byte) ([]byte, error) {
+	return processAvatarImage(data, setting.Avatar.MaxOriginSize)
+}
+
+// scale resizes the image to width x height using the given scaler.
+func scale(src image.Image, width, height int, scale draw.Scaler) image.Image {
+	rect := image.Rect(0, 0, width, height)
+	dst := image.NewRGBA(rect)
+	scale.Scale(dst, rect, src, src.Bounds(), draw.Over, nil)
+	return dst
+}
+
+// cropSquare crops the largest square image from the center of the image.
+// If the image is already square, it is returned unchanged.
+func cropSquare(src image.Image) image.Image {
+	bounds := src.Bounds()
+	if bounds.Dx() == bounds.Dy() {
+		return src
+	}
+
+	var rect image.Rectangle
+	if bounds.Dx() > bounds.Dy() {
+		// width > height
+		size := bounds.Dy()
+		rect = image.Rect((bounds.Dx()-size)/2, 0, (bounds.Dx()+size)/2, size)
+	} else {
+		// width < height
+		size := bounds.Dx()
+		rect = image.Rect(0, (bounds.Dy()-size)/2, size, (bounds.Dy()+size)/2)
+	}
+
+	dst := image.NewRGBA(rect)
+	draw.Draw(dst, rect, src, rect.Min, draw.Src)
+	return dst
+}
diff --git a/modules/avatar/avatar_test.go b/modules/avatar/avatar_test.go
new file mode 100644
index 0000000..824a38e
--- /dev/null
+++ b/modules/avatar/avatar_test.go
@@ -0,0 +1,137 @@
+// Copyright 2016 The Gogs Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package avatar
+
+import (
+	"bytes"
+	"image"
+	"image/png"
+	"os"
+	"testing"
+
+	"code.gitea.io/gitea/modules/setting"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_RandomImageSize(t *testing.T) {
+	_, err := RandomImageSize(0, []byte("gitea@local"))
+	require.Error(t, err)
+
+	_, err = RandomImageSize(64, []byte("gitea@local"))
+	require.NoError(t, err)
+}
+
+func Test_RandomImage(t *testing.T) {
+	_, err := RandomImage([]byte("gitea@local"))
+	require.NoError(t, err)
+}
+
+func Test_ProcessAvatarPNG(t *testing.T) {
+	setting.Avatar.MaxWidth = 4096
+	setting.Avatar.MaxHeight = 4096
+
+	data, err := os.ReadFile("testdata/avatar.png")
+	require.NoError(t, err)
+
+	_, err = processAvatarImage(data, 262144)
+	require.NoError(t, err)
+}
+
+func Test_ProcessAvatarJPEG(t *testing.T) {
+	setting.Avatar.MaxWidth = 4096
+	setting.Avatar.MaxHeight = 4096
+
+	data, err := os.ReadFile("testdata/avatar.jpeg")
+	require.NoError(t, err)
+
+	_, err = processAvatarImage(data, 262144)
+	require.NoError(t, err)
+}
+
+func Test_ProcessAvatarInvalidData(t *testing.T) {
+	setting.Avatar.MaxWidth = 5
+	setting.Avatar.MaxHeight = 5
+
+	_, err := processAvatarImage([]byte{}, 12800)
+	assert.EqualError(t, err, "image.DecodeConfig: image: unknown format")
+}
+
+func Test_ProcessAvatarInvalidImageSize(t *testing.T) {
+	setting.Avatar.MaxWidth = 5
+	setting.Avatar.MaxHeight = 5
+
+	data, err := os.ReadFile("testdata/avatar.png")
+	require.NoError(t, err)
+
+	_, err = processAvatarImage(data, 12800)
+	assert.EqualError(t, err, "image width is too large: 10 > 5")
+}
+
+func Test_ProcessAvatarImage(t *testing.T) {
+	setting.Avatar.MaxWidth = 4096
+	setting.Avatar.MaxHeight = 4096
+	scaledSize := DefaultAvatarSize * setting.Avatar.RenderedSizeFactor
+
+	newImgData := func(size int, optHeight ...int) []byte {
+		width := size
+		height := size
+		if len(optHeight) == 1 {
+			height = optHeight[0]
+		}
+		img := image.NewRGBA(image.Rect(0, 0, width, height))
+		bs := bytes.Buffer{}
+		err := png.Encode(&bs, img)
+		require.NoError(t, err)
+		return bs.Bytes()
+	}
+
+	// if origin image canvas is too large, crop and resize it
+	origin := newImgData(500, 600)
+	result, err := processAvatarImage(origin, 0)
+	require.NoError(t, err)
+	assert.NotEqual(t, origin, result)
+	decoded, err := png.Decode(bytes.NewReader(result))
+	require.NoError(t, err)
+	assert.EqualValues(t, scaledSize, decoded.Bounds().Max.X)
+	assert.EqualValues(t, scaledSize, decoded.Bounds().Max.Y)
+
+	// if origin image is smaller than the default size, use the origin image
+	origin = newImgData(1)
+	result, err = processAvatarImage(origin, 0)
+	require.NoError(t, err)
+	assert.Equal(t, origin, result)
+
+	// use the origin image if the origin is smaller
+	origin = newImgData(scaledSize + 100)
+	result, err = processAvatarImage(origin, 0)
+	require.NoError(t, err)
+	assert.Less(t, len(result), len(origin))
+
+	// still use the origin image if the origin doesn't exceed the max-origin-size
+	origin = newImgData(scaledSize + 100)
+	result, err = processAvatarImage(origin, 262144)
+	require.NoError(t, err)
+	assert.Equal(t, origin, result)
+
+	// allow to use known image format (eg: webp) if it is small enough
+	origin, err = os.ReadFile("testdata/animated.webp")
+	require.NoError(t, err)
+	result, err = processAvatarImage(origin, 262144)
+	require.NoError(t, err)
+	assert.Equal(t, origin, result)
+
+	// do not support unknown image formats, eg: SVG may contain embedded JS
+	origin = []byte("<svg></svg>")
+	_, err = processAvatarImage(origin, 262144)
+	require.ErrorContains(t, err, "image: unknown format")
+
+	// make sure the canvas size limit works
+	setting.Avatar.MaxWidth = 5
+	setting.Avatar.MaxHeight = 5
+	origin = newImgData(10)
+	_, err = processAvatarImage(origin, 262144)
+	require.ErrorContains(t, err, "image width is too large: 10 > 5")
+}
diff --git a/modules/avatar/hash.go b/modules/avatar/hash.go
new file mode 100644
index 0000000..50db9c1
--- /dev/null
+++ b/modules/avatar/hash.go
@@ -0,0 +1,28 @@
+// Copyright 2023 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package avatar
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"strconv"
+)
+
+// HashAvatar will generate a unique string, which ensures that when there's a
+// different unique ID while the data is the same, it will generate a different
+// output. It will generate the output according to:
+// HEX(HASH(uniqueID || - || data))
+// The hash being used is SHA256.
+// The sole purpose of the unique ID is to generate a distinct hash Such that
+// two unique IDs with the same data will have a different hash output.
+// The "-" byte is important to ensure that data cannot be modified such that
+// the first byte is a number, which could lead to a "collision" with the hash
+// of another unique ID.
+func HashAvatar(uniqueID int64, data []byte) string {
+	h := sha256.New()
+	h.Write([]byte(strconv.FormatInt(uniqueID, 10)))
+	h.Write([]byte{'-'})
+	h.Write(data)
+	return hex.EncodeToString(h.Sum(nil))
+}
diff --git a/modules/avatar/hash_test.go b/modules/avatar/hash_test.go
new file mode 100644
index 0000000..1b8249c
--- /dev/null
+++ b/modules/avatar/hash_test.go
@@ -0,0 +1,26 @@
+// Copyright 2023 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package avatar_test
+
+import (
+	"bytes"
+	"image"
+	"image/png"
+	"testing"
+
+	"code.gitea.io/gitea/modules/avatar"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_HashAvatar(t *testing.T) {
+	myImage := image.NewRGBA(image.Rect(0, 0, 32, 32))
+	var buff bytes.Buffer
+	png.Encode(&buff, myImage)
+
+	assert.EqualValues(t, "9ddb5bac41d57e72aa876321d0c09d71090c05f94bc625303801be2f3240d2cb", avatar.HashAvatar(1, buff.Bytes()))
+	assert.EqualValues(t, "9a5d44e5d637b9582a976676e8f3de1dccd877c2fe3e66ca3fab1629f2f47609", avatar.HashAvatar(8, buff.Bytes()))
+	assert.EqualValues(t, "ed7399158672088770de6f5211ce15528ebd675e92fc4fc060c025f4b2794ccb", avatar.HashAvatar(1024, buff.Bytes()))
+	assert.EqualValues(t, "161178642c7d59eb25a61dddced5e6b66eae1c70880d5f148b1b497b767e72d9", avatar.HashAvatar(1024, []byte{}))
+}
diff --git a/modules/avatar/identicon/block.go b/modules/avatar/identicon/block.go
new file mode 100644
index 0000000..cb1803a
--- /dev/null
+++ b/modules/avatar/identicon/block.go
@@ -0,0 +1,717 @@
+// Copyright 2021 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+// Copied and modified from https://github.com/issue9/identicon/ (MIT License)
+
+package identicon
+
+import "image"
+
+var (
+	// the blocks can appear in center, these blocks can be more beautiful
+	centerBlocks = []blockFunc{b0, b1, b2, b3, b19, b26, b27}
+
+	// all blocks
+	blocks = []blockFunc{b0, b1, b2, b3, b4, b5, b6, b7, b8, b9, b10, b11, b12, b13, b14, b15, b16, b17, b18, b19, b20, b21, b22, b23, b24, b25, b26, b27}
+)
+
+type blockFunc func(img *image.Paletted, x, y, size, angle int)
+
+// draw a polygon by points, and the polygon is rotated by angle.
+func drawBlock(img *image.Paletted, x, y, size, angle int, points []int) {
+	if angle != 0 {
+		m := size / 2
+		rotate(points, m, m, angle)
+	}
+
+	for i := 0; i < size; i++ {
+		for j := 0; j < size; j++ {
+			if pointInPolygon(i, j, points) {
+				img.SetColorIndex(x+i, y+j, 1)
+			}
+		}
+	}
+}
+
+// blank
+//
+//	--------
+//	|      |
+//	|      |
+//	|      |
+//	--------
+func b0(img *image.Paletted, x, y, size, angle int) {}
+
+// full-filled
+//
+//	--------
+//	|######|
+//	|######|
+//	|######|
+//	--------
+func b1(img *image.Paletted, x, y, size, angle int) {
+	for i := x; i < x+size; i++ {
+		for j := y; j < y+size; j++ {
+			img.SetColorIndex(i, j, 1)
+		}
+	}
+}
+
+// a small block
+//
+//	----------
+//	|        |
+//	|  ####  |
+//	|  ####  |
+//	|        |
+//	----------
+func b2(img *image.Paletted, x, y, size, angle int) {
+	l := size / 4
+	x += l
+	y += l
+
+	for i := x; i < x+2*l; i++ {
+		for j := y; j < y+2*l; j++ {
+			img.SetColorIndex(i, j, 1)
+		}
+	}
+}
+
+// diamond
+//
+//	---------
+//	|   #   |
+//	|  ###  |
+//	| ##### |
+//	|#######|
+//	| ##### |
+//	|  ###  |
+//	|   #   |
+//	---------
+func b3(img *image.Paletted, x, y, size, angle int) {
+	m := size / 2
+	drawBlock(img, x, y, size, 0, []int{
+		m, 0,
+		size, m,
+		m, size,
+		0, m,
+		m, 0,
+	})
+}
+
+// b4
+//
+//	-------
+//	|#####|
+//	|#### |
+//	|###  |
+//	|##   |
+//	|#    |
+//	|------
+func b4(img *image.Paletted, x, y, size, angle int) {
+	drawBlock(img, x, y, size, angle, []int{
+		0, 0,
+		size, 0,
+		0, size,
+		0, 0,
+	})
+}
+
+// b5
+//
+//	---------
+//	|   #   |
+//	|  ###  |
+//	| ##### |
+//	|#######|
+func b5(img *image.Paletted, x, y, size, angle int) {
+	m := size / 2
+	drawBlock(img, x, y, size, angle, []int{
+		m, 0,
+		size, size,
+		0, size,
+		m, 0,
+	})
+}
+
+// b6
+//
+//	--------
+//	|###   |
+//	|###   |
+//	|###   |
+//	--------
+func b6(img *image.Paletted, x, y, size, angle int) {
+	m := size / 2
+	drawBlock(img, x, y, size, angle, []int{
+		0, 0,
+		m, 0,
+		m, size,
+		0, size,
+		0, 0,
+	})
+}
+
+// b7 italic cone
+//
+//	---------
+//	| #     |
+//	|  ##   |
+//	|  #####|
+//	|   ####|
+//	|--------
+func b7(img *image.Paletted, x, y, size, angle int) {
+	m := size / 2
+	drawBlock(img, x, y, size, angle, []int{
+		0, 0,
+		size, m,
+		size, size,
+		m, size,
+		0, 0,
+	})
+}
+
+// b8 three small triangles
+//
+//	-----------
+//	|    #    |
+//	|   ###   |
+//	|  #####  |
+//	|  #   #  |
+//	| ### ### |
+//	|#########|
+//	-----------
+func b8(img *image.Paletted, x, y, size, angle int) {
+	m := size / 2
+	mm := m / 2
+
+	// top
+	drawBlock(img, x, y, size, angle, []int{
+		m, 0,
+		3 * mm, m,
+		mm, m,
+		m, 0,
+	})
+
+	// bottom left
+	drawBlock(img, x, y, size, angle, []int{
+		mm, m,
+		m, size,
+		0, size,
+		mm, m,
+	})
+
+	// bottom right
+	drawBlock(img, x, y, size, angle, []int{
+		3 * mm, m,
+		size, size,
+		m, size,
+		3 * mm, m,
+	})
+}
+
+// b9 italic triangle
+//
+//	---------
+//	|#      |
+//	| ####  |
+//	|  #####|
+//	|  #### |
+//	|   #   |
+//	---------
+func b9(img *image.Paletted, x, y, size, angle int) {
+	m := size / 2
+	drawBlock(img, x, y, size, angle, []int{
+		0, 0,
+		size, m,
+		m, size,
+		0, 0,
+	})
+}
+
+// b10
+//
+//	----------
+//	|    ####|
+//	|    ### |
+//	|    ##  |
+//	|    #   |
+//	|####    |
+//	|###     |
+//	|##      |
+//	|#       |
+//	----------
+func b10(img *image.Paletted, x, y, size, angle int) {
+	m := size / 2
+	drawBlock(img, x, y, size, angle, []int{
+		m, 0,
+		size, 0,
+		m, m,
+		m, 0,
+	})
+
+	drawBlock(img, x, y, size, angle, []int{
+		0, m,
+		m, m,
+		0, size,
+		0, m,
+	})
+}
+
+// b11
+//
+//	----------
+//	|####    |
+//	|####    |
+//	|####    |
+//	|        |
+//	|        |
+//	----------
+func b11(img *image.Paletted, x, y, size, angle int) {
+	m := size / 2
+	drawBlock(img, x, y, size, angle, []int{
+		0, 0,
+		m, 0,
+		m, m,
+		0, m,
+		0, 0,
+	})
+}
+
+// b12
+//
+//	-----------
+//	|         |
+//	|         |
+//	|#########|
+//	|  #####  |
+//	|    #    |
+//	-----------
+func b12(img *image.Paletted, x, y, size, angle int) {
+	m := size / 2
+	drawBlock(img, x, y, size, angle, []int{
+		0, m,
+		size, m,
+		m, size,
+		0, m,
+	})
+}
+
+// b13
+//
+//	-----------
+//	|         |
+//	|         |
+//	|    #    |
+//	|  #####  |
+//	|#########|
+//	-----------
+func b13(img *image.Paletted, x, y, size, angle int) {
+	m := size / 2
+	drawBlock(img, x, y, size, angle, []int{
+		m, m,
+		size, size,
+		0, size,
+		m, m,
+	})
+}
+
+// b14
+//
+//	---------
+//	|   #   |
+//	| ###   |
+//	|####   |
+//	|       |
+//	|       |
+//	---------
+func b14(img *image.Paletted, x, y, size, angle int) {
+	m := size / 2
+	drawBlock(img, x, y, size, angle, []int{
+		m, 0,
+		m, m,
+		0, m,
+		m, 0,
+	})
+}
+
+// b15
+//
+//	----------
+//	|#####   |
+//	|###     |
+//	|#       |
+//	|        |
+//	|        |
+//	----------
+func b15(img *image.Paletted, x, y, size, angle int) {
+	m := size / 2
+	drawBlock(img, x, y, size, angle, []int{
+		0, 0,
+		m, 0,
+		0, m,
+		0, 0,
+	})
+}
+
+// b16
+//
+//	---------
+//	|   #   |
+//	| ##### |
+//	|#######|
+//	|   #   |
+//	| ##### |
+//	|#######|
+//	---------
+func b16(img *image.Paletted, x, y, size, angle int) {
+	m := size / 2
+	drawBlock(img, x, y, size, angle, []int{
+		m, 0,
+		size, m,
+		0, m,
+		m, 0,
+	})
+
+	drawBlock(img, x, y, size, angle, []int{
+		m, m,
+		size, size,
+		0, size,
+		m, m,
+	})
+}
+
+// b17
+//
+//	----------
+//	|#####   |
+//	|###     |
+//	|#       |
+//	|      ##|
+//	|      ##|
+//	----------
+func b17(img *image.Paletted, x, y, size, angle int) {
+	m := size / 2
+
+	drawBlock(img, x, y, size, angle, []int{
+		0, 0,
+		m, 0,
+		0, m,
+		0, 0,
+	})
+
+	quarter := size / 4
+	drawBlock(img, x, y, size, angle, []int{
+		size - quarter, size - quarter,
+		size, size - quarter,
+		size, size,
+		size - quarter, size,
+		size - quarter, size - quarter,
+	})
+}
+
+// b18
+//
+//	----------
+//	|#####   |
+//	|####    |
+//	|###     |
+//	|##      |
+//	|#       |
+//	----------
+func b18(img *image.Paletted, x, y, size, angle int) {
+	m := size / 2
+
+	drawBlock(img, x, y, size, angle, []int{
+		0, 0,
+		m, 0,
+		0, size,
+		0, 0,
+	})
+}
+
+// b19
+//
+//	----------
+//	|########|
+//	|###  ###|
+//	|#      #|
+//	|###  ###|
+//	|########|
+//	----------
+func b19(img *image.Paletted, x, y, size, angle int) {
+	m := size / 2
+
+	drawBlock(img, x, y, size, angle, []int{
+		0, 0,
+		m, 0,
+		0, m,
+		0, 0,
+	})
+
+	drawBlock(img, x, y, size, angle, []int{
+		m, 0,
+		size, 0,
+		size, m,
+		m, 0,
+	})
+
+	drawBlock(img, x, y, size, angle, []int{
+		size, m,
+		size, size,
+		m, size,
+		size, m,
+	})
+
+	drawBlock(img, x, y, size, angle, []int{
+		0, m,
+		m, size,
+		0, size,
+		0, m,
+	})
+}
+
+// b20
+//
+//	----------
+//	|  ##     |
+//	|###      |
+//	|##       |
+//	|##       |
+//	|#        |
+//	----------
+func b20(img *image.Paletted, x, y, size, angle int) {
+	m := size / 2
+	q := size / 4
+
+	drawBlock(img, x, y, size, angle, []int{
+		q, 0,
+		0, size,
+		0, m,
+		q, 0,
+	})
+}
+
+// b21
+//
+//	----------
+//	| ####   |
+//	|## #####|
+//	|##    ##|
+//	|##      |
+//	|#       |
+//	----------
+func b21(img *image.Paletted, x, y, size, angle int) {
+	m := size / 2
+	q := size / 4
+
+	drawBlock(img, x, y, size, angle, []int{
+		q, 0,
+		0, size,
+		0, m,
+		q, 0,
+	})
+
+	drawBlock(img, x, y, size, angle, []int{
+		q, 0,
+		size, q,
+		size, m,
+		q, 0,
+	})
+}
+
+// b22
+//
+//	----------
+//	| ####   |
+//	|##  ### |
+//	|##    ##|
+//	|##    ##|
+//	|#      #|
+//	----------
+func b22(img *image.Paletted, x, y, size, angle int) {
+	m := size / 2
+	q := size / 4
+
+	drawBlock(img, x, y, size, angle, []int{
+		q, 0,
+		0, size,
+		0, m,
+		q, 0,
+	})
+
+	drawBlock(img, x, y, size, angle, []int{
+		q, 0,
+		size, q,
+		size, size,
+		q, 0,
+	})
+}
+
+// b23
+//
+//	----------
+//	| #######|
+//	|###    #|
+//	|##      |
+//	|##      |
+//	|#       |
+//	----------
+func b23(img *image.Paletted, x, y, size, angle int) {
+	m := size / 2
+	q := size / 4
+
+	drawBlock(img, x, y, size, angle, []int{
+		q, 0,
+		0, size,
+		0, m,
+		q, 0,
+	})
+
+	drawBlock(img, x, y, size, angle, []int{
+		q, 0,
+		size, 0,
+		size, q,
+		q, 0,
+	})
+}
+
+// b24
+//
+//	----------
+//	| ##  ###|
+//	|###  ###|
+//	|##  ##  |
+//	|##  ##  |
+//	|#   #   |
+//	----------
+func b24(img *image.Paletted, x, y, size, angle int) {
+	m := size / 2
+	q := size / 4
+
+	drawBlock(img, x, y, size, angle, []int{
+		q, 0,
+		0, size,
+		0, m,
+		q, 0,
+	})
+
+	drawBlock(img, x, y, size, angle, []int{
+		m, 0,
+		size, 0,
+		m, size,
+		m, 0,
+	})
+}
+
+// b25
+//
+//	----------
+//	|#      #|
+//	|##   ###|
+//	|##  ##  |
+//	|######  |
+//	|####    |
+//	----------
+func b25(img *image.Paletted, x, y, size, angle int) {
+	m := size / 2
+	q := size / 4
+
+	drawBlock(img, x, y, size, angle, []int{
+		0, 0,
+		0, size,
+		q, size,
+		0, 0,
+	})
+
+	drawBlock(img, x, y, size, angle, []int{
+		0, m,
+		size, 0,
+		q, size,
+		0, m,
+	})
+}
+
+// b26
+//
+//	----------
+//	|#      #|
+//	|###  ###|
+//	|  ####  |
+//	|###  ###|
+//	|#      #|
+//	----------
+func b26(img *image.Paletted, x, y, size, angle int) {
+	m := size / 2
+	q := size / 4
+
+	drawBlock(img, x, y, size, angle, []int{
+		0, 0,
+		m, q,
+		q, m,
+		0, 0,
+	})
+
+	drawBlock(img, x, y, size, angle, []int{
+		size, 0,
+		m + q, m,
+		m, q,
+		size, 0,
+	})
+
+	drawBlock(img, x, y, size, angle, []int{
+		size, size,
+		m, m + q,
+		q + m, m,
+		size, size,
+	})
+
+	drawBlock(img, x, y, size, angle, []int{
+		0, size,
+		q, m,
+		m, q + m,
+		0, size,
+	})
+}
+
+// b27
+//
+//	----------
+//	|########|
+//	|##   ###|
+//	|#      #|
+//	|###   ##|
+//	|########|
+//	----------
+func b27(img *image.Paletted, x, y, size, angle int) {
+	m := size / 2
+	q := size / 4
+
+	drawBlock(img, x, y, size, angle, []int{
+		0, 0,
+		size, 0,
+		0, q,
+		0, 0,
+	})
+
+	drawBlock(img, x, y, size, angle, []int{
+		q + m, 0,
+		size, 0,
+		size, size,
+		q + m, 0,
+	})
+
+	drawBlock(img, x, y, size, angle, []int{
+		size, q + m,
+		size, size,
+		0, size,
+		size, q + m,
+	})
+
+	drawBlock(img, x, y, size, angle, []int{
+		0, size,
+		0, 0,
+		q, size,
+		0, size,
+	})
+}
diff --git a/modules/avatar/identicon/colors.go b/modules/avatar/identicon/colors.go
new file mode 100644
index 0000000..09a98bd
--- /dev/null
+++ b/modules/avatar/identicon/colors.go
@@ -0,0 +1,134 @@
+// Copyright 2021 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package identicon
+
+import "image/color"
+
+// DarkColors are dark colors for avatar blocks, they come from image/color/palette.WebSafe, and light colors (0xff) are removed
+var DarkColors = []color.Color{
+	color.RGBA{0x00, 0x00, 0x33, 0xff},
+	color.RGBA{0x00, 0x00, 0x66, 0xff},
+	color.RGBA{0x00, 0x00, 0x99, 0xff},
+	color.RGBA{0x00, 0x00, 0xcc, 0xff},
+	color.RGBA{0x00, 0x33, 0x00, 0xff},
+	color.RGBA{0x00, 0x33, 0x33, 0xff},
+	color.RGBA{0x00, 0x33, 0x66, 0xff},
+	color.RGBA{0x00, 0x33, 0x99, 0xff},
+	color.RGBA{0x00, 0x33, 0xcc, 0xff},
+	color.RGBA{0x00, 0x66, 0x00, 0xff},
+	color.RGBA{0x00, 0x66, 0x33, 0xff},
+	color.RGBA{0x00, 0x66, 0x66, 0xff},
+	color.RGBA{0x00, 0x66, 0x99, 0xff},
+	color.RGBA{0x00, 0x66, 0xcc, 0xff},
+	color.RGBA{0x00, 0x99, 0x00, 0xff},
+	color.RGBA{0x00, 0x99, 0x33, 0xff},
+	color.RGBA{0x00, 0x99, 0x66, 0xff},
+	color.RGBA{0x00, 0x99, 0x99, 0xff},
+	color.RGBA{0x00, 0x99, 0xcc, 0xff},
+	color.RGBA{0x00, 0xcc, 0x00, 0xff},
+	color.RGBA{0x00, 0xcc, 0x33, 0xff},
+	color.RGBA{0x00, 0xcc, 0x66, 0xff},
+	color.RGBA{0x00, 0xcc, 0x99, 0xff},
+	color.RGBA{0x00, 0xcc, 0xcc, 0xff},
+	color.RGBA{0x33, 0x00, 0x00, 0xff},
+	color.RGBA{0x33, 0x00, 0x33, 0xff},
+	color.RGBA{0x33, 0x00, 0x66, 0xff},
+	color.RGBA{0x33, 0x00, 0x99, 0xff},
+	color.RGBA{0x33, 0x00, 0xcc, 0xff},
+	color.RGBA{0x33, 0x33, 0x00, 0xff},
+	color.RGBA{0x33, 0x33, 0x33, 0xff},
+	color.RGBA{0x33, 0x33, 0x66, 0xff},
+	color.RGBA{0x33, 0x33, 0x99, 0xff},
+	color.RGBA{0x33, 0x33, 0xcc, 0xff},
+	color.RGBA{0x33, 0x66, 0x00, 0xff},
+	color.RGBA{0x33, 0x66, 0x33, 0xff},
+	color.RGBA{0x33, 0x66, 0x66, 0xff},
+	color.RGBA{0x33, 0x66, 0x99, 0xff},
+	color.RGBA{0x33, 0x66, 0xcc, 0xff},
+	color.RGBA{0x33, 0x99, 0x00, 0xff},
+	color.RGBA{0x33, 0x99, 0x33, 0xff},
+	color.RGBA{0x33, 0x99, 0x66, 0xff},
+	color.RGBA{0x33, 0x99, 0x99, 0xff},
+	color.RGBA{0x33, 0x99, 0xcc, 0xff},
+	color.RGBA{0x33, 0xcc, 0x00, 0xff},
+	color.RGBA{0x33, 0xcc, 0x33, 0xff},
+	color.RGBA{0x33, 0xcc, 0x66, 0xff},
+	color.RGBA{0x33, 0xcc, 0x99, 0xff},
+	color.RGBA{0x33, 0xcc, 0xcc, 0xff},
+	color.RGBA{0x66, 0x00, 0x00, 0xff},
+	color.RGBA{0x66, 0x00, 0x33, 0xff},
+	color.RGBA{0x66, 0x00, 0x66, 0xff},
+	color.RGBA{0x66, 0x00, 0x99, 0xff},
+	color.RGBA{0x66, 0x00, 0xcc, 0xff},
+	color.RGBA{0x66, 0x33, 0x00, 0xff},
+	color.RGBA{0x66, 0x33, 0x33, 0xff},
+	color.RGBA{0x66, 0x33, 0x66, 0xff},
+	color.RGBA{0x66, 0x33, 0x99, 0xff},
+	color.RGBA{0x66, 0x33, 0xcc, 0xff},
+	color.RGBA{0x66, 0x66, 0x00, 0xff},
+	color.RGBA{0x66, 0x66, 0x33, 0xff},
+	color.RGBA{0x66, 0x66, 0x66, 0xff},
+	color.RGBA{0x66, 0x66, 0x99, 0xff},
+	color.RGBA{0x66, 0x66, 0xcc, 0xff},
+	color.RGBA{0x66, 0x99, 0x00, 0xff},
+	color.RGBA{0x66, 0x99, 0x33, 0xff},
+	color.RGBA{0x66, 0x99, 0x66, 0xff},
+	color.RGBA{0x66, 0x99, 0x99, 0xff},
+	color.RGBA{0x66, 0x99, 0xcc, 0xff},
+	color.RGBA{0x66, 0xcc, 0x00, 0xff},
+	color.RGBA{0x66, 0xcc, 0x33, 0xff},
+	color.RGBA{0x66, 0xcc, 0x66, 0xff},
+	color.RGBA{0x66, 0xcc, 0x99, 0xff},
+	color.RGBA{0x66, 0xcc, 0xcc, 0xff},
+	color.RGBA{0x99, 0x00, 0x00, 0xff},
+	color.RGBA{0x99, 0x00, 0x33, 0xff},
+	color.RGBA{0x99, 0x00, 0x66, 0xff},
+	color.RGBA{0x99, 0x00, 0x99, 0xff},
+	color.RGBA{0x99, 0x00, 0xcc, 0xff},
+	color.RGBA{0x99, 0x33, 0x00, 0xff},
+	color.RGBA{0x99, 0x33, 0x33, 0xff},
+	color.RGBA{0x99, 0x33, 0x66, 0xff},
+	color.RGBA{0x99, 0x33, 0x99, 0xff},
+	color.RGBA{0x99, 0x33, 0xcc, 0xff},
+	color.RGBA{0x99, 0x66, 0x00, 0xff},
+	color.RGBA{0x99, 0x66, 0x33, 0xff},
+	color.RGBA{0x99, 0x66, 0x66, 0xff},
+	color.RGBA{0x99, 0x66, 0x99, 0xff},
+	color.RGBA{0x99, 0x66, 0xcc, 0xff},
+	color.RGBA{0x99, 0x99, 0x00, 0xff},
+	color.RGBA{0x99, 0x99, 0x33, 0xff},
+	color.RGBA{0x99, 0x99, 0x66, 0xff},
+	color.RGBA{0x99, 0x99, 0x99, 0xff},
+	color.RGBA{0x99, 0x99, 0xcc, 0xff},
+	color.RGBA{0x99, 0xcc, 0x00, 0xff},
+	color.RGBA{0x99, 0xcc, 0x33, 0xff},
+	color.RGBA{0x99, 0xcc, 0x66, 0xff},
+	color.RGBA{0x99, 0xcc, 0x99, 0xff},
+	color.RGBA{0x99, 0xcc, 0xcc, 0xff},
+	color.RGBA{0xcc, 0x00, 0x00, 0xff},
+	color.RGBA{0xcc, 0x00, 0x33, 0xff},
+	color.RGBA{0xcc, 0x00, 0x66, 0xff},
+	color.RGBA{0xcc, 0x00, 0x99, 0xff},
+	color.RGBA{0xcc, 0x00, 0xcc, 0xff},
+	color.RGBA{0xcc, 0x33, 0x00, 0xff},
+	color.RGBA{0xcc, 0x33, 0x33, 0xff},
+	color.RGBA{0xcc, 0x33, 0x66, 0xff},
+	color.RGBA{0xcc, 0x33, 0x99, 0xff},
+	color.RGBA{0xcc, 0x33, 0xcc, 0xff},
+	color.RGBA{0xcc, 0x66, 0x00, 0xff},
+	color.RGBA{0xcc, 0x66, 0x33, 0xff},
+	color.RGBA{0xcc, 0x66, 0x66, 0xff},
+	color.RGBA{0xcc, 0x66, 0x99, 0xff},
+	color.RGBA{0xcc, 0x66, 0xcc, 0xff},
+	color.RGBA{0xcc, 0x99, 0x00, 0xff},
+	color.RGBA{0xcc, 0x99, 0x33, 0xff},
+	color.RGBA{0xcc, 0x99, 0x66, 0xff},
+	color.RGBA{0xcc, 0x99, 0x99, 0xff},
+	color.RGBA{0xcc, 0x99, 0xcc, 0xff},
+	color.RGBA{0xcc, 0xcc, 0x00, 0xff},
+	color.RGBA{0xcc, 0xcc, 0x33, 0xff},
+	color.RGBA{0xcc, 0xcc, 0x66, 0xff},
+	color.RGBA{0xcc, 0xcc, 0x99, 0xff},
+	color.RGBA{0xcc, 0xcc, 0xcc, 0xff},
+}
diff --git a/modules/avatar/identicon/identicon.go b/modules/avatar/identicon/identicon.go
new file mode 100644
index 0000000..4047156
--- /dev/null
+++ b/modules/avatar/identicon/identicon.go
@@ -0,0 +1,140 @@
+// Copyright 2021 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+// Copied and modified from https://github.com/issue9/identicon/ (MIT License)
+// Generate pseudo-random avatars by IP, E-mail, etc.
+
+package identicon
+
+import (
+	"crypto/sha256"
+	"fmt"
+	"image"
+	"image/color"
+)
+
+const minImageSize = 16
+
+// Identicon is used to generate pseudo-random avatars
+type Identicon struct {
+	foreColors []color.Color
+	backColor  color.Color
+	size       int
+	rect       image.Rectangle
+}
+
+// New returns an Identicon struct with the correct settings
+// size image size
+// back background color
+// fore all possible foreground colors. only one foreground color will be picked randomly for one image
+func New(size int, back color.Color, fore ...color.Color) (*Identicon, error) {
+	if len(fore) == 0 {
+		return nil, fmt.Errorf("foreground is not set")
+	}
+
+	if size < minImageSize {
+		return nil, fmt.Errorf("size %d is smaller than min size %d", size, minImageSize)
+	}
+
+	return &Identicon{
+		foreColors: fore,
+		backColor:  back,
+		size:       size,
+		rect:       image.Rect(0, 0, size, size),
+	}, nil
+}
+
+// Make generates an avatar by data
+func (i *Identicon) Make(data []byte) image.Image {
+	h := sha256.New()
+	h.Write(data)
+	sum := h.Sum(nil)
+
+	b1 := int(sum[0]+sum[1]+sum[2]) % len(blocks)
+	b2 := int(sum[3]+sum[4]+sum[5]) % len(blocks)
+	c := int(sum[6]+sum[7]+sum[8]) % len(centerBlocks)
+	b1Angle := int(sum[9]+sum[10]) % 4
+	b2Angle := int(sum[11]+sum[12]) % 4
+	foreColor := int(sum[11]+sum[12]+sum[15]) % len(i.foreColors)
+
+	return i.render(c, b1, b2, b1Angle, b2Angle, foreColor)
+}
+
+func (i *Identicon) render(c, b1, b2, b1Angle, b2Angle, foreColor int) image.Image {
+	p := image.NewPaletted(i.rect, []color.Color{i.backColor, i.foreColors[foreColor]})
+	drawBlocks(p, i.size, centerBlocks[c], blocks[b1], blocks[b2], b1Angle, b2Angle)
+	return p
+}
+
+/*
+# Algorithm
+
+Origin: An image is split into 9 areas
+
+```
+  -------------
+  | 1 | 2 | 3 |
+  -------------
+  | 4 | 5 | 6 |
+  -------------
+  | 7 | 8 | 9 |
+  -------------
+```
+
+Area 1/3/9/7 use a 90-degree rotating pattern.
+Area 1/3/9/7 use another 90-degree rotating pattern.
+Area 5 uses a random pattern.
+
+The Patched Fix: make the image left-right mirrored to get rid of something like "swastika"
+*/
+
+// draw blocks to the paletted
+// c: the block drawer for the center block
+// b1,b2: the block drawers for other blocks (around the center block)
+// b1Angle,b2Angle: the angle for the rotation of b1/b2
+func drawBlocks(p *image.Paletted, size int, c, b1, b2 blockFunc, b1Angle, b2Angle int) {
+	nextAngle := func(a int) int {
+		return (a + 1) % 4
+	}
+
+	padding := (size % 3) / 2 // in cased the size can not be aligned by 3 blocks.
+
+	blockSize := size / 3
+	twoBlockSize := 2 * blockSize
+
+	// center
+	c(p, blockSize+padding, blockSize+padding, blockSize, 0)
+
+	// left top (1)
+	b1(p, 0+padding, 0+padding, blockSize, b1Angle)
+	// center top (2)
+	b2(p, blockSize+padding, 0+padding, blockSize, b2Angle)
+
+	b1Angle = nextAngle(b1Angle)
+	b2Angle = nextAngle(b2Angle)
+	// right top (3)
+	// b1(p, twoBlockSize+padding, 0+padding, blockSize, b1Angle)
+	// right middle (6)
+	// b2(p, twoBlockSize+padding, blockSize+padding, blockSize, b2Angle)
+
+	b1Angle = nextAngle(b1Angle)
+	b2Angle = nextAngle(b2Angle)
+	// right bottom (9)
+	// b1(p, twoBlockSize+padding, twoBlockSize+padding, blockSize, b1Angle)
+	// center bottom (8)
+	b2(p, blockSize+padding, twoBlockSize+padding, blockSize, b2Angle)
+
+	b1Angle = nextAngle(b1Angle)
+	b2Angle = nextAngle(b2Angle)
+	// lef bottom (7)
+	b1(p, 0+padding, twoBlockSize+padding, blockSize, b1Angle)
+	// left middle (4)
+	b2(p, 0+padding, blockSize+padding, blockSize, b2Angle)
+
+	// then we make it left-right mirror, so we didn't draw 3/6/9 before
+	for x := 0; x < size/2; x++ {
+		for y := 0; y < size; y++ {
+			p.SetColorIndex(size-x, y, p.ColorIndexAt(x, y))
+		}
+	}
+}
diff --git a/modules/avatar/identicon/identicon_test.go b/modules/avatar/identicon/identicon_test.go
new file mode 100644
index 0000000..88702b0
--- /dev/null
+++ b/modules/avatar/identicon/identicon_test.go
@@ -0,0 +1,39 @@
+// Copyright 2021 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+//go:build test_avatar_identicon
+
+package identicon
+
+import (
+	"image/color"
+	"image/png"
+	"os"
+	"strconv"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestGenerate(t *testing.T) {
+	dir, _ := os.Getwd()
+	dir = dir + "/testdata"
+	if st, err := os.Stat(dir); err != nil || !st.IsDir() {
+		t.Errorf("can not save generated images to %s", dir)
+	}
+
+	backColor := color.White
+	imgMaker, err := New(64, backColor, DarkColors...)
+	require.NoError(t, err)
+	for i := 0; i < 100; i++ {
+		s := strconv.Itoa(i)
+		img := imgMaker.Make([]byte(s))
+
+		f, err := os.Create(dir + "/" + s + ".png")
+		require.NoError(t, err)
+
+		defer f.Close()
+		err = png.Encode(f, img)
+		require.NoError(t, err)
+	}
+}
diff --git a/modules/avatar/identicon/polygon.go b/modules/avatar/identicon/polygon.go
new file mode 100644
index 0000000..ecfc179
--- /dev/null
+++ b/modules/avatar/identicon/polygon.go
@@ -0,0 +1,68 @@
+// Copyright 2021 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+// Copied and modified from https://github.com/issue9/identicon/ (MIT License)
+
+package identicon
+
+var (
+	// cos(0),cos(90),cos(180),cos(270)
+	cos = []int{1, 0, -1, 0}
+
+	// sin(0),sin(90),sin(180),sin(270)
+	sin = []int{0, 1, 0, -1}
+)
+
+// rotate the points by center point (x,y)
+// angle: [0,1,2,3] means [0，90，180，270] degree
+func rotate(points []int, x, y, angle int) {
+	// the angle is only used internally, and it has been guaranteed to be 0/1/2/3, so we do not check it again
+	for i := 0; i < len(points); i += 2 {
+		px, py := points[i]-x, points[i+1]-y
+		points[i] = px*cos[angle] - py*sin[angle] + x
+		points[i+1] = px*sin[angle] + py*cos[angle] + y
+	}
+}
+
+// check whether the point is inside the polygon (defined by the points)
+// the first and the last point must be the same
+func pointInPolygon(x, y int, polygonPoints []int) bool {
+	if len(polygonPoints) < 8 { // a valid polygon must have more than 2 points
+		return false
+	}
+
+	// reference: nonzero winding rule, https://en.wikipedia.org/wiki/Nonzero-rule
+	// split the plane into two by the check point horizontally:
+	//   y>0，includes (x>0 && y==0)
+	//   y<0，includes (x<0 && y==0)
+	//
+	// then scan every point in the polygon.
+	//
+	// if current point and previous point are in different planes (eg: curY>0 && prevY<0),
+	// check the clock-direction from previous point to current point (use check point as origin).
+	// if the direction is clockwise, then r++, otherwise then r--
+	// finally, if 2==abs(r), then the check point is inside the polygon
+
+	r := 0
+	prevX, prevY := polygonPoints[0], polygonPoints[1]
+	prev := (prevY > y) || ((prevX > x) && (prevY == y))
+	for i := 2; i < len(polygonPoints); i += 2 {
+		currX, currY := polygonPoints[i], polygonPoints[i+1]
+		curr := (currY > y) || ((currX > x) && (currY == y))
+
+		if curr == prev {
+			prevX, prevY = currX, currY
+			continue
+		}
+
+		if mul := (prevX-x)*(currY-y) - (currX-x)*(prevY-y); mul >= 0 {
+			r++
+		} else { // mul < 0
+			r--
+		}
+		prevX, prevY = currX, currY
+		prev = curr
+	}
+
+	return r == 2 || r == -2
+}
diff --git a/modules/avatar/identicon/testdata/.gitignore b/modules/avatar/identicon/testdata/.gitignore
new file mode 100644
index 0000000..72e8ffc
--- /dev/null
+++ b/modules/avatar/identicon/testdata/.gitignore
@@ -0,0 +1 @@
+*
diff --git a/modules/avatar/testdata/animated.webp b/modules/avatar/testdata/animated.webp
new file mode 100644
index 0000000..4c05f46
--- /dev/null
+++ b/modules/avatar/testdata/animated.webp
diff --git a/modules/avatar/testdata/avatar.jpeg b/modules/avatar/testdata/avatar.jpeg
new file mode 100644
index 0000000..892b7ba
--- /dev/null
+++ b/modules/avatar/testdata/avatar.jpeg
diff --git a/modules/avatar/testdata/avatar.png b/modules/avatar/testdata/avatar.png
new file mode 100644
index 0000000..c0f7922
--- /dev/null
+++ b/modules/avatar/testdata/avatar.png