Fix validity of users avatars not checked in management panel

Fixes #490.

flaskbb/management/forms.py

@@ -9,22 +9,24 @@
     :license: BSD, see LICENSE for more details.
 """
 import logging
+
+from flask_allows import Permission
+from flask_babelplus import lazy_gettext as _
 from flask_wtf import FlaskForm
+from sqlalchemy.orm.session import make_transient, make_transient_to_detached
 from wtforms import (BooleanField, HiddenField, IntegerField, PasswordField,
                      SelectField, StringField, SubmitField, TextAreaField)
-from wtforms.validators import (DataRequired, Optional, Email, regexp, Length,
-                                URL, ValidationError)
 from wtforms.ext.sqlalchemy.fields import (QuerySelectField,
                                            QuerySelectMultipleField)
-from sqlalchemy.orm.session import make_transient, make_transient_to_detached
-from flask_babelplus import lazy_gettext as _
+from wtforms.validators import (URL, DataRequired, Email, Length, Optional,
+                                ValidationError, regexp)
 
-from flaskbb.utils.fields import BirthdayField
 from flaskbb.extensions import db
-from flaskbb.forum.models import Forum, Category
-from flaskbb.user.models import User, Group
+from flaskbb.forum.models import Category, Forum
+from flaskbb.user.models import Group, User
+from flaskbb.utils.fields import BirthdayField
+from flaskbb.utils.helpers import check_image
 from flaskbb.utils.requirements import IsAtleastModerator
-from flask_allows import Permission
 
 
 logger = logging.getLogger(__name__)
@@ -135,6 +137,13 @@ class UserForm(FlaskForm):
         if user:
             raise ValidationError(_("This email address is already taken."))
 
+    def validate_avatar(self, field):
+        if field.data is not None:
+            error, status = check_image(field.data)
+            if error is not None:
+                raise ValidationError(error)
+            return status
+
     def save(self):
         data = self.data
         data.pop('submit', None)