Answers.Body: <blockquote>
    <p>Since I use email addresses as usernames, I don’t think it’s a good idea to expose the email addresses of all users on the web.</p>
  </blockquote>
  
  <p>I agree, and that's something we overlooked when we added the '<a href="http://buildwithcraft.com/docs/config-settings#useEmailAsUsername" rel="nofollow">useEmailAsUsername</a>' config setting.</p>
  
  <blockquote>
    <p>Question: Is there a way to remove the username (in my case email address) from the photo path and replace it with the users ID for example?</p>
  </blockquote>
  
  <p>Currently not, unfortunately.  And it's hard-coded so there really isn't a chance for a plugin to override the behavior.  And I don't think it's really any better to be displaying a user's ID or UID as well, since people wouldn't expect those to be publicly available by default.</p>
  
  <blockquote>
    <p>Bonus question: is there any way to protect user photos from access at all? It looks to me like the urls to the user photos could be guessed quite easily.</p>
  </blockquote>
  
  <p>Again, no.</p>
  
  <p>I think the proper solution to both problems would be, upon uploading a user profile photo, generate a random string and save that along with the user in the database.  The string would be used in the URL when retrieving the user's profile photo. </p>
  
  <p>I'll add it to our list to address.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2014-12-02T07:23:05.027Z
Answers.Text: Thanks for the insights! Do you have any idea when this issue will be addressed? Days, weeks, month, years? :)
Answers.UserDisplayName: medoingthings
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2014-12-02T07:29:18.213Z
Answers.Text: Would be interesting to know if it’s an option for me to hold back the user photo feature until this is fixed.
Answers.UserDisplayName: medoingthings
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2014-12-15T18:58:35.297Z
Answers.Text: can you tell anything about a rough timeline here? Sorry for bothering you with this.
Answers.UserDisplayName: medoingthings
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2014-12-15T19:03:21.220Z
Answers.Text: Sorry, no ETA, but it is still on our list.
Answers.UserDisplayName: Brad Bell
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2014-11-30T23:47:54.863Z
Answers.LastActivityDate: 2014-11-30T23:47:54.863Z
Answers.UserDisplayName: Brad Bell
Body: <p>I just realized that Craft puts the username into the path of the <code>photoUrl</code>. Since I use email addresses as usernames, I don’t think it’s a good idea to expose the email addresses of all users on the web.</p>
  
  <p><strong>Question:</strong> Is there a way to remove the username (in my case email address) from the photo path and replace it with the users ID for example?</p>
  
  <p>I would like to get around adding a new asset field for every user, since the user photo would be fine.</p>
  
  <p><strong>Bonus question:</strong> is there any way to protect user photos from access at all? It looks to me like the urls to the user photos could be guessed quite easily.</p>
  
  <p>Best, Mark</p>
  
Tags: <user-profile><usermodel>
Title: Remove username from photoUrl path
ThreadText: # Remove username from photoUrl path
  
  (Asked by: username_0 on 2014-11-30)
  
  I just realized that Craft puts the username into the path of the `photoUrl`. Since I use email addresses as usernames, I don’t think it’s a good idea to expose the email addresses of all users on the web.
  
  **Question:** Is there a way to remove the username (in my case email address) from the photo path and replace it with the users ID for example?
  
  I would like to get around adding a new asset field for every user, since the user photo would be fine.
  
  **Bonus question:** is there any way to protect user photos from access at all? It looks to me like the urls to the user photos could be guessed quite easily.
  
  Best, Mark
  
  **Tags:** user-profile, usermodel
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2014-11-30. Score: 3 | Accepted answer
  
  > Since I use email addresses as usernames, I don’t think it’s a good idea to expose the email addresses of all users on the web.
  
  I agree, and that's something we overlooked when we added the '[useEmailAsUsername](http://buildwithcraft.com/docs/config-settings#useEmailAsUsername)' config setting.
  
  > Question: Is there a way to remove the username (in my case email address) from the photo path and replace it with the users ID for example?
  
  Currently not, unfortunately. And it's hard-coded so there really isn't a chance for a plugin to override the behavior. And I don't think it's really any better to be displaying a user's ID or UID as well, since people wouldn't expect those to be publicly available by default.
  
  > Bonus question: is there any way to protect user photos from access at all? It looks to me like the urls to the user photos could be guessed quite easily.
  
  Again, no.
  
  I think the proper solution to both problems would be, upon uploading a user profile photo, generate a random string and save that along with the user in the database. The string would be used in the URL when retrieving the user's profile photo.
  
  I'll add it to our list to address.
  
  > **Comments:**
  > **username_0**: Thanks for the insights! Do you have any idea when this issue will be addressed? Days, weeks, month, years? :)  
  > **username_0**: Would be interesting to know if it’s an option for me to hold back the user photo feature until this is fixed.  
  > **username_0**: can you tell anything about a rough timeline here? Sorry for bothering you with this.  
  > **username_1**: Sorry, no ETA, but it is still on our list.  
  
  ---
  
  