From 0418a92c4837de0169a0173ef202d28494a86b23 Mon Sep 17 00:00:00 2001
From: Marius Balteanu <marius.balteanu@zitec.com>
Date: Sat, 28 May 2022 09:55:51 +0000
Subject: [PATCH] Merged r21606 to 5.0-stable (#37157).

git-svn-id: https://svn.redmine.org/redmine/branches/5.0-stable@21615 e93f8b46-1217-0410-a6f0-8f06a7374b81
---
 app/views/users/show.api.rsb            |  2 +-
 test/integration/api_test/users_test.rb | 18 ++++++++++++++++++
 2 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/app/views/users/show.api.rsb b/app/views/users/show.api.rsb
index f6a323265..d84be914e 100644
--- a/app/views/users/show.api.rsb
+++ b/app/views/users/show.api.rsb
@@ -9,7 +9,7 @@ api.user do
   api.updated_on @user.updated_on
   api.last_login_on     @user.last_login_on
   api.passwd_changed_on @user.passwd_changed_on
-  api.avatar_url gravatar_url(@user.mail, {rating: nil, size: nil, default: Setting.gravatar_default}) if Setting.gravatar_enabled?
+  api.avatar_url gravatar_url(@user.mail, {rating: nil, size: nil, default: Setting.gravatar_default}) if @user.mail && Setting.gravatar_enabled?
   api.twofa_scheme      @user.twofa_scheme if User.current.admin? || (User.current == @user)
   api.api_key    @user.api_key if User.current.admin? || (User.current == @user)
   api.status     @user.status if User.current.admin?
diff --git a/test/integration/api_test/users_test.rb b/test/integration/api_test/users_test.rb
index 26473356a..8444500d9 100644
--- a/test/integration/api_test/users_test.rb
+++ b/test/integration/api_test/users_test.rb
@@ -96,6 +96,24 @@ class Redmine::ApiTest::UsersTest < Redmine::ApiTest::Base
     assert_select 'user avatar_url', :text => %r|\Ahttps://gravatar.com/avatar/\h{32}\?default=robohash|
   end
 
+  test "GET /users/:id.xml should not return avatar_url when not set email address" do
+    user = User.find(2)
+    user.email_addresses.delete_all
+    assert_equal 'jsmith', user.login
+    assert_nil user.mail
+
+    Redmine::Configuration.with 'avatar_server_url' => 'https://gravatar.com' do
+      with_settings :gravatar_enabled => '1', :gravatar_default => 'robohash' do
+        get '/users/2.xml'
+      end
+    end
+
+    assert_response :success
+    assert_select 'user id', :text => '2'
+    assert_select 'user login', :text => 'jsmith'
+    assert_select 'user avatar_url', :count => 0
+  end
+
   test "GET /users/:id.json should return the user" do
     get '/users/2.json'
 
-- 
2.39.5