2 files changed, 28 insertions, 0 deletions
diff --git a/collections/avatars.js b/collections/avatars.js
new file mode 100644
index 00000000..5ca074ee
--- /dev/null
+++ b/collections/avatars.js
@@ -0,0 +1,27 @@
+Avatars = new FS.Collection('avatars', {
+  stores: [
+    new FS.Store.GridFS('avatars')
+  ],
+  filter: {
+    maxSize: 32000,
+    allow: {
+      contentTypes: ['image/*']
+    }
+  }
+});
+
+var isOwner = function(userId, file) {
+  return userId && userId === file.userId;
+};
+
+Avatars.allow({
+  insert: isOwner,
+  update: isOwner,
+  remove: isOwner,
+  download: function() { return true; },
+  fetch: ['userId']
+});
+
+Avatars.files.before.insert(function(userId, doc) {
+  doc.userId = userId;
+});
diff --git a/collections/users.js b/collections/users.js
index 8d1c0d58..304011f6 100644
--- a/collections/users.js
+++ b/collections/users.js
@@ -43,6 +43,7 @@ Users.helpers({
 
 Meteor.methods({
   setUsername: function(username) {
+    check(username, String);
     var nUsersWithUsername = Users.find({username: username}).count();
     if (nUsersWithUsername > 0) {
       throw new Meteor.Error('username-already-taken');