User profile picture visibility settings not respected in Connect Apps for Confluence

Based on further investigation we have concluded that this is not a privacy issue.

We are not leaking any photos of other users. Their privacy settings are being properly respected.

The difference between confluence and Jira lies in how we return URLs for the photos. Confluence returns a URL back to the user within our own system, which then gets called to fetch the photo, behind the scenes we then call the avatar management service to get the user's photo and return this URL to the browser for it to be rendered. JIRA directly returns this URL for the avatar management service.

The difference is then in the fact that Jira hardcodes these URLs into the response, and since to GET the user data it was the APP making the request, the profile photo is also assumed to be the APP calling it, and thus the APP shouldn't have access.

In confluence, we return a URL that then gets evaluated in our system and turned into a redirect. The difference is this URL in our system gets called at page display time from the BROWSER itself (as the logged-in user).