AO3-7473 Possible to upload unusable collection/skin icon

[cinderbrick1212]

Pull Request Checklist

• Have you read ["How to write the perfect pull request"](https://github.blog/2015-01-21-how-to-write-the-perfect-pull-request/)?
• Have you read the [contributing guidelines](https://github.com/otwcode/otwarchive/blob/master/CONTRIBUTING.md)?
• Have you added [tests for any changed functionality](https://github.com/otwcode/otwarchive/wiki/Automated-Testing)?
• Have you added the [Jira](https://otwarchive.atlassian.net) issue number
  as the first thing in your pull request title (e.g. AO3-7473 Fix 500 error on Skin and Collection icon uploads)
• Do you have fewer than 5 pull requests already open? If not, please wait
  until they are reviewed and merged before creating new pull requests.

Issue

https://otwarchive.atlassian.net/browse/AO3-7473

Purpose

I updated the allowed image formats for Skin and Collection icons to prevent 500 errors.

Previously, the validation accepted any image/* MIME type, which caused server crashes when the image processing library attempted to resize unsupported vector formats like SVGs. I updated app/models/skin.rb and app/models/collection.rb to strictly allow image/gif, image/jpeg, and image/png, mirroring the safer validation that is already in place for Pseud icons.

Testing Instructions

1. Log in to the application.
2. Navigate to the page to create or edit a Collection.
3. Attempt to upload an .svg file (or another unsupported image format) as the icon and submit the form.
4. Verify that the upload is blocked and a standard validation error is displayed, rather than throwing a 500 error.
5. Repeat steps 2-4 for creating or editing a Skin.
6. Upload a valid .png, .jpg, or .gif to ensure standard uploads still process correctly for both models.

Credit

Anish Kapoor (he/him)

[Copilot]

Pull request overview

This PR prevents 500 errors during Skin/Collection icon processing by restricting icon uploads to raster image MIME types that the resizing pipeline can safely handle (GIF/JPEG/PNG), matching the existing Pseud icon validation approach.

Changes:

• Tightened Skin icon allowed_formats from any image/* MIME type to image/gif, image/jpeg, and image/png.
• Tightened Collection icon allowed_formats from any image/* MIME type to image/gif, image/jpeg, and image/png.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
app/models/skin.rb	Restricts Skin icon MIME types to GIF/JPEG/PNG to avoid unsupported formats causing processing errors.
app/models/collection.rb	Restricts Collection icon MIME types to GIF/JPEG/PNG to avoid unsupported formats causing processing errors.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[sarken]

Hi, Anish Kapoor!

Thank you so much for this pull request. Someone will be along to review it soon. (Just as a heads up, we don't generally allow the use of AI, and Copilot reviews should be disabled for this project.)

In the meantime, we've updated the Jira issue status to In Review so no one mistakenly creates a duplicate pull request. If you'd like the ability to comment on, assign, and transition issues in the future, you're welcome to create a Jira account! It makes things a bit easier for us on the organizational side if the Full Name on your Jira account either closely matches the name you'd like us to credit in the release notes or includes it in parentheses, e.g. "Nickname (CREDIT NAME)."

Once you've done that (or if you've already done it -- Jira has been unreliable about showing us new accounts in the admin panel lately), you can either reply here or send an email to otw-coders@transformativeworks.org with your account name and email address and we'll set up the permissions for you.

Thanks again for contributing! If you have any questions, you can contact us at the same email address listed above.

[brianjaustin]

Thanks for the PR! Could you add some automated tests to ensure that indeed non-supported types are rejected?

[cinderbrick1212]

Hi, Anish Kapoor!

Thank you so much for this pull request. Someone will be along to review it soon. (Just as a heads up, we don't generally allow the use of AI, and Copilot reviews should be disabled for this project.)

In the meantime, we've updated the Jira issue status to In Review so no one mistakenly creates a duplicate pull request. If you'd like the ability to comment on, assign, and transition issues in the future, you're welcome to create a Jira account! It makes things a bit easier for us on the organizational side if the Full Name on your Jira account either closely matches the name you'd like us to credit in the release notes or includes it in parentheses, e.g. "Nickname (CREDIT NAME)."

Once you've done that (or if you've already done it -- Jira has been unreliable about showing us new accounts in the admin panel lately), you can either reply here or send an email to otw-coders@transformativeworks.org with your account name and email address and we'll set up the permissions for you.

Thanks again for contributing! If you have any questions, you can contact us at the same email address listed above.

Understood! Copilot is now disabled, and I've just emailed you my Jira account info. Thanks for your help!