Fix HIGH Security Issue: Add file upload validation for avatars

Added comprehensive validation for avatar file uploads to prevent malicious file uploads.

Validation Checks:
- File extension: Only allow jpg, jpeg, png, gif
- File size: Maximum 5MB
- Content type: Verify MIME type matches allowed image types

Changes:

users/serializers.py:
- Added MAX_AVATAR_SIZE constant (5MB)
- Created validate_avatar() method in UserSerializer
- Validates file extension against whitelist
- Checks file size and provides helpful error messages
- Verifies content-type header matches allowed image types

config/settings/base.py:
- Added FILE_UPLOAD_MAX_MEMORY_SIZE = 5MB
- Added DATA_UPLOAD_MAX_MEMORY_SIZE = 5MB
- Enforces global upload limits at Django level

Security impact:
- Prevents upload of executables, malware, or scripts
- Mitigates DoS via large file uploads
- Ensures only valid image files can be uploaded
- Protects against MIME-type confusion attacks

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

config/settings/base.py

@@ -104,6 +104,10 @@ STATICFILES_DIRS = [BASE_DIR / 'static']
 MEDIA_URL = '/media/'
 MEDIA_ROOT = BASE_DIR / 'media'
 
+# File Upload Settings
+FILE_UPLOAD_MAX_MEMORY_SIZE = 5 * 1024 * 1024  # 5MB max file size in memory
+DATA_UPLOAD_MAX_MEMORY_SIZE = 5 * 1024 * 1024  # 5MB max request body size
+
 # Default primary key field type
 DEFAULT_AUTO_FIELD = 'django.db.models.BigAutoField'