Avatar upload lets one user overwrite another’s profile image

    public Result<Object> imgaeUpload(@RequestBody CommonDto common){
        String imgPath = memberService.imageUpload(common.getUserId(),common.getToken(),common.getImgData());
        return new ResultUtil<Object>().setData(imgPath);
    }

    public String imageUpload(Long userId,String token,String imgData) {
        TbMember tbMember=tbMemberMapper.selectByPrimaryKey(userId);
        // updates the target record with no token/userId consistency check
        tbMemberMapper.updateByPrimaryKey(tbMember);
        Member member=loginService.getUserByToken(token);
        member.setFile(imgPath);
        jedisClient.set("SESSION:" + token, new Gson().toJson(member));
        return imgPath;
    }