Read-Only mode allows multiple changes to occur that should be restricted

[DieselTech]

What happened?

When a user is set to Read-Only mode they are still able to make a lot of changes that should be restricted:

• Adding and deleting reading lists
• Can download and apply themes
• Add and remove devices
• Change locale language
• Can add external sources that point to other websites outside of kavita

Trying to set a different email does log the user out, but it doesn't change the email address directly. Ideally it should error 400 like all the other attempts to change the user profile.

What did you expect?

To be proper read-only and unable to add or delete things.

Kavita Version Number - If you don not see your version number listed, please update Kavita and see if your issue still persists.

0.8.3 - Stable

What operating system is Kavita being hosted from?

None

If the issue is being seen on Desktop, what OS are you running where you see the issue?

None

If the issue is being seen in the UI, what browsers are you seeing the problem on?

No response

If the issue is being seen on Mobile, what OS are you running where you see the issue?

None

If the issue is being seen on the Mobile UI, what browsers are you seeing the problem on?

No response

Relevant log output

No response

Additional Notes

No response

[majora2007]

This is a note for myself that I will go forward with these restrictions.

Originally I had wanted the readonly account to have some customization, but after using our demo site many times, I should restrict this up to be what the name implies.