Prevent set avatar

RocketChat · Jan 28, 2020 · be07e28 · be07e28
1 parent 6d63fad
commit be07e28
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/app/lib/server/functions/sendMessage.js b/app/lib/server/functions/sendMessage.js
@@ -148,7 +148,7 @@ const validateUserIdentity = (message, _id) => {
 	if (!message.alias && !message.avatar) {
 		return;
 	}
-	const forbiddenPropsToChangeWhenUserIsNotABot = ['alias', 'avatar'];
+	const forbiddenPropsToChangeWhenUserIsNotABot = ['avatar'];
 	const user = Users.findOneById(_id, { fields: { roles: 1, name: 1 } });
 	/**
 	 * If the query returns no user, the message has likely
@@ -160,7 +160,7 @@ const validateUserIdentity = (message, _id) => {
 	}
 	const userIsNotABot = !user.roles.includes('bot');
 	const messageContainsAnyForbiddenProp = Object.keys(message).some((key) => forbiddenPropsToChangeWhenUserIsNotABot.includes(key));
-	if (userIsNotABot && messageContainsAnyForbiddenProp && message.alias !== user.name) {
+	if (userIsNotABot && (messageContainsAnyForbiddenProp || (typeof message.alias !== 'undefined' && message.alias !== user.name))) {
 		throw new Error('You are not authorized to change message properties');
 	}
 };