Merge pull request #3179 from matrix-org/matthew/disable-set-profile

options to disable setting profile info

1 files changed, 10 insertions, 0 deletions

diff --git a/synapse/handlers/profile.py b/synapse/handlers/profile.py
index 195684c88c..29ccf23849 100644
--- a/synapse/handlers/profile.py
+++ b/synapse/handlers/profile.py
@@ -215,6 +215,11 @@ class ProfileHandler(BaseHandler):
         if not by_admin and target_user != requester.user:
             raise AuthError(400, "Cannot set another user's displayname")
 
+        if not by_admin and self.hs.config.disable_set_displayname:
+            profile = yield self.store.get_profileinfo(target_user.localpart)
+            if profile.display_name:
+                raise SynapseError(400, "Changing displayname is disabled on this server")
+
         if new_displayname == '':
             new_displayname = None
 
@@ -277,6 +282,11 @@ class ProfileHandler(BaseHandler):
         if not by_admin and target_user != requester.user:
             raise AuthError(400, "Cannot set another user's avatar_url")
 
+        if not by_admin and self.hs.config.disable_set_avatar_url:
+            profile = yield self.store.get_profileinfo(target_user.localpart)
+            if profile.avatar_url:
+                raise SynapseError(400, "Changing avatar url is disabled on this server")
+
         if len(self.hs.config.replicate_user_profiles_to) > 0:
             cur_batchnum = yield self.store.get_latest_profile_replication_batch_number()
             new_batchnum = 0 if cur_batchnum is None else cur_batchnum + 1