Skip to content

Forbid changing display name in local rooms if enable_set_displayname is disabled. #19811

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
bxdxnn wants to merge 4 commits into
base: develop
Choose a base branch
from
+29 −0
Open

Forbid changing display name in local rooms if enable_set_displayname is disabled. #19811

Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
73f199a
Forbid changing display name in local rooms if `enable_set_displaynam…
bxdxnn May 29, 2026
e5b39af
Update synapse/handlers/room_member.py
bxdxnn Jun 23, 2026
677b81a
Update synapse/handlers/room_member.py
bxdxnn Jun 23, 2026
26eb90e
Update
bxdxnn Jun 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 20 additions & 0 deletions synapse/handlers/room_member.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -831,6 +831,26 @@ async def update_membership_locked(
):
raise SynapseError(403, "This avatar is not allowed", Codes.FORBIDDEN)

# Check if the displayname in the membership event differs from what's
# stored in the user's profile when changing displayname is disabled.
Comment thread
bxdxnn marked this conversation as resolved.
Outdated
if (
self.hs.is_mine(target)
Comment thread
bxdxnn marked this conversation as resolved.
Outdated
and "displayname" in content
and not self.hs.config.registration.enable_set_displayname
):
is_admin = await self.auth.is_server_admin(requester)
if not is_admin:
profile = await self.store.get_profileinfo(target)
if (
profile.display_name is not None
Comment thread
bxdxnn marked this conversation as resolved.
Outdated
and content["displayname"] != profile.display_name
):
raise SynapseError(
400,
"Changing display name is disabled on this server",
Codes.FORBIDDEN,
)

# The event content should *not* include the authorising user as
# it won't be properly signed. Strip it out since it might come
# back from a client updating a display name / avatar.
Expand Down
Loading