Don't allow the user to set fields they can't see

[nickvergessen]

Signed-off-by: Joas Schilling coding@schilljs.com

[schiessle]

looks good to me

[blizzz]

the same issue exists in settings/Controller/UserController

[codecov]

Codecov Report

Merging #5223 into master will decrease coverage by 22.87%.
The diff coverage is 16.21%.

@@              Coverage Diff              @@
##             master    #5223       +/-   ##
=============================================
- Coverage     54.15%   31.27%   -22.88%     
- Complexity    22292    22305       +13     
=============================================
  Files          1379     1380        +1     
  Lines         85359    84813      -546     
  Branches       1321     1321               
=============================================
- Hits          46223    26526    -19697     
- Misses        39136    58287    +19151

Impacted Files	Coverage Δ	Complexity Δ
settings/Controller/UsersController.php	0% <0%> (-69.92%)	112 <0> (+3)
...rovisioning_api/lib/Controller/UsersController.php	81.21% <42.85%> (-1.89%)	116 <0> (+3)
...public/AppFramework/OCS/OCSBadRequestException.php	0% <0%> (-100%)	1% <0%> (ø)
apps/user_ldap/lib/Migration/UUIDFixUser.php	0% <0%> (-100%)	1% <0%> (ø)
...rivate/Authentication/Token/DefaultTokenMapper.php	0% <0%> (-100%)	11% <0%> (ø)
apps/files_sharing/lib/SharedPropagator.php	0% <0%> (-100%)	1% <0%> (ø)
apps/user_ldap/lib/Mapping/UserMapping.php	0% <0%> (-100%)	1% <0%> (ø)
apps/comments/lib/AppInfo/Application.php	0% <0%> (-100%)	1% <0%> (ø)
lib/private/Files/Mount/CacheMountProvider.php	0% <0%> (-100%)	4% <0%> (ø)
apps/files_trashbin/lib/AppInfo/Application.php	0% <0%> (-100%)	2% <0%> (ø)
... and 372 more

[nickvergessen]

Done @blizzz

[blizzz]

@nickvergessen thx, works!

[schiessle]

@nickvergessen seems like you need to adjust some tests...

[MorrisJobke]

@nickvergessen seems like you need to adjust some tests...

Ping

[nickvergessen]

Yeah morris, sorry there was a long weekend in german, will fix now.

[MorrisJobke]

Failing tests (autoloader) fixed in another PR already.

[MorrisJobke]

Let me backport this.

[skjnldsv]

Hey everyone!
Any reason we're forbidding the editing of email with this?
I think it should be more clear. The name of the config is allow_user_to_change_display_name it never mention email :)

Also, it now prevent admin to edit those fields if they're the current user, I think we should always let the admin edit those fields then. Thoughts? cc @rullzer

[nickvergessen]

The name of the config is allow_user_to_change_display_name it never mention email :)

Yeah well, this is one of the stories with a long history even on OC already.

Also, it now prevent admin to edit those fields if they're the current user, I think we should always let the admin edit those fields then.

fine by me