Comparing a48f29abff..bf76ab1ddf - meet

gsadmin/meet

Fork 0

mirror of https://github.com/suitenumerique/meet.git synced 2026-09-09 08:55:42 +00:00

Author	SHA1	Message	Date
lebaudantoine	bf76ab1ddf	🔒️(backend) enforce display name setting on rename API AUTHENTICATED_PARTICIPANTS_CAN_EDIT_DISPLAY_NAME was only enforced at LiveKit token generation and by hiding the name field in the frontend. The `rooms/{id}/rename/` endpoint never checked it, so any authenticated user with a valid room token could rename themselves via the API even when the self-hoster had disabled it. Return 403 from the rename action for authenticated users when the setting is disabled, mirroring the `can_edit` rule in `core.utils.generate_token`. Anonymous participants are unaffected, as they have no account name to fall back on. Add tests covering the disabled/enabled cases for authenticated users and the anonymous exception.	2026-09-08 01:26:27 +02:00

Author

SHA1

Message

Date

lebaudantoine

bf76ab1ddf

🔒️(backend) enforce display name setting on rename API

AUTHENTICATED_PARTICIPANTS_CAN_EDIT_DISPLAY_NAME was only enforced at
LiveKit token generation and by hiding the name field in the frontend.
The `rooms/{id}/rename/` endpoint never checked it, so any authenticated
user with a valid room token could rename themselves via the API even
when the self-hoster had disabled it.

Return 403 from the rename action for authenticated users when the
setting is disabled, mirroring the `can_edit` rule in
`core.utils.generate_token`. Anonymous participants are unaffected, as
they have no account name to fall back on.

Add tests covering the disabled/enabled cases for authenticated users
and the anonymous exception.

2026-09-08 01:26:27 +02:00

Compare commits

1 Commits

fix/enforce-display-name-api .. main

Diff Content Not Available

Compare commits

1 Commits fix/enforce-display-name-api .. main

Diff Content Not Available

1 Commits

fix/enforce-display-name-api .. main