diff --git a/app/lib/server/functions/sendMessage.js b/app/lib/server/functions/sendMessage.js index 184f6e07f6224..a596d957b0403 100644 --- a/app/lib/server/functions/sendMessage.js +++ b/app/lib/server/functions/sendMessage.js @@ -148,7 +148,7 @@ const validateUserIdentity = (message, _id) => { if (!message.alias && !message.avatar) { return; } - const forbiddenPropsToChangeWhenUserIsNotABot = ['alias', 'avatar']; + const forbiddenPropsToChangeWhenUserIsNotABot = ['avatar']; const user = Users.findOneById(_id, { fields: { roles: 1, name: 1 } }); /** * If the query returns no user, the message has likely @@ -160,7 +160,7 @@ const validateUserIdentity = (message, _id) => { } const userIsNotABot = !user.roles.includes('bot'); const messageContainsAnyForbiddenProp = Object.keys(message).some((key) => forbiddenPropsToChangeWhenUserIsNotABot.includes(key)); - if ((userIsNotABot && messageContainsAnyForbiddenProp) || (settings.get('Message_SetNameToAliasEnabled') && message.alias !== user.name)) { + if (userIsNotABot && (messageContainsAnyForbiddenProp || (typeof message.alias !== 'undefined' && message.alias !== user.name))) { throw new Error('You are not authorized to change message properties'); } };