diff --git a/app/file-upload/server/lib/FileUpload.js b/app/file-upload/server/lib/FileUpload.js index 44aa37c170c3e..dc5a4d4db8d8a 100644 --- a/app/file-upload/server/lib/FileUpload.js +++ b/app/file-upload/server/lib/FileUpload.js @@ -181,7 +181,12 @@ export const FileUpload = { if (settings.get('Accounts_AvatarResize') !== true) { return; } - if (Meteor.userId() !== file.userId && !hasPermission(Meteor.userId(), 'edit-other-user-info')) { + + if (file.rid && !hasPermission(Meteor.userId(), 'edit-room-avatar', file.rid)) { + throw new Meteor.Error('error-not-allowed', 'Change avatar is not allowed'); + } + + if (file.userId && Meteor.userId() !== file.userId && !hasPermission(Meteor.userId(), 'edit-other-user-info')) { throw new Meteor.Error('error-not-allowed', 'Change avatar is not allowed'); }