whitelist profile change

src/controllers/user.ts

@@ -56,15 +56,10 @@ export const UpdateProfiles = async (ctx: Context) => {
         ctx.throw(400);
     }
 
-    const targetUser = ctx.request.body;
-
-    if (targetUser.username && process.env.NO_CHANGE_USERNAME) {
-        ctx.throw("Changing username is currently not allowed.", 400);
-    }
-
-    if (user.id != targetUser.id || targetUser.admin != null || targetUser.active != null || targetUser.registration_ip_address || targetUser.ip_address) {
-        ctx.throw("Cannot change sensitive data.", 400);
-    }
+    const targetUser = {
+        name: ctx.request.body.name,
+        avatar: ctx.request.body.avatar,
+    };
 
     const userRep = getEntityManager().getRepository(User);
 
@@ -99,6 +94,10 @@ export const UpdateAccount = async (ctx: Context) => {
         user_id: ctx.request.body.user_id
     };
 
+    if (u.username && process.env.NO_CHANGE_USERNAME) {
+        ctx.throw("Changing username is currently not allowed.", 400);
+    }
+
     if (!u.user_id || !u.password) {
         ctx.throw(400);
     }