[sushifrick]

Fixes #1188

This fix respects the instance's setting allow_user_to_change_display_name with a default true. The setting is meant to prevent spoofing other user names in bigger instances.

For now this setting can be circumvented by importing an export from another instance or one that has been manipulated after unzipping it.

[come-nc]

Hmm. I just realized it looks like the whole permission checks are applied when importing as admin too, so occ user:import will not import display name anymore with this change.
But there is the same issue for all the other fields, so I guess it’s still fine to merge this for now.
But we would need a follow-up to bypass most permission checks when importing as admin (especially when importing in a new user).

[sushifrick]

Hmm I guess you are right. I was wondering if the permission check was better suited in $user->setDisplayName() itself instead of during the migration here. Therefore the setting would be respected by each app calling it. What is your opinion on that?

[github-actions]

Hello there,
Thank you so much for taking the time and effort to create a pull request to our Nextcloud project.

We hope that the review process is going smooth and is helpful for you. We want to ensure your pull request is reviewed to your satisfaction. If you have a moment, our community management team would very much appreciate your feedback on your experience with this PR review process.

Your feedback is valuable to us as we continuously strive to improve our community developer experience. Please take a moment to complete our short survey by clicking on the following link: https://cloud.nextcloud.com/apps/forms/s/i9Ago4EQRZ7TWxjfmeEpPkf6

Thank you for contributing to Nextcloud and we hope to hear from you soon!

(If you believe you should not receive this message, you can add yourself to the blocklist.)

[come-nc]

Hmm I guess you are right. I was wondering if the permission check was better suited in $user->setDisplayName() itself instead of during the migration here. Therefore the setting would be respected by each app calling it. What is your opinion on that?

No, the permission check should stay outside of the method. The method can be used by admin endpoints as well.

[come-nc]

@sushifrick Can you add a sign-off to your commits to fix DCO?
git rebase HEAD~2 --signoff should be enough, and then a force-push.