Skip to content

Add avatar access settings to updateRCSettings.js #27

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
rakeshSgr wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Add avatar access settings to updateRCSettings.js #27

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions src/scripts/updateRCSettings.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,6 +75,8 @@ async function run() {
{ _id: 'Accounts_AllowPasswordChange', value: false },
{ _id: 'Accounts_AllowPasswordChangeForOAuthUsers', value: false },
{ _id: 'Accounts_AllowEmailNotifications', value: false },
{ _id: 'Accounts_AvatarBlockUnauthenticatedAccess', value: false },
{ _id: 'Accounts_AllowAnonymousAvatarAccess', value: true },
Comment on lines +78 to +79
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot Apr 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🌐 Web query:

Rocket.Chat Accounts_AvatarBlockUnauthenticatedAccess and Accounts_AllowAnonymousAvatarAccess settings documentation

💡 Result:

Accounts_AvatarBlockUnauthenticatedAccess (documented)

Where it is in the UI:

  • Administration → Workspace → Settings → Accounts → Avatar → “Block Unauthenticated Access to Avatars” (enabling it restricts unauthenticated users from accessing avatars). [1]

Where it appears as a setting key (for settings-permissions / settings APIs):

  • Accounts → Avatar → Block Unauthenticated Access → Accounts_AvatarBlockUnauthenticatedAccess. [2]

Behavioral note (impact on avatar fetching):

  • When enabled, the avatar endpoint requires authentication parameters (rc_uid / rc_token). [3]
  • Rocket.Chat security guidance also notes that in “latest versions” unauthenticated avatar access is disabled by default. [4]

Accounts_AllowAnonymousAvatarAccess (not found in current official docs)

In the current Rocket.Chat docs pages that enumerate Accounts settings and the settings keys list, there is no documented setting named Accounts_AllowAnonymousAvatarAccess. [1] [2]

Practical implication:

  • In current documentation, the control for anonymous/unauthenticated avatar access is via Accounts_AvatarBlockUnauthenticatedAccess (i.e., block/allow unauthenticated access), not an “AllowAnonymousAvatarAccess” key. [1] [2]

Sources
[1] Rocket.Chat Docs — Accounts Settings (Avatar section includes “Block Unauthenticated Access to Avatars”)
[2] Rocket.Chat Docs — Settings permission list (maps UI paths to setting IDs, including Accounts_AvatarBlockUnauthenticatedAccess)
[3] Rocket.Chat Developer Docs — Get Avatars endpoint notes auth required if Accounts_AvatarBlockUnauthenticatedAccess is enabled
[4] Rocket.Chat Docs — Security Guidelines (Avatar Access section, default behavior note)

Remove invalid setting and address avatar access security concern.

Line 78 enables unauthenticated access to avatars (Accounts_AvatarBlockUnauthenticatedAccess: false), which allows broad public access—a potential privacy issue if avatars contain identifiable information. This contrasts sharply with the restrictive settings in lines 69-77.

Line 79 references Accounts_AllowAnonymousAvatarAccess, which does not exist in current Rocket.Chat documentation. The control for anonymous/unauthenticated avatar access is solely through Accounts_AvatarBlockUnauthenticatedAccess on line 78.

Actions needed:

  1. Remove the non-existent setting from line 79
  2. Document the rationale for allowing unauthenticated avatar access and any privacy/compliance review performed
  3. Verify if this intentionally overrides Rocket.Chat's default (which blocks unauthenticated access by default)
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@src/scripts/updateRCSettings.js` around lines 78 - 79, Remove the invalid
setting entry Accounts_AllowAnonymousAvatarAccess from the updates array in
updateRCSettings.js and keep only the supported
Accounts_AvatarBlockUnauthenticatedAccess setting; update the change note or
nearby comment to document why unauthenticated avatar access is being enabled
(privacy/compliance review summary, stakeholders, and risk mitigation) and
explicitly confirm whether this change intentionally overrides Rocket.Chat's
default (which blocks unauthenticated access) so the reviewer knows this is
deliberate.

],
'Save Settings Group 1'
)
Expand Down