mirror of
https://github.com/bulwarkmail/webmail.git
synced 2026-10-31 08:13:50 +00:00
Linus Rath
91a1b1cb51
Bulwark read the live display name (#900) and the account profile with `x:Account/get`, which Stalwart only allows for admins. Every other user got `forbidden`, so the settings page showed no name and the identity kept the stale snapshot. The name now comes from `x:AccountSettings/get`, the account's own settings object; aliases and quota still use `x:Account/get` where it is permitted. With TOTP on, Stalwart requires the current code for a password change and for switching TOTP off ("Current OTP code is required"). Neither dialog asked for it. Both now do, and the password change sends it as the `otpAuth/otpCode` patch, because a whole `otpAuth` object would reset `otpUrl` and turn TOTP off. Saving the display name also ignored a `notUpdated` answer and showed success.