admin: Add realm option to prevent users from changing their name.

A realm option to prevent users from changing their name is added.
Fixes #3950.

static/js/admin.js

@@ -129,6 +129,15 @@ function populate_streams(streams_data) {
     loading.destroy_indicator($('#admin_page_streams_loading_indicator'));
 }
 
+exports.toggle_name_change_display = function () {
+    if ($('#full_name').attr('disabled')) {
+        $('#full_name').removeAttr('disabled');
+    } else {
+        $('#full_name').attr('disabled', 'disabled');
+    }
+    $(".change_name_tooltip").toggle();
+};
+
 exports.toggle_email_change_display = function () {
     $("#change_email").toggle();
     $(".change_email_tooltip").toggle();
@@ -336,6 +345,7 @@ function _setup_page() {
         realm_invite_by_admins_only: page_params.realm_invite_by_admins_only,
         realm_authentication_methods: page_params.realm_authentication_methods,
         realm_create_stream_by_admins_only: page_params.realm_create_stream_by_admins_only,
+        realm_name_changes_disabled: page_params.realm_name_changes_disabled,
         realm_email_changes_disabled: page_params.realm_email_changes_disabled,
         realm_add_emoji_by_admins_only: page_params.realm_add_emoji_by_admins_only,
         realm_allow_message_editing: page_params.realm_allow_message_editing,
@@ -588,6 +598,7 @@ function _setup_page() {
         var invite_by_admins_only_status = $("#admin-realm-invite-by-admins-only-status").expectOne();
         var authentication_methods_status = $("#admin-realm-authentication-methods-status").expectOne();
         var create_stream_by_admins_only_status = $("#admin-realm-create-stream-by-admins-only-status").expectOne();
+        var name_changes_disabled_status = $("#admin-realm-name-changes-disabled-status").expectOne();
         var email_changes_disabled_status = $("#admin-realm-email-changes-disabled-status").expectOne();
         var add_emoji_by_admins_only_status = $("#admin-realm-add-emoji-by-admins-only-status").expectOne();
         var message_editing_status = $("#admin-realm-message-editing-status").expectOne();
@@ -599,6 +610,7 @@ function _setup_page() {
         invite_by_admins_only_status.hide();
         authentication_methods_status.hide();
         create_stream_by_admins_only_status.hide();
+        name_changes_disabled_status.hide();
         email_changes_disabled_status.hide();
         add_emoji_by_admins_only_status.hide();
         message_editing_status.hide();
@@ -613,6 +625,7 @@ function _setup_page() {
         var new_invite = $("#id_realm_invite_required").prop("checked");
         var new_invite_by_admins_only = $("#id_realm_invite_by_admins_only").prop("checked");
         var new_create_stream_by_admins_only = $("#id_realm_create_stream_by_admins_only").prop("checked");
+        var new_name_changes_disabled = $("#id_realm_name_changes_disabled").prop("checked");
         var new_email_changes_disabled = $("#id_realm_email_changes_disabled").prop("checked");
         var new_add_emoji_by_admins_only = $("#id_realm_add_emoji_by_admins_only").prop("checked");
         var new_allow_message_editing = $("#id_realm_allow_message_editing").prop("checked");
@@ -644,6 +657,7 @@ function _setup_page() {
             invite_by_admins_only: JSON.stringify(new_invite_by_admins_only),
             authentication_methods: JSON.stringify(new_auth_methods),
             create_stream_by_admins_only: JSON.stringify(new_create_stream_by_admins_only),
+            name_changes_disabled: JSON.stringify(new_name_changes_disabled),
             email_changes_disabled: JSON.stringify(new_email_changes_disabled),
             add_emoji_by_admins_only: JSON.stringify(new_add_emoji_by_admins_only),
             allow_message_editing: JSON.stringify(new_allow_message_editing),
@@ -688,6 +702,13 @@ function _setup_page() {
                         ui.report_success(i18n.t("Any user may now create new streams!"), create_stream_by_admins_only_status);
                     }
                 }
+                if (response_data.name_changes_disabled !== undefined) {
+                    if (response_data.name_changes_disabled) {
+                        ui.report_success(i18n.t("Users cannot change their name!"), name_changes_disabled_status);
+                    } else {
+                        ui.report_success(i18n.t("Users may now change their name!"), name_changes_disabled_status);
+                    }
+                }
                 if (response_data.email_changes_disabled !== undefined) {
                     if (response_data.email_changes_disabled) {
                         ui.report_success(i18n.t("Users cannot change their email!"), email_changes_disabled_status);

static/js/server_events.js

@@ -64,6 +64,9 @@ function dispatch_normal_event(event) {
             if (!page_params.is_admin) {
                 page_params.can_create_streams = !page_params.realm_create_stream_by_admins_only;
             }
+        } else if (event.op === 'update' && event.property === 'name_changes_disabled') {
+            page_params.realm_name_changes_disabled = event.value;
+            admin.toggle_name_change_display();
         } else if (event.op === 'update' && event.property === 'email_changes_disabled') {
             page_params.realm_email_changes_disabled = event.value;
             admin.toggle_email_change_display();

static/templates/settings/account-settings.handlebars

@@ -39,7 +39,9 @@
         <div class="user-name-section inline-block">
           <div class="input-group" id="name_change_container">
             <label for="full_name" class="inline-block title">{{t "Full name" }}</label>
-            <input type="text" name="full_name" id="full_name" class="w-200 inline-block" value="{{ page_params.fullname }}" />
+            <input type="text" name="full_name" id="full_name" class="w-200 inline-block" value="{{ page_params.fullname }}" {{#if page_params.realm_name_changes_disabled}}disabled="disabled" {{/if}}/>
+            <i class="icon-vector-question-sign change_name_tooltip" {{#unless page_params.realm_name_changes_disabled}}style="display:none" {{/unless}}data-toggle="tooltip"
+            title="{{t 'Changing your name has been disabled by your Zulip organization administrators. Contact an administrator for help.' }}"></i>
             <div class="warning"></div>
           </div>
 

static/templates/settings/organization-settings-admin.handlebars

@@ -11,6 +11,7 @@
     <div class="alert" id="admin-realm-message-editing-status"></div>
     <div class="alert" id="admin-realm-default-language-status"></div>
     <div class="alert" id="admin-realm-waiting_period_threshold_status"></div>
+    <div class="alert" id="admin-realm-name-changes-disabled-status"></div>
     <div class="alert" id="admin-realm-email-changes-disabled-status"></div>
 
     <div class="m-10 inline-block grid organization-settings-parent">
@@ -59,6 +60,17 @@
         {{t "Only admins may create streams" }}
       </label>
     </div>
+    <div class="input-group">
+      <input type="checkbox" class="inline-block" id="id_realm_name_changes_disabled"
+             name="realm_name_changes_disabled"
+        {{#if realm_name_changes_disabled}}checked="checked"{{/if}} />
+
+      <label for="id_realm_name_changes_disabled" class="inline-block"
+        id="id_realm_name_changes_disabled_label" style="width:initial"
+        title="{{t 'If checked, users will be unable to change their name.' }}">
+        {{t "Prevent users from changing their name" }}
+      </label>
+    </div>
     <div class="input-group">
       <input type="checkbox" class="inline-block" id="id_realm_email_changes_disabled"
              name="realm_email_changes_disabled"

zerver/lib/actions.py

@@ -3415,3 +3415,15 @@ def do_set_email_changes_disabled(realm, email_changes_disabled):
         value=email_changes_disabled,
     )
     send_event(event, active_user_ids(realm))
+
+def do_set_name_changes_disabled(realm, name_changes_disabled):
+    # type: (Realm, bool) -> None
+    realm.name_changes_disabled = name_changes_disabled
+    realm.save(update_fields=['name_changes_disabled'])
+    event = dict(
+        type="realm",
+        op="update",
+        property='name_changes_disabled',
+        value=name_changes_disabled,
+    )
+    send_event(event, active_user_ids(realm))

zerver/lib/events.py

@@ -105,6 +105,7 @@ def fetch_initial_state_data(user_profile, event_types, queue_id,
         state['realm_waiting_period_threshold'] = user_profile.realm.waiting_period_threshold
         state['realm_icon_url'] = realm_icon_url(user_profile.realm)
         state['realm_icon_source'] = user_profile.realm.icon_source
+        state['realm_name_changes_disabled'] = user_profile.realm.name_changes_disabled
         state['realm_email_changes_disabled'] = user_profile.realm.email_changes_disabled
         state['max_icon_file_size'] = settings.MAX_ICON_FILE_SIZE
         state['realm_bot_domain'] = user_profile.realm.get_bot_domain()

zerver/tests/test_events.py

@@ -45,6 +45,7 @@ from zerver.lib.actions import (
     do_set_realm_restricted_to_domain,
     do_set_realm_invite_required,
     do_set_realm_invite_by_admins_only,
+    do_set_name_changes_disabled,
     do_set_email_changes_disabled,
     do_set_realm_message_editing,
     do_set_realm_default_language,
@@ -568,6 +569,20 @@ class EventsRegisterTest(ZulipTestCase):
             error = schema_checker('events[0]', events[0])
             self.assert_on_error(error)
 
+    def test_change_realm_name_changes_disabled(self):
+        # type: () -> None
+        schema_checker = check_dict([
+            ('type', equals('realm')),
+            ('op', equals('update')),
+            ('property', equals('name_changes_disabled')),
+            ('value', check_bool),
+        ])
+        do_set_name_changes_disabled(self.user_profile.realm, name_changes_disabled=True)
+        for name_changes_disabled in (False, True):
+            events = self.do_test(lambda: do_set_name_changes_disabled(self.user_profile.realm, name_changes_disabled))
+            error = schema_checker('events[0]', events[0])
+            self.assert_on_error(error)
+
     def test_change_realm_email_changes_disabled(self):
         # type: () -> None
         schema_checker = check_dict([

zerver/tests/test_home.py

@@ -108,6 +108,7 @@ class HomeTest(ZulipTestCase):
             "realm_invite_required",
             "realm_message_content_edit_limit_seconds",
             "realm_name",
+            "realm_name_changes_disabled",
             "realm_presence_disabled",
             "realm_restricted_to_domain",
             "realm_uri",

zerver/tests/test_realm.py

@@ -8,7 +8,7 @@ from mock import patch
 from typing import Any, Dict, List, Text
 
 from zerver.lib.actions import \
-    do_change_is_admin, do_set_realm_name, do_deactivate_realm
+    do_change_is_admin, do_set_realm_name, do_deactivate_realm, do_set_name_changes_disabled
 
 from zerver.lib.test_classes import ZulipTestCase
 from zerver.lib.test_helpers import tornado_redirected_to_list
@@ -102,6 +102,13 @@ class RealmTest(ZulipTestCase):
         realm = update_with_api(create_stream_by_admins_only=False)
         self.assertEqual(realm.create_stream_by_admins_only, False)
 
+        # email address change disabled
+        set_up_db('name_changes_disabled', False)
+        realm = update_with_api(name_changes_disabled=True)
+        self.assertEqual(realm.name_changes_disabled, True)
+        realm = update_with_api(name_changes_disabled=False)
+        self.assertEqual(realm.name_changes_disabled, False)
+
         # email address change disabled
         set_up_db('email_changes_disabled', False)
         realm = update_with_api(email_changes_disabled=True)
@@ -150,6 +157,19 @@ class RealmTest(ZulipTestCase):
         result = self.client_patch('/json/realm', req)
         self.assert_json_error(result, 'Must be a realm administrator')
 
+    def test_unauthorized_name_change(self):
+        # type: () -> None
+        data = {'full_name': 'Sir Hamlet'}
+        email = 'hamlet@zulip.com'
+        self.login(email)
+        user_profile = get_user_profile_by_email(email)
+        do_set_name_changes_disabled(user_profile.realm, name_changes_disabled=True)
+        url = '/json/settings/change'
+        result = self.client_post(url, data)
+        self.assertEqual(result.status_code, 200)
+        # Since the setting fails silently, no message is returned
+        self.assert_in_response("", result)
+
     def test_do_deactivate_realm(self):
         # type: () -> None
         """The main complicated thing about deactivating realm names is

zerver/views/home.py

@@ -296,13 +296,14 @@ def home_real(request):
         'realm_default_streams',
         'realm_email_changes_disabled',
         'realm_emoji',
+        'realm_filters',
         'realm_icon_source',
         'realm_icon_url',
-        'realm_message_content_edit_limit_seconds',
-        'realm_name',
         'realm_invite_by_admins_only',
         'realm_invite_required',
-        'realm_filters',
+        'realm_message_content_edit_limit_seconds',
+        'realm_name',
+        'realm_name_changes_disabled',
         'realm_restricted_to_domain',
         'realm_waiting_period_threshold',
         'referrals',

zerver/views/realm.py

@@ -9,6 +9,7 @@ from zerver.lib.actions import (
     do_set_realm_create_stream_by_admins_only,
     do_set_realm_name,
     do_set_realm_invite_by_admins_only,
+    do_set_name_changes_disabled,
     do_set_email_changes_disabled,
     do_set_realm_add_emoji_by_admins_only,
     do_set_realm_invite_required,
@@ -30,6 +31,7 @@ def update_realm(request, user_profile, name=REQ(validator=check_string, default
                  restricted_to_domain=REQ(validator=check_bool, default=None),
                  invite_required=REQ(validator=check_bool, default=None),
                  invite_by_admins_only=REQ(validator=check_bool, default=None),
+                 name_changes_disabled=REQ(validator=check_bool, default=None),
                  email_changes_disabled=REQ(validator=check_bool, default=None),
                  create_stream_by_admins_only=REQ(validator=check_bool, default=None),
                  add_emoji_by_admins_only=REQ(validator=check_bool, default=None),
@@ -38,7 +40,7 @@ def update_realm(request, user_profile, name=REQ(validator=check_string, default
                  default_language=REQ(validator=check_string, default=None),
                  waiting_period_threshold=REQ(converter=to_non_negative_int, default=None),
                  authentication_methods=REQ(validator=check_dict([]), default=None)):
-    # type: (HttpRequest, UserProfile, Optional[str], Optional[bool], Optional[bool], Optional[bool], Optional[bool], Optional[bool], Optional[bool], Optional[bool], Optional[int], Optional[str], Optional[int], Optional[dict]) -> HttpResponse
+    # type: (HttpRequest, UserProfile, Optional[str], Optional[bool], Optional[bool], Optional[bool], Optional[bool], Optional[bool], Optional[bool], Optional[bool], Optional[bool], Optional[int], Optional[str], Optional[int], Optional[dict]) -> HttpResponse
     # Validation for default_language
     if default_language is not None and default_language not in get_available_language_codes():
         raise JsonableError(_("Invalid language '%s'" % (default_language,)))
@@ -56,6 +58,9 @@ def update_realm(request, user_profile, name=REQ(validator=check_string, default
     if invite_by_admins_only is not None and realm.invite_by_admins_only != invite_by_admins_only:
         do_set_realm_invite_by_admins_only(realm, invite_by_admins_only)
         data['invite_by_admins_only'] = invite_by_admins_only
+    if name_changes_disabled is not None and realm.name_changes_disabled != name_changes_disabled:
+        do_set_name_changes_disabled(realm, name_changes_disabled)
+        data['name_changes_disabled'] = name_changes_disabled
     if email_changes_disabled is not None and realm.email_changes_disabled != email_changes_disabled:
         do_set_email_changes_disabled(realm, email_changes_disabled)
         data['email_changes_disabled'] = email_changes_disabled