From 86ba7d57572f516adb6a9a0753d4dc7c0ea15af2 Mon Sep 17 00:00:00 2001
From: gauthier-th <mail@gauthierth.fr>
Date: Mon, 29 Jul 2024 18:29:23 +0200
Subject: [PATCH] fix: disallow Plex users from changing their email

---
 server/routes/user/index.ts                        | 14 +++++++++++++-
 server/routes/user/usersettings.ts                 |  6 +++---
 .../UserSettings/UserGeneralSettings/index.tsx     |  1 +
 3 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/server/routes/user/index.ts b/server/routes/user/index.ts
index 10a247191..016709c60 100644
--- a/server/routes/user/index.ts
+++ b/server/routes/user/index.ts
@@ -41,7 +41,19 @@ router.get('/', async (req, res, next) => {
         break;
       case 'displayname':
         query = query.orderBy(
-          "(CASE WHEN (user.username IS NULL OR user.username = '') THEN (CASE WHEN (user.plexUsername IS NULL OR user.plexUsername = '') THEN user.email ELSE LOWER(user.plexUsername) END) ELSE LOWER(user.username) END)",
+          `CASE WHEN (user.username IS NULL OR user.username = '') THEN (
+             CASE WHEN (user.plexUsername IS NULL OR user.plexUsername = '') THEN (
+               CASE WHEN (user.jellyfinUsername IS NULL OR user.jellyfinUsername = '') THEN
+                 user.email
+               ELSE
+                 LOWER(user.jellyfinUsername)
+               END)
+             ELSE
+               LOWER(user.jellyfinUsername)
+             END)
+           ELSE
+             LOWER(user.username)
+           END`,
           'ASC'
         );
         break;
diff --git a/server/routes/user/usersettings.ts b/server/routes/user/usersettings.ts
index b56d28445..9669cb186 100644
--- a/server/routes/user/usersettings.ts
+++ b/server/routes/user/usersettings.ts
@@ -98,9 +98,9 @@ userSettingsRoutes.post<
     }
 
     user.username = req.body.username;
-    user.email =
-      req.body.email ||
-      ((user.plexUsername || user.jellyfinUsername) as string);
+    if (user.jellyfinUsername) {
+      user.email = req.body.email || user.jellyfinUsername || user.email;
+    }
 
     // Update quota values only if the user has the correct permissions
     if (
diff --git a/src/components/UserProfile/UserSettings/UserGeneralSettings/index.tsx b/src/components/UserProfile/UserSettings/UserGeneralSettings/index.tsx
index fc5fe5be5..3bcf1a049 100644
--- a/src/components/UserProfile/UserSettings/UserGeneralSettings/index.tsx
+++ b/src/components/UserProfile/UserSettings/UserGeneralSettings/index.tsx
@@ -297,6 +297,7 @@ const UserGeneralSettings = () => {
                       name="email"
                       type="text"
                       placeholder="example@domain.com"
+                      disabled={user?.plexUsername}
                       className={
                         user?.warnings.find((w) => w === 'userEmailRequired')
                           ? 'border-2 border-red-400 focus:border-blue-600'