fix: #8163, prevent account deletion

src/socket.io/user.js

@@ -49,6 +49,9 @@ SocketUser.deleteAccount = async function (socket, data) {
 	if (isAdmin) {
 		throw new Error('[[error:cant-delete-admin]]');
 	}
+	if (meta.config.allowAccountDelete !== 1) {
+		throw new Error('[[error:no-privileges]]');
+	}
 	const userData = await user.deleteAccount(socket.uid);
 	require('./index').server.sockets.emit('event:user_status_change', { uid: socket.uid, status: 'offline' });
 

test/user.js

@@ -1446,6 +1446,18 @@ describe('User', function () {
 			});
 		});
 
+		it('should fail to delete user if account deletion is not allowed', async function () {
+			const oldValue = meta.config.allowAccountDeletion;
+			meta.config.allowAccountDeletion = 0;
+			const uid = await User.create({ username: 'tobedeleted' });
+			try {
+				await socketUser.deleteAccount({ uid: uid }, {});
+			} catch (err) {
+				assert.equal(err.message, '[[error:no-privileges]]');
+			}
+			meta.config.allowAccountDeletion = oldValue;
+		});
+
 		it('should fail if data is invalid', function (done) {
 			socketUser.emailExists({ uid: testUid }, null, function (err) {
 				assert.equal(err.message, '[[error:invalid-data]]');