closes #3941

src/controllers/accounts/edit.js

@@ -19,6 +19,7 @@ editController.get = function(req, res, callback) {
 			return callback(err);
 		}
 
+		userData['username:disableEdit'] = !userData.isAdmin && parseInt(meta.config['username:disableEdit'], 10) === 1;
 		userData.title = '[[pages:account/edit, ' + userData.username + ']]';
 		userData.breadcrumbs = helpers.buildBreadcrumbs([{text: userData.username, url: '/user/' + userData.userslug}, {text: '[[user:edit]]'}]);
 

src/socket.io/user/profile.js

@@ -117,12 +117,17 @@ module.exports = function(SocketUser) {
 					return next(new Error('[[error:invalid-data]]'));
 				}
 
-				if (parseInt(meta.config['username:disableEdit'], 10) === 1) {
+				user.isAdministrator(socket.uid, next);
+			},
+			function(isAdmin, next) {
+				if (!isAdmin && socket.uid !== parseInt(data.uid, 10)) {
+					return next(new Error('[[error:no-privileges]]'));
+				}
+
+				if (!isAdmin && parseInt(meta.config['username:disableEdit'], 10) === 1) {
 					data.username = oldUserData.username;
 				}
-				user.isAdminOrSelf(socket.uid, data.uid, next);
-			},
-			function (next) {
+
 				user.updateProfile(data.uid, data, next);
 			},
 			function (userData, next) {