closes #4459

src/controllers/accounts/helpers.js

@@ -58,7 +58,7 @@ helpers.getUserDataByUserSlug = function(userslug, callerUID, callback) {
 			var userSettings = results.userSettings;
 			var isAdmin = results.isAdmin;
 			var isGlobalModerator = results.isGlobalModerator;
-			var self = parseInt(callerUID, 10) === parseInt(userData.uid, 10);
+			var isSelf = parseInt(callerUID, 10) === parseInt(userData.uid, 10);
 
 			userData.joindateISO = utils.toISOString(userData.joindate);
 			userData.lastonlineISO = utils.toISOString(userData.lastonline || userData.joindate);
@@ -66,17 +66,17 @@ helpers.getUserDataByUserSlug = function(userslug, callerUID, callback) {
 
 			userData.emailClass = 'hide';
 
-			if (!(isAdmin || isGlobalModerator || self || (userData.email && userSettings.showemail))) {
+			if (!(isAdmin || isGlobalModerator || isSelf || (userData.email && userSettings.showemail))) {
 				userData.email = '';
 			} else if (!userSettings.showemail) {
 				userData.emailClass = '';
 			}
 
-			if (!isAdmin && !isGlobalModerator && !self && !userSettings.showfullname) {
+			if (!isAdmin && !isGlobalModerator && !isSelf && !userSettings.showfullname) {
 				userData.fullname = '';
 			}
 
-			if (isAdmin || isGlobalModerator || self) {
+			if (isAdmin || isGlobalModerator || isSelf) {
 				userData.ips = results.ips;
 			}
 
@@ -86,15 +86,15 @@ helpers.getUserDataByUserSlug = function(userslug, callerUID, callback) {
 			userData.isAdmin = isAdmin;
 			userData.isGlobalModerator = isGlobalModerator;
 			userData.canBan = isAdmin || isGlobalModerator;
-			userData.canChangePassword = isAdmin || self;
-			userData.isSelf = self;
-			userData.showHidden = self || isAdmin || isGlobalModerator;
+			userData.canChangePassword = isAdmin || (isSelf && parseInt(meta.config['password:disableEdit'], 10) !== 1);
+			userData.isSelf = isSelf;
+			userData.showHidden = isSelf || isAdmin || isGlobalModerator;
 			userData.groups = Array.isArray(results.groups) && results.groups.length ? results.groups[0] : [];
 			userData.disableSignatures = meta.config.disableSignatures !== undefined && parseInt(meta.config.disableSignatures, 10) === 1;
 			userData['reputation:disabled'] = parseInt(meta.config['reputation:disabled'], 10) === 1;
 			userData['downvote:disabled'] = parseInt(meta.config['downvote:disabled'], 10) === 1;
 			userData['email:confirmed'] = !!parseInt(userData['email:confirmed'], 10);
-			userData.profile_links = filterLinks(results.profile_links, self);
+			userData.profile_links = filterLinks(results.profile_links, isSelf);
 			userData.sso = results.sso.associations;
 			userData.status = user.getStatus(userData);
 			userData.banned = parseInt(userData.banned, 10) === 1;

src/views/admin/settings/user.tpl

@@ -72,6 +72,12 @@
 					<span class="mdl-switch__label"><strong>Disable email changes</strong></span>
 				</label>
 			</div>
+			<div class="checkbox">
+				<label class="mdl-switch mdl-js-switch mdl-js-ripple-effect">
+					<input class="mdl-switch__input" type="checkbox" data-field="password:disableEdit">
+					<span class="mdl-switch__label"><strong>Disable password changes</strong></span>
+				</label>
+			</div>
 			<div class="checkbox">
 				<label class="mdl-switch mdl-js-switch mdl-js-ripple-effect">
 					<input class="mdl-switch__input" type="checkbox" data-field="allowAccountDelete" checked>