From 164163788af21f16fdef2a874a6413da8cee131d Mon Sep 17 00:00:00 2001
From: dklimpel <5740567+dklimpel@users.noreply.github.com>
Date: Tue, 17 Mar 2020 22:07:27 +0100
Subject: [PATCH 1/6] Add options to prevent users from changing their profile.

---
 changelog.d/7053.feature                   |   1 +
 docs/sample_config.yaml                    |  16 ++
 synapse/config/registration.py             |  20 ++
 synapse/handlers/profile.py                |  16 ++
 synapse/rest/client/v2_alpha/account.py    |  16 ++
 tests/handlers/test_profile.py             |  33 ++-
 tests/rest/client/v2_alpha/test_account.py | 303 +++++++++++++++++++++
 7 files changed, 404 insertions(+), 1 deletion(-)
 create mode 100644 changelog.d/7053.feature

diff --git a/changelog.d/7053.feature b/changelog.d/7053.feature
new file mode 100644
index 000000000000..00f47b2a14a5
--- /dev/null
+++ b/changelog.d/7053.feature
@@ -0,0 +1 @@
+Add options to prevent users from changing their profile or associated 3PIDs.
\ No newline at end of file
diff --git a/docs/sample_config.yaml b/docs/sample_config.yaml
index 54cbe840d520..9a2f3804964f 100644
--- a/docs/sample_config.yaml
+++ b/docs/sample_config.yaml
@@ -1057,6 +1057,22 @@ account_threepid_delegates:
     #email: https://example.com     # Delegate email sending to example.com
     #msisdn: http://localhost:8090  # Delegate SMS sending to this local process
 
+# If false, don't let users set their own display names/avatars
+# (unless they are a server admin) other than for the very first time.
+# Useful when provisioning users based on the contents of a 3rd party
+# directory and to avoid ambiguities.
+# Default is true and users can edit their own display names/avatars.
+#
+#enable_set_displayname: false
+#
+#enable_set_avatar_url: false
+
+# If false, stop users from trying to change the 3PIDs associated with
+# their accounts (email address and msisdn).
+# Default is true and users can edit their own 3PIDs.
+#
+#enable_3pid_changes: false
+
 # Users who register on this homeserver will automatically be joined
 # to these rooms
 #
diff --git a/synapse/config/registration.py b/synapse/config/registration.py
index 9bb3beedbc1a..d9bdd7f55adb 100644
--- a/synapse/config/registration.py
+++ b/synapse/config/registration.py
@@ -129,6 +129,10 @@ def read_config(self, config, **kwargs):
                 raise ConfigError("Invalid auto_join_rooms entry %s" % (room_alias,))
         self.autocreate_auto_join_rooms = config.get("autocreate_auto_join_rooms", True)
 
+        self.enable_set_displayname = config.get("enable_set_displayname", True)
+        self.enable_set_avatar_url = config.get("enable_set_avatar_url", True)
+        self.enable_3pid_changes = config.get("enable_3pid_changes", True)
+
         self.disable_msisdn_registration = config.get(
             "disable_msisdn_registration", False
         )
@@ -330,6 +334,22 @@ def generate_config_section(self, generate_secrets=False, **kwargs):
             #email: https://example.com     # Delegate email sending to example.com
             #msisdn: http://localhost:8090  # Delegate SMS sending to this local process
 
+        # If false, don't let users set their own display names/avatars
+        # (unless they are a server admin) other than for the very first time.
+        # Useful when provisioning users based on the contents of a 3rd party
+        # directory and to avoid ambiguities.
+        # Default is true and users can edit their own display names/avatars.
+        #
+        #enable_set_displayname: false
+        #
+        #enable_set_avatar_url: false
+
+        # If false, stop users from trying to change the 3PIDs associated with
+        # their accounts (email address and msisdn).
+        # Default is true and users can edit their own 3PIDs.
+        #
+        #enable_3pid_changes: false
+
         # Users who register on this homeserver will automatically be joined
         # to these rooms
         #
diff --git a/synapse/handlers/profile.py b/synapse/handlers/profile.py
index 50ce0c585b9e..6aa1c0f5e019 100644
--- a/synapse/handlers/profile.py
+++ b/synapse/handlers/profile.py
@@ -157,6 +157,15 @@ def set_displayname(self, target_user, requester, new_displayname, by_admin=Fals
         if not by_admin and target_user != requester.user:
             raise AuthError(400, "Cannot set another user's displayname")
 
+        if not by_admin and not self.hs.config.enable_set_displayname:
+            profile = yield self.store.get_profileinfo(target_user.localpart)
+            if profile.display_name:
+                raise SynapseError(
+                    400,
+                    "Changing display name is disabled on this server",
+                    Codes.FORBIDDEN,
+                )
+
         if len(new_displayname) > MAX_DISPLAYNAME_LEN:
             raise SynapseError(
                 400, "Displayname is too long (max %i)" % (MAX_DISPLAYNAME_LEN,)
@@ -218,6 +227,13 @@ def set_avatar_url(self, target_user, requester, new_avatar_url, by_admin=False)
         if not by_admin and target_user != requester.user:
             raise AuthError(400, "Cannot set another user's avatar_url")
 
+        if not by_admin and not self.hs.config.enable_set_avatar_url:
+            profile = yield self.store.get_profileinfo(target_user.localpart)
+            if profile.avatar_url:
+                raise SynapseError(
+                    400, "Changing avatar is disabled on this server", Codes.FORBIDDEN
+                )
+
         if len(new_avatar_url) > MAX_AVATAR_URL_LEN:
             raise SynapseError(
                 400, "Avatar URL is too long (max %i)" % (MAX_AVATAR_URL_LEN,)
diff --git a/synapse/rest/client/v2_alpha/account.py b/synapse/rest/client/v2_alpha/account.py
index dc837d6c7582..e40136f2f3b2 100644
--- a/synapse/rest/client/v2_alpha/account.py
+++ b/synapse/rest/client/v2_alpha/account.py
@@ -599,6 +599,11 @@ async def on_GET(self, request):
         return 200, {"threepids": threepids}
 
     async def on_POST(self, request):
+        if not self.hs.config.enable_3pid_changes:
+            raise SynapseError(
+                400, "3PID changes are disabled on this server", Codes.FORBIDDEN
+            )
+
         requester = await self.auth.get_user_by_req(request)
         user_id = requester.user.to_string()
         body = parse_json_object_from_request(request)
@@ -643,6 +648,11 @@ def __init__(self, hs):
 
     @interactive_auth_handler
     async def on_POST(self, request):
+        if not self.hs.config.enable_3pid_changes:
+            raise SynapseError(
+                400, "3PID changes are disabled on this server", Codes.FORBIDDEN
+            )
+
         requester = await self.auth.get_user_by_req(request)
         user_id = requester.user.to_string()
         body = parse_json_object_from_request(request)
@@ -738,10 +748,16 @@ class ThreepidDeleteRestServlet(RestServlet):
 
     def __init__(self, hs):
         super(ThreepidDeleteRestServlet, self).__init__()
+        self.hs = hs
         self.auth = hs.get_auth()
         self.auth_handler = hs.get_auth_handler()
 
     async def on_POST(self, request):
+        if not self.hs.config.enable_3pid_changes:
+            raise SynapseError(
+                400, "3PID changes are disabled on this server", Codes.FORBIDDEN
+            )
+
         body = parse_json_object_from_request(request)
         assert_params_in_dict(body, ["medium", "address"])
 
diff --git a/tests/handlers/test_profile.py b/tests/handlers/test_profile.py
index d60c124eec34..e600b9777b53 100644
--- a/tests/handlers/test_profile.py
+++ b/tests/handlers/test_profile.py
@@ -19,7 +19,7 @@
 from twisted.internet import defer
 
 import synapse.types
-from synapse.api.errors import AuthError
+from synapse.api.errors import AuthError, SynapseError
 from synapse.handlers.profile import MasterProfileHandler
 from synapse.types import UserID
 
@@ -70,6 +70,7 @@ def register_query_handler(query_type, handler):
         yield self.store.create_profile(self.frank.localpart)
 
         self.handler = hs.get_profile_handler()
+        self.hs = hs
 
     @defer.inlineCallbacks
     def test_get_my_name(self):
@@ -90,6 +91,19 @@ def test_set_my_name(self):
             "Frank Jr.",
         )
 
+    @defer.inlineCallbacks
+    def test_set_my_name_if_disabled(self):
+        self.hs.config.enable_set_displayname = False
+
+        # Set first displayname is allowed, if displayname is null
+        yield self.store.set_profile_displayname(self.frank.localpart, "Frank")
+
+        d = self.handler.set_displayname(
+            self.frank, synapse.types.create_requester(self.frank), "Frank Jr."
+        )
+
+        yield self.assertFailure(d, SynapseError)
+
     @defer.inlineCallbacks
     def test_set_my_name_noauth(self):
         d = self.handler.set_displayname(
@@ -147,3 +161,20 @@ def test_set_my_avatar(self):
             (yield self.store.get_profile_avatar_url(self.frank.localpart)),
             "http://my.server/pic.gif",
         )
+
+    @defer.inlineCallbacks
+    def test_set_my_avatar_if_disabled(self):
+        self.hs.config.enable_set_avatar_url = False
+
+        # Set first time avatar is allowed, if avatar is null
+        yield self.store.set_profile_avatar_url(
+            self.frank.localpart, "http://my.server/me.png"
+        )
+
+        d = self.handler.set_avatar_url(
+            self.frank,
+            synapse.types.create_requester(self.frank),
+            "http://my.server/pic.gif",
+        )
+
+        yield self.assertFailure(d, SynapseError)
diff --git a/tests/rest/client/v2_alpha/test_account.py b/tests/rest/client/v2_alpha/test_account.py
index c3facc00eb3a..99cc9163f3c6 100644
--- a/tests/rest/client/v2_alpha/test_account.py
+++ b/tests/rest/client/v2_alpha/test_account.py
@@ -24,6 +24,7 @@
 
 import synapse.rest.admin
 from synapse.api.constants import LoginType, Membership
+from synapse.api.errors import Codes
 from synapse.rest.client.v1 import login, room
 from synapse.rest.client.v2_alpha import account, register
 
@@ -325,3 +326,305 @@ def deactivate(self, user_id, tok):
         )
         self.render(request)
         self.assertEqual(request.code, 200)
+
+
+class ThreepidEmailRestTestCase(unittest.HomeserverTestCase):
+
+    servlets = [
+        account.register_servlets,
+        login.register_servlets,
+        synapse.rest.admin.register_servlets_for_client_rest_resource,
+    ]
+
+    def make_homeserver(self, reactor, clock):
+        config = self.default_config()
+
+        # Email config.
+        self.email_attempts = []
+
+        def sendmail(smtphost, from_addr, to_addrs, msg, **kwargs):
+            self.email_attempts.append(msg)
+            return
+
+        config["email"] = {
+            "enable_notifs": False,
+            "template_dir": os.path.abspath(
+                pkg_resources.resource_filename("synapse", "res/templates")
+            ),
+            "smtp_host": "127.0.0.1",
+            "smtp_port": 20,
+            "require_transport_security": False,
+            "smtp_user": None,
+            "smtp_pass": None,
+            "notif_from": "test@example.com",
+        }
+        config["public_baseurl"] = "https://example.com"
+
+        self.hs = self.setup_test_homeserver(config=config, sendmail=sendmail)
+        return self.hs
+
+    def prepare(self, reactor, clock, hs):
+        self.store = hs.get_datastore()
+
+        self.user_id = self.register_user("kermit", "test")
+        self.user_id_tok = self.login("kermit", "test")
+        self.email = "test@example.com"
+        self.url_3pid = b"account/3pid"
+
+    def test_add_email(self):
+        """Test add mail to profile
+        """
+        client_secret = "foobar"
+        session_id = self._request_token(self.email, client_secret)
+
+        self.assertEquals(len(self.email_attempts), 1)
+        link = self._get_link_from_email()
+
+        self._validate_token(link)
+
+        request, channel = self.make_request(
+            "POST",
+            b"/_matrix/client/unstable/account/3pid/add",
+            {
+                "client_secret": client_secret,
+                "sid": session_id,
+                "auth": {
+                    "type": "m.login.password",
+                    "user": self.user_id,
+                    "password": "test",
+                },
+            },
+            access_token=self.user_id_tok,
+        )
+
+        self.render(request)
+        self.assertEqual(200, int(channel.result["code"]), msg=channel.result["body"])
+
+        # Get user
+        request, channel = self.make_request(
+            "GET", self.url_3pid, access_token=self.user_id_tok,
+        )
+        self.render(request)
+
+        self.assertEqual(200, int(channel.result["code"]), msg=channel.result["body"])
+        self.assertEqual("email", channel.json_body["threepids"][0]["medium"])
+        self.assertEqual(self.email, channel.json_body["threepids"][0]["address"])
+
+    def test_add_email_if_disabled(self):
+        """Test add mail to profile if disabled
+        """
+        self.hs.config.enable_3pid_changes = False
+
+        client_secret = "foobar"
+        session_id = self._request_token(self.email, client_secret)
+
+        self.assertEquals(len(self.email_attempts), 1)
+        link = self._get_link_from_email()
+
+        self._validate_token(link)
+
+        request, channel = self.make_request(
+            "POST",
+            b"/_matrix/client/unstable/account/3pid/add",
+            {
+                "client_secret": client_secret,
+                "sid": session_id,
+                "auth": {
+                    "type": "m.login.password",
+                    "user": self.user_id,
+                    "password": "test",
+                },
+            },
+            access_token=self.user_id_tok,
+        )
+        self.render(request)
+        self.assertEqual(400, int(channel.result["code"]), msg=channel.result["body"])
+        self.assertEqual(Codes.FORBIDDEN, channel.json_body["errcode"])
+
+        # Get user
+        request, channel = self.make_request(
+            "GET", self.url_3pid, access_token=self.user_id_tok,
+        )
+        self.render(request)
+
+        self.assertEqual(200, int(channel.result["code"]), msg=channel.result["body"])
+        self.assertFalse(channel.json_body["threepids"])
+
+    def test_delete_email(self):
+        """Test delete mail from profile
+        """
+        # Add a threepid
+        self.get_success(
+            self.store.user_add_threepid(
+                user_id=self.user_id,
+                medium="email",
+                address=self.email,
+                validated_at=0,
+                added_at=0,
+            )
+        )
+
+        request, channel = self.make_request(
+            "POST",
+            b"account/3pid/delete",
+            {"medium": "email", "address": self.email},
+            access_token=self.user_id_tok,
+        )
+        self.render(request)
+        self.assertEqual(200, int(channel.result["code"]), msg=channel.result["body"])
+
+        # Get user
+        request, channel = self.make_request(
+            "GET", self.url_3pid, access_token=self.user_id_tok,
+        )
+        self.render(request)
+
+        self.assertEqual(200, int(channel.result["code"]), msg=channel.result["body"])
+        self.assertFalse(channel.json_body["threepids"])
+
+    def test_delete_email_if_disabled(self):
+        """Test delete mail from profile if disabled
+        """
+        self.hs.config.enable_3pid_changes = False
+
+        # Add a threepid
+        self.get_success(
+            self.store.user_add_threepid(
+                user_id=self.user_id,
+                medium="email",
+                address=self.email,
+                validated_at=0,
+                added_at=0,
+            )
+        )
+
+        request, channel = self.make_request(
+            "POST",
+            b"account/3pid/delete",
+            {"medium": "email", "address": self.email},
+            access_token=self.user_id_tok,
+        )
+        self.render(request)
+
+        self.assertEqual(400, int(channel.result["code"]), msg=channel.result["body"])
+        self.assertEqual(Codes.FORBIDDEN, channel.json_body["errcode"])
+
+        # Get user
+        request, channel = self.make_request(
+            "GET", self.url_3pid, access_token=self.user_id_tok,
+        )
+        self.render(request)
+
+        self.assertEqual(200, int(channel.result["code"]), msg=channel.result["body"])
+        self.assertEqual("email", channel.json_body["threepids"][0]["medium"])
+        self.assertEqual(self.email, channel.json_body["threepids"][0]["address"])
+
+    def test_cant_add_email_without_clicking_link(self):
+        """Test that we do actually need to click the link in the email
+        """
+        client_secret = "foobar"
+        session_id = self._request_token(self.email, client_secret)
+
+        self.assertEquals(len(self.email_attempts), 1)
+
+        # Attempt to add email without clicking the link
+        request, channel = self.make_request(
+            "POST",
+            b"/_matrix/client/unstable/account/3pid/add",
+            {
+                "client_secret": client_secret,
+                "sid": session_id,
+                "auth": {
+                    "type": "m.login.password",
+                    "user": self.user_id,
+                    "password": "test",
+                },
+            },
+            access_token=self.user_id_tok,
+        )
+        self.render(request)
+        self.assertEqual(400, int(channel.result["code"]), msg=channel.result["body"])
+        self.assertEqual(Codes.THREEPID_AUTH_FAILED, channel.json_body["errcode"])
+
+        # Get user
+        request, channel = self.make_request(
+            "GET", self.url_3pid, access_token=self.user_id_tok,
+        )
+        self.render(request)
+
+        self.assertEqual(200, int(channel.result["code"]), msg=channel.result["body"])
+        self.assertFalse(channel.json_body["threepids"])
+
+    def test_no_valid_token(self):
+        """Test that we do actually need to request a token and can't just
+        make a session up.
+        """
+        client_secret = "foobar"
+        session_id = "weasle"
+
+        # Attempt to add email without even requesting an email
+        request, channel = self.make_request(
+            "POST",
+            b"/_matrix/client/unstable/account/3pid/add",
+            {
+                "client_secret": client_secret,
+                "sid": session_id,
+                "auth": {
+                    "type": "m.login.password",
+                    "user": self.user_id,
+                    "password": "test",
+                },
+            },
+            access_token=self.user_id_tok,
+        )
+        self.render(request)
+        self.assertEqual(400, int(channel.result["code"]), msg=channel.result["body"])
+        self.assertEqual(Codes.THREEPID_AUTH_FAILED, channel.json_body["errcode"])
+
+        # Get user
+        request, channel = self.make_request(
+            "GET", self.url_3pid, access_token=self.user_id_tok,
+        )
+        self.render(request)
+
+        self.assertEqual(200, int(channel.result["code"]), msg=channel.result["body"])
+        self.assertFalse(channel.json_body["threepids"])
+
+    def _request_token(self, email, client_secret):
+        request, channel = self.make_request(
+            "POST",
+            b"account/3pid/email/requestToken",
+            {"client_secret": client_secret, "email": email, "send_attempt": 1},
+        )
+        self.render(request)
+        self.assertEquals(200, channel.code, channel.result)
+
+        return channel.json_body["sid"]
+
+    def _validate_token(self, link):
+        # Remove the host
+        path = link.replace("https://example.com", "")
+
+        request, channel = self.make_request("GET", path, shorthand=False)
+        self.render(request)
+        self.assertEquals(200, channel.code, channel.result)
+
+    def _get_link_from_email(self):
+        assert self.email_attempts, "No emails have been sent"
+
+        raw_msg = self.email_attempts[-1].decode("UTF-8")
+        mail = Parser().parsestr(raw_msg)
+
+        text = None
+        for part in mail.walk():
+            if part.get_content_type() == "text/plain":
+                text = part.get_payload(decode=True).decode("UTF-8")
+                break
+
+        if not text:
+            self.fail("Could not find text portion of email to parse")
+
+        match = re.search(r"https://example.com\S+", text)
+        assert match, "Could not find link in email"
+
+        return match.group(0)

From 9458281de471779b8499880bab1b22ecf017ac9d Mon Sep 17 00:00:00 2001
From: dklimpel <5740567+dklimpel@users.noreply.github.com>
Date: Tue, 17 Mar 2020 22:30:51 +0100
Subject: [PATCH 2/6] Update changelog

---
 changelog.d/{7053.feature => 7096.feature} | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename changelog.d/{7053.feature => 7096.feature} (100%)

diff --git a/changelog.d/7053.feature b/changelog.d/7096.feature
similarity index 100%
rename from changelog.d/7053.feature
rename to changelog.d/7096.feature

From 8e203e47582b6e2e11bd45b6938e7f20830564ca Mon Sep 17 00:00:00 2001
From: Dirk Klimpel <5740567+dklimpel@users.noreply.github.com>
Date: Mon, 23 Mar 2020 20:03:45 +0100
Subject: [PATCH 3/6] Apply suggestions from code review

Co-Authored-By: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com>
---
 synapse/config/registration.py | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/synapse/config/registration.py b/synapse/config/registration.py
index d9bdd7f55adb..80ebe8468c56 100644
--- a/synapse/config/registration.py
+++ b/synapse/config/registration.py
@@ -344,9 +344,10 @@ def generate_config_section(self, generate_secrets=False, **kwargs):
         #
         #enable_set_avatar_url: false
 
-        # If false, stop users from trying to change the 3PIDs associated with
-        # their accounts (email address and msisdn).
-        # Default is true and users can edit their own 3PIDs.
+        # Whether users can change the 3PIDs associated with their accounts
+        # (email address and msisdn).
+        #
+        # Defaults to 'true'
         #
         #enable_3pid_changes: false
 

From 219cf3f1b0f9433dd7e41138b8975d324af89b0e Mon Sep 17 00:00:00 2001
From: dklimpel <5740567+dklimpel@users.noreply.github.com>
Date: Mon, 23 Mar 2020 21:00:49 +0100
Subject: [PATCH 4/6] update tests

---
 docs/sample_config.yaml        | 23 ++++++++++++++--------
 synapse/config/registration.py | 16 ++++++++++-----
 tests/handlers/test_profile.py | 36 +++++++++++++++++++++++++++++++++-
 3 files changed, 61 insertions(+), 14 deletions(-)

diff --git a/docs/sample_config.yaml b/docs/sample_config.yaml
index 4b6f5a27c753..d14db0d51dd0 100644
--- a/docs/sample_config.yaml
+++ b/docs/sample_config.yaml
@@ -1057,19 +1057,26 @@ account_threepid_delegates:
     #email: https://example.com     # Delegate email sending to example.com
     #msisdn: http://localhost:8090  # Delegate SMS sending to this local process
 
-# If false, don't let users set their own display names/avatars
-# (unless they are a server admin) other than for the very first time.
-# Useful when provisioning users based on the contents of a 3rd party
-# directory and to avoid ambiguities.
-# Default is true and users can edit their own display names/avatars.
+# Whether users are allowed to change their displayname after it has
+# been initially set. Useful when provisioning users based on the
+# contents of a third-party directory.
+#
+# Does not apply to server administrators. Defaults to 'true'
 #
 #enable_set_displayname: false
+
+# Whether users are allowed to change their avatar after it has been
+# initially set. Useful when provisioning users based on the contents
+# of a third-party directory.
+#
+# Does not apply to server administrators. Defaults to 'true'
 #
 #enable_set_avatar_url: false
 
-# If false, stop users from trying to change the 3PIDs associated with
-# their accounts (email address and msisdn).
-# Default is true and users can edit their own 3PIDs.
+# Whether users can change the 3PIDs associated with their accounts
+# (email address and msisdn).
+#
+# Defaults to 'true'
 #
 #enable_3pid_changes: false
 
diff --git a/synapse/config/registration.py b/synapse/config/registration.py
index 80ebe8468c56..4a6f9d716f2a 100644
--- a/synapse/config/registration.py
+++ b/synapse/config/registration.py
@@ -334,13 +334,19 @@ def generate_config_section(self, generate_secrets=False, **kwargs):
             #email: https://example.com     # Delegate email sending to example.com
             #msisdn: http://localhost:8090  # Delegate SMS sending to this local process
 
-        # If false, don't let users set their own display names/avatars
-        # (unless they are a server admin) other than for the very first time.
-        # Useful when provisioning users based on the contents of a 3rd party
-        # directory and to avoid ambiguities.
-        # Default is true and users can edit their own display names/avatars.
+        # Whether users are allowed to change their displayname after it has
+        # been initially set. Useful when provisioning users based on the
+        # contents of a third-party directory.
+        #
+        # Does not apply to server administrators. Defaults to 'true'
         #
         #enable_set_displayname: false
+        
+        # Whether users are allowed to change their avatar after it has been
+        # initially set. Useful when provisioning users based on the contents
+        # of a third-party directory.
+        #
+        # Does not apply to server administrators. Defaults to 'true'
         #
         #enable_set_avatar_url: false
 
diff --git a/tests/handlers/test_profile.py b/tests/handlers/test_profile.py
index e600b9777b53..1942ac1cca62 100644
--- a/tests/handlers/test_profile.py
+++ b/tests/handlers/test_profile.py
@@ -91,13 +91,29 @@ def test_set_my_name(self):
             "Frank Jr.",
         )
 
+        # Set second time displayname
+        yield self.handler.set_displayname(
+            self.frank, synapse.types.create_requester(self.frank), "Frank"
+        )
+
+        self.assertEquals(
+            (yield self.store.get_profile_displayname(self.frank.localpart)),
+            "Frank",
+        )
+
     @defer.inlineCallbacks
     def test_set_my_name_if_disabled(self):
         self.hs.config.enable_set_displayname = False
 
-        # Set first displayname is allowed, if displayname is null
+        # Set first time displayname is allowed, if displayname is null
         yield self.store.set_profile_displayname(self.frank.localpart, "Frank")
 
+        self.assertEquals(
+            (yield self.store.get_profile_displayname(self.frank.localpart)),
+            "Frank",
+        )
+
+        # Set second time displayname is forbidden
         d = self.handler.set_displayname(
             self.frank, synapse.types.create_requester(self.frank), "Frank Jr."
         )
@@ -162,6 +178,18 @@ def test_set_my_avatar(self):
             "http://my.server/pic.gif",
         )
 
+        # Set second time avatar
+        yield self.handler.set_avatar_url(
+            self.frank,
+            synapse.types.create_requester(self.frank),
+            "http://my.server/me.png",
+        )
+
+        self.assertEquals(
+            (yield self.store.get_profile_avatar_url(self.frank.localpart)),
+            "http://my.server/me.png",
+        )
+
     @defer.inlineCallbacks
     def test_set_my_avatar_if_disabled(self):
         self.hs.config.enable_set_avatar_url = False
@@ -171,6 +199,12 @@ def test_set_my_avatar_if_disabled(self):
             self.frank.localpart, "http://my.server/me.png"
         )
 
+        self.assertEquals(
+            (yield self.store.get_profile_avatar_url(self.frank.localpart)),
+            "http://my.server/me.png",
+        )
+
+        # Set second time avatar is forbidden
         d = self.handler.set_avatar_url(
             self.frank,
             synapse.types.create_requester(self.frank),

From 050d780b5d112ab435dd30e8d9d87bd643fcb824 Mon Sep 17 00:00:00 2001
From: dklimpel <5740567+dklimpel@users.noreply.github.com>
Date: Mon, 23 Mar 2020 21:12:39 +0100
Subject: [PATCH 5/6] lint

---
 synapse/config/registration.py | 2 +-
 tests/handlers/test_profile.py | 6 ++----
 2 files changed, 3 insertions(+), 5 deletions(-)

diff --git a/synapse/config/registration.py b/synapse/config/registration.py
index 4a6f9d716f2a..e7ea3a01cb87 100644
--- a/synapse/config/registration.py
+++ b/synapse/config/registration.py
@@ -341,7 +341,7 @@ def generate_config_section(self, generate_secrets=False, **kwargs):
         # Does not apply to server administrators. Defaults to 'true'
         #
         #enable_set_displayname: false
-        
+
         # Whether users are allowed to change their avatar after it has been
         # initially set. Useful when provisioning users based on the contents
         # of a third-party directory.
diff --git a/tests/handlers/test_profile.py b/tests/handlers/test_profile.py
index 1942ac1cca62..f55ee3b6d692 100644
--- a/tests/handlers/test_profile.py
+++ b/tests/handlers/test_profile.py
@@ -97,8 +97,7 @@ def test_set_my_name(self):
         )
 
         self.assertEquals(
-            (yield self.store.get_profile_displayname(self.frank.localpart)),
-            "Frank",
+            (yield self.store.get_profile_displayname(self.frank.localpart)), "Frank",
         )
 
     @defer.inlineCallbacks
@@ -109,8 +108,7 @@ def test_set_my_name_if_disabled(self):
         yield self.store.set_profile_displayname(self.frank.localpart, "Frank")
 
         self.assertEquals(
-            (yield self.store.get_profile_displayname(self.frank.localpart)),
-            "Frank",
+            (yield self.store.get_profile_displayname(self.frank.localpart)), "Frank",
         )
 
         # Set second time displayname is forbidden

From 4ed68925c864c270eefbe8212591a23600ede1a3 Mon Sep 17 00:00:00 2001
From: Dirk Klimpel <5740567+dklimpel@users.noreply.github.com>
Date: Thu, 26 Mar 2020 13:26:11 +0100
Subject: [PATCH 6/6] Apply suggestions from code review

Co-Authored-By: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com>
---
 tests/handlers/test_profile.py             | 12 ++++++------
 tests/rest/client/v2_alpha/test_account.py |  9 ++++-----
 2 files changed, 10 insertions(+), 11 deletions(-)

diff --git a/tests/handlers/test_profile.py b/tests/handlers/test_profile.py
index f55ee3b6d692..be665262c601 100644
--- a/tests/handlers/test_profile.py
+++ b/tests/handlers/test_profile.py
@@ -91,7 +91,7 @@ def test_set_my_name(self):
             "Frank Jr.",
         )
 
-        # Set second time displayname
+        # Set displayname again
         yield self.handler.set_displayname(
             self.frank, synapse.types.create_requester(self.frank), "Frank"
         )
@@ -104,14 +104,14 @@ def test_set_my_name(self):
     def test_set_my_name_if_disabled(self):
         self.hs.config.enable_set_displayname = False
 
-        # Set first time displayname is allowed, if displayname is null
+        # Setting displayname for the first time is allowed
         yield self.store.set_profile_displayname(self.frank.localpart, "Frank")
 
         self.assertEquals(
             (yield self.store.get_profile_displayname(self.frank.localpart)), "Frank",
         )
 
-        # Set second time displayname is forbidden
+        # Setting displayname a second time is forbidden
         d = self.handler.set_displayname(
             self.frank, synapse.types.create_requester(self.frank), "Frank Jr."
         )
@@ -176,7 +176,7 @@ def test_set_my_avatar(self):
             "http://my.server/pic.gif",
         )
 
-        # Set second time avatar
+        # Set avatar again
         yield self.handler.set_avatar_url(
             self.frank,
             synapse.types.create_requester(self.frank),
@@ -192,7 +192,7 @@ def test_set_my_avatar(self):
     def test_set_my_avatar_if_disabled(self):
         self.hs.config.enable_set_avatar_url = False
 
-        # Set first time avatar is allowed, if avatar is null
+        # Setting displayname for the first time is allowed
         yield self.store.set_profile_avatar_url(
             self.frank.localpart, "http://my.server/me.png"
         )
@@ -202,7 +202,7 @@ def test_set_my_avatar_if_disabled(self):
             "http://my.server/me.png",
         )
 
-        # Set second time avatar is forbidden
+        # Set avatar a second time is forbidden
         d = self.handler.set_avatar_url(
             self.frank,
             synapse.types.create_requester(self.frank),
diff --git a/tests/rest/client/v2_alpha/test_account.py b/tests/rest/client/v2_alpha/test_account.py
index 99cc9163f3c6..45a9d445f823 100644
--- a/tests/rest/client/v2_alpha/test_account.py
+++ b/tests/rest/client/v2_alpha/test_account.py
@@ -344,7 +344,6 @@ def make_homeserver(self, reactor, clock):
 
         def sendmail(smtphost, from_addr, to_addrs, msg, **kwargs):
             self.email_attempts.append(msg)
-            return
 
         config["email"] = {
             "enable_notifs": False,
@@ -372,7 +371,7 @@ def prepare(self, reactor, clock, hs):
         self.url_3pid = b"account/3pid"
 
     def test_add_email(self):
-        """Test add mail to profile
+        """Test adding an email to profile
         """
         client_secret = "foobar"
         session_id = self._request_token(self.email, client_secret)
@@ -411,7 +410,7 @@ def test_add_email(self):
         self.assertEqual(self.email, channel.json_body["threepids"][0]["address"])
 
     def test_add_email_if_disabled(self):
-        """Test add mail to profile if disabled
+        """Test adding email to profile when doing so is disallowed
         """
         self.hs.config.enable_3pid_changes = False
 
@@ -451,7 +450,7 @@ def test_add_email_if_disabled(self):
         self.assertFalse(channel.json_body["threepids"])
 
     def test_delete_email(self):
-        """Test delete mail from profile
+        """Test deleting an email from profile
         """
         # Add a threepid
         self.get_success(
@@ -483,7 +482,7 @@ def test_delete_email(self):
         self.assertFalse(channel.json_body["threepids"])
 
     def test_delete_email_if_disabled(self):
-        """Test delete mail from profile if disabled
+        """Test deleting an email from profile when disallowed
         """
         self.hs.config.enable_3pid_changes = False