The users cannot change the avatar after updating from 5.4.10 to 6.4.2 (the function is enabled in the settings)

Description:

Steps to reproduce:

1. Users tries to change avatar
2. Gets an error "Not allowed"
3. The avatar remains the same

Expected behavior:

User avatar has been changed

Actual behavior:

The users cannot change the avatar after updating from 5.4.10 to 6.4.2 via snap

Server Setup Information:

• Version of Rocket.Chat Server: 6.4.2
• Operating System: Ubuntu 20.04
• Deployment Method: snap
• Number of Running Instances: 1
• DB Replicaset Oplog: on
• NodeJS Version: v14.21.2
• MongoDB Version: 5.0.15

Client Setup Information

• Desktop App or Browser Version: Desktop App 3.9.9 and Google Chrome 118.0.5993.118
• Operating System: All

Additional context

The error appeared after updating from 5.4.10 to 6.4.2 . The users cannot change the avatar, admin can change the user's avatar.

Relevant logs:

Exception while invoking method saveUserProfile errorClass [Error]: Not allowed [error-not-allowed] at app/user-status/server/methods/setUserStatus.ts:32:10 at /snap/rocketchat-server/1581/programs/server/npm/node_modules/meteor/promise/node_modules/meteor-promise/fiber_pool.js:43:40 => awaited here: at Function.Promise.await (/snap/rocketchat-server/1581/programs/server/npm/node_modules/meteor/promise/node_modules/meteor-promise/promise_server.js:56:12) at server/methods/saveUserProfile.ts:75:3 at /snap/rocketchat-server/1581/programs/server/npm/node_modules/meteor/promise/node_modules/meteor-promise/fiber_pool.js:43:40 => awaited here: at Function.Promise.await (/snap/rocketchat-server/1581/programs/server/npm/node_modules/meteor/promise/node_modules/meteor-promise/promise_server.js:56:12) at packages/meteor.js:367:22 at Meteor.EnvironmentVariable.EVp.withValue (packages/meteor.js:1389:31) at packages/ddp-server/livedata_server.js:1818:36 at new Promise () at Server.applyAsync (packages/ddp-server/livedata_server.js:1817:12) at Server.callAsync (packages/ddp-server/livedata_server.js:1743:17) at app/api/server/v1/misc.ts:559:33 at /snap/rocketchat-server/1581/programs/server/npm/node_modules/meteor/promise/node_modules/meteor-promise/fiber_pool.js:43:40 => awaited here: at Function.Promise.await (/snap/rocketchat-server/1581/programs/server/npm/node_modules/meteor/promise/node_modules/meteor-promise/promise_server.js:56:12) at app/api/server/v1/misc.ts:559:17 at /snap/rocketchat-server/1581/programs/server/npm/node_modules/meteor/promise/node_modules/meteor-promise/fiber_pool.js:43:40 { isClientSafe: true, error: 'error-not-allowed', reason: 'Not allowed', details: { method: 'setUserStatus' }, errorType: 'Meteor.Error' }

Start with app/user-status/server/methods/setUserStatus.ts and server/methods/saveUserProfile.ts, then trace the saveUserProfile call shown in app/api/server/v1/misc.ts. Reproduce the 5.4.10-to-6.4.2 upgrade scenario and inspect why a regular user receives Not allowed while an admin can change the avatar. Done means users can change their avatars with the setting enabled.