Currently if a user has a "move" permission, they can also reset the comment or avatar of another user as describe in issue #1016. I stumbled into this by accident when I gave a user the move permission to help get new users into the right channels with their friends.
After reviewing the content found in PR #1223 which introduced the reset avatar feature, I found the code that allowed a user to do these resets and changed the required permission from Move to RegisterUser as suggested by @bontibon in the issue thread. As they state, this permission makes more sense than the move permission.
After compiling I found no issues and the changes worked as expected. The one caveat is that if the server has these changes implemented and not the client, (seems daft but this is preferable for me so I don't have to ask my users to change anything) it makes the permissions required to do the reset be move AND registeruser. The client will expect the user to have Move permission and the server will expect the RegisterUser permission, hence then requiring both.
Fixes#1016
52b58de44f