fix(frontend): disable self password change if passwordProfile is read-only

Fixes: https://github.com/owncloud/enterprise/issues/6849

services/frontend/pkg/revaconfig/config.go

@@ -7,6 +7,7 @@ import (
 	"os"
 	"path"
 	"path/filepath"
+	"slices"
 	"strconv"
 
 	"github.com/owncloud/ocis/v2/ocis-pkg/capabilities"
@@ -81,6 +82,11 @@ func FrontendConfigFromStruct(cfg *config.Config, logger log.Logger) (map[string
 		readOnlyUserAttributes = cfg.ReadOnlyUserAttributes
 	}
 
+	changePasswordDisabled := !cfg.LDAPServerWriteEnabled
+	if slices.Contains(readOnlyUserAttributes, "user.passwordProfile") {
+		changePasswordDisabled = true
+	}
+
 	return map[string]interface{}{
 		"shared": map[string]interface{}{
 			"jwt_secret":                cfg.TokenManager.JWTSecret,
@@ -218,7 +224,7 @@ func FrontendConfigFromStruct(cfg *config.Config, logger log.Logger) (map[string
 									"read_only_attributes":          readOnlyUserAttributes,
 									"create_disabled":               !cfg.LDAPServerWriteEnabled,
 									"delete_disabled":               !cfg.LDAPServerWriteEnabled,
-									"change_password_self_disabled": !cfg.LDAPServerWriteEnabled,
+									"change_password_self_disabled": changePasswordDisabled,
 								},
 							},
 							"checksums": map[string]interface{}{