fix: prevent guest user from updating profile

[yclw]

Problem Description

Currently, if the guest account is enabled, anyone can modify the guest user's username and password through the /api/me/update API endpoint without any authentication (something that even admins cannot do through the user management interface). While testing has not revealed any severe security issues, I believe no one wants to see the GUEST username changed to "You are cute" (⁄ ⁄•⁄ω⁄•⁄ ⁄) .

Changes Made

Added a check for Guest users in the UpdateCurrent function. When a Guest user attempts to modify their profile information, the system now returns a 403 error and blocks the operation. This is consistent with restrictions applied to Guest users in other functions (such as Generate2FA).

This small change ensures your GUEST user won't suddenly become unexpectedly charming without your permission.

[petercat-assistant]

Walkthrough

This pull request addresses a security issue where guest users could modify their profile information without authentication. The change introduces a check in the UpdateCurrent function to prevent guest users from updating their username and password, returning a 403 error if attempted.

Changes

File	Summary
server/handles/auth.go	Added a condition to block guest users from updating their profile, ensuring a 403 error is returned when such an attempt is made.