VolatileStateResults: Don't reapply commandline values if not permitted

Icinga · Jun 22, 2023 · 2093690 · 2093690
1 parent 0f7452f
commit 2093690
Showing 1 changed file with 8 additions and 0 deletions.
diff --git a/library/Icingadb/Redis/VolatileStateResults.php b/library/Icingadb/Redis/VolatileStateResults.php
@@ -7,6 +7,7 @@
 use Exception;
 use Generator;
 use Icinga\Application\Benchmark;
+use Icinga\Module\Icingadb\Common\Auth;
 use Icinga\Module\Icingadb\Common\IcingaRedis;
 use Icinga\Module\Icingadb\Model\Host;
 use Icinga\Module\Icingadb\Model\Service;
@@ -18,6 +19,8 @@
 
 class VolatileStateResults extends ResultSet
 {
+    use Auth;
+
     /** @var Resolver */
     private $resolver;
 
@@ -91,6 +94,8 @@ protected function applyRedisUpdates()
         $keys = [];
         $hostStateKeys = [];
 
+        $showSourceGranted = $this->getAuth()->hasPermission('icingadb/object/show-source');
+
         $states = [];
         $hostStates = [];
         foreach ($this as $row) {
@@ -112,6 +117,9 @@ protected function applyRedisUpdates()
             $states[bin2hex($row->id)] = $row->state;
             if (empty($keys)) {
                 $keys = $row->state->getColumns();
+                if (! $showSourceGranted) {
+                    $keys = array_diff($keys, ['check_commandline']);
+                }
             }
 
             if ($type === 'service' && $row->host instanceof Host) {