non-admin users can't see sessions in Firewall: Diagnostics: Sessions

[teawithbrownsugar]

Important notices

Before you add a new report, we ask you kindly to acknowledge the following:

• I have read the contributing guide lines at https://github.com/opnsense/core/blob/master/CONTRIBUTING.md
• I am convinced that my issue is new after having checked both open and closed issues at https://github.com/opnsense/core/issues?q=is%3Aissue

Describe the bug

"Firewall: Diagnostics: Sessions" provides a list of current connections. It's similar to "Firewall: Diagnostics: States", but showing more details.

A non-admin user should only have access to this list, if the "Effective Privileges" of that user contain "Diagnostics: Firewall sessions". Adding the required privilege does activate the menu entry, so the user can open "Firewall: Diagnostics: Sessions". This is the expected behavior.

The unexpected behavior here is, that the list is always empty for a non-admin user, even if he has the privilege. Instead of seeing the current connections/sessions, there is only a message being displayed: "No results found!".

Last known working version? Unknown. But it's safe to say, that this bug existed before version 22.1.

To Reproduce

Steps to reproduce the behavior:

1. Edit the "Effective Privileges" of a non-admin user. Activate the privilege "Diagnostics: Firewall sessions".
2. Log in the previously edited user.
3. Make sure the firewall is currently handling at least 1 connection. Using the web GUI should do that.
4. Go to Firewall - Diagnostics - Sessions. URL path: /ui/diagnostics/firewall/pf_top
5. Notice that there are no session listed in this table, there is only the message "No results found!".

Expected behavior

"Firewall: Diagnostics: Sessions" should contain the same (amount of) connections, no matter which user, no matter if admin or non-admin. The only relevant factor should be, if the user has the privilege "Diagnostics: Firewall sessions".

Describe alternatives you considered

I have manually edited the file "/usr/local/opnsense/mvc/app/models/OPNsense/Core/ACL/ACL.xml". I searched for "pf_top" and added a line <pattern>api/diagnostics/firewall/query_pf_top</pattern>

This workaround didn't survive an update.

Environment

OPNsense 22.1.5-amd64