From 5173f1f7e8023ad82a3c42c30833cb380f499a51 Mon Sep 17 00:00:00 2001
From: Dane Everitt <dane@daneeveritt.com>
Date: Sun, 23 Aug 2020 14:56:05 -0700
Subject: [PATCH] Don't allow editing read only values; closes #2252

---
 .../Api/Client/Servers/StartupController.php  |  8 ++++++--
 .../components/server/startup/VariableBox.tsx | 19 ++++++++++++++++---
 2 files changed, 22 insertions(+), 5 deletions(-)

diff --git a/app/Http/Controllers/Api/Client/Servers/StartupController.php b/app/Http/Controllers/Api/Client/Servers/StartupController.php
index 6eb1df0ad..92961e1c9 100644
--- a/app/Http/Controllers/Api/Client/Servers/StartupController.php
+++ b/app/Http/Controllers/Api/Client/Servers/StartupController.php
@@ -55,9 +55,13 @@ class StartupController extends ClientApiController
         /** @var \Pterodactyl\Models\EggVariable $variable */
         $variable = $server->variables()->where('env_variable', $request->input('key'))->first();
 
-        if (is_null($variable) || !$variable->user_viewable || !$variable->user_editable) {
+        if (is_null($variable) || !$variable->user_viewable) {
             throw new BadRequestHttpException(
-                "The environment variable you are trying to edit [\"{$request->input('key')}\"] does not exist."
+                "The environment variable you are trying to edit does not exist."
+            );
+        } else if (! $variable->user_editable) {
+            throw new BadRequestHttpException(
+                "The environment variable you are trying to edit is read-only."
             );
         }
 
diff --git a/resources/scripts/components/server/startup/VariableBox.tsx b/resources/scripts/components/server/startup/VariableBox.tsx
index e9e7b58f0..ffc589329 100644
--- a/resources/scripts/components/server/startup/VariableBox.tsx
+++ b/resources/scripts/components/server/startup/VariableBox.tsx
@@ -43,12 +43,25 @@ const VariableBox = ({ variable }: Props) => {
     }, 500);
 
     return (
-        <TitledGreyBox title={variable.name}>
+        <TitledGreyBox
+            title={
+                <p css={tw`text-sm uppercase`}>
+                    {!variable.isEditable &&
+                    <span css={tw`bg-neutral-700 text-xs py-1 px-2 rounded-full mr-2`}>Read Only</span>
+                    }
+                    {variable.name}
+                </p>
+            }
+        >
             <FlashMessageRender byKey={FLASH_KEY} css={tw`mb-4`}/>
             <InputSpinner visible={loading}>
                 <Input
-                    onKeyUp={e => setVariableValue(e.currentTarget.value)}
-                    readOnly={!canEdit}
+                    onKeyUp={e => {
+                        if (canEdit && variable.isEditable) {
+                            setVariableValue(e.currentTarget.value);
+                        }
+                    }}
+                    readOnly={!canEdit || !variable.isEditable}
                     name={variable.envVariable}
                     defaultValue={variable.serverValue}
                     placeholder={variable.defaultValue}