From 5cd308d10cbd53cff986ab1f85f1cee619c8c450 Mon Sep 17 00:00:00 2001
From: Martin Preuss <martin@aquamaniac.de>
Date: Tue, 16 Sep 2025 23:19:45 +0200
Subject: [PATCH] only create links for values if perms match.

---
 apps/aqhome-cgi/modules/mdevices.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/apps/aqhome-cgi/modules/mdevices.c b/apps/aqhome-cgi/modules/mdevices.c
index 9c82f47..31f11bd 100644
--- a/apps/aqhome-cgi/modules/mdevices.c
+++ b/apps/aqhome-cgi/modules/mdevices.c
@@ -189,6 +189,9 @@ void _runIndex(AQH_MODULE *m, AQCGI_REQUEST *rq, AQH_SESSION *session, AQH_DATAC
 {
   AQH_DEVICE_LIST *deviceList;
   AQH_DEVICE *device;
+  uint32_t perms;
+
+  perms=AQH_ModService_GetUserPerms(m);
 
   deviceList=AQH_DataClient_GetDevices(dc, NULL);
   if (deviceList==NULL)  {
@@ -225,9 +228,13 @@ void _runIndex(AQH_MODULE *m, AQCGI_REQUEST *rq, AQH_SESSION *session, AQH_DATAC
     GBAA(dbuf, "<tr>");
     /* name for system */
     s=AQH_Device_GetNameForSystem(device);
-    GBAS(dbuf,"<td><a href=\"values.html?device=");
-    GWEN_Text_EscapeToBufferTolerant(s, dbuf);
-    GBAA(dbuf,"\">%s</a></td>", s?s:"");
+    if (perms & AQH_MODDEVICES_PERMS_VALUEREAD) {
+      GBAS(dbuf,"<td><a href=\"values.html?device=");
+      GWEN_Text_EscapeToBufferTolerant(s, dbuf);
+      GBAA(dbuf,"\">%s</a></td>", s?s:"");
+    }
+    else
+      GBAA(dbuf,"<td>%s</td>", s?s:"");
     /* room */
     s=AQH_Device_GetRoomName(device);
     GBAA(dbuf, "<td>%s</td>", s?s:"");
@@ -261,8 +268,6 @@ void _runIndex(AQH_MODULE *m, AQCGI_REQUEST *rq, AQH_SESSION *session, AQH_DATAC
        "</tbody>\n"
        "</table>\n");
   AQH_Device_List_free(deviceList);
-  AQCGI_Request_SetResponseCode(rq, 200);
-  AQCGI_Request_SetResponseText(rq, "Ok");
 }