Don't allow editing read only values; closes pterodactyl#2252

Author: DaneEveritt

app/Http/Controllers/Api/Client/Servers/StartupController.php

@@ -55,9 +55,13 @@ public function update(UpdateStartupVariableRequest $request, Server $server)
         /** @var \Pterodactyl\Models\EggVariable $variable */
         $variable = $server->variables()->where('env_variable', $request->input('key'))->first();
 
-        if (is_null($variable) || !$variable->user_viewable || !$variable->user_editable) {
+        if (is_null($variable) || !$variable->user_viewable) {
             throw new BadRequestHttpException(
-                "The environment variable you are trying to edit [\"{$request->input('key')}\"] does not exist."
+                "The environment variable you are trying to edit does not exist."
+            );
+        } else if (! $variable->user_editable) {
+            throw new BadRequestHttpException(
+                "The environment variable you are trying to edit is read-only."
             );
         }
 

resources/scripts/components/server/startup/VariableBox.tsx

@@ -43,12 +43,25 @@ const VariableBox = ({ variable }: Props) => {
     }, 500);
 
     return (
-        <TitledGreyBox title={variable.name}>
+        <TitledGreyBox
+            title={
+                <p css={tw`text-sm uppercase`}>
+                    {!variable.isEditable &&
+                    <span css={tw`bg-neutral-700 text-xs py-1 px-2 rounded-full mr-2`}>Read Only</span>
+                    }
+                    {variable.name}
+                </p>
+            }
+        >
             <FlashMessageRender byKey={FLASH_KEY} css={tw`mb-4`}/>
             <InputSpinner visible={loading}>
                 <Input
-                    onKeyUp={e => setVariableValue(e.currentTarget.value)}
-                    readOnly={!canEdit}
+                    onKeyUp={e => {
+                        if (canEdit && variable.isEditable) {
+                            setVariableValue(e.currentTarget.value);
+                        }
+                    }}
+                    readOnly={!canEdit || !variable.isEditable}
                     name={variable.envVariable}
                     defaultValue={variable.serverValue}
                     placeholder={variable.defaultValue}