Hide startup line from API response if user doesn't have startup permissions

Author: DaneEveritt

app/Services/Servers/StartupCommandService.php

@@ -10,16 +10,17 @@ class StartupCommandService
      * Generates a startup command for a given server instance.
      *
      * @param \Pterodactyl\Models\Server $server
+     * @param bool $hideAllValues
      * @return string
      */
-    public function handle(Server $server): string
+    public function handle(Server $server, bool $hideAllValues = false): string
     {
         $find = ['{{SERVER_MEMORY}}', '{{SERVER_IP}}', '{{SERVER_PORT}}'];
         $replace = [$server->memory, $server->allocation->ip, $server->allocation->port];
 
         foreach ($server->variables as $variable) {
             $find[] = '{{' . $variable->env_variable . '}}';
-            $replace[] = $variable->user_viewable ? ($variable->server_value ?? $variable->default_value) : '[hidden]';
+            $replace[] = ($variable->user_viewable && !$hideAllValues) ? ($variable->server_value ?? $variable->default_value) : '[hidden]';
         }
 
         return str_replace($find, $replace, $server->startup);

app/Transformers/Api/Client/ServerTransformer.php

@@ -61,7 +61,7 @@ public function transform(Server $server): array
                 'io' => $server->io,
                 'cpu' => $server->cpu,
             ],
-            'invocation' => $service->handle($server),
+            'invocation' => $service->handle($server, ! $this->getUser()->can(Permission::ACTION_STARTUP_READ, $server)),
             'feature_limits' => [
                 'databases' => $server->database_limit,
                 'allocations' => $server->allocation_limit,