Fix: Deny passwordless access to prometheus API if readonly access is…

… disabled Fix #1358
hoylabs · Sep 19, 2023 · f8cba57 · f8cba57
1 parent d419fd4
commit f8cba57
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/src/WebApi_prometheus.cpp b/src/WebApi_prometheus.cpp
@@ -25,6 +25,10 @@ void WebApiPrometheusClass::loop()
 
 void WebApiPrometheusClass::onPrometheusMetricsGet(AsyncWebServerRequest* request)
 {
+    if (!WebApi.checkCredentialsReadonly(request)) {
+        return;
+    }
+
     try {
         auto stream = request->beginResponseStream("text/plain; charset=utf-8", 40960);