22101 fix(mon-hosts): apply legacy view permissions

The experimental "All hosts" page was reachable by any logged-in user,
even though the sidebar entry and the classic view it replaces both
require "view.allhosts". Require it on the page as well, so a user who
may not see the classic view cannot reach the new one either.

The availability dropdown now follows the classic view too: it is only
offered to users who may see availability, instead of linking every user
to a page that then refuses them.

CMK-37891

Change-Id: I99475847b3eb9d4cb1bbef69432efe4fa941e563
(cherry picked from commit 8e775423f518d82f7784242c8b4ca7b08586b017)

Author: otAAAh

.werks/22101.md

@@ -0,0 +1,25 @@
+[//]: # (werk v3)
+# All hosts page requires the 'view.allhosts' permission
+
+key        | value
+---------- | ---
+date       | 2026-08-10T11:01:37.906374+00:00
+version    | 2.5.0p12
+class      | fix
+edition    | community
+component  | multisite
+level      | 1
+compatible | yes
+
+The experimental "All hosts" page could be opened by any logged-in user via
+its URL, even though the sidebar entry and the classic "All hosts" view it
+replaces both require the <tt>view.allhosts</tt> permission. The page now
+requires that permission as well, so a user who may not see the classic view
+can no longer reach the new one either.
+
+Note that this only concerns which view a user may open; the hosts listed on
+the page have always been restricted to those the user is a contact for.
+
+In addition, the "Availability" menu is now only offered to users who hold the
+<tt>general.see_availability</tt> permission, instead of linking every user to
+a page that then refuses them.

cmk/gui/monitor/hosts/_pages/_monitor_all_hosts.py

@@ -38,6 +38,9 @@
 
 _PAGE_TITLE = _("All hosts (experimental)")
 
+_LEGACY_VIEW_NAME = "allhosts"
+_LEGACY_VIEW_PERMISSION = f"view.{_LEGACY_VIEW_NAME}"
+
 
 def _row_actions(config: Config) -> list[RowAction]:
     if not config.wato_enabled:
@@ -99,6 +102,8 @@ def __init__(self, commands: CommandRegistry) -> None:
 
     @override
     def page(self, ctx: PageContext) -> None:
+        user.need_permission(_LEGACY_VIEW_PERMISSION)
+
         breadcrumb = _make_breadcrumb(ctx)
 
         make_header(
@@ -121,7 +126,9 @@ def page(self, ctx: PageContext) -> None:
                     may_ignore_hard_limit=user.may("general.ignore_hard_limit"),
                     legacy_view_button=MonitoringPageLinkButton(
                         url=makeuri_contextless(
-                            ctx.request, vars_=[("view_name", "allhosts")], filename="view.py"
+                            ctx.request,
+                            vars_=[("view_name", _LEGACY_VIEW_NAME)],
+                            filename="view.py",
                         ),
                         title=_("Return to classic view"),
                     ),
@@ -148,35 +155,42 @@ def _make_breadcrumb(ctx: PageContext) -> Breadcrumb:
     return breadcrumb
 
 
-def _build_page_menu(breadcrumb: Breadcrumb) -> PageMenu:
+def _availability_dropdowns() -> list[PageMenuDropdown]:
+    if not user.may("general.see_availability"):
+        return []
+
     availability_url = makeuri_contextless(
         request,
-        [("view_name", "allhosts"), ("mode", "availability")],
+        [("view_name", _LEGACY_VIEW_NAME), ("mode", "availability")],
         filename="view.py",
     )
 
+    return [
+        PageMenuDropdown(
+            name="availability",
+            title=_("Availability"),
+            topics=[
+                PageMenuTopic(
+                    title=_("This view"),
+                    entries=[
+                        PageMenuEntry(
+                            title=_("Availability"),
+                            icon_name=StaticIcon(IconNames.availability),
+                            item=make_simple_link(availability_url),
+                            name="availability",
+                            is_shortcut=False,
+                            is_suggested=False,
+                        )
+                    ],
+                )
+            ],
+        ),
+    ]
+
+
+def _build_page_menu(breadcrumb: Breadcrumb) -> PageMenu:
     menu = PageMenu(
-        dropdowns=[
-            PageMenuDropdown(
-                name="availability",
-                title=_("Availability"),
-                topics=[
-                    PageMenuTopic(
-                        title=_("This view"),
-                        entries=[
-                            PageMenuEntry(
-                                title=_("Availability"),
-                                icon_name=StaticIcon(IconNames.availability),
-                                item=make_simple_link(availability_url),
-                                name="availability",
-                                is_shortcut=False,
-                                is_suggested=False,
-                            )
-                        ],
-                    )
-                ],
-            ),
-        ],
+        dropdowns=_availability_dropdowns(),
         breadcrumb=breadcrumb,
     )
 

tests/unit/cmk/gui/monitor/hosts/test_monitor_all_hosts_page.py

@@ -0,0 +1,54 @@
+#!/usr/bin/env python3
+# Copyright (C) 2026 Checkmk GmbH - License: GNU General Public License v2
+# This file is part of Checkmk (https://checkmk.com). It is subject to the terms and
+# conditions defined in the file COPYING, which is part of this source code package.
+from collections.abc import Iterator
+
+import pytest
+
+from cmk.ccc.user import UserId
+from cmk.gui import login
+from cmk.gui.config import Config
+from cmk.gui.exceptions import MKAuthException
+from cmk.gui.http import request
+from cmk.gui.monitor.hosts._pages._monitor_all_hosts import (
+    _availability_dropdowns,
+    MonitorAllHostsPage,
+)
+from cmk.gui.pages import PageContext
+from cmk.gui.permissions import permission_registry
+from cmk.gui.utils.roles import UserPermissions
+from cmk.gui.views.command.registry import command_registry
+from tests.unit.cmk.gui.users import create_and_destroy_user
+
+
+@pytest.fixture(name="user_without_permissions")
+def fixture_user_without_permissions(load_config: Config) -> Iterator[UserId]:
+    with create_and_destroy_user(
+        automation=False, role="no_permissions", config=load_config
+    ) as created:
+        user_id = created[0]
+        with login.TransactionIdContext(
+            user_id,
+            UserPermissions(
+                load_config.roles, permission_registry, {user_id: ["no_permissions"]}, []
+            ),
+        ):
+            yield user_id
+
+
+def test_page_denied_without_legacy_view_permission(user_without_permissions: UserId) -> None:
+    page = MonitorAllHostsPage(command_registry)
+
+    with pytest.raises(MKAuthException):
+        page.page(PageContext(config=Config(), request=request))
+
+
+def test_availability_dropdown_hidden_without_permission(
+    user_without_permissions: UserId,
+) -> None:
+    assert _availability_dropdowns() == []
+
+
+def test_availability_dropdown_shown_with_permission(with_user_login: UserId) -> None:
+    assert [dropdown.name for dropdown in _availability_dropdowns()] == ["availability"]