18194 FIX Host check command: crash when using "Use a custom check plug-in" option

When setting the "Use a custom check plug-in" option for the Host check command ruleset
and then logging in as a normal monitoring user without the permission to configure this
option, this would lead to a crash to both the UI and the REST API.

Now this option is still being display but not editable by users without permission.

SUP-23384

Change-Id: Id709889822f854f3010324944b64507828769a55

Author: loocars

.werks/18194.md

@@ -0,0 +1,18 @@
+[//]: # (werk v2)
+# Host check command: crash when using "Use a custom check plug-in" option
+
+key        | value
+---------- | ---
+date       | 2025-07-23T07:31:03+00:00
+version    | 2.4.0p9
+class      | fix
+edition    | cre
+component  | wato
+level      | 1
+compatible | yes
+
+When setting the "Use a custom check plug-in" option for the Host check command ruleset
+and then logging in as a normal monitoring user without the permission to configure this
+option, this would lead to a crash to both the UI and the REST API.
+
+Now this option is still being display but not editable by users without permission.

cmk/gui/wato/_check_mk_configuration.py

@@ -3778,18 +3778,26 @@ def _host_check_commands_host_check_command_choices() -> list[CascadingDropdownC
             ),
         ),
     ]
+    if edition(cmk.utils.paths.omd_root) is Edition.CSE:
+        return choices
 
-    if (
-        user.may("wato.add_or_modify_executables")
-        and edition(cmk.utils.paths.omd_root) is not Edition.CSE
-    ):
-        choices.append(("custom", _("Use a custom check plug-in..."), PluginCommandLine()))
-
+    choices.append(
+        (
+            "custom",
+            _("Use a custom check plug-in..."),
+            PluginCommandLine(read_only=not user.may("wato.add_or_modify_executables")),
+        )
+    )
     return choices
 
 
-def PluginCommandLine() -> ValueSpec:
+def PluginCommandLine(read_only: bool = False) -> ValueSpec:
     def _validate_custom_check_command_line(value, varprefix):
+        if read_only:
+            raise MKUserError(
+                varprefix,
+                _("You are not allowed to change the command line of a custom check plug-in."),
+            )
         if "--pwstore=" in value:
             raise MKUserError(
                 varprefix, _("You are not allowed to use passwords from the password store here.")
@@ -3805,6 +3813,7 @@ def _validate_custom_check_command_line(value, varprefix):
         )
         + monitoring_macro_help(),
         size="max",
+        read_only=read_only,
         validate=_validate_custom_check_command_line,
     )