Show anonymized (AAAA****ZZZZ) API key in remote server view (#10731)

app/Controller/EventsController.php

@@ -3709,7 +3709,7 @@ public function delete($id = null)
                 $this->redirect(array('action' => 'index'));
             }
         } else {
-            $eventList = is_numeric($id) ? [$id] : $this->_jsonDecode($id);
+            $eventList = (is_numeric($id) || Validation::uuid($id)) ? [$id] : $this->_jsonDecode($id);
             $this->request->data['Event']['id'] = json_encode($eventList);
             $this->set('idArray', $eventList);
             $this->layout = false;
@@ -4224,7 +4224,7 @@ public function restSearchExport($id = null, $returnFormat = null)
                 'yara-json' => __('YARA rules (JSON)'),
             ];
 
-            $idList = is_numeric($id) ? [$id] : $this->_jsonDecode($id);
+            $idList = (is_numeric($id) || Validation::uuid($id)) ? [$id] : $this->_jsonDecode($id);
             if (empty($idList)) {
                 throw new NotFoundException(__('Invalid input.'));
             }

app/Controller/ServersController.php

@@ -52,10 +52,7 @@ public function beforeFilter()
 
     public function index()
     {
-        // Do not fetch server authkey from DB
-        $fields = $this->Server->schema();
-        unset($fields['authkey']);
-        $fields = array_keys($fields);
+        $fields = array_keys($this->Server->schema());
 
         $filters = $this->IndexFilter->harvestParameters(['search']);
         $conditions = [];
@@ -84,6 +81,14 @@ public function index()
             );
             $servers = $this->Server->find('all', $params);
             $servers = $this->Server->attachServerCacheTimestamps($servers);
+            $isSiteAdmin = $this->_isSiteAdmin();
+            foreach ($servers as $k => $server) {
+                if ($isSiteAdmin) {
+                    $servers[$k]['Server']['authkey'] = $this->Server->anonymizeAuthkey($server['Server']['authkey']);
+                } else {
+                    unset($servers[$k]['Server']['authkey']);
+                }
+            }
             return $this->RestResponse->viewData($servers, $this->response->type());
         } else {
             $this->paginate['fields'] = $fields;
@@ -98,6 +103,14 @@ public function index()
             $collection['tags'] = $this->Tag->find('list', array(
                   'fields' => array('id', 'name'),
             ));
+            $isSiteAdmin = $this->_isSiteAdmin();
+            foreach ($servers as $k => $server) {
+                if ($isSiteAdmin) {
+                    $servers[$k]['Server']['authkey'] = $this->Server->anonymizeAuthkey($server['Server']['authkey']);
+                } else {
+                    unset($servers[$k]['Server']['authkey']);
+                }
+            }
             $servers = $this->Server->attachRuleDescriptions($servers, $collection);
             $this->set('servers', $servers);
             $this->set('collection', $collection);
@@ -1763,7 +1776,7 @@ public function postTest()
 
     public function getRemoteUser($id)
     {
-        $user = $this->Server->getRemoteUser($id);
+        $user = $this->Server->getRemoteUser($id, $this->_isSiteAdmin());
         if ($user === null) {
             throw new NotFoundException(__('Invalid server'));
         }

app/Model/Server.php

@@ -5138,13 +5138,36 @@ private function serverGetRequest(array $server, $relativeUri)
 
         return $response;
     }
+    /**
+     * @param string $authkey
+     * @return string
+     */
+    public function anonymizeAuthkey($authkey)
+    {
+        if (empty($authkey)) {
+            return '';
+        }
+        if (EncryptedValue::isEncrypted($authkey)) {
+            try {
+                $authkey = (new EncryptedValue($authkey))->decrypt();
+            } catch (Exception $e) {
+                return 'ERROR: Could not decrypt authkey';
+            }
+        }
+        if (strlen($authkey) < 10) {
+            return $authkey;
+        }
+        return substr($authkey, 0, 4) . '****' . substr($authkey, -4);
+    }
+
 
     /**
      * @param int $id
+     * @param bool $isSiteAdmin
      * @return array|null
      * @throws JsonException
      */
-    public function getRemoteUser($id)
+    public function getRemoteUser($id, $isSiteAdmin = false)
     {
         $server = $this->find('first', array(
             'conditions' => array('Server.id' => $id),
@@ -5167,6 +5190,9 @@ public function getRemoteUser($id)
                 __('Sync Internal flag') => isset($user['Role']['perm_sync_internal']) ? ($user['Role']['perm_sync_internal'] ? __('Yes') : __('No')) : __('Unknown, outdated instance'),
                 __('Sync Authoritative flag') => isset($user['Role']['perm_sync_authoritative']) ? ($user['Role']['perm_sync_authoritative'] ? __('Yes') : __('No')) : __('Unknown, outdated instance'),
             ];
+            if ($isSiteAdmin) {
+                $results[__('Anonymized API key')] = $this->anonymizeAuthkey($server['Server']['authkey']);
+            }
             if ($response->getHeader('X-Auth-Key-Expiration')) {
                 $date = new DateTime($response->getHeader('X-Auth-Key-Expiration'));
                 $results[__('Auth key expiration')] = $date->format('Y-m-d H:i:s');

app/View/Servers/index.ctp

@@ -55,6 +55,12 @@
                     ],
                     'data_html' => '<span role="button" tabindex="0" aria-label="' . __('View the sync user of the remote instance') . '" title="' . __('View the sync user of the remote instance') . '" class="btn btn-primary" style="line-height:10px; padding: 4px 4px;" onClick="getRemoteSyncUser(%s);">' . __('View') . '</span>',
                 ],
+                [
+                    'name' => __('Authkey'),
+                    'data_path' => 'Server.authkey',
+                    'class' => 'short',
+                    'requirement' => $isSiteAdmin,
+                ],
                 [
                     'name' =>  __('Reset API key'),
                     'element' => 'postlink',