From c2039583d6196095686143a927569ca5930abb52 Mon Sep 17 00:00:00 2001
From: Johannes Meyer <johannes.meyer@icinga.com>
Date: Wed, 13 Dec 2023 16:47:15 +0100
Subject: [PATCH] CommandActions: Only respond with JSON if it's an API request

fixes #945
---
 library/Icingadb/Common/CommandActions.php | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/library/Icingadb/Common/CommandActions.php b/library/Icingadb/Common/CommandActions.php
index 2cd13feef..ea5c2daf7 100644
--- a/library/Icingadb/Common/CommandActions.php
+++ b/library/Icingadb/Common/CommandActions.php
@@ -139,7 +139,8 @@ protected function assertIsGrantedOnCommandTargets(string $permission)
     protected function handleCommandForm($form)
     {
         $isXhr = $this->getRequest()->isXmlHttpRequest();
-        if ($isXhr && $this->getRequest()->isApiRequest()) {
+        $isApi = $this->getRequest()->isApiRequest();
+        if ($isXhr && $isApi) {
             // Prevents the framework already, this is just a fail-safe
             $this->httpBadRequest('Responding with JSON during a Web request is not supported');
         }
@@ -151,7 +152,7 @@ protected function handleCommandForm($form)
 
         $form->setObjects($this->getCommandTargets());
 
-        if ($isXhr) {
+        if (! $isApi || $isXhr) {
             $this->handleWebRequest($form);
         } else {
             $this->handleApiRequest($form);