From 209c29991b69524298943c0c87b7ea941a673b5e Mon Sep 17 00:00:00 2001
From: Jake Barnby <jakeb994@gmail.com>
Date: Sun, 25 Feb 2024 18:49:25 +1300
Subject: [PATCH] Only return allowed runtimes in runtime list route

---
 app/controllers/api/functions.php | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/app/controllers/api/functions.php b/app/controllers/api/functions.php
index 8c4eb8b09a..0de6f28d57 100644
--- a/app/controllers/api/functions.php
+++ b/app/controllers/api/functions.php
@@ -420,17 +420,23 @@ App::get('/v1/functions/runtimes')
     ->label('sdk.response.model', Response::MODEL_RUNTIME_LIST)
     ->inject('response')
     ->action(function (Response $response) {
-
         $runtimes = Config::getParam('runtimes');
 
-        $runtimes = array_map(function ($key) use ($runtimes) {
+        $allowList = \array_filter(\explode(',', App::getEnv('_APP_FUNCTIONS_RUNTIMES', '')));
+
+        $allowed = [];
+        foreach ($runtimes as $key => $runtime) {
+            if (!empty($allowList) && !\in_array($key, $allowList)) {
+                continue;
+            }
+
             $runtimes[$key]['$id'] = $key;
-            return $runtimes[$key];
-        }, array_keys($runtimes));
+            $allowed[] = $runtimes[$key];
+        }
 
         $response->dynamic(new Document([
-            'total' => count($runtimes),
-            'runtimes' => $runtimes
+            'total' => count($allowed),
+            'runtimes' => $allowed
         ]), Response::MODEL_RUNTIME_LIST);
     });