1. diff --git a/html/includes/forms/get-vmlist.inc.php b/html/includes/forms/get-vmlist.inc.php
2. index 468f17963..08df3dd89 100644
3. --- a/html/includes/forms/get-vmlist.inc.php
4. +++ b/html/includes/forms/get-vmlist.inc.php
5. @@ -16,19 +16,28 @@
6.   * @author     Aldemir Akpinar <aldemir>
7.   */
8.  
9. -$vm_query = "SELECT a.vmwVmDisplayName AS vmname, a.vmwVmState AS powerstat, a.device_id AS deviceid, b.hostname AS physicalsrv, b.sysname AS sysname, a.vmwVmGuestOS AS os, a.vmwVmMemSize AS memory, a.vmwVmCpus AS cpu FROM vminfo AS a  LEFT JOIN devices AS b ON  a.device_id = b.device_id";
10. +use LibreNMS\Authentication\Auth;
11.  
12. -if (isset($_POST['searchPhrase']) && !empty($_POST['searchPhrase'])) {
13. +$vm_query = "SELECT v.vmwVmDisplayName AS vmname, v.vmwVmState AS powerstat, v.device_id AS deviceid, d.hostname AS physicalsrv, d.sysname AS sysname, v.vmwVmGuestOS AS os, v.vmwVmMemSize AS memory, v.vmwVmCpus AS cpu FROM vminfo AS v LEFT JOIN devices AS d ON v.device_id = d.device_id";
14. +if (!Auth::user()->hasGlobalRead()) {
15. +    $vm_query .= ' LEFT JOIN `devices_perms` AS `DP` ON `d`.`device_id` = `DP`.`device_id`';
16. +    $where .= ' AND `DP`.`user_id`=?';
17. +    $param = [Auth::id()];
18. +}
19. +    
20. +if (isset($vars['searchPhrase']) && !empty($vars['searchPhrase'])) {
21.      #This is a bit ugly
22.      $vm_query .= " WHERE a.vmwVmDisplayName LIKE ? OR b.hostname LIKE ? OR a.vmwVmGuestOS LIKE ? OR b.sysname LIKE ?";
23.      $count_query = "SELECT COUNT(a.vmwVmDisplayName) FROM vminfo AS a LEFT JOIN devices AS b ON  a.device_id = b.device_id WHERE a.vmwVmDisplayName LIKE ? OR b.hostname LIKE ? OR a.vmwVmGuestOS LIKE ? OR b.sysname LIKE ?";
24. +    $searchphrase = "%{$vars['searchPhrase']}%";
25. +    array_push($param, $searchphrase, $searchphrase, $searchphrase, $searchphrase);
26.  } else {
27.      $count_query = "SELECT COUNT(*) FROM vminfo ";
28.  }
29.  
30.  $order_by = '';
31. -if (isset($_REQUEST['sort']) && is_array($_REQUEST['sort'])) {
32. -    foreach ($_REQUEST['sort'] as $key => $value) {
33. +if (isset($vars['sort']) && is_array($vars['sort'])) {
34. +    foreach ($vars['sort'] as $key => $value) {
35.          $order_by .= " $key $value";
36.      }
37.  } else {
38. @@ -37,30 +46,17 @@ if (isset($_REQUEST['sort']) && is_array($_REQUEST['sort'])) {
39.  
40.  $vm_query .= " ORDER BY " . $order_by;
41.  
42. -if (is_numeric($_POST['rowCount']) && is_numeric($_POST['current'])) {
43. -    $rowcount = $_POST['rowCount'];
44. -    $current = $_POST['current'];
45. +if (is_numeric($vars['rowCount']) && is_numeric($vars['current'])) {
46. +    $rowcount = $vars['rowCount'];
47. +    $current = $vars['current'];
48.      $vm_query .= " LIMIT ".$rowcount * ($current - 1).", ".$rowcount;
49.  }
50.  
51. -if (!empty($_POST['searchPhrase'])) {
52. -    $searchphrase = '%'.mres($_POST['searchPhrase']).'%';
53. -    $vm_arr = dbFetchRows($vm_query, array($searchphrase, $searchphrase, $searchphrase, $searchphrase));
54. -    $rec_count = dbFetchCell($count_query, array($searchphrase, $searchphrase, $searchphrase, $searchphrase));
55. -} else {
56. -    $vm_arr = dbFetchRows($vm_query);
57. -    $rec_count = dbFetchCell($count_query);
58. -}
59. -
60. -foreach ($vm_arr as $k => $v) {
61. -    if (device_permitted($v['deviceid']) === false) {
62. -        unset($vm_arr[$k]);
63. -        $rec_count--;
64. -    }
65. -}
66. +$vm_arr = dbFetchRows($vm_query, $param);
67. +$rec_count = dbFetchCell($count_query, $param);
68.  
69. -
70. -$status = array('current' => $current, 'rowCount' => $rowcount, 'rows' => $vm_arr, 'total' => $rec_count);
71. +$status = ['current' => $current, 'rowCount' => $rowcount, 'rows' => $vm_arr, 'total' => $rec_count];
72.  
73.  header('Content-Type: application/json');
74.  echo _json_encode($status);
75. +
76.