From 9c50e4bc8bef6ac82780a35d5711b0e5af345fe0 Mon Sep 17 00:00:00 2001
From: Gary Ewan Park <gep13@gep13.co.uk>
Date: Wed, 22 Jan 2025 11:58:38 +0000
Subject: [PATCH] (#3604) Don't allow trace logging when no elevated

Prior to this change, trace level logging was available to everyone.
However, due to the sensitive nature of some of the output, the
decision has been taken to restrict trace logging to only elevated
sessions.

When an attempt is made to use trace logging in a non-elevated session,
a warning will be shown, and no trace logging will be shown.  In
addition, if the -r option is in play, the warning about no trace
logging will go to the log file, but won't be displayed.
---
 src/chocolatey.console/Program.cs | 18 +++++++++++++++++-
 src/chocolatey/GetChocolatey.cs   | 10 +++++++++-
 2 files changed, 26 insertions(+), 2 deletions(-)

diff --git a/src/chocolatey.console/Program.cs b/src/chocolatey.console/Program.cs
index 312673a473..877f4d5460 100644
--- a/src/chocolatey.console/Program.cs
+++ b/src/chocolatey.console/Program.cs
@@ -145,7 +145,23 @@ private static void Main(string[] args)
                 var traceAppenderName = "{0}LoggingColoredConsoleAppender".FormatWith(ChocolateyLoggers.Trace.ToStringSafe());
                 Log4NetAppenderConfiguration.EnableDebugLoggingIf(config.Debug, verboseAppenderName, traceAppenderName);
                 Log4NetAppenderConfiguration.EnableVerboseLoggingIf(config.Verbose, config.Debug, verboseAppenderName);
-                Log4NetAppenderConfiguration.EnableTraceLoggingIf(config.Trace, traceAppenderName);
+
+                if (config.Information.IsProcessElevated)
+                {
+                    Log4NetAppenderConfiguration.EnableTraceLoggingIf(config.Trace, traceAppenderName);
+                }
+                else
+                {
+                    var logger = ChocolateyLoggers.Normal;
+
+                    if (!config.RegularOutput)
+                    {
+                        logger = ChocolateyLoggers.LogFileOnly;
+                    }
+
+                    "chocolatey".Log().Warn(logger, "Usage of the --trace option is only allowed when running from an elevated session.");
+                }
+                
                 "chocolatey".Log().Debug(() => "{0} is running on {1} v {2}".FormatWith(ApplicationParameters.Name, config.Information.PlatformType, config.Information.PlatformVersion.ToStringSafe()));
                 //"chocolatey".Log().Debug(() => "Command Line: {0}".FormatWith(Environment.CommandLine));
 
diff --git a/src/chocolatey/GetChocolatey.cs b/src/chocolatey/GetChocolatey.cs
index 0e5236fd59..cef87f4b8f 100644
--- a/src/chocolatey/GetChocolatey.cs
+++ b/src/chocolatey/GetChocolatey.cs
@@ -448,7 +448,15 @@ private T EnsureOriginalConfiguration<T>(IList<string> args, Func<ChocolateyConf
                 var traceAppenderName = "{0}LoggingColoredConsoleAppender".FormatWith(ChocolateyLoggers.Trace.ToStringSafe());
                 Log4NetAppenderConfiguration.EnableDebugLoggingIf(configuration.Debug, verboseAppenderName, traceAppenderName);
                 Log4NetAppenderConfiguration.EnableVerboseLoggingIf(configuration.Verbose, configuration.Debug, verboseAppenderName);
-                Log4NetAppenderConfiguration.EnableTraceLoggingIf(configuration.Trace, traceAppenderName);
+
+                var logger = ChocolateyLoggers.Normal;
+
+                if (!configuration.RegularOutput)
+                {
+                    logger = ChocolateyLoggers.LogFileOnly;
+                }
+
+                "chocolatey".Log().Warn(logger, "Usage of the --trace option is only allowed when running from an elevated session.");
             }
             finally
             {