Skip to content
Permalink
Browse files Browse the repository at this point in the history
Merge pull request from GHSA-52vv-hm4x-8584
  • Loading branch information
cedric-anne committed Apr 5, 2023
1 parent 624adbb commit 784260b
Show file tree
Hide file tree
Showing 4 changed files with 63 additions and 53 deletions.
5 changes: 4 additions & 1 deletion front/container.form.php
Expand Up @@ -53,7 +53,10 @@
$container->update($_POST);
Html::back();
} else if (isset($_POST["update_fields_values"])) {
$container->updateFieldsValues($_REQUEST, $_REQUEST['itemtype'], false);
$right = PluginFieldsProfile::getRightOnContainer($_SESSION['glpiactiveprofile']['id'], $_POST['plugin_fields_containers_id']);
if ($right > READ) {
$container->updateFieldsValues($_REQUEST, $_REQUEST['itemtype'], false);
}
Html::back();
} else {
Html::header(
Expand Down
32 changes: 14 additions & 18 deletions inc/container.class.php
Expand Up @@ -967,7 +967,6 @@ public static function getEntries($type = 'tab', $full = false)

$itemtypes = [];
$container = new self();
$profile = new PluginFieldsProfile();
$found = $container->find($condition, 'label');
foreach ($found as $item) {
//entities restriction
Expand All @@ -986,12 +985,8 @@ public static function getEntries($type = 'tab', $full = false)
continue;
}
//profiles restriction
$found = $profile->find(['profiles_id' => $_SESSION['glpiactiveprofile']['id'],
'plugin_fields_containers_id' => $item['id'],
'right' => ['>=', READ]
]);
$first_found = array_shift($found);
if (!$first_found || $first_found['right'] == null || $first_found['right'] == 0) {
$right = PluginFieldsProfile::getRightOnContainer($_SESSION['glpiactiveprofile']['id'], $item['id']);
if ($right < READ) {
continue;
}

Expand Down Expand Up @@ -1457,16 +1452,10 @@ public static function findContainer($itemtype, $type = 'tab', $subtype = '')
}

//profiles restriction
if (isset($_SESSION['glpiactiveprofile']['id'])) {
$profile = new PluginFieldsProfile();
if (isset($id)) {
$found = $profile->find(['profiles_id' => $_SESSION['glpiactiveprofile']['id'],
'plugin_fields_containers_id' => $id
]);
$first_found = array_shift($found);
if ($first_found === null || $first_found['right'] == null || $first_found['right'] == 0) {
return false;
}
if (isset($_SESSION['glpiactiveprofile']['id']) && $id > 0) {
$right = PluginFieldsProfile::getRightOnContainer($_SESSION['glpiactiveprofile']['id'], $id);
if ($right < READ) {
return false;
}
}

Expand Down Expand Up @@ -1551,9 +1540,16 @@ public static function preItem(CommonDBTM $item)
}
}

//need to check if container is usable on this object entity
$loc_c = new PluginFieldsContainer();
$loc_c->getFromDB($c_id);

// check rights on $c_id
$right = PluginFieldsProfile::getRightOnContainer($_SESSION['glpiactiveprofile']['id'], $c_id);
if (($right > READ) === false) {
return;
}

// need to check if container is usable on this object entity
$entities = [$loc_c->fields['entities_id']];
if ($loc_c->fields['is_recursive']) {
$entities = getSonsOf(getTableForItemType('Entity'), $loc_c->fields['entities_id']);
Expand Down
61 changes: 27 additions & 34 deletions inc/field.class.php
Expand Up @@ -722,13 +722,12 @@ public function showForm($ID, $options = [])

public static function showForTabContainer($c_id, $item)
{
//profile restriction (for reading profile)
$profile = new PluginFieldsProfile();
$found = $profile->find(['profiles_id' => $_SESSION['glpiactiveprofile']['id'],
'plugin_fields_containers_id' => $c_id
]);
$first_found = array_shift($found);
$canedit = ($first_found['right'] == CREATE);
//profile restriction
$right = PluginFieldsProfile::getRightOnContainer($_SESSION['glpiactiveprofile']['id'], $c_id);
if ($right < READ) {
return;
}
$canedit = $right > READ;

//get fields for this container
$field_obj = new self();
Expand Down Expand Up @@ -794,8 +793,6 @@ public static function showDomContainer($id, $item, $type = "dom", $subtype = ""
*/
public static function showForTab($params)
{
Html::requireJs('tinymce');

$item = $params['item'];

$functions = array_column(debug_backtrace(), 'function');
Expand All @@ -814,13 +811,21 @@ public static function showForTab($params)
if ($type != 'domtab') {
$subtype = "";
}

//find container (if not exist, do nothing)
if (isset($_REQUEST['c_id'])) {
$c_id = $_REQUEST['c_id'];
} else if (!$c_id = PluginFieldsContainer::findContainer(get_Class($item), $type, $subtype)) {
return false;
}

$right = PluginFieldsProfile::getRightOnContainer($_SESSION['glpiactiveprofile']['id'], $c_id);
if ($right < READ) {
return;
}

Html::requireJs('tinymce');

//need to check if container is usable on this object entity
$loc_c = new PluginFieldsContainer();
$loc_c->getFromDB($c_id);
Expand Down Expand Up @@ -964,10 +969,18 @@ public static function prepareHtmlFields(
}

//get object associated with this fields
$tmp = $fields;
$first_field = array_shift($tmp);
$first_field = reset($fields);
$container_obj = new PluginFieldsContainer();
$container_obj->getFromDB($first_field['plugin_fields_containers_id']);
if (!$container_obj->getFromDB($first_field['plugin_fields_containers_id'])) {
return false;
}

// check if current profile can edit fields
$right = PluginFieldsProfile::getRightOnContainer($_SESSION['glpiactiveprofile']['id'], $container_obj->getID());
if ($right < READ) {
return;
}
$canedit = $right > READ;

// Fill status overrides if needed
if (in_array($item->getType(), PluginFieldsStatusOverride::getStatusItemtypes())) {
Expand All @@ -994,29 +1007,9 @@ public static function prepareHtmlFields(
$found_v = array_shift($found_values);
}

// find profiles (to check if current profile can edit fields)
$fprofile = new PluginFieldsProfile();
$found_p = $fprofile->find(
[
'profiles_id' => $_SESSION['glpiactiveprofile']['id'],
'plugin_fields_containers_id' => $first_field['plugin_fields_containers_id'],
]
);
$first_found_p = array_shift($found_p);

// test status for "CommonITILObject" objects
if ($item instanceof CommonITILObject) {
$status = $item->fields['status'] ?? null;
if (
($status !== null && in_array($status, $item->getClosedStatusArray()))
|| $first_found_p['right'] != CREATE
) {
$canedit = false;
}
} else {
if ($first_found_p['right'] != CREATE) {
$canedit = false;
}
if ($item instanceof CommonITILObject && in_array($item->fields['status'] ?? null, $item->getClosedStatusArray())) {
$canedit = false;
}

//show all fields
Expand Down
18 changes: 18 additions & 0 deletions inc/profile.class.php
Expand Up @@ -196,4 +196,22 @@ public static function deleteProfile(Profile $profile)
$fields_profile->deleteByCriteria(['profiles_id' => $profile->fields['id']]);
return true;
}

public static function getRightOnContainer(int $profile_id, int $container_id): int
{
global $DB;

$container_profile = $DB->request(
[
'SELECT' => ['MAX' => 'right AS right'],
'FROM' => self::getTable(),
'WHERE' => [
'profiles_id' => $profile_id,
'plugin_fields_containers_id' => $container_id,
],
]
);

return (int)$container_profile->current()['right'];
}
}

0 comments on commit 784260b

Please sign in to comment.