Fix: correct answer and dropdown data handling

CHANGELOG.md

@@ -13,6 +13,8 @@ and this project adheres to [Semantic Versioning](http://semver.org/).
 
 ### Fixed
 
+- Fixed the `Hidden`, `IP address`, and `Hostname` questions to always use the correct value regardless of what was submitted, and restored the missing access check on the tree cascade dropdown children endpoint
+- Fixed the `LDAP select` question's autocomplete search to properly handle special characters in the search text
 - Fix visibility conditions on tree cascade dropdown questions
 - Fixed the `Tree cascade Dropdown` field so that the subtree depth limit is enforced when loading children via AJAX
 - Fixed the `Tree cascade Dropdown` question to only show items from the configured custom dropdown instead of all custom dropdowns

src/Controller/TreeDropdownChildrenController.php

@@ -39,6 +39,7 @@
 use CommonTreeDropdown;
 use Glpi\Application\View\TemplateRenderer;
 use Glpi\Controller\AbstractController;
+use Glpi\Controller\Form\Utils\CanCheckAccessPolicies;
 use Glpi\Http\Firewall;
 use Glpi\Security\Attribute\SecurityStrategy;
 use Symfony\Component\HttpFoundation\Request;
@@ -47,6 +48,8 @@
 
 final class TreeDropdownChildrenController extends AbstractController
 {
+    use CanCheckAccessPolicies;
+
     #[SecurityStrategy(Firewall::STRATEGY_AUTHENTICATED)]
     #[Route(
         path: 'TreeDropdownChildren',
@@ -66,6 +69,9 @@ public function __invoke(Request $request): Response
             return new Response('', Response::HTTP_OK);
         }
 
+        // Validate that the form is readable for the current user
+        $this->checkFormAccessPolicies($question->getForm(), $request);
+
         /** @var QuestionTypeItemDropdown $question_type */
         $question_type = $question->getQuestionType();
 

src/Model/Dropdown/LdapDropdown.php

@@ -144,10 +144,11 @@ public function getDropdownValues(LdapDropdownQuery $query): array
 
         // Insert search text into filter if specified
         if ($search_text !== '') {
+            $escaped_search_text = ldap_escape($search_text, '', LDAP_ESCAPE_FILTER);
             $ldap_filter = sprintf(
                 "(& %s (%s))",
                 $config->getLdapFilter(),
-                $attribute . '=*' . $search_text . '*',
+                $attribute . '=*' . $escaped_search_text . '*',
             );
         } else {
             $ldap_filter = $config->getLdapFilter();

src/Model/QuestionType/HiddenQuestion.php

@@ -115,6 +115,13 @@ public function isHiddenInput(): bool
         return true;
     }
 
+    #[Override]
+    public function prepareEndUserAnswer(Question $question, mixed $answer): mixed
+    {
+        // Ignore the submitted value: this field must never be attacker-controlled.
+        return $question->fields['default_value'];
+    }
+
     #[Override]
     public static function getConfigKey(): string
     {

src/Model/QuestionType/HostnameQuestion.php

@@ -118,6 +118,13 @@ public function isHiddenInput(): bool
         return true;
     }
 
+    #[Override]
+    public function prepareEndUserAnswer(Question $question, mixed $answer): mixed
+    {
+        // Ignore the submitted value: this field must never be attacker-controlled.
+        return gethostbyaddr(NetworkHelper::getRemoteIpAddress());
+    }
+
     #[Override]
     public static function getConfigKey(): string
     {

src/Model/QuestionType/IpAddressQuestion.php

@@ -118,6 +118,13 @@ public function isHiddenInput(): bool
         return true;
     }
 
+    #[Override]
+    public function prepareEndUserAnswer(Question $question, mixed $answer): mixed
+    {
+        // Ignore the submitted value: this field must never be attacker-controlled.
+        return NetworkHelper::getRemoteIpAddress();
+    }
+
     #[Override]
     public static function getConfigKey(): string
     {