diff --git a/CHANGELOG.md b/CHANGELOG.md index 96d2b13a..ef6d5ba5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/). ### Fixed +- Fix missing right checks on some ajax config endpoints and escape default value and URL field output. - Fix item creation with null value for mandatory fields - Fix search crash when two containers share a dropdown field with the same name. - Fix handle native GLPI dropdown types when binding additional fields to form destination diff --git a/ajax/container_display_condition.php b/ajax/container_display_condition.php index d0aafb91..55253479 100644 --- a/ajax/container_display_condition.php +++ b/ajax/container_display_condition.php @@ -27,7 +27,7 @@ * @link https://github.com/pluginsGLPI/fields * ------------------------------------------------------------------------- */ -Session::checkLoginUser(); +Session::checkRight('config', READ); if (isset($_GET['action'])) { if ($_GET['action'] === 'get_add_form') { diff --git a/ajax/container_itemtypes_dropdown.php b/ajax/container_itemtypes_dropdown.php index c527174c..fcf27aea 100644 --- a/ajax/container_itemtypes_dropdown.php +++ b/ajax/container_itemtypes_dropdown.php @@ -28,6 +28,8 @@ * ------------------------------------------------------------------------- */ +declare(strict_types=1); + Session::checkLoginUser(); PluginFieldsContainer::showFormItemtype($_REQUEST); diff --git a/ajax/container_subtype_dropdown.php b/ajax/container_subtype_dropdown.php index 0b70b3f9..e3b5a3db 100644 --- a/ajax/container_subtype_dropdown.php +++ b/ajax/container_subtype_dropdown.php @@ -28,6 +28,8 @@ * ------------------------------------------------------------------------- */ +declare(strict_types=1); + Session::checkLoginUser(); PluginFieldsContainer::showFormSubtype($_REQUEST, true); diff --git a/ajax/field_specific_fields.php b/ajax/field_specific_fields.php index 61671293..e5745ad6 100644 --- a/ajax/field_specific_fields.php +++ b/ajax/field_specific_fields.php @@ -33,7 +33,7 @@ header('Content-Type: text/html; charset=UTF-8'); Html::header_nocache(); -Session::checkLoginUser(); +Session::checkRight('config', READ); $id = $_POST['id']; $type = $_POST['type']; diff --git a/ajax/reorder.php b/ajax/reorder.php index 67e35c09..e287ccaa 100644 --- a/ajax/reorder.php +++ b/ajax/reorder.php @@ -30,7 +30,7 @@ use Glpi\DBAL\QueryExpression; -Session::checkLoginUser(); +Session::checkRight('config', UPDATE); if ( !array_key_exists('container_id', $_POST) diff --git a/ajax/status_override.php b/ajax/status_override.php index ae780789..75e9d219 100644 --- a/ajax/status_override.php +++ b/ajax/status_override.php @@ -28,7 +28,7 @@ * ------------------------------------------------------------------------- */ -Session::checkLoginUser(); +Session::checkRight('config', READ); if (isset($_GET['action'])) { if ($_GET['action'] === 'get_status_dropdown') { diff --git a/front/export_to_yaml.php b/front/export_to_yaml.php index 150cfaa1..6eb20dd0 100644 --- a/front/export_to_yaml.php +++ b/front/export_to_yaml.php @@ -28,6 +28,8 @@ * ------------------------------------------------------------------------- */ +declare(strict_types=1); + include(__DIR__ . '/../hook.php'); Session::checkRight('config', READ); diff --git a/front/labeltranslation.form.php b/front/labeltranslation.form.php index 13de5eff..f928dce3 100644 --- a/front/labeltranslation.form.php +++ b/front/labeltranslation.form.php @@ -28,6 +28,8 @@ * ------------------------------------------------------------------------- */ +declare(strict_types=1); + Session::checkRight('config', UPDATE); $translation = new PluginFieldsLabelTranslation(); diff --git a/front/profile.form.php b/front/profile.form.php index dcc7664f..a27ed64c 100644 --- a/front/profile.form.php +++ b/front/profile.form.php @@ -28,6 +28,8 @@ * ------------------------------------------------------------------------- */ +declare(strict_types=1); + Session::checkRight('config', UPDATE); if (isset($_POST['update'])) { diff --git a/front/regenerate_files.php b/front/regenerate_files.php index fdb68bdf..02acb6b2 100644 --- a/front/regenerate_files.php +++ b/front/regenerate_files.php @@ -28,6 +28,8 @@ * ------------------------------------------------------------------------- */ +declare(strict_types=1); + include(__DIR__ . '/../hook.php'); Session::checkRight('config', READ); diff --git a/inc/field.class.php b/inc/field.class.php index 7f47d65b..28daa9d5 100644 --- a/inc/field.class.php +++ b/inc/field.class.php @@ -696,7 +696,7 @@ public function showSummary($container) echo Dropdown::getDropdownName($table, $this->fields['default_value']); } } else { - echo $this->fields['default_value']; + echo htmlspecialchars((string) $this->fields['default_value']); } echo ''; diff --git a/rector.php b/rector.php index d7f5b473..3cdf1519 100644 --- a/rector.php +++ b/rector.php @@ -28,6 +28,8 @@ * ------------------------------------------------------------------------- */ +declare(strict_types=1); + require_once __DIR__ . '/../../src/Plugin.php'; use Rector\Caching\ValueObject\Storage\FileCacheStorage; diff --git a/templates/fields.html.twig b/templates/fields.html.twig index 44a3c5a4..666abea1 100644 --- a/templates/fields.html.twig +++ b/templates/fields.html.twig @@ -109,7 +109,7 @@ {% elseif type == 'url' %} {% set ext_link %} - {% if value|length %} + {% if value|length and value matches '/^(https?|mailto):/i' %} {{ __('show', 'fields') }} diff --git a/tests/Units/ContainerTest.php b/tests/Units/ContainerTest.php index a7fa7098..74cdc500 100644 --- a/tests/Units/ContainerTest.php +++ b/tests/Units/ContainerTest.php @@ -28,6 +28,8 @@ * ------------------------------------------------------------------------- */ +declare(strict_types=1); + namespace GlpiPlugin\Field\Tests\Units; use Computer; diff --git a/tests/bootstrap.php b/tests/bootstrap.php index 41ae4189..6039a3f7 100644 --- a/tests/bootstrap.php +++ b/tests/bootstrap.php @@ -28,6 +28,8 @@ * ------------------------------------------------------------------------- */ +declare(strict_types=1); + require __DIR__ . '/../../../tests/bootstrap.php'; if (!Plugin::isPluginActive("fields")) {