Fix: check rights and escape output on field forms

CHANGELOG.md

@@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/).
 
 ### Fixed
 
+- Fix missing right checks on some ajax config endpoints and escape default value and URL field output.
 - Fix item creation with null value for mandatory fields
 - Fix search crash when two containers share a dropdown field with the same name.
 - Fix handle native GLPI dropdown types when binding additional fields to form destination

ajax/container_display_condition.php

@@ -27,7 +27,7 @@
  * @link      https://github.com/pluginsGLPI/fields
  * -------------------------------------------------------------------------
  */
-Session::checkLoginUser();
+Session::checkRight('config', READ);
 
 if (isset($_GET['action'])) {
     if ($_GET['action'] === 'get_add_form') {

ajax/container_itemtypes_dropdown.php

@@ -28,6 +28,8 @@
  * -------------------------------------------------------------------------
  */
 
+declare(strict_types=1);
+
 Session::checkLoginUser();
 
 PluginFieldsContainer::showFormItemtype($_REQUEST);

ajax/container_subtype_dropdown.php

@@ -28,6 +28,8 @@
  * -------------------------------------------------------------------------
  */
 
+declare(strict_types=1);
+
 Session::checkLoginUser();
 
 PluginFieldsContainer::showFormSubtype($_REQUEST, true);

ajax/field_specific_fields.php

@@ -33,7 +33,7 @@
 
 header('Content-Type: text/html; charset=UTF-8');
 Html::header_nocache();
-Session::checkLoginUser();
+Session::checkRight('config', READ);
 
 $id   = $_POST['id'];
 $type = $_POST['type'];

ajax/reorder.php

@@ -30,7 +30,7 @@
 
 use Glpi\DBAL\QueryExpression;
 
-Session::checkLoginUser();
+Session::checkRight('config', UPDATE);
 
 if (
     !array_key_exists('container_id', $_POST)

ajax/status_override.php

@@ -28,7 +28,7 @@
  * -------------------------------------------------------------------------
  */
 
-Session::checkLoginUser();
+Session::checkRight('config', READ);
 
 if (isset($_GET['action'])) {
     if ($_GET['action'] === 'get_status_dropdown') {

front/export_to_yaml.php

@@ -28,6 +28,8 @@
  * -------------------------------------------------------------------------
  */
 
+declare(strict_types=1);
+
 include(__DIR__ . '/../hook.php');
 
 Session::checkRight('config', READ);

front/labeltranslation.form.php

@@ -28,6 +28,8 @@
  * -------------------------------------------------------------------------
  */
 
+declare(strict_types=1);
+
 Session::checkRight('config', UPDATE);
 
 $translation = new PluginFieldsLabelTranslation();

front/profile.form.php

@@ -28,6 +28,8 @@
  * -------------------------------------------------------------------------
  */
 
+declare(strict_types=1);
+
 Session::checkRight('config', UPDATE);
 
 if (isset($_POST['update'])) {

front/regenerate_files.php

@@ -28,6 +28,8 @@
  * -------------------------------------------------------------------------
  */
 
+declare(strict_types=1);
+
 include(__DIR__ . '/../hook.php');
 
 Session::checkRight('config', READ);

inc/field.class.php

@@ -696,7 +696,7 @@ public function showSummary($container)
                             echo Dropdown::getDropdownName($table, $this->fields['default_value']);
                         }
                     } else {
-                        echo $this->fields['default_value'];
+                        echo htmlspecialchars((string) $this->fields['default_value']);
                     }
 
                     echo '</td>';

rector.php

@@ -28,6 +28,8 @@
  * -------------------------------------------------------------------------
  */
 
+declare(strict_types=1);
+
 require_once __DIR__ . '/../../src/Plugin.php';
 
 use Rector\Caching\ValueObject\Storage\FileCacheStorage;

templates/fields.html.twig

@@ -109,7 +109,7 @@
 
     {% elseif type == 'url' %}
             {% set ext_link %}
-            {% if value|length %}
+            {% if value|length and value matches '/^(https?|mailto):/i' %}
                 <a target="_blank" href="{{ value }}">
                     <i class="ti ti-external-link"></i>
                     {{ __('show', 'fields') }}

tests/Units/ContainerTest.php

@@ -28,6 +28,8 @@
  * -------------------------------------------------------------------------
  */
 
+declare(strict_types=1);
+
 namespace GlpiPlugin\Field\Tests\Units;
 
 use Computer;

tests/bootstrap.php

@@ -28,6 +28,8 @@
  * -------------------------------------------------------------------------
  */
 
+declare(strict_types=1);
+
 require __DIR__ . '/../../../tests/bootstrap.php';
 
 if (!Plugin::isPluginActive("fields")) {