Fix(Core): use item-scoped access check on escalation routes

CHANGELOG.md

@@ -11,6 +11,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/).
 
 - Fix infinite loop / Gateway Timeout when a ticket's assigned technician and assigned group are changed simultaneously, caused by a synchronous actor removal during `pre_item_update()`
 - Fixed group reassignment to remove previously assigned groups only when using the Escalade reassignment action
+- Use item-scoped access check on escalation routes
 
 ## [2.10.6] - 2026-07-31
 

front/climb_group.php

@@ -48,7 +48,8 @@
 $tickets_id = (int) $_REQUEST['tickets_id'];
 
 $ticket = new Ticket();
-if (!$ticket->getFromDB($tickets_id) || !$ticket->canAssign()) {
+
+if (!$ticket->getFromDB($tickets_id) || !$ticket->canAssign() || !$ticket->checkEntity(true)) {
     throw new AccessDeniedHttpException();
 }
 

front/ticket.form.php

@@ -40,7 +40,8 @@
     $tickets_id = (int) $_POST['tickets_id'];
 
     $ticket = new Ticket();
-    if (!$ticket->getFromDB($tickets_id) || !$ticket->canAssign()) {
+
+    if (!$ticket->getFromDB($tickets_id) || !$ticket->canAssign() || !$ticket->checkEntity(true)) {
         throw new AccessDeniedHttpException();
     }
 

tests/Units/EscalationAccessTest.php

@@ -0,0 +1,83 @@
+<?php
+
+/**
+ * -------------------------------------------------------------------------
+ * Escalade plugin for GLPI
+ * -------------------------------------------------------------------------
+ *
+ * LICENSE
+ *
+ * This file is part of Escalade.
+ *
+ * Escalade is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * Escalade is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with Escalade. If not, see <http://www.gnu.org/licenses/>.
+ * -------------------------------------------------------------------------
+ * @copyright Copyright (C) 2015-2023 by Escalade plugin team.
+ * @license   GPLv2 https://www.gnu.org/licenses/gpl-2.0.html
+ * @link      https://github.com/pluginsGLPI/escalade
+ * -------------------------------------------------------------------------
+ */
+
+namespace GlpiPlugin\Escalade\Tests\Units;
+
+use GlpiPlugin\Escalade\Tests\EscaladeTestCase;
+use ProfileRight;
+use Ticket;
+
+final class EscalationAccessTest extends EscaladeTestCase
+{
+    private function setTechnicianTicketRight(int $right): void
+    {
+        ProfileRight::updateProfileRights(
+            getItemByTypeName('Profile', 'Technician', true),
+            ['ticket' => $right],
+        );
+    }
+
+    private function loadTicket(int $tickets_id): Ticket
+    {
+        $ticket = new Ticket();
+        $ticket->getFromDB($tickets_id);
+        return $ticket;
+    }
+
+    public function testAssignOnlyUserCanReachEscalationRoutes(): void
+    {
+        $this->initConfig();
+        $tickets_id = $this->createItem(Ticket::class, ['name' => 'Escalation access test', 'content' => ''])->getID();
+
+        $this->setTechnicianTicketRight(Ticket::ASSIGN);
+        $this->login('tech', 'tech');
+
+        $ticket = $this->loadTicket($tickets_id);
+        $this->assertTrue(
+            $ticket->canAssign() && $ticket->checkEntity(),
+            'A user with only the ASSIGN right must be allowed to reach escalation routes',
+        );
+    }
+
+    public function testUpdateOnlyUserCannotReachEscalationRoutes(): void
+    {
+        $this->initConfig();
+        $tickets_id = $this->createItem(Ticket::class, ['name' => 'Escalation access test', 'content' => ''])->getID();
+
+        $this->setTechnicianTicketRight(UPDATE);
+        $this->login('tech', 'tech');
+
+        $ticket = $this->loadTicket($tickets_id);
+        $this->assertFalse(
+            (bool) $ticket->canAssign(),
+            'A user with only the UPDATE right must not be allowed to reach escalation routes',
+        );
+    }
+}