Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.md
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/).
### Fixed

- Avoid a per-tag database lookup when rendering the tag column in item lists
- Fix tag associate item

## [2.14.6] - 2026-08-04

Expand Down
1 change: 1 addition & 0 deletions composer.json
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@
},
"autoload": {
"psr-4": {
"GlpiPlugin\\Tag\\": "src/",
"GlpiPlugin\\Tag\\Tests\\": "tests"
}
},
Expand Down
2 changes: 1 addition & 1 deletion inc/tagitem.class.php
Original file line number Diff line number Diff line change
Expand Up @@ -197,7 +197,7 @@ public static function showForTag(PluginTagTag $tag)
if ($canedit) {
echo "<div class='firstbloc'>";
echo "<form name='tagitem_form{$rand}' id='tagitem_form{$rand}' method='post'
action='" . Toolbox::getItemTypeFormURL('PluginTagTag') . "'>";
action='/plugins/tag/associate'>";

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
action='/plugins/tag/associate'>";
action='" . Toolbox::getItemTypeFormURL('PluginTagTagItem') . "'>";


echo "<table class='tab_cadre_fixe'>";
echo "<tr class='tab_bg_2'><th colspan='2'>" . __s('Add an item') . "</th></tr>";
Expand Down
92 changes: 92 additions & 0 deletions src/Controller/TagItemController.php
Original file line number Diff line number Diff line change
@@ -0,0 +1,92 @@
<?php

/**
* -------------------------------------------------------------------------
* Tag plugin for GLPI
* -------------------------------------------------------------------------
*
* LICENSE
*
* This file is part of Tag.
*
* Tag is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* Tag is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with Tag. If not, see <http://www.gnu.org/licenses/>.
* -------------------------------------------------------------------------
* @copyright Copyright (C) 2014-2026 by Teclib'.
* @license GPLv2 https://www.gnu.org/licenses/gpl-2.0.html
* @link https://github.com/pluginsGLPI/tag
* -------------------------------------------------------------------------
*/

namespace GlpiPlugin\Tag\Controller;

use CommonDBTM;
use Glpi\Controller\GenericFormController;
use Glpi\Exception\Http\AccessDeniedHttpException;
use Glpi\Exception\Http\BadRequestHttpException;
use Glpi\Http\RedirectResponse;
use Html;
use PluginTagTag;
use PluginTagTagItem;
use Session;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\Routing\Attribute\Route;

final class TagItemController extends GenericFormController
{
#[Route('/associate', methods: ['POST'])]

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
#[Route('/associate', methods: ['POST'])]
#[ItemtypeFormRoute(PluginTagTagItem::class)]

public function associate(Request $request): Response
{
Session::checkLoginUser();

$tag_id = $request->request->getInt('plugin_tag_tags_id');
$itemtype = $request->request->get('itemtype');
$item_id = $request->request->getInt('items_id');

if (!$tag_id || !$itemtype || !$item_id) {
throw new BadRequestHttpException(__s('Missing parameters', 'tag'));
}

$tag = new PluginTagTag();
if (!$tag->getFromDB($tag_id) || !$tag->can($tag_id, UPDATE)) {
throw new AccessDeniedHttpException(__s('You do not have permission to update this tag', 'tag'));
}

if (!is_a($itemtype, CommonDBTM::class, true) || !PluginTagTag::canItemtype($itemtype)) {
throw new BadRequestHttpException(__s('Invalid item type', 'tag'));
}

$item = new $itemtype();
if (!$item->getFromDB($item_id) || !$item->canUpdateItem()) {
throw new AccessDeniedHttpException(__s('You do not have permission to update this item', 'tag'));
}

$tag_item = new PluginTagTagItem();
$found = $tag_item->find([
'plugin_tag_tags_id' => $tag_id,
'items_id' => $item_id,
'itemtype' => $itemtype,
]);

if (count($found) === 0) {
$tag_item->add([
'plugin_tag_tags_id' => $tag_id,
'items_id' => $item_id,
'itemtype' => $itemtype,
]);
}

return new RedirectResponse(Html::getBackUrl());
}
Comment on lines +49 to +91

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
public function associate(Request $request): Response
{
Session::checkLoginUser();
$tag_id = $request->request->getInt('plugin_tag_tags_id');
$itemtype = $request->request->get('itemtype');
$item_id = $request->request->getInt('items_id');
if (!$tag_id || !$itemtype || !$item_id) {
throw new BadRequestHttpException(__s('Missing parameters', 'tag'));
}
$tag = new PluginTagTag();
if (!$tag->getFromDB($tag_id) || !$tag->can($tag_id, UPDATE)) {
throw new AccessDeniedHttpException(__s('You do not have permission to update this tag', 'tag'));
}
if (!is_a($itemtype, CommonDBTM::class, true) || !PluginTagTag::canItemtype($itemtype)) {
throw new BadRequestHttpException(__s('Invalid item type', 'tag'));
}
$item = new $itemtype();
if (!$item->getFromDB($item_id) || !$item->canUpdateItem()) {
throw new AccessDeniedHttpException(__s('You do not have permission to update this item', 'tag'));
}
$tag_item = new PluginTagTagItem();
$found = $tag_item->find([
'plugin_tag_tags_id' => $tag_id,
'items_id' => $item_id,
'itemtype' => $itemtype,
]);
if (count($found) === 0) {
$tag_item->add([
'plugin_tag_tags_id' => $tag_id,
'items_id' => $item_id,
'itemtype' => $itemtype,
]);
}
return new RedirectResponse(Html::getBackUrl());
}
public function associate(Request $request): Response
{
if ($request->query->getInt('associate') === 1) {
Session::checkLoginUser();
$tag_id = $request->request->getInt('plugin_tag_tags_id');
$itemtype = $request->request->get('itemtype');
$item_id = $request->request->getInt('items_id');
if (!$tag_id || !$itemtype || !$item_id) {
throw new BadRequestHttpException(__s('Missing parameters', 'tag'));
}
$tag = new PluginTagTag();
if (!$tag->getFromDB($tag_id) || !$tag->can($tag_id, UPDATE)) {
throw new AccessDeniedHttpException(__s('You do not have permission to update this tag', 'tag'));
}
if (!is_a($itemtype, CommonDBTM::class, true) || !PluginTagTag::canItemtype($itemtype)) {
throw new BadRequestHttpException(__s('Invalid item type', 'tag'));
}
$item = new $itemtype();
if (!$item->getFromDB($item_id) || !$item->canUpdateItem()) {
throw new AccessDeniedHttpException(__s('You do not have permission to update this item', 'tag'));
}
$tag_item = new PluginTagTagItem();
$found = $tag_item->find([
'plugin_tag_tags_id' => $tag_id,
'items_id' => $item_id,
'itemtype' => $itemtype,
]);
if (count($found) === 0) {
$tag_item->add([
'plugin_tag_tags_id' => $tag_id,
'items_id' => $item_id,
'itemtype' => $itemtype,
]);
}
return new RedirectResponse(Html::getBackUrl());
}
}

}
20 changes: 8 additions & 12 deletions tests/TagTestCase.php
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,7 @@ protected function logOut()
$_SESSION['glpi_currenttime'] = $ctime;
}

public function loginAs(array $credentials): int
public function loginAs(array $credentials, int $rights = CREATE | UPDATE | PURGE): int
{
global $DB;

Expand All @@ -59,7 +59,7 @@ public function loginAs(array $credentials): int
$DB->update(
'glpi_profilerights',
[
'rights' => CREATE | UPDATE | PURGE,
'rights' => $rights,
],
[
'profiles_id' => $user_profile,
Expand All @@ -72,17 +72,13 @@ public function loginAs(array $credentials): int
return $user->getID();
}

public function createTag(string $tagName): int
public function createTag(string $tagName, array $typeMenu = ['Ticket']): int
{
$tag = new PluginTagTag();
$tag->add(
[
'name' => $tagName,
'is_active' => 1,
'type_menu' => ['Ticket'],
],
);
$this->assertGreaterThan(0, $tag->getID());
$tag = $this->createItem(PluginTagTag::class, [
'name' => $tagName,
'is_active' => 1,
'type_menu' => $typeMenu,
], ['type_menu']);

return $tag->getID();
}
Expand Down
27 changes: 26 additions & 1 deletion tests/Units/TagItemTest.php
Original file line number Diff line number Diff line change
Expand Up @@ -30,17 +30,21 @@

namespace GlpiPlugin\Tag\Tests\Units;

use Computer;
use GlpiPlugin\Tag\Controller\TagItemController;
use GlpiPlugin\Tag\Tests\TagTestCase;
use Symfony\Component\HttpFoundation\Request;
use Ticket;

final class TagItemTest extends TagTestCase
{
private const TECH_USER = ['login' => 'tech', 'pass' => 'tech'];

public function testTagsFromTicket(): void
{
$tagID1 = $this->createTag('TicketTag1');
$tagID2 = $this->createTag('TicketTag2');


$ticket = new Ticket();
$ticket->add([
'name' => 'Ticket add Tag',
Expand All @@ -56,4 +60,25 @@ public function testTagsFromTicket(): void
$this->isItemTagged($ticket, $tagID2);
}

public function testTagAssociationCreatesLink(): void

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

testTagAssociationCreatesLink() creates a PluginTagTagItem directly via createItem(),
bypassing the controller entirely. The original regression was a missing route handler — if
the controller is removed again, this test still passes. A test that POSTs to
/plugins/tag/associate is needed to actually guard against the regression.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This test builds the PluginTagTagItem link directly via createItem(), bypassing TagItemController::associate entirely. Since the original regression was exactly this route handler going missing, can you add a test that POSTs to /plugins/tag/associate instead (or in addition), so a future removal of the controller/route is actually caught?

{
$this->loginAs(self::TECH_USER);

$tag = $this->createTag('MyTag', ['Computer']);
$computer = $this->createItem(Computer::class, [
'name' => 'Computer to tag',
'entities_id' => 0,
]);

$controller = new TagItemController();
$request = Request::create('/plugins/tag/associate', 'POST', [
'plugin_tag_tags_id' => $tag,
'itemtype' => Computer::class,
'items_id' => $computer->getID(),
]);

$controller->associate($request);

$this->isItemTagged($computer, $tag);
}
}