diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5332418..c0e1773 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,12 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](http://keepachangelog.com/)
 and this project adheres to [Semantic Versioning](http://semver.org/).
 
+## [Unreleased]
+
+### Fixed
+
+- Enforce item rights and sanitize inputs in tree loading
+
 ## [1.20.2] - 2026-06-24
 
 ### Fixed
diff --git a/front/config.form.php b/front/config.form.php
index 3391915..ef21173 100644
--- a/front/config.form.php
+++ b/front/config.form.php
@@ -32,6 +32,15 @@
 
 $config = new PluginTreeviewConfig();
 if (isset($_POST['update'])) {
+    if (isset($_POST['target']) && !in_array($_POST['target'], ['_blank', 'right'], true)) {
+        unset($_POST['target']);
+    }
+
+    foreach (['folderLinks', 'useSelection', 'useLines', 'useIcons', 'closeSameLevel', 'itemName', 'locationName'] as $field) {
+        if (isset($_POST[$field])) {
+            $_POST[$field] = (int) $_POST[$field];
+        }
+    }
     $config->update($_POST);
     Html::back();
 } elseif (Plugin::isPluginActive('treeview')) {
diff --git a/front/preference.form.php b/front/preference.form.php
index 06e76d2..bf09ed0 100644
--- a/front/preference.form.php
+++ b/front/preference.form.php
@@ -34,6 +34,14 @@
 
 //Save user preferences
 if (isset($_POST['plugin_treeview_user_preferences_save'])) {
-    $pref->update($_POST);
+    if (!($own_id = $pref->checkIfPreferenceExists(Session::getLoginUserID()))) {
+        $own_id = $pref->addDefaultPreference(Session::getLoginUserID());
+        if (!$own_id) {
+            Session::addMessageAfterRedirect(__s('Unable to save preferences', 'treeview'), false, ERROR);
+            Html::back();
+        }
+    }
+
+    $pref->update(['id' => $own_id, 'show_on_load' => (int) ($_POST['show_on_load'] ?? 0)]);
     Html::back();
 }
diff --git a/inc/config.class.php b/inc/config.class.php
index 105601f..da447ff 100644
--- a/inc/config.class.php
+++ b/inc/config.class.php
@@ -239,7 +239,7 @@ public function getNodesFromDb()
         $closeSameLevel = $this->fields['closeSameLevel'];
 
         // Load the settings in JavaSript so that dTree script can apply them
-        echo "d.config.target         = '" . $target . "';\n";
+        echo "d.config.target         = " . json_encode($target) . ";\n";
         echo 'd.config.folderLinks    = ' . $folderLinks . ";\n";
         echo 'd.config.useSelection   = ' . $useSelection . ";\n";
         echo 'd.config.useLines       = ' . $useLines . ";\n";
@@ -267,7 +267,7 @@ public function getNodesFromDb()
         // Is this the first time we load the page?
         if (isset($_GET['nodes']) && $_GET['nodes'] != '') {
             // If no then get all the nodes requested by the client
-            $nodes = array_reverse(explode('.', $_GET['nodes']));
+            $nodes = array_map(intval(...), array_reverse(explode('.', $_GET['nodes'])));
         } else {
             // If yes then get only the root node
             $nodes[0] = 0;
@@ -319,7 +319,7 @@ public function getNodesFromDb()
                                 ", true, -1,'');\n";
                         $dontLoad = 'true';
                         // Then add aloso its items
-                        foreach (self::$types as $type) {
+                        foreach (self::getTypes() as $type) {
 
                             if (!class_exists($type) || !is_a($type, CommonDBTM::class, true)) {
                                 continue;
@@ -344,7 +344,7 @@ public function getNodesFromDb()
                                 $criteria['WHERE']['is_deleted'] = 0;
                             }
 
-                            if ($this->isEntityAssign()) {
+                            if ($item->isEntityAssign()) {
                                 $criteria['WHERE']['entities_id'] = $_SESSION['glpiactive_entity'];
                             }
 
@@ -451,9 +451,9 @@ public function getNodesFromDb()
 
         // Open the tree to the desired node
         if ($openedType != -1) {
-            echo 'd.openTo(' . htmlspecialchars((string) $openedType) . ");\n";
+            echo 'd.openTo(' . (int) $openedType . ");\n";
         } else {
-            echo 'd.openTo(' . $nodes[count($nodes) - 1] . ");\n";
+            echo 'd.openTo(' . (int) $nodes[count($nodes) - 1] . ");\n";
         }
     }
 
diff --git a/templates/preference.html.twig b/templates/preference.html.twig
index ad05d74..e3580cf 100644
--- a/templates/preference.html.twig
+++ b/templates/preference.html.twig
@@ -34,7 +34,6 @@
 </div>
 
 <form action="{{ target }}" method="post">
-   <input type="hidden" name="id" value="{{ pref_id }}">
    <input type="hidden" name="_glpi_csrf_token" value="{{ csrf_token() }}">
 
     {{ fields.checkboxField(