From e17b02f4203c208a733c2bf5aa9fc3212bcac8aa Mon Sep 17 00:00:00 2001 From: Stanislas Kita <7335054+stonebuzz@users.noreply.github.com> Date: Mon, 24 Aug 2026 12:16:51 +0200 Subject: [PATCH 1/6] Fix(Core): item validation when loading trees --- front/config.form.php | 3 +++ front/preference.form.php | 5 ++++- inc/config.class.php | 12 ++++++------ 3 files changed, 13 insertions(+), 7 deletions(-) diff --git a/front/config.form.php b/front/config.form.php index 3391915..171d14a 100644 --- a/front/config.form.php +++ b/front/config.form.php @@ -32,6 +32,9 @@ $config = new PluginTreeviewConfig(); if (isset($_POST['update'])) { + if (isset($_POST['target']) && !in_array($_POST['target'], ['_blank', 'right'], true)) { + unset($_POST['target']); + } $config->update($_POST); Html::back(); } elseif (Plugin::isPluginActive('treeview')) { diff --git a/front/preference.form.php b/front/preference.form.php index 06e76d2..362db7a 100644 --- a/front/preference.form.php +++ b/front/preference.form.php @@ -34,6 +34,9 @@ //Save user preferences if (isset($_POST['plugin_treeview_user_preferences_save'])) { - $pref->update($_POST); + if (!($own_id = $pref->checkIfPreferenceExists(Session::getLoginUserID()))) { + $own_id = $pref->addDefaultPreference(Session::getLoginUserID()); + } + $pref->update(['id' => $own_id, 'show_on_load' => (int) ($_POST['show_on_load'] ?? 0)]); Html::back(); } diff --git a/inc/config.class.php b/inc/config.class.php index 105601f..ea3bd41 100644 --- a/inc/config.class.php +++ b/inc/config.class.php @@ -239,7 +239,7 @@ public function getNodesFromDb() $closeSameLevel = $this->fields['closeSameLevel']; // Load the settings in JavaSript so that dTree script can apply them - echo "d.config.target = '" . $target . "';\n"; + echo "d.config.target = " . json_encode($target) . ";\n"; echo 'd.config.folderLinks = ' . $folderLinks . ";\n"; echo 'd.config.useSelection = ' . $useSelection . ";\n"; echo 'd.config.useLines = ' . $useLines . ";\n"; @@ -267,7 +267,7 @@ public function getNodesFromDb() // Is this the first time we load the page? if (isset($_GET['nodes']) && $_GET['nodes'] != '') { // If no then get all the nodes requested by the client - $nodes = array_reverse(explode('.', $_GET['nodes'])); + $nodes = array_map('intval', array_reverse(explode('.', $_GET['nodes']))); } else { // If yes then get only the root node $nodes[0] = 0; @@ -319,7 +319,7 @@ public function getNodesFromDb() ", true, -1,'');\n"; $dontLoad = 'true'; // Then add aloso its items - foreach (self::$types as $type) { + foreach (self::getTypes() as $type) { if (!class_exists($type) || !is_a($type, CommonDBTM::class, true)) { continue; @@ -344,7 +344,7 @@ public function getNodesFromDb() $criteria['WHERE']['is_deleted'] = 0; } - if ($this->isEntityAssign()) { + if ($item->isEntityAssign()) { $criteria['WHERE']['entities_id'] = $_SESSION['glpiactive_entity']; } @@ -451,9 +451,9 @@ public function getNodesFromDb() // Open the tree to the desired node if ($openedType != -1) { - echo 'd.openTo(' . htmlspecialchars((string) $openedType) . ");\n"; + echo 'd.openTo(' . (int) $openedType . ");\n"; } else { - echo 'd.openTo(' . $nodes[count($nodes) - 1] . ");\n"; + echo 'd.openTo(' . (int) $nodes[count($nodes) - 1] . ");\n"; } } From c4057974fc0ad5123a4bb77a6669c03f20ca8862 Mon Sep 17 00:00:00 2001 From: Stanislas Kita <7335054+stonebuzz@users.noreply.github.com> Date: Mon, 24 Aug 2026 12:21:20 +0200 Subject: [PATCH 2/6] adapt changelog --- CHANGELOG.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 5332418..e437faa 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,12 @@ All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](http://keepachangelog.com/) and this project adheres to [Semantic Versioning](http://semver.org/). +## [UNRELEASED] + +### Fixed + +- Enforce item rights and sanitize inputs in tree loading + ## [1.20.2] - 2026-06-24 ### Fixed From 23d0ae36c0684d31daebef4bcba9f355a19d92c7 Mon Sep 17 00:00:00 2001 From: Stanislas Kita <7335054+stonebuzz@users.noreply.github.com> Date: Mon, 24 Aug 2026 15:13:24 +0200 Subject: [PATCH 3/6] fix --- CHANGELOG.md | 2 +- front/preference.form.php | 5 +++++ inc/config.class.php | 4 ++-- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index e437faa..c0e1773 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,7 +5,7 @@ All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](http://keepachangelog.com/) and this project adheres to [Semantic Versioning](http://semver.org/). -## [UNRELEASED] +## [Unreleased] ### Fixed diff --git a/front/preference.form.php b/front/preference.form.php index 362db7a..bf09ed0 100644 --- a/front/preference.form.php +++ b/front/preference.form.php @@ -36,7 +36,12 @@ if (isset($_POST['plugin_treeview_user_preferences_save'])) { if (!($own_id = $pref->checkIfPreferenceExists(Session::getLoginUserID()))) { $own_id = $pref->addDefaultPreference(Session::getLoginUserID()); + if (!$own_id) { + Session::addMessageAfterRedirect(__s('Unable to save preferences', 'treeview'), false, ERROR); + Html::back(); + } } + $pref->update(['id' => $own_id, 'show_on_load' => (int) ($_POST['show_on_load'] ?? 0)]); Html::back(); } diff --git a/inc/config.class.php b/inc/config.class.php index ea3bd41..b520c00 100644 --- a/inc/config.class.php +++ b/inc/config.class.php @@ -267,7 +267,7 @@ public function getNodesFromDb() // Is this the first time we load the page? if (isset($_GET['nodes']) && $_GET['nodes'] != '') { // If no then get all the nodes requested by the client - $nodes = array_map('intval', array_reverse(explode('.', $_GET['nodes']))); + $nodes = array_map(intval(...), array_reverse(explode('.', $_GET['nodes']))); } else { // If yes then get only the root node $nodes[0] = 0; @@ -321,7 +321,7 @@ public function getNodesFromDb() // Then add aloso its items foreach (self::getTypes() as $type) { - if (!class_exists($type) || !is_a($type, CommonDBTM::class, true)) { + if (!class_exists($type) || !is_a($type, CommonDBTM::class, true)) { continue; } From 3a59a3b5e62d0f0c98083493aa393342fab288c5 Mon Sep 17 00:00:00 2001 From: Stanislas Kita <7335054+stonebuzz@users.noreply.github.com> Date: Mon, 24 Aug 2026 15:42:25 +0200 Subject: [PATCH 4/6] fix lint --- front/config.form.php | 1 + inc/config.class.php | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/front/config.form.php b/front/config.form.php index 171d14a..2110e8d 100644 --- a/front/config.form.php +++ b/front/config.form.php @@ -35,6 +35,7 @@ if (isset($_POST['target']) && !in_array($_POST['target'], ['_blank', 'right'], true)) { unset($_POST['target']); } + $config->update($_POST); Html::back(); } elseif (Plugin::isPluginActive('treeview')) { diff --git a/inc/config.class.php b/inc/config.class.php index b520c00..da447ff 100644 --- a/inc/config.class.php +++ b/inc/config.class.php @@ -321,7 +321,7 @@ public function getNodesFromDb() // Then add aloso its items foreach (self::getTypes() as $type) { - if (!class_exists($type) || !is_a($type, CommonDBTM::class, true)) { + if (!class_exists($type) || !is_a($type, CommonDBTM::class, true)) { continue; } From 3dc869175197393571343570965521572a2dba01 Mon Sep 17 00:00:00 2001 From: Stanislas Kita <7335054+stonebuzz@users.noreply.github.com> Date: Mon, 24 Aug 2026 16:01:59 +0200 Subject: [PATCH 5/6] clean template --- templates/preference.html.twig | 1 - 1 file changed, 1 deletion(-) diff --git a/templates/preference.html.twig b/templates/preference.html.twig index ad05d74..e3580cf 100644 --- a/templates/preference.html.twig +++ b/templates/preference.html.twig @@ -34,7 +34,6 @@
- {{ fields.checkboxField( From 2d0b008616f390c7e85f1d6780b67b11a908dcb4 Mon Sep 17 00:00:00 2001 From: Stanislas Date: Fri, 28 Aug 2026 15:56:35 +0200 Subject: [PATCH 6/6] cast to int Co-authored-by: Romain B. <8530352+Rom1-B@users.noreply.github.com> --- front/config.form.php | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/front/config.form.php b/front/config.form.php index 2110e8d..ef21173 100644 --- a/front/config.form.php +++ b/front/config.form.php @@ -36,6 +36,11 @@ unset($_POST['target']); } + foreach (['folderLinks', 'useSelection', 'useLines', 'useIcons', 'closeSameLevel', 'itemName', 'locationName'] as $field) { + if (isset($_POST[$field])) { + $_POST[$field] = (int) $_POST[$field]; + } + } $config->update($_POST); Html::back(); } elseif (Plugin::isPluginActive('treeview')) {