Skip to content

Fix item validation when loading trees #123

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
stonebuzz wants to merge 6 commits into
base: main
Choose a base branch
from
Open

Fix item validation when loading trees #123

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
e17b02f
Fix(Core): item validation when loading trees
stonebuzz Aug 24, 2026
c405797
adapt changelog
stonebuzz Aug 24, 2026
23d0ae3
fix
stonebuzz Aug 24, 2026
3a59a3b
fix lint
stonebuzz Aug 24, 2026
3dc8691
clean template
stonebuzz Aug 24, 2026
2d0b008
cast to int
stonebuzz Aug 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,12 @@ All notable changes to this project will be documented in this file.
The format is based on [Keep a Changelog](http://keepachangelog.com/)
and this project adheres to [Semantic Versioning](http://semver.org/).

## [Unreleased]

### Fixed

- Enforce item rights and sanitize inputs in tree loading

## [1.20.2] - 2026-06-24

### Fixed
Expand Down
9 changes: 9 additions & 0 deletions front/config.form.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,15 @@

$config = new PluginTreeviewConfig();
if (isset($_POST['update'])) {
if (isset($_POST['target']) && !in_array($_POST['target'], ['_blank', 'right'], true)) {
unset($_POST['target']);
}

Comment thread
stonebuzz marked this conversation as resolved.
foreach (['folderLinks', 'useSelection', 'useLines', 'useIcons', 'closeSameLevel', 'itemName', 'locationName'] as $field) {
if (isset($_POST[$field])) {
$_POST[$field] = (int) $_POST[$field];
}
}
$config->update($_POST);
Html::back();
} elseif (Plugin::isPluginActive('treeview')) {
Expand Down
10 changes: 9 additions & 1 deletion front/preference.form.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,14 @@

//Save user preferences
if (isset($_POST['plugin_treeview_user_preferences_save'])) {
$pref->update($_POST);
if (!($own_id = $pref->checkIfPreferenceExists(Session::getLoginUserID()))) {
$own_id = $pref->addDefaultPreference(Session::getLoginUserID());
if (!$own_id) {
Session::addMessageAfterRedirect(__s('Unable to save preferences', 'treeview'), false, ERROR);
Html::back();
}
}

$pref->update(['id' => $own_id, 'show_on_load' => (int) ($_POST['show_on_load'] ?? 0)]);
Comment on lines 36 to +45

@Rom1-B Rom1-B Aug 24, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you add a functional test for the preference-ownership fix and the entity/right filtering in getNodesFromDb()?

Html::back();
}
12 changes: 6 additions & 6 deletions inc/config.class.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -239,7 +239,7 @@ public function getNodesFromDb()
$closeSameLevel = $this->fields['closeSameLevel'];

// Load the settings in JavaSript so that dTree script can apply them
echo "d.config.target = '" . $target . "';\n";
echo "d.config.target = " . json_encode($target) . ";\n";
echo 'd.config.folderLinks = ' . $folderLinks . ";\n";
echo 'd.config.useSelection = ' . $useSelection . ";\n";
echo 'd.config.useLines = ' . $useLines . ";\n";
Expand Down Expand Up @@ -267,7 +267,7 @@ public function getNodesFromDb()
// Is this the first time we load the page?
if (isset($_GET['nodes']) && $_GET['nodes'] != '') {
// If no then get all the nodes requested by the client
$nodes = array_reverse(explode('.', $_GET['nodes']));
$nodes = array_map(intval(...), array_reverse(explode('.', $_GET['nodes'])));
} else {
// If yes then get only the root node
$nodes[0] = 0;
Expand Down Expand Up @@ -319,7 +319,7 @@ public function getNodesFromDb()
", true, -1,'');\n";
$dontLoad = 'true';
// Then add aloso its items
foreach (self::$types as $type) {
foreach (self::getTypes() as $type) {

if (!class_exists($type) || !is_a($type, CommonDBTM::class, true)) {
continue;
Expand All @@ -344,7 +344,7 @@ public function getNodesFromDb()
$criteria['WHERE']['is_deleted'] = 0;
}

if ($this->isEntityAssign()) {
if ($item->isEntityAssign()) {
$criteria['WHERE']['entities_id'] = $_SESSION['glpiactive_entity'];
}

Expand Down Expand Up @@ -451,9 +451,9 @@ public function getNodesFromDb()

// Open the tree to the desired node
if ($openedType != -1) {
echo 'd.openTo(' . htmlspecialchars((string) $openedType) . ");\n";
echo 'd.openTo(' . (int) $openedType . ");\n";
} else {
echo 'd.openTo(' . $nodes[count($nodes) - 1] . ");\n";
echo 'd.openTo(' . (int) $nodes[count($nodes) - 1] . ");\n";
}
}

Expand Down
1 change: 0 additions & 1 deletion templates/preference.html.twig
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,6 @@
</div>

<form action="{{ target }}" method="post">
<input type="hidden" name="id" value="{{ pref_id }}">
<input type="hidden" name="_glpi_csrf_token" value="{{ csrf_token() }}">

{{ fields.checkboxField(
Expand Down
Loading