fix(target_actor): prevent inconsistent adds

pluginsGLPI · Jan 31, 2022 · 9f75b25 · 9f75b25
1 parent c456a5d
commit 9f75b25
Show file tree

Hide file tree

Showing 3 changed files with 70 additions and 23 deletions.
diff --git a/front/targetticket.form.php b/front/targetticket.form.php
@@ -41,31 +41,51 @@
 
 // Edit an existing target ticket
 if (isset($_POST['update'])) {
-   $targetticket->update($_POST);
+   if (!$targetticket->canUpdateItem()) {
+      Session::addMessageAfterRedirect(__('No right to update this item.', 'formcreator'), false, ERROR);
+   } else {
+      $targetticket->update($_POST);
+   }
    Html::back();
 
 } else if (isset($_POST['actor_role'])) {
-   $id          = (int) $_POST['id'];
-   $actor_value = $_POST['actor_value_' . $_POST['actor_type']] ?? null;
-   $use_notification = ($_POST['use_notification'] == 0) ? 0 : 1;
-   $targetTicket_actor = new PluginFormcreatorTarget_Actor();
-   $targetTicket_actor->add([
-      'itemtype'         => $targetticket->getType(),
-      'items_id'         => $id,
-      'actor_role'       => $_POST['actor_role'],
-      'actor_type'       => $_POST['actor_type'],
-      'actor_value'      => $actor_value,
-      'use_notification' => $use_notification,
-   ]);
+   $id = (int) $_POST['id'];
+   $targetticket->getFromDB($id);
+   if (!$targetticket->canUpdateItem()) {
+      Session::addMessageAfterRedirect(__('No right to update this item.', 'formcreator'), false, ERROR);
+   } else {
+      $actor_value = $_POST['actor_value_' . $_POST['actor_type']] ?? null;
+      $use_notification = ($_POST['use_notification'] == 0) ? 0 : 1;
+      $targetTicket_actor = new PluginFormcreatorTarget_Actor();
+      $targetTicket_actor->add([
+         'itemtype'         => $targetticket->getType(),
+         'items_id'         => $id,
+         'actor_role'       => $_POST['actor_role'],
+         'actor_type'       => $_POST['actor_type'],
+         'actor_value'      => $actor_value,
+         'use_notification' => $use_notification,
+      ]);
+   }
    Html::back();
 
 } else if (isset($_GET['delete_actor'])) {
-   $targetTicket_actor = new PluginFormcreatorTarget_Actor();
-   $targetTicket_actor->delete([
-      'itemtype' => $targetticket->getType(),
-      'items_id' => $id,
-      'id'       => (int) $_GET['delete_actor']
-   ]);
+   $requiredKeys = ['id'];
+   if (count(array_intersect(array_keys($_GET), $requiredKeys)) < count($requiredKeys)) {
+      Session::addMessageAfterRedirect(__('Bad request while deleting an actor.', 'formcreator'), false, ERROR);
+      Html::back();
+   }
+   $id = (int) $_GET['id'];
+   $targetticket->getFromDB($id);
+   if (!$targetticket->canUpdateItem()) {
+      Session::addMessageAfterRedirect(__('No right to update this item.', 'formcreator'), false, ERROR);
+   } else {
+      $targetTicket_actor = new PluginFormcreatorTarget_Actor();
+      $targetTicket_actor->delete([
+         'itemtype' => $targetticket->getType(),
+         'items_id' => $id,
+         'id'       => (int) $_GET['delete_actor']
+      ]);
+   }
    Html::back();
 
    // Show target ticket form

diff --git a/inc/abstracttarget.class.php b/inc/abstracttarget.class.php
@@ -1826,9 +1826,9 @@ public function post_updateItem($history = 1) {
       $this->updateConditions($this->input);
    }
 
-   protected static function getDeleteImage($id) {
+   protected function getDeleteImage($id) {
       $formUrl = static::getFormURL();
-      $link  = ' &nbsp;<a href="' . $formUrl . '?delete_actor=' . $id . '">';
+      $link  = ' &nbsp;<a href="' . $formUrl . '?delete_actor=' . $id . '&id=' . $this->getID() . '">';
       $link .= '<i style="color: #000" class="fas fa-trash-alt" alt="' . __('Delete') . '" title="' . __('Delete') . '"></i>';
       $link .= '</a>';
       return $link;
@@ -2371,7 +2371,7 @@ protected function showActorSettingsForType($actorType, array $actors) {
                break;
          }
          echo $values['use_notification'] ? ' ' . $img_mail . ' ' : ' ' . $img_nomail . ' ';
-         echo self::getDeleteImage($id);
+         echo $this->getDeleteImage($id);
          echo '</div>';
       }
 

diff --git a/inc/target_actor.class.php b/inc/target_actor.class.php
@@ -74,7 +74,7 @@ static function getEnumActorType() {
          self::ACTOR_TYPE_SUPPLIER               => __('Specific supplier', 'formcreator'),
          self::ACTOR_TYPE_QUESTION_SUPPLIER      => __('Supplier from the question', 'formcreator'),
          self::ACTOR_TYPE_QUESTION_ACTORS        => __('Actors from the question', 'formcreator'),
-         self::ACTOR_TYPE_AUTHORS_SUPERVISOR        => __('Form author\'s supervisor', 'formcreator'),
+         self::ACTOR_TYPE_AUTHORS_SUPERVISOR     => __('Form author\'s supervisor', 'formcreator'),
       ];
    }
 
@@ -92,6 +92,33 @@ public static function getTypeName($nb = 0) {
    }
 
    public function prepareInputForAdd($input) {
+
+      $requiredKeys = ['itemtype', 'items_id', 'actor_role', 'actor_type', 'use_notification'];
+      if (count(array_intersect(array_keys($input), $requiredKeys)) < count($requiredKeys)) {
+         Session::addMessageAfterRedirect(__('Bad request while adding an actor.', 'formcreator'), false, ERROR);
+         return false;
+      }
+
+      switch ($input['actor_type']) {
+         case self::ACTOR_TYPE_PERSON:
+         case self::ACTOR_TYPE_GROUP:
+            if (!isset($input['actor_value']) || $input['actor_value'] == 0) {
+               Session::addMessageAfterRedirect(__('Bad request while adding an actor.', 'formcreator'), false, ERROR);
+               return false;
+            }
+            break;
+
+            case self::ACTOR_TYPE_QUESTION_PERSON:
+            case self::ACTOR_TYPE_QUESTION_GROUP:
+            case self::ACTOR_TYPE_QUESTION_ACTORS:
+               if (!isset($input['actor_value']) || $input['actor_value'] == 0) {
+                  Session::addMessageAfterRedirect(__('Bad request while adding an actor.', 'formcreator'), false, ERROR);
+                  return false;
+               }
+               break;
+
+      }
+
       // generate a unique id
       if (!isset($input['uuid']) || empty($input['uuid'])) {
          $input['uuid'] = plugin_formcreator_getUuid();