Fix - Linked ITIL objects visibility across entities and rights verification - #22851
Conversation
This is a common behaviour in GLPI. When a user does not have enough rights to see the linked item, most of the time, the name of this item is displayed instead of a link. |
7d0af3c to
2db6081
Compare
Co-authored-by: Cédric Anne <cedric.anne@gmail.com>
Co-authored-by: Cédric Anne <cedric.anne@gmail.com>
There was a problem hiding this comment.
As discussed IRL, the entity restriction has been introduced by #10989 and should be reverted.
There was a problem hiding this comment.
The getAllLinkedTo() method is used during notification generation, with a session context that, most of the time, does not correspond to the notification target user. It means that the filtering cannot be done using the session.
Anyway, as notification data is shared accross all users, I have no idea how we could make it compatible with the fact we want to relations out of the current entity scope in the UI.
Co-authored-by: Cédric Anne <cedric.anne@gmail.com>
Co-authored-by: Cédric Anne <cedric.anne@gmail.com>
Co-authored-by: Cédric Anne <cedric.anne@gmail.com>
Co-authored-by: Cédric Anne <cedric.anne@gmail.com>
Co-authored-by: Cédric Anne <cedric.anne@gmail.com>
|
This PR has been is closed and has been automatically locked. Please open a new issue with all requested information for related bugs. |
Checklist before requesting a review
Please delete options that are not relevant.
Description
Fixes an issue where users could not link tickets between parent/child entities from the root entity, and could see titles of tickets they don't have access to in the linked objects panel.
Issues addressed
Self-linking possible: Users could link a ticket to itself, causing an "Unknown ITIL object" error.
Duplicate links possible: Users could select items already linked in the dropdown, leading to duplicate link attempts.
Incomplete Change/Problem handling in Dropdown: The Dropdown.php was missing rights restriction handling for
ChangeandProblemitemtypes (onlyTicketwas handled).Missing visual distinction for inaccessible items: Linked items were displayed with clickable links even when the user cannot access them.
Changes
CommonITILObject_CommonITILObject.php: Added self-link prevention in
prepareInputForAdd()- an item cannot be linked to itself.Dropdown.php: Mutualized
Ticket,Change, andProblemcases into a single block with proper rights restrictions usingSearch::addDefaultJoin/addDefaultWhere.linked_itilobjects.html.twig:
entity_restrict(uses default behavior respecting entity visibility as discussed in fix(itil): Linked itilobject should return the child entities itilobject #21680)usedparameter to exclude current item AND already linked items from dropdowncanViewItem()check: items the user can access are display 8000 ed as clickable links, others are displayed as muted text without linkTests added