Fix(core):Fix missing rights checks and unescaped output in order/rec…

.gitignore

@@ -2,3 +2,5 @@ dist/
 vendor/
 .gh_token
 *.min.*
+var/
+.phpunit.result.cache

CHANGELOG.md

@@ -10,6 +10,8 @@ and this project adheres to [Semantic Versioning](http://semver.org/).
 ### Fixed
 
 - Fix warning : `creation of dynamic property $table is deprecated`
+- Fix missing rights checks
+- Fix unescaped output in order/reception forms
 
 ## [2.11.5] - 2026-03-24
 

ajax/linkactions.php

@@ -29,6 +29,10 @@
  */
 
 include("../../../inc/includes.php");
+
+/** @var array $CFG_GLPI */
+global $CFG_GLPI;
+
 header("Content-Type: text/html; charset=UTF-8");
 Html::header_nocache();
 Session::checkLoginUser();
@@ -175,6 +179,15 @@
             break;
 
         case "check_unicity":
+            Session::checkRight('plugin_order_order', READ);
+
+            if (
+                !in_array($_POST['itemtype'] ?? '', $CFG_GLPI['asset_types'], true)
+                || !in_array($_POST['field'] ?? '', ['name', 'serial'], true)
+            ) {
+                throw new RuntimeException("Invalid item type or field");
+            }
+
             $itemtype = new $_POST['itemtype']();
             if (count($itemtype->find([$_POST['field'] => $_POST['field_value'], ])) > 0) {
                 echo "false";

ajax/massreception.php

@@ -35,6 +35,8 @@
 Html::header_nocache();
 
 Session::checkLoginUser();
+Session::checkRight('plugin_order_order', READ);
+(new PluginOrderOrder())->check($_POST['plugin_order_orders_id'], READ);
 
 $PluginOrderReception = new PluginOrderReception();
 

front/documentcategory.form.php

@@ -30,6 +30,7 @@
 
 include('../../../inc/includes.php');
 Session::checkLoginUser();
+Session::checkRight("config", UPDATE);
 
 $documentCategory = new PluginOrderDocumentCategory();
 

front/order.form.php

@@ -88,13 +88,15 @@
    //Status update & order workflow
 } else if (isset($_POST["validate"])) {
    /* validate order */
+    $pluginOrderOrder->check($_POST["id"], UPDATE);
     if (PluginOrderOrder::canView() && (PluginOrderOrder::canValidate() || !$config->useValidation())) {
         $pluginOrderOrder->updateOrderStatus($_POST["id"], $config->getApprovedState(), $_POST["comment"]);
         PluginOrderReception::updateDelivryStatus($_POST["id"]);
         Session::addMessageAfterRedirect(__("Order is validated", "order"));
     }
     Html::back();
 } else if (isset($_POST["waiting_for_approval"])) {
+    $pluginOrderOrder->check($_POST["id"], UPDATE);
     if (PluginOrderOrder::canCreate()) {
         $pluginOrderOrder->updateOrderStatus(
             $_POST["id"],
@@ -105,6 +107,7 @@
     }
     Html::back();
 } else if (isset($_POST["cancel_waiting_for_approval"])) {
+    $pluginOrderOrder->check($_POST["id"], UPDATE);
     if (PluginOrderOrder::canView() && PluginOrderOrder::canCancel()) {
         $pluginOrderOrder->updateOrderStatus(
             $_POST["id"],
@@ -116,6 +119,7 @@
 
     Html::back();
 } else if (isset($_POST["cancel_order"])) {
+    $pluginOrderOrder->check($_POST["id"], UPDATE);
     if (PluginOrderOrder::canView() && PluginOrderOrder::canCancel()) {
         $pluginOrderOrder->updateOrderStatus(
             $_POST["id"],
@@ -128,6 +132,7 @@
 
     Html::back();
 } else if (isset($_POST["undovalidation"])) {
+    $pluginOrderOrder->check($_POST["id"], UPDATE);
     if (PluginOrderOrder::canView() && PluginOrderOrder::canUndo()) {
         $pluginOrderOrder->updateOrderStatus(
             $_POST["id"],
@@ -140,6 +145,7 @@
     Html::back();
 } else if (isset($_POST["add_item"])) {
    //Details management
+    $pluginOrderOrder->check($_POST["plugin_order_orders_id"], UPDATE);
     if ($_POST["discount"] < 0 || $_POST["discount"] > 100) {
         Session::addMessageAfterRedirect(__("The discount pourcentage must be between 0 and 100", "order"), false, ERROR);
     } else {
@@ -170,6 +176,7 @@
     }
     Html::back();
 } else if (isset($_POST["delete_item"])) {
+    $pluginOrderOrder->check($_POST["plugin_order_orders_id"], UPDATE);
     if (
         isset($_POST["plugin_order_orders_id"])
         && ($_POST["plugin_order_orders_id"] > 0)
@@ -227,6 +234,11 @@
                         $new_value,
                         $_POST["plugin_order_orders_id"]
                     );
+
+                    if (!$pluginOrderOrder_Item->belongsToOrder((int) $_POST["plugin_order_orders_id"])) {
+                        continue;
+                    }
+
                     $pluginOrderOrder_Item->delete(['id' => $ID]);
                 }
             }
@@ -238,6 +250,7 @@
     Html::back();
 } else if (isset($_POST["add_itemfree"])) {
    //Details management
+    $pluginOrderOrder->check($_POST["plugin_order_orders_id"], UPDATE);
     if ($_POST["discount"] < 0 || $_POST["discount"] > 100) {
         Session::addMessageAfterRedirect(__("The discount pourcentage must be between 0 and 100", "order"), false, ERROR);
     } else {
@@ -313,6 +326,7 @@
     }
     Html::back();
 } else if (isset($_POST["delete_itemfree"])) {
+    $pluginOrderOrder->check($_POST["plugin_order_orders_id"], UPDATE);
     if (
         isset($_POST["plugin_order_orders_id"])
         && ($_POST["plugin_order_orders_id"] > 0)
@@ -364,12 +378,18 @@
                         $new_value,
                         $_POST["plugin_order_orders_id"]
                     );
+
+                    if (!$pluginOrderOrder_Item->belongsToOrder((int) $_POST["plugin_order_orders_id"])) {
+                        continue;
+                    }
+
                     $pluginOrderOrder_Item->delete(['id' => $ID]);
                 }
             }
         }
     }
 } else if (isset($_POST["update_item"])) {
+    $pluginOrderOrder->check($_POST["plugin_order_orders_id"], UPDATE);
     if (isset($_POST['quantity'])) {
         $pluginOrderOrder_Item->updateQuantity($_POST);
     }
@@ -430,6 +450,7 @@
 
     Html::back();
 } else if (isset($_POST["update_detail_item"])) {
+    $pluginOrderOrder->check($_POST["plugin_order_orders_id"], UPDATE);
     if (isset($_POST['detail_price_taxfree'])) {
         foreach ($_POST['detail_price_taxfree'] as $item_id => $price) {
             $pluginOrderOrder_Item->updatePrice_taxfree([

front/order_item.form.php

@@ -33,6 +33,8 @@
 $item = new PluginOrderOrder_Item();
 
 if (isset($_POST['update'])) {
+    $item->getFromDB($_POST['id']);
+    (new PluginOrderOrder())->check($item->fields['plugin_order_orders_id'], UPDATE);
     $item->update($_POST);
     $item->updatePrices($_POST['id']);
     Html::redirect($_SERVER['HTTP_REFERER']);

front/reception.form.php

@@ -45,8 +45,9 @@
 $order_item = new PluginOrderOrder_Item();
 
 if (isset($_POST["update"])) {
+    $order_item->getFromDB($_POST["id"]);
+    (new PluginOrderOrder())->check($order_item->fields["plugin_order_orders_id"], UPDATE);
     if (PluginOrderReception::canCreate()) {
-        $order_item->getFromDB($_POST["id"]);
         if ($order_item->fields["itemtype"] == 'SoftwareLicense') {
             $result = $order_item->queryRef(
                 $order_item->fields["plugin_order_orders_id"],
@@ -82,6 +83,8 @@
     ]);
     Html::redirect($_SERVER['HTTP_REFERER']);
 } else if (isset($_POST["delete"])) {
+    $order_item->getFromDB($_POST["id"]);
+    (new PluginOrderOrder())->check($order_item->fields["plugin_order_orders_id"], UPDATE);
     $reception->deleteDelivery($_POST["id"]);
     $reception->updateReceptionStatus([
         'items' => [
@@ -93,6 +96,7 @@
     Html::redirect(Toolbox::getItemTypeFormURL('PluginOrderOrder') . "?id=" . $_POST["plugin_order_orders_id"]);
 } else if (isset($_POST["bulk_reception"])) {
    //Several new items are delivered
+    (new PluginOrderOrder())->check($_POST["plugin_order_orders_id"], UPDATE);
     $reception->updateBulkReceptionStatus($_POST);
     Html::redirect($_SERVER["HTTP_REFERER"]);
 } else {

hook.php

@@ -132,7 +132,7 @@ function plugin_order_uninstall()
         'PluginOrderOrderType', 'PluginOrderOther', 'PluginOrderOtherType',
         'PluginOrderPreference', 'PluginOrderProfile', 'PluginOrderReference_Supplier',
         'PluginOrderSurveySupplier', 'PluginOrderDocumentCategory',
-        'PluginOrderAccountSection', 'PluginOrderAnalyticNature'
+        'PluginOrderAccountSection', 'PluginOrderAnalyticNature', 'PluginOrderReferenceFree'
     ];
     foreach ($classes as $class) {
         call_user_func([$class, 'uninstall']);

inc/order.class.php

@@ -1818,6 +1818,15 @@ public function generateOrder($params)
             throw new \RuntimeException("Invalid template name");
         }
 
+        // Avoid access to another directory or to files that does not match allowed extension
+        $extensionPattern = '/\.(' . implode('|', array_map(fn($ext) => preg_quote((string) $ext, '/'), PLUGIN_ORDER_SIGNATURE_EXTENSION)) . ')$/';
+        if (
+            !empty($signature)
+            && (preg_match('/[\\\\\/]/', $signature) !== 0 || preg_match($extensionPattern, $signature) === 0)
+        ) {
+            throw new RuntimeException("Invalid signature file name");
+        }
+
         $template_path = PLUGIN_ORDER_TEMPLATE_DIR . $template;
 
         // Ensure the file exists and is readable

inc/order_item.class.php

@@ -312,6 +312,16 @@ public function getPricesATI($priceHT, $taxes)
         return (!$priceHT ? 0 : $priceHT + (($priceHT * $taxes) / 100));
     }
 
+    /**
+     * Check that this item belongs to the given order, to prevent cross-order IDOR on deletion.
+     *
+     * @param int $orders_id Order ID expected to own this item
+     */
+    public function belongsToOrder(int $orders_id): bool
+    {
+        return (int) $this->fields['plugin_order_orders_id'] === $orders_id;
+    }
+
     /**
      * Calculate the total ecotax from all ordered items with their quantities
      *

inc/profile.class.php

@@ -267,10 +267,11 @@ public static function migrateOneProfile($profiles_id)
                             }
                             break;
                     }
-                    $query = "UPDATE `glpi_profilerights`
-                         SET `rights`='" . $right . "'
-                         WHERE `name`='$new' AND `profiles_id`='$profiles_id'";
-                    $DB->query($query);
+                    $DB->update(
+                        'glpi_profilerights',
+                        ['rights' => $right],
+                        ['name' => $new, 'profiles_id' => $profiles_id],
+                    );
                 }
             }
         }

inc/referencefree.class.php

@@ -107,20 +107,21 @@ public static function install(Migration $migration)
 
     public static function uninstall()
     {
-        /** @var \DBmysql $DB */
+        /** @var DBmysql $DB */
         global $DB;
 
-        $table  = getTableForItemType(__CLASS__);
+        $table  = getTableForItemType(self::class);
         foreach (
             ["glpi_displaypreferences", "glpi_documents_items", "glpi_savedsearches",
-                "glpi_logs"
+                "glpi_logs",
             ] as $t
         ) {
-            $query = "DELETE FROM `$t` WHERE `itemtype`='" . __CLASS__ . "'";
-            $DB->query($query);
+            $itemtype = getItemTypeForTable($t);
+            $item = getItemForItemtype($itemtype);
+            $item->deleteByCriteria(['itemtype' => self::class]);
         }
 
-        $DB->query("DROP TABLE IF EXISTS `$table`") or die($DB->error());
+        $DB->doQuery(sprintf('DROP TABLE IF EXISTS `%s`', $table));
     }
 
     /**

phpunit.xml

@@ -0,0 +1,7 @@
+<phpunit bootstrap="tests/bootstrap.php" colors="true" testdox="true">
+   <testsuites>
+      <testsuite name="Tests">
+         <directory>tests</directory>
+      </testsuite>
+   </testsuites>
+</phpunit>

tests/Units/DocumentCategoryTest.php

@@ -0,0 +1,62 @@
+<?php
+
+/**
+ * -------------------------------------------------------------------------
+ * Order plugin for GLPI
+ * -------------------------------------------------------------------------
+ *
+ * LICENSE
+ *
+ * This file is part of Order.
+ *
+ * Order is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * Order is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with Order. If not, see <http://www.gnu.org/licenses/>.
+ * -------------------------------------------------------------------------
+ * @copyright Copyright (C) 2009-2026 by Order plugin team.
+ * @license   GPLv3 https://www.gnu.org/licenses/gpl-3.0.html
+ * @link      https://github.com/pluginsGLPI/order
+ * -------------------------------------------------------------------------
+ */
+
+declare(strict_types=1);
+
+namespace GlpiPlugin\Order\Tests\Units;
+
+use DbTestCase;
+use DocumentCategory;
+use Glpi\Toolbox\Sanitizer;
+use PluginOrderDocumentCategory;
+
+final class DocumentCategoryTest extends DbTestCase
+{
+    private const XSS_PAYLOAD = '<script>alert(1);</script>';
+
+    public function testShowForDocumentCategoryEscapesPrefix(): void
+    {
+        $document_category = $this->createItem(DocumentCategory::class, [
+            'name' => $this->getUniqueString(),
+        ]);
+
+        $this->createItem(PluginOrderDocumentCategory::class, [
+            'documentcategories_id'     => $document_category->getID(),
+            'documentcategories_prefix' => self::XSS_PAYLOAD,
+        ]);
+
+        ob_start();
+        PluginOrderDocumentCategory::showForDocumentCategory($document_category);
+        $output = ob_get_clean();
+
+        $this->assertStringNotContainsString(self::XSS_PAYLOAD, $output);
+        $this->assertStringContainsString(Sanitizer::sanitize(self::XSS_PAYLOAD), $output);
+    }
+}