[stonebuzz]

Checklist before requesting a review

Please delete options that are not relevant.

• I have performed a self-review of my code.
• I have added tests (when available) that prove my fix is effective or that my feature works.
• I have updated the CHANGELOG with a short functional description of the fix or new feature.
• This change requires a documentation update.

Description

• It fixes !47495
• Mapping a CSV column to an additional field (Fields plugin) made the model inaccessible, even for a super admin, and the Fields values were rejected during injection.
• Since Fields 1.24.7, its container classes always refuse direct creation and update, which datainjection used to check on every mapped itemtype.
• Fields containers now follow the Fields rule instead: the parent item rights are checked as before, and the active profile must have more than read access on the container.
• The CSRF error reported alongside is only a side effect of submitting the form again after the access denied page.

User ID: `XXXXX` tried to execute an invalid request on `/plugins/datainjection/front/model.form.php?id=2`. Backtrace : ./src/CommonGLPI.php:1287 .../plugins/datainjection/front/model.form.php:116 CommonGLPI->display() ...Glpi/Controller/LegacyFileLoadController.php:64 require() ./vendor/symfony/http-kernel/HttpKernel.php:181 Glpi\Controller\LegacyFileLoadController->__invoke() ./vendor/symfony/http-kernel/HttpKernel.php:76 Symfony\Component\HttpKernel\HttpKernel->handleRaw() ./vendor/symfony/http-kernel/Kernel.php:208 Symfony\Component\HttpKernel\HttpKernel->handle() ./src/Glpi/Kernel/Kernel.php:201 Symfony\Component\HttpKernel\Kernel->handle() ./public/index.php:78 Glpi\Kernel\Kernel->handle()
[XXXXX@hostname] CSRF check failed for User ID: XXXXX at /plugins/datainjection/front/mapping.form.php

Screenshots (if appropriate):

[RomainLvr]

@stonebuzz As we discussed internally, we're closing this PR since it already exists: pluginsGLPI/fields#1336 ?

[RomainLvr]

Finally, this is the right fix. I closed pluginsGLPI/fields#1335 and pluginsGLPI/fields#1336.

Data Injection never checks the rights of the generated ...Injection class: the mapping stores the parent container class, and the written item is resolved from its table. So the check has to happen here. Fixing it on the Fields side would mean opening the container instance class again, which would undo pluginsGLPI/fields#1299.

Tested locally with the real plugins (block on Computers, model mapped to it): the model opens and the value is injected with this PR, with or without the Fields PR.

[glpi-project]

Backport-action failed to backport this pull request in workflow run 42850334455.

Target	Status
main	❌ Failed

❌ main — push failed

Tried to push backport branch forward-port/703-to-main to origin, but the push failed (exit code 1).

This usually means the token lacks permission to push to this repository. Consider using a Personal Access Token (PAT) with repo scope as github_token.