Skip to content

Commit 376b173

Browse files
stonebuzzstonebuzz
committed
fix
1 parent 568344f commit 376b173

1 file changed

Lines changed: 109 additions & 102 deletions

File tree

‎ajax/dropdownReplaceFindDevice.php‎

Lines changed: 109 additions & 102 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,8 @@
3030

3131
include('../../../inc/includes.php');
3232

33+
use Glpi\Exception\Http\AccessDeniedHttpException;
34+
use Glpi\Exception\Http\BadRequestHttpException;
3335
use Glpi\Toolbox\Sanitizer;
3436

3537
header("Content-Type: text/html; charset=UTF-8");
@@ -46,128 +48,133 @@
4648
global $UNINSTALL_TYPES, $UNINSTALL_DIRECT_CONNECTIONS_TYPE, $CFG_GLPI, $DB;
4749

4850
if (!in_array($_REQUEST['itemtype'], array_merge($UNINSTALL_TYPES, $UNINSTALL_DIRECT_CONNECTIONS_TYPE))) {
49-
Html::displayErrorAndDie(__("You don't have permission to perform this action."));
51+
throw new AccessDeniedHttpException(__("You don't have permission to perform this action."));
5052
}
5153

52-
$itemtypeisplugin = isPluginItemType($_REQUEST['itemtype']);
53-
$item = new $_REQUEST['itemtype']();
54-
$table = getTableForItemType($_REQUEST['itemtype']);
55-
$options = [];
56-
$count = 0;
57-
$datastoadd = [];
58-
59-
$displaywith = false;
60-
if (isset($_REQUEST['displaywith'])) {
61-
if (is_array($_REQUEST['displaywith']) && count($_REQUEST['displaywith'])) {
62-
$displaywith = true;
54+
if (class_exists($_REQUEST['itemtype']) && is_a($_REQUEST['itemtype'], CommonDBTM::class, true)) {
55+
$itemtypeisplugin = isPluginItemType($_REQUEST['itemtype']);
56+
$item = new $_REQUEST['itemtype']();
57+
$table = getTableForItemType($_REQUEST['itemtype']);
58+
$options = [];
59+
$count = 0;
60+
$datastoadd = [];
61+
62+
$displaywith = false;
63+
if (isset($_REQUEST['displaywith'])) {
64+
if (is_array($_REQUEST['displaywith']) && count($_REQUEST['displaywith'])) {
65+
$displaywith = true;
66+
}
6367
}
64-
}
65-
66-
$criteria = [
67-
'FROM' => $table,
68-
'WHERE' => [],
69-
];
70-
71-
if ($item->isEntityAssign()) {
72-
// allow opening ticket on recursive object (printer, software, ...)
73-
$criteria['WHERE'] = getEntitiesRestrictCriteria($table, '', $_SESSION['glpiactiveentities'], $item->maybeRecursive());
74-
}
7568

76-
if ($item->maybeDeleted()) {
77-
$criteria['WHERE']['is_deleted'] = 0;
78-
}
79-
if ($item->maybeTemplate()) {
80-
$criteria['WHERE']['is_template'] = 0;
81-
}
82-
83-
if (
84-
isset($_REQUEST['searchText'])
85-
&& strlen($_REQUEST['searchText']) > 0
86-
&& $_REQUEST['searchText'] != $CFG_GLPI["ajax_wildcard"]
87-
) {
88-
// isset already makes sure the search value isn't null
89-
$search_val = Search::makeTextSearchValue($_REQUEST['searchText']);
90-
$criteria['WHERE'][] = [
91-
'OR' => [
92-
'name' => ['LIKE', $search_val],
93-
'id' => ['LIKE', $search_val],
94-
'serial' => ['LIKE', $search_val],
95-
'otherserial' => ['LIKE', $search_val],
96-
],
69+
$criteria = [
70+
'FROM' => $table,
71+
'WHERE' => [],
9772
];
98-
}
9973

100-
//If software or plugins : filter to display only the objects that are allowed to be visible in Helpdesk
101-
if (in_array($_REQUEST['itemtype'], $CFG_GLPI["helpdesk_visible_types"])) {
102-
$criteria['WHERE']['is_helpdesk_visible'] = 1;
103-
}
74+
if ($item->isEntityAssign()) {
75+
// allow opening ticket on recursive object (printer, software, ...)
76+
$criteria['WHERE'] = getEntitiesRestrictCriteria($table, '', $_SESSION['glpiactiveentities'], $item->maybeRecursive());
77+
}
10478

105-
if (isset($_REQUEST['used'])) {
106-
$used = $_REQUEST['used'];
79+
if ($item->maybeDeleted()) {
80+
$criteria['WHERE']['is_deleted'] = 0;
81+
}
82+
if ($item->maybeTemplate()) {
83+
$criteria['WHERE']['is_template'] = 0;
84+
}
10785

108-
if (count($used)) {
86+
if (
87+
isset($_REQUEST['searchText'])
88+
&& strlen($_REQUEST['searchText']) > 0
89+
&& $_REQUEST['searchText'] != $CFG_GLPI["ajax_wildcard"]
90+
) {
91+
// isset already makes sure the search value isn't null
92+
$search_val = Search::makeTextSearchValue($_REQUEST['searchText']);
10993
$criteria['WHERE'][] = [
110-
'NOT' => ["$table.id" => $used],
94+
'OR' => [
95+
'name' => ['LIKE', $search_val],
96+
'id' => ['LIKE', $search_val],
97+
'serial' => ['LIKE', $search_val],
98+
'otherserial' => ['LIKE', $search_val],
99+
],
111100
];
112101
}
113-
}
114-
115-
if (isset($_REQUEST['current_item']) && ($_REQUEST['current_item'] > 0)) {
116-
$criteria['WHERE']['id'] = ['!=', $_REQUEST['current_item']];
117-
}
118102

119-
$criteria['START'] = 0;
120-
$criteria['LIMIT'] = $CFG_GLPI["dropdown_max"];
121-
$criteria['ORDER'] = ['name'];
103+
//If software or plugins : filter to display only the objects that are allowed to be visible in Helpdesk
104+
if (in_array($_REQUEST['itemtype'], $CFG_GLPI["helpdesk_visible_types"])) {
105+
$criteria['WHERE']['is_helpdesk_visible'] = 1;
106+
}
122107

123-
if (
124-
isset($_REQUEST['searchText'])
125-
&& $_REQUEST['searchText'] == $CFG_GLPI["ajax_wildcard"]
126-
) {
127-
unset($criteria['LIMIT']);
128-
}
108+
if (isset($_REQUEST['used'])) {
109+
$used = $_REQUEST['used'];
129110

130-
$it = $DB->request($criteria);
131-
foreach ($it as $data) {
132-
$outputval = Sanitizer::unsanitize($data["name"]);
133-
134-
if ($displaywith) {
135-
foreach ($_REQUEST['displaywith'] as $key) {
136-
if (isset($data[$key])) {
137-
$withoutput = $data[$key];
138-
if (isForeignKeyField($key)) {
139-
$withoutput = Dropdown::getDropdownName(
140-
getTableNameForForeignKeyField($key),
141-
$data[$key],
142-
);
143-
}
144-
if ((strlen($withoutput) > 0) && ($withoutput != ' ')) {
145-
$outputval = sprintf(__('%1$s - %2$s'), $outputval, $withoutput);
146-
}
147-
}
111+
if (count($used)) {
112+
$criteria['WHERE'][] = [
113+
'NOT' => ["$table.id" => $used],
114+
];
148115
}
149116
}
150-
$ID = $data['id'];
151-
$addcomment = "";
152-
$title = $outputval;
153-
if (isset($data["comment"])) {
154-
$addcomment .= $data["comment"];
155-
$title = sprintf(__('%1$s - %2$s'), $title, $addcomment);
117+
118+
if (isset($_REQUEST['current_item']) && ($_REQUEST['current_item'] > 0)) {
119+
$criteria['WHERE']['id'] = ['!=', $_REQUEST['current_item']];
156120
}
121+
122+
$criteria['START'] = 0;
123+
$criteria['LIMIT'] = $CFG_GLPI["dropdown_max"];
124+
$criteria['ORDER'] = ['name'];
125+
157126
if (
158-
$_SESSION["glpiis_ids_visible"]
159-
|| (strlen($outputval) == 0)
127+
isset($_REQUEST['searchText'])
128+
&& $_REQUEST['searchText'] == $CFG_GLPI["ajax_wildcard"]
160129
) {
161-
$outputval = sprintf(__('%1$s (%2$s)'), $outputval, $ID);
130+
unset($criteria['LIMIT']);
131+
}
132+
133+
$it = $DB->request($criteria);
134+
foreach ($it as $data) {
135+
$outputval = $data["name"];
136+
137+
if ($displaywith) {
138+
foreach ($_REQUEST['displaywith'] as $key) {
139+
if (isset($data[$key])) {
140+
$withoutput = $data[$key];
141+
if (isForeignKeyField($key)) {
142+
$withoutput = Dropdown::getDropdownName(
143+
getTableNameForForeignKeyField($key),
144+
$data[$key],
145+
);
146+
}
147+
if ((strlen($withoutput) > 0) && ($withoutput != ' ')) {
148+
$outputval = sprintf(__('%1$s - %2$s'), $outputval, $withoutput);
149+
}
150+
}
151+
}
152+
}
153+
$ID = $data['id'];
154+
$addcomment = "";
155+
$title = $outputval;
156+
if (isset($data["comment"])) {
157+
$addcomment .= $data["comment"];
158+
$title = sprintf(__('%1$s - %2$s'), $title, $addcomment);
159+
}
160+
if (
161+
$_SESSION["glpiis_ids_visible"]
162+
|| (strlen($outputval) == 0)
163+
) {
164+
$outputval = sprintf(__('%1$s (%2$s)'), $outputval, $ID);
165+
}
166+
array_push($options, ['id' => $ID,
167+
'text' => $outputval,
168+
'title' => $title,
169+
]);
170+
$count++;
162171
}
163-
array_push($options, ['id' => $ID,
164-
'text' => $outputval,
165-
'title' => $title,
172+
173+
174+
echo json_encode(['results' => $options,
175+
'count' => $count,
166176
]);
167-
$count++;
177+
} else {
178+
throw new BadRequestHttpException();
168179
}
169180

170-
171-
echo json_encode(['results' => $options,
172-
'count' => $count,
173-
]);

0 commit comments

Comments
 (0)