Skip to content

Fix ticket observer can edit #1278

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Herafia wants to merge 3 commits into
base: main
Choose a base branch
from
+16 −2
Open

Fix ticket observer can edit #1278

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
ac697a6
Fix ticket observer can edit
Herafia Sep 29, 2026
c8daeff
fix CI
Herafia Sep 30, 2026
bd189b5
changelog
Herafia Sep 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/).
- Fix dependency conflict with GLPI core by no longer vendoring symfony/deprecation-contracts and symfony/polyfill-ctype.
- Fix default field values not being applied when fields are empty on creation
- Fix mandatory fields blocking automated item creation
- Fix ticket observers being able to edit and save additional fields they are not allowed to modify

## [1.24.5] - 2026-09-11

Expand Down
13 changes: 13 additions & 0 deletions inc/container.class.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1900,6 +1900,19 @@ public static function preItemUpdate(CommonDBTM $item)
{
self::preItem($item);
if (array_key_exists('_plugin_fields_data', $item->input)) {
// Only save plugin fields if the user can update this specific item.
// Automated contexts (cron jobs, API without active profile) bypass this check.
if (
isset($_SESSION['glpiactiveprofile']['id'])
&& $_SESSION['glpiactiveprofile']['id'] != null
&& $item instanceof CommonITILObject
&& Session::getCurrentInterface() === 'helpdesk'
&& !$item->canRequesterUpdateItem()
) {
unset($item->input['_plugin_fields_data']);
return true;
}

$data = $item->input['_plugin_fields_data'];
$data['itemtype'] = $item::class;
$data['entities_id'] = $item->isEntityAssign() ? $item->getEntityID() : 0;
Expand Down
4 changes: 2 additions & 2 deletions inc/field.class.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -891,7 +891,7 @@ public static function showForTabContainer($c_id, $item)
return null;
}

$canedit = $right > READ;
$canedit = $right > READ && ($item->isNewItem() || $item->canUpdateItem());

//get fields for this container
$field_obj = new self();
Expand Down Expand Up @@ -1210,7 +1210,7 @@ public static function prepareHtmlFields(
return null;
}

$canedit = $right > READ;
$canedit = $right > READ && ($item->isNewItem() || $item->canUpdateItem());

// Fill status overrides if needed
if (in_array($item->getType(), PluginFieldsStatusOverride::getStatusItemtypes())) {
Expand Down
Loading