Fix: apply missing checks on block and field handling

Author: stonebuzz

CHANGELOG.md

@@ -5,6 +5,20 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](http://keepachangelog.com/)
 and this project adheres to [Semantic Versioning](http://semver.org/).
 
+## [Unreleased]
+
+### Fixed
+
+- Fix blocks export, block deletion and read-only fields not applying expected checks.
+- Fix read-only status overrides being resolved with the previous status instead of the submitted one.
+- Fix read-only fields of "Insertion in form" blocks being overwritable from the item form.
+- Fix block's associated item types and type being changeable after creation.
+- Remove obsolete FusionInventory integration.
+
+### Changed
+
+- "GLPI item" field now rejects a new reference to an item the current user cannot read, instead of silently clearing it. Automated writes (CLI, cron, inventory) are not affected.
+
 ## [1.21.30] 2026-09-11
 
 - Fix additional fields being saved on an item the user is not allowed to update.

composer.json

@@ -1,12 +1,12 @@
 {
     "require": {
-        "php": ">=7.4",
-        "symfony/yaml": "^5.4"
+        "php": ">=7.4"
     },
     "require-dev": {
         "glpi-project/tools": "^0.8"
     },
     "config": {
+        "autoloader-suffix": "PluginField",
         "optimize-autoloader": true,
         "platform": {
             "php": "7.4.0"

front/container.form.php

@@ -45,12 +45,14 @@
     $container->check($_POST['id'], DELETE);
     $ok = $container->delete($_POST);
     Html::redirect(PLUGINFIELDS_WEB_DIR . '/front/container.php');
-} elseif (isset($_REQUEST['purge'])) {
-    $container->check($_REQUEST['id'], PURGE);
-    $container->delete($_REQUEST, true);
+} elseif (isset($_POST['purge'])) {
+    $container->check($_POST['id'], PURGE);
+    $container->delete($_POST, true);
     Html::redirect(PLUGINFIELDS_WEB_DIR . '/front/container.php');
 } elseif (isset($_POST['update'])) {
     $container->check($_POST['id'], UPDATE);
+    // structural fields drive generated classes and tables; only migrations may change them
+    unset($_POST['itemtypes'], $_POST['type'], $_POST['subtype']);
     $container->update($_POST);
     Html::back();
 } elseif (isset($_POST['update_fields_values'])) {
@@ -66,7 +68,7 @@
             Html::displayRightError();
         }
 
-        $container->updateFieldsValues($_REQUEST, $_REQUEST['itemtype'], false);
+        $container->updateFieldsValues(PluginFieldsContainer::removeReadonlyValues($_REQUEST, $item), $_REQUEST['itemtype'], false);
     }
     Html::back();
 } else {

front/field.form.php

@@ -46,9 +46,9 @@
     $field->check($_POST['id'], DELETE);
     $field->delete($_POST);
     Html::back();
-} elseif (isset($_REQUEST['purge'])) {
-    $field->check($_REQUEST['id'], PURGE);
-    $field->delete($_REQUEST, true);
+} elseif (isset($_POST['purge'])) {
+    $field->check($_POST['id'], PURGE);
+    $field->delete($_POST, true);
     $field->redirectToList();
 } elseif (isset($_POST['update'])) {
     $field->check($_POST['id'], UPDATE);

hook.php

@@ -231,88 +231,6 @@ function plugin_fields_MassiveActionsFieldsDisplay($options = [])
     return false;
 }
 
-
-/**** RULES ENGINE ****/
-
-/**
- *
- * Actions for rules
- * @since 0.84
- * @param array $params input data
- * @return array    an array of actions
- */
-function plugin_fields_getRuleActions($params = [])
-{
-    $actions = [];
-
-    switch ($params['rule_itemtype']) {
-        case 'PluginFusioninventoryTaskpostactionRule':
-            $options = PluginFieldsContainer::getAddSearchOptions('Computer');
-            foreach ($options as $option) {
-                $actions[$option['linkfield']]['name'] = $option['name'];
-                $actions[$option['linkfield']]['type'] = $option['pfields_type'];
-                if ($option['pfields_type'] == 'dropdown') {
-                    $actions[$option['linkfield']]['table'] = $option['table'];
-                }
-            }
-
-            break;
-    }
-
-    return $actions;
-}
-
-
-function plugin_fields_rule_matched($params = [])
-{
-    /** @var DBmysql $DB */
-    global $DB;
-
-    $container = new PluginFieldsContainer();
-
-    if (class_exists('PluginFusioninventoryAgent') && $params['sub_type'] == 'PluginFusioninventoryTaskpostactionRule') {
-        $agent = new PluginFusioninventoryAgent();
-
-        if (isset($params['input']['plugin_fusioninventory_agents_id'])) {
-            foreach ($params['output'] as $field => $value) {
-                // check if current field is in a tab container
-                $iterator = $DB->request([
-                    'SELECT'    => 'glpi_plugin_fields_containers.id',
-                    'FROM'      => 'glpi_plugin_fields_containers',
-                    'LEFT JOIN' => [
-                        'glpi_plugin_fields_fields' => [
-                            'FKEY' => [
-                                'glpi_plugin_fields_containers' => 'id',
-                                'glpi_plugin_fields_fields'     => 'plugin_fields_containers_id',
-                            ],
-                        ],
-                    ],
-                    'WHERE' => [
-                        'glpi_plugin_fields_fields.name' => $field,
-                    ],
-                ]);
-                if (count($iterator) > 0) {
-                    $data = $iterator->current();
-
-                    //retrieve computer
-                    $agents_id = $params['input']['plugin_fusioninventory_agents_id'];
-                    $agent->getFromDB($agents_id);
-
-                    // update current field
-                    $container->updateFieldsValues(
-                        [
-                            'plugin_fields_containers_id' => $data['id'],
-                            $field                        => $value,
-                            'items_id'                    => $agent->fields['computers_id'],
-                        ],
-                        Computer::getType(),
-                    );
-                }
-            }
-        }
-    }
-}
-
 function plugin_fields_giveItem($itemtype, $ID, $data, $num)
 {
     $searchopt = &Search::getOptions($itemtype);