Fix: apply missing checks on block and field handling

CHANGELOG.md

@@ -22,6 +22,15 @@ and this project adheres to [Semantic Versioning](http://semver.org/).
 - Fix a field's default value not being applied to existing items and not being shown in search results for items with no dedicated row in the container table
 - Fix mandatory fields blocking automated item creation
 - Fix unclear mandatory field error when a GLPI form creating a ticket does not provide the field.
+- Fix blocks export, block deletion, read-only fields, item fields and form editor field selection not applying the expected checks.
+- Fix read-only status overrides being resolved from the previous status instead of the submitted one.
+- Fix read-only fields of an "Insertion in form" block being overwritable from the item form.
+- Fix a block's associated item types, type and tab being changeable after creation.
+- Remove obsolete FusionInventory integration.
+
+### Changed
+
+- A "GLPI item" field now rejects a new reference to an item the current user cannot read, instead of silently clearing it. Automated writes (CLI, cron, inventory) are not affected.
 
 ## [1.24.5] - 2026-09-11
 

front/container.form.php

@@ -46,12 +46,14 @@
     $container->check($_POST['id'], DELETE);
     $ok = $container->delete($_POST);
     Html::redirect(PLUGINFIELDS_WEB_DIR . '/front/container.php');
-} elseif (isset($_REQUEST['purge'])) {
-    $container->check($_REQUEST['id'], PURGE);
-    $container->delete($_REQUEST, true);
+} elseif (isset($_POST['purge'])) {
+    $container->check($_POST['id'], PURGE);
+    $container->delete($_POST, true);
     Html::redirect(PLUGINFIELDS_WEB_DIR . '/front/container.php');
 } elseif (isset($_POST['update'])) {
     $container->check($_POST['id'], UPDATE);
+    // structural fields drive generated classes and tables; only migrations may change them
+    unset($_POST['itemtypes'], $_POST['type'], $_POST['subtype']);
     $container->update($_POST);
     Html::back();
 } elseif (isset($_POST['update_fields_values'])) {
@@ -67,7 +69,7 @@
             throw new AccessDeniedHttpException();
         }
 
-        $container->updateFieldsValues($_REQUEST, $_REQUEST['itemtype'], false);
+        $container->updateFieldsValues(PluginFieldsContainer::removeReadonlyValues($_REQUEST, $item), $_REQUEST['itemtype'], false);
     }
 
     Html::back();

front/field.form.php

@@ -45,9 +45,9 @@
     $field->check($_POST['id'], DELETE);
     $field->delete($_POST);
     Html::back();
-} elseif (isset($_REQUEST['purge'])) {
-    $field->check($_REQUEST['id'], PURGE);
-    $field->delete($_REQUEST, true);
+} elseif (isset($_POST['purge'])) {
+    $field->check($_POST['id'], PURGE);
+    $field->delete($_POST, true);
     $field->redirectToList();
 } elseif (isset($_POST['update'])) {
     $field->check($_POST['id'], UPDATE);

hook.php

@@ -234,85 +234,6 @@ function plugin_fields_MassiveActionsFieldsDisplay($options = [])
     return false;
 }
 
-
-/**** RULES ENGINE ****/
-
-/**
- *
- * Actions for rules
- * @since 0.84
- * @param array $params input data
- * @return array    an array of actions
- */
-function plugin_fields_getRuleActions($params = [])
-{
-    $actions = [];
-
-    if ($params['rule_itemtype'] === 'PluginFusioninventoryTaskpostactionRule') {
-        $options = PluginFieldsContainer::getAddSearchOptions('Computer');
-        foreach ($options as $option) {
-            $actions[$option['linkfield']]['name'] = $option['name'];
-            $actions[$option['linkfield']]['type'] = $option['pfields_type'];
-            if ($option['pfields_type'] == 'dropdown') {
-                $actions[$option['linkfield']]['table'] = $option['table'];
-            }
-        }
-    }
-
-    return $actions;
-}
-
-
-function plugin_fields_rule_matched($params = [])
-{
-    /** @var DBmysql $DB */
-    global $DB;
-
-    $container = new PluginFieldsContainer();
-
-    if (class_exists('PluginFusioninventoryAgent') && $params['sub_type'] == 'PluginFusioninventoryTaskpostactionRule') {
-        $agent = new PluginFusioninventoryAgent();
-
-        if (isset($params['input']['plugin_fusioninventory_agents_id'])) {
-            foreach ($params['output'] as $field => $value) {
-                // check if current field is in a tab container
-                $iterator = $DB->request([
-                    'SELECT'    => 'glpi_plugin_fields_containers.id',
-                    'FROM'      => 'glpi_plugin_fields_containers',
-                    'LEFT JOIN' => [
-                        'glpi_plugin_fields_fields' => [
-                            'FKEY' => [
-                                'glpi_plugin_fields_containers' => 'id',
-                                'glpi_plugin_fields_fields'     => 'plugin_fields_containers_id',
-                            ],
-                        ],
-                    ],
-                    'WHERE' => [
-                        'glpi_plugin_fields_fields.name' => $field,
-                    ],
-                ]);
-                if (count($iterator) > 0) {
-                    $data = $iterator->current();
-
-                    //retrieve computer
-                    $agents_id = $params['input']['plugin_fusioninventory_agents_id'];
-                    $agent->getFromDB($agents_id);
-
-                    // update current field
-                    $container->updateFieldsValues(
-                        [
-                            'plugin_fields_containers_id' => $data['id'],
-                            $field                        => $value,
-                            'items_id'                    => $agent->fields['computers_id'],
-                        ],
-                        Computer::getType(),
-                    );
-                }
-            }
-        }
-    }
-}
-
 function plugin_fields_giveItem($itemtype, $ID, $data, $num)
 {
     $searchopt = Search::getOptions($itemtype);