Fix: strengthen ticket escalation validation

CHANGELOG.md

@@ -10,6 +10,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/).
 ### Fixed
 
 - Fix massive action modal not showing when a group has more than 10 associated groups
+- Strengthen input validation and access checks on ticket escalation actions
 
 ## [2.10.4] - 2026-06-24
 

Makefile

@@ -0,0 +1 @@
+include ../../PluginsMakefile.mk

ajax/assign_me.php

@@ -36,4 +36,9 @@
     throw new BadRequestHttpException();
 }
 
-PluginEscaladeTicket::assign_me((int) $_REQUEST['tickets_id']);
+$tickets_id = (int) $_REQUEST['tickets_id'];
+
+$ticket = new Ticket();
+$ticket->check($tickets_id, UPDATE);
+
+PluginEscaladeTicket::assign_me($tickets_id);

ajax/cloneandlink_ticket.php

@@ -46,17 +46,19 @@
     throw new BadRequestHttpException();
 }
 
+$tickets_id = (int) $_REQUEST['tickets_id'];
+
 $ticket = new Ticket();
 
-if ($ticket->getFromDB($_REQUEST['tickets_id'])) {
+if ($ticket->getFromDB($tickets_id)) {
     if (
-        !$ticket->can($_REQUEST['tickets_id'], READ)
+        !$ticket->can($tickets_id, READ)
         || !Ticket::canCreate()
     ) {
         throw new AccessDeniedHttpException(
             'You do not have permission to clone this ticket.',
         );
     }
 
-    PluginEscaladeTicket::cloneAndLink($_REQUEST['tickets_id']);
+    PluginEscaladeTicket::cloneAndLink($tickets_id);
 }

ajax/history.php

@@ -34,5 +34,10 @@
 Session::checkLoginUser();
 
 if (isset($_REQUEST['tickets_id'])) {
-    PluginEscaladeHistory::getHistory($_REQUEST['tickets_id']);
+    $tickets_id = (int) $_REQUEST['tickets_id'];
+
+    $ticket = new Ticket();
+    $ticket->check($tickets_id, READ);
+
+    PluginEscaladeHistory::getHistory($tickets_id);
 }

front/climb_group.php

@@ -27,7 +27,7 @@
  * @link      https://github.com/pluginsGLPI/escalade
  * -------------------------------------------------------------------------
  */
-use Glpi\Exception\Http\AccessDeniedHttpException;
+
 use Glpi\Exception\Http\BadRequestHttpException;
 
 Session::checkLoginUser();
@@ -44,12 +44,9 @@
     throw new BadRequestHttpException();
 }
 
-$ticket = new Ticket();
-$ticket->getFromDB((int) $_REQUEST['tickets_id']);
-
-if (!$ticket->canAssign()) {
-    throw new AccessDeniedHttpException();
-}
+$tickets_id = (int) $_REQUEST['tickets_id'];
 
+$ticket = new Ticket();
+$ticket->check($tickets_id, UPDATE);
 
-PluginEscaladeTicket::climb_group((int) $_REQUEST['tickets_id'], (int) $_REQUEST['groups_id']);
+PluginEscaladeTicket::climb_group($tickets_id, (int) $_REQUEST['groups_id']);

front/group_group.form.php

@@ -28,20 +28,40 @@
  * -------------------------------------------------------------------------
  */
 
+use Glpi\Exception\Http\AccessDeniedHttpException;
+
 Session::checkLoginUser();
 
 Html::header("escalade", $_SERVER["PHP_SELF"], "plugins", "escalade", "group_group");
 
 if (Session::haveRight('group', UPDATE)) {
     if (isset($_POST['addgroup'])) {
+        $group_source = new Group();
+        $group_destination = new Group();
+        if (
+            !$group_source->getFromDB((int) $_POST['groups_id_source'])
+            || !Session::haveAccessToEntity($group_source->getEntityID())
+            || !$group_destination->getFromDB((int) $_POST['groups_id_destination'])
+            || !Session::haveAccessToEntity($group_destination->getEntityID())
+        ) {
+            throw new AccessDeniedHttpException();
+        }
+
         $PluginEscaladeGroup_Group = new PluginEscaladeGroup_Group();
         $PluginEscaladeGroup_Group->add($_POST);
     }
 
     if (isset($_POST['deleteitem'])) {
         $PluginEscaladeGroup_Group = new PluginEscaladeGroup_Group();
+        $group = new Group();
         foreach ($_POST['delgroup'] as $id) {
-            $PluginEscaladeGroup_Group->delete(['id' => $id]);
+            if (
+                $PluginEscaladeGroup_Group->getFromDB((int) $id)
+                && $group->getFromDB((int) $PluginEscaladeGroup_Group->fields['groups_id_source'])
+                && Session::haveAccessToEntity($group->getEntityID())
+            ) {
+                $PluginEscaladeGroup_Group->delete(['id' => $id]);
+            }
         }
     }
 }

front/popup_histories.php

@@ -41,8 +41,13 @@
     throw new AccessDeniedHttpException();
 }
 
+$tickets_id = (int) $_REQUEST['tickets_id'];
+
+$ticket = new Ticket();
+$ticket->check($tickets_id, READ);
+
 echo "<div id='page'>";
-PluginEscaladeHistory::getHistory((int) $_REQUEST['tickets_id'], true);
+PluginEscaladeHistory::getHistory($tickets_id, true);
 echo "</div>";
 
 Html::popFooter();

front/ticket.form.php

@@ -28,8 +28,6 @@
  * -------------------------------------------------------------------------
  */
 
-use Glpi\Exception\Http\AccessDeniedHttpException;
-
 Session::checkLoginUser();
 
 /** @var array $CFG_GLPI */
@@ -40,14 +38,7 @@
     $tickets_id = (int) $_POST['tickets_id'];
 
     $ticket = new Ticket();
-    if (!$ticket->getFromDB($tickets_id)) {
-        throw new AccessDeniedHttpException();
-    }
-
-    // Same right check as in PluginEscaladeTicket::addToTimeline()
-    if (!$ticket->canAssign()) {
-        throw new AccessDeniedHttpException();
-    }
+    $ticket->check($tickets_id, UPDATE);
 
     PluginEscaladeTicket::timelineClimbAction($group_id, $tickets_id, $_POST);
 

inc/history.class.php

@@ -246,7 +246,7 @@ public static function showGroupLink($group, $full_history = false)
     {
 
         if (!$group->can($group->fields['id'], READ)) {
-            return $group->getNameID(true);
+            return '';
         }
 
         $link_item = $group->getFormURL();

inc/ticket.class.php

@@ -1005,6 +1005,9 @@ public static function cloneAndLink($tickets_id)
         /** @var DBmysql $DB */
         global $DB;
 
+        // Enforce integer type before interpolation in the raw SQL below (SQL injection guard)
+        $tickets_id = (int) $tickets_id;
+
         //get old ticket
         $ticket = new Ticket();
         if (!$ticket->getFromDB($tickets_id)) {