Fix import 10

CHANGELOG.md

@@ -11,6 +11,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/).
 
 - Fix retrieval of dropdown and multiline values containing special characters
 - Fix repeated User updates failing with `Data too long for column cookie_token` by excluding token fields from update payloads (backport of PR #566 from GLPI 11-compatible line)
+- Fix various minor bugs in the import/export workflow (backport of PR #656 from GLPI 11-compatible line)
 
 ## [2.14.4] - 2025-11-25
 

Makefile

@@ -0,0 +1 @@
+include ../../PluginsMakefile.mk

ajax/injection.php

@@ -35,6 +35,6 @@
     Html::header_nocache();
 }
 
-Session::checkCentralAccess();
+Session::checkRight(PluginDatainjectionClientInjection::$rightname, READ);
 $model = unserialize($_SESSION['datainjection']['currentmodel']);
 PluginDatainjectionClientInjection::showInjectionForm($model, $_SESSION['glpiactive_entity']);

ajax/results.php

@@ -35,6 +35,6 @@
     Html::header_nocache();
 }
 
-Session::checkCentralAccess();
+Session::checkRight(PluginDatainjectionClientInjection::$rightname, READ);
 $model = unserialize($_SESSION['datainjection']['currentmodel']);
 PluginDatainjectionClientInjection::showResultsForm($model);

front/info.form.php

@@ -33,6 +33,8 @@
 
 /* Update mappings */
 if (isset($_POST["update"])) {
+    $model = new PluginDatainjectionModel();
+    $model->check($_POST['models_id'], UPDATE);
     PluginDatainjectionInfo::manageInfos($_POST['models_id'], $_POST);
 } else if (isset($_POST["delete"])) {
     $info = new PluginDatainjectionInfo();

front/popup.php

@@ -34,6 +34,8 @@
 
 switch ($_GET["popup"]) {
     case "preview":
+        $model = new PluginDatainjectionModel();
+        $model->check($_GET['models_id'], READ);
         Html::popHeader(__('See the file', 'datainjection'), $_SERVER['PHP_SELF']);
         PluginDatainjectionModel::showPreviewMappings($_GET['models_id']);
         Html::popFooter();

hook.php

@@ -210,6 +210,12 @@ function plugin_datainjection_uninstall()
         }
     }
 
+    // Remove plugin rights from all profiles
+    $profileRight = new ProfileRight();
+    foreach (PluginDatainjectionProfile::getAllRights() as $right) {
+        $profileRight->deleteByCriteria(['name' => $right['field']]);
+    }
+
     if (is_dir(PLUGIN_DATAINJECTION_UPLOAD_DIR)) {
         Toolbox::deleteDir(PLUGIN_DATAINJECTION_UPLOAD_DIR);
     }

inc/clientinjection.class.php

@@ -417,6 +417,13 @@ public static function showResultsForm(PluginDatainjectionModel $model)
         Html::closeForm();
     }
 
+    private static function escapeCsvFormula($value)
+    {
+        if (is_string($value) && isset($value[0]) && in_array($value[0], ['=', '+', '-', '@'], true)) {
+            return "'" . $value;
+        }
+        return $value;
+    }
 
     public static function exportErrorsInCSV()
     {
@@ -426,7 +433,7 @@ public static function exportErrorsInCSV()
 
         if (!empty($error_lines)) {
             $model = unserialize(PluginDatainjectionSession::getParam('currentmodel'));
-            $file  = PLUGIN_DATAINJECTION_UPLOAD_DIR . PluginDatainjectionSession::getParam('file_name');
+            $file  = PLUGIN_DATAINJECTION_UPLOAD_DIR . basename(PluginDatainjectionSession::getParam('file_name'));
 
             $mappings = $model->getMappings();
             $tmpfile  = fopen($file, 'w');
@@ -439,11 +446,11 @@ public static function exportErrorsInCSV()
 
            //Write lines
             foreach ($error_lines as $line) {
-                fputcsv($tmpfile, $line, $model->getBackend()->getDelimiter());
+                fputcsv($tmpfile, array_map([self::class, 'escapeCsvFormula'], $line), $model->getBackend()->getDelimiter());
             }
             fclose($tmpfile);
 
-            $name = "Error-" . PluginDatainjectionSession::getParam('file_name');
+            $name = "Error-" . basename(PluginDatainjectionSession::getParam('file_name'));
             $name = str_replace(' ', '', $name);
             header('Content-disposition: attachment; filename=' . $name);
             header('Content-Type: application/octet-stream');

inc/info.class.php

@@ -222,7 +222,10 @@ public static function manageInfos($models_id, $infos = [])
                 }
 
                 if ($id > 0) {
-                    $info->update($info_infos);
+                    $existing = new self();
+                    if ($existing->getFromDB($id) && $existing->fields['models_id'] == $models_id) {
+                        $info->update($info_infos);
+                    }
                 } else {
                     $info_infos['models_id'] = $models_id;
                     unset($info_infos['id']);

inc/model.class.php

@@ -28,6 +28,8 @@
  * -------------------------------------------------------------------------
  */
 
+use Glpi\Toolbox\Sanitizer;
+
 class PluginDatainjectionModel extends CommonDBTM
 {
     public static $rightname = "plugin_datainjection_model";
@@ -1317,7 +1319,7 @@ public function switchReadyToUse()
 
         $tmp         = $this->fields;
         $tmp['step'] = self::READY_TO_USE_STEP;
-        $tmp = Toolbox::addslashes_deep($tmp);
+        $tmp = Sanitizer::dbEscapeRecursive($tmp);
         $this->update($tmp);
     }
 

inc/softwarelicenseinjection.class.php

@@ -159,20 +159,20 @@ public function getValueForAdditionalMandatoryFields($fields_toinject = [])
             return $fields_toinject;
         }
 
-        $query = "SELECT `id`
-                FROM `glpi_softwares`
-                WHERE `name` = '" . $fields_toinject['SoftwareLicense']['softwares_id'] . "'" .
-                    getEntitiesRestrictRequest(
-                        " AND",
-                        "glpi_softwares",
-                        "entities_id",
-                        $fields_toinject['SoftwareLicense']['entities_id'],
-                        true
-                    );
-        $result = $DB->doQuery($query);
-
-        if ($DB->numrows($result) > 0) {
-            $id = $DB->result($result, 0, 'id');
+        $where = ['name' => $fields_toinject['SoftwareLicense']['softwares_id']] + getEntitiesRestrictCriteria(
+            "glpi_softwares",
+            "entities_id",
+            $fields_toinject['SoftwareLicense']['entities_id'],
+            true
+        );
+        $result = $DB->request([
+            'SELECT' => 'id',
+            'FROM'   => 'glpi_softwares',
+            'WHERE'  => $where,
+        ]);
+
+        if (count($result) > 0) {
+            $id = $result->current()['id'];
             //Add softwares_id to the array
             $fields_toinject['SoftwareLicense']['softwares_id'] = $id;
         } else {

inc/softwareversioninjection.class.php

@@ -154,20 +154,20 @@ public function getValueForAdditionalMandatoryFields($fields_toinject = [])
             return $fields_toinject;
         }
 
-        $query = "SELECT `id`
-                FROM `glpi_softwares`
-                WHERE `name` = '" . $fields_toinject['SoftwareVersion']['softwares_id'] . "'" .
-                    getEntitiesRestrictRequest(
-                        " AND",
-                        "glpi_softwares",
-                        "entities_id",
-                        $fields_toinject['SoftwareVersion']['entities_id'],
-                        true
-                    );
-        $result = $DB->doQuery($query);
-
-        if ($DB->numrows($result) > 0) {
-            $id = $DB->result($result, 0, 'id');
+        $where = ['name' => $fields_toinject['SoftwareVersion']['softwares_id']] + getEntitiesRestrictCriteria(
+            "glpi_softwares",
+            "entities_id",
+            $fields_toinject['SoftwareVersion']['entities_id'],
+            true
+        );
+        $result = $DB->request([
+            'SELECT' => 'id',
+            'FROM'   => 'glpi_softwares',
+            'WHERE'  => $where,
+        ]);
+
+        if (count($result) > 0) {
+            $id = $result->current()['id'];
             //Add softwares_id to the array
             $fields_toinject['SoftwareVersion']['softwares_id'] = $id;
         } else {

inc/userinjection.class.php

@@ -235,14 +235,11 @@ public function processAfterInsertOrUpdate($values, $add = true, $rights = [])
         }
 
         if (isset($values['User']['password']) && ($values['User']['password'] != '')) {
-           //We use an SQL request because updating the password is unesasy
-           //(self reset password process in $user->prepareInputForUpdate())
-            $password = sha1(Sanitizer::unsanitize($values['User']["password"]));
-
-            $query = "UPDATE `glpi_users`
-                   SET `password` = '" . $password . "'
-                   WHERE `id` = '" . $values['User']['id'] . "'";
-            $DB->doQuery($query);
+            $DB->update(
+                'glpi_users',
+                ['password' => Auth::getPasswordHash(Sanitizer::unsanitize($values['User']['password']))],
+                ['id' => $values['User']['id']],
+            );
         }
     }
 

phpunit.xml

@@ -0,0 +1,7 @@
+<phpunit bootstrap="tests/bootstrap.php" colors="true" testdox="true">
+   <testsuites>
+      <testsuite name="Tests">
+         <directory suffix="Test.php">tests</directory>
+      </testsuite>
+   </testsuites>
+</phpunit>

tests/bootstrap.php

@@ -0,0 +1,48 @@
+<?php
+
+/**
+ * -------------------------------------------------------------------------
+ * DataInjection plugin for GLPI
+ * -------------------------------------------------------------------------
+ *
+ * LICENSE
+ *
+ * This file is part of DataInjection.
+ *
+ * DataInjection is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * DataInjection is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with DataInjection. If not, see <http://www.gnu.org/licenses/>.
+ * -------------------------------------------------------------------------
+ * @copyright Copyright (C) 2007-2023 by DataInjection plugin team.
+ * @license   GPLv2 https://www.gnu.org/licenses/gpl-2.0.html
+ * @link      https://github.com/pluginsGLPI/datainjection
+ * -------------------------------------------------------------------------
+ */
+
+global $CFG_GLPI, $PLUGIN_HOOKS;
+
+define('GLPI_ROOT', dirname(__DIR__, 3));
+define('GLPI_LOG_DIR', GLPI_ROOT . '/files/_logs');
+define('TU_USER', 'glpi');
+define('TU_PASS', 'glpi');
+define('GLPI_LOG_LVL', 'DEBUG');
+
+require GLPI_ROOT . '/inc/includes.php';
+
+include_once GLPI_ROOT . '/phpunit/GLPITestCase.php';
+include_once GLPI_ROOT . '/phpunit/DbTestCase.php';
+
+require_once __DIR__ . '/../setup.php';
+
+if (!Plugin::isPluginActive('datainjection')) {
+    throw new RuntimeException('Plugin datainjection is not active in the test database');
+}

tests/unit/ClientInjectionEscapeCsvFormulaTest.php

@@ -0,0 +1,69 @@
+<?php
+
+/**
+ * -------------------------------------------------------------------------
+ * DataInjection plugin for GLPI
+ * -------------------------------------------------------------------------
+ *
+ * LICENSE
+ *
+ * This file is part of DataInjection.
+ *
+ * DataInjection is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * DataInjection is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with DataInjection. If not, see <http://www.gnu.org/licenses/>.
+ * -------------------------------------------------------------------------
+ * @copyright Copyright (C) 2007-2023 by DataInjection plugin team.
+ * @license   GPLv2 https://www.gnu.org/licenses/gpl-2.0.html
+ * @link      https://github.com/pluginsGLPI/datainjection
+ * -------------------------------------------------------------------------
+ */
+
+require_once dirname(__DIR__, 2) . '/inc/clientinjection.class.php';
+
+/**
+ * Covers escapeCsvFormula(), which prefixes values starting with a CSV
+ * formula-injection trigger character with a single quote before they are
+ * written out by exportErrorsInCSV().
+ */
+class ClientInjectionEscapeCsvFormulaTest extends DbTestCase
+{
+    public function escapeCsvFormulaProvider(): array
+    {
+        return [
+            'empty string'           => ['', ''],
+            'equals trigger'         => ['=SUM(A1:A2)', "'=SUM(A1:A2)"],
+            'plus trigger'           => ['+1234', "'+1234"],
+            'minus trigger'          => ['-1234', "'-1234"],
+            'at trigger'             => ['@SUM(A1:A2)', "'@SUM(A1:A2)"],
+            'safe value passthrough' => ['normal value', 'normal value'],
+            'non-string passthrough' => [42, 42],
+        ];
+    }
+
+    /**
+     * @dataProvider escapeCsvFormulaProvider
+     */
+    public function testEscapeCsvFormula($value, $expected): void
+    {
+        $escape_csv_formula = new ReflectionMethod(
+            PluginDatainjectionClientInjection::class,
+            'escapeCsvFormula'
+        );
+        // Required on PHP < 8.1, where private members stay closed to reflection
+        if (PHP_VERSION_ID < 80100) {
+            $escape_csv_formula->setAccessible(true);
+        }
+
+        $this->assertSame($expected, $escape_csv_formula->invoke(null, $value));
+    }
+}