";
echo "| " . __('Warning: If there are more than one plugin which be loaded at startup, then only the first will be used', 'treeview');
diff --git a/index.php b/index.php
index bc45949..3fb3307 100644
--- a/index.php
+++ b/index.php
@@ -30,6 +30,12 @@
include('../../inc/includes.php');
+Session::checkLoginUser();
+
+if (empty($_SESSION['glpi_plugin_treeview_profile']['treeview'])) {
+ Html::displayRightError();
+}
+
Plugin::load('treeview', true);
$_SESSION['glpi_plugin_treeview_loaded'] = 1;
diff --git a/left.php b/left.php
index 013f9ca..3afa579 100644
--- a/left.php
+++ b/left.php
@@ -32,6 +32,10 @@
Session::checkLoginUser();
+if (empty($_SESSION['glpi_plugin_treeview_profile']['treeview'])) {
+ Html::displayRightError();
+}
+
$treeview_url = Plugin::getWebDir('treeview');
Html::includeHeader('TreeView');
diff --git a/phpunit.xml b/phpunit.xml
new file mode 100644
index 0000000..3023d8c
--- /dev/null
+++ b/phpunit.xml
@@ -0,0 +1,7 @@
+
+
+
+ tests
+
+
+
diff --git a/tests/TreeviewTestCase.php b/tests/TreeviewTestCase.php
new file mode 100644
index 0000000..5e58be4
--- /dev/null
+++ b/tests/TreeviewTestCase.php
@@ -0,0 +1,69 @@
+.
+ * -------------------------------------------------------------------------
+ * @copyright Copyright (C) 2007-2023 by Teclib'.
+ * @license GPLv2 https://www.gnu.org/licenses/gpl-2.0.html
+ * @link https://github.com/pluginsGLPI/treeview
+ * -------------------------------------------------------------------------
+ */
+
+namespace GlpiPlugin\Treeview\Tests;
+
+use DbTestCase;
+use PluginTreeviewConfig;
+
+abstract class TreeviewTestCase extends DbTestCase
+{
+ /**
+ * Capture the JavaScript tree markup generated by
+ * PluginTreeviewConfig::getNodesFromDb() for the current session
+ * (active entity, current user rights).
+ *
+ * @param int|null $opened_locations_id A top-level location id to expand,
+ * so its items get loaded too (the
+ * tree only loads items for nodes
+ * present in the "nodes" path, same
+ * as a client expanding a node).
+ */
+ protected function getTreeOutput(?int $opened_locations_id = null): string
+ {
+ $previous_nodes = $_GET['nodes'] ?? null;
+ if ($opened_locations_id !== null) {
+ $_GET['nodes'] = $opened_locations_id . '.0';
+ }
+
+ $config = new PluginTreeviewConfig();
+ ob_start();
+ $config->getNodesFromDb();
+ $output = ob_get_clean();
+
+ if ($previous_nodes === null) {
+ unset($_GET['nodes']);
+ } else {
+ $_GET['nodes'] = $previous_nodes;
+ }
+
+ return $output;
+ }
+}
diff --git a/tests/Units/ConfigTest.php b/tests/Units/ConfigTest.php
new file mode 100644
index 0000000..8168e1b
--- /dev/null
+++ b/tests/Units/ConfigTest.php
@@ -0,0 +1,120 @@
+.
+ * -------------------------------------------------------------------------
+ * @copyright Copyright (C) 2007-2023 by Teclib'.
+ * @license GPLv2 https://www.gnu.org/licenses/gpl-2.0.html
+ * @link https://github.com/pluginsGLPI/treeview
+ * -------------------------------------------------------------------------
+ */
+
+namespace GlpiPlugin\Treeview\Tests\Units;
+
+use Computer;
+use Entity;
+use GlpiPlugin\Treeview\Tests\TreeviewTestCase;
+use Location;
+use Profile;
+use ProfileRight;
+
+final class ConfigTest extends TreeviewTestCase
+{
+ public function testGetNodesFromDbOnlyShowsActiveEntityData(): void
+ {
+ $this->login();
+ $root_id = $this->getTestRootEntity(true);
+
+ $entity_a = $this->createItem(Entity::class, [
+ 'name' => 'treeview_entity_a_' . $this->getUniqueString(),
+ 'entities_id' => $root_id,
+ ]);
+ $entity_b = $this->createItem(Entity::class, [
+ 'name' => 'treeview_entity_b_' . $this->getUniqueString(),
+ 'entities_id' => $root_id,
+ ]);
+
+ $location_a = $this->createItem(Location::class, [
+ 'name' => 'treeview_loc_a_' . $this->getUniqueString(),
+ 'entities_id' => $entity_a->getID(),
+ ]);
+ $location_b = $this->createItem(Location::class, [
+ 'name' => 'treeview_loc_b_' . $this->getUniqueString(),
+ 'entities_id' => $entity_b->getID(),
+ ]);
+
+ $computer_a = $this->createItem(Computer::class, [
+ 'name' => 'treeview_computer_a_' . $this->getUniqueString(),
+ 'entities_id' => $entity_a->getID(),
+ 'locations_id' => $location_a->getID(),
+ ]);
+ $computer_b = $this->createItem(Computer::class, [
+ 'name' => 'treeview_computer_b_' . $this->getUniqueString(),
+ 'entities_id' => $entity_b->getID(),
+ 'locations_id' => $location_b->getID(),
+ ]);
+
+ // Switch active entity A only (not recursive).
+ $this->setEntity($entity_a->getID(), false);
+
+ $output = $this->getTreeOutput($location_a->getID());
+
+ $this->assertStringContainsString($computer_a->fields['name'], $output);
+ $this->assertStringNotContainsString($computer_b->fields['name'], $output);
+ $this->assertStringNotContainsString($location_b->fields['name'], $output);
+ }
+
+ public function testGetNodesFromDbHidesItemtypeWithoutViewRight(): void
+ {
+ $this->login();
+ $entity_id = $this->getTestRootEntity(true);
+
+ $location = $this->createItem(Location::class, [
+ 'name' => 'treeview_loc_' . $this->getUniqueString(),
+ 'entities_id' => $entity_id,
+ ]);
+ $computer = $this->createItem(Computer::class, [
+ 'name' => 'treeview_computer_' . $this->getUniqueString(),
+ 'entities_id' => $entity_id,
+ 'locations_id' => $location->getID(),
+ ]);
+
+ $super_admin_id = getItemByTypeName(Profile::class, 'Super-Admin', true);
+ $original_rights = ProfileRight::getProfileRights($super_admin_id, [Computer::$rightname]);
+
+ // remove all rights to view computers
+ ProfileRight::updateProfileRights($super_admin_id, [
+ Computer::$rightname => $original_rights[Computer::$rightname] & ~(READ),
+ ]);
+ try {
+ $this->login('glpi');
+ $this->setEntity($entity_id, false);
+ $output = $this->getTreeOutput($location->getID());
+
+ $this->assertStringNotContainsString($computer->fields['name'], $output);
+ } finally {
+ ProfileRight::updateProfileRights($super_admin_id, [
+ Computer::$rightname => $original_rights[Computer::$rightname],
+ ]);
+ }
+ }
+}
diff --git a/tests/Units/PreferenceTest.php b/tests/Units/PreferenceTest.php
new file mode 100644
index 0000000..371fc7d
--- /dev/null
+++ b/tests/Units/PreferenceTest.php
@@ -0,0 +1,82 @@
+.
+ * -------------------------------------------------------------------------
+ * @copyright Copyright (C) 2007-2023 by Teclib'.
+ * @license GPLv2 https://www.gnu.org/licenses/gpl-2.0.html
+ * @link https://github.com/pluginsGLPI/treeview
+ * -------------------------------------------------------------------------
+ */
+
+namespace GlpiPlugin\Treeview\Tests\Units;
+
+use GlpiPlugin\Treeview\Tests\TreeviewTestCase;
+use PluginTreeviewPreference;
+use Session;
+
+final class PreferenceTest extends TreeviewTestCase
+{
+ public function testCheckIfPreferenceExistsIsScopedToOwner(): void
+ {
+ $this->login();
+ $user_a_id = (int) Session::getLoginUserID();
+ $pref_a = new PluginTreeviewPreference();
+ $pref_a_id = $pref_a->addDefaultPreference($user_a_id);
+
+ $this->login('normal', 'normal');
+ $user_b_id = (int) Session::getLoginUserID();
+ $pref_b = new PluginTreeviewPreference();
+ $pref_b_id = $pref_b->addDefaultPreference($user_b_id);
+
+ $this->assertNotEquals($pref_a_id, $pref_b_id);
+
+ // Even if an attacker-controlled value referenced user A's record,
+ // resolving "own_id" must always come back to the logged-in user.
+ $own_id = $pref_b->checkIfPreferenceExists($user_b_id);
+ $this->assertEquals($pref_b_id, $own_id);
+ $this->assertNotEquals($pref_a_id, $own_id);
+ }
+
+ public function testUpdateScopedToOwnPreferenceDoesNotAffectOtherUser(): void
+ {
+ $this->login();
+ $pref_a = new PluginTreeviewPreference();
+ $pref_a_id = $pref_a->addDefaultPreference((int) Session::getLoginUserID());
+
+ $this->login('normal', 'normal');
+ $pref_b = new PluginTreeviewPreference();
+ $pref_b_id = $pref_b->addDefaultPreference((int) Session::getLoginUserID());
+
+ // Reproduces the fixed front/preference.form.php flow: the id used
+ // for the update is resolved server-side from the session user,
+ // never taken from client-supplied data.
+ $own_id = $pref_b->checkIfPreferenceExists(Session::getLoginUserID());
+ $this->assertTrue($pref_b->update(['id' => $own_id, 'show_on_load' => 1]));
+
+ $this->assertTrue($pref_a->getFromDB($pref_a_id));
+ $this->assertEquals(0, $pref_a->fields['show_on_load']);
+
+ $this->assertTrue($pref_b->getFromDB($pref_b_id));
+ $this->assertEquals(1, $pref_b->fields['show_on_load']);
+ }
+}
diff --git a/tests/bootstrap.php b/tests/bootstrap.php
new file mode 100644
index 0000000..00b6650
--- /dev/null
+++ b/tests/bootstrap.php
@@ -0,0 +1,58 @@
+.
+ * -------------------------------------------------------------------------
+ * @copyright Copyright (C) 2007-2023 by Teclib'.
+ * @license GPLv2 https://www.gnu.org/licenses/gpl-2.0.html
+ * @link https://github.com/pluginsGLPI/treeview
+ * -------------------------------------------------------------------------
+ */
+
+global $CFG_GLPI, $PLUGIN_HOOKS;
+
+define('GLPI_ROOT', __DIR__ . '/../../../');
+define('GLPI_LOG_DIR', __DIR__ . '/files/_logs');
+
+define('TU_USER', 'glpi');
+define('TU_PASS', 'glpi');
+define('GLPI_LOG_LVL', 'DEBUG');
+
+require GLPI_ROOT . '/inc/includes.php';
+include_once GLPI_ROOT . '/phpunit/GLPITestCase.php';
+include_once GLPI_ROOT . '/phpunit/DbTestCase.php';
+require_once __DIR__ . '/../vendor/autoload.php';
+require_once __DIR__ . '/../setup.php';
+
+if (!Plugin::isPluginActive("treeview")) {
+ throw new RuntimeException("Plugin treeview is not active in the test database");
+}
+
+if (!file_exists(GLPI_LOG_DIR . '/php-errors.log')) {
+ file_put_contents(GLPI_LOG_DIR . '/php-errors.log', '');
+}
+
+if (!file_exists(GLPI_LOG_DIR . '/sql-errors.log')) {
+ file_put_contents(GLPI_LOG_DIR . '/sql-errors.log', '');
+}
+
+plugin_init_treeview();
|