Fix escaping handling in formatUserName() and getUserName()

glpi-project · Sep 18, 2024 · 5c839ef · 5c839ef
1 parent 38bf81c
commit 5c839ef
Show file tree

Hide file tree

Showing 21 changed files with 381 additions and 326 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -219,6 +219,8 @@ The present file will list all changes made to the project; according to the
 - `js/Forms/FaIconSelector.js` and therefore `window.GLPI.Forms.FaIconSelector` has been deprecated and replaced by `js/modules/Form/WebIconSelector.js`
 - `linkuser_types`, `linkgroup_types`, `linkuser_tech_types`, `linkgroup_tech_types` configuration entries have been merged in a unique `assignable_types` configuration entry.
 - Usage of the `front/dropdown.common.php` and the `dropdown.common.form.php` files. There is now a generic controller that will serve the search and form pages of any `Dropdown` class.
+- Usage of the `$link` parameter in `formatUserName()` and `DbUtils::formatUserName()`. Use `formatUserLink()` or `DbUtils::formatUserLink()` instead.
+- Usage of the `$link` parameter in `getUserName()` and `DbUtils::getUserName()`. Use `getUserLink()`, `DbUtils::getUserLink()`, or `User::getInfoCard()` instead.
 - `Auth::getErr()`
 - `AuthLDAP::dropdownUserDeletedActions()`
 - `AuthLDAP::getOptions()`
@@ -311,6 +313,7 @@ The present file will list all changes made to the project; according to the
 - `CommonGLPI::showDislayOptions()`
 - `CommonITILActor::showUserNotificationForm()`
 - `CommonITILActor::showSupplierNotificationForm()`
+- `CommonITILObject::getAssignName()`
 - `CommonITILValidation::alreadyExists()`
 - `CommonITILValidation::getTicketStatusNumber()`
 - `CommonTreeDropdown::sanitizeSeparatorInCompletename()`
@@ -496,6 +499,7 @@ The present file will list all changes made to the project; according to the
 - `ajax/planningcheck.php` script. Use `Planning::showPlanningCheck()` instead.
 - `test_ldap` and `test_ldap_replicate` actions in `front/authldap.form.php`. Use `ajax/ldap.php` instead.
 - `ajax/ticketsatisfaction.php` and `ajax/changesatisfaction.php` scripts. Access `ajax/commonitilsatisfaction.php` directly instead.
+- Usage of the `$cut` parameter in `formatUserName()` and `DbUtils::formatUserName()`.
 
 
 ## [10.0.17] unreleased

diff --git a/ajax/comments.php b/ajax/comments.php
@@ -60,36 +60,32 @@
 
     switch ($_POST["itemtype"]) {
         case User::getType():
+            $link = null;
+            $comments = [];
             if ($_POST['value'] == 0) {
-                $tmpname = [
-                    'link'    => $CFG_GLPI['root_doc'] . "/front/user.php",
-                    'comment' => "",
-                ];
+                $link = $CFG_GLPI['root_doc'] . "/front/user.php";
             } else {
                 $user = new \User();
                 if (is_array($_POST["value"])) {
-                    $comments = [];
                     foreach ($_POST["value"] as $users_id) {
                         if ($user->getFromDB($users_id) && $user->canView()) {
-                            $username   = getUserName($users_id, 2);
-                            $comments[] = $username['comment'] ?? "";
+                            $comments[] = $user->getInfoCard();
                         }
                     }
-                    $tmpname = [
-                        'comment' => implode("<br>", $comments),
-                    ];
                     unset($_POST['withlink']);
                 } else {
                     if ($user->getFromDB($_POST['value']) && $user->canView()) {
-                        $tmpname = getUserName($_POST["value"], 2);
+                        $link = $user->getLinkURL();
+                        $comments[] = $user->getInfoCard();
                     }
                 }
             }
-            echo($tmpname["comment"] ?? '');
 
-            if (isset($_POST['withlink']) && isset($tmpname['link'])) {
+            echo(implode("<br>", $comments));
+
+            if (isset($_POST['withlink']) && $link !== null) {
                 echo "<script type='text/javascript' >\n";
-                echo Html::jsGetElementbyID($_POST['withlink']) . ".attr('href', '" . $tmpname['link'] . "');";
+                echo Html::jsGetElementbyID($_POST['withlink']) . ".attr('href', '" . htmlspecialchars($link) . "');";
                 echo "</script>\n";
             }
             break;

diff --git a/front/stat.graph.php b/front/stat.graph.php
@@ -88,25 +88,22 @@
         $val1    = $_GET["id"];
         $val2    = "";
         $values  = Stat::getItems($_GET["itemtype"], $_GET["date1"], $_GET["date2"], $_GET["type"]);
-        $link    = User::canView() ? 1 : 0;
-        $name    = $item->getAssignName($_GET["id"], 'User', $link);
         $title   = sprintf(
             __s('%1$s: %2$s'),
             __s('Technician'),
-            $link ? $name : htmlspecialchars($name)
+            getUserLink($_GET["id"])
         );
         break;
 
     case "suppliers_id_assign":
         $val1    = $_GET["id"];
         $val2    = "";
         $values  = Stat::getItems($_GET["itemtype"], $_GET["date1"], $_GET["date2"], $_GET["type"]);
-        $link    = Supplier::canView() ? 1 : 0;
-        $name    = $item->getAssignName($_GET["id"], 'Supplier', $link);
+        $supplier = Supplier::getById($_GET["id"]);
         $title   = sprintf(
             __s('%1$s: %2$s'),
             Supplier::getTypeName(1),
-            $link ? $name : htmlspecialchars($name)
+            $supplier !== false ? $supplier->getLink(['comments' => true]) : ''
         );
         break;
 
@@ -115,12 +112,10 @@
         $val1    = $_GET["id"];
         $val2    = "";
         $values  = Stat::getItems($_GET["itemtype"], $_GET["date1"], $_GET["date2"], $_GET["type"]);
-        $link    = User::canView() ? 1 : 0;
-        $name    = getUserName($_GET["id"], $link);
         $title   = sprintf(
             __s('%1$s: %2$s'),
             User::getTypeName(1),
-            $link ? $name : htmlspecialchars($name)
+            getUserLink($_GET["id"])
         );
         break;
 

diff --git a/src/Change.php b/src/Change.php
@@ -1224,9 +1224,8 @@ public static function showCentralList($start, $status = "process", $showgroupch
                         ) {
                             foreach ($change->users[CommonITILActor::REQUESTER] as $d) {
                                 if ($d["users_id"] > 0) {
-                                    $userdata = getUserName($d["users_id"], 2);
                                     $name = '<i class="fas fa-sm fa-fw fa-user text-muted me-1"></i>' .
-                                        $userdata['name'];
+                                        htmlspecialchars(getUserName($d["users_id"]));
                                     $requesters[] = $name;
                                 } else {
                                     $requesters[] = '<i class="fas fa-sm fa-fw fa-envelope text-muted me-1"></i>' .
@@ -1451,16 +1450,17 @@ public static function showVeryShort($ID, $forcetab = '')
                 && count($change->users[CommonITILActor::REQUESTER])
             ) {
                 foreach ($change->users[CommonITILActor::REQUESTER] as $d) {
-                    if ($d["users_id"] > 0) {
-                         $userdata = getUserName($d["users_id"], 2);
-                         $name     = "<span class='b'>" . $userdata['name'] . "</span>";
+                    $user = new User();
+                    if ($d["users_id"] > 0 && $user->getFromDB($d["users_id"])) {
+                        $name     = "<span class='b'>" . htmlspecialchars($user->getName()) . "</span>";
                         if ($viewusers) {
                             $name = sprintf(
-                                __('%1$s %2$s'),
+                                __s('%1$s %2$s'),
                                 $name,
                                 Html::showToolTip(
-                                    $userdata["comment"],
-                                    ['link'    => $userdata["link"],
+                                    $user->getInfoCard(),
+                                    [
+                                        'link'    => $user->getLinkURL(),
                                         'display' => false
                                     ]
                                 )

diff --git a/src/CommonDBTM.php b/src/CommonDBTM.php
@@ -4911,11 +4911,14 @@ public function getValueToDisplay($field_id_or_search_options, $values, $options
                             return $searchoptions['emptylabel'];
                         }
 
+                        $user = new User();
                         if ($searchoptions['table'] == 'glpi_users') {
+                            if (!$user->getFromDB($value)) {
+                                return '';
+                            }
                             if ($param['comments']) {
-                                $tmp = getUserName($value, 2);
-                                return $tmp['name'] . '&nbsp;' . Html::showToolTip(
-                                    $tmp['comment'],
+                                return $user->getLink() . '&nbsp;' . Html::showToolTip(
+                                    $user->getInfoCard(),
                                     ['display' => false]
                                 );
                             }