Fix: validate item type and rights in lifecycle actions

Author: Rom1-B

CHANGELOG.md

@@ -5,6 +5,12 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](http://keepachangelog.com/)
 and this project adheres to [Semantic Versioning](http://semver.org/).
 
+## [Unreleased]
+
+### Fixed
+
+- Fix uninstall/replace actions processing items without checking item type or user rights on the item
+
 ## [2.10.4] - 2026-08-04
 
 ### Fixed

ajax/locations.php

@@ -38,7 +38,7 @@
     && $_POST['templates_id']
 ) {
     $location = PluginUninstallPreference::getLocationByUserByEntity(
-        $_POST["users_id"],
+        Session::getLoginUserID(),
         $_POST["templates_id"],
         $_POST["entity"],
     );

front/action.php

@@ -40,6 +40,12 @@
     Html::back();
 }
 
+/** @var array $UNINSTALL_TYPES */
+global $UNINSTALL_TYPES;
+if (!in_array($_REQUEST["device_type"], $UNINSTALL_TYPES, true)) {
+    Html::back();
+}
+
 if (isset($_REQUEST["locations_id"])) {
     $location = $_REQUEST["locations_id"];
 } else {
@@ -51,6 +57,7 @@
 }
 
 if (isset($_REQUEST["replace"])) {
+    Session::checkRight(PluginUninstallUninstall::$rightname, PluginUninstallProfile::RIGHT_REPLACE);
     PluginUninstallReplace::replace(
         $_REQUEST["device_type"],
         $_REQUEST["model_id"],

inc/model.class.php

@@ -279,7 +279,7 @@ public function showForm($ID, $options = [])
         echo "</td>";
         echo "<td rowspan='4'>" . __s('Comments') . "</td>";
         echo "<td rowspan='4'>";
-        echo "<textarea cols='60' rows='4' name='comment'>" . $this->fields["comment"] . "</textarea>";
+        echo "<textarea cols='60' rows='4' name='comment'>" . htmlentities((string) $this->fields["comment"]) . "</textarea>";
         echo "</td></tr>";
 
         echo "<tr class='tab_bg_1'><td>" . __s('New status of the computer', 'uninstall') . "</td>";

inc/replace.class.php

@@ -114,10 +114,28 @@ public static function replace($type, $model_id, $tab_ids, $location)
             }
 
             $olditem = new $type();
-            $olditem->getFromDB($olditem_id);
+            if (!$olditem->getFromDB($olditem_id) || !$olditem->can($olditem_id, UPDATE)) {
+                continue;
+            }
 
             $newitem = new $type();
-            $newitem->getFromDB($newitem_id);
+            if (!$newitem->getFromDB($newitem_id) || !$newitem->can($newitem_id, UPDATE)) {
+                continue;
+            }
+
+            if (
+                $model->fields['replace_method'] == self::METHOD_PURGE
+                && !$olditem->can($olditem_id, PURGE)
+            ) {
+                continue;
+            }
+
+            if (
+                $model->fields['replace_method'] == self::METHOD_DELETE_AND_COMMENT
+                && !$olditem->can($olditem_id, DELETE)
+            ) {
+                continue;
+            }
 
             //Hook to perform actions before item is being replaced
             $olditem->fields['_newid'] = $newitem_id;
@@ -839,11 +857,11 @@ public static function showReplacementForm($type, $model_id, $tab_ids, $location
                 echo "<td>" . $commonitem->getName() . "</td>";
 
                 if (Search::getOptionNumber($type, 'otherserial')) {
-                    echo "<td>" . $commonitem->fields['otherserial'] . "</td>";
+                    echo "<td>" . htmlentities((string) $commonitem->fields['otherserial']) . "</td>";
                 }
 
                 if (Search::getOptionNumber($type, 'serial')) {
-                    echo "<td>" . $commonitem->fields['serial'] . "</td>";
+                    echo "<td>" . htmlentities((string) $commonitem->fields['serial']) . "</td>";
                 }
 
                 echo "<td>";

inc/uninstall.class.php

@@ -117,10 +117,12 @@ public static function processMassiveActionsForOneItemtype(MassiveAction $ma, Co
         if ($ma->getAction() === "uninstall") {
             $itemtype = $ma->getItemtype(false);
             foreach ($ids as $id) {
-                if ($item->getFromDB($id)) {
+                if ($item->getFromDB($id) && $item->can($id, UPDATE)) {
                     //Session::addMessageAfterRedirect(sprintf(__s('Form duplicated: %s', 'formcreator'), $item->getName()));
                     $_SESSION['glpi_uninstalllist'][$itemtype][$id] = $id;
                     $ma->itemDone($item->getType(), $id, MassiveAction::ACTION_OK);
+                } else {
+                    $ma->itemDone($item->getType(), $id, MassiveAction::ACTION_NORIGHT);
                 }
             }
 
@@ -373,7 +375,9 @@ public static function uninstall($type, $model_id, $tab_ids, $location)
             $count++;
             if (class_exists($type) && is_a($type, CommonDBTM::class, true)) {
                 $item = new $type();
-                $item->getFromDB($id);
+                if (!$item->getFromDB($id) || !$item->can($id, UPDATE)) {
+                    continue;
+                }
 
                 self::doOneUninstall($model, $transfer, $item, [
                     'type' => $type,
@@ -476,6 +480,7 @@ public static function deleteComputerInOCS($ocs_id, $ocs_server_id)
         global $DB;
         if (class_exists('PluginOcsinventoryngOcsServer')) {
             $DBocs = PluginOcsinventoryngOcsServer::getDBocs($ocs_server_id)->getDB();
+            $ocs_id = (int) $ocs_id;
 
             //First try to remove all the network ports
             $query = "DELETE