glpi-project / glpi

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing.
https://glpi-project.org
GNU General Public License v3.0
4.36k stars 1.3k forks source link

Data recorded in savesearch with special caracter a replaced with space #10009

Closed smounier-cgo closed 2 years ago

smounier-cgo commented 2 years ago

Code of Conduct

Is there an existing issue for this?

Version

9.5.5 and dont find any issue or correction in 9.5.6

Bug description

When I use the star to save search.

The field query in table glpi_savedsearches does not has correctly special caracters like + written When I see and extract SQL data

I saw that the string I wrote NOTEPAD++(32 The caracters ++ that should be wrote on criteria with there 16bits code &2B is replace by the space caracter &20 (see the my exemple in bold)

If I change the data directly on the database writing &2B The filter can be use correctly.

If I let the &20 the caracter restored in filter take the space value and the filter does not work

Example "front/computer.php", "criteria%5B0%5D%5Blink%5D=AND& criteria%5B0%5D%5 Bcriteria%5D%5B0%5D%5Blink%5D=AND& criteria%5B0%5D%5B criteria%5D%5B0%5D%5Bfield%5D=view& criteria%5B0%5D%5B criteria%5D%5B0%5D%5Bsearchtype%5D=contains& criteria%5B0%5D%5B criteria%5D%5B0%5D%5Bvalue%5D=& criteria%5B0%5D%5B criteria%5D%5B1%5D%5Blink%5D=AND& criteria%5B0%5D%5B criteria%5D%5B1%5D%5Bitemtype%5D=Software& criteria%5B0%5D%5B criteria%5D%5B1%5D%5Bmeta%5D=1& criteria%5B0%5D%5B criteria%5D%5B1%5D%5Bfield%5D=1& criteria%5B0%5D%5B criteria%5D%5B1%5D%5Bsearchtype%5D=contains& criteria%5B0%5D%5B

KO criteria%5D%5B1%5D%5Bvalue%5D=Notepad%20%20%20%2832&

OK criteria%5D%5B1%5D%5Bvalue%5D=Notepad%2B%2B%20%2832&

criteria%5B0%5D%5B criteria%5D%5B2%5D%5Blink%5D=AND& criteria%5B0%5D%5B criteria%5D%5B2%5D%5Bitemtype%5D=Software& criteria%5B0%5D%5B criteria%5D%5B2%5D%5Bmeta%5D=1& criteria%5B0%5D%5B criteria%5D%5B2%5D%5Bfield%5D=5& criteria%5B0%5D%5B criteria%5D%5B2%5D%5Bsearchtype%5D=contains& criteria%5B0%5D%5B

Relevant log output

No response

Page URL

No response

Steps To reproduce

On Computers Make a filter with AND SOFTWARE NAME contains NOTEPAD++ (32) and use the star to save it

Your GLPI setup information

[code]   GLPI 9.5.5 ( => /var/www/html/glpi) Installation mode: TARBALL -- Operating system: Linux SVPL01-CDS-01 4.19.0-16-amd64 #1 SMP Debian 4.19.181-1 (2021-03-19) x86_64 PHP 7.3.31-1~deb10u1 apache2handler (Core, PDO, Phar, Reflection, SPL, SimpleXML, Zend OPcache, apache2handler, apc, apcu, bz2, calendar, ctype, curl, date, dom, exif, fileinfo, filter, ftp, gd, gettext, hash, iconv, imap, intl, json, ldap, libxml, mbstring, mysqli, mysqlnd, openssl, pcre, pdo_mysql, posix, readline, session, shmop, sockets, sodium, standard, sysvmsg, sysvsem, sysvshm, tokenizer, wddx, xml, xmlreader, xmlrpc, xmlwriter, xsl, zip, zlib) Setup: max_execution_time="30" memory_limit="1500M" post_max_size="8M" safe_mode="" session.save_handler="files" upload_max_filesize="10M" Software: Apache () Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Server Software: Debian 10 Server Version: 10.3.29-MariaDB-0+deb10u1 Server SQL Mode: Parameters: admindb_glpi@10.100.50.18/db_glpi Host info: 10.100.50.18 via TCP/IP PHP version is at least 7.2.0 - Perfect! Sessions support is available - Perfect! Allocated memory > 64 Mio - Perfect! mysqli extension is installed ctype extension is installed fileinfo extension is installed json extension is installed mbstring extension is installed iconv extension is installed zlib extension is installed curl extension is installed gd extension is installed simplexml extension is installed intl extension is installed ldap extension is installed apcu extension is installed Zend OPcache extension is installed xmlrpc extension is installed CAS extension is installed exif extension is installed zip extension is installed bz2 extension is installed sodium extension is installed Database version seems correct (10.3.29) - Perfect! Access to timezone database (mysql) is not allowed. The log file has been created successfully. Write access to /var/www/html/glpi/files/_cache has been validated. Write access to /var/www/html/glpi/config has been validated. Write access to /var/www/html/glpi/files/_cron has been validated. Write access to /var/www/html/glpi/files has been validated. Write access to /var/www/html/glpi/files/_dumps has been validated. Write access to /var/www/html/glpi/files/_graphs has been validated. Write access to /var/www/html/glpi/files/_lock has been validated. Write access to /var/www/html/glpi/files/_pictures has been validated. Write access to /var/www/html/glpi/files/_plugins has been validated. Write access to /var/www/html/glpi/files/_rss has been validated. Write access to /var/www/html/glpi/files/_sessions has been validated. Write access to /var/www/html/glpi/files/_tmp has been validated. Write access to /var/www/html/glpi/files/_uploads has been validated. Write access to /var/www/html/glpi/marketplace has been validated. Web access to files directory is protected GLPI_ROOT: /var/www/html/glpi GLPI_CONFIG_DIR: /var/www/html/glpi/config GLPI_VAR_DIR: /var/www/html/glpi/files GLPI_MARKETPLACE_DIR: /var/www/html/glpi/marketplace GLPI_USE_CSRF_CHECK: 1 GLPI_CSRF_EXPIRES: 7200 GLPI_CSRF_MAX_TOKENS: 100 GLPI_USE_IDOR_CHECK: 1 GLPI_IDOR_EXPIRES: 7200 GLPI_ALLOW_IFRAME_IN_RICH_TEXT: GLPI_TELEMETRY_URI: https://telemetry.glpi-project.org GLPI_INSTALL_MODE: TARBALL GLPI_NETWORK_MAIL: glpi@teclib.com GLPI_NETWORK_SERVICES: https://services.glpi-network.com GLPI_MARKETPLACE_PRERELEASES: GLPI_MARKETPLACE_ALLOW_OVERRIDE: 1 GLPI_MARKETPLACE_MANUAL_DOWNLOADS: 1 GLPI_USER_AGENT_EXTRA_COMMENTS: GLPI_AJAX_DASHBOARD: 1 GLPI_CALDAV_IMPORT_STATE: 0 GLPI_DEMO_MODE: 0 GLPI_FORCE_EMPTY_SQL_MODE: 1 GLPI_DOC_DIR: /var/www/html/glpi/files GLPI_CACHE_DIR: /var/www/html/glpi/files/_cache GLPI_CRON_DIR: /var/www/html/glpi/files/_cron GLPI_DUMP_DIR: /var/www/html/glpi/files/_dumps GLPI_GRAPH_DIR: /var/www/html/glpi/files/_graphs GLPI_LOCAL_I18N_DIR: /var/www/html/glpi/files/_locales GLPI_LOCK_DIR: /var/www/html/glpi/files/_lock GLPI_LOG_DIR: /var/www/html/glpi/files/_log GLPI_PICTURE_DIR: /var/www/html/glpi/files/_pictures GLPI_PLUGIN_DOC_DIR: /var/www/html/glpi/files/_plugins GLPI_RSS_DIR: /var/www/html/glpi/files/_rss GLPI_SESSION_DIR: /var/www/html/glpi/files/_sessions GLPI_TMP_DIR: /var/www/html/glpi/files/_tmp GLPI_UPLOAD_DIR: /var/www/html/glpi/files/_uploads GLPI_NETWORK_REGISTRATION_API_URL: https://services.glpi-network.com/api/registration/ GLPI_MARKETPLACE_PLUGINS_API_URI: https://services.glpi-network.com/api/glpi-plugins/ GLPI_I18N_DIR: /var/www/html/glpi/locales GLPI_VERSION: 9.5.5 GLPI_SCHEMA_VERSION: 9.5.5 GLPI_MIN_PHP: 7.2.0 GLPI_YEAR: 2021 htmlawed/htmlawed version 1.2.5 in (/var/www/html/glpi/vendor/htmlawed/htmlawed) phpmailer/phpmailer version 6.1.6 in (/var/www/html/glpi/vendor/phpmailer/phpmailer/src) simplepie/simplepie version 1.5.6 in (/var/www/html/glpi/vendor/simplepie/simplepie/library) tecnickcom/tcpdf version 6.3.5 in (/var/www/html/glpi/vendor/tecnickcom/tcpdf) michelf/php-markdown in (/var/www/html/glpi/vendor/michelf/php-markdown/Michelf) true/punycode in (/var/www/html/glpi/vendor/true/punycode/src) iamcal/lib_autolink in (/var/www/html/glpi/vendor/iamcal/lib_autolink) sabre/dav in (/var/www/html/glpi/vendor/sabre/dav/lib/DAV) sabre/http in (/var/www/html/glpi/vendor/sabre/http/lib) sabre/uri in (/var/www/html/glpi/vendor/sabre/uri/lib) sabre/vobject in (/var/www/html/glpi/vendor/sabre/vobject/lib) laminas/laminas-cache in (/var/www/html/glpi/vendor/laminas/laminas-cache/src) laminas/laminas-i18n in (/var/www/html/glpi/vendor/laminas/laminas-i18n/src) laminas/laminas-serializer in (/var/www/html/glpi/vendor/laminas/laminas-serializer/src) monolog/monolog in (/var/www/html/glpi/vendor/monolog/monolog/src/Monolog) sebastian/diff in (/var/www/html/glpi/vendor/sebastian/diff/src) elvanto/litemoji in (/var/www/html/glpi/vendor/elvanto/litemoji/src) symfony/console in (/var/www/html/glpi/vendor/symfony/console) scssphp/scssphp in (/var/www/html/glpi/vendor/scssphp/scssphp/src) laminas/laminas-mail in (/var/www/html/glpi/vendor/laminas/laminas-mail/src/Protocol) laminas/laminas-mime in (/var/www/html/glpi/vendor/laminas/laminas-mime/src) rlanvin/php-rrule in (/var/www/html/glpi/vendor/rlanvin/php-rrule/src) blueimp/jquery-file-upload in (/var/www/html/glpi/vendor/blueimp/jquery-file-upload/server/php) ramsey/uuid in (/var/www/html/glpi/vendor/ramsey/uuid/src) psr/log in (/var/www/html/glpi/vendor/psr/log/Psr/Log) psr/simple-cache in (/var/www/html/glpi/vendor/psr/simple-cache/src) mexitek/phpcolors in (/var/www/html/glpi/vendor/mexitek/phpcolors/src/Mexitek/PHPColors) guzzlehttp/guzzle in (/var/www/html/glpi/vendor/guzzlehttp/guzzle/src) guzzlehttp/psr7 in (/var/www/html/glpi/vendor/guzzlehttp/psr7/src) wapmorgan/unified-archive in (/var/www/html/glpi/vendor/wapmorgan/unified-archive/src) paragonie/sodium_compat in (/var/www/html/glpi/vendor/paragonie/sodium_compat/src) phpCas version 1.3.6 in (/usr/share/php/CAS/source) Server: 'svpw01-dc-03.cgo.local', Port: '389', BaseDN: 'OU=CGO,DC=cgo,DC=local', Connection filter: '(&(objectClass=user)(objectCategory=person)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))', RootDN: 'adm.infra', Use TLS: none Not active Way of sending emails: SMTP+TLS (cds@cgo.local@arobase.cgo.local)   news Name: Alertes Version: 1.9.0 State: Enabled treeview Name: Arborescence Version: 1.9.1 State: Enabled fields Name: Champs supplémentaires Version: 1.12.8 State: Enabled behaviors Name: Comportements Version: 2.5.0 State: Enabled datainjection Name: Data Injection Version: 2.9.0 State: Enabled useditemsexport Name: Export des éléments utilisés Version: 2.4.0 State: Enabled fusioninventory Name: FusionInventory Version: 9.5+3.0 State: Enabled tag Name: Gestion des tags Version: 2.8.1 State: Not installed typology Name: Typologies Version: 2.7.2 State: Not installed [/code]

Anything else?

No response

github-actions[bot] commented 2 years ago

There has been no activity on this issue for some time and therefore it is considered stale and will be closed automatically in 10 days.

If this issue is related to a bug, please try to reproduce on latest release. If the problem persist, feel free to add a comment to revive this issue. If it is related to a new feature, please open a topic to discuss with community about this enhancement on suggestion website.

You may also consider taking a subscription to get professionnal support or contact GLPI editor team directly.

smounier-cgo commented 2 years ago

I ask testing on new version 9.5.6 and 10 on Telegram users groups

cconard96 commented 2 years ago

Fixed by #10515 for GLPI 10. Something would have to be done for 9.5.X though still.

cedric-anne commented 2 years ago

@smounier-cgo

Can you confirm that #10755 fixes your issue ?

Regards