cconard96
commented
2 years ago This should be fixed by #12692
Closed Phorms closed 2 years ago
cconard96
commented
2 years ago This should be fixed by #12692
Phorms
commented
2 years ago Hi,
thanks for your quick response, but the fix does not fix the issue.
The SQL query gets shorter, but is missing any user filter.
SELECT glpi_savedsearches.*, glpi_savedsearches_users.id AS is_default FROM glpi_savedsearches
LEFT JOIN glpi_savedsearches_users ON (glpi_savedsearches_users.savedsearches_id = glpi_savedsearches.id)
WHERE glpi_savedsearches.itemtype = 'Ticket' ORDER BY itemtype, name+ self::getVisibilityCriteria(); could add the user filter, but Session::haveRight('config', UPDATE) skips that filter.
Maybe this is usefull for admins in the saved searches overview (/front/savedsearch.php), but not if you want to see only your own saved searches under "Lists".
Phorms
commented
2 years ago Removing
if (Session::haveRight('config', UPDATE)) { return $criteria; }
in src/SavedSearch.php under the function public static function getVisibilityCriteria(bool $forceall = false): array (line 1327 - 1332) solves my issue. Maybe with unpredictable side effects, but the lists now contains only my own and public saved searches.
Code of Conduct
Is there an existing issue for this?
Version
10.0.3
Bug description
Expected behavior: Only your own and all plublic saved searches of the current category (tickets, assets, ...) are visible.
Current behavior: All saved searches of the current category (tickets, assets, ...) are visible. The private / public option has no impact.
User permissions seems not to affect this behavior. I'm unaware of any settings that could affect the saved search. I disabled all plugins, no change.
The system was updated from version 9.5.4 where the filter worked correctly.
Adding a new saved search entry does not create a new entry in the database table "glpi_savedsearches_users". Only a entry in "glpi_savedsearches" is created.
All three entries are from different users and private.
But, I'm able to see them.
The SQL query received on our SQL server (no filter for 'is_private' field)
SELECT glpi_savedsearches.*, glpi_savedsearches_users.id AS is_default FROM glpi_savedsearches LEFT JOIN glpi_savedsearches_users ON (glpi_savedsearches_users.savedsearches_id = glpi_savedsearches.id AND glpi_savedsearches.itemtype = glpi_savedsearches_users.itemtype AND glpi_savedsearches_users.users_id = '9') WHERE (glpi_savedsearches.itemtype = 'Ticket') ORDER BY itemtype, nameHope that helps.
Relevant log output
Page URL
/front/ticket.php
Steps To reproduce
Your GLPI setup information
Information about system installation and configuration
Server
Operating system: Linux XXX 5.10.0-18-amd64 #1 SMP Debian 5.10.140-1 (2022-09-02) x86_64 PHP 8.1.9 apache2handler (Core, FFI, PDO, Phar, Reflection, SPL, SimpleXML, Zend OPcache, apache2handler, bcmath, bz2, calendar, ctype, curl, date, dom, exif, fileinfo, filter, ftp, gd, gettext, hash, iconv, intl, json, ldap, libxml, mbstring, mysqli, mysqlnd, openssl, pcre, pdo_mysql, posix, readline, session, shmop, sockets, sodium, standard, sysvmsg, sysvsem, sysvshm, tokenizer, xml, xmlreader, xmlrpc, xmlwriter, xsl, zip, zlib) Setup: max_execution_time="600" memory_limit="512M" post_max_size="80M" safe_mode="" session.save_handler="files" upload_max_filesize="80M" Software: Apache/2.4.54 (Debian) (Apache/2.4.54 (Debian) Server at XXX Port 443 ) Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Server Software: Debian 11 Server Version: 10.5.15-MariaDB-0+deb11u1-log Server SQL Mode: STRICT_TRANS_TABLES,ERROR_FOR_DIVISION_BY_ZERO,NO_AUTO_CREATE_USER,NO_ENGINE_SUBSTITUTION Parameters: XXX Host info: XXX via TCP/IP PHP version (8.1.9) is supported. Sessions configuration is OK. Allocated memory is sufficient. mysqli extension is installed. Following extensions are installed: dom, fileinfo, json, simplexml. curl extension is installed. gd extension is installed. intl extension is installed. libxml extension is installed. zlib extension is installed. The constant SODIUM_CRYPTO_AEAD_XCHACHA20POLY1305_IETF_NPUBBYTES is present. Database engine version (10.5.15) is supported. The log file has been created successfully. Write access to /var/www/glpi/files/_cache has been validated. Write access to /var/www/glpi/config has been validated. Write access to /var/www/glpi/files/_cron has been validated. Write access to /var/www/glpi/files has been validated. Write access to /var/www/glpi/files/_dumps has been validated. Write access to /var/www/glpi/files/_graphs has been validated. Write access to /var/www/glpi/files/_lock has been validated. Write access to /var/www/glpi/files/_pictures has been validated. Write access to /var/www/glpi/files/_plugins has been validated. Write access to /var/www/glpi/files/_rss has been validated. Write access to /var/www/glpi/files/_sessions has been validated. Write access to /var/www/glpi/files/_tmp has been validated. Write access to /var/www/glpi/files/_uploads has been validated. Web access to files directory is protected Sessions configuration is secured. exif extension is installed. ldap extension is installed. openssl extension is installed. zip extension is installed. bz2 extension is installed. Zend OPcache extension is installed. Following extensions are installed: ctype, iconv, mbstring, sodium. Write access to /var/www/glpi/marketplace has been validated. Access to timezone database (mysql) is not allowed.GLPI constants
Libraries
SQL replicas
Plugins list
I disabled all plugins. The problem did not change.order Name: Bestellverwaltung Version: 2.9.0 State: Enabled Install Method: Manual datainjection Name: Data injection Version: 2.12.0 State: Enabled Install Method: Manual formcreator Name: Form Creator Version: 2.13.0 State: Enabled Install Method: Manual fpsoftware Name: FP Software Version: 2.0.0 State: Enabled Install Method: Manual fusioninventory Name: FusionInventory Version: 10.0.1+1.0 State: Enabled Install Method: Manual accounts Name: Konten Version: 3.0.2 State: Enabled Install Method: Manual mreporting Name: More Reporting Version: 1.8.1 State: Enabled Install Method: Manual pdf Name: PDF-Ausgabe Version: 2.1.0 State: Enabled Install Method: Manual stab Name: Split Timeline Action Buttons Version: 1.0.2 State: Enabled Install Method: Manual manufacturersimports Name: Suppliers imports Version: 3.0.2 State: Enabled Install Method: Manual behaviors Name: Verhalten Version: 2.7.1 State: Enabled Install Method: ManualAnything else?
No response