Fix(Core): use item-scoped access check on escalation routes (#490)

CHANGELOG.md

@@ -5,6 +5,12 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](http://keepachangelog.com/)
 and this project adheres to [Semantic Versioning](http://semver.org/).
 
+## [Unreleased]
+
+### Fixed
+
+- Use item-scoped access check on escalation routes
+
 ## [2.9.20] - 2026-06-24
 
 - Fix escape chars

front/climb_group.php

@@ -46,7 +46,7 @@
 $ticket = new Ticket();
 $ticket->getFromDB((int) $_REQUEST['tickets_id']);
 
-if (!$ticket->canAssign()) {
+if (!$ticket->canAssign() || !$ticket->checkEntity(true)) {
     Html::displayRightError();
 }
 

front/ticket.form.php

@@ -44,7 +44,7 @@
     }
 
     // Same right check as in PluginEscaladeTicket::addToTimeline()
-    if (!$ticket->canAssign()) {
+    if (!$ticket->canAssign() || !$ticket->checkEntity(true)) {
         Html::displayRightError();
     }
 

tests/EscaladeTestCase.php

@@ -33,6 +33,7 @@
 use Auth;
 use Session;
 use DbTestCase;
+use PluginEscaladeConfig;
 
 abstract class EscaladeTestCase extends DbTestCase
 {
@@ -58,6 +59,51 @@ protected function logOut()
         $_SESSION['glpi_currenttime'] = $ctime;
     }
 
+    public function initConfig(array $conf = [])
+    {
+        $this->login();
+
+        // Initialize session structure FIRST to avoid warnings
+        if (!isset($_SESSION['glpi_plugins'])) {
+            $_SESSION['glpi_plugins'] = [];
+        }
+
+        if (!isset($_SESSION['glpi_plugins']['escalade'])) {
+            $_SESSION['glpi_plugins']['escalade'] = [];
+        }
+
+        // Load default config into session to avoid warnings during ticket operations
+        $_SESSION['glpi_plugins']['escalade']['config'] = [
+            'use_assign_user_group' => 0,
+            'use_assign_user_group_creation' => 0,
+            'use_assign_user_group_modification' => 0,
+            'remove_tech' => 0,
+            'remove_group' => 0,
+            'remove_requester' => 0,
+            'show_history' => 0,
+            'ticket_last_status' => 0,
+            'solve_return_group' => 0,
+            'task_history' => 0,
+            'cloneandlink_ticket' => 0,
+            'close_linkedtickets' => 0,
+            'reassign_group_from_cat' => 0,
+            'task_private' => 1,
+        ];
+
+        // Update escalade config in database if provided
+        if ($conf !== []) {
+            $this->updateItem(PluginEscaladeConfig::class, 1, $conf);
+
+            // Load updated config into session
+            $config = new PluginEscaladeConfig();
+            $config->getFromDB(1);
+            $_SESSION['glpi_plugins']['escalade']['config'] = array_merge(
+                $_SESSION['glpi_plugins']['escalade']['config'],
+                $config->fields,
+            );
+        }
+    }
+
     /**
      * Get the methods for simulating different ways of escalating a ticket.
      *

tests/Units/EscalationAccessTest.php

@@ -0,0 +1,83 @@
+<?php
+
+/**
+ * -------------------------------------------------------------------------
+ * Escalade plugin for GLPI
+ * -------------------------------------------------------------------------
+ *
+ * LICENSE
+ *
+ * This file is part of Escalade.
+ *
+ * Escalade is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * Escalade is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with Escalade. If not, see <http://www.gnu.org/licenses/>.
+ * -------------------------------------------------------------------------
+ * @copyright Copyright (C) 2015-2023 by Escalade plugin team.
+ * @license   GPLv2 https://www.gnu.org/licenses/gpl-2.0.html
+ * @link      https://github.com/pluginsGLPI/escalade
+ * -------------------------------------------------------------------------
+ */
+
+namespace GlpiPlugin\Escalade\Tests\Units;
+
+use GlpiPlugin\Escalade\Tests\EscaladeTestCase;
+use ProfileRight;
+use Ticket;
+
+final class EscalationAccessTest extends EscaladeTestCase
+{
+    private function setTechnicianTicketRight(int $right): void
+    {
+        ProfileRight::updateProfileRights(
+            getItemByTypeName('Profile', 'Technician', true),
+            ['ticket' => $right],
+        );
+    }
+
+    private function loadTicket(int $tickets_id): Ticket
+    {
+        $ticket = new Ticket();
+        $ticket->getFromDB($tickets_id);
+        return $ticket;
+    }
+
+    public function testAssignOnlyUserCanReachEscalationRoutes(): void
+    {
+        $this->initConfig();
+        $tickets_id = $this->createItem(Ticket::class, ['name' => 'Escalation access test', 'content' => ''])->getID();
+
+        $this->setTechnicianTicketRight(Ticket::ASSIGN);
+        $this->login('tech', 'tech');
+
+        $ticket = $this->loadTicket($tickets_id);
+        $this->assertTrue(
+            $ticket->canAssign() && $ticket->checkEntity(),
+            'A user with only the ASSIGN right must be allowed to reach escalation routes',
+        );
+    }
+
+    public function testUpdateOnlyUserCannotReachEscalationRoutes(): void
+    {
+        $this->initConfig();
+        $tickets_id = $this->createItem(Ticket::class, ['name' => 'Escalation access test', 'content' => ''])->getID();
+
+        $this->setTechnicianTicketRight(UPDATE);
+        $this->login('tech', 'tech');
+
+        $ticket = $this->loadTicket($tickets_id);
+        $this->assertFalse(
+            (bool) $ticket->canAssign(),
+            'A user with only the UPDATE right must not be allowed to reach escalation routes',
+        );
+    }
+}