From 6c67eea59190de15a47a08955fefabb479032add Mon Sep 17 00:00:00 2001 From: Rom1-B <8530352+Rom1-B@users.noreply.github.com> Date: Tue, 10 Nov 2026 15:55:32 +0100 Subject: [PATCH 1/2] feat: make plugin CSP compliant --- CHANGELOG.md | 6 +++ inc/bill.class.php | 11 +++-- inc/order.class.php | 12 +++--- inc/order_item.class.php | 14 +++--- inc/order_supplier.class.php | 4 +- inc/reception.class.php | 11 ++--- inc/reference_supplier.class.php | 8 ++-- inc/surveysupplier.class.php | 10 ++--- public/js/order.js | 36 ++++++++++++++++ setup.php | 2 + templates/order_getitems.html.twig | 67 ++++++++++++++++------------- templates/order_link_item.html.twig | 42 +++++++++--------- 12 files changed, 136 insertions(+), 87 deletions(-) create mode 100644 public/js/order.js diff --git a/CHANGELOG.md b/CHANGELOG.md index 964ef75e86..fc24b23a15 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,12 @@ All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](http://keepachangelog.com/) and this project adheres to [Semantic Versioning](http://semver.org/). +## [Unreleased] + +### Changed + +- Make the plugin compatible with the Content Security Policy (requires the GLPI release with CSP support) + ## [2.12.12] - 2026-10-06 ### Fixed diff --git a/inc/bill.class.php b/inc/bill.class.php index 773f982e62..3f5ac4aa3c 100644 --- a/inc/bill.class.php +++ b/inc/bill.class.php @@ -360,8 +360,7 @@ public static function showOrder($data_ref, $result_ref, $canedit, $order, $refe $itemtype = $data_ref["itemtype"]; $item = getItemForItemtype($itemtype); echo ""; @@ -479,12 +478,12 @@ public static function showOrder($data_ref, $result_ref, $canedit, $order, $refe echo "
"; echo ""; echo ""; + echo sprintf("", $rand) + . __s("Check all") . ""; echo ""; echo ""; @@ -1863,12 +1863,12 @@ public function showBillsItemsDetail($data_ref, $result_ref, $canedit, $order, $ echo "
"; echo "
"; - echo sprintf("" . __s("Check all") . "/"; - echo sprintf("" . __s("Uncheck all") . ""; + echo sprintf("", $rand) + . __s("Uncheck all") . ""; echo ""; echo Html::hidden('plugin_order_orders_id', ['value' => $order->getID()]); $order_item->dropdownBillItemsActions($order->getID()); diff --git a/inc/order.class.php b/inc/order.class.php index b655b1d0be..70677bb81b 100644 --- a/inc/order.class.php +++ b/inc/order.class.php @@ -1696,9 +1696,9 @@ public function showValidationForm($orders_id) $link = ""; if ($this->canCancelOrder()) { - echo ""; + . "\" name='cancel_order' value=\"" . __s("Cancel order", "order") . "\" class='submit'>"; $link = "

"; } @@ -1709,9 +1709,9 @@ public function showValidationForm($orders_id) } if ($this->canCancelValidationRequest()) { - echo $link . ""; $link = "

"; } @@ -1723,9 +1723,9 @@ public function showValidationForm($orders_id) } if ($this->canUndoValidation()) { - echo $link . ""; $link = "

"; } diff --git a/inc/order_item.class.php b/inc/order_item.class.php index 7d5bd9bc3e..c0d38db70d 100644 --- a/inc/order_item.class.php +++ b/inc/order_item.class.php @@ -650,7 +650,8 @@ public function showAddForm($plugin_order_orders_id) } };"); - echo ""; + echo ""; + echo Html::scriptBlock('$("#addreference").on("click", function () { plugin_order_checkboxAction(); });'); echo "
"; echo ""; + echo sprintf("", $rand) + . __s("Check all") . ""; echo ""; echo sprintf("", $arrow); echo ""; + echo sprintf("", htmlescape($formname)) . __s('Check all') . ""; echo ""; echo ""; + echo sprintf("", htmlescape($formname)) . __s('Uncheck all') . ""; echo ""; @@ -507,7 +506,7 @@ public function showOrderReceptionItem($data_ref, $numref, $canedit, $reference, 'rand' => $rand, ], ); - echo " "; + echo sprintf(" "; echo ""; } @@ -625,7 +624,7 @@ public function showOrderReceptionItem($data_ref, $numref, $canedit, $reference, 'rand' => $rand, ], ); - echo " "; + echo sprintf(" "; echo ""; } @@ -685,8 +684,10 @@ private function displayBulkReceptionForm($order_order, $orders_id, $references_ if ($order_order->canDeliver() && $this->checkItemStatus($orders_id, $references_id, PluginOrderOrder::ORDER_DEVICE_NOT_DELIVRED) && $typeRef != 'SoftwareLicense') { $bulk_rand = mt_rand(); - $button = "

"); + $button_id = 'massreception_button' . $suffix . $orders_id . $bulk_rand; + $button = "

"; $button .= __s("Take item delivery (bulk)", "order") . "

"; + $button .= Html::scriptBlock("\$('#{$button_id}').on('click', function (e) { e.preventDefault(); viewmassreception{$suffix}{$orders_id}{$bulk_rand}(); });"); echo ""; if ($position == 'top') { diff --git a/inc/reference_supplier.class.php b/inc/reference_supplier.class.php index 7cecf6dced..620b5c7172 100644 --- a/inc/reference_supplier.class.php +++ b/inc/reference_supplier.class.php @@ -350,11 +350,11 @@ public function showReferenceManufacturers($ID) echo "
"; echo "
"; - echo sprintf("" . __s("Check all") . "/"; - echo sprintf("" . __s("Uncheck all") . ""; + echo sprintf("", $rand) + . __s("Uncheck all") . ""; echo ""; echo Html::hidden('plugin_order_orders_id', ['value' => $order->getID()]); $this->dropdownBillItemsActions($order->getID()); diff --git a/inc/order_supplier.class.php b/inc/order_supplier.class.php index a0c8c5fb1e..c6a298c948 100644 --- a/inc/order_supplier.class.php +++ b/inc/order_supplier.class.php @@ -276,10 +276,10 @@ public static function showOrderSupplierInfos($ID) echo "
"; - echo sprintf("", $formname) . __s('Check all') . "/"; - echo sprintf("", $formname) . __s('Uncheck all') . ""; echo "
"; echo ""; - echo sprintf(""; + echo sprintf(""; - echo sprintf(""; echo "
" . __s("Check all") . "", $rand) + . __s("Check all") . "/" . __s("Uncheck all") . ""; + echo sprintf("/", $rand) + . __s("Uncheck all") . ""; echo ""; echo ""; diff --git a/inc/surveysupplier.class.php b/inc/surveysupplier.class.php index c92d9d366a..6fafe217fc 100644 --- a/inc/surveysupplier.class.php +++ b/inc/surveysupplier.class.php @@ -101,15 +101,13 @@ public function addNotation($field, $value) echo "
"; - echo ""; + resetable: false});"); } @@ -474,10 +472,10 @@ public static function showOrderSupplierSurvey($ID) echo ""; echo sprintf("", $arrow); echo ""; - echo sprintf("", $formname) . __s('Check all') . ""; + echo sprintf("", htmlescape($formname)) . __s('Check all') . ""; echo "/"; echo ""; - echo sprintf("", $formname) . __s('Uncheck all') . ""; + echo sprintf("", htmlescape($formname)) . __s('Uncheck all') . ""; echo ""; echo " 'The plugin order team', 'homepage' => 'https://github.com/pluginsGLPI/order', 'license' => 'GPLv2+', + 'csp_compliant' => true, 'requirements' => [ 'glpi' => [ 'min' => PLUGIN_ORDER_MIN_GLPI, diff --git a/templates/order_getitems.html.twig b/templates/order_getitems.html.twig index 5c8ab6d274..f449fe1ebf 100644 --- a/templates/order_getitems.html.twig +++ b/templates/order_getitems.html.twig @@ -120,7 +120,7 @@
+ data-glpi-check-all="{{ massiveactionparams['container'] }}" />
{% endif %} @@ -134,16 +134,16 @@ {% set new_order = (order == 'ASC' ? 'DESC' : 'ASC') %} {% endif %} - {% set sort_href = "javascript:reloadTab('start=" ~ start ~ "&limit=" ~ limit ~ "&" ~ countainer_name ~ "sort=" ~ colkey ~ "&" ~ countainer_name ~ "order=" ~ new_order ~ "&" ~ countainer_name ~ "visible=" ~ true ~ "');" %} + {% set sort_params = "start=" ~ start ~ "&limit=" ~ limit ~ "&" ~ countainer_name ~ "sort=" ~ colkey ~ "&" ~ countainer_name ~ "order=" ~ new_order ~ "&" ~ countainer_name ~ "visible=" ~ true %} {% if not nosort and not (column is array and column['nosort'] is defined) %} - + {% endif %} {% endfor %} @@ -285,12 +285,12 @@ {% elseif formatter == "editable_price" %} {% if canedit %} {% if is_summary_table is defined and is_summary_table %} -