Merge branch 'release/2.7.1'

.github/workflows/release.yml

@@ -0,0 +1,40 @@
+name: "Plugin release"
+
+on:
+  push:
+    tags:
+       - '*'
+
+jobs:
+  create-release:
+    name: "Create release"
+    runs-on: "ubuntu-latest"
+    steps:
+      - name: "Extract tag name"
+        run: |
+          echo "tag_name=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV
+      - name: "Checkout"
+        uses: "actions/checkout@v2"
+      - name: "Build package"
+        id: "build-package"
+        uses: "glpi-project/tools/github-actions/[email protected]"
+        with:
+          plugin-version: ${{ env.tag_name }}
+      - name: "Create release"
+        id: "create-release"
+        uses: "actions/create-release@v1"
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          tag_name: ${{ env.tag_name }}
+          release_name: ${{ env.tag_name }}
+          draft: true
+      - name: "Attach package to release"
+        uses: "actions/upload-release-asset@v1"
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          upload_url: ${{ steps.create-release.outputs.upload_url }}
+          asset_path: ${{ steps.build-package.outputs.package-path }}
+          asset_name: ${{ steps.build-package.outputs.package-basename }}
+          asset_content_type: " application/x-bzip2"

ajax/dropdownReplaceFindDevice.php

@@ -32,6 +32,15 @@
 header("Content-Type: text/html; charset=UTF-8");
 Html::header_nocache();
 
+Session::checkSeveralRightsOr(['uninstall:profile' => READ,
+                               'uninstall:profile' => PluginUninstallProfile::RIGHT_REPLACE]);
+
+global $UNINSTALL_TYPES, $UNINSTALL_DIRECT_CONNECTIONS_TYPE;
+
+if (!in_array($_REQUEST['itemtype'], array_merge($UNINSTALL_TYPES, $UNINSTALL_DIRECT_CONNECTIONS_TYPE))) {
+   Html::displayErrorAndDie(__("You don't have permission to perform this action."));
+}
+
 $itemtypeisplugin = isPluginItemType($_REQUEST['itemtype']);
 $item             = new $_REQUEST['itemtype']();
 $table            = getTableForItemType($_REQUEST['itemtype']);
@@ -68,7 +77,7 @@
    $search = Search::makeTextSearch($_REQUEST['searchText']);
 
    $where .= " AND (`name` ".$search."
-                    OR `id` = '".$_REQUEST['searchText']."'
+                    OR `id` = '".intval($_REQUEST['searchText'])."'
                     OR `serial` ".$search."
                     OR `otherserial` ".$search.")";
 }

ajax/groups.php

@@ -32,6 +32,9 @@
 header("Content-Type: text/html; charset=UTF-8");
 Html::header_nocache();
 
+Session::checkSeveralRightsOr(['uninstall:profile' => READ,
+                               'uninstall:profile' => PluginUninstallProfile::RIGHT_REPLACE]);
+
 if (Session::haveRight(PluginUninstallProfile::$rightname, READ)) {
    switch ($_POST["id"]) {
       case 'old' :

ajax/locations.php

@@ -32,6 +32,9 @@
 header("Content-Type: text/html; charset=UTF-8");
 Html::header_nocache();
 
+Session::checkSeveralRightsOr(['uninstall:profile' => READ,
+                               'uninstall:profile' => PluginUninstallProfile::RIGHT_REPLACE]);
+
 if (Session::haveRight(PluginUninstallUninstall::$rightname, READ)
     && $_POST['templates_id']) {
    $location = PluginUninstallPreference::getLocationByUserByEntity($_POST["users_id"],