feature/glpi-12.0 - #150
Draft
Rom1-B wants to merge 2 commits into
Draft
Conversation
There was a problem hiding this comment.
🟡 Changes recommended
CSRF tokens were removed from manually-built POST forms, which can break GLPI’s CSRF enforcement and weakens protection for delete/diagnostic actions.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Updates the oauthimap plugin to declare compatibility with GLPI 12 and align a few integration points (rights checks, URLs, CI matrix) with the GLPI 12 ecosystem.
Changes:
- Bump supported GLPI range to 12.0.x and update CI matrix accordingly.
- Adjust PHP class/property typing and a few UI strings/URL-building behaviors for GLPI 12.
- Remove
glpi-project/toolsfrom Composer dev requirements and regeneratecomposer.lock.
File summaries
| File | Description |
|---|---|
setup.php |
Updates declared supported GLPI version range to 12.0.x. |
inc/authorization.class.php |
Adds typed properties; adjusts form rendering and create/update flow. |
inc/application.class.php |
Types $rightname, tweaks i18n calls, and changes OAuth callback URL construction. |
ajax/dropdownAuthorization.php |
Updates config-right check to use Config::$rightname. |
composer.json |
Removes glpi-project/tools from require-dev. |
composer.lock |
Regenerates lockfile consistent with removed dev dependencies. |
CHANGELOG.md |
Adds an UNRELEASED entry noting GLPI 12 compatibility. |
.github/workflows/continuous-integration.yml |
Switches CI matrix generation to GLPI 12.0.x. |
Review details
Suppressed comments (1)
inc/authorization.class.php:249
- This diagnostic POST form no longer includes a CSRF token. If GLPI's CSRF protection is enabled for the plugin (it is marked
csrf_compliantin setup.php), POST submissions can be blocked without_glpi_csrf_token, and it reduces protection against cross-site requests.
echo '<form method="post" action="' . $this->getFormURL() . '">';
echo '<input type="hidden" name="diagnose" value="1" />';
echo '<input type="hidden" name="id" value="' . $this->fields['id'] . '" />';
- Files reviewed: 7/8 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
170
to
172
| echo '<form method="POST" action="' . self::getFormURL() . '" style="display:inline-block;">'; | ||
| echo Html::hidden('_glpi_csrf_token', ['value' => Session::getNewCSRFToken()]); | ||
| echo Html::hidden('id', ['value' => $row['id']]); | ||
| echo '<button type="submit" class="btn btn-primary btn-sm" name="delete" value="1">'; |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
GLPI 12 compatibility