itsmng / itsm-ng Goto Github PK

Hello,
It seems the _sessions folder never purged on my instance. This morning the partition was 99% filled. Is there something I forgot to configure ?
Thank you for your help.

Install informations

• OS: Debian Bullseye
• ITSM-NG: v1.4.0
• install type: from sources
• PHP-FPM: v8.2
• use cron.php in crontab

Hi,

If a profile does not have any rights to core rules, the rules of a plugin are no longer accessible.

The problem is easily reproducible with the OCSInventory-ng plugin.

Steps to reproduce the issue:

1. Put all rights on the rules of the OCS plugin
2. Remove all rights to core rules
3. The rules menu is no longer accessible, therefore no access to OCS rules

Best regards,
Charlene

Quand je demande l'affichage des équipes

Hello !

I got a display bug that can be a bit distrubing for a final user

To reproduce :

• Create a profile without any document permissions
• Add permissions to create / update / list a ticket
• Go to a user account with the said profile
• In ticket processing of a ticket you will see a "Document" button

Expected behavior :

• Should not display a button of something you should'nt have access to

PS : An issue template would be appreciated :D

J'ajoute une solution, le ticket ne passe pas au statut Résolu

In CAS client code, SSL validation is disabled (https://github.com/itsmng/itsm-ng/blob/main/inc/auth.class.php#L486):

            // no SSL validation for the CAS server
            phpCAS::setNoCasServerValidation();

This is a bad practice and can be considered as a security issue (with DNS spoofing, an attacker can log as any user).

The SSL validation should be enabled by default, and an option can be created to disable it if needed.

affichage d'un ticket

Describe the bug
Hi,

When connecting in OIDC, a PHP warning appears in the Apache logs :

[Thu Apr 04 14:01:40.867982 2024] [php:warn] [pid 34562] [client 172.18.15.159:57392] PHP Warning:  Undefined array key "redirect" i  
n /usr/share/itsm-ng/inc/oidc.class.php on line 169

The warning appeared after the merge of PR #241 on the stable branch.

Information :

• PHP 8.1.27
• ITSM-NG 1.6.1 stable branch

Best regards,
Charlene

Le Select all ne fonctionne pas

Bonjour,

On a un soucis lorsqu'on veut upgrade notre version de ITSM-NG en passant de la version 1.5.1 vers la version.

Au moment de faire l'upgrade, l'erreur suivante survient :

Uncaught Exception mysqli_sql_exception: Row size too large. The maximum row size for the used table type, not counting BLOBs, is 8126. This includes storage overhead, check the manual. You have to change some columns to TEXT or BLOBs in /opt/itsm-ng/inc/dbmysql.class.php at line 328

Tous les checks sont passés avant de faire l'upgrade

Voici ce que ça depuis l'interface Web :

et en ligne de commande :

Pour info, notre bdd est en 10.6.16-MariaDB-0ubuntu0.22.04.1

Describe the bug
When updating the "Matrix of calculus for priority" in Setup > General > Assistance, an SQL error appears when inserting the history into the glpi_logs table :

[2024-03-29 08:48:33] glpisqllog.ERROR: DBmysql::query() in /var/www/html/itsm-ng/inc/dbmysql.class.php line 335
  *** MySQL query error:
  SQL: INSERT INTO `glpi_logs` (`items_id`, `itemtype`, `itemtype_link`, `linked_action`, `user_name`, `date_mod`, `id_search_option`, `old_value`, `new_value`) VALUES ('1', 'Config', '', '0', 'glpi (2)', '2024-03-29 08:48:33', '1', 'priority_matrix {\"1\":{\"1\":\"1\",\"2\":\"1\",\"3\":\"2\",\"4\":\"2\",\"5\":\"2\"},\"2\":{\"1\":\"1\",\"2\":\"2\",\"3\":\"2\",\"4\":\"3\",\"5\":\"3\"},\"3\":{\"1\":\"2\",\"2\":\"2\",\"3\":\"3\",\"4\":\"4\",\"5\":\"4\"},\"4\":{\"1\":\"2\",\"2\":\"3\', '{\"1\":{\"1\":\"1\",\"2\":\"1\",\"3\":\"2\",\"4\":\"2\",\"5\":\"2\"},\"2\":{\"1\":\"1\",\"2\":\"2\",\"3\":\"2\",\"4\":\"3\",\"5\":\"3\"},\"3\":{\"1\":\"2\",\"2\":\"2\",\"3\":\"3\",\"4\":\"4\",\"5\":\"4\"},\"4\":{\"1\":\"2\",\"2\":\"3\",\"3\":\"4\",\"')
  Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '{\"1\":{\"1\":\"1\",\"2\":\"1\",\"3\":\"2\",\"4\":\"2\",\"5\":\"2\"},\"2\":{\"1\' at line 1
  Backtrace :
  inc/dbmysql.class.php:1174                         
  inc/log.class.php:246                              DBmysql->insert()
  inc/log.class.php:173                              Log::history()
  inc/config.class.php:3809                          Log::constructHistory()
  inc/config.class.php:3784                          Config->logConfigChange()
  inc/commondbtm.class.php:1685                      Config->post_updateItem()
  inc/config.class.php:3044                          CommonDBTM->update()
  inc/config.class.php:263                           Config::setConfigurationValues()
  inc/commondbtm.class.php:1568                      Config->prepareInputForUpdate()
  front/config.form.php:60                           CommonDBTM->update()

To Reproduce
Steps to reproduce the behavior:

1. Go to Setup > General > Assistance
2. Modify the Matrix of calculus for priority
3. Click on Save
4. See error in sql-errors.log or php-errors_log

Fix
File : inc/log.class.php
Line : 224
Current code

      $old_value = $DB->escape(Toolbox::substr(stripslashes($old_value), 0, 180));
      $new_value = $DB->escape(Toolbox::substr(stripslashes($new_value), 0, 180));

      // Security to be sure that values do not pass over the max length
      if (Toolbox::strlen($old_value) > 255) {
         $old_value = Toolbox::substr($old_value, 0, 250);
      }
      if (Toolbox::strlen($new_value) > 255) {
         $new_value = Toolbox::substr($new_value, 0, 250);
      }

Correction

      $old_value = Toolbox::substr(stripslashes($old_value), 0, 180);
      $new_value = Toolbox::substr(stripslashes($new_value), 0, 180);

      // Security to be sure that values do not pass over the max length
      if (Toolbox::strlen($old_value) > 255) {
         $old_value = Toolbox::substr($old_value, 0, 250);
      }
      if (Toolbox::strlen($new_value) > 255) {
         $new_value = Toolbox::substr($new_value, 0, 250);
      }

      $old_value = $DB->escape($old_value);
      $new_value = $DB->escape($new_value);

Best regards,
Charlene

Describe the bug
Auto-increment of the name of an object doesn't work (<ABCD####>, <ABCD\g####>).
Note that the auto-increment of the inventory number is functional

To Reproduce
Steps to reproduce the behavior:

1. Create a gabarit with dynamic code

2. Create an object with this template

3. ITSM create the object as (copy) or (copy X)

Expected behavior
The result should be ABCD0001, ABCD0002, etc ...

Additional context
Reproducible bug on any version of ITSM.
No errors in logs.

Best regards,
Charlene

Profil Super-Admin
Impossible d'ajouter une tâche à un projet

Describe the bug
Hi,

Since this commit 4563d09, users with a simplified interface can no longer see attachments, even those they added themselves.

When you revert the commit, the attachments are visible again.

To Reproduce
Steps to reproduce the behavior:

1. In simplified interface, create a ticket with attachment
2. Go to the created ticket, no attachment visible

Expected behavior
See attachment.

Screenshots
Before revert commit:

After revert commit:

Additional context
ITSM-NG 1.6.4

With ITSM-NG version 1.4.0, when installation is done the file php-errors.log had wrong owner

-rw-r--r-- 1 root root 280 Feb 28 07:45 php-errors.log

If i delete the file and reload the itsm-ng page, php-errors.log is recreated correctly

-rw-r--r-- 1 www-data www-data 31384 Feb 28 08:11 php-errors.log

And it works

Hello,

a new CVE was published on GLPI v10 : https://nvd.nist.gov/vuln/detail/CVE-2023-42802

Does it impact itsm-ng even if it's a fork from glpi v9 ?

Thanks for your answer.

Bonjour,
J'écris ce message en Français, vous me direz si vous préférez que tous les tickets soient rédigés en anglais.
J'ai migré de GLPI v9.5.6 vers ITSM-NG 1.1.0. Tout s'est bien passé. La seule chose, depuis l'interface d'administration (configuration > général > système), j'ai voulu vérifier si une nouvelle version d'ITSM NG était disponible via le bouton "Vérifier si une nouvelle version est disponible" (https://xxxxxxxx.tld/front/config.form.php?check_version), et c'est la dernière version de GLPI qui m'est proposée (v10.0.1). Maintenant, j'ai en bas de page le mention "Une nouvelle version est disponible : 10.0.1".

Hello,
I migrated from GLPI v9.5.6 to ITSM-NG 1.1.0. Everything went well. The only thing, from the administration interface (configuration > general > system), I wanted to check if a new version of ITSM NG was available via the button "Check if a new version is available" (https:/ /xxxxxxxx.tld/front/config.form.php?check_version), and it is the latest version of GLPI that is offered to me (v10.0.1). Now, I have at the bottom of the page the mention "A new version is available: 10.0.1".

Describe the bug

When you manage mail notification, the application will generate this type link :
https://my.itsmnginstance.com/index.php?redirect=ticket_XXXXX

Upon login, the application will redirect you to the ticket with the id XXXX
However, if you are using OpenIDConnect and you are not logged, the redirection will not work and send you on the dashboard.

To Reproduce

Steps to reproduce the behavior:

1. Receive a mail notification with a redirect parameter
2. While being logged out of the application, click on the link
3. Connect using OIDC
4. You are being redirect to the dashboard instead of the item provided in the redirect parameter

Expected behavior

To work as the internal database login

Analysis

I think it mainly comes from 2 places :

• When OIDC connect via SSO button is clicked we are redirected to oidc.php with keeping the redirect argumentHtml::redirect("front/oidc.php");
• We should be able to acheive that using use setRedirectURL before calling authenticate method from OIDC library

Some links :

• https://github.com/jumbojett/OpenID-Connect-PHP/blob/7be38be967dd7845d0700924a69af34ef1c4077f/src/OpenIDConnectClient.php#L745
• setRedirectURL

Hello,
When I tried to update from ITSM NG v1.1 to 1.2, I've got the mention :
"Application dependencies are not up to date. Run "php bin/console dependencies install" in the glpi tree to fix this."
And When I ran the command :
"> @php -r "file_put_contents('.composer.hash', sha1_file('composer.lock'));"

patch -f -p1 -d vendor/laminas/laminas-mail/ < tools/laminas-mail-128.patch || echo 'Error applying patch, retrieving some mail attachement could fail'
patching file src/Header/ContentDisposition.php
Hunk #1 FAILED at 137.
1 out of 1 hunk FAILED -- saving rejects to file src/Header/ContentDisposition.php.rej
patching file src/Header/ContentDisposition.php
Hunk #1 FAILED at 87.
1 out of 1 hunk FAILED -- saving rejects to file src/Header/ContentDisposition.php.rej
Error applying patch, retrieving some mail attachement could fail
sh: 1: npm: not found"

I downloaded the v1.2 tgz archive decompressed and copy in my ITSM NG dir.
Debian Bullseye / PHP 7.4
Thank you for your help