Fix all dropdowns

pluginsGLPI · Mar 13, 2024 · 12a66de · 12a66de
1 parent 3f36ae8
commit 12a66de
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 2 deletions.
diff --git a/inc/field/actorfield.class.php b/inc/field/actorfield.class.php
@@ -128,7 +128,7 @@ public function getRenderedHtml($domain, $canEdit = true): string {
          'display_emptychoice' => false,
          'values'          => array_keys($value),
          'valuesnames'     => array_values($value),
-         '_idor_token'     => Session::getNewIDORToken(User::getType()),
+         '_idor_token'     => Session::getNewIDORToken(User::getType(), ['entity_restrict' => -1]),
       ];
       $html .= \PluginFormcreatorCommon::jsAjaxDropdown(
          $fieldName . '[]',

diff --git a/inc/field/dropdownfield.class.php b/inc/field/dropdownfield.class.php
@@ -383,7 +383,15 @@ public function getRenderedHtml($domain, $canEdit = true): string {
       $dparams = [];
       $dparams = $this->buildParams($rand);
       $dparams['display'] = false;
-      $dparams['_idor_token'] = Session::getNewIDORToken($itemtype);
+
+      $idor_params = [];
+      foreach (['condition', 'displaywith', 'entity_restrict', 'right'] as $sensitive_param) {
+         if (array_key_exists($sensitive_param, $dparams)) {
+            $idor_params[$sensitive_param] = $dparams[$sensitive_param];
+         }
+      }
+      $dparams['_idor_token'] = Session::getNewIDORToken($itemtype, $idor_params);
+
       $html .= $itemtype::dropdown($dparams);
       $html .= PHP_EOL;
       $html .= Html::scriptBlock("$(function() {