Fix/snyk report

front/commonitilobject_commonitilobject.form.php

@@ -45,6 +45,12 @@
 if (isset($_POST['purge'], $_POST['id'])) {
     [$link_class_1, $link_class_2, $link_id] = explode('_', $_POST['id'], 3);
     $link_class = $link_class_1 . '_' . $link_class_2;
+
+    // limit to GLPI Classes
+    if (!class_exists($link_class) && !is_subclass_of($_POST["itemtype"], "CommonDBTM")) {
+        return;
+    }
+
     $itil_itil = new $link_class();
     $_POST['id'] = $link_id;
     $itil_itil->check($_POST['id'], PURGE);

src/CommonGLPI.php

@@ -717,6 +717,8 @@ private static function getTabIconClass(?string $form_itemtype = null): string
      **/
     public static function createTabEntry($text, $nb = 0, ?string $form_itemtype = null, string $icon = '')
     {
+        $text = htmlspecialchars($text);
+
         if (empty($icon)) {
             $icon = static::getTabIconClass($form_itemtype);
         }

src/Glpi/Inventory/Conf.php

@@ -359,7 +359,7 @@ public function showConfigForm()
 
         echo "<th>";
         echo "<label for='enabled_inventory'>";
-        echo __('Enable inventory');
+        echo __s('Enable inventory');
         echo "</label>";
         echo "</th>";
         echo "<td colspan='3'>";
@@ -376,7 +376,7 @@ public function showConfigForm()
             echo "<div class='alert alert-info d-flex align-items-center m-0' role='alert'>";
             echo "<span class='ms-2'>";
             echo "<i class='fas fa-info-circle'> </i> &nbsp;";
-            echo __("The inventory is disabled, remember to activate it if necessary");
+            echo __s("The inventory is disabled, remember to activate it if necessary");
             echo "</span>";
             echo "</div>";
         } else {
@@ -400,7 +400,7 @@ public function showConfigForm()
 
             echo "<tr>";
             echo "<th colspan='4'>";
-            echo __('Import options');
+            echo __s('Import options');
             echo "</th>";
             echo "</tr>";
 
@@ -609,7 +609,7 @@ public function showConfigForm()
 
             echo "<tr class='tab_bg_1'>";
             echo "<th colspan='4'>";
-            echo __('Related configurations');
+            echo __s('Related configurations');
             echo "</th>";
             echo "</tr>";
             echo "<tr class='tab_bg_1'>";
@@ -705,7 +705,7 @@ public function showConfigForm()
 
             echo "<tr class='tab_bg_1'>";
             echo "<td colspan='4' style='text-align:right;'>";
-            echo "<span class='red'>" . __('Will attempt to create components from VM information sent from host, do not use if you plan to inventory any VM directly!') . "</span>";
+            echo "<span class='red'>" . __s('Will attempt to create components from VM information sent from host, do not use if you plan to inventory any VM directly!') . "</span>";
             echo "</td>";
             echo "</tr>";
 
@@ -917,7 +917,7 @@ public function showConfigForm()
             echo "</tr>";
 
             echo "<tr class='tab_bg_1'>";
-            echo "<th colspan=4 >" . __('Agent cleanup') . "</th></tr>";
+            echo "<th colspan=4 >" . __s('Agent cleanup') . "</th></tr>";
             echo "<tr class='tab_bg_1'><td>";
             echo \Agent::createTabEntry(__('Update agents who have not contacted the server for (in days)'), 0, \Agent::getType());
             echo "</td><td width='20%'>";

src/Session.php

@@ -168,13 +168,15 @@ public static function init(Auth $auth)
 
                     $auth->user->computePreferences();
                     foreach ($CFG_GLPI['user_pref_field'] as $field) {
-                        if ($field == 'language' && isset($_POST['language']) && $_POST['language'] != '') {
-                            $_SESSION["glpi$field"] = $_POST[$field];
-                        } else if (isset($auth->user->fields[$field])) {
+                        if (isset($auth->user->fields[$field])) {
                             $_SESSION["glpi$field"] = $auth->user->fields[$field];
                         }
                     }
 
+                    if (isset($_POST['language']) && $_POST['language'] != '' && isset($CFG_GLPI['languages'][$_POST['language']])) {
+                        $_SESSION["glpilanguage"] = $_POST['language'];
+                    }
+
                     if (isset($_SESSION['glpidefault_central_tab']) && $_SESSION['glpidefault_central_tab']) {
                         Session::setActiveTab("central", "Central$" . $_SESSION['glpidefault_central_tab']);
                     }