fix/ escape SQL values

.gitignore

@@ -2,4 +2,4 @@ dist/
 vendor/
 .gh_token
 *.min.*
-
+var/

CHANGELOG.md

@@ -5,6 +5,12 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](http://keepachangelog.com/)
 and this project adheres to [Semantic Versioning](http://semver.org/).
 
+## [Unreleased]
+
+### Fixed
+
+- fix escape SQL values
+
 ## [2.15.6] - 2026-05-05
 
 ### Fixed

inc/commoninjectionlib.class.php

@@ -27,6 +27,8 @@
  * @link      https://github.com/pluginsGLPI/datainjection
  * -------------------------------------------------------------------------
  */
+
+use Glpi\DBAL\QuerySubQuery;
 use Glpi\Exception\Http\HttpException;
 use Glpi\Features\AssignableItem;
 
@@ -1865,7 +1867,6 @@ private function dataAlreadyInDB($injectionClass, $itemtype)
         /** @var DBmysql $DB */
         global $DB;
 
-        $where    = "";
         $continue = true;
 
         $injectionClass->getOptions($this->primary_type);
@@ -1893,17 +1894,15 @@ private function dataAlreadyInDB($injectionClass, $itemtype)
             if (!$continue) {
                 $this->values[$itemtype]['id'] = self::ITEM_NOT_FOUND;
             } else {
-                $sql = "SELECT *
-                    FROM `" . $injectionClass->getTable() . "`";
-
                 if (!is_a($itemtype, CommonDBTM::class, true)) {
                     throw new HttpException(500, 'Class ' . $itemtype . ' is not a valid class');
                 }
-                $item = new $itemtype();
+                $item  = new $itemtype();
+                $where = [];
+
                 //If it's a computer device
                 if ($item instanceof CommonDevice) {
-                    $sql .= " WHERE `designation` = '" .
-                    $this->getValueByItemtypeAndName($itemtype, 'designation') . "'";
+                    $where['designation'] = $this->getValueByItemtypeAndName($itemtype, 'designation');
                 } elseif ($item instanceof CommonDBRelation) {
                     //Type is a relation : check it this relation still exists
                     //Define the side of the relation to use
@@ -1919,94 +1918,101 @@ private function dataAlreadyInDB($injectionClass, $itemtype)
                         $source_itemtype      = $item::$itemtype_1;
                         $destination_itemtype = $item::$itemtype_2;
                     }
-                    $where .= " AND `$source_id`='" .
-                    $this->getValueByItemtypeAndName($itemtype, $source_id) . "'";
+                    $where[$source_id]      = $this->getValueByItemtypeAndName($itemtype, $source_id);
+                    $where[$destination_id] = $this->getValueByItemtypeAndName($itemtype, $destination_id);
                     if ($item->isField('itemtype')) {
-                        $where .= " AND `$source_itemtype`='" .
-                        $this->getValueByItemtypeAndName($itemtype, $source_itemtype) . "'";
+                        $where[$source_itemtype] = $this->getValueByItemtypeAndName($itemtype, $source_itemtype);
                     }
-                    $where .= " AND `" . $destination_id . "`='" .
-                    $this->getValueByItemtypeAndName($itemtype, $destination_id) . "'";
-                    $sql   .= " WHERE 1 " . $where;
                 } else {
                     //Type is not a relation
 
                     //Type can be deleted
                     if ($injectionClass->maybeDeleted()) {
-                        $where .= " AND `is_deleted` = '0' ";
+                        $where['is_deleted'] = 0;
                     }
 
                     //Type can be a template
                     if ($injectionClass->maybeTemplate()) {
-                        $where .= " AND `is_template` = '0' ";
+                        $where['is_template'] = 0;
                     }
 
                     //Type can be assigned to an entity
                     if ($injectionClass->isEntityAssign()) {
                         //Type can be recursive
                         if ($injectionClass->maybeRecursive()) {
-                            $where_entity = getEntitiesRestrictRequest(
-                                " AND",
-                                $injectionClass->getTable(),
-                                "entities_id",
-                                $this->getValueByItemtypeAndName(
-                                    $itemtype,
+                            $where = array_merge(
+                                $where,
+                                getEntitiesRestrictCriteria(
+                                    $injectionClass->getTable(),
                                     'entities_id',
+                                    $this->getValueByItemtypeAndName($itemtype, 'entities_id'),
+                                    true,
                                 ),
-                                true,
                             );
                         } else {
                             //Type cannot be recursive
-                            $where_entity = " AND `entities_id` = '" .
-                            $this->getValueByItemtypeAndName($itemtype, 'entities_id') . "'";
+                            $where['entities_id'] = $this->getValueByItemtypeAndName($itemtype, 'entities_id');
                         }
-                    } else { //If no entity assignment for this itemtype
-                        $where_entity = "";
                     }
 
                     //Add mandatory fields to the query only if it's the primary_type to be injected
                     if ($itemtype == $this->primary_type) {
                         foreach ($this->mandatory_fields[$itemtype] as $field => $is_mandatory) {
                             if ($is_mandatory) {
                                 if ($item instanceof User && $field == "useremails_id") {
-                                    $email = $DB->escape($this->getValueByItemtypeAndName($itemtype, $field));
-                                    $where .= " AND `id` IN (SELECT `users_id` FROM glpi_useremails WHERE `email` = '$email') ";
+                                    $where['id'] = new QuerySubQuery([
+                                        'SELECT' => 'users_id',
+                                        'FROM'   => 'glpi_useremails',
+                                        'WHERE'  => ['email' => $this->getValueByItemtypeAndName($itemtype, $field)],
+                                    ]);
                                 } else {
-                                    $where .= " AND `" . $field . "`='" . (string) $this->getValueByItemtypeAndName($itemtype, $field) . "'";
+                                    $where[$field] = $this->getValueByItemtypeAndName($itemtype, $field);
                                 }
                             }
                         }
                     } else {
                         //Table contains an itemtype field
                         if ($injectionClass->isField('itemtype')) {
-                            $where .= " AND `itemtype` = '" . $this->getValueByItemtypeAndName(
-                                $itemtype,
-                                'itemtype',
-                            ) . "'";
+                            $where['itemtype'] = $this->getValueByItemtypeAndName($itemtype, 'itemtype');
                         }
 
                         //Table contains an items_id field
                         if ($injectionClass->isField('items_id')) {
-                            $where .= " AND `items_id` = '" . $this->getValueByItemtypeAndName(
-                                $itemtype,
-                                'items_id',
-                            ) . "'";
+                            $where['items_id'] = $this->getValueByItemtypeAndName($itemtype, 'items_id');
                         }
                     }
 
                     //Add additional parameters specific to this itemtype (or function checkPresent exists)
                     if (method_exists($injectionClass, 'checkPresent')) {
-                        $where .= $injectionClass->checkPresent($this->values, $options);
+                        $extra = $injectionClass->checkPresent($this->values, $options);
+                        if (is_array($extra)) {
+                            if (count($extra) > 0) {
+                                $where = array_merge($where, $extra);
+                            }
+                        } elseif (!empty($extra)) {
+                            trigger_error(
+                                sprintf(
+                                    '%s::checkPresent() must return an array, %s returned instead.',
+                                    get_class($injectionClass),
+                                    gettype($extra),
+                                ),
+                                E_USER_WARNING,
+                            );
+                        }
                     }
-                    $sql .= " WHERE 1 " . $where_entity . " " . $where;
                 }
-                $result = $DB->doQuery($sql);
-                if ($DB->numrows($result) > 0) {
-                    $db_fields = $DB->fetchAssoc($result);
+
+                $result = $DB->request([
+                    'FROM'  => $injectionClass->getTable(),
+                    'WHERE' => $where,
+                ]);
+
+                if (count($result) > 0) {
+                    $db_fields = $result->current();
                     foreach ($db_fields as $key => $value) {
                         $this->setValueForItemtype($itemtype, $key, $value, true);
                     }
-                    $this->setValueForItemtype($itemtype, 'id', $DB->result($result, 0, 'id'));
+                    $this->setValueForItemtype($itemtype, 'id', $db_fields['id']);
                 } else {
                     $this->setValueForItemtype($itemtype, 'id', self::ITEM_NOT_FOUND);
                 }

inc/model.class.php

@@ -993,6 +993,7 @@ public function readUploadedFile($options = [])
                     ),
                 ];
             }
+            unset($_FILES['filename']);
         }
 
         //If file has not the right extension, reject it and delete if

inc/networkportinjection.class.php

@@ -184,13 +184,13 @@ public function addOrUpdateObject($values = [], $options = [])
     * @param array $fields_toinject    array
     * @param array $options            array
    **/
-    public function checkPresent($fields_toinject = [], $options = [])
+    public function checkPresent($fields_toinject = [], $options = []): array
     {
-
         return $this->getUnicityRequest($fields_toinject['NetworkPort'], $options['checks']);
     }
 
 
+
     /**
     * @param array $fields_toinject
     * @param array $options
@@ -245,40 +245,38 @@ public function checkParameters($fields_toinject, $options)
     * @param array $fields_toinject    array    the fields to insert into DB
     * @param array $options            array
     *
-    * @return string the sql where clause
+    * @return array
    **/
-    public function getUnicityRequest($fields_toinject = [], $options = [])
+    public function getUnicityRequest($fields_toinject = [], $options = []): array
     {
-
-        $where = "";
-
+        $where = [];
         switch ($options['port_unicity']) {
             case PluginDatainjectionCommonInjectionLib::UNICITY_NETPORT_LOGICAL_NUMBER:
-                $where .= " AND `logical_number` = '" . ($fields_toinject["logical_number"] ?? '') . "'";
+                $where['logical_number'] = $fields_toinject['logical_number'] ?? '';
                 break;
 
             case PluginDatainjectionCommonInjectionLib::UNICITY_NETPORT_LOGICAL_NUMBER_MAC:
-                $where .= " AND `logical_number` = '" . ($fields_toinject["logical_number"] ?? '') . "'
-                        AND `mac` = '" . ($fields_toinject["mac"] ?? '') . "'";
+                $where['logical_number'] = $fields_toinject['logical_number'] ?? '';
+                $where['mac']            = $fields_toinject['mac'] ?? '';
                 break;
 
             case PluginDatainjectionCommonInjectionLib::UNICITY_NETPORT_LOGICAL_NUMBER_NAME:
-                $where .= " AND `logical_number` = '" . ($fields_toinject["logical_number"] ?? '') . "'
-                        AND `name` = '" . ($fields_toinject["name"] ?? '') . "'";
+                $where['logical_number'] = $fields_toinject['logical_number'] ?? '';
+                $where['name']           = $fields_toinject['name'] ?? '';
                 break;
 
             case PluginDatainjectionCommonInjectionLib::UNICITY_NETPORT_LOGICAL_NUMBER_NAME_MAC:
-                $where .= " AND `logical_number` = '" . ($fields_toinject["logical_number"] ?? '') . "'
-                        AND `name` = '" . ($fields_toinject["name"] ?? '') . "'
-                        AND `mac` = '" . ($fields_toinject["mac"] ?? '') . "'";
+                $where['logical_number'] = $fields_toinject['logical_number'] ?? '';
+                $where['name']           = $fields_toinject['name'] ?? '';
+                $where['mac']            = $fields_toinject['mac'] ?? '';
                 break;
 
             case PluginDatainjectionCommonInjectionLib::UNICITY_NETPORT_MACADDRESS:
-                $where .= " AND `mac` = '" . ($fields_toinject["mac"] ?? '') . "'";
+                $where['mac'] = $fields_toinject['mac'] ?? '';
                 break;
 
             case PluginDatainjectionCommonInjectionLib::UNICITY_NETPORT_NAME:
-                $where .= " AND `name` = '" . ($fields_toinject["name"] ?? '') . "'";
+                $where['name'] = $fields_toinject['name'] ?? '';
                 break;
         }
 

inc/softwarelicenseinjection.class.php

@@ -200,14 +200,16 @@ public function addSpecificNeededFields($primary_type, $values)
     /**
     * @param array $fields_toinject    array
     * @param array $options            array
+    * @retrun array
    **/
-    public function checkPresent($fields_toinject = [], $options = [])
+    public function checkPresent($fields_toinject = [], $options = []): array
     {
-
         if ($options['itemtype'] != 'SoftwareLicense') {
-            return (" AND `softwares_id` = '" . $fields_toinject['Software']['id'] . "'
-                   AND `name` = '" . $fields_toinject['SoftwareLicense']['name'] . "'");
+            return [
+                'softwares_id' => $fields_toinject['Software']['id'],
+                'name'         => $fields_toinject['SoftwareLicense']['name'],
+            ];
         }
-        return "";
+        return [];
     }
 }

inc/softwareversioninjection.class.php

@@ -195,14 +195,16 @@ public function addSpecificNeededFields($primary_type, $values)
     /**
     * @param array $fields_toinject    array
     * @param array $options            array
+    * @return array
    **/
-    public function checkPresent($fields_toinject = [], $options = [])
+    public function checkPresent($fields_toinject = [], $options = []): array
     {
-
         if ($options['itemtype'] != 'SoftwareVersion') {
-            return (" AND `softwares_id` = '" . $fields_toinject['Software']['id'] . "'
-                   AND `name` = '" . $fields_toinject['SoftwareVersion']['name'] . "'");
+            return [
+                'softwares_id' => $fields_toinject['Software']['id'],
+                'name'         => $fields_toinject['SoftwareVersion']['name'],
+            ];
         }
-        return "";
+        return [];
     }
 }

phpunit.xml

@@ -0,0 +1,18 @@
+<phpunit
+    bootstrap="tests/bootstrap.php"
+    colors="true"
+    testdox="true"
+    cacheDirectory="var/phpunit"
+>
+    <source>
+        <include>
+            <directory>src</directory>
+        </include>
+    </source>
+
+    <testsuites>
+        <testsuite name="Tests">
+            <directory suffix="Test.php">tests</directory>
+        </testsuite>
+    </testsuites>
+</phpunit>

tests/bootstrap.php

@@ -0,0 +1,38 @@
+<?php
+
+/**
+ * -------------------------------------------------------------------------
+ * DataInjection plugin for GLPI
+ * -------------------------------------------------------------------------
+ *
+ * LICENSE
+ *
+ * This file is part of DataInjection.
+ *
+ * DataInjection is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * DataInjection is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with DataInjection. If not, see <http://www.gnu.org/licenses/>.
+ * -------------------------------------------------------------------------
+ * @copyright Copyright (C) 2007-2023 by DataInjection plugin team.
+ * @license   GPLv2 https://www.gnu.org/licenses/gpl-2.0.html
+ * @link      https://github.com/pluginsGLPI/datainjection
+ * -------------------------------------------------------------------------
+ */
+
+$current_plugin_folder = basename(realpath(__DIR__ . '/../'));
+
+require __DIR__ . '/../../../tests/bootstrap.php';
+require dirname(__DIR__) . '/vendor/autoload.php';
+
+if (!Plugin::isPluginActive($current_plugin_folder)) {
+    throw new RuntimeException("Plugin $current_plugin_folder is not active in the test database");
+}