Forum GLPI-Project

kedson.42

Member

Registered: 2019-03-18

Posts: 3

Bug found on Behaviour (plugin)

So, I faced a bug recently and I wanted to let you know. I'm posting here because I couldn't find the github repository.

Here it is:
When any glpi profile have disabled the permission "Update", on tab "Assistance", the user can bypass some rules from Behaviour, like the rules below:
- solution description  is mandatory before ticket is solved/closed
- technicians assigned is mandatory before ticket is solved/closed
- block solution if there is tasks "to do" and others...

When the user profile has the "Update" permission enable, the plugin can block the action.

The GIF is available on this link:

yllen

GLPI-DEV

From: Sillery (51)

Registered: 2008-01-14

Posts: 15,278

Re: Bug found on Behaviour (plugin)

I don't understand the issue: if you don't have right to update your can't change the status or add a solution.

Forge of plugin is here: https://forge.glpi-project.org/projects/behaviors

---

CentOS 6.5 - CentOS 7.x
PHP 5.6 - PHP 7.x - MySQL 5.6  - MariaDB 10.2 + APC + oOPcache
GLPI from 0.72 to dev version
Certifiée ITIL (ITV2F, ITILF, ITILOSA)

kedson.42

Member

Registered: 2019-03-18

Posts: 3

Re: Bug found on Behaviour (plugin)

Not exactly, you don't need the "update ticket" right to solve a ticket. You only need right to move the ticket from processing to solved status.

The point is the behavior plugin only works if the user has the "update ticket" right.
Any user without this permission can bypass the plugin rules.

yllen

GLPI-DEV

From: Sillery (51)

Registered: 2008-01-14

Posts: 15,278

Re: Bug found on Behaviour (plugin)

Which version of GLPI do you used?
For me, if you don't have right to update ticket, you can't change anything (you don't have update button).

---

CentOS 6.5 - CentOS 7.x
PHP 5.6 - PHP 7.x - MySQL 5.6  - MariaDB 10.2 + APC + oOPcache
GLPI from 0.72 to dev version
Certifiée ITIL (ITV2F, ITILF, ITILOSA)