Fix: add missing right checks on Jamf ajax endpoints

CHANGELOG.md

@@ -2,6 +2,10 @@
 
 ## [UNRELEASED]
 
+### Fixed
+
+- Fix missing right checks on Jamf import, merge, sync, cron and MDM command endpoints
+
 ## [3.2.1] - 2026-04-30
 
 ### Fixed

Makefile

@@ -0,0 +1 @@
+include ../../PluginsMakefile.mk

ajax/cron.php

@@ -40,7 +40,7 @@
 
 Html::header_nocache();
 
-Session::checkLoginUser();
+Session::checkRight('config', UPDATE);
 
 /** @var DBmysql $DB */
 global $DB;

ajax/getMDMCommandForm.php

@@ -36,23 +36,35 @@
     throw new NotFoundHttpException();
 }
 
-Session::checkLoginUser();
+Session::checkRight(PluginJamfMobileDevice::$rightname, READ);
 
 // An action must be specified
 if (!isset($_GET['command'])) {
     throw new RuntimeException('Required argument missing!');
 }
 
 if (isset($_GET['itemtype'], $_GET['items_id'])) {
+    /** @var class-string<PluginJamfAbstractDevice> $className */
     $className = 'PluginJamf' . $_GET['itemtype'];
-    if (is_a($className, 'CommonDBTM', true) === false) {
+    if (is_a($className, PluginJamfAbstractDevice::class, true) === false) {
         throw new RuntimeException('Invalid itemtype!');
     }
 
     $device = new $className();
     if (!$device->getFromDB($_GET['items_id'])) {
         throw new RuntimeException('Invalid itemtype/items_id!');
     }
+
+    $device_data = $device->getJamfDeviceData();
+    $glpi_itemtype = $device_data['itemtype'] ?? null;
+    if (!is_string($glpi_itemtype) || !is_a($glpi_itemtype, CommonDBTM::class, true)) {
+        throw new RuntimeException('Invalid itemtype/items_id!');
+    }
+
+    $glpi_item = new $glpi_itemtype();
+    if (!$glpi_item->getFromDB($device_data['items_id']) || !Session::haveAccessToEntity($glpi_item->fields['entities_id'])) {
+        throw new RuntimeException('Invalid itemtype/items_id!');
+    }
 } else {
     $device = null;
 }

ajax/import.php

@@ -40,7 +40,7 @@
 
 Html::header_nocache();
 
-Session::checkLoginUser();
+Session::checkRight(PluginJamfMobileDevice::$rightname, CREATE);
 
 /** @var DBmysql $DB */
 global $DB;

ajax/merge.php

@@ -40,7 +40,7 @@
 
 Html::header_nocache();
 
-Session::checkLoginUser();
+Session::checkRight(PluginJamfMobileDevice::$rightname, CREATE);
 
 /** @var DBmysql $DB */
 global $DB;
@@ -76,6 +76,11 @@
             }
 
             $item = new $itemtype();
+            if (!$item->getFromDB($glpi_id) || !Session::haveAccessToEntity($item->fields['entities_id'])) {
+                $failures++;
+                continue;
+            }
+
             /** @var class-string<PluginJamfAbstractDevice> $plugin_itemtype */
             $plugin_itemtype = 'PluginJamf' . $data['jamf_type'];
             /** @var class-string<PluginJamfDeviceSync> $plugin_sync_itemtype */

ajax/sync.php

@@ -40,7 +40,7 @@
 
 Html::header_nocache();
 
-Session::checkLoginUser();
+Session::checkRight(PluginJamfMobileDevice::$rightname, UPDATE);
 
 /** @var DBmysql $DB */
 global $DB;
@@ -54,6 +54,15 @@
     throw new RuntimeException('Required argument missing!');
 }
 
+if (!is_a($_REQUEST['itemtype'], CommonDBTM::class, true)) {
+    throw new RuntimeException('Invalid itemtype!');
+}
+
+$synced_item = new $_REQUEST['itemtype']();
+if (!$synced_item->getFromDB((int) $_REQUEST['items_id']) || !Session::haveAccessToEntity($synced_item->fields['entities_id'])) {
+    throw new RuntimeException('Invalid item!');
+}
+
 try {
     $jamf_class = PluginJamfAbstractDevice::getJamfItemClassForGLPIItem($_REQUEST['itemtype'], $_REQUEST['items_id']);
     if ($jamf_class !== null) {

front/import.php

@@ -37,7 +37,7 @@
     throw new NotFoundHttpException();
 }
 
-Session::checkRight('plugin_jamf_mobiledevice', CREATE);
+Session::checkRight(PluginJamfMobileDevice::$rightname, CREATE);
 Html::header('Jamf Plugin', '', 'tools', 'PluginJamfMenu', 'import');
 
 global $DB, $CFG_GLPI;

front/menu.php

@@ -45,7 +45,7 @@
 $plugin_dir = $CFG_GLPI['root_doc'] . '/plugins/jamf';
 
 $links      = [];
-if (Session::haveRight('plugin_jamf_mobiledevice', CREATE)) {
+if (Session::haveRight(PluginJamfMobileDevice::$rightname, CREATE)) {
     $links[] = [
         'name'          => _x('menu', 'Import devices', 'jamf'),
         'url'           => PluginJamfImport::getSearchURL(),

front/merge.php

@@ -39,7 +39,7 @@
     throw new NotFoundHttpException();
 }
 
-Session::checkRight('plugin_jamf_mobiledevice', CREATE);
+Session::checkRight(PluginJamfMobileDevice::$rightname, CREATE);
 Html::header('Jamf Plugin', '', 'tools', 'PluginJamfMenu', 'import');
 
 global $DB, $CFG_GLPI;

inc/computersync.class.php

@@ -61,7 +61,7 @@ protected function syncGeneral(): PluginJamfDeviceSync
             $other_general_items['udid'] = 'uuid';
             foreach ($other_general_items as $jamf_field => $item_field) {
                 if ($general[$jamf_field] !== $this->item->fields[$item_field]) {
-                    $this->item_changes[$item_field] = $this->db->escape($general[$jamf_field]);
+                    $this->item_changes[$item_field] = $general[$jamf_field];
                 }
             }
 

inc/mobilesync.class.php

@@ -66,7 +66,7 @@ protected function syncGeneral(): PluginJamfDeviceSync
 
             foreach ($other_general_items as $jamf_field => $item_field) {
                 if ($general[$jamf_field] !== $this->item->fields[$item_field]) {
-                    $this->item_changes[$item_field] = $this->db->escape($general[$jamf_field]);
+                    $this->item_changes[$item_field] = $general[$jamf_field];
                 }
             }
 

rector.php

@@ -29,31 +29,28 @@
  * -------------------------------------------------------------------------
  */
 
+use Rector\Configuration\RectorConfigBuilder;
+
 require_once __DIR__ . '/../../src/Plugin.php';
 
-use Rector\Caching\ValueObject\Storage\FileCacheStorage;
-use Rector\Config\RectorConfig;
-use Rector\ValueObject\PhpVersion;
+$baseline_file = __DIR__ . '/../../PluginsRector.php';
+if (!file_exists($baseline_file)) {
+    throw new RuntimeException(
+        sprintf(
+            'Unable to find "%s". Running rector on a plugin requires a GLPI development checkout that ships PluginsRector.php.',
+            $baseline_file,
+        ),
+    );
+}
+
+$baseline = require $baseline_file;
+
+/** @var RectorConfigBuilder $config */
+$config = $baseline([
+    __DIR__ . '/ajax',
+    __DIR__ . '/front',
+    __DIR__ . '/inc',
+    __DIR__ . '/tests',
+]);
 
-return RectorConfig::configure()
-    ->withPaths([
-        __DIR__ . '/ajax',
-        __DIR__ . '/front',
-        __DIR__ . '/inc',
-        __DIR__ . '/tests',
-    ])
-    ->withPhpVersion(PhpVersion::PHP_82)
-    ->withCache(
-        cacheDirectory: __DIR__ . '/var/rector',
-        cacheClass: FileCacheStorage::class,
-    )
-    ->withRootFiles()
-    ->withParallel(timeoutSeconds: 300)
-    ->withImportNames(removeUnusedImports: true)
-    ->withPreparedSets(
-        deadCode: true,
-        codeQuality: true,
-        codingStyle: true,
-    )
-    ->withPhpSets(php82: true) // apply PHP sets up to PHP 8.2
-;
+return $config;

setup.php

@@ -61,7 +61,7 @@ function plugin_init_jamf()
             'Phone',
         ]]);
         Plugin::registerClass('PluginJamfUser_JSSAccount', ['addtabon' => ['User']]);
-        if (Session::haveRight('plugin_jamf_mobiledevice', READ)) {
+        if (Session::haveRight(PluginJamfMobileDevice::$rightname, READ)) {
             $PLUGIN_HOOKS['menu_toadd']['jamf'] = ['tools' => 'PluginJamfMenu'];
         }