Fix(core): validate entity access in consumeVoucher before recording

.gitignore

@@ -2,3 +2,4 @@ dist/
 node_modules/
 vendor/
 .gh_token
+.phpunit.result.cache

CHANGELOG.md

@@ -5,6 +5,12 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](http://keepachangelog.com/)
 and this project adheres to [Semantic Versioning](http://semver.org/).
 
+## [Unreleased]
+
+### Fixed
+
+- Validate entity access in consumeVoucher before recording
+
 ## [1.14.2] - 2026-06-24
 
 ### Fixed

inc/ticket.class.php

@@ -612,7 +612,18 @@ public static function consumeVoucher(CommonDBTM $item)
         $credit_ticket = new self();
 
         $credit_entity = new PluginCreditEntity();
-        $credit_entity->getFromDB($item->input['plugin_credit_entities_id']);
+        if (!$credit_entity->getFromDB($item->input['plugin_credit_entities_id'])) {
+            return;
+        }
+
+        if (!Session::haveAccessToEntity($credit_entity->getField('entities_id'), $credit_entity->getField('is_recursive'))) {
+            Session::addMessageAfterRedirect(
+                __('You are not allowed to consume credits from the selected entity', 'credit'),
+                true,
+                ERROR
+            );
+            return;
+        }
 
         $quantity_sold      = (int)$credit_entity->fields['quantity'];
         $quantity_consumed  = $credit_ticket->getConsumedForCreditEntity($item->input['plugin_credit_entities_id']);

phpunit.xml

@@ -0,0 +1,7 @@
+<phpunit bootstrap="tests/bootstrap.php" colors="true" testdox="true">
+   <testsuites>
+      <testsuite name="Units">
+         <directory>tests/Units</directory>
+      </testsuite>
+   </testsuites>
+</phpunit>

tests/Units/ConsumeVoucherTest.php

@@ -0,0 +1,91 @@
+<?php
+
+/**
+ * -------------------------------------------------------------------------
+ * Credit plugin for GLPI
+ * -------------------------------------------------------------------------
+ *
+ * LICENSE
+ *
+ * This file is part of Credit.
+ *
+ * Credit is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * Credit is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with Credit. If not, see <http://www.gnu.org/licenses/>.
+ * -------------------------------------------------------------------------
+ * @author    François Legastelois
+ * @copyright Copyright (C) 2017-2023 by Credit plugin team.
+ * @license   GPLv3 https://www.gnu.org/licenses/gpl-3.0.html
+ * @link      https://github.com/pluginsGLPI/credit
+ * -------------------------------------------------------------------------
+ */
+
+namespace GlpiPlugin\Credit\Tests\Units;
+
+use Entity;
+use Glpi\Tests\DbTestCase;
+use ITILFollowup;
+use PluginCreditEntity;
+use PluginCreditTicket;
+use Session;
+use Ticket;
+
+final class ConsumeVoucherTest extends DbTestCase
+{
+    public function testVoucherConsumptionIsRejectedWhenCreditEntityIsNotAccessible(): void
+    {
+        $this->login();
+
+        $accessible_entity_id = $this->createItem(Entity::class, [
+            'name' => 'Accessible entity',
+            'entities_id' => 0,
+        ])->getID();
+
+        $restricted_entity_id = $this->createItem(Entity::class, [
+            'name' => 'Restricted entity',
+            'entities_id' => 0,
+        ])->getID();
+
+        $credit_entity_id = $this->createItem(PluginCreditEntity::class, [
+            'name' => 'Restricted credit voucher',
+            'entities_id' => $restricted_entity_id,
+            'is_recursive' => 0,
+            'is_active' => 1,
+            'quantity' => 10,
+        ])->getID();
+
+        $ticket_id = $this->createItem(Ticket::class, [
+            'name' => 'Consume voucher test',
+            'content' => 'Test',
+            'entities_id' => $accessible_entity_id,
+        ])->getID();
+
+        $this->assertTrue(Session::changeActiveEntities($accessible_entity_id));
+
+        $followup = new ITILFollowup();
+        $followup_id = $followup->add([
+            'itemtype' => Ticket::class,
+            'items_id' => $ticket_id,
+            'content' => 'Followup consuming a voucher from an inaccessible entity',
+            'plugin_credit_consumed_voucher' => 1,
+            'plugin_credit_entities_id' => $credit_entity_id,
+            'plugin_credit_quantity' => 1,
+        ]);
+        $this->assertGreaterThan(0, $followup_id);
+
+        $credit_ticket = new PluginCreditTicket();
+        $this->assertFalse(
+            $credit_ticket->getFromDBByCrit(['tickets_id' => $ticket_id]),
+            'Voucher consumption must not be recorded when the credit entity is outside the accessible entities'
+        );
+    }
+}

tests/bootstrap.php

@@ -0,0 +1,40 @@
+<?php
+
+/**
+ * -------------------------------------------------------------------------
+ * Credit plugin for GLPI
+ * -------------------------------------------------------------------------
+ *
+ * LICENSE
+ *
+ * This file is part of Credit.
+ *
+ * Credit is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * Credit is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with Credit. If not, see <http://www.gnu.org/licenses/>.
+ * -------------------------------------------------------------------------
+ * @author    François Legastelois
+ * @copyright Copyright (C) 2017-2023 by Credit plugin team.
+ * @license   GPLv3 https://www.gnu.org/licenses/gpl-3.0.html
+ * @link      https://github.com/pluginsGLPI/credit
+ * -------------------------------------------------------------------------
+ */
+
+require __DIR__ . '/../../../tests/bootstrap.php';
+
+if (file_exists(__DIR__ . '/../vendor/autoload.php')) {
+    require __DIR__ . '/../vendor/autoload.php';
+}
+
+if (!Plugin::isPluginActive('credit')) {
+    throw new RuntimeException('Plugin credit is not active in the test database');
+}