Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
pluginsGLPI/formcreator
develop @ bc1061a
12
Fixes
0
CVEs
HIGH
Peak severity
54.5%
Coverage
Highlights
Auth Bypass: 6 prior fixes. Scrutinize any change in this area.
inc/formanswer.class.php: most-fixed (4 issues). Treat as high-risk during review.
10 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Multiple fixes in this component address missing or incomplete permission checks across saveAnswers, canValidate, and canPurgeItem, indicating a systemic weakness in enforcing authorization on form answer operations.
Auth Bypass: Removal of an admin-only check and addition of a default WHERE clause shows a pattern where overly broad access was granted to non-admin users; the fix relies on proper session rights.
Auth Bypass: Replacing raw session profile field checks with Session::haveRight for ticketvalidation indicates a recurring flaw of trusting session data directly instead of using the framework's permission API.