Knowledge base show articles without access when impersonate user

[ftoledo]

Code of Conduct

• I agree to follow this project's Code of Conduct

Is there an existing issue for this?

• I have searched the existing issues

Version

10.0.6

Bug description

When I impersonte user.. the FAQ section with self-service profile shows items he shouldn't have access to

Target is Supervisor profile on Root entity:

the KB is still show on user whitout the Supervisor profile and sub entity:

on click on the item it's show access deny (not bad for security concerns):

The expected result is that this item is not displayed because the user do not have the profile/entity as defined in target

Relevant log output

No response

Page URL

No response

Steps To reproduce

No response

Your GLPI setup information

No response

Anything else?

No response

[Phil-ipp1]

We have the same issue on our side.
We have multiple entities and each entity manages their own knowledge base.
The knowledge articles Target is linked to one entity only but users from other entities (not sub entities) can see the articles as well.
Luckily this articles cannot be opened by users that are assigned to an entity which is not mentioned within the Target. So it is the same issue as described by ftoledo.

It would be important that users that are not part of the Target definition could not see the article (not even the topic/header).

[cedric-anne]

Hi,

Can you try to apply #13890 and see if problem persist?

[trasher]

N o feedback , I close

[Phil-ipp1]

@cedric-anne Sorry for the late reply.
This fix solved the issue! Thank you so much for the support finding the fix.
FYI: Tested it with formCreator as well and the plugin is fully compatible to the fix

[ftoledo]

alo! sorry for delay too!,
I try to apply the patch over 10.0.6:

patch -p1 </tmp/13890.patch 

patching file src/KnowbaseItem.php
Hunk #2 FAILED at 1534.
1 out of 2 hunks FAILED -- saving rejects to file src/KnowbaseItem.php.rej
patching file src/KnowbaseItemCategory.php

[cedric-anne]

alo! sorry for delay too!, I try to apply the patch over 10.0.6:

patch -p1 </tmp/13890.patch 

patching file src/KnowbaseItem.php
Hunk #2 FAILED at 1534.
1 out of 2 hunks FAILED -- saving rejects to file src/KnowbaseItem.php.rej
patching file src/KnowbaseItemCategory.php

GLPI 10.0.7 will be released tomorrow. You will be able to update directly.

[ftoledo]

I can confirm that update to 10.0.7 fix the issue. thanks!