Fix(Core): harden report data handling and prevent cross-entity exposure

CHANGELOG.md

@@ -5,6 +5,17 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](http://keepachangelog.com/)
 and this project adheres to [Semantic Versioning](http://semver.org/).
 
+## [UNRELEASED]
+
+### Fixed
+
+- Escape chart labels before injecting them into report graphs
+- Cast state filter values before building SQL
+
+### Removed
+
+- Remove the logs activity report to prevent cross-entity data display
+
 ## [1.10.1] - 2026-08-04
 
 ### Fixed

hook.php

@@ -248,6 +248,21 @@ function plugin_mreporting_install()
     );
     $migration->migrationOneTable('glpi_plugin_mreporting_dashboards');
 
+    // == Remove the logs activity report (instance-wide counts, no entity restriction)
+    $logs_report = $DB->request([
+        'SELECT' => 'id',
+        'FROM'   => 'glpi_plugin_mreporting_configs',
+        'WHERE'  => [
+            'classname' => 'PluginMreportingOther',
+            'name'      => 'reportHbarLogs',
+        ],
+    ]);
+    foreach ($logs_report as $report) {
+        $DB->delete('glpi_plugin_mreporting_profiles', ['reports' => $report['id']]);
+        $DB->delete('glpi_plugin_mreporting_dashboards', ['reports_id' => $report['id']]);
+        $DB->delete('glpi_plugin_mreporting_configs', ['id' => $report['id']]);
+    }
+
     // == Init available reports
     require_once __DIR__ . '/inc/baseclass.class.php';
     require_once __DIR__ . '/inc/common.class.php';

inc/config.class.php

@@ -341,7 +341,7 @@ public function createFirstConfig()
                 $input = [];
 
                 if ($classConfig) { // If a preconfig exists in class we do it
-                    /** @var null|PluginMreportingOther|PluginMreportingHelpdesk $classObject */
+                    /** @var null|PluginMreportingHelpdesk $classObject */
                     $input = $classObject->preconfig($funct_name, $classname, $this);
                 } else {// Else we get the default preconfig
                     $input = $this->preconfig($funct_name, $classname);

inc/graph.class.php

@@ -1835,18 +1835,9 @@ public function initDatasSimple($datas, $unit = '', $links = [])
         $out = substr($out, 0, -2) . "\n";
         $out .= "];\n";
 
-        $out .= "var labels = [\n";
-        foreach ($labels as $label) {
-            $out .= "\t'" . $label . "',\n";
-        }
-        $out = substr($out, 0, -2) . "\n";
-        $out .= "];\n";
+        $out .= 'var labels = ' . json_encode($labels, JSON_HEX_TAG | JSON_HEX_APOS | JSON_HEX_QUOT | JSON_HEX_AMP) . ";\n";
 
-        $out .= "var links = [\n";
-        foreach ($links as $link) {
-            $out .= "\t'" . $link . "',\n";
-        }
-        $out .= "];\n";
+        $out .= 'var links = ' . json_encode($links, JSON_HEX_TAG | JSON_HEX_APOS | JSON_HEX_QUOT | JSON_HEX_AMP) . ";\n";
 
         echo $out;
         $max = count($values) > 0 ? max($values) * 1.1 : 1;
@@ -1915,19 +1906,9 @@ public function initDatasMultiple($datas, $labels2, $unit = '', $stacked = false
         $out = substr($out, 0, -2) . "\n";
         $out .= "];\n";
 
-        $out .= "var labels = [\n";
-        foreach ($labels as $label) {
-            $out .= "\t'" . $label . "',\n";
-        }
-        $out = substr($out, 0, -2) . "\n";
-        $out .= "];\n";
+        $out .= 'var labels = ' . json_encode($labels, JSON_HEX_TAG | JSON_HEX_APOS | JSON_HEX_QUOT | JSON_HEX_AMP) . ";\n";
 
-        $out .= "var labels2 = [\n";
-        foreach ($labels2 as $label) {
-            $out .= "\t'" . $label . "',\n";
-        }
-        $out = substr($out, 0, -2) . "\n";
-        $out .= "];\n";
+        $out .= 'var labels2 = ' . json_encode($labels2, JSON_HEX_TAG | JSON_HEX_APOS | JSON_HEX_QUOT | JSON_HEX_AMP) . ";\n";
         echo $out;
 
         if (!$stacked) {

inc/graphpng.class.php

@@ -171,6 +171,10 @@ public function generateImage($params)
 
         $params = array_merge($default_params, $params);
 
+        if ($params['f_name'] !== '' && !preg_match('/^[A-Za-z0-9_]+$/', $params['f_name'])) {
+            $params['f_name'] = '';
+        }
+
         ob_start();
 
         if ($params['export'] == 'odt') {

inc/inventory.class.php

@@ -94,13 +94,13 @@ public static function getStateCondition($field, $as_array = false)
                 if ($as_array) {
                     $sql_states[$field] = $_SESSION['mreporting_values']['states_id'];
                 } else {
-                    $sql_states = " AND $field IN (" . implode(',', $_SESSION['mreporting_values']['states_id']) . ')';
+                    $sql_states = " AND $field IN (" . implode(',', array_map('intval', $_SESSION['mreporting_values']['states_id'])) . ')';
                 }
             } elseif ($_SESSION['mreporting_values']['states_id'] > 0) {
                 if ($as_array) {
                     $sql_states[$field] = $_SESSION['mreporting_values']['states_id'];
                 } else {
-                    $sql_states = " AND $field = " . $_SESSION['mreporting_values']['states_id'];
+                    $sql_states = " AND $field = " . (int) $_SESSION['mreporting_values']['states_id'];
                 }
             }
         }