Fix - Data Injection models mapping additional fields become inaccessible

CHANGELOG.md

@@ -10,6 +10,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/).
 ### Fixed
 
 - Remove redundant variable initialization in the question type AJAX controller
+- Fix Data Injection models mapping additional fields becoming inaccessible with a "You don't have permission" error
 
 ## [1.25.1] - 2026-10-28
 

templates/injection.class.tpl

@@ -21,6 +21,24 @@ class %%CLASSNAME%%Injection extends %%CLASSNAME%% implements PluginDatainjectio
         return $itemtype::getTypeName($nb) . " - " . $container_name;
     }
 
+    /**
+     * Injecting fields values means updating the parent item, so the same rules
+     * as the item form apply: update right on the itemtype and write right on the container.
+     * The update right on the targeted item itself is checked by CommonDBChild.
+     */
+    static function canCreate(): bool {
+        $itemtype = %%ITEMTYPE%%;
+        return $itemtype::canUpdate()
+            && PluginFieldsProfile::getRightOnContainer(
+                (int) ($_SESSION['glpiactiveprofile']['id'] ?? 0),
+                (int) %%CONTAINER_ID%%
+            ) > READ;
+    }
+
+    static function canUpdate(): bool {
+        return static::canCreate();
+    }
+
     /**
      * Tells datainjection if the type is a primary type or not
      *

tests/Units/ContainerItemRightTest.php

@@ -85,6 +85,43 @@ public function testCanUpdateTargetItemFollowsRightOnItem(): void
         $this->assertFalse(PluginFieldsContainer::canUpdateTargetItem(Computer::class, $computer->getID()));
     }
 
+    public function testInjectionClassFollowsParentItemtypeUpdateRight(): void
+    {
+        if (!interface_exists('PluginDatainjectionInjectionInterface')) {
+            require_once __DIR__ . '/../fixtures/datainjection_stubs.php';
+        }
+
+        $entity_id = getItemByTypeName(Entity::class, '_test_root_entity', true);
+        $this->setEntity($entity_id, true);
+
+        $container = $this->createFieldContainer([
+            'label'        => 'Injection container ' . $this->getUniqueString(),
+            'type'         => 'dom',
+            'itemtypes'    => [Computer::class],
+            'is_active'    => 1,
+            'entities_id'  => $entity_id,
+            'is_recursive' => 1,
+        ]);
+        $classname = PluginFieldsContainer::getClassname(Computer::class, $container->fields['name'], 'Injection');
+
+        // Datainjection requires these rights to display and run a model mapping the container
+        $this->assertTrue($classname::canCreate());
+        $this->assertTrue($classname::canUpdate());
+
+        // A read-only container must not be writable through injection
+        PluginFieldsProfile::updateProfile([
+            'plugin_fields_containers_id' => $container->getID(),
+            'rights'                      => [$_SESSION['glpiactiveprofile']['id'] => READ],
+        ]);
+        $this->assertFalse($classname::canCreate());
+        $this->assertFalse($classname::canUpdate());
+
+        $this->login('post-only', 'postonly');
+
+        $this->assertFalse($classname::canCreate());
+        $this->assertFalse($classname::canUpdate());
+    }
+
     public function testCanUpdateTargetItemRejectsInvalidItemtype(): void
     {
         $this->login();

tests/fixtures/datainjection_stubs.php

@@ -0,0 +1,43 @@
+<?php
+
+/**
+ * -------------------------------------------------------------------------
+ * Fields plugin for GLPI
+ * -------------------------------------------------------------------------
+ *
+ * LICENSE
+ *
+ * This file is part of Fields.
+ *
+ * Fields is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * Fields is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with Fields. If not, see <http://www.gnu.org/licenses/>.
+ * -------------------------------------------------------------------------
+ * @copyright Copyright (C) 2013-2023 by Fields plugin team.
+ * @license   GPLv2 https://www.gnu.org/licenses/gpl-2.0.html
+ * @link      https://github.com/pluginsGLPI/fields
+ * -------------------------------------------------------------------------
+ */
+
+// Minimal stand-in for the Data Injection interface implemented by the generated `...Injection` classes,
+// loaded only when the plugin is absent so their rights can be tested.
+// It mirrors Data Injection 2.16: keep it in sync if the interface changes there.
+interface PluginDatainjectionInjectionInterface
+{
+    public function isPrimaryType();
+
+    public function connectedTo();
+
+    public function getOptions($primary_type = '');
+
+    public function addOrUpdateObject($values = [], $options = []);
+}