From 53a2dccb79d9989cf54df1ee10288436cb88d582 Mon Sep 17 00:00:00 2001
From: ciberfred <85504218+ciberfred@users.noreply.github.com>
Date: Thu, 28 Nov 2024 09:28:38 +0100
Subject: [PATCH] Fix(Core): Hide `items` without proper user access rights in
 the family list. (#392)

* Update familylist.php to remove items that user don't have right access

instead listing all items of a family, and on click get 'you don't have access' error message, juste remove it from the listing.

* Update familylist.php

* fix CS

* adapt CHANGELOG

---------

Co-authored-by: stonebuzz <skita@teclib.com>
---
 CHANGELOG.md         |  4 ++++
 front/familylist.php | 10 ++++++----
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 63cd146..6517835 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](http://semver.org/).
 
 ## [Unreleased]
 
+### Fixed
+
+-  Hide `items` without proper user access rights in the family list.
+
 ## [2.14.10] - 2024-09-06
 
 ### Fixed
diff --git a/front/familylist.php b/front/familylist.php
index 8119ac3..3880052 100644
--- a/front/familylist.php
+++ b/front/familylist.php
@@ -57,10 +57,12 @@
     echo "<tr class='tab_bg_2'><th>" . Dropdown::getDropdownName("glpi_plugin_genericobject_typefamilies", $_GET['id']) . "</th></tr>";
     foreach ($types as $type) {
         $itemtype = $type['itemtype'];
-        echo "<tr class='tab_bg_1'><td align='center'>";
-        echo "<a href='" . $itemtype::getSearchURL() . "'>";
-        echo $itemtype::getTypeName();
-        echo "</a></td></tr>";
+        if (Session::haveRight(PluginGenericobjectProfile::getProfileNameForItemtype($itemtype), READ)) {
+            echo "<tr class='tab_bg_1'><td align='center'>";
+            echo "<a href='" . $itemtype::getSearchURL() . "'>";
+            echo $itemtype::getTypeName();
+            echo "</a></td></tr>";
+        }
     }
     echo "</table>";
 }