From d66ecdfad6958014a05e2a28a820a3492d9f4990 Mon Sep 17 00:00:00 2001
From: Rom1-B <8530352+Rom1-B@users.noreply.github.com>
Date: Tue, 28 Jul 2026 11:42:07 +0200
Subject: [PATCH] Fix: various minor fixes and hardening

---
 CHANGELOG.md            |  6 ++++++
 ajax/extract_json.php   |  2 +-
 inc/apiclient.class.php |  2 +-
 inc/config.class.php    | 28 ++++++++++++++++++++++++----
 inc/dashboard.class.php |  5 +++--
 setup.php               |  2 +-
 6 files changed, 36 insertions(+), 9 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7058b61..0e83ea7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,12 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](http://keepachangelog.com/)
 and this project adheres to [Semantic Versioning](http://semver.org/).
 
+## [Unreleased]
+
+### Fixed
+
+- Various minor fixes and hardening
+
 ## [1.4.1] - 2025-11-25
 
 ### Fixed
diff --git a/ajax/extract_json.php b/ajax/extract_json.php
index 67f8d6a..fc3b43c 100644
--- a/ajax/extract_json.php
+++ b/ajax/extract_json.php
@@ -30,7 +30,7 @@
 
 header('Content-Type: text/html; charset=UTF-8');
 Html::header_nocache();
-Session::checkLoginUser();
+Session::checkRight('config', READ);
 
 if (
     !isset($_REQUEST['id'])
diff --git a/inc/apiclient.class.php b/inc/apiclient.class.php
index c6d918b..6675668 100644
--- a/inc/apiclient.class.php
+++ b/inc/apiclient.class.php
@@ -822,7 +822,7 @@ public function httpQuery($resource = '', $params = [], $method = 'GET')
             'timeout'         => 5,
             'connect_timeout' => 2,
             'debug'           => false,
-            'verify'          => false,
+            'verify'          => true,
             'query'           => [], // url parameter
             'body'            => '', // raw data to send in body
             'json'            => [], // json data to send
diff --git a/inc/config.class.php b/inc/config.class.php
index bbd02fb..8ac029f 100644
--- a/inc/config.class.php
+++ b/inc/config.class.php
@@ -140,10 +140,11 @@ public static function showForConfig(Config $config, $withtemplate = 0)
         ]);
 
         echo self::showField([
-            'label' => __s('Metabase embedded token (to display dashboard in GLPI)', 'metabase'),
-            'attrs' => [
+            'inputtype' => 'password',
+            'label'     => __s('Metabase embedded token (to display dashboard in GLPI)', 'metabase'),
+            'attrs'     => [
                 'name'        => 'embedded_token',
-                'value'       => $current_config['embedded_token'],
+                'value'       => '',
                 'placeholder' => '',
                 'required'    => false,
             ],
@@ -202,7 +203,7 @@ public static function showForConfig(Config $config, $withtemplate = 0)
             echo '</ul>';
 
             $error = $apiclient->getLastError();
-            if (count($error) > 0) {
+            if ($canedit && count($error) > 0) {
                 echo '<h1>' . __s('Last Error', 'metabase') . '</h1>';
                 if (isset($error['exception'])) {
                     echo $error['exception'];
@@ -764,6 +765,10 @@ public static function configUpdate($input)
             }
         }
 
+        if (isset($input['embedded_token']) && empty($input['embedded_token'])) {
+            unset($input['embedded_token']);
+        }
+
         return $input;
     }
 
@@ -801,6 +806,21 @@ public static function install(Migration $migration)
             Config::deleteConfigurationValues('plugin:metabase', ['is_password_encrypted', 'is_password_random_encrypted']);
         }
 
+        // Encrypt embedded_token, previously stored in plain text
+        if (!array_key_exists('is_embedded_token_encrypted', $current_config) || !$current_config['is_embedded_token_encrypted']) {
+            if (!empty($current_config['embedded_token'])) {
+                Config::setConfigurationValues(
+                    'plugin:metabase',
+                    [
+                        'embedded_token' => $current_config['embedded_token'],
+                    ],
+                );
+            }
+
+            // Add flag in config to prevent re-encrypt
+            Config::setConfigurationValues('plugin:metabase', ['is_embedded_token_encrypted' => 1]);
+        }
+
         // fill config table with default values if missing
         foreach (
             [
diff --git a/inc/dashboard.class.php b/inc/dashboard.class.php
index 1a90775..9ad8cde 100644
--- a/inc/dashboard.class.php
+++ b/inc/dashboard.class.php
@@ -113,7 +113,8 @@ function ($dashboard) {
             return;
         }
 
-        if (null === $currentUuid) {
+        $allowedUuids = array_column($dashboards, 'id');
+        if (null === $currentUuid || !in_array($currentUuid, $allowedUuids)) {
             $firstDashboard = current($dashboards);
             $currentUuid    = $firstDashboard['id'];
         }
@@ -131,7 +132,7 @@ function ($dashboard) {
 
         $signer_config = Configuration::forSymmetricSigner(
             new Sha256(),
-            InMemory::plainText($config['embedded_token']),
+            InMemory::plainText((new GLPIKey())->decrypt($config['embedded_token'])),
         );
         $token = $signer_config->builder()
           ->withClaim('resource', [
diff --git a/setup.php b/setup.php
index ef8d9e9..312ee24 100644
--- a/setup.php
+++ b/setup.php
@@ -93,7 +93,7 @@ function plugin_init_metabase()
     $PLUGIN_HOOKS['add_javascript']['metabase'] = 'metabase.js';
 
     // Encryption
-    $PLUGIN_HOOKS['secured_configs']['metabase'] = ['password'];
+    $PLUGIN_HOOKS['secured_configs']['metabase'] = ['password', 'embedded_token'];
 }