Fix(Notifications): attached documents in private followup

[Rom1-B]

Checklist before requesting a review

Please delete options that are not relevant.

• I have read the CONTRIBUTING document.
• I have performed a self-review of my code.
• I have added tests that prove my fix is effective or that my feature works.
• This change requires a documentation update.

Description

• It fixes !39340

It checks that the recipient user has the necessary permissions to view the documents in private follow-ups before attaching them to the notification.

NB: rework of #17544

Screenshots (if appropriate):

[cconard96]

Seems to replace #17544

[trasher]

LTM. Maybe ask for customer validation

[Rom1-B]

The customer has just approved (with the latest commit)

[cedric-anne]

Yous should check the user rights on the entity of the ITIL object. Indeed, the user may not have the right to see private items on the root entity, but have rights to view them in a sub-entity.

[cedric-anne]

Using the $user object instead of the session will add, at least, 5 SQL queries more to display the ticket timeline. It should keep the checks on session when the $user param is null.

if (
    !$bypass_rights
    && (
        ($user === null && !Session::haveRight(ITILFollowup::$rightname, ITILFollowup::SEEPRIVATE))
        || ($user !== null && !$user->hasRight(ITILFollowup::$rightname, ITILFollowup::SEEPRIVATE))
    )
) {

[cedric-anne]

Could you check the behaviour with an "external" user? For instance for a ticket with a requester that does not correspond to a valid GLPI user but is targetted only with an email (anonymous tickets from helpdesk).

[Rom1-B]

With an anonymous user, $user is null in getAssociatedDocumentsCriteria(), so do not call hasRight().

[cedric-anne]

Unless I miss something, $user will be an instance of User, but getFromDBbyEmail() will have fail, and I think isNewItem will return true in this case.

$user = new User();
$user->getFromDBbyEmail($current->fields['recipient']);
$doc_crit = $item->getAssociatedDocumentsCriteria(false, $user);