From e955c077f6d2d58cf22c86784421684e59e2bd75 Mon Sep 17 00:00:00 2001
From: Stanislas Kita <skita@teclib.com>
Date: Mon, 13 Oct 2025 15:40:00 +0200
Subject: [PATCH 01/13] fix(Core): fix display

---
 inc/common.class.php |  2 +-
 inc/graph.class.php  | 19 +++++++++++--------
 2 files changed, 12 insertions(+), 9 deletions(-)

diff --git a/inc/common.class.php b/inc/common.class.php
index e13e478e..3e5d7d24 100644
--- a/inc/common.class.php
+++ b/inc/common.class.php
@@ -1018,7 +1018,7 @@ public static function showGraphDatas(
                 echo "<tr class='tab_bg_1'>";
                 echo '<td>' . htmlspecialchars($label2) . '</td>';
                 if ($simpledatas) { //simple array
-                    echo "<td class='center'>" . htmlspecialchars($cols) . ' ' . htmlspecialchars($unit) . '</td>';
+                    echo "<td class='center'>" . htmlspecialchars($cols) . ' ' . htmlspecialchars($unit ?? '') . '</td>';
                 } else { //multiple array
                     foreach ($cols as $date => $nb) {
                         if (!is_array($nb)) {
diff --git a/inc/graph.class.php b/inc/graph.class.php
index 54a84e7a..fd23158d 100644
--- a/inc/graph.class.php
+++ b/inc/graph.class.php
@@ -105,7 +105,10 @@ public function initGraph($options)
 
         echo "<div class='graph' id='graph_content" . $randname . "'>";
 
-        $colors = htmlspecialchars("'" . implode("', '", PluginMreportingConfig::getColors()) . "'");
+
+        $colorsArray = PluginMreportingConfig::getColors();
+        $escapedColors = array_map(fn($color) => htmlspecialchars($color, ENT_QUOTES, 'UTF-8'), $colorsArray);
+        $colors = "'" . implode("', '", $escapedColors) . "'";
         echo "<script type='text/javascript+protovis'>
          showGraph$randname = function() {
             colors = pv.colors($colors);";
@@ -299,7 +302,7 @@ public function showHbar($params, $dashboard = false, $width = false)
 JAVASCRIPT;
 
         if ($show_graph) {
-            echo htmlspecialchars($JS);
+            echo $JS;
         }
 
         $opt['randname'] = $randname;
@@ -496,7 +499,7 @@ public function showPie($params, $dashboard = false, $width = false)
 JAVASCRIPT;
 
         if ($show_graph) {
-            echo htmlspecialchars($JS);
+            echo $JS;
         }
 
         $opt['randname'] = $randname;
@@ -776,7 +779,7 @@ function getLevelNbNode(node) {
 JAVASCRIPT;
 
         if ($show_graph) {
-            echo htmlspecialchars($JS);
+            echo $JS;
         }
 
         $opt['randname'] = $randname;
@@ -1008,7 +1011,7 @@ public function showHgbar($params, $dashboard = false, $width = false)
 JAVASCRIPT;
 
         if ($show_graph) {
-            echo htmlspecialchars($JS);
+            echo $JS;
         }
 
         $opt['randname'] = $randname;
@@ -1244,7 +1247,7 @@ public function showVstackbar($params, $dashboard = false, $width = false)
 JAVASCRIPT;
 
         if ($show_graph) {
-            echo htmlspecialchars($JS);
+            echo $JS;
         }
 
         $opt['randname'] = $randname;
@@ -1485,7 +1488,7 @@ public function showArea($params, $dashboard = false, $width = false)
 JAVASCRIPT;
 
         if ($show_graph) {
-            echo htmlspecialchars($JS);
+            echo $JS;
         }
 
         $opt['randname'] = $randname;
@@ -1765,7 +1768,7 @@ public function showGarea($params, $dashboard = false, $width = false)
 JAVASCRIPT;
 
         if ($show_graph) {
-            echo htmlspecialchars($JS);
+            echo $JS;
         }
 
         $opt['randname'] = $randname;

From d3e8b5b9934107dfa6fff44bf25a770f95c69431 Mon Sep 17 00:00:00 2001
From: Stanislas Kita <skita@teclib.com>
Date: Mon, 13 Oct 2025 16:24:39 +0200
Subject: [PATCH 02/13] fix ci

---
 psalm.xml | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/psalm.xml b/psalm.xml
index f051d3de..d5f56eac 100644
--- a/psalm.xml
+++ b/psalm.xml
@@ -11,13 +11,16 @@
     </projectFiles>
 
     <issueHandlers>
-        <!--
-            Too many false positives.
-            - many are already secured by ForbidDynamicInstantiationRule, but Psalm does not seems to consider `is_a()` checks safe enough;
-            - many are related dynamic call to plugin functions/classes, we need a lot of refactor to indicate to Psalm these can be ignored;
-            - the rest is likely to not be exploitable, due to the really low probability to have a classname
-              that can be abused and that implements the specific static method called on a dynamic classname.
-        -->
+        <TaintedTextWithQuotes>
+            <errorLevel type="suppress">
+            <file name="inc/graph.class.php" />
+            </errorLevel>
+        </TaintedTextWithQuotes>
+        <TaintedHtml>
+            <errorLevel type="suppress">
+            <file name="inc/graph.class.php" />
+            </errorLevel>
+        </TaintedHtml>
         <TaintedCallable errorLevel="suppress" />
     </issueHandlers>
 </psalm>

From 51643e49d3d121c5f57aeff30908fe8cc5339db9 Mon Sep 17 00:00:00 2001
From: Stanislas Kita <skita@teclib.com>
Date: Tue, 14 Oct 2025 09:35:54 +0200
Subject: [PATCH 03/13] another fix

---
 inc/helpdesk.class.php | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/inc/helpdesk.class.php b/inc/helpdesk.class.php
index c935ee18..de9a3c54 100644
--- a/inc/helpdesk.class.php
+++ b/inc/helpdesk.class.php
@@ -424,11 +424,15 @@ private function reportHgbarTicketNumberByCategoryAndByType(array $config, $filt
         foreach ($result as $ticket) {
             if (empty($ticket['category_id'])) {
                 $ticket['category_id']   = 0;
-                $ticket['category_name'] = __s('None');
+                $ticket['category_name'] = __('None');
+            }
+            if ($ticket['type'] == 0) {
+                $type = __('Undefined', 'mreporting');
+            } else {
+                $type = htmlspecialchars(Ticket::getTicketTypeName(intval($ticket['type'])));
             }
-            $type = $ticket['type'] == 0 ? __s('Undefined', 'mreporting') : Ticket::getTicketTypeName(intval($ticket['type']));
             $datas['labels2'][$type]                         = $type;
-            $datas['datas'][$ticket['category_name']][$type] = $ticket['count'];
+            $datas['datas'][htmlspecialchars($ticket['category_name'])][$type] = $ticket['count'];
         }
 
         return $datas;
@@ -826,7 +830,7 @@ public function reportSunburstTicketByCategories($config = [])
             if (!isset($flat_datas[$current_datas['parent']]) && ($current_datas['parent'] != 0 && $itilcategory->getFromDB(intval($current_datas['parent'])))) {
                 $flat_datas[$current_datas['parent']] = [
                     'id'     => $current_datas['parent'],
-                    'name'   => $itilcategory->fields['name'],
+                    'name'   => htmlspecialchars($itilcategory->fields['name']),
                     'parent' => $itilcategory->fields['itilcategories_id'],
                     'count'  => 0,
                 ];

From 7c34cb1604082f686908de39aec134756b540a18 Mon Sep 17 00:00:00 2001
From: Stanislas Kita <skita@teclib.com>
Date: Tue, 14 Oct 2025 09:37:50 +0200
Subject: [PATCH 04/13] fix CI

---
 inc/helpdesk.class.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/inc/helpdesk.class.php b/inc/helpdesk.class.php
index de9a3c54..a007a6b3 100644
--- a/inc/helpdesk.class.php
+++ b/inc/helpdesk.class.php
@@ -424,10 +424,10 @@ private function reportHgbarTicketNumberByCategoryAndByType(array $config, $filt
         foreach ($result as $ticket) {
             if (empty($ticket['category_id'])) {
                 $ticket['category_id']   = 0;
-                $ticket['category_name'] = __('None');
+                $ticket['category_name'] = __s('None');
             }
             if ($ticket['type'] == 0) {
-                $type = __('Undefined', 'mreporting');
+                $type = __s('Undefined', 'mreporting');
             } else {
                 $type = htmlspecialchars(Ticket::getTicketTypeName(intval($ticket['type'])));
             }

From 3ea6ea7312ccc65366342148864fb09f5f3142d5 Mon Sep 17 00:00:00 2001
From: Stanislas Kita <skita@teclib.com>
Date: Tue, 14 Oct 2025 10:27:33 +0200
Subject: [PATCH 05/13] fix <   >

---
 inc/helpdesk.class.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/inc/helpdesk.class.php b/inc/helpdesk.class.php
index a007a6b3..ba2f43bc 100644
--- a/inc/helpdesk.class.php
+++ b/inc/helpdesk.class.php
@@ -432,7 +432,7 @@ private function reportHgbarTicketNumberByCategoryAndByType(array $config, $filt
                 $type = htmlspecialchars(Ticket::getTicketTypeName(intval($ticket['type'])));
             }
             $datas['labels2'][$type]                         = $type;
-            $datas['datas'][htmlspecialchars($ticket['category_name'])][$type] = $ticket['count'];
+            $datas['datas'][htmlspecialchars($ticket['category_name'], ENT_NOQUOTES | ENT_SUBSTITUTE, 'UTF-8', false)][$type] = $ticket['count'];
         }
 
         return $datas;
@@ -830,7 +830,7 @@ public function reportSunburstTicketByCategories($config = [])
             if (!isset($flat_datas[$current_datas['parent']]) && ($current_datas['parent'] != 0 && $itilcategory->getFromDB(intval($current_datas['parent'])))) {
                 $flat_datas[$current_datas['parent']] = [
                     'id'     => $current_datas['parent'],
-                    'name'   => htmlspecialchars($itilcategory->fields['name']),
+                    'name'   => htmlspecialchars($itilcategory->fields['name'], ENT_NOQUOTES | ENT_SUBSTITUTE, 'UTF-8', false),
                     'parent' => $itilcategory->fields['itilcategories_id'],
                     'count'  => 0,
                 ];

From b44eb96c92d5b1b78285106a20bc9c59960e9483 Mon Sep 17 00:00:00 2001
From: Stanislas Kita <skita@teclib.com>
Date: Tue, 14 Oct 2025 10:44:39 +0200
Subject: [PATCH 06/13] fix again

---
 inc/helpdesk.class.php | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/inc/helpdesk.class.php b/inc/helpdesk.class.php
index ba2f43bc..5bf68f90 100644
--- a/inc/helpdesk.class.php
+++ b/inc/helpdesk.class.php
@@ -432,7 +432,14 @@ private function reportHgbarTicketNumberByCategoryAndByType(array $config, $filt
                 $type = htmlspecialchars(Ticket::getTicketTypeName(intval($ticket['type'])));
             }
             $datas['labels2'][$type]                         = $type;
-            $datas['datas'][htmlspecialchars($ticket['category_name'], ENT_NOQUOTES | ENT_SUBSTITUTE, 'UTF-8', false)][$type] = $ticket['count'];
+
+            $ticket['category_name'] = str_replace(
+                ["'", '"'],
+                ["\'", "&quot;"],
+                $ticket['category_name']
+            );
+
+            $datas['datas'][$ticket['category_name']][$type] = $ticket['count'];
         }
 
         return $datas;
@@ -828,9 +835,10 @@ public function reportSunburstTicketByCategories($config = [])
         $itilcategory = new ITILCategory();
         foreach ($flat_datas as $cat_id => $current_datas) {
             if (!isset($flat_datas[$current_datas['parent']]) && ($current_datas['parent'] != 0 && $itilcategory->getFromDB(intval($current_datas['parent'])))) {
+
                 $flat_datas[$current_datas['parent']] = [
                     'id'     => $current_datas['parent'],
-                    'name'   => htmlspecialchars($itilcategory->fields['name'], ENT_NOQUOTES | ENT_SUBSTITUTE, 'UTF-8', false),
+                    'name'   => htmlspecialchars($itilcategory->fields['name']),
                     'parent' => $itilcategory->fields['itilcategories_id'],
                     'count'  => 0,
                 ];

From 0ff79b028b91e3017f492062b83d22772d16a567 Mon Sep 17 00:00:00 2001
From: Stanislas Kita <skita@teclib.com>
Date: Tue, 14 Oct 2025 10:48:44 +0200
Subject: [PATCH 07/13] fix

---
 inc/helpdesk.class.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/inc/helpdesk.class.php b/inc/helpdesk.class.php
index 5bf68f90..19ab99c5 100644
--- a/inc/helpdesk.class.php
+++ b/inc/helpdesk.class.php
@@ -436,7 +436,7 @@ private function reportHgbarTicketNumberByCategoryAndByType(array $config, $filt
             $ticket['category_name'] = str_replace(
                 ["'", '"'],
                 ["\'", "&quot;"],
-                $ticket['category_name']
+                $ticket['category_name'],
             );
 
             $datas['datas'][$ticket['category_name']][$type] = $ticket['count'];

From 2bf726a88cf01ae8be97a734cc54325c796cf862 Mon Sep 17 00:00:00 2001
From: Stanislas Kita <skita@teclib.com>
Date: Tue, 14 Oct 2025 11:13:45 +0200
Subject: [PATCH 08/13] fix pics

---
 inc/graph.class.php    | 2 +-
 inc/graphpng.class.php | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/inc/graph.class.php b/inc/graph.class.php
index fd23158d..b82fd55b 100644
--- a/inc/graph.class.php
+++ b/inc/graph.class.php
@@ -60,7 +60,7 @@ public function initGraph($options)
             echo "<div class='graph_title'>";
             $gtype = htmlspecialchars($_REQUEST['gtype']);
 
-            echo "<img src='" . $CFG_GLPI['root_doc'] . "'/plugins/mreporting/pics/chart-$gtype.png' class='title_pics' />";
+            echo "<img src='/plugins/mreporting/pics/chart-$gtype.png' class='title_pics' />";
             echo htmlspecialchars($options['title']);
             echo '</div>';
 
diff --git a/inc/graphpng.class.php b/inc/graphpng.class.php
index 8e75dd65..f07c3e4d 100644
--- a/inc/graphpng.class.php
+++ b/inc/graphpng.class.php
@@ -86,7 +86,7 @@ public function initGraph($options)
                 echo '</div>';
             }
             echo "<div class='graph_title'>";
-            echo "<img src='" . $CFG_GLPI['root_doc'] . "'/plugins/mreporting/pics/chart-" . htmlspecialchars($prev_function) . ".png' class='title_pics' />";
+            echo "<img src='/plugins/mreporting/pics/chart-" . htmlspecialchars($prev_function) . ".png' class='title_pics' />";
             echo htmlspecialchars($options['title']);
             echo '</div>';
 

From 4030ec289379fe5e8d52d44b32e8717d74d42c77 Mon Sep 17 00:00:00 2001
From: Stanislas Kita <skita@teclib.com>
Date: Tue, 14 Oct 2025 11:17:03 +0200
Subject: [PATCH 09/13] fix another category

---
 inc/helpdesk.class.php | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/inc/helpdesk.class.php b/inc/helpdesk.class.php
index 19ab99c5..59904b0a 100644
--- a/inc/helpdesk.class.php
+++ b/inc/helpdesk.class.php
@@ -88,7 +88,7 @@ public function reportHbarTicketNumberByEntity($config = [])
         $result = $DB->request($query);
 
         foreach ($result as $ticket) {
-            $label = empty($ticket['name']) ? __s('Root entity') : $ticket['name'];
+            $label = empty($ticket['name']) ? __s('Root entity') : htmlspecialchars($ticket['name']);
             $datas['datas'][$label] = $ticket['count'];
         }
 
@@ -142,9 +142,18 @@ public function reportHgbarTicketNumberByCatAndEntity($config = [])
             if (empty($data['category'])) {
                 $data['category'] = __s('None');
             }
+
+            $data['category'] = str_replace(
+                ["'", '"'],
+                ["\'", "&quot;"],
+                $data['category'],
+            );
+
             $categories[$data['category']] = $data['itilcategories_id'];
         }
 
+
+
         $labels2 = array_keys($categories);
 
         $tmp_cat = [];

From 78f55396b43e87847f41ea4172411460b8c54bd6 Mon Sep 17 00:00:00 2001
From: Stanislas Kita <skita@teclib.com>
Date: Tue, 14 Oct 2025 11:19:29 +0200
Subject: [PATCH 10/13] another

---
 inc/helpdesk.class.php | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/inc/helpdesk.class.php b/inc/helpdesk.class.php
index 59904b0a..748ee344 100644
--- a/inc/helpdesk.class.php
+++ b/inc/helpdesk.class.php
@@ -617,6 +617,12 @@ public function reportHgbarOpenedTicketNumberByCategory($config = [])
         foreach ($result as $ticket) {
             if (empty($ticket['category_name'])) {
                 $ticket['category_name'] = __s('None');
+            } else {
+                $ticket['category_name'] = str_replace(
+                    ["'", '"'],
+                    ["\'", "&quot;"],
+                    $ticket['category_name'],
+                );
             }
 
             if (!isset($datas['datas'][$ticket['category_name']])) {
@@ -627,6 +633,8 @@ public function reportHgbarOpenedTicketNumberByCategory($config = [])
                 }
             }
 
+
+
             $datas['datas'][$ticket['category_name']][$status[$ticket['status']]] = $ticket['count'];
         }
 

From 957d0035815968863868ed64c6a98eec10fc695d Mon Sep 17 00:00:00 2001
From: Stanislas <skita@teclib.com>
Date: Tue, 14 Oct 2025 13:20:49 +0200
Subject: [PATCH 11/13] Apply suggestion from @Rom1-B

Co-authored-by: Romain B. <8530352+Rom1-B@users.noreply.github.com>
---
 inc/graph.class.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/inc/graph.class.php b/inc/graph.class.php
index b82fd55b..fd23158d 100644
--- a/inc/graph.class.php
+++ b/inc/graph.class.php
@@ -60,7 +60,7 @@ public function initGraph($options)
             echo "<div class='graph_title'>";
             $gtype = htmlspecialchars($_REQUEST['gtype']);
 
-            echo "<img src='/plugins/mreporting/pics/chart-$gtype.png' class='title_pics' />";
+            echo "<img src='" . $CFG_GLPI['root_doc'] . "'/plugins/mreporting/pics/chart-$gtype.png' class='title_pics' />";
             echo htmlspecialchars($options['title']);
             echo '</div>';
 

From 82959ae8d6d0a48170eca96fa55289df53f44200 Mon Sep 17 00:00:00 2001
From: Stanislas <skita@teclib.com>
Date: Tue, 14 Oct 2025 13:20:54 +0200
Subject: [PATCH 12/13] Apply suggestion from @Rom1-B

Co-authored-by: Romain B. <8530352+Rom1-B@users.noreply.github.com>
---
 inc/graphpng.class.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/inc/graphpng.class.php b/inc/graphpng.class.php
index f07c3e4d..8e75dd65 100644
--- a/inc/graphpng.class.php
+++ b/inc/graphpng.class.php
@@ -86,7 +86,7 @@ public function initGraph($options)
                 echo '</div>';
             }
             echo "<div class='graph_title'>";
-            echo "<img src='/plugins/mreporting/pics/chart-" . htmlspecialchars($prev_function) . ".png' class='title_pics' />";
+            echo "<img src='" . $CFG_GLPI['root_doc'] . "'/plugins/mreporting/pics/chart-" . htmlspecialchars($prev_function) . ".png' class='title_pics' />";
             echo htmlspecialchars($options['title']);
             echo '</div>';
 

From ff3858dea40415dc65965adf24cba508d87bc8fb Mon Sep 17 00:00:00 2001
From: Stanislas Kita <skita@teclib.com>
Date: Tue, 14 Oct 2025 14:00:42 +0200
Subject: [PATCH 13/13] fix pics

---
 inc/graph.class.php    | 2 +-
 inc/graphpng.class.php | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/inc/graph.class.php b/inc/graph.class.php
index fd23158d..43b269ad 100644
--- a/inc/graph.class.php
+++ b/inc/graph.class.php
@@ -60,7 +60,7 @@ public function initGraph($options)
             echo "<div class='graph_title'>";
             $gtype = htmlspecialchars($_REQUEST['gtype']);
 
-            echo "<img src='" . $CFG_GLPI['root_doc'] . "'/plugins/mreporting/pics/chart-$gtype.png' class='title_pics' />";
+            echo "<img src='" . $CFG_GLPI['root_doc'] . "/plugins/mreporting/pics/chart-$gtype.png' class='title_pics' />";
             echo htmlspecialchars($options['title']);
             echo '</div>';
 
diff --git a/inc/graphpng.class.php b/inc/graphpng.class.php
index 8e75dd65..96bff60d 100644
--- a/inc/graphpng.class.php
+++ b/inc/graphpng.class.php
@@ -86,7 +86,7 @@ public function initGraph($options)
                 echo '</div>';
             }
             echo "<div class='graph_title'>";
-            echo "<img src='" . $CFG_GLPI['root_doc'] . "'/plugins/mreporting/pics/chart-" . htmlspecialchars($prev_function) . ".png' class='title_pics' />";
+            echo "<img src='" . $CFG_GLPI['root_doc'] . "/plugins/mreporting/pics/chart-" . htmlspecialchars($prev_function) . ".png' class='title_pics' />";
             echo htmlspecialchars($options['title']);
             echo '</div>';