[stonebuzz]

Checklist before requesting a review

Please delete options that are not relevant.

• I have performed a self-review of my code.
• I have added tests (when available) that prove my fix is effective or that my feature works.
• I have updated the CHANGELOG with a short functional description of the fix or new feature.
• This change requires a documentation update.

Description

• It fixes !47495
• Mapping a CSV column to an additional field (Fields plugin) made the model inaccessible, even for a super admin, and the Fields values were rejected during injection.
• Since Fields 1.24.7, its container classes always refuse direct creation and update, which datainjection used to check on every mapped itemtype.
• Fields containers now follow the Fields rule instead: the parent item rights are checked as before, and the active profile must have more than read access on the container.
• The CSRF error reported alongside is only a side effect of submitting the form again after the access denied page.

User ID: `XXXXX` tried to execute an invalid request on `/plugins/datainjection/front/model.form.php?id=2`. Backtrace : ./src/CommonGLPI.php:1287 .../plugins/datainjection/front/model.form.php:116 CommonGLPI->display() ...Glpi/Controller/LegacyFileLoadController.php:64 require() ./vendor/symfony/http-kernel/HttpKernel.php:181 Glpi\Controller\LegacyFileLoadController->__invoke() ./vendor/symfony/http-kernel/HttpKernel.php:76 Symfony\Component\HttpKernel\HttpKernel->handleRaw() ./vendor/symfony/http-kernel/Kernel.php:208 Symfony\Component\HttpKernel\HttpKernel->handle() ./src/Glpi/Kernel/Kernel.php:201 Symfony\Component\HttpKernel\Kernel->handle() ./public/index.php:78 Glpi\Kernel\Kernel->handle()
[XXXXX@hostname] CSRF check failed for User ID: XXXXX at /plugins/datainjection/front/mapping.form.php

Screenshots (if appropriate):