[RomainLvr]

Checklist before requesting a review

• I have performed a self-review of my code.
• I have added tests (when available) that prove my fix is effective or that my feature works.
• I have updated the CHANGELOG with a short functional description of the fix or new feature.
• This change requires a documentation update.

Description

• It fixes !47472
• Here is a brief description of what this PR does

When a Data Injection model maps a column to an additional field (e.g. Entity - My block), saving the mapping makes the model inaccessible: it disappears from the models list and opening it shows:

You don't have permission to perform this action.

The injection itself would fail for the same reason.

Since #1299, PluginFieldsAbstractContainerInstance::canCreate() / canUpdate() always return false. The generated ...Injection class inherits them. Data Injection (2.15.12) now checks canCreate() / canUpdate() on every itemtype mapped in a model (PluginDatainjectionModel::checkRightOnModel()) and before writing, so any model using an additional field is rejected.

Fix

The generated injection class (templates/injection.class.tpl) overrides canCreate() / canUpdate() with the same rules as the item form:

• update right on the parent itemtype;
• write right of the active profile on the container (PluginFieldsProfile);
• the update right on the targeted item (including its entity) is still checked by CommonDBChild.

The container instance classes keep denying any direct write, so #1299 is not weakened. Generated files are regenerated on plugin update.

Tests

• ContainerItemRightTest::testInjectionClassFollowsParentItemtypeUpdateRight: rights are granted to an admin, denied when the container is read-only for the profile, and denied to a post-only user. The Data Injection interface is stubbed (tests/fixtures/datainjection_stubs.php) when the plugin is absent, so the test always runs.