[Lainow]

The escalation form (front/escalation.form.php) and its modal (ajax/escalation_form.php) only checked canAssign(), a global profile right: a user allowed to assign items in one entity could escalate any ticket, change or problem of another entity by its id. The comment was then added to its timeline, its assigned groups replaced and, depending on the configuration, its technicians removed and its status changed.

Escalation also relied on the generic CommonDBTM rights with $rightname = 'ticket'. Its table has no entities_id, so through the legacy API any user with the ticket right could create escalations on items of any entity (even where escalation is disabled), list every escalation (private ones included), and edit or delete them. As the table has is_private and users_id, CommonDBTM::can() also granted every right, creation included, to the author of a private escalation.

Changes

• Escalation::canEscalate(): escalation enabled for the item entity, item visible to the user (can($id, READ), which checks its entity) and assignable. Used by the form, the modal, the "Escalate" button and canCreateItem().
• The form goes through Escalation::check(-1, CREATE), the same check as the API.
• Escalations cannot be read, edited nor deleted on their own (canView()/canUpdate()/canDelete()/canPurge() are false, as for Group_Link): they are only shown in the timeline of their item, which reads them directly. canViewItem() still tells whether the item, and the private followups for a private one, can be seen.
• maybePrivate() is false: is_private means internal, not personal.
• prepareInputForAdd() refuses items of entities where escalation is not enabled. The rights of the user are deliberately not checked there: business rules (EscalationRule) escalate items whatever the user who triggers them, e.g. the mail collector.

Tests

New tests in EscalationTest, for tickets, changes and problems:

• an item of an entity the user has no access to cannot be escalated, even with the "private escalation" input;
• an item of an entity where escalation is not enabled cannot be escalated;
• an escalation cannot be read, edited nor deleted on its own, even by its author.

[stonebuzz]

canViewItem() is never reached in production: canView() returns false so can($id, READ) short-circuits, and the timeline uses getEscalationsOf(), which duplicates the private rule (SEEPRIVATE) on its own.
Only the tests call it, so the two privacy rules can drift; either drop it or make it the single source of the rule.

[Lainow]

Done, i've deleted canViewItem()