Language: PHP
Label: vulnerable
CWE: CWE-269 \u2014 Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Code:
    public static function preItem(CommonDBTM $item)
    {
        //find container (if not exist, do nothing)
        if (isset($_REQUEST['c_id'])) {
            $c_id = $_REQUEST['c_id'];
        } else {
            $type = 'dom';
            if (isset($_REQUEST['_plugin_fields_type'])) {
                $type = $_REQUEST['_plugin_fields_type'];
            }
            $subtype = '';
            if ($type == 'domtab') {
                $subtype = $_REQUEST['_plugin_fields_subtype'];
            }
            if (false === ($c_id = self::findContainer(get_Class($item), $type, $subtype))) {
                // tries for 'tab'
                if (false === ($c_id = self::findContainer(get_Class($item)))) {
                    return false;
                }
            }
        }

        //need to check if container is usable on this object entity
        $loc_c = new PluginFieldsContainer();
        $loc_c->getFromDB($c_id);
        $entities = [$loc_c->fields['entities_id']];
        if ($loc_c->fields['is_recursive']) {
            $entities = getSonsOf(getTableForItemType('Entity'), $loc_c->fields['entities_id']);
        }

        //workaround: when a ticket is created from readdonly profile,
        //it is not initialized; see https://github.com/glpi-project/glpi/issues/1438
        if (!isset($item->fields) || count($item->fields) == 0) {
            $item->fields = $item->input;
        }

        if ($item->isEntityAssign() && !in_array($item->getEntityID(), $entities)) {
            return false;
        }

        if (false !== ($data = self::populateData($c_id, $item))) {
            if (self::validateValues($data, $item::getType(), isset($_REQUEST['massiveaction'])) === false) {
                return $item->input = [];
            }
            return $item->plugin_fields_data = $data;
        }

        return;
    }