Fix(Core): Add entities_id and is_recursive fields to correctly filter data from the API

inc/abstractcontainerinstance.class.php

@@ -30,6 +30,69 @@
 
 abstract class PluginFieldsAbstractContainerInstance extends CommonDBTM
 {
+
+    /**
+     * Checks if the HTTP request targets an object with an ID.
+     *
+     * This function determines whether the path contains an ID as the last segment
+     * (i.e., a number after the final '/').
+     *
+     * @param string $path The HTTP request path (e.g., $_SERVER['PATH_INFO']).
+     * @return mixed Returns ID if is present in the path, null otherwise.
+     */
+    public static function hasRequestedObjectId(string $path): ?int
+    {
+        if (preg_match('#/(\d+)$#', $path, $matches)) {
+            return (int)$matches[1];
+        }
+        return null;
+    }
+
+    public static function canView()
+    {
+        $want_all =  self::hasRequestedObjectId($_SERVER['PATH_INFO']);
+        if (isAPI() && ($want_all == null)) {
+            return false;
+        }
+
+        return parent::canView();
+    }
+
+    public function canViewItem()
+    {
+        //check if current user have access to the main item entity
+        $item = new $this->fields['itemtype']();
+        $item->getFromDB($this->fields['items_id']);
+        if (!Session::haveAccessToEntity($item->getEntityID(), $item->isRecursive())) {
+            return false;
+        }
+        $right = PluginFieldsProfile::getRightOnContainer($_SESSION['glpiactiveprofile']['id'], $this->fields['plugin_fields_containers_id']);
+        if ($right < READ) {
+            return false;
+        }
+        return true;
+    }
+
+    public function canUpdateItem()
+    {
+        //check if current user have access to the main item entity
+        $item = new $this->fields['itemtype']();
+        $item->getFromDB($this->fields['items_id']);
+        if (!Session::haveAccessToEntity($item->getEntityID(), $item->isRecursive())) {
+            return false;
+        }
+        $right = PluginFieldsProfile::getRightOnContainer($_SESSION['glpiactiveprofile']['id'], $this->fields['plugin_fields_containers_id']);
+        if ($right > READ) {
+            return true;
+        }
+        return false;
+    }
+
+    public function canPurgeItem()
+    {
+        return false;
+    }
+
     public static function getSpecificValueToSelect($field, $name = '', $values = '', array $options = [])
     {
         if (!is_array($values)) {