Fix - getEntitiesRestrictCriteria() returns invalid SQL criterion when no session is active

src/DbUtils.php

@@ -52,7 +52,7 @@
  *
  * @since 9.2
  */
-final class DbUtils
+class DbUtils
 {
     /**
      * Return foreign key field name for a table
@@ -890,6 +890,16 @@ public function getEntitiesRestrictRequest(
         return $query;
     }
 
+    /**
+     * Check whether the current execution context is privileged (CLI or cron).
+     *
+     * @return bool
+     */
+    protected function isPrivilegedContext(): bool
+    {
+        return isCommandLine() || Session::isCron();
+    }
+
     /**
      * Get criteria to restrict to current entities of the user
      *
@@ -942,8 +952,12 @@ public function getEntitiesRestrictCriteria(
                 $value = $_SESSION['glpiactiveentities'];
             } elseif (Session::isRightChecksDisabled()) {
                 return [new QueryExpression('true')];
-            } elseif (isCommandLine() || Session::isCron()) {
+            } elseif ($this->isPrivilegedContext()) {
                 $value = '0'; // If value is not set, fallback to root entity in cron / command line
+            } else {
+                // No active session and no privileged context: deny all access to prevent
+                // invalid SQL criterion (entities_id = '' on integer column → MySQL warning 1292).
+                return [new QueryExpression('false')];
             }
         }
 

tests/functional/DbUtilsTest.php

@@ -902,6 +902,29 @@ public function testGetEntityRestrict()
         );
     }
 
+    public function testGetEntitiesRestrictCriteriaWithNoSession()
+    {
+        // Use a subclass that overrides isPrivilegedContext() to simulate a
+        // non-CLI, non-cron context (unreachable in PHPUnit because PHP_SAPI === 'cli').
+        $instance = new class extends \DbUtils {
+            protected function isPrivilegedContext(): bool
+            {
+                return false;
+            }
+        };
+
+        // Ensure no active session entities and no right-check bypass.
+        unset($_SESSION['glpiactiveentities']);
+        unset($_SESSION['glpishowallentities']);
+
+        $criteria = $instance->getEntitiesRestrictCriteria('glpi_computers');
+
+        $this->assertCount(1, $criteria);
+        $this->assertArrayHasKey(0, $criteria);
+        $this->assertInstanceOf(QueryExpression::class, $criteria[0]);
+        $this->assertSame('false', (string) $criteria[0]);
+    }
+
     /**
      * Run getAncestorsOf tests
      *