GLPI 11 : customs assets, it's possible to update a read-only field

[flegastelois]

Code of Conduct

• I agree to follow this project's Code of Conduct

Is there an existing issue for this?

• I have searched the existing issues

Version

11.0/bugfixes

Bug description

I set a field to read-only in my asset definition.

In the interface, I can select the field, but the input is disabled.

However, by modifying the DOM (by removing readonly=""), the field becomes editable again, and saving the form correctly records the change.

Value changed:

[cconard96]

I seem to recall a discussion about this (maybe I was just thinking about it to myself) and this isn't really different from the way ticket templates are handled. The feature only exists on the UI side. You can set a field readonly in a ticket template, start creating a new ticket, manually change the hidden input of the readonly field, and then submit the ticket seeing the change takes effect. This is the same reason the API bypasses ticket templates (#15225).

It isn't a replacement for true per-field profile permissions.